I found this while auditing serendipty blog. You need a blog account ( 
which isnt that big of deal just google all the sites that give out free 
blogs ) for this to work. After you get hte blog account you go into 
your admin panel where there will be config options. The mysql details 
are editable from this form. Since these details are what connects to 
the database they cant be stored in it. For this reason
they are stored in a config .php file.
They way this is done isthrough unfiltered fwrites() to the file so for 
example my "tableprefix" was tgo_ and the code in the config file looked 
liked:
CODEWHATEVER_THE_VAR_WAS='tgo_';
Soas we can see here we have some room for fun. MY poc on my 
friendsserver was to make my table prefix ( there cant be any spaces )
CODEtgo_';phpinfo();echo'hi
Which makes the file look like:
CODE
WHATEVER_THE_VAR_WAS='tgo';phpinfo();echo'hi';
As expected my blog got defaced with the servers phpinfo(). Other fun 
things would be like
CODE
tgo';system
Thefile this gets wrote to gets included on every page for YOUR blog 
sofor instace my blog is blogs.site.com/tgo then this file will 
beincluded in all those allowing me to put ?cmd= on all of them

vuln by moep , moep2mail[at]mail[dot]ru