CVE-2008-7059

This exploit demonstrates XSS, HTML injection, and SQL injection vulnerabilities in OneNews Beta 2. The XSS and HTML injection can be triggered in both authenticated (add.php) and unauthenticated (index.php) contexts, while the SQL injection requires MAGIC_QUOTES to be off.

The exploit demonstrates an SQL injection vulnerability in One-News Beta 2 by injecting a malicious query into the 'q' parameter. The payload uses a UNION-based SQLi to extract data from the database.